Changeset 2617885

Timestamp:

10/21/2021 03:41:50 PM (4 years ago)

Author:

mmuro

Message:

Escape additional values

Location:

visual-form-builder/trunk/admin

Files:

• class-ajax.php (modified) (1 diff)
• class-entries-detail.php (modified) (2 diffs)
• class-media-button.php (modified) (2 diffs)

visual-form-builder/trunk/admin/class-ajax.php

@@ -67 +67 @@
         $form_id    = absint( $data['form_id'] );
         $field_key  = sanitize_title( $_POST['field_type'] );
-        $field_name = esc_html( $_POST['field_type'] );
+        $field_name = sanitize_text_field( $_POST['field_type'] );
         $field_type = strtolower( sanitize_title( $_POST['field_type'] ) );
 

visual-form-builder/trunk/admin/class-entries-detail.php

@@ -29 +29 @@
 ?>
             <form id="entry-edit" method="post" action="">
-            <h3><span><?php echo stripslashes( $entry->form_title ); ?> : <?php echo __( 'Entry' , 'visual-form-builder'); ?> # <?php echo $entry->entries_id; ?></span></h3>
+            <h3><span><?php echo stripslashes( $entry->form_title ); ?> : <?php _e( 'Entry' , 'visual-form-builder'); ?> # <?php echo $entry->entries_id; ?></span></h3>
             <div id="vfb-poststuff" class="metabox-holder has-right-sidebar">
                 <div id="side-info-column" class="inner-sidebar">
@@ -40 +40 @@
                                     <div id="misc-publishing-actions">
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo  __( 'Form Title' , 'visual-form-builder'); ?>: </strong><?php echo stripslashes( $entry->form_title ); ?></span>
+                                            <span><strong><?php _e( 'Form Title' , 'visual-form-builder'); ?>: </strong><?php echo esc_html( $entry->form_title ); ?></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo  __( 'Date Submitted' , 'visual-form-builder'); ?>: </strong><?php echo date( "$date_format $time_format", strtotime( $entry->date_submitted ) ); ?></span>
+                                            <span><strong><?php _e( 'Date Submitted' , 'visual-form-builder'); ?>: </strong><?php echo esc_html( date( "$date_format $time_format", strtotime( $entry->date_submitted ) ) ); ?></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo __( 'IP Address' , 'visual-form-builder'); ?>: </strong><?php echo $entry->ip_address; ?></span>
+                                            <span><strong><?php _e( 'IP Address' , 'visual-form-builder'); ?>: </strong><?php echo esc_html( $entry->ip_address ); ?></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo __( 'Email Subject' , 'visual-form-builder'); ?>: </strong><?php echo stripslashes( $entry->subject ); ?></span>
+                                            <span><strong><?php _e( 'Email Subject' , 'visual-form-builder'); ?>: </strong><?php echo esc_html( $entry->subject ); ?></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo __( 'Sender Name' , 'visual-form-builder'); ?>: </strong><?php echo stripslashes( $entry->sender_name ); ?></span>
+                                            <span><strong><?php _e( 'Sender Name' , 'visual-form-builder'); ?>: </strong><?php echo esc_html( $entry->sender_name ); ?></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo __( 'Sender Email' , 'visual-form-builder'); ?>: </strong><a href="mailto:<?php echo stripslashes( $entry->sender_email ); ?>"><?php echo stripslashes( $entry->sender_email ); ?></a></span>
+                                            <span><strong><?php _e( 'Sender Email' , 'visual-form-builder'); ?>: </strong><a href="mailto:<?php echo esc_html( $entry->sender_email ); ?>"><?php echo esc_html( $entry->sender_email ); ?></a></span>
                                         </div>
                                         <div class="misc-pub-section">
-                                            <span><strong><?php echo __( 'Emailed To' , 'visual-form-builder'); ?>: </strong><?php echo preg_replace('/\b([A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4})\b/i', '<a href="mailto:$1">$1</a>', implode( ',', unserialize( stripslashes( $entry->emails_to ) ) ) ); ?></span>
+                                            <span><strong><?php _e( 'Emailed To' , 'visual-form-builder'); ?>: </strong><?php echo preg_replace('/\b([A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4})\b/i', '<a href="mailto:$1">$1</a>', esc_html( implode( ',', unserialize( stripslashes( $entry->emails_to ) ) ) ) ); ?></span>
                                         </div>
                                         <div class="clear"></div>

visual-form-builder/trunk/admin/class-media-button.php

@@ -37 +37 @@
         );
     ?>
-        <a href="<?php echo esc_url( $button_url ); ?>" class="button add_media thickbox" title="<?php _e( 'Add Visual Form Builder form', 'visual-form-builder' ); ?>">
+        <a href="<?php echo esc_url( $button_url ); ?>" class="button add_media thickbox" title="<?php esc_attr_e( 'Add Visual Form Builder form', 'visual-form-builder' ); ?>">
             <span class="dashicons dashicons-feedback" style="color:#888; display: inline-block; width: 18px; height: 18px; vertical-align: text-top; margin: 0 4px 0 0;"></span>
             <?php _e( 'Add Form', 'visual-form-builder' ); ?>
@@ -79 +79 @@
                 <select id="vfb_forms" name="vfb_forms">
                     <?php foreach( $forms as $form ) : ?>
-                        <option value="<?php echo $form->form_id; ?>"><?php echo $form->form_title; ?></option>
+                        <option value="<?php echo esc_attr( $form->form_id ); ?>"><?php echo $form->form_title; ?></option>
                     <?php endforeach; ?>
                 </select>