diff --git a/includes/admin/post-types/class-sp-admin-cpt-column.php b/includes/admin/post-types/class-sp-admin-cpt-column.php index fb723033..053e422b 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-column.php +++ b/includes/admin/post-types/class-sp-admin-cpt-column.php @@ -58,7 +58,7 @@ class SP_Admin_CPT_Column extends SP_Admin_CPT { switch ( $column ): case 'sp_key': global $post; - echo $post->post_name; + echo esc_attr( $post->post_name ); break; case 'sp_equation': echo sp_get_post_equation( $post_id ); diff --git a/includes/admin/post-types/class-sp-admin-cpt-event.php b/includes/admin/post-types/class-sp-admin-cpt-event.php index c139f3fc..02236359 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-event.php +++ b/includes/admin/post-types/class-sp-admin-cpt-event.php @@ -218,9 +218,9 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { $team_results = implode( ' | ', $team_results ); endif; - echo '' . ( $team_result == '' ? '-' : apply_filters( 'sportspress_event_team_result_admin', $team_result, $post_id, $team_id ) ) . ''; - echo ' '; - echo $team->post_title; + echo '' . ( $team_result == '' ? '-' : apply_filters( 'sportspress_event_team_result_admin', $team_result, $post_id, $team_id ) ) . ''; + echo ' '; + echo esc_attr( $team->post_title ); echo '
'; endif; endforeach; @@ -248,7 +248,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { case 'sp_day': $day = get_post_meta ( $post_id, 'sp_day', true ); if ( '' === $day ) $day = __( 'Default', 'sportspress' ); - echo $day; + echo esc_attr( $day ); break; endswitch; } diff --git a/includes/admin/post-types/class-sp-admin-cpt-list.php b/includes/admin/post-types/class-sp-admin-cpt-list.php index 441e0cfc..337233c5 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-list.php +++ b/includes/admin/post-types/class-sp-admin-cpt-list.php @@ -85,7 +85,7 @@ class SP_Admin_CPT_List extends SP_Admin_CPT { foreach( $teams as $team_id ): if ( ! $team_id ) continue; $team = get_post( $team_id ); - if ( $team ) echo $team->post_title . '
'; + if ( $team ) echo esc_attr( $team->post_title ) . '
'; endforeach; endif; break; diff --git a/includes/admin/post-types/class-sp-admin-cpt-metric.php b/includes/admin/post-types/class-sp-admin-cpt-metric.php index 319af6db..92887585 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-metric.php +++ b/includes/admin/post-types/class-sp-admin-cpt-metric.php @@ -55,7 +55,7 @@ class SP_Admin_CPT_Metric extends SP_Admin_CPT { switch ( $column ): case 'sp_key': global $post; - echo $post->post_name; + echo esc_attr( $post->post_name ); break; case 'sp_description': global $post; diff --git a/includes/admin/post-types/class-sp-admin-cpt-outcome.php b/includes/admin/post-types/class-sp-admin-cpt-outcome.php index 1c097c9c..e9bf8802 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-outcome.php +++ b/includes/admin/post-types/class-sp-admin-cpt-outcome.php @@ -56,7 +56,7 @@ class SP_Admin_CPT_Outcome extends SP_Admin_CPT { switch ( $column ): case 'sp_key': global $post; - echo $post->post_name; + echo esc_attr( $post->post_name ); break; case 'sp_abbreviation': global $post; diff --git a/includes/admin/post-types/class-sp-admin-cpt-performance.php b/includes/admin/post-types/class-sp-admin-cpt-performance.php index 72a836e5..58d6cc40 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-performance.php +++ b/includes/admin/post-types/class-sp-admin-cpt-performance.php @@ -61,7 +61,7 @@ class SP_Admin_CPT_Performance extends SP_Admin_CPT { break; case 'sp_key': global $post; - echo $post->post_name; + echo esc_attr( $post->post_name ); break; case 'sp_section': global $post; diff --git a/includes/admin/post-types/class-sp-admin-cpt-player.php b/includes/admin/post-types/class-sp-admin-cpt-player.php index 39fd8d97..1a67ee4a 100755 --- a/includes/admin/post-types/class-sp-admin-cpt-player.php +++ b/includes/admin/post-types/class-sp-admin-cpt-player.php @@ -110,7 +110,7 @@ class SP_Admin_CPT_Player extends SP_Admin_CPT { if ( ! $team_id ) continue; $team = get_post( $team_id ); if ( $team ): - echo $team->post_title; + echo esc_attr( $team->post_title ); if ( in_array( $team_id, $current_teams ) ): echo ''; endif; @@ -257,14 +257,14 @@ class SP_Admin_CPT_Player extends SP_Admin_CPT { @@ -326,14 +326,14 @@ class SP_Admin_CPT_Player extends SP_Admin_CPT { diff --git a/includes/admin/post-types/class-sp-admin-cpt-result.php b/includes/admin/post-types/class-sp-admin-cpt-result.php index 2b2b6ecb..045bee9b 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-result.php +++ b/includes/admin/post-types/class-sp-admin-cpt-result.php @@ -55,11 +55,11 @@ class SP_Admin_CPT_Result extends SP_Admin_CPT { switch ( $column ): case 'sp_key': global $post; - echo $post->post_name . 'for, ' . $post->post_name . 'against'; + echo esc_attr( $post->post_name ) . 'for, ' . esc_attr( $post->post_name ) . 'against'; break; case 'sp_description': global $post; - echo '' . $post->post_excerpt . ''; + echo '' . wp_kses_post( $post->post_excerpt ) . ''; break; endswitch; }