asc/sportspress
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape output vars from admin meta-boxes (#2)

Browse Source
This commit is contained in:
savvasha
2021-11-06 08:48:09 +02:00
parent b5427bd302
commit 6a29c3b1ee
14 changed files with 44 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
includes/admin/post-types/meta-boxes/class-sp-meta-box-event-results.php
View File

@@ -243,14 +243,14 @@ class SP_Meta_Box_Event_Results {
<?php _e( 'Team', 'sportspress' ); ?>
</th>
<?php foreach ( $columns as $key => $label ): ?>
<th class="column-<?php echo $key; ?>">
<th class="column-<?php echo esc_attr( $key ); ?>">
<?php if ( $has_checkboxes ): ?>
<label for="sp_result_columns_<?php echo $key; ?>">
<input type="checkbox" name="sp_result_columns[]" value="<?php echo $key; ?>" id="sp_result_columns_<?php echo $key; ?>" <?php checked( ! is_array( $usecolumns ) || in_array( $key, $usecolumns ) ); ?>>
<?php echo $label; ?>
<label for="sp_result_columns_<?php echo esc_attr( $key ); ?>">
<input type="checkbox" name="sp_result_columns[]" value="<?php echo esc_attr( $key ); ?>" id="sp_result_columns_<?php echo esc_attr( $key ); ?>" <?php checked( ! is_array( $usecolumns ) || in_array( $key, $usecolumns ) ); ?>>
<?php echo esc_attr( $label ); ?>
</label>
<?php else: ?>
<?php echo $label; ?>
<?php echo esc_attr( $label ); ?>
<?php endif; ?>
</th>
<?php endforeach; ?>
@@ -265,14 +265,14 @@ class SP_Meta_Box_Event_Results {
foreach ( $data as $team_id => $team_results ):
if ( ! $team_id || -1 == $team_id ) continue;
?>
<tr class="sp-row sp-post<?php if ( $i % 2 == 0 ) echo ' alternate'; ?>" data-team="<?php echo $team_id; ?>">
<tr class="sp-row sp-post<?php if ( $i % 2 == 0 ) echo ' alternate'; ?>" data-team="<?php echo esc_attr( $team_id ); ?>">
<td>
<?php echo get_the_title( $team_id ); ?>
</td>
<?php foreach( $columns as $column => $label ):
$value = sp_array_value( $team_results, $column, '' );
?>
<td><input class="sp-team-<?php echo $column; ?>-input" type="text" name="sp_results[<?php echo $team_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>"<?php if ( in_array( $column, $auto_columns ) ) { ?> placeholder="<?php _e( '(Auto)', 'sportspress' ); ?>"<?php } ?> /></td>
<td><input class="sp-team-<?php echo esc_attr( $column ); ?>-input" type="text" name="sp_results[<?php echo esc_attr( $team_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>"<?php if ( in_array( $column, $auto_columns ) ) { ?> placeholder="<?php _e( '(Auto)', 'sportspress' ); ?>"<?php } ?> /></td>
<?php endforeach; ?>
<td>
<?php

2
includes/admin/post-types/meta-boxes/class-sp-meta-box-event-shortcode.php
View File

@@ -35,7 +35,7 @@ class SP_Meta_Box_Event_Shortcode {
</p>
<?php foreach ( $shortcodes as $id => $label ) { ?>
<p>
<strong><?php echo $label; ?></strong>
<strong><?php echo esc_attr( $label ); ?></strong>
</p>
<p><input type="text" value="<?php sp_shortcode_template( $id, $post->ID ); ?>" readonly="readonly" class="code widefat"></p>
<?php } ?>

4
includes/admin/post-types/meta-boxes/class-sp-meta-box-event-specs.php
View File

@@ -35,8 +35,8 @@ class SP_Meta_Box_Event_Specs {
if ( $vars ):
foreach ( $vars as $var ):
?>
<p><strong><?php echo $var->post_title; ?></strong></p>
<p><input type="text" name="sp_specs[<?php echo $var->post_name; ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
<p><strong><?php echo esc_attr( $var->post_title ); ?></strong></p>
<p><input type="text" name="sp_specs[<?php echo esc_attr( $var->post_name ); ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
<?php
endforeach;
else:

2
includes/admin/post-types/meta-boxes/class-sp-meta-box-event-teams.php
View File

@@ -101,7 +101,7 @@ class SP_Meta_Box_Event_Teams {
$j = 0;
foreach ( $tabs as $slug => $tab ) {
?>
<li class="<?php if ( 0 == $j ) { ?>tabs<?php } ?>"><a href="#<?php echo $slug; ?>-all"><?php echo $tab['label']; ?></a></li>
<li class="<?php if ( 0 == $j ) { ?>tabs<?php } ?>"><a href="#<?php echo esc_attr( $slug ); ?>-all"><?php echo esc_attr( $tab['label'] ); ?></a></li>
<?php
$j++;
}

2
includes/admin/post-types/meta-boxes/class-sp-meta-box-event-video.php
View File

@@ -29,7 +29,7 @@ class SP_Meta_Box_Event_Video {
<?php endif; ?>
<fieldset class="sp-video-field hidden">
<p><strong><?php _e( 'URL', 'sportspress' ); ?></strong></p>
<p><input class="widefat" type="text" name="sp_video" id="sp_video" value="<?php echo $video; ?>"></p>
<p><input class="widefat" type="text" name="sp_video" id="sp_video" value="<?php echo esc_url( $video ); ?>"></p>
<p><a href="#" class="sp-remove-video"><?php _e( 'Cancel', 'sportspress' ); ?></a></p>
</fieldset>
<fieldset class="sp-video-adder<?php if ( $video ): ?> hidden<?php endif; ?>">

20
includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
View File

@@ -64,8 +64,8 @@ class SP_Meta_Box_List_Data {
<?php } ?>
<?php foreach ( $columns as $key => $label ): ?>
<?php if ( in_array( $key, array( 'number', 'team', 'position' ) ) ) continue; ?>
<th><label for="sp_columns_<?php echo $key; ?>">
<?php echo $label; ?>
<th><label for="sp_columns_<?php echo esc_attr( $key ); ?>">
<?php echo esc_attr( $label ); ?>
</label></th>
<?php endforeach; ?>
</tr>
@@ -89,7 +89,7 @@ class SP_Meta_Box_List_Data {
<td>
<?php
if ( 'number' == $orderby ) {
echo ( $number ? $number : '&nbsp;' );
echo ( $number ? esc_attr( $number ) : '&nbsp;' );
} else {
echo $i + 1;
}
@@ -99,11 +99,11 @@ class SP_Meta_Box_List_Data {
<td>
<?php if ( $show_player_photo ) echo get_the_post_thumbnail( $player_id, 'sportspress-fit-mini' ); ?>
<span class="sp-default-value">
<span class="sp-default-value-input"><?php echo $default_name; ?></span>
<span class="sp-default-value-input"><?php echo esc_attr( $default_name ); ?></span>
<a class="dashicons dashicons-edit sp-edit" title="<?php _e( 'Edit', 'sportspress' ); ?>"></a>
</span>
<span class="hidden sp-custom-value">
<input type="text" name="sp_players[<?php echo $player_id; ?>][name]" class="name sp-custom-value-input" value="<?php echo esc_attr( sp_array_value( $player_stats, 'name', '' ) ); ?>" placeholder="<?php echo esc_attr( get_the_title( $player_id ) ); ?>" size="6">
<input type="text" name="sp_players[<?php echo esc_attr( $player_id ); ?>][name]" class="name sp-custom-value-input" value="<?php echo esc_attr( sp_array_value( $player_stats, 'name', '' ) ); ?>" placeholder="<?php echo esc_attr( get_the_title( $player_id ) ); ?>" size="6">
<a class="button button-secondary sp-cancel"><?php _e( 'Cancel', 'sportspress' ); ?></a>
<a class="button button-primary sp-save"><?php _e( 'Save', 'sportspress' ); ?></a>
</span>
@@ -158,7 +158,7 @@ class SP_Meta_Box_List_Data {
$value = sp_array_value( $player_stats, $column, '' );
$placeholder = sp_array_value( sp_array_value( $placeholders, $player_id, array() ), $column, 0 );
?>
<td><input type="text" name="sp_players[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="<?php echo esc_attr( $placeholder ); ?>" data-placeholder="<?php echo esc_attr( $placeholder ); ?>" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
<td><input type="text" name="sp_players[<?php echo esc_attr( $player_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="<?php echo esc_attr( $placeholder ); ?>" data-placeholder="<?php echo esc_attr( $placeholder ); ?>" data-matrix="<?php echo esc_attr( $player_id ); ?>_<?php echo esc_attr( $column ); ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
<?php endforeach; ?>
</tr>
<?php
@@ -167,7 +167,7 @@ class SP_Meta_Box_List_Data {
else:
?>
<tr class="sp-row alternate">
<td colspan="<?php $colspan = sizeof( $columns ) + ( apply_filters( 'sportspress_has_teams', true ) ? 3 : 2 ); echo $colspan; ?>">
<td colspan="<?php $colspan = sizeof( $columns ) + ( apply_filters( 'sportspress_has_teams', true ) ? 3 : 2 ); echo esc_attr( $colspan ); ?>">
<?php printf( __( 'Select %s', 'sportspress' ), __( 'Data', 'sportspress' ) ); ?>
</td>
</tr>
@@ -184,7 +184,7 @@ class SP_Meta_Box_List_Data {
<th>#</th>
<th><?php _e( 'Player', 'sportspress' ); ?></th>
<?php foreach ( $columns as $key => $label ): if ( in_array( $key, array( 'number', 'team', 'position' ) ) ) continue; ?>
<th><?php echo $label; ?></th>
<th><?php echo esc_attr( $label ); ?></th>
<?php endforeach; ?>
</tr>
</thead>
@@ -206,7 +206,7 @@ class SP_Meta_Box_List_Data {
if ( in_array( $column, array( 'number', 'team', 'position' ) ) ) continue;
$value = sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, '' );
?>
<td><input type="text" name="sp_adjustments[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="0" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" /></td>
<td><input type="text" name="sp_adjustments[<?php echo esc_attr( $player_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="0" data-matrix="<?php echo esc_attr( $player_id ); ?>_<?php echo esc_attr( $column ); ?>" /></td>
<?php endforeach; ?>
</tr>
<?php
@@ -215,7 +215,7 @@ class SP_Meta_Box_List_Data {
else:
?>
<tr class="sp-row alternate">
<td colspan="<?php $colspan = sizeof( $columns ) + 3; echo $colspan; ?>">
<td colspan="<?php $colspan = sizeof( $columns ) + 3; echo esc_attr( $colspan ); ?>">
<?php printf( __( 'Select %s', 'sportspress' ), __( 'Details', 'sportspress' ) ); ?>
</td>
</tr>

10
includes/admin/post-types/meta-boxes/class-sp-meta-box-list-details.php
View File

@@ -56,9 +56,9 @@ class SP_Meta_Box_List_Details {
</p>
<div class="sp-date-range">
<p class="sp-date-range-absolute">
<input type="text" class="sp-datepicker-from" name="sp_date_from" value="<?php echo $date_from ? $date_from : date_i18n( 'Y-m-d' ); ?>" size="10">
<input type="text" class="sp-datepicker-from" name="sp_date_from" value="<?php echo $date_from ? esc_attr( $date_from ) : date_i18n( 'Y-m-d' ); ?>" size="10">
:
<input type="text" class="sp-datepicker-to" name="sp_date_to" value="<?php echo $date_to ? $date_to : date_i18n( 'Y-m-d' ); ?>" size="10">
<input type="text" class="sp-datepicker-to" name="sp_date_to" value="<?php echo $date_to ? esc_attr( $date_to ) : date_i18n( 'Y-m-d' ); ?>" size="10">
</p>
<p class="sp-date-range-relative">
@@ -106,9 +106,9 @@ class SP_Meta_Box_List_Details {
<select id="sp_nationality" name="sp_nationality[]" data-placeholder="<?php printf( __( 'Select %s', 'sportspress' ), __( 'Nationality', 'sportspress' ) ); ?>" class="widefat chosen-select<?php if ( is_rtl() ): ?> chosen-rtl<?php endif; ?>" multiple="multiple">
<option value=""></option>
<?php foreach ( $continents as $continent => $countries ): ?>
<optgroup label="<?php echo $continent; ?>">
<optgroup label="<?php echo esc_attr( $continent ); ?>">
<?php foreach ( $countries as $code => $country ): ?>
<option value="<?php echo $code; ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo $country; ?></option>
<option value="<?php echo esc_attr( $code ); ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo esc_attr( $country ); ?></option>
<?php endforeach; ?>
</optgroup>
<?php endforeach; ?>
@@ -173,7 +173,7 @@ class SP_Meta_Box_List_Details {
} else {
?>
<p><strong><?php _e( 'Display', 'sportspress' ); ?></strong></p>
<p><input name="sp_number" id="sp_number" type="number" step="1" min="0" class="small-text" placeholder="<?php _e( 'All', 'sportspress' ); ?>" value="<?php echo $number; ?>"> <?php _e( 'players', 'sportspress' ); ?></p>
<p><input name="sp_number" id="sp_number" type="number" step="1" min="0" class="small-text" placeholder="<?php _e( 'All', 'sportspress' ); ?>" value="<?php echo esc_attr( $number ); ?>"> <?php _e( 'players', 'sportspress' ); ?></p>
<?php
}
?>

2
includes/admin/post-types/meta-boxes/class-sp-meta-box-list-format.php
View File

@@ -24,7 +24,7 @@ class SP_Meta_Box_List_Format {
?>
<div id="post-formats-select">
<?php foreach ( SP()->formats->list as $key => $format ): ?>
<input type="radio" name="sp_format" class="post-format" id="post-format-<?php echo $key; ?>" value="<?php echo $key; ?>" <?php checked( true, ( $key == 'list' && ! $the_format ) || $the_format == $key ); ?>> <label for="post-format-<?php echo $key; ?>" class="post-format-icon post-format-<?php echo $key; ?>"><?php echo $format; ?></label><br>
<input type="radio" name="sp_format" class="post-format" id="post-format-<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $key ); ?>" <?php checked( true, ( $key == 'list' && ! $the_format ) || $the_format == $key ); ?>> <label for="post-format-<?php echo esc_attr( $key ); ?>" class="post-format-icon post-format-<?php echo esc_attr( $key ); ?>"><?php echo esc_attr( $format ); ?></label><br>
<?php endforeach; ?>
</div>
<?php

4
includes/admin/post-types/meta-boxes/class-sp-meta-box-metric-details.php
View File

@@ -28,8 +28,8 @@ class SP_Meta_Box_Metric_Details extends SP_Meta_Box_Config {
?>
<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>">
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>">
</p>
<p>
<strong><?php _e( 'Visible', 'sportspress' ); ?></strong>

8
includes/admin/post-types/meta-boxes/class-sp-meta-box-outcome-details.php
View File

@@ -40,17 +40,17 @@ class SP_Meta_Box_Outcome_Details extends SP_Meta_Box_Config {
?>
<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
</p>
<p><strong><?php _e( 'Abbreviation', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_abbreviation" type="text" id="sp_abbreviation" value="<?php echo $abbreviation; ?>" placeholder="<?php echo sp_substr( $post->post_title, 0, 1 ); ?>">
<input name="sp_abbreviation" type="text" id="sp_abbreviation" value="<?php echo esc_attr( $abbreviation ); ?>" placeholder="<?php echo sp_substr( $post->post_title, 0, 1 ); ?>">
</p>
<p><strong><?php _e( 'Color', 'sportspress' ); ?></strong></p>
<p>
<div class="sp-color-box">
<input name="sp_color" id="sp_color" type="text" value="<?php echo $color; ?>" class="colorpick">
<input name="sp_color" id="sp_color" type="text" value="<?php echo esc_attr( $color ); ?>" class="colorpick">
<div id="sp_color" class="colorpickdiv"></div>
</div>
</p>

8
includes/admin/post-types/meta-boxes/class-sp-meta-box-performance-details.php
View File

@@ -55,12 +55,12 @@ class SP_Meta_Box_Performance_Details extends SP_Meta_Box_Config {
?>
<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
</p>
<p><strong><?php _e( 'Singular', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_singular" type="text" id="sp_singular" placeholder="<?php echo $post->post_title; ?>" value="<?php echo $singular; ?>">
<input name="sp_singular" type="text" id="sp_singular" placeholder="<?php echo esc_attr( $post->post_title ); ?>" value="<?php echo esc_attr( $singular ); ?>">
</p>
<p><strong><?php _e( 'Category', 'sportspress' ); ?></strong></p>
<p class="sp-section-selector">
@@ -87,7 +87,7 @@ class SP_Meta_Box_Performance_Details extends SP_Meta_Box_Config {
<div id="sp_precisiondiv">
<p><strong><?php _e( 'Decimal Places', 'sportspress' ); ?></strong></p>
<p>
<input name="sp_precision" type="text" size="4" id="sp_precision" value="<?php echo $precision; ?>" placeholder="0">
<input name="sp_precision" type="text" size="4" id="sp_precision" value="<?php echo esc_attr( $precision ); ?>" placeholder="0">
</p>
</div>
<div id="sp_timeddiv">

2
includes/admin/post-types/meta-boxes/class-sp-meta-box-player-columns.php
View File

@@ -26,7 +26,7 @@ class SP_Meta_Box_Player_Columns {
<?php if ( $tabs ) { ?>
<ul id="sp_column-tabs" class="sp-tab-bar category-tabs">
<?php foreach ( $tabs as $index => $post_type ) { $object = get_post_type_object( $post_type ); ?>
<li class="<?php if ( 0 == $index ) { ?>tabs<?php } ?>"><a href="#<?php echo $post_type; ?>-all"><?php echo $object->labels->menu_name; ?></a></li>
<li class="<?php if ( 0 == $index ) { ?>tabs<?php } ?>"><a href="#<?php echo esc_attr( $post_type ); ?>-all"><?php echo esc_attr( $object->labels->menu_name ); ?></a></li>
<?php } ?>
</ul>
<?php

6
includes/admin/post-types/meta-boxes/class-sp-meta-box-player-details.php
View File

@@ -77,15 +77,15 @@ class SP_Meta_Box_Player_Details {
?>
<p><strong><?php _e( 'Squad Number', 'sportspress' ); ?></strong></p>
<p><input type="text" size="4" id="sp_number" name="sp_number" value="<?php echo $number; ?>"></p>
<p><input type="text" size="4" id="sp_number" name="sp_number" value="<?php echo esc_attr( $number ); ?>"></p>
<p><strong><?php _e( 'Nationality', 'sportspress' ); ?></strong></p>
<p><select id="sp_nationality" name="sp_nationality[]" data-placeholder="<?php printf( __( 'Select %s', 'sportspress' ), __( 'Nationality', 'sportspress' ) ); ?>" class="widefat chosen-select<?php if ( is_rtl() ): ?> chosen-rtl<?php endif; ?>" multiple="multiple">
<option value=""></option>
<?php foreach ( $continents as $continent => $countries ): ?>
<optgroup label="<?php echo $continent; ?>">
<optgroup label="<?php echo esc_attr( $continent ); ?>">
<?php foreach ( $countries as $code => $country ): ?>
<option value="<?php echo $code; ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo $country; ?></option>
<option value="<?php echo esc_attr( $code ); ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo esc_attr( $country ); ?></option>
<?php endforeach; ?>
</optgroup>
<?php endforeach; ?>

4
includes/admin/post-types/meta-boxes/class-sp-meta-box-player-metrics.php
View File

@@ -35,8 +35,8 @@ class SP_Meta_Box_Player_Metrics {
if ( $vars ):
foreach ( $vars as $var ):
?>
<p><strong><?php echo $var->post_title; ?></strong></p>
<p><input type="text" name="sp_metrics[<?php echo $var->post_name; ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
<p><strong><?php echo esc_attr( $var->post_title ); ?></strong></p>
<p><input type="text" name="sp_metrics[<?php echo esc_attr( $var->post_name ); ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
<?php
endforeach;
else: