Security fix: Backport security fixes from WC 3.5.8

assets/js/admin/users.js

@@ -36,7 +36,10 @@ jQuery( function ( $ ) {
 				$parent = $state.parent(),
 				input_name = $state.attr( 'name' ),
 				input_id = $state.attr( 'id' ),
-				value = $this.data( 'woocommerce.stickState-' + country ) ? $this.data( 'woocommerce.stickState-' + country ) : $state.val();
+				stickstatefield = 'woocommerce.stickState-' + country,
+				value = $this.data( stickstatefield ) ? $this.data( stickstatefield ) : $state.val(),
+				placeholder = $state.attr( 'placeholder' ),
+				$newstate;
 
 			if ( stickValue ){
 				$this.data( 'woocommerce.stickState-' + country, value );
@@ -46,22 +49,37 @@ jQuery( function ( $ ) {
 			$parent.show().find( '.select2-container' ).remove();
 
 			if ( ! $.isEmptyObject( wc_users_fields.states[ country ] ) ) {
-				var $states_select = $( '<select name="' + input_name + '" id="' + input_id + '" class="js_field-state" style="width: 25em;"></select>' ),
-					state = wc_users_fields.states[ country ];
+				var state          = wc_users_fields.states[ country ],
+					$defaultOption = $( '<option value=""></option>' )
+						.text( wc_users_fields.i18n_select_state_text );
 
-				$states_select.append( $( '<option value="">' + wc_users_params.i18n_select_state_text + '</option>' ) );
+				$newstate = $( '<select style="width: 25em;"></select>' )
+					.prop( 'id', input_id )
+					.prop( 'name', input_name )
+					.prop( 'placeholder', placeholder )
+					.addClass( 'js_field-state' )
+					.append( $defaultOption );
 
 				$.each( state, function( index ) {
-					$states_select.append( $( '<option value="' + index + '">' + state[ index ] + '</option>' ) );
+					var $option = $( '<option></option>' )
+						.prop( 'value', index )
+						.text( state[ index ] );
+					$newstate.append( $option );
 				} );
 
-				$states_select.val( value );
+				$newstate.val( value );
 
-				$state.replaceWith( $states_select );
+				$state.replaceWith( $newstate );
 
-				$states_select.show().selectWoo().hide().change();
+				$newstate.show().selectWoo().hide().change();
 			} else {
-				$state.replaceWith( '<input type="text" class="js_field-state" name="' + input_name + '" id="' + input_id + '" value="' + value + '" />' );
+				$newstate = $( '<input type="text" />' )
+					.prop( 'id', input_id )
+					.prop( 'name', input_name )
+					.prop( 'placeholder', placeholder )
+					.addClass( 'js_field-state regular-text' )
+					.val( value );
+				$state.replaceWith( $newstate );
 			}
 
 			// This event has a typo - deprecated in 2.5.0

assets/js/frontend/single-product.js

@@ -287,7 +287,15 @@ jQuery( function( $ ) {
 		}
 
 		var options = $.extend( {
-			index: $( clicked ).index()
+			index: $( clicked ).index(),
+			addCaptionHTMLFn: function( item, captionEl ) {
+				if ( ! item.title ) {
+					captionEl.children[0].textContent = '';
+					return false;
+				}
+				captionEl.children[0].textContent = item.title;
+				return true;
+			}
 		}, wc_single_product_params.photoswipe_options );
 
 		// Initializes and opens PhotoSwipe.

assets/js/selectWoo/selectWoo.full.js

@@ -1,5 +1,5 @@
 /*!
- * SelectWoo 1.0.1
+ * SelectWoo 1.0.5
  * https://github.com/woocommerce/selectWoo
  *
  * Released under the MIT license
@@ -1613,7 +1613,7 @@ S2.define('select2/selection/single',[
     var $rendered = this.$selection.find('.select2-selection__rendered');
     var formatted = this.display(selection, $rendered);
 
-    $rendered.empty().append(formatted);
+	$rendered.empty().text(formatted);
     $rendered.prop('title', selection.title || selection.text);
   };
 
@@ -1924,7 +1924,7 @@ S2.define('select2/selection/search',[
     var $search = $(
       '<li class="select2-search select2-search--inline">' +
         '<input class="select2-search__field" type="text" tabindex="-1"' +
-        ' autocomplete="off" autocorrect="off" autocapitalize="off"' +
+		' autocomplete="off" autocorrect="off" autocapitalize="none"' +
         ' spellcheck="false" role="textbox" aria-autocomplete="list" />' +
       '</li>'
     );
@@ -3992,7 +3992,7 @@ S2.define('select2/dropdown/search',[
     var $search = $(
       '<span class="select2-search select2-search--dropdown">' +
         '<input class="select2-search__field" type="text" tabindex="-1"' +
-        ' autocomplete="off" autocorrect="off" autocapitalize="off"' +
+        ' autocomplete="off" autocorrect="off" autocapitalize="none"' +
         ' spellcheck="false" role="combobox" aria-autocomplete="list" aria-expanded="true" />' +
       '</span>'
     );
@@ -4047,7 +4047,7 @@ S2.define('select2/dropdown/search',[
     });
 
     container.on('focus', function () {
-      if (container.isOpen()) {
+      if (!container.isOpen()) {
         self.$search.focus();
       }
     });