Gravity Forms v1.9.4 is now available via automatic update and the customer downloads page. This is a maintenance and security release and we recommend users update as soon as possible.
This release includes a fix for a blind SQL injection vulnerability similar to the issue recently fixed in other popular WordPress plugins such as WPSEO, WooCommerce, and PODS. The scope of this vulnerability was limited to functionality within the Gravity Forms admin by a user within sufficient privileges to view and edit forms within the WordPress Dashboard. By default this vulnerability could only be exploited by a WordPress user with admin privileges to your site and could not be exploited anonymously from the frontend.
Security is extremely important, which is why we preach always keeping WordPress up to date. It is also why we are utilizing security service Acunetix to scan for potential vulnerabilities directly within our source control system so that any potential issues can be found and corrected immediately.
We recommend users enable background automatic updates within the Gravity Forms Settings so that updates such as this may be applied automatically.
What's New in Gravity Forms v1.9.4
- Added 2 new ready classes: gf_simple_horizontal and gf_section_right.
- Added logging for $phpmailer->ErrorInfo.
- Updated the Number field to include the thousands separator when returning a validation failure if the input type is 'text'. Some browsers do not allow commas when using the HTML5 'number' input type.
- Updated number formatting to include the thousands separator on the entry list and detail pages and when merge tags are processed. The :value modifier will return the value without the thousand separator.
- Fixed security issue in the import process of legacy forms on some systems.
- Fixed an issue with GFCommon::format_number using the currency defined on the Forms > Settings page instead of the currency used with the entry which resulted in the number being incorrectly formatted when using the third-party Gravity Forms Multi Currency add-on.
- Fixed an issue with conditional logic not updating the enhanced UI after resetting the value of the underlying select element.
- Fixed a security vulnerability in the admin area that could be exploited by users with permission to edit forms in the WordPress Dashboard which is admin only by default. Credit: 10up.
- Fixed a security vulnerability for forms that require login. Caching pages with forms that require login will now cause submissions to fail.
- Fixed a JavaScript error on the edit page for some custom post types that don't have an editor.
- Fixed issue with chosen sprite file name. Renamed it to prevent issues on some server configurations.
- Fixed calculations in the the post custom field when when the input type is set to number and calculations are enabled.
- Fixed an issue with the ID attributes of the left span elements of Email and Password fields.
- Fixed an issue with the field label for attribute in the form editor containing an extra underscore.
Add-On Framework Updates in Gravity Forms v1.9.4
- Updated logging in GFPaymentAddOn.
API Updates in Gravity Forms v1.9.4
- Fixed an issue that could potentially pose a security vulnerability via third-party add-ons and custom code.
- Fixed a warning generated in the results endpoint when there are no entries.
You can update to the latest version of Gravity Forms using Automatic Update. Just visit the Updates page under the Forms navigation in your WordPress Dashboard. Update deployment is staged so if you do not see the update available, try again in a few hours. You can also download the latest version of the plugin from the Downloads page.
Don't own a Gravity Forms Yet? What are you waiting for? Purchase a copy today!
Share This
Hi guys.
If possible, for future releases, can you please explain or show some of the updates / new features a little more. For example, as much as I can guess what the new gf_simple_horizontal and gf_section_right ready classes do, it would be good to see even a simple screenshot of them.
Thanks and keep up the great work 🙂
Yes. I apologize, we were focused on the security update and didn't include additional details in the post. The 2 ready classes that were added can be found in the CSS Ready Class Documentation here: https://docs.gravityforms.com/css-ready-classes/
The new classes that were added and can be found on that page are: gf_simple_horizontal and gf_section_right. They were minor additions to the available ready classes.
Hope I'm not ignorant here but I have Background updates set to On on all of my sites. Does this mean that the plugin will maintain itself when updates are released? Or, do I have to go in and update them? So far, I'm always alerted that the update exists in the dashboard but I haven't witnessed an automatic update without an interaction. Must I do something else in the WP-config? Or via filter or?
You can delete that comment. I'll have to dig deeper but as I'm checking sites I'm finding some of them have updated. I'll have to figure out why on my end. Sorry - again. 😉
@jkirker The background automatic updates will execute when WordPress checks for updates. This can vary from site to site as it's unique to each WordPress install. However, it typically happens within 12 hours or so. You can still update via the Plugins page or by going to the Updates nav item under Forms and update that way if WordPress has already done so in the background.
Not really happy with the idea that I now have a security loophole on my site but, unless I pay for another year, it will remain. Why not allow people like me (using Gravity forms only a little and entirely happy with what it does), get the security fixed without the payment?
Like I said, I use it in a very small way, I'm happy with it, don't really want to keep upgrading for stuff I don't need or want, but then I find this out.....
@nigdowser Gravity Forms is a yearly subscription. We just do not currently use recurring billing so the yearly renewal payment doesn't happen automatically. Our Pricing & Purchase page explains this and this is addressed in a couple different of the Q&A questions on that page, including the first one. The primary thing you are paying for each year is software updates and support. New features are a bonus. Even on a single site renewing is important for software update reasons alone. What I can do is update your license key so that it is again eligible for the renewal discount which is a 50% discount and I have gone ahead and done so. It can be renewed via the Settings page of Gravity Forms in your WordPress Dashboard or via the My Account page on the support site at that discounted rate.
@nigdowser - for the support and ongoing development, this plugin is a bargain at any level - and I'd gladly pay full-boat for renewal - but I'm glad that it's discounted. 🙂 There's plenty of free stuff out there - but you get what you give when it's free - nothing.