asc/sportspress
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape output vars of Admin Settings pages

Browse Source
This commit is contained in:
savvasha
2021-11-06 09:19:11 +02:00
parent 54eeca28e8
commit 0c9a9dc104
9 changed files with 51 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
includes/admin/settings/class-sp-settings-events.php
View File

@@ -502,7 +502,7 @@ class SP_Settings_Events extends SP_Settings_Page {
<?php foreach ( $delimiters as $delimiter ): ?>
<label title="<?php echo $delimiter; ?>"><input type="radio" class="preset" name="sportspress_event_teams_delimiter_preset" value="<?php echo $delimiter; ?>" data-example="<?php printf( $example, $delimiter ); ?>" <?php checked( $delimiter, $selection ); ?>> <span><?php printf( $example, $delimiter ); ?></span></label><br>
<?php endforeach; ?>
<label><input type="radio" class="preset" name="sportspress_event_teams_delimiter_preset" value="\c\u\s\t\o\m" <?php checked( false, in_array( $selection, $delimiters ) ); ?>> <?php _e( 'Custom:', 'sportspress' ); ?> </label><input type="text" class="small-text value" name="sportspress_event_teams_delimiter" value="<?php echo $selection; ?>" data-example-format="<?php printf( $example, '__val__' ); ?>">
<label><input type="radio" class="preset" name="sportspress_event_teams_delimiter_preset" value="\c\u\s\t\o\m" <?php checked( false, in_array( $selection, $delimiters ) ); ?>> <?php _e( 'Custom:', 'sportspress' ); ?> </label><input type="text" class="small-text value" name="sportspress_event_teams_delimiter" value="<?php echo esc_attr( $selection ); ?>" data-example-format="<?php printf( $example, '__val__' ); ?>">
<span class="example"><?php printf( $example, $selection ); ?></span>
</fieldset>
</td>

8
includes/admin/settings/class-sp-settings-general.php
View File

@@ -356,13 +356,13 @@ class SP_Settings_General extends SP_Settings_Page {
<fieldset>
<?php foreach ( $color_schemes as $name => $colors ) { ?>
<div class="color-option sp-color-option">
<label data-sp-colors="<?php echo implode( ',', $colors ); ?>"><?php echo $name; ?></label>
<label data-sp-colors="<?php echo implode( ',', $colors ); ?>"><?php echo esc_attr( $name ); ?></label>
<table class="color-palette">
<tbody>
<tr>
<td style="background-color: #<?php echo $colors[0]; ?>">&nbsp;</td>
<td style="background-color: #<?php echo $colors[0]; ?>">&nbsp;</td>
<td style="background-color: #<?php echo $colors[4]; ?>">&nbsp;</td>
<td style="background-color: #<?php echo esc_attr( $colors[0] ); ?>">&nbsp;</td>
<td style="background-color: #<?php echo esc_attr( $colors[0] ); ?>">&nbsp;</td>
<td style="background-color: #<?php echo esc_attr( $colors[4] ); ?>">&nbsp;</td>
</tr>
</tbody>
</table>

10
includes/admin/settings/class-sp-settings-licenses.php
View File

@@ -62,7 +62,7 @@ class SP_Settings_Licenses extends SP_Settings_Page {
$status = get_site_option( 'sportspress_' . $id . '_license_status', false );
?>
<div class="sp-settings-section sp-settings-section-license_options">
<h3><?php echo $license['name']; ?></h3>
<h3><?php echo esc_attr( $license['name'] ); ?></h3>
<table class="form-table sp-licenses-table">
<tbody>
<tr>
@@ -77,13 +77,13 @@ class SP_Settings_Licenses extends SP_Settings_Page {
<td>
<?php if ( false !== $status && 'valid' == $status ) { ?>
<p>
<input type="text" name="sp_license_key_<?php echo $id; ?>" size="40" value="<?php esc_attr_e( $key ); ?>" readonly="readonly">
<input name="sp_license_deactivate_<?php echo $id; ?>" class="button button-secondary button-small" type="submit" value="<?php esc_attr_e( 'Deactivate', 'sportspress' ); ?>" />
<input type="text" name="sp_license_key_<?php echo esc_attr( $id ); ?>" size="40" value="<?php esc_attr_e( $key ); ?>" readonly="readonly">
<input name="sp_license_deactivate_<?php echo esc_attr( $id ); ?>" class="button button-secondary button-small" type="submit" value="<?php esc_attr_e( 'Deactivate', 'sportspress' ); ?>" />
</p>
<?php } else { ?>
<p>
<input type="text" name="sp_license_key_<?php echo $id; ?>" size="40">
<input name="sp_license_activate_<?php echo $id; ?>" class="button button-primary button-small" type="submit" value="<?php esc_attr_e( 'Activate', 'sportspress' ); ?>" />
<input type="text" name="sp_license_key_<?php echo esc_attr( $id ); ?>" size="40">
<input name="sp_license_activate_<?php echo esc_attr( $id ); ?>" class="button button-primary button-small" type="submit" value="<?php esc_attr_e( 'Activate', 'sportspress' ); ?>" />
</p>
<?php } ?>
</td>

12
includes/admin/settings/class-sp-settings-modules.php
View File

@@ -104,7 +104,7 @@ class SP_Settings_Modules extends SP_Settings_Page {
</thead>
<tbody>
<tr><td>
<img src="<?php echo $theme->get_screenshot(); ?>" class="sp-theme-screenshot">
<img src="<?php echo esc_url( $theme->get_screenshot() ); ?>" class="sp-theme-screenshot">
<p><?php _e( 'Rookie is a free starter theme for SportsPress designed by ThemeBoy.', 'sportspress' ); ?></p>
<p class="sp-module-actions">
<span><?php _e( 'Need a better theme?', 'sportspress' ); ?></span>
@@ -193,10 +193,10 @@ class SP_Settings_Modules extends SP_Settings_Page {
<tbody>
<tr><td>
<?php foreach ( $categories as $slug => $category ) { ?>
<p><strong><i class="<?php echo $category['icon']; ?>"></i> <?php echo $category['label']; ?></strong></p>
<ul class="sp-<?php echo $slug; ?>-links">
<p><strong><i class="<?php echo esc_attr( $category['icon'] ); ?>"></i> <?php echo esc_attr( $category['label'] ); ?></strong></p>
<ul class="sp-<?php echo esc_attr( $slug ); ?>-links">
<?php foreach ( $category['links'] as $url => $text ) { ?>
<li><a href="<?php echo $url; ?>" target="_blank"><?php echo $text; ?></a></li>
<li><a href="<?php echo esc_url( $url ); ?>" target="_blank"><?php echo wp_kses_post( $text ); ?></a></li>
<?php } ?>
</ul>
<?php } ?>
@@ -227,7 +227,7 @@ class SP_Settings_Modules extends SP_Settings_Page {
</span>
<?php if ( isset( $module['desc'] ) ) { ?>
<span class="sp-desc">
<?php echo $module['desc']; ?>
<?php echo wp_kses_post( $module['desc'] ); ?>
<?php if ( array_key_exists( 'link', $module ) ) { ?>
<a href="<?php echo apply_filters( 'sportspress_pro_url', $module['link'] ); ?>" target="_blank"><?php echo sp_array_value( $module, 'action', __( 'Learn more', 'sportspress' ) ); ?></a>
<?php } ?>
@@ -242,7 +242,7 @@ class SP_Settings_Modules extends SP_Settings_Page {
<?php echo sp_array_value( $module, 'label', $id ); ?>
</label>
<?php if ( isset( $module['desc'] ) ) { ?>
<span class="sp-desc"><?php echo $module['desc']; ?></span>
<span class="sp-desc"><?php echo wp_kses_post( $module['desc'] ); ?></span>
<?php } ?>
</td></tr>
<?php } ?>

18
includes/admin/settings/class-sp-settings-page.php
View File

@@ -125,12 +125,12 @@ class SP_Settings_Page {
<div class="sp-item-bar sp-layout-item-bar">
<div class="sp-item-handle sp-layout-item-handle ui-sortable-handle">
<span class="sp-item-title item-title"><?php echo sp_array_value( $details, 'title', ucfirst( $template ) ); ?></span>
<input type="hidden" name="sportspress_<?php echo $this->template; ?>_template_order[]" value="<?php echo $template; ?>">
<input type="hidden" name="sportspress_<?php echo esc_attr( $this->template ); ?>_template_order[]" value="<?php echo esc_attr( $template ); ?>">
</div>
<input type="hidden" name="sportspress_template_visibility[<?php echo $option; ?>]" value="0">
<input class="sp-toggle-switch" type="checkbox" name="sportspress_template_visibility[<?php echo $option; ?>]" id="<?php echo $option; ?>" value="1" <?php checked( $visibility, 'yes' ); ?>>
<label for="sportspress_<?php echo $this->template; ?>_show_<?php echo $template; ?>"></label>
<input type="hidden" name="sportspress_template_visibility[<?php echo esc_attr( $option ); ?>]" value="0">
<input class="sp-toggle-switch" type="checkbox" name="sportspress_template_visibility[<?php echo esc_attr( $option ); ?>]" id="<?php echo esc_attr( $option ); ?>" value="1" <?php checked( $visibility, 'yes' ); ?>>
<label for="sportspress_<?php echo esc_attr( $this->template ); ?>_show_<?php echo esc_attr( $template ); ?>"></label>
</div>
</li>
<?php } ?>
@@ -170,7 +170,7 @@ class SP_Settings_Page {
</th>
<td class="sp-sortable-list-container">
<p class="description"><?php _e( 'Drag items here to display them as tabs.', 'sportspress' ); ?></p>
<input type="hidden" name="sportspress_<?php echo $this->template; ?>_template_order[]" value="tabs">
<input type="hidden" name="sportspress_<?php echo esc_attr( $this->template ); ?>_template_order[]" value="tabs">
<ul class="sp-layout sp-sortable-list sp-connected-list ui-sortable">
<?php foreach ( $templates as $template => $details ) {
@@ -182,12 +182,12 @@ class SP_Settings_Page {
<div class="sp-item-bar sp-layout-item-bar">
<div class="sp-item-handle sp-layout-item-handle ui-sortable-handle">
<span class="sp-item-title item-title"><?php echo sp_array_value( $details, 'title', ucfirst( $template ) ); ?></span>
<input type="hidden" name="sportspress_<?php echo $this->template; ?>_template_order[]" value="<?php echo $template; ?>">
<input type="hidden" name="sportspress_<?php echo esc_attr( $this->template ); ?>_template_order[]" value="<?php echo esc_attr( $template ); ?>">
</div>
<input type="hidden" name="sportspress_template_visibility[<?php echo $option; ?>]" value="0">
<input class="sp-toggle-switch" type="checkbox" name="sportspress_template_visibility[<?php echo $option; ?>]" id="<?php echo $option; ?>" value="1" <?php checked( $visibility, 'yes' ); ?>>
<label for="sportspress_<?php echo $this->template; ?>_show_<?php echo $template; ?>"></label>
<input type="hidden" name="sportspress_template_visibility[<?php echo esc_attr( $option ); ?>]" value="0">
<input class="sp-toggle-switch" type="checkbox" name="sportspress_template_visibility[<?php echo esc_attr( $option ); ?>]" id="<?php echo esc_attr( $option ); ?>" value="1" <?php checked( $visibility, 'yes' ); ?>>
<label for="sportspress_<?php echo esc_attr( $this->template ); ?>_show_<?php echo esc_attr( $template ); ?>"></label>
</div>
</li>
<?php } ?>

8
includes/admin/settings/class-sp-settings-status.php
View File

@@ -390,7 +390,7 @@ class SP_Settings_Status extends SP_Settings_Page {
<td>
<?php
$object = get_post_type_object( $post_type );
echo $object->labels->name;
echo esc_attr( $object->labels->name );
?>:
</td>
<td>
@@ -442,13 +442,13 @@ class SP_Settings_Status extends SP_Settings_Page {
<tr>
<td><?php _e( 'Theme Name', 'sportspress' ); ?>:</td>
<td><?php
echo $active_theme->Name;
echo esc_attr( $active_theme->Name );
?></td>
</tr>
<tr>
<td><?php _e( 'Theme Version', 'sportspress' ); ?>:</td>
<td><?php
echo $active_theme->Version;
echo esc_attr( $active_theme->Version );
if ( ! empty( $theme_version_data['version'] ) && version_compare( $theme_version_data['version'], $active_theme->Version, '!=' ) )
echo ' &ndash; <strong style="color:red;">' . $theme_version_data['version'] . ' ' . __( 'is available', 'sportspress' ) . '</strong>';
@@ -457,7 +457,7 @@ class SP_Settings_Status extends SP_Settings_Page {
<tr>
<td><?php _e( 'Author URL', 'sportspress' ); ?>:</td>
<td><?php
echo $active_theme->{'Author URI'};
echo esc_url( $active_theme->{'Author URI'} );
?></td>
</tr>
</tbody>

36
includes/admin/views/html-admin-config.php
View File

@@ -37,11 +37,11 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
</thead>
<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="row-title"><?php echo $row->post_title; ?></td>
<td><code><?php echo $row->post_name; ?></code></td>
<td class="row-title"><?php echo esc_attr( $row->post_title ); ?></td>
<td><code><?php echo esc_attr( $row->post_name ); ?></code></td>
<td><?php echo sp_get_post_abbreviation( $row->ID ); ?></td>
<td><?php echo sp_get_post_condition( $row->ID ); ?></td>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>
@@ -112,12 +112,12 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
</tfoot>
<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="radio"><input type="radio" class="sp-primary-result-option" id="sportspress_primary_result_<?php echo $row->post_name; ?>" name="sportspress_primary_result" value="<?php echo $row->post_name; ?>" <?php checked( $selection, $row->post_name ); ?>></td>
<td class="row-title"><label for="sportspress_primary_result_<?php echo $row->post_name; ?>"><?php echo esc_html( $row->post_title ); ?></label></td>
<td><code><?php echo $row->post_name; ?>for</code>, <code><?php echo $row->post_name; ?>against</code></td>
<td class="radio"><input type="radio" class="sp-primary-result-option" id="sportspress_primary_result_<?php echo esc_attr( $row->post_name ); ?>" name="sportspress_primary_result" value="<?php echo esc_attr( $row->post_name ); ?>" <?php checked( $selection, $row->post_name ); ?>></td>
<td class="row-title"><label for="sportspress_primary_result_<?php echo esc_attr( $row->post_name ); ?>"><?php echo esc_html( $row->post_title ); ?></label></td>
<td><code><?php echo esc_attr( $row->post_name ); ?>for</code>, <code><?php echo esc_attr( $row->post_name ); ?>against</code></td>
<td><?php echo esc_html( sp_get_post_equation( $row->ID ) ); ?></td>
<td><?php echo esc_html( sp_get_post_precision( $row->ID ) ); ?></td>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>
@@ -203,7 +203,7 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
if ( '' === $visible ) $visible = 1;
?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="radio"><input type="radio" class="sp-primary-performance-option" id="sportspress_primary_performance_<?php echo $row->post_name; ?>" name="sportspress_primary_performance" value="<?php echo $row->post_name; ?>" <?php checked( $selection, $row->post_name ); ?>></td>
<td class="radio"><input type="radio" class="sp-primary-performance-option" id="sportspress_primary_performance_<?php echo esc_attr( $row->post_name ); ?>" name="sportspress_primary_performance" value="<?php echo esc_attr( $row->post_name ); ?>" <?php checked( $selection, $row->post_name ); ?>></td>
<td class="icon">
<?php
if ( has_post_thumbnail( $row->ID ) )
@@ -214,8 +214,8 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
echo apply_filters( 'sportspress_performance_icon', $icon, $row->ID );
?>
</td>
<td class="row-title"><?php echo $row->post_title; ?></td>
<td><code><?php echo $row->post_name; ?></code></td>
<td class="row-title"><?php echo esc_html( $row->post_title ); ?></td>
<td><code><?php echo esc_attr( $row->post_name ); ?></code></td>
<td><?php echo sp_get_post_section( $row->ID ); ?></td>
<td><?php echo sp_get_post_format( $row->ID ); ?></td>
<?php if ( 'auto' === $columns ) { ?>
@@ -223,7 +223,7 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
<?php if ( $visible ) { ?><i class="dashicons dashicons-yes"></i><?php } else { ?>&nbsp;<?php } ?>
</td>
<?php } ?>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>
@@ -273,11 +273,11 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
</thead>
<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="row-title"><?php echo $row->post_title; ?></td>
<td class="row-title"><?php echo esc_html( $row->post_title ); ?></td>
<td><?php echo esc_html( sp_get_post_equation( $row->ID ) ); ?></td>
<td><?php echo esc_html( sp_get_post_precision( $row->ID ) ); ?></td>
<td><?php echo esc_html( sp_get_post_order( $row->ID ) ); ?></td>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>
@@ -325,9 +325,9 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
</thead>
<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="row-title"><?php echo $row->post_title; ?></td>
<td><code><?php echo $row->post_name; ?></code></td>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td class="row-title"><?php echo esc_html( $row->post_title ); ?></td>
<td><code><?php echo esc_attr( $row->post_name ); ?></code></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>
@@ -391,7 +391,7 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
if ( '' === $visible ) $visible = 1;
?>
<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
<td class="row-title"><?php echo $row->post_title; ?></td>
<td class="row-title"><?php echo esc_html( $row->post_title ); ?></td>
<td class="icon">
<?php
if ( has_post_thumbnail( $row->ID ) )
@@ -410,7 +410,7 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
<?php if ( $visible ) { ?><i class="dashicons dashicons-yes"></i><?php } else { ?>&nbsp;<?php } ?>
</td>
<?php } ?>
<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
<td><p class="description"><?php echo wp_kses_post( $row->post_excerpt ); ?></p></td>
<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
</tr>
<?php $i++; endforeach; else: ?>

6
includes/admin/views/html-admin-page-status.php
View File

@@ -349,7 +349,7 @@
<td>
<?php
$object = get_post_type_object( $post_type );
echo $object->labels->name;
echo esc_attr( $object->labels->name );
?>:
</td>
<td>
@@ -401,7 +401,7 @@
<tr>
<td><?php _e( 'Theme Name', 'sportspress' ); ?>:</td>
<td><?php
echo $active_theme->Name;
echo esc_attr( $active_theme->Name );
?></td>
</tr>
<tr>
@@ -416,7 +416,7 @@
<tr>
<td><?php _e( 'Author URL', 'sportspress' ); ?>:</td>
<td><?php
echo $active_theme->{'Author URI'};
echo esc_url( $active_theme->{'Author URI'} );
?></td>
</tr>
</tbody>

2
includes/admin/views/html-admin-settings.php
View File

@@ -2,7 +2,7 @@
<h2><?php echo apply_filters( 'sportspress_logo', '<img src="' . plugin_dir_url( SP_PLUGIN_FILE ) . 'assets/images/modules/sportspress' . ( class_exists( 'SportsPress_Pro' ) ? '-pro' : '' ) . '.png" alt="' . __( 'SportsPress', 'sportspress' ) . '" class="sp-settings-logo">' ); ?></h2>
<form method="post" id="mainform" action="" enctype="multipart/form-data">
<h2 class="nav-tab-wrapper sp-nav-tab-wrapper">
<?php foreach ( $tabs as $name => $label ): ?><a href="<?php echo admin_url( 'admin.php?page=sportspress&tab=' . $name ); ?>" class="nav-tab <?php echo ( $current_tab == $name ? 'nav-tab-active' : '' ); ?>"><?php echo $label; ?></a><?php endforeach; ?>
<?php foreach ( $tabs as $name => $label ): ?><a href="<?php echo admin_url( 'admin.php?page=sportspress&tab=' . $name ); ?>" class="nav-tab <?php echo ( $current_tab == $name ? 'nav-tab-active' : '' ); ?>"><?php echo esc_attr( $label ); ?></a><?php endforeach; ?>
<?php do_action( 'sportspress_settings_tabs' ); ?>
</h2>
<?php