Changeset 1971315

Timestamp:

11/09/2018 05:25:29 AM (7 years ago)

Author:

rinatkhaziev

Message:

Merge 1.3.2 from GitHub

Location:

frontend-uploader/trunk

Files:

• frontend-uploader.php (modified) (32 diffs)
• lib/js/frontend-uploader.js (modified) (1 diff)
• lib/php/akismet.php (modified) (3 diffs)
• lib/php/class-frontend-uploader-wp-posts-list-table.php (modified) (2 diffs)
• lib/php/class-html-helper.php (modified) (8 diffs)
• lib/php/frontend-uploader-settings.php (modified) (2 diffs)
• lib/php/recaptcha.php (modified) (1 diff)
• lib/php/settings-api/class.settings-api.php (modified) (17 diffs)
• lib/views/manage-ugc-media.tpl.php (modified) (4 diffs)
• lib/views/manage-ugc-posts.tpl.php (modified) (4 diffs)
• readme.txt (modified) (2 diffs)

frontend-uploader/trunk/frontend-uploader.php

@@ -4 +4 @@
 Description: Allow your visitors to upload content and moderate it.
 Author: Rinat Khaziev, Daniel Bachhuber
-Version: 1.3.1
+Version: 1.3.2
 Author URI: http://digitallyconscious.com
 
@@ -26 +26 @@
 
 // Define consts and bootstrap and dependencies
-define( 'FU_VERSION', '1.3.1' );
+define( 'FU_VERSION', '1.3.2' );
 define( 'FU_ROOT' , dirname( __FILE__ ) );
 define( 'FU_FILE_PATH' , FU_ROOT . '/' . basename( __FILE__ ) );
@@ -156 +156 @@
         foreach ( $fu_mime_types as $extension => $details ) {
             // Skip if it's not in the settings
-            if ( !in_array( $extension, $enabled ) )
+            if ( ! in_array( $extension, $enabled, true ) )
                 continue;
 
@@ -199 +199 @@
         global $wp_version;
         if ( version_compare( $wp_version, '3.3', '<' ) ) {
-            wp_die( __( 'Frontend Uploader requires WordPress 3.3 or newer. Please upgrade.', 'frontend-uploader' ) );
+            wp_die( esc_html__( 'Frontend Uploader requires WordPress 3.3 or newer. Please upgrade.', 'frontend-uploader' ) );
         }
 
@@ -230 +230 @@
 
         $screen = get_current_screen();
-        if ( ! defined( 'DOING_AJAX' ) && $screen && isset( $screen->base ) && $screen->base == 'upload' && ( !isset( $_GET['page'] ) || $_GET['page'] != 'manage_frontend_uploader' ) ) {
+        if ( ! defined( 'DOING_AJAX' ) && $screen && isset( $screen->base ) && $screen->base === 'upload' && ( !isset( $_GET['page'] ) || $_GET['page'] !== 'manage_frontend_uploader' ) ) {
             $where = str_replace( "post_status = 'private'", "post_status = 'inherit'", $where );
         }
@@ -242 +242 @@
      */
     function _is_public() {
-        return ( current_user_can( 'read' ) && 'on' == $this->settings['auto_approve_user_files'] ) || ( 'on' == $this->settings['auto_approve_any_files'] );
+        return ( current_user_can( 'read' ) && 'on' === $this->settings['auto_approve_user_files'] ) || ( 'on' === $this->settings['auto_approve_any_files'] );
     }
 
@@ -290 +290 @@
             $typecheck = wp_check_filetype_and_ext( $k['tmp_name'], $k['name'], false );
             // Add an error message if MIME-type is not allowed
-            if ( ! in_array( $typecheck['type'], (array) $this->allowed_mime_types ) ) {
+            if ( ! in_array( $typecheck['type'], (array) $this->allowed_mime_types, true ) ) {
                 $errors['fu-disallowed-mime-type'][] = array( 'name' => $k['name'], 'mime' => $k['type'] );
                 continue;
@@ -323 +323 @@
 
             // Obfuscate filename if setting is present
-            if (  isset( $this->settings['obfuscate_file_name'] ) && 'on' == $this->settings['obfuscate_file_name']  ){
+            if ( isset( $this->settings['obfuscate_file_name'] ) && 'on' === $this->settings['obfuscate_file_name']  ){
                 $fn = explode( '.', $k['name'] );
-                $m['name'] = uniqid( mt_rand( 1, 1000 ) , true ) . '.' . end( $fn );
+                $m['name'] = uniqid( wp_rand( 1, 1000 ) , true ) . '.' . end( $fn );
             }
 
@@ -390 +390 @@
      */
     function wp_kses_add_srcset( $tags, $context ) {
-        if ( $context == 'post' )
+        if ( $context === 'post' )
             $tags['img']['srcset'] = true;
 
@@ -524 +524 @@
         $this->form_fields = !empty( $this->form_fields ) ? $this->form_fields : $this->_get_fields_for_form( $form_post_id, $hash );
 
-        $layout = isset( $_POST['form_layout'] ) && !empty( $_POST['form_layout'] ) ? $_POST['form_layout'] : 'image';
+        $layout = isset( $_POST['form_layout'] ) && ! empty( $_POST['form_layout'] ) ? sanitize_text_field( $_POST['form_layout'] ) : 'image';
 
         /**
@@ -586 +586 @@
     function _notify_admin( $result = array() ) {
         // Email notifications are disabled, or upload has failed, bailing
-        if ( ! ( 'on' == $this->settings['notify_admin'] && $result['success'] ) )
+        if ( ! ( 'on' === $this->settings['notify_admin'] && $result['success'] ) )
             return;
 
@@ -627 +627 @@
         if ( empty( $result ) || !is_array( $result ) ) {
             wp_safe_redirect( wp_get_referer() );
+            exit;
+
             return;
         }
@@ -632 +634 @@
         // Either redirect to success page if it's set and valid
         // Or to referrer
-        $url = isset( $_POST['success_page'] ) && filter_var( $_POST['success_page'], FILTER_VALIDATE_URL ) ? $_POST['success_page'] : wp_get_referer();
+        $url = isset( $_POST['success_page'] ) && filter_var( $_POST['success_page'], FILTER_VALIDATE_URL ) ? esc_url_raw( $_POST['success_page'] ) : wp_get_referer();
 
         // $query_args will hold everything that's needed for displaying notices to user
@@ -688 +690 @@
             include_once FU_ROOT . '/' . $file;
         } else {
-            wp_die( __( "Couldn't find template file", 'frontend-uploader' ) );
+            wp_die( esc_html__( "Couldn't find template file", 'frontend-uploader' ) );
         }
     }
@@ -697 +699 @@
      */
     private function _set_global_query_for_tables( $type = 'posts' ) {
-        if ( ! in_array( $type, array( 'posts', 'media' ) ) )
+        if ( ! in_array( $type, array( 'posts', 'media' ), true ) )
             return false;
 
@@ -752 +754 @@
         add_media_page( __( 'Manage UGC', 'frontend-uploader' ), __( 'Manage UGC', 'frontend-uploader' ), $this->manage_permissions, 'manage_frontend_uploader', array( $this, 'admin_list' ) );
         foreach ( (array) $this->settings['enabled_post_types'] as $cpt ) {
-            if ( $cpt == 'post' ) {
+            if ( $cpt === 'post' ) {
                 add_posts_page( __( 'Manage UGC Posts', 'frontend-uploader' ), __( 'Manage UGC', 'frontend-uploader' ), $this->manage_permissions, 'manage_frontend_uploader_posts', array( $this, 'admin_posts_list' ) );
                 continue;
@@ -773 +775 @@
         }
 
-        $post = get_post( $_GET['id'] );
-
-        if ( is_object( $post ) && $post->post_status == 'private' ) {
+        $post = get_post( (int) $_GET['id'] );
+
+        if ( is_object( $post ) && $post->post_status === 'private' ) {
             $post->post_status = 'inherit';
             wp_update_post( $post );
@@ -803 +805 @@
         }
 
-        $post = get_post( $_GET['id'] );
+        $post = get_post( (int) $_GET['id'] );
 
         if ( is_object( $post ) ) {
@@ -822 +824 @@
                 'page' => "manage_frontend_uploader_{$post->post_type}s",
                 'approved' => 1,
-                'post_type' => $post->post_type != 'post' ? $post->post_type : '',
+                'post_type' => $post->post_type !== 'post' ? $post->post_type : '',
             );
 
@@ -884 +886 @@
         extract( $atts );
 
-        $role = in_array( $role, array( 'meta', 'title', 'description', 'author', 'internal', 'content' ) ) ? $role : 'meta';
+        $role = in_array( $role, array( 'meta', 'title', 'description', 'author', 'internal', 'content' ), true ) ? $role : 'meta';
         $name = sanitize_text_field( $name );
         // Add the field to fields map
@@ -910 +912 @@
         // Allow multiple file upload by default.
         // To do so, we need to add array notation to name field: []
-        if ( !strpos( $name, '[]' ) && $type == 'file' )
+        if ( !strpos( $name, '[]' ) && $type === 'file' )
             $name = 'files' . '[]';
 
@@ -916 +918 @@
 
         // No need for wrappers or labels for hidden input
-        if ( $type == 'hidden' )
+        if ( $type === 'hidden' )
             return $input;
 
@@ -940 +942 @@
 
         // Render WYSIWYG textarea
-        if ( ( isset( $this->settings['wysiwyg_enabled'] ) && 'on' == $this->settings['wysiwyg_enabled'] ) || $wysiwyg_enabled == true ) {
+        if ( ( isset( $this->settings['wysiwyg_enabled'] ) && 'on' === $this->settings['wysiwyg_enabled'] ) || $wysiwyg_enabled === true ) {
             ob_start();
             wp_editor( '', $id, array(
@@ -1085 +1087 @@
         $post_id = (int) $post_id;
 
-        $this->enqueue_scripts();
+        add_action( 'wp_footer', array( $this, 'enqueue_scripts' ), 0 );
 
         $form_layout = in_array( $form_layout, array( 'post', 'image', 'media', 'post_image', 'post_media' ), true ) ? $form_layout : 'media';
@@ -1091 +1093 @@
         ob_start();
 ?>
-    <form action="<?php echo admin_url( 'admin-ajax.php' ) ?>" method="post" id="ugc-media-form-<?php echo $inst++; ?>" class="<?php echo esc_attr( $class )?> fu-upload-form" enctype="multipart/form-data">
+    <form action="<?php echo esc_url( admin_url( 'admin-ajax.php' ) ) ?>" method="post" id="ugc-media-form-<?php echo esc_attr( $inst++ ); ?>" class="<?php echo esc_attr( $class )?> fu-upload-form" enctype="multipart/form-data">
      <div class="ugc-inner-wrapper">
          <h2><?php echo esc_html( $title ) ?></h2>
@@ -1104 +1106 @@
         // Set post type for layouts that include uploading of posts
         // Put it in front of the main form to allow to override it
-        if ( in_array( $form_layout, array( "post_media", "post_image", "post" ) ) ) {
+        if ( in_array( $form_layout, array( "post_media", "post_image", "post" ), true ) ) {
             echo $this->shortcode_content_parser( array(
                     'type' => 'hidden',
@@ -1129 +1131 @@
         }
 
-        if ( !( isset( $this->settings['suppress_default_fields'] ) && 'on' == $this->settings['suppress_default_fields'] ) && ( $suppress_default_fields === false ) ) {
+        if ( !( isset( $this->settings['suppress_default_fields'] ) && 'on' === $this->settings['suppress_default_fields'] ) && ( $suppress_default_fields === false ) ) {
 
             // Display title field
@@ -1179 +1181 @@
             echo do_shortcode( $content );
 
-        if ( !( isset( $this->settings['suppress_default_fields'] ) && 'on' == $this->settings['suppress_default_fields'] ) && ( $suppress_default_fields === false ) ) {
-
-            if ( in_array( $form_layout, array( 'image', 'media', 'post_image', 'post_media' ) ) ) {
+        if ( !( isset( $this->settings['suppress_default_fields'] ) && 'on' === $this->settings['suppress_default_fields'] ) && ( $suppress_default_fields === false ) ) {
+
+            if ( in_array( $form_layout, array( 'image', 'media', 'post_image', 'post_media' ), true ) ) {
                 // Default upload field
                 echo $this->shortcode_content_parser( array(
@@ -1194 +1196 @@
             }
 
-            if ( $this->settings['enable_recaptcha_protection' ] == 'on' )
+            if ( $this->settings['enable_recaptcha_protection' ] === 'on' )
                 echo fu_get_recaptcha_markup();
 
@@ -1236 +1238 @@
             ), null, 'input' );
 
-        if ( in_array( $form_layout, array( 'post_media', 'post_image' ) ) ) {
+        if ( in_array( $form_layout, array( 'post_media', 'post_image' ), true ) ) {
                     // One of supported form layouts
             echo $this->shortcode_content_parser( array(
@@ -1454 +1456 @@
          * Otherwise it produces JS errors, potentially breaking some post edit screen features
          */
-        if ( $screen && 'media_page_manage_frontend_uploader' == $screen->base )
+        if ( $screen && 'media_page_manage_frontend_uploader' === $screen->base )
             wp_enqueue_script( 'media', array( 'jquery' ) );
     }
@@ -1516 +1518 @@
     function _enable_akismet_protection() {
         // Maybe include Akismet
-        if ( isset( $this->settings['enable_akismet_protection'] ) && 'on' == $this->settings['enable_akismet_protection'] ) {
+        if ( isset( $this->settings['enable_akismet_protection'] ) && 'on' === $this->settings['enable_akismet_protection'] ) {
             require_once FU_ROOT . '/lib/php/akismet.php';
         }

frontend-uploader/trunk/lib/js/frontend-uploader.js

@@ -1 @@
-jQuery( function($) {
-    // Drop in _.string
-    _.mixin(s.exports());
-    var uploadForm = $( '.fu-upload-form' );
-    var uploadFormInputs = uploadForm.find('input[type="text"], textarea');
+jQuery(function ($) {
+  // Drop in _.string
+  _.mixin(s.exports());
+  var uploadForm = $('.fu-upload-form');
+  var uploadFormInputs = uploadForm.find('input[type="text"], textarea');
+  _.each( uploadForm, function (f, i) {
+    $(f).validate({
+      submitHandler: function (form) {
+        form.submit();
+      }
+    })
+  });
 
-    uploadForm.validate({
-        submitHandler: function(form) {
-        form.submit();
-        }
-    });
+  /**
+   * Only set the fields if an error happened
+   * @return {[type]} [description]
+   */
+  var shouldPopulate = function () {
+    var qv = getQueryVariable('response');
+    return false === (qv == '' || qv == 'fu-sent' || qv == 'fu-post-sent');
+  };
 
-    /**
-     * Only set the fields if an error happened
-     * @return {[type]} [description]
-     */
-    var shouldPopulate = function() {
-        var qv = getQueryVariable('response');
-        return false === ( qv == '' || qv == 'fu-sent' || qv == 'fu-post-sent' );
-    };
+  /**
+   * Extract needed var from location.search
+   * @param  {[type]} variable [description]
+   * @return {[type]}          [description]
+   */
+  var getQueryVariable = function (variable) {
+    var query = window.location.search.substring(1);
+    var vars = query.split('&');
+    for (var i = 0; i < vars.length; i++) {
+      var pair = vars[i].split('=');
+      if (decodeURIComponent(pair[0]) == variable) {
+        return decodeURIComponent(pair[1]);
+      }
+    }
 
-    /**
-     * Extract needed var from location.search
-     * @param  {[type]} variable [description]
-     * @return {[type]}          [description]
-     */
-    var getQueryVariable = function (variable) {
-        var query = window.location.search.substring(1);
-        var vars = query.split('&');
-        for (var i = 0; i < vars.length; i++) {
-            var pair = vars[i].split('=');
-            if (decodeURIComponent(pair[0]) == variable) {
-                return decodeURIComponent(pair[1]);
-            }
-        }
+    return '';
+  }
 
-        return '';
-    }
+  // Strip all tags and escape HTML
+  var sanitize = function (str) {
+    return _.escapeHTML(_.stripTags(str));
+  };
 
-    // Strip all tags and escape HTML
-    var sanitize = function( str ) {
-        return _.escapeHTML( _.stripTags( str ) );
-    };
+  /**
+   * Iterate over form text inputs and textareas and either populate value or remove it from local storage
+   * @param  {[type]} value [description]
+   * @param  {[type]} key   [description]
+   * @param  {[type]} list
+   * @return {[type]}       [description]
+   */
+  _.each(uploadFormInputs, function (value, key, list) {
+    var lsKey = $(value).prop('id') + ':value';
+    if (shouldPopulate()) {
+      $(value).val(sanitize(localStorage.getItem(lsKey)));
+    } else {
+      localStorage.removeItem(lsKey);
+    }
+  });
 
-    /**
-     * Iterate over form text inputs and textareas and either populate value or remove it from local storage
-     * @param  {[type]} value [description]
-     * @param  {[type]} key   [description]
-     * @param  {[type]} list  )             {       var lsKey [description]
-     * @return {[type]}       [description]
-     */
-    _.each( uploadFormInputs, function( value, key, list ) {
-        var lsKey = $(value).prop('id') + ':value';
-        if ( shouldPopulate() ) {
-            $(value).val( sanitize( localStorage.getItem( lsKey ) ) );
-        } else {
-            localStorage.removeItem( lsKey );
-        }
-    });
+  /**
+   * Store input value in localStorage
+   */
+  uploadFormInputs.on('change keyup focusin focusout', function (e) {
+    var el = $(e.target);
 
-    /**
-     * Store input value in localStorage
-     */
-    uploadFormInputs.on( "change keyup focusin focusout", function( e ) {
-        var el = $(e.target);
+    var key = el.prop('id') + ':value';
 
-        var key = el.prop('id') + ':value';
+    // you can never be too safe
+    var val = sanitize(el.val());
 
-        // you can never be too safe
-        var val = sanitize( el.val() );
-
-        localStorage.setItem( key, val );
-    });
+    localStorage.setItem(key, val);
+  });
 
 });

frontend-uploader/trunk/lib/php/akismet.php

@@ -18 +18 @@
 
     $content['comment_author'] = isset( $_POST['post_author'] ) ? sanitize_text_field( $_POST['post_author'] ) : null;
-    $content['comment_content'] = isset( $_POST[ 'post_content' ] ) ? $_POST['post_content'] : null;
+    $content['comment_content'] = isset( $_POST[ 'post_content' ] ) ? wp_kses_post( $_POST['post_content'] ) : null;
 
     // Permalink of the post with upload form, fallback to wp_get_referer()
     // Fallback is used to
-    $content['permalink'] = isset( $_POST['form_post_id'] ) ? get_permalink( $_POST['form_post_id'] ) : wp_get_referer();
+    $content['permalink'] = isset( $_POST['form_post_id'] ) ? get_permalink( sanitize_text_area( $_POST['form_post_id'] ) ) : wp_get_referer();
 
     // Set required Akismet values
-    $content['user_ip'] = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : null;
-    $content['user_agent'] = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : null;
-    $content['referrer'] = isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : null;
+    $content['user_ip'] = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( $_SERVER['REMOTE_ADDR'] ) : null;
+    $content['user_agent'] = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ) : null;
+    $content['referrer'] = isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( $_SERVER['HTTP_REFERER'] ) : null;
     $content['blog'] = get_option( 'home' );
     $content['blog_lang']    = get_locale();
@@ -36 +36 @@
     $ignore = array( 'HTTP_COOKIE', 'HTTP_COOKIE2', 'PHP_AUTH_PW', 'ff', 'fu_nonce' );
     foreach ( $_POST as $key => $value ) {
-        if ( !in_array( $key, $ignore ) && is_string( $value ) )
+        if ( ! in_array( $key, $ignore, true ) && is_string( $value ) )
             $content["POST_{$key}"] = $value;
     }
 
     foreach ( $_SERVER as $key => $value ) {
-        if ( !in_array( $key, $ignore ) && is_string( $value ) )
+        if ( ! in_array( $key, $ignore, true ) && is_string( $value ) )
             $content["$key"] = $value;
         else
@@ -52 +52 @@
 
     // It's a spam
-    if ( $response[1] == 'true' )
+    if ( $response[1] === 'true' )
         $should_process = false;
 

frontend-uploader/trunk/lib/php/class-frontend-uploader-wp-posts-list-table.php

@@ -10 +10 @@
 
         $screen = get_current_screen();
-        if ( $screen->post_type == '' ) {
+        if ( $screen->post_type === '' ) {
             $screen->post_type ='post';
         }
@@ -21 +21 @@
     function _add_row_actions( $actions, $post ) {
         unset( $actions['inline hide-if-no-js'] );
-        if ( $post->post_status == 'private' ) {
+        if ( $post->post_status === 'private' ) {
             $actions['pass'] = '<a href="'.admin_url( 'admin-ajax.php' ).'?action=approve_ugc_post&id=' . $post->ID . '&post_type=' . $post->post_type . '">'. __( 'Approve', 'frontend-uploader' ) .'</a>';
             $actions['delete'] = '<a onclick="return showNotice.warn();" href="'.admin_url( 'admin-ajax.php' ).'?action=delete_ugc&id=' . $post->ID . '&post_type=' . $post->post_type . '&fu_nonce=' . wp_create_nonce( FU_NONCE ). '">'. __( 'Delete Permanently', 'frontend-uploader' ) .'</a>';

frontend-uploader/trunk/lib/php/class-html-helper.php

@@ -20 +20 @@
      */
     function checkboxes( $name = '', $description = '', $data = array(), $checked = array() ) {
-        if ( $name != '' ) {
+        if ( $name !== '' ) {
             $name = filter_var( $name, FILTER_SANITIZE_STRING );
             if ( $description );
@@ -26 +26 @@
             echo '<input type="hidden" name="' . esc_attr( $name ) .'" value="" />';
             foreach ( (array) $data as $item ) {
-                $is_checked_attr =  in_array( $item, (array) $checked ) ? ' checked="true" ' : '';
+                $is_checked_attr =  in_array( $item, (array) $checked, true ) ? ' checked="true" ' : '';
                 $item = filter_var( $item, FILTER_SANITIZE_STRING );
                 echo '<div class="sm-input-wrapper">';
-                echo '<input type="checkbox" name="' . esc_attr( $name ) . '[]" value="' . esc_attr( $item ) . '" id="' .esc_attr( $name ) . esc_attr( $item )  . '" ' . $is_checked_attr . ' />';
+                echo '<input type="checkbox" name="' . esc_attr( $name ) . '[]" value="' . esc_attr( $item ) . '" id="' .esc_attr( $name ) . esc_attr( $item )  . '" ' . esc_attr( $is_checked_attr ) . ' />';
                 echo '<label for="' .esc_attr( $name ) . esc_attr( $item )  . '">' . esc_attr ( $item ) . '</label>';
                 echo '</div>';
@@ -77 +77 @@
         case 'file':
         case 'checkbox':
+        case 'email':
+        case 'date':
+        case 'datetime':
+        case 'datetime-local':
+        case 'color':
+        case 'month':
+        case 'number':
+        case 'password':
+        case 'range':
+        case 'search':
+        case 'reset':
+        case 'button':
+        case 'tel':
+        case 'time':
+        case 'url':
+        case 'week':
             return $this->_text( $name, $type,  $data, $attrs ) ;
             break;
@@ -106 +122 @@
         foreach ( (array) $data as $key => $value ) {
             $attrs_to_pass = array( 'value' => $key );
-            if ( isset( $attrs[ 'default' ] ) && $key == $attrs[ 'default' ] )
+            if ( isset( $attrs[ 'default' ] ) && $key === $attrs[ 'default' ] )
                 $attrs_to_pass[ 'selected' ] = 'selected';
             $ret .= $this->element( 'option', $value, $attrs_to_pass, false );
@@ -146 +162 @@
         $allowed = apply_filters( 'hh_allowed_html_elements' , array( 'div', 'p', 'span', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'td', 'option', 'label', 'textarea', 'select', 'option', 'fieldset' ) );
         $attr_string = $this->_format_attributes( $params );
-        if ( in_array( $tag, $allowed ) )
+        if ( in_array( $tag, $allowed, true ) )
             return "<{$tag} {$attr_string}>" . ( $escape ? esc_html ( $content ) : $content ) . "</{$tag}>";
     }
@@ -165 +181 @@
 
         foreach ( (array) $attrs as $attr => $value ) {
-            if ( in_array( $attr, $this->_allowed_html_attrs() ) && $value != '' )
+            if ( in_array( $attr, $this->_allowed_html_attrs(), true ) && $value !== '' )
                 $attr_string .= " {$attr}='" . esc_attr ( $value ) . "'";
         }
@@ -182 +198 @@
         $attr_string = $this->_format_attributes( $params );
         if ( filter_var( trim( $url ), FILTER_VALIDATE_URL ) )
-            return '<a href="' . esc_url( trim( $url ) ) . '" ' . $attr_string . '>' . ( $title != '' ? esc_html ( $title ) : esc_url( trim( $url ) ) ) . '</a>';
+            return '<a href="' . esc_url( trim( $url ) ) . '" ' . $attr_string . '>' . ( $title !== '' ? esc_html ( $title ) : esc_url( trim( $url ) ) ) . '</a>';
     }
 
@@ -211 +227 @@
             'max',
             'placeholder',
-
         ) );
     }

frontend-uploader/trunk/lib/php/frontend-uploader-settings.php

@@ -20 +20 @@
     function action_current_screen() {
         $screen = get_current_screen();
-        if ( in_array( $screen->base, array( 'settings_page_fu_settings', 'options' ) ) ) {
+        if ( in_array( $screen->base, array( 'settings_page_fu_settings', 'options' ), true ) ) {
             $this->settings_api->set_sections( $this->get_settings_sections() );
             $this->settings_api->set_fields( $this->get_settings_fields() );
@@ -35 +35 @@
         $fu_public_post_types = get_post_types( array( 'public' => true ), 'objects' );
         foreach( $fu_public_post_types as $slug => $post_object ) {
-            if ( $slug == 'attachment' ) {
+            if ( $slug === 'attachment' ) {
                 unset( $fu_public_post_types[$slug] );
                 continue;

frontend-uploader/trunk/lib/php/recaptcha.php

@@ -21 +21 @@
             'secret' => fu_get_option( 'recaptcha_secret_key' ),
             'response' => sanitize_text_field( $_POST['g-recaptcha-response'] ),
-            'remoteip' => $_SERVER['REMOTE_ADDR']
+            'remoteip' => sanitize_text_field( $_SERVER['REMOTE_ADDR'] )
         ),
         'timeout' => 3,

frontend-uploader/trunk/lib/php/settings-api/class.settings-api.php

@@ -103 +103 @@
         //register settings sections
         foreach ( $this->settings_sections as $section ) {
-            if ( false == get_option( $section['id'] ) ) {
+            if ( false === get_option( $section['id'] ) ) {
                 add_option( $section['id'] );
             }
@@ -143 +143 @@
     function callback_text( $args ) {
 
-        $value = esc_attr( $this->get_option( $args['id'], $args['section'], $args['std'] ) );
+        $value = $this->get_option( $args['id'], $args['section'], $args['std'] );
         $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : 'regular';
 
-        $html = sprintf( '<input type="text" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', $size, $args['section'], $args['id'], $value );
-        $html .= sprintf( '<span class="description"> %s</span>', $args['desc'] );
+        $html = sprintf( '<input type="text" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', esc_attr( $size ), esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $value ) );
+        $html .= sprintf( '<span class="description"> %s</span>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -159 +159 @@
     function callback_checkbox( $args ) {
 
-        $value = esc_attr( $this->get_option( $args['id'], $args['section'], $args['std'] ) );
-
-        $html = sprintf( '<input type="hidden" name="%1$s[%2$s]" value="off" />', $args['section'], $args['id'] );
-        $html .= sprintf( '<input type="checkbox" class="checkbox" id="%1$s[%2$s]" name="%1$s[%2$s]" value="on"%4$s />', $args['section'], $args['id'], $value, checked( $value, 'on', false ) );
-        $html .= sprintf( '<label for="%1$s[%2$s]"> %3$s</label>', $args['section'], $args['id'], $args['desc'] );
+        $value = $this->get_option( $args['id'], $args['section'], $args['std'] );
+
+        $html = sprintf( '<input type="hidden" name="%1$s[%2$s]" value="off" />', esc_attr( $args['section'] ), esc_attr( $args['id'] ) );
+        $html .= sprintf( '<input type="checkbox" class="checkbox" id="%1$s[%2$s]" name="%1$s[%2$s]" value="on"%4$s />', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $value ), checked( $value, 'on', false ) );
+        $html .= sprintf( '<label for="%1$s[%2$s]"> %3$s</label>', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_html( $args['desc'] ) );
 
         echo $html;
@@ -180 +180 @@
         foreach ( $args['options'] as $key => $label ) {
             $checked = isset( $value[$key] ) ? $value[$key] : '0';
-            $html .= sprintf( '<input type="checkbox" class="checkbox" id="%1$s[%2$s][%3$s]" name="%1$s[%2$s][%3$s]" value="%3$s"%4$s />', $args['section'], $args['id'], $key, checked( $checked, $key, false ) );
-            $html .= sprintf( '<label for="%1$s[%2$s][%4$s]"> %3$s</label><br>', $args['section'], $args['id'], $label, $key );
-        }
-        $html .= sprintf( '<span class="description"> %s</label>', $args['desc'] );
+            $html .= sprintf( '<input type="checkbox" class="checkbox" id="%1$s[%2$s][%3$s]" name="%1$s[%2$s][%3$s]" value="%3$s"%4$s />', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $key ), checked( $checked, $key, false ) );
+            $html .= sprintf( '<label for="%1$s[%2$s][%4$s]"> %3$s</label><br>', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_html( $label ), esc_attr( $key ) );
+        }
+        $html .= sprintf( '<span class="description"> %s</label>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -199 +199 @@
         $html = '';
         foreach ( $args['options'] as $key => $label ) {
-            $html .= sprintf( '<input type="radio" class="radio" id="%1$s[%2$s][%3$s]" name="%1$s[%2$s]" value="%3$s"%4$s />', $args['section'], $args['id'], $key, checked( $value, $key, false ) );
-            $html .= sprintf( '<label for="%1$s[%2$s][%4$s]"> %3$s</label><br>', $args['section'], $args['id'], $label, $key );
-        }
-        $html .= sprintf( '<span class="description"> %s</label>', $args['desc'] );
+            $html .= sprintf( '<input type="radio" class="radio" id="%1$s[%2$s][%3$s]" name="%1$s[%2$s]" value="%3$s"%4$s />', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $key ), checked( $value, $key, false ) );
+            $html .= sprintf( '<label for="%1$s[%2$s][%4$s]"> %3$s</label><br>', esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_html( $label ), esc_attr( $key ) );
+        }
+        $html .= sprintf( '<span class="description"> %s</label>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -214 +214 @@
     function callback_select( $args ) {
 
-        $value = esc_attr( $this->get_option( $args['id'], $args['section'], $args['std'] ) );
+        $value = $this->get_option( $args['id'], $args['section'], $args['std'] );
         $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : 'regular';
 
-        $html = sprintf( '<select class="%1$s" name="%2$s[%3$s]" id="%2$s[%3$s]">', $size, $args['section'], $args['id'] );
+        $html = sprintf( '<select class="%1$s" name="%2$s[%3$s]" id="%2$s[%3$s]">', esc_attr( $size ), esc_attr( $args['section'] ), esc_attr( $args['id'] ) );
         foreach ( $args['options'] as $key => $label ) {
-            $html .= sprintf( '<option value="%s"%s>%s</option>', $key, selected( $value, $key, false ), $label );
+            $html .= sprintf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $value, $key, false ), esc_html( $label ) );
         }
         $html .= sprintf( '</select>' );
-        $html .= sprintf( '<span class="description"> %s</span>', $args['desc'] );
+        $html .= sprintf( '<span class="description"> %s</span>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -234 +234 @@
     function callback_textarea( $args ) {
 
-        $value = esc_textarea( $this->get_option( $args['id'], $args['section'], $args['std'] ) );
+        $value = $this->get_option( $args['id'], $args['section'], $args['std'] );
         $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : 'regular';
 
-        $html = sprintf( '<textarea rows="5" cols="55" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]">%4$s</textarea>', $size, $args['section'], $args['id'], $value );
-        $html .= sprintf( '<br><span class="description"> %s</span>', $args['desc'] );
+        $html = sprintf( '<textarea rows="5" cols="55" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]">%4$s</textarea>', esc_attr( $size ), esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_textarea( $value ) );
+        $html .= sprintf( '<br><span class="description"> %s</span>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -249 +249 @@
      */
     function callback_html( $args ) {
-        echo $args['desc'];
+        echo esc_textarea( $args['desc'] );
     }
 
@@ -262 +262 @@
         $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : '500px';
 
-        echo '<div style="width: ' . $size . ';">';
+        echo '<div style="width: ' . esc_attr( $size ) . ';">';
 
         wp_editor( $value, $args['section'] . '[' . $args['id'] . ']', array( 'teeny' => true, 'textarea_rows' => 10 ) );
@@ -268 +268 @@
         echo '</div>';
 
-        echo sprintf( '<br><span class="description"> %s</span>', $args['desc'] );
+        echo sprintf( '<br><span class="description"> %s</span>', esc_html( $args['desc'] ) );
     }
 
@@ -282 +282 @@
         $id = $args['section']  . '[' . $args['id'] . ']';
         $js_id = $args['section']  . '\\\\[' . $args['id'] . '\\\\]';
-        $html = sprintf( '<input type="text" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', $size, $args['section'], $args['id'], $value );
-        $html .= '<input type="button" class="button wpsf-browse" id="'. $id .'_button" value="Browse" />
+        $html = sprintf( '<input type="text" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', esc_attr( $size ), esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $value ) );
+        $html .= '<input type="button" class="button wpsf-browse" id="'. esc_attr( $id ) .'_button" value="Browse" />
         <script type="text/javascript">
         jQuery(document).ready(function($){
-            $("#'. $js_id .'_button").click(function() {
+            $("#'. wp_json_encode( $js_id ) .'_button").click(function() {
                 tb_show("", "media-upload.php?post_id=0&amp;type=image&amp;TB_iframe=true");
                 window.original_send_to_editor = window.send_to_editor;
@@ -294 +294 @@
                     url = $(html).attr(\'src\');
                 };
-                $("#'. $js_id .'").val(url);
+                $("#'. wp_json_encode( $js_id ) .'").val(url);
                 tb_remove();
                 window.send_to_editor = window.original_send_to_editor;
@@ -302 +302 @@
         });
         </script>';
-        $html .= sprintf( '<span class="description"> %s</span>', $args['desc'] );
+        $html .= sprintf( '<span class="description"> %s</span>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -317 +317 @@
         $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : 'regular';
 
-        $html = sprintf( '<input type="password" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', $size, $args['section'], $args['id'], $value );
-        $html .= sprintf( '<span class="description"> %s</span>', $args['desc'] );
+        $html = sprintf( '<input type="password" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/>', esc_attr( $size ), esc_attr( $args['section'] ), esc_attr( $args['id'] ), esc_attr( $value ) );
+        $html .= sprintf( '<span class="description"> %s</span>', esc_html( $args['desc'] ) );
 
         echo $html;
@@ -358 +358 @@
         foreach( $this->settings_fields as $section => $options ) {
             foreach ( $options as $option ) {
-                if ( $option['name'] != $slug )
+                if ( $option['name'] !== $slug )
                     continue;
                 // Return the callback name 
@@ -395 +395 @@
 
         foreach ( $this->settings_sections as $tab ) {
-            $html .= sprintf( '<a href="#%1$s" class="nav-tab" id="%1$s-tab">%2$s</a>', $tab['id'], $tab['title'] );
+            $html .= sprintf( '<a href="#%1$s" class="nav-tab" id="%1$s-tab">%2$s</a>', esc_attr( esc_url( $tab['id'] ) ), esc_html( $tab['title'] ) );
         }
 
@@ -413 +413 @@
             <div class="postbox">
                 <?php foreach ( $this->settings_sections as $form ) { ?>
-                    <div id="<?php echo $form['id']; ?>" class="group inside">
+                    <div id="<?php echo esc_attr( $form['id'] ); ?>" class="group inside">
                         <form method="post" action="options.php">
 

frontend-uploader/trunk/lib/views/manage-ugc-media.tpl.php

@@ -3 +3 @@
 set_current_screen( 'upload' );
 if ( ! current_user_can( 'upload_files' ) )
-    wp_die( __( 'You do not have permission to upload files.', 'frontend-uploader' ) );
+    wp_die( esc_html__( 'You do not have permission to upload files.', 'frontend-uploader' ) );
 
 $wp_list_table = new FU_WP_Media_List_Table();
@@ -12 +12 @@
 ?>
 <div class="wrap">
-<?php screen_icon(); ?>
 <h2><?php echo esc_html( $title ); ?> <?php
 if ( isset( $_REQUEST['s'] ) && $_REQUEST['s'] )
-    printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;', 'frontend-uploader' ) . '</span>', get_search_query() ); ?>
+    printf( '<span class="subtitle">' . esc_html__( 'Search results for &#8220;%s&#8221;', 'frontend-uploader' ) . '</span>', get_search_query() ); ?>
 </h2>
 
@@ -38 +37 @@
 if ( isset( $_GET['trashed'] ) && (int) $_GET['trashed'] ) {
     $message = sprintf( _n( 'Media attachment moved to the trash.', '%d media attachments moved to the trash.', $_GET['trashed'] ), number_format_i18n( $_GET['trashed'] ) );
-    $message .= ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? $_GET['ids'] : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
+    $message .= ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? sanitize_text_field( $_GET['ids'] ) : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'trashed' ), $_SERVER['REQUEST_URI'] );
 }
 
 if ( isset( $_GET['untrashed'] ) && (int) $_GET['untrashed'] ) {
-    $message = sprintf( _n( 'Media attachment restored from the trash.', '%d media attachments restored from the trash.', $_GET['untrashed'] ), number_format_i18n( $_GET['untrashed'] ) );
+    $message = sprintf( _n( 'Media attachment restored from the trash.', '%d media attachments restored from the trash.', sanitize_text_field( $_GET['untrashed'] ) ), number_format_i18n( $_GET['untrashed'] ) );
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'untrashed' ), $_SERVER['REQUEST_URI'] );
 }
@@ -54 +53 @@
 $messages[2] = __( 'Media permanently deleted.', 'frontend-uploader' );
 $messages[3] = __( 'Error saving media attachment.', 'frontend-uploader' );
-$messages[4] = __( 'Media moved to the trash.', 'frontend-uploader' ) . ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? $_GET['ids'] : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
+$messages[4] = __( 'Media moved to the trash.', 'frontend-uploader' ) . ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? sanitize_text_field( $_GET['ids'] ) : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
 $messages[5] = __( 'Media restored from the trash.', 'frontend-uploader' );
 
 if ( isset( $_GET['message'] ) && (int) $_GET['message'] ) {
-    $message = $messages[$_GET['message']];
+    $message = $messages[ sanitize_text_field( $_GET['message'] ) ];
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'message' ), $_SERVER['REQUEST_URI'] );
 }

frontend-uploader/trunk/lib/views/manage-ugc-posts.tpl.php

@@ -2 +2 @@
 $title = __( 'Manage UGC Posts', 'frontend-uploader' );
 if ( ! current_user_can( 'publish_posts' ) )
-    wp_die( __( 'You do not have permission to publish posts.', 'frontend-uploader' ) );
+    wp_die( esc_html__( 'You do not have permission to publish posts.', 'frontend-uploader' ) );
 
 $wp_post_list_table = new FU_WP_Posts_List_Table();
@@ -11 +11 @@
 
 <div class="wrap">
-<?php screen_icon(); ?>
 <h2><?php echo esc_html( $title ); ?><?php
 if ( isset( $_REQUEST['s'] ) && $_REQUEST['s'] )
-    printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;', 'frontend-uploader' ) . '</span>', get_search_query() ); ?>
+    printf( '<span class="subtitle">' . esc_html__( 'Search results for &#8220;%s&#8221;', 'frontend-uploader' ) . '</span>', get_search_query() ); ?>
 </h2>
 
@@ -36 +35 @@
 
 if ( isset( $_GET['trashed'] ) && (int) $_GET['trashed'] ) {
-    $message = sprintf( _n( 'Post moved to the trash.', '%d Posts moved to the trash.', $_GET['trashed'] ), number_format_i18n( $_GET['trashed'] ) );
-    $message .= ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? $_GET['ids'] : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
+    $message = sprintf( _n( 'Post moved to the trash.', '%d Posts moved to the trash.', sanitize_text_field( $_GET['trashed'] ) ), number_format_i18n( $_GET['trashed'] ) );
+    $message .= ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? sanitize_text_field( $_GET['ids'] ) : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'trashed' ), $_SERVER['REQUEST_URI'] );
 }
 
 if ( isset( $_GET['untrashed'] ) && (int) $_GET['untrashed'] ) {
-    $message = sprintf( _n( 'Post restored from the trash.', '%d Posts restored from the trash.', $_GET['untrashed'] ), number_format_i18n( $_GET['untrashed'] ) );
+    $message = sprintf( _n( 'Post restored from the trash.', '%d Posts restored from the trash.', sanitize_text_field( $_GET['untrashed'] ) ), number_format_i18n( $_GET['untrashed'] ) );
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'untrashed' ), $_SERVER['REQUEST_URI'] );
 }
@@ -53 +52 @@
 $messages[2] = __( 'Media permanently deleted.', 'frontend-uploader' );
 $messages[3] = __( 'Error saving Post.', 'frontend-uploader' );
-$messages[4] = __( 'Media moved to the trash.', 'frontend-uploader' ) . ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? $_GET['ids'] : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
+$messages[4] = __( 'Media moved to the trash.', 'frontend-uploader' ) . ' <a href="' . esc_url( wp_nonce_url( 'upload.php?doaction=undo&action=untrash&ids='.( isset( $_GET['ids'] ) ? sanitize_text_field( $_GET['ids'] ) : '' ), "bulk-media" ) ) . '">' . __( 'Undo', 'frontend-uploader' ) . '</a>';
 $messages[5] = __( 'Media restored from the trash.', 'frontend-uploader' );
 
 if ( isset( $_GET['message'] ) && (int) $_GET['message'] ) {
-    $message = $messages[$_GET['message']];
+    $message = $messages[ sanitize_text_field( $_GET['message'] ) ];
     $_SERVER['REQUEST_URI'] = remove_query_arg( array( 'message' ), $_SERVER['REQUEST_URI'] );
 }
 
 if ( !empty( $message ) ) { ?>
-<div id="message" class="updated"><p><?php echo $message; ?></p></div>
+<div id="message" class="updated"><p><?php echo esc_html( $message ); ?></p></div>
 <?php } ?>
 

frontend-uploader/trunk/readme.txt

@@ -4 +4 @@
 Tags: frontend, image, images, media, uploader, upload, video, audio, photo, photos, picture, pictures, file, user generated content, ugc, frontend upload
 Requires at least: 4.1
-Tested up to: 4.8.2
-Stable tag: 1.3.1
+Tested up to: 5.0
+Stable tag: 1.3.2
 License: GPLv2 or later
 
@@ -341 +341 @@
 == Changelog ==
 
+= 1.3.2 (Nov 2, 2018) =
+* Bugfix: allow multiple forms to be properly validated if they're rendered on the same page.
+* Feature: add support for all HTML5 input types
+
 = 1.3.1 (Sep 21, 2017) =
 * Bugfix: fix blank page in Manage UGC on Windows machines