Skip to content

Commit 8fb0d9d

Browse files
andergmartinsandergmartins
committed
Escape output
1 parent eb6e920 commit 8fb0d9d

File tree

12 files changed

+161
-162
lines changed

12 files changed

+161
-162
lines changed

‎src/core/Classes/Author_Editor.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,10 @@ public static function admin_notices()
619619
if (empty($count)) {
620620
esc_html__('No authors were updated', 'publishpress-authors');
621621
} else {
622-
esc_html(printf(__('Updated %d authors', 'publishpress-authors'), $count)); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
622+
printf(
623+
esc_html__('Updated %d authors', 'publishpress-authors'),
624+
esc_html($count)
625+
);
623626
}
624627

625628
echo '</div>';

‎src/core/Classes/Post_Editor.php

+9-12
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ public static function render_authors_metabox()
209209

210210
$authors = get_multiple_authors();
211211

212-
echo self::get_rendered_authors_selection($authors, false);
212+
echo self::get_rendered_authors_selection($authors, false); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
213213
}
214214

215215
/**
@@ -224,8 +224,7 @@ public static function get_rendered_authors_selection($authors, $showAvatars = t
224224
$classes[] = 'authors-current-user-can-assign';
225225
}
226226
?>
227-
<ul class="<?php
228-
echo(implode(' ', $classes)); ?>">
227+
<ul class="<?php echo esc_attr(implode(' ', $classes)); ?>">
229228
<?php
230229
if (!empty($authors)) {
231230
foreach ($authors as $author) {
@@ -251,7 +250,7 @@ public static function get_rendered_authors_selection($authors, $showAvatars = t
251250
$args['avatar'] = $author->get_avatar(20);
252251
}
253252

254-
echo self::get_rendered_author_partial($args);
253+
echo self::get_rendered_author_partial($args); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
255254
}
256255
}
257256
?>
@@ -271,7 +270,7 @@ class="authors-select2 authors-search"
271270
</select>
272271
<script type="text/html" id="tmpl-authors-author-partial">
273272
<?php
274-
echo self::get_rendered_author_partial(
273+
echo self::get_rendered_author_partial( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
275274
[
276275
'display_name' => '{{ data.display_name }}',
277276
'term' => '{{ data.id }}',
@@ -287,7 +286,7 @@ class="authors-select2 authors-search"
287286
<div id="publishpress-authors-user-author-wrapper">
288287
<hr>
289288
<label for="publishpress-authors-user-author-select"><?php
290-
echo __(
289+
echo esc_html__(
291290
'This option is showing because you do not have a WordPress user selected as an author. For some tasks, it can be helpful to have a user selected here. This user will not be visible on the front of your site.',
292291
'publishpress-authors'
293292
); ?></label>
@@ -298,7 +297,7 @@ class="authors-select2 authors-user-search"
298297
esc_attr_e('Search for an user', 'publishpress-authors'); ?>" style="width: 100%"
299298
name="fallback_author_user">
300299
<option value="<?php echo (int)$post->post_author; ?>">
301-
<?php echo is_object($userAuthor) ? $userAuthor->display_name : ''; ?>
300+
<?php echo is_object($userAuthor) ? esc_html($userAuthor->display_name) : ''; ?>
302301
</option>
303302
</select>
304303
</div>
@@ -333,13 +332,11 @@ private static function get_rendered_author_partial($args = [])
333332
<?php
334333
if (!empty($args['avatar'])) : ?>
335334
<?php
336-
echo $args['avatar']; ?>
335+
echo $args['avatar']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
337336
<?php
338337
endif; ?>
339-
<span class="display-name"><?php
340-
echo wp_kses_post($args['display_name']); ?></span>
341-
<input type="hidden" name="authors[]" value="<?php
342-
echo esc_attr($args['term']); ?>">
338+
<span class="display-name"><?php echo esc_html($args['display_name']); ?></span>
339+
<input type="hidden" name="authors[]" value="<?php echo esc_attr($args['term']); ?>">
343340
</li>
344341
<?php
345342
return ob_get_clean();

‎src/core/Widget.php

+16-16
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,10 @@ public function widget( $args, $instance )
8686
}
8787

8888
if ( ! empty( $output ) ) {
89-
echo $args['before_widget'];
90-
echo $args['before_title'] . apply_filters( 'widget_title', $title ) . $args['after_title'];
91-
echo $output;
92-
echo $args['after_widget'];
89+
echo $args['before_widget']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
90+
echo $args['before_title'] . apply_filters('widget_title', esc_html($title)) . $args['after_title']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
91+
echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
92+
echo $args['after_widget']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
9393
}
9494
}
9595
}
@@ -123,29 +123,29 @@ public function form( $instance )
123123
'layout' => esc_html__( 'Layout', 'publishpress-authors' ),
124124
),
125125
'ids' => array(
126-
'title' => $this->get_field_id( 'title' ),
127-
'title_plural' => $this->get_field_id( 'title_plural' ),
128-
'layout' => $this->get_field_id( 'layout' ),
129-
'nonce' => $this->get_field_id( 'nonce' ),
126+
'title' => esc_html($this->get_field_id( 'title' )),
127+
'title_plural' => esc_html($this->get_field_id( 'title_plural' )),
128+
'layout' => esc_html($this->get_field_id( 'layout' )),
129+
'nonce' => esc_html($this->get_field_id( 'nonce' )),
130130
),
131131
'names' => array(
132-
'title' => $this->get_field_name( 'title' ),
133-
'title_plural' => $this->get_field_name( 'title_plural' ),
134-
'layout' => $this->get_field_name( 'layout' ),
135-
'nonce' => $this->get_field_name( 'nonce' ),
132+
'title' => esc_html($this->get_field_name( 'title' )),
133+
'title_plural' => esc_html($this->get_field_name( 'title_plural' )),
134+
'layout' => esc_html($this->get_field_name( 'layout' )),
135+
'nonce' => esc_html($this->get_field_name( 'nonce' )),
136136
),
137137
'values' => array(
138-
'title' => $titleSingle,
139-
'title_plural' => $titlePlural,
140-
'layout' => $layout,
138+
'title' => esc_html($titleSingle),
139+
'title_plural' => esc_html($titlePlural),
140+
'layout' => esc_html($layout),
141141
'nonce' => wp_create_nonce('pp_multiple_authors_widget_form'),
142142
),
143143
'layouts' => apply_filters( 'pp_multiple_authors_author_layouts', array() ),
144144
);
145145

146146
$container = Factory::get_container();
147147

148-
echo $container['twig']->render( 'widget-form.twig', $context );
148+
echo $container['twig']->render( 'widget-form.twig', $context ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
149149
}
150150

151151
/**

‎src/functions/template-tags.php

+6-6
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,7 @@ function multiple_authors__echo($tag, $type = 'tag', $separators = [], $tag_args
355355
$output .= $separators['after'];
356356

357357
if ($echo) {
358-
echo $output;
358+
echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
359359
}
360360

361361
return $output;
@@ -688,7 +688,7 @@ function get_the_multiple_author_meta($field)
688688
function the_multiple_author_meta($field, $user_id = 0)
689689
{
690690
// TODO: need before after options
691-
echo get_the_multiple_author_meta($field, $user_id);
691+
echo get_the_multiple_author_meta($field, $user_id); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
692692
}
693693
}
694694

@@ -728,7 +728,7 @@ function multiple_authors_wp_list_authors($args = [])
728728
return $return;
729729
}
730730

731-
echo $return;
731+
echo $return; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
732732
}
733733
}
734734

@@ -786,7 +786,7 @@ function multiple_authors_get_avatar($coauthor, $size = 32, $default = '', $alt
786786
*/
787787
function the_authors()
788788
{
789-
echo get_the_authors();
789+
echo get_the_authors(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
790790
}
791791
}
792792

@@ -815,7 +815,7 @@ function ($author) {
815815
*/
816816
function the_authors_posts_links()
817817
{
818-
echo get_the_authors_posts_links();
818+
echo get_the_authors_posts_links(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
819819
}
820820
}
821821

@@ -872,7 +872,7 @@ function ($author) {
872872
*/
873873
function the_authors_links()
874874
{
875-
echo get_the_authors_links();
875+
echo get_the_authors_links(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
876876
}
877877
}
878878

‎src/modules/debug/debug.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ public function renderDebugMetaBox()
129129

130130
echo '<pre><ul>';
131131
foreach ($dataList as $key => $data) {
132-
echo '<li style="border-bottom: 1px solid silver; padding: 5px;">' . $key . ' = ' . print_r($data, true) . '</li>';
132+
echo '<li style="border-bottom: 1px solid silver; padding: 5px;">' . esc_html($key) . ' = ' . esc_html(print_r($data, true)) . '</li>';
133133
}
134134
echo '</ul></pre>';
135135
}

‎src/modules/elementor-integration/Modules/Posts/Skins/PostsSkinCards.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ protected function render_author()
5252
$authorNames[] = $author->display_name;
5353
}
5454

55-
echo apply_filters(
55+
echo apply_filters( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
5656
'publishpress_authors_elementor_posts_skin_cards_byline',
5757
implode(', ', $authorNames),
5858
$authorNames,
@@ -73,9 +73,9 @@ protected function render_avatar()
7373

7474
foreach ($authors as $author) {
7575
if (is_a($author, Author::class)) {
76-
echo $author->get_avatar($avatarSize);
76+
echo $author->get_avatar($avatarSize); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
7777
} elseif (isset($author->ID)) {
78-
echo get_avatar($author->ID, $avatarSize);
78+
echo get_avatar($author->ID, $avatarSize); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
7979
}
8080
}
8181
?>

‎src/modules/elementor-integration/Modules/Posts/Skins/PostsSkinClassic.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ protected function render_author()
5050
$authorNames[] = $author->display_name;
5151
}
5252

53-
echo apply_filters(
53+
echo apply_filters( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
5454
'publishpress_authors_elementor_posts_skin_classic_byline',
5555
implode(', ', $authorNames),
5656
$authorNames,

‎src/modules/modules-settings/modules-settings.php

+19-21
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ public function print_configure_view()
182182
echo '<ul id="publishpress-authors-settings-tabs" class="nav-tab-wrapper">';
183183
foreach ($tabs as $tabLink => $tabLabel) {
184184
echo '<li class="nav-tab ' . ($tabLink === '#ppma-tab-general' ? 'nav-tab-active' : '') . '">';
185-
echo '<a href="' . $tabLink . '">' . $tabLabel . '</a>';
185+
echo '<a href="' . esc_url($tabLink) . '">' . esc_html($tabLabel) . '</a>';
186186
echo '</li>';
187187
}
188188
echo '</ul>';
@@ -203,12 +203,11 @@ public function print_configure_view()
203203
continue;
204204
}
205205

206-
echo sprintf('<h3>%s</h3>', $mod_data->title);
207-
echo sprintf('<p>%s</p>', $mod_data->short_description);
206+
echo sprintf('<h3>%s</h3>', esc_html($mod_data->title));
207+
echo sprintf('<p>%s</p>', esc_html($mod_data->short_description));
208208

209-
echo '<input name="multiple_authors_module_name[]" type="hidden" value="' . esc_attr(
210-
$mod_data->name
211-
) . '" />';
209+
echo '<input name="multiple_authors_module_name[]" type="hidden" value="'
210+
. esc_attr($mod_data->name) . '" />';
212211

213212
$legacyPlugin->$slug->print_configure_view();
214213
}
@@ -228,16 +227,16 @@ public function print_configure_view()
228227

229228
<?php if ($featuresCount > 0) : ?>
230229
<div id="modules-wrapper">
231-
<h3><?php echo __('Features', 'publishpress-authors'); ?></h3>
232-
<p><?php echo __(
230+
<h3><?php echo esc_html__('Features', 'publishpress-authors'); ?></h3>
231+
<p><?php echo esc_html__(
233232
'Feel free to select only the features you need.',
234233
'publishpress-authors'
235234
); ?></p>
236235

237236
<table class="form-table">
238237
<tbody>
239238
<tr>
240-
<th scope="row"><?php echo __(
239+
<th scope="row"><?php echo esc_html__(
241240
'Enabled features',
242241
'publishpress-authors'
243242
); ?></th>
@@ -254,7 +253,7 @@ public function print_configure_view()
254253
$mod_data->slug
255254
); ?>]" <?php echo ($mod_data->options->enabled == 'on') ? "checked=\"checked\"" : ""; ?>
256255
type="checkbox">
257-
&nbsp;&nbsp;&nbsp;<?php echo $mod_data->title; ?>
256+
&nbsp;&nbsp;&nbsp;<?php echo esc_html($mod_data->title); ?>
258257
</label>
259258
<br>
260259
<?php endforeach; ?>
@@ -263,9 +262,8 @@ public function print_configure_view()
263262
</tbody>
264263
</table>
265264

266-
<?php echo '<input name="multiple_authors_module_name[]" type="hidden" value="' . esc_attr(
267-
$this->module->name
268-
) . '" />'; ?>
265+
<?php echo '<input name="multiple_authors_module_name[]" type="hidden" value="'
266+
. esc_attr($this->module->name) . '" />'; ?>
269267
</div>
270268
<?php endif; ?>
271269

@@ -280,16 +278,16 @@ public function print_configure_view()
280278
<?php
281279
$banners = new PublishPress\WordPressBanners\BannersMain;
282280
$banners->pp_display_banner(
283-
__( 'Recommendations for you', 'publishpress-authors' ),
284-
__( 'Showcase your Authors with PublishPress Blocks', 'publishpress-authors' ),
281+
esc_html__( 'Recommendations for you', 'publishpress-authors' ),
282+
esc_html__( 'Showcase your Authors with PublishPress Blocks', 'publishpress-authors' ),
285283
array(
286-
__( 'PublishPress Blocks is a free plugin with full support for PublishPress Authors.', 'publishpress-authors' ),
287-
__( 'Install this plugin to showcase content by your Authors.', 'publishpress-authors' ),
288-
__( 'Use the Content Display block to show your posts in many beautiful layouts.', 'publishpress-authors' ),
289-
__( 'PublishPress Blocks has over 20 extra Gutenberg blocks including accordions, galleries, tables, and more.', 'publishpress-authors' ),
284+
esc_html__( 'PublishPress Blocks is a free plugin with full support for PublishPress Authors.', 'publishpress-authors' ),
285+
esc_html__( 'Install this plugin to showcase content by your Authors.', 'publishpress-authors' ),
286+
esc_html__( 'Use the Content Display block to show your posts in many beautiful layouts.', 'publishpress-authors' ),
287+
esc_html__( 'PublishPress Blocks has over 20 extra Gutenberg blocks including accordions, galleries, tables, and more.', 'publishpress-authors' ),
290288
),
291-
admin_url( 'plugin-install.php?s=publishpress-advg-install&tab=search&type=term' ),
292-
__( 'Click here to install PublishPress Blocks', 'publishpress-authors' ),
289+
esc_url(admin_url( 'plugin-install.php?s=publishpress-advg-install&tab=search&type=term' )),
290+
esc_html__( 'Click here to install PublishPress Blocks', 'publishpress-authors' ),
293291
'install-blocks.jpg'
294292
);
295293
?>

0 commit comments

Comments
 (0)