rebase from live enviornment

wp/wp-content/plugins/contact-form-7/includes/block-editor/block-editor.php

@@ -79,7 +79,7 @@ function wpcf7_enqueue_block_editor_assets() {
 		'contact-form-7-block-editor',
 		sprintf(
 			'window.wpcf7 = {contactForms:%s};',
-			json_encode( $contact_forms )
+			wp_json_encode( $contact_forms )
 		),
 		'before'
 	);

wp/wp-content/plugins/contact-form-7/includes/formatting.php

@@ -275,6 +275,17 @@ function wpcf7_sanitize_unit_tag( $tag ) {
 function wpcf7_antiscript_file_name( $filename ) {
 	$filename = wp_basename( $filename );
 
+	// Apply part of protection logic from sanitize_file_name().
+	$filename = str_replace(
+		array(
+			'?', '[', ']', '/', '\\', '=', '<', '>', ':', ';', ',', "'", '"',
+			'&', '$', '#', '*', '(', ')', '|', '~', '`', '!', '{', '}',
+			'%', '+', '’', '«', '»', '”', '“', chr( 0 )
+		),
+		'',
+		$filename
+	);
+
 	$filename = preg_replace( '/[\r\n\t -]+/', '-', $filename );
 	$filename = preg_replace( '/[\pC\pZ]+/iu', '', $filename );
 

wp/wp-content/plugins/contact-form-7/includes/swv/rules/file.php

@@ -25,7 +25,7 @@ class WPCF7_SWV_FileRule extends WPCF7_SWV_Rule {
 		$acceptable_filetypes = array();
 
 		foreach ( (array) $this->get_property( 'accept' ) as $accept ) {
-			if ( false === strpos( $accept, '/' ) ) {
+			if ( preg_match( '/^\.[a-z0-9]+$/i', $accept ) ) {
 				$acceptable_filetypes[] = strtolower( $accept );
 			} else {
 				foreach ( wpcf7_convert_mime_to_ext( $accept ) as $ext ) {