POSTデータのサニタイズ

README を更新

ClickpostNumber.class.php

@@ -58,7 +58,7 @@ public function save_data(){
 
 			$usces->stripslashes_deep_post($_POST);
 			self::$opts['activate_flag'] = isset($_POST['cp_activate_flag']) ? (int)$_POST['cp_activate_flag'] : 0;
-            self::$opts['name_code'] = isset($_POST['cp_name_code']) ? trim($_POST['cp_name_code']) : '';
+            self::$opts['name_code'] = isset($_POST['cp_name_code']) ? sanitize_text_field($_POST['cp_name_code']) : '';
 
 			$options = get_option('usces_ex');
 			$options['system']['clickpostcsv'] = self::$opts;

readme.txt

@@ -0,0 +1,58 @@
+=== CSV Export for Click Post ===
+Contributors: hatchbitco
+Donate link: https://www.hatchbit.jp/
+Tags: e-commerce, export
+Requires at least: 5.3.2
+Tested up to: 5.3.2
+Stable tag: 5.3.2
+Requires PHP: 7.1.2
+License: MIT
+License URI: https://opensource.org/licenses/mit-license.php
+
+== Description ==
+
+"CSV Export for Click Post" is a Welcart-only extension plug-in and is intended for use in Japan only.
+
+Provides CSV file output function for click post.
+
+
+== Installation ==
+
+1. Upload the plugin files to the `/wp-content/plugins/welcart_csv4clickpost` directory, or install the plugin through the WordPress plugins screen directly.
+2. Activate the plugin through the 'Plugins' screen in WordPress
+3. Use the Settings->Welcart Shop->システム設定->拡張機能 screen to configure the plugin
+
+== Frequently Asked Questions ==
+
+= CSV file is garbled =
+
+The encoding of the CSV file is Shift JIS.
+
+= CSV file is empty =
+
+Check the checkbox of the target order information.
+
+
+== Screenshots ==
+
+1. screenshot-1.png
+
+
+== Changelog ==
+
+= 1.1.1 =
+* Renewed README.
+
+= 1.1.0 =
+* Remove unnecessary functions.
+
+= 1.0.2 =
+* Supports file format errors.
+
+= 1.0.1 =
+* Initial version.
+
+== Upgrade Notice ==
+
+= 1.1.1 =
+This version fixes a security related bug.  Upgrade immediately.

readme_ja.txt

@@ -38,6 +38,9 @@ CSV Export for Click Post は Welcart専用の拡張プラグインで、日本
 ==============
 更新履歴
 ==============
+v1.1.1 2020/02/14
+　・READMEを更新
+
 v1.1.0 2020/01/28
 　・不要な関数を削除