v5.4.3

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02)
+
+
+### Security
+
+* **API:** Fixed proper filtering for OData variables to close a report from Patchstack. ([29ed776](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/29ed776df86d8ea81f5cc450c8d7348b21474d80))
+
 ### [5.4.2](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.0...v5.4.2) (2026-04-30)
 
 

PLUGIN-CHECKSUM

@@ -1 +1 @@
-7728161a3a97dd741671f333b181ab1d
+e0c928c4d26838ef036a5067b4f081b4

class/class-eduadmin-loginhandler.php

@@ -25,7 +25,7 @@ public function process_login() {
 
 				$possible_persons = EDUAPI()->OData->Persons->Search(
 					'PersonId',
-					"CanLogin and $login_field eq '" . sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) . '\'', // Input var okay.
+					"CanLogin and $login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) ), // Input var okay.
 					'CustomFields($filter=ShowOnWeb;)',
 					null,
 					null,

content/template/bookingTemplate/-login-handler.php

@@ -9,7 +9,7 @@
 
 		$possible_persons = EDUAPI()->OData->Persons->Search(
 			null,
-			"$login_field eq '" . sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) . '\'', // Input var okay.
+			"$login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) ), // Input var okay.
 			'CustomFields($filter=ShowOnWeb;)'
 		)['value'];
 

content/template/myPagesTemplate/bookings.php

@@ -37,8 +37,8 @@
 
 	$events = EDUAPI()->OData->Events->Search(
 		'EventId,EventName,CourseName,InternalCourseName,OnDemand,StartDate,EndDate',
-		'Bookings/any(b:b/Customer/CustomerId eq ' . $customer->CustomerId . ') and StatusId eq 1',
-		'Bookings($expand=Participants($select=FirstName,LastName,Arrived,GradeName,Canceled,PriceNameId),UnnamedParticipants($select=PriceNameId,Quantity,Canceled);$filter=Customer/CustomerId eq ' . $customer->CustomerId . ' and NumberOfParticipants gt 0;$select=BookingId,Created,NumberOfParticipants,TotalPriceIncVat,TotalPriceExVat)'
+		'Bookings/any(b:b/Customer/CustomerId eq ' . intval( $customer->CustomerId ) . ') and StatusId eq 1',
+		'Bookings($expand=Participants($select=FirstName,LastName,Arrived,GradeName,Canceled,PriceNameId),UnnamedParticipants($select=PriceNameId,Quantity,Canceled);$filter=Customer/CustomerId eq ' . intval( $customer->CustomerId ) . ' and NumberOfParticipants gt 0;$select=BookingId,Created,NumberOfParticipants,TotalPriceIncVat,TotalPriceExVat)'
 	);
 
 	$bookings = array();

content/template/myPagesTemplate/certificates.php

@@ -10,7 +10,7 @@
 if ( $show_company_certificates ) {
 	$certificates = EDUAPI()->OData->Persons->Search(
 		'PersonId,FirstName,LastName,CivicRegistrationNumber',
-		'CustomerId eq ' . $customer->CustomerId,
+		'CustomerId eq ' . intval( $customer->CustomerId ),
 		'Certificates'
 	)["value"];
 } else {

content/template/myPagesTemplate/login-tab-header.php

@@ -15,7 +15,7 @@
 if ( $show_company_certificates ) {
 	$certificates = EDUAPI()->OData->Persons->Search(
 		'PersonId,FirstName,LastName,CivicRegistrationNumber',
-		'CustomerId eq ' . $customer->CustomerId,
+		'CustomerId eq ' . intval( $customer->CustomerId ),
 		'Certificates'
 	)["value"];
 } else {

eduadmin.php

@@ -9,7 +9,7 @@
  * Plugin URI:	https://www.eduadmin.com
  * Description:	EduAdmin plugin to allow visitors to book courses at your website
  * Tags:	booking, participants, courses, events, eduadmin
- * Version:	5.4.2
+ * Version:	5.4.3
  * GitHub Plugin URI: multinetinteractive/eduadmin-wordpress
  * GitHub Plugin URI: https://github.com/multinetinteractive/eduadmin-wordpress
  * Requires at least: 6.0

includes/edu-ajax-functions.php

@@ -43,17 +43,17 @@ function edu_listview_courselist() {
 	}
 
 	if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-		$filters[] = 'CategoryId eq ' . $category_id;
+		$filters[] = 'CategoryId eq ' . intval( $category_id );
 	} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-		$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+		$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 	}
 
 	if ( ! empty( $_POST['city'] ) && is_numeric( $_POST['city'] ) ) {
 		$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $_POST['city'] ) . ')';
 	}
 
 	if ( ! empty( $_POST['subject'] ) ) {
-		$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $_POST['subject'] ) . '\')';
+		$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['subject'] ) ) ) . ')';
 	}
 
 	if ( ! empty( $_POST['subjectid'] ) ) {

includes/edu-login-functions.php

@@ -7,7 +7,7 @@ function edu_send_forgotten_password( $login_value ) {
 
 	$cc = EDUAPI()->OData->Persons->Search(
 		null,
-		"$login_field eq '" . sanitize_text_field( $login_value ) . '\' and CanLogin',
+		"$login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $login_value ) ) ) . ' and CanLogin',
 		null,
 		null,
 		null,

includes/edu-shortcodes.php

@@ -871,7 +871,7 @@ function eduadmin_get_programme_list( $attributes ) {
 	$programmes = EDUAPI()->OData->Programmes->Search(
 		null,
 		'ShowOnWeb' .
-		( ! empty( $attributes['category'] ) ? ' and CategoryId eq ' . $attributes['category'] : '' ),
+		( ! empty( $attributes['category'] ) ? ' and CategoryId eq ' . intval( $attributes['category'] ) : '' ),
 		'ProgrammeStarts(' .
 		'$filter=' .
 		'HasPublicPriceName' .

includes/eduapi-helper-functions.php

@@ -196,26 +196,26 @@ public function GetCourseList( $attributes, $category_id, $city, $subjectid, $co
 		$filters[] = 'OnDemand eq false';
 
 		if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'CategoryId eq ' . $category_id;
+			$filters[] = 'CategoryId eq ' . intval( $category_id );
 		} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+			$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 		}
 
 		if ( ! empty( $city ) ) {
 			$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $city ) . ')';
 		}
 
 		if ( isset( $attributes['subject'] ) && ! empty( $attributes['subject'] ) ) {
-			$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $attributes['subject'] ) . '\')';
+			$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $attributes['subject'] ) ) ) . ')';
 		}
 
 		if ( ! empty( $subjectid ) ) {
-			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . $subjectid . ')';
+			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . intval( $subjectid ) . ')';
 			$attributes['subjectid'] = $subjectid;
 		}
 
 		if ( ! empty( $courselevel ) ) {
-			$filters[] = 'CourseLevelId eq ' . $courselevel;
+			$filters[] = 'CourseLevelId eq ' . intval( $courselevel );
 		}
 
 		$sort_order = EDU()->get_option( 'eduadmin-listSortOrder', 'SortIndex' );
@@ -311,26 +311,26 @@ public function GetOnDemandCourseList( $attributes, $category_id, $city, $subjec
 		$filters[] = 'OnDemand eq true';
 
 		if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'CategoryId eq ' . $category_id;
+			$filters[] = 'CategoryId eq ' . intval( $category_id );
 		} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+			$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 		}
 
 		if ( ! empty( $city ) ) {
 			$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $city ) . ')';
 		}
 
 		if ( isset( $attributes['subject'] ) && ! empty( $attributes['subject'] ) ) {
-			$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $attributes['subject'] ) . '\')';
+			$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $attributes['subject'] ) ) ) . ')';
 		}
 
 		if ( ! empty( $subjectid ) ) {
-			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . $subjectid . ')';
+			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . intval( $subjectid ) . ')';
 			$attributes['subjectid'] = $subjectid;
 		}
 
 		if ( ! empty( $courselevel ) ) {
-			$filters[] = 'CourseLevelId eq ' . $courselevel;
+			$filters[] = 'CourseLevelId eq ' . intval( $courselevel );
 		}
 
 		$sort_order = EDU()->get_option( 'eduadmin-listSortOrder', 'SortIndex' );
@@ -424,26 +424,26 @@ public function GetEventList( $attributes, $category_id, $city, $subjectid, $cou
 		$filters[] = 'ShowOnWeb';
 
 		if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'CategoryId eq ' . $category_id;
+			$filters[] = 'CategoryId eq ' . intval( $category_id );
 		} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+			$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 		}
 
 		if ( ! empty( $city ) ) {
 			$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $city ) . ')';
 		}
 
 		if ( isset( $attributes['subject'] ) && ! empty( $attributes['subject'] ) ) {
-			$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $attributes['subject'] ) . '\')';
+			$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $attributes['subject'] ) ) ) . ')';
 		}
 
 		if ( ! empty( $subjectid ) ) {
-			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . $subjectid . ')';
-			$attributes['subjectid'] = $subjectid;
+			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . intval( $subjectid ) . ')';
+			$attributes['subjectid'] = intval( $subjectid );
 		}
 
 		if ( ! empty( $courselevel ) ) {
-			$filters[] = 'CourseLevelId eq ' . $courselevel;
+			$filters[] = 'CourseLevelId eq ' . intval( $courselevel );
 		}
 
 		$order_by     = array();
@@ -539,26 +539,26 @@ public function GetOnDemandEventList( $attributes, $category_id, $city, $subject
 		$filters[] = 'OnDemand';
 
 		if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'CategoryId eq ' . $category_id;
+			$filters[] = 'CategoryId eq ' . intval( $category_id );
 		} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-			$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+			$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 		}
 
 		if ( ! empty( $city ) ) {
 			$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $city ) . ')';
 		}
 
 		if ( isset( $attributes['subject'] ) && ! empty( $attributes['subject'] ) ) {
-			$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $attributes['subject'] ) . '\')';
+			$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $attributes['subject'] ) ) ) . ')';
 		}
 
 		if ( ! empty( $subjectid ) ) {
-			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . $subjectid . ')';
-			$attributes['subjectid'] = $subjectid;
+			$filters[]               = 'Subjects/any(s:s/SubjectId eq ' . intval( $subjectid ) . ')';
+			$attributes['subjectid'] = intval( $subjectid );
 		}
 
 		if ( ! empty( $courselevel ) ) {
-			$filters[] = 'CourseLevelId eq ' . $courselevel;
+			$filters[] = 'CourseLevelId eq ' . intval( $courselevel );
 		}
 
 		$order_by     = array();

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "eduadmin-wordpress-plugin",
 	"private": true,
-	"version": "5.4.2",
+	"version": "5.4.3",
 	"repository": "https://github.com/MultinetInteractive/EduAdmin-WordPress.git",
 	"author": "Chris Gårdenberg <chga@multinet.se>",
 	"license": "MIT",

readme.md

@@ -1,7 +1,7 @@
 # EduAdmin Booking
 - Requires at least: 6.0
 - Tested up to: 7.0
-- Stable tag: 5.4.2
+- Stable tag: 5.4.3
 - Requires PHP: 8.1
 - License: GPL3
 - License URI: https://www.gnu.org/licenses/gpl-3.0.en.html
@@ -44,6 +44,13 @@ If you notice that your API key doesn't work any more, you have to contact us.
 
 The full changelog available on [GitHub](https://github.com/MultinetInteractive/EduAdmin-WordPress/blob/production/CHANGELOG.md)
 
+### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02)
+
+
+#### Security
+
+* **API:** Fixed proper filtering for OData variables to close a report from Patchstack. ([29ed776](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/29ed776df86d8ea81f5cc450c8d7348b21474d80))
+
 ### [5.4.2](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.0...v5.4.2) (2026-04-30)
 
 
@@ -75,12 +82,5 @@ The full changelog available on [GitHub](https://github.com/MultinetInteractive/
 
 * Remove ondemand-attribute from detailinfo ([dfa3f59](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/dfa3f59c5bea11c8da99d5067e415d6859475a34))
 
-### [5.3.1](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.3.0...v5.3.1) (2024-11-05)
-
-
-#### Bug Fixes
-
-* Set health-check as blocking, so we get an actual result, increase timeout to 0.5 seconds ([7e4bd4e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/7e4bd4e7ece1efe0bd7e99ecc5b0ada8f7422957))
-
 
 

readme.txt

@@ -3,7 +3,7 @@ Contributors: mnchga
 Tags: booking, participants, courses, events, eduadmin
 Requires at least: 6.0
 Tested up to: 7.0
-Stable tag: 5.4.2
+Stable tag: 5.4.3
 Requires PHP: 8.1
 License: GPL3
 License URI: https://www.gnu.org/licenses/gpl-3.0.en.html
@@ -49,6 +49,13 @@ If you notice that your API key doesn't work any more, you have to contact us.
 
 The full changelog available on [GitHub](https://github.com/MultinetInteractive/EduAdmin-WordPress/blob/production/CHANGELOG.md)
 
+### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02)
+
+
+#### Security
+
+* **API:** Fixed proper filtering for OData variables to close a report from Patchstack. ([29ed776](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/29ed776df86d8ea81f5cc450c8d7348b21474d80))
+
 ### [5.4.2](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.0...v5.4.2) (2026-04-30)
 
 
@@ -80,12 +87,5 @@ The full changelog available on [GitHub](https://github.com/MultinetInteractive/
 
 * Remove ondemand-attribute from detailinfo ([dfa3f59](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/dfa3f59c5bea11c8da99d5067e415d6859475a34))
 
-### [5.3.1](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.3.0...v5.3.1) (2024-11-05)
-
-
-#### Bug Fixes
-
-* Set health-check as blocking, so we get an actual result, increase timeout to 0.5 seconds ([7e4bd4e](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/7e4bd4e7ece1efe0bd7e99ecc5b0ada8f7422957))
-