WordPress.org
Get WordPress

Plugin Directory

Changeset 2721774


Ignore:
Timestamp:
05/11/2022 08:04:09 AM (4 years ago)
Author:
likebtn
Message:

Update

Location:
likebtn-like-button/tags/2.6.44
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • likebtn-like-button/tags/2.6.44/includes/tab_votes.php

    r2721442 r2721774  
    115115                            <option value="">-- <?php _e('Any', 'likebtn-like-button'); ?> --</option>
    116116                            <?php foreach ($likebtn_entities as $entity_name_value => $entity_title): ?>
    117                                 <option value="<?php echo $entity_name_value; ?>" <?php selected($entity_name, $entity_name_value); ?> ><?php _e($entity_title, 'likebtn-like-button'); ?></option>
     117                                <option value="<?php echo esc_attr($entity_name_value); ?>" <?php selected($entity_name, $entity_name_value); ?> ><?php echo esc_html(__($entity_title, 'likebtn-like-button')); ?></option>
    118118                            <?php endforeach ?>
    119119                        </select>
    … …  
    122122                    <div class="likebtn-form-group">
    123123                        <label><?php _e('Item ID', 'likebtn-like-button'); ?>:</label>
    124                         <input type="text" name="likebtn_post_id" value="<?php echo htmlspecialchars($post_id) ?>" size="10" />
     124                        <input type="text" name="likebtn_post_id" value="<?php echo esc_attr($post_id) ?>" size="10" />
    125125                    </div>
    126126                    <br/>
    127127                    <div class="likebtn-form-group">
    128128                        <label><?php _e('User ID', 'likebtn-like-button'); ?>:</label>
    129                         <input type="text" name="likebtn_user_id" value="<?php echo htmlspecialchars($user_id) ?>" size="10" />
     129                        <input type="text" name="likebtn_user_id" value="<?php echo esc_attr($user_id) ?>" size="10" />
    130130                    </div>
    131131                   
    132132                    <div class="likebtn-form-group">
    133133                        <label><?php _e('IP'); ?>:</label>
    134                         <input type="text" name="likebtn_ip" value="<?php echo htmlspecialchars($ip) ?>" size="20"/>
     134                        <input type="text" name="likebtn_ip" value="<?php echo esc_attr($ip) ?>" size="20"/>
    135135                    </div>
    136136
    … …  
    167167                <select name="likebtn_blog_id" >
    168168                    <?php foreach ($blogs as $blog_id_value => $blog_title): ?>
    169                         <option value="<?php echo $blog_id_value; ?>" <?php selected($votes_blog_id, $blog_id_value); ?> ><?php echo $blog_title; ?></option>
     169                        <option value="<?php echo esc_attr($blog_id_value); ?>" <?php selected($votes_blog_id, $blog_id_value); ?> ><?php echo esc_html($blog_title); ?></option>
    170170                    <?php endforeach ?>
    171171                </select>&nbsp;&nbsp;
    … …  
    175175            <select name="likebtn_page_size" >
    176176                <?php foreach ($likebtn_page_sizes as $page_size_value): ?>
    177                     <option value="<?php echo $page_size_value; ?>" <?php selected($page_size, $page_size_value); ?> ><?php echo $page_size_value ?></option>
     177                    <option value="<?php echo esc_attr($page_size_value); ?>" <?php selected($page_size, $page_size_value); ?> ><?php echo esc_html($page_size_value) ?></option>
    178178                <?php endforeach ?>
    179179
    … …  
    183183                    <input class="button-primary" type="submit" name="show" value="<?php _e('View', 'likebtn-like-button'); ?>" />
    184184                    &nbsp;
    185                     <?php _e('Votes Found', 'likebtn-like-button'); ?>: <strong><?php echo $total_found ?></strong>
     185                    <?php _e('Votes Found', 'likebtn-like-button'); ?>: <strong><?php echo esc_html($total_found) ?></strong>
    186186                </nobr>
    187187                <?php if (count($votes) && $p->lastpage > 1): ?>
    … …  
    439439            }
    440440
    441             jQuery.getJSON('<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_vgaph&nonce=<?php echo wp_create_nonce('likebtn_vgaph'); ?>&<?php echo $_SERVER['QUERY_STRING'] ?>', function(response) {
     441            jQuery.getJSON('<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_vgaph&nonce=<?php echo wp_create_nonce('likebtn_vgaph'); ?>&<?php echo esc_url($_SERVER['QUERY_STRING']) ?>', function(response) {
    442442
    443443                if (!response.data) {
    … …  
    560560
    561561            // Load data from server
    562             jQuery.getJSON('<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_vgaph&level='+level+'&timestamp='+timestamp+'&nonce=<?php echo wp_create_nonce('likebtn_vgaph'); ?>&<?php echo $_SERVER['QUERY_STRING'] ?>', function(response) {
     562            jQuery.getJSON('<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_vgaph&level='+level+'&timestamp='+timestamp+'&nonce=<?php echo wp_create_nonce('likebtn_vgaph'); ?>&<?php echo esc_url($_SERVER['QUERY_STRING']) ?>', function(response) {
    563563
    564564                if (response.error_message) {
    … …  
    643643
    644644    <div id="likebtn_export" class="likebtn_export hidden">
    645         <form action="<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_export_votes&<?php echo $_SERVER['QUERY_STRING'] ?>" method="post" target="_blank">
     645        <form action="<?php echo admin_url('admin-ajax.php') ?>?action=likebtn_export_votes&<?php echo esc_url($_SERVER['QUERY_STRING']) ?>" method="post" target="_blank">
    646646            <input type="hidden" name="export" value="1" />
    647647            <input type="hidden" name="nonce" value="<?php echo wp_create_nonce( 'likebtn_export_votes' ); ?>" />

  • likebtn-like-button/tags/2.6.44/likebtn_like_button.php

    r2721442 r2721774  
    18001800            var likebtn_msg_f_submit2 = "<?php echo likebtn_esctr_msg(__('Submit and KEEP plugin active', 'likebtn-like-button')) ?>";
    18011801            var likebtn_msg_f_tmp = "<?php echo likebtn_esctr_msg(__('Deactivating for time being', 'likebtn-like-button')) ?>";
    1802             var likebtn_msg_f_offer1 = "<?php echo likebtn_esctr_msg(strtr(__('Here is your personal <strong style="font-size:20px;">%discount%% OFF</strong> coupon. Enter the code on %a_start%Upgrade%a_end% page and click Apply!', 'likebtn-like-button'), array('%discount%'=>65, '%a_start%'=>'<a href="'.__("https://likebtn.com/en/customer.php/upgrade/", 'likebtn-like-button')."?site_id=".get_option('likebtn_site_id')."&engine=wordpress&add_website=".$_SERVER['SERVER_NAME'].'" target="_blank">', '%a_end%'=>'</a>'))) ?>";
     1802            var likebtn_msg_f_offer1 = "<?php echo likebtn_esctr_msg(strtr(__('Here is your personal <strong style="font-size:20px;">%discount%% OFF</strong> coupon. Enter the code on %a_start%Upgrade%a_end% page and click Apply!', 'likebtn-like-button'), array('%discount%'=>65, '%a_start%'=>'<a href="'.__("https://likebtn.com/en/customer.php/upgrade/", 'likebtn-like-button')."?site_id=".get_option('likebtn_site_id')."&engine=wordpress&add_website=".esc_attr($_SERVER['SERVER_NAME']).'" target="_blank">', '%a_end%'=>'</a>'))) ?>";
    18031803            var likebtn_msg_f_offer2 = "<?php echo __("Enjoy!", 'likebtn-like-button') ?>";
    18041804        </script>
    … …  
    18511851function likebtn_admin_header() {
    18521852    $logo_url = _likebtn_get_public_url() . 'img/logo.png';
    1853     $header = <<<HEADER
    1854     <div class="wrap" id="likebtn">
    1855 HEADER;
    1856 
    1857     $header .= '
     1853
     1854    $header = '<div class="wrap" id="likebtn">
    18581855        <div id="poststuff">
    18591856            <div id="post-body" class="metabox-holder columns-2">
    … …  
    18631860                        <div class="postbox likebtn_logo">
    18641861                            <div class="inside likebtn_sidebar_inside">
    1865                                 <a href="https://likebtn.com/en/wordpress-like-button-plugin" target="_blank" title="LikeBtn.com"><img alt="" src="'.$logo_url.'" /></a>
     1862                                <a href="https://likebtn.com/en/wordpress-like-button-plugin" target="_blank" title="LikeBtn.com"><img alt="" src="'.esc_url($logo_url).'" /></a>
    18661863                                <input type="submit" id="likebtn_contact" value="' . __('Contact Us', 'likebtn-like-button') . '" class="button-primary" onclick="likebtnContactUs()">
    18671864                            </div>
    … …  
    19761973            <div id="likebtn_trial_info" class="likebtn_sidebar_section">
    19771974                <a href="javascript:jQuery(\'#likebtn_trial_help\').toggle();void(0);">'.__('What is TRIAL?', 'likebtn-like-button').'</a>
    1978                 <div id="likebtn_trial_help" style="display:none"><br/>'.strtr(__('During the TRIAL period you can enjoy ULTRA features for 7 days. After TRIAL expires your website is switched to the %a_begin%FREE%a_end% plan (all the votes will be kept!) and you can continue using FREE plan or go Premium.', 'likebtn-like-button'), array('%a_begin%'=>'<a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.$_SERVER['SERVER_NAME'].'\');void(0);">', '%a_end%'=>'</a>')).'</div>
     1975                <div id="likebtn_trial_help" style="display:none"><br/>'.strtr(__('During the TRIAL period you can enjoy ULTRA features for 7 days. After TRIAL expires your website is switched to the %a_begin%FREE%a_end% plan (all the votes will be kept!) and you can continue using FREE plan or go Premium.', 'likebtn-like-button'), array('%a_begin%'=>'<a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.esc_attr($_SERVER['SERVER_NAME']).'\');void(0);">', '%a_end%'=>'</a>')).'</div>
    19791976            </div>';
    19801977    }
    … …  
    20192016
    20202017    //if ($plan_synced && $likebtn_plan != LIKEBTN_PLAN_ULTRA) {
    2021         $html .= '<input class="button-secondary likebtn_button_upgrade" type="button" value="'.__('Upgrade', 'likebtn-like-button').'" onclick="likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.$_SERVER['SERVER_NAME'].'\')" /> &nbsp;';
     2018        $html .= '<input class="button-secondary likebtn_button_upgrade" type="button" value="'.__('Upgrade', 'likebtn-like-button').'" onclick="likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.esc_attr($_SERVER['SERVER_NAME']).'\')" /> &nbsp;';
    20222019    //}
    20232020    if ($plan_synced && $likebtn_plan != LIKEBTN_PLAN_FREE && $likebtn_plan != LIKEBTN_PLAN_TRIAL) {
    2024         $html .= '<small><a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&prolong=1&engine=wordpress&add_website='.$_SERVER['SERVER_NAME'].'\');void(0);">'.__('Renew Plan', 'likebtn-like-button').'</a></small>';
     2021        $html .= '<small><a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&prolong=1&engine=wordpress&add_website='.esc_attr($_SERVER['SERVER_NAME']).'\');void(0);">'.__('Renew Plan', 'likebtn-like-button').'</a></small>';
    20252022    } else {
    2026         $html .= '<small><a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.$_SERVER['SERVER_NAME'].'\');void(0);">'.__('Plans & Pricing', 'likebtn-like-button').'</a></small>';
     2023        $html .= '<small><a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/customer.php/upgrade/', 'likebtn-like-button').'?site_id='.get_option('likebtn_site_id').'&engine=wordpress&add_website='.esc_attr($_SERVER['SERVER_NAME']).'\');void(0);">'.__('Plans & Pricing', 'likebtn-like-button').'</a></small>';
    20272024    }
    20282025    $html .= '</div>';
    … …  
    20682065}
    20692066
    2070 // sidebar social
    2071 function _likebtn_sidebar_social()
    2072 {
    2073     $html =<<<HTML
    2074 <div class="likebtn_social">
    2075     <iframe src="//www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2FLikeBtn.LikeButton&amp;width&amp;layout=button_count&amp;action=like&amp;show_faces=false&amp;share=false&amp;height=21&amp;appId=192115980991078" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:21px; width:110px;" allowTransparency="true"></iframe>
    2076 </div>
    2077 <div class="likebtn_social">
    2078     <a href="https://twitter.com/likebtn" class="twitter-follow-button" data-show-count="true" data-show-screen-name="false" data-width="144px"></a>
    2079 <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+'://platform.twitter.com/widgets.js';fjs.parentNode.insertBefore(js,fjs);}}(document, 'script', 'twitter-wjs');</script>
    2080 </div>
    2081 HTML;
    2082 
    2083     return $html;
    2084 }
    2085 
    20862067// sidebar Referral Program
    20872068function _likebtn_sidebar_rp()
    20882069{
    2089     $public_url = _likebtn_get_public_url();
    2090     $title = __('Earn Money With LikeBtn!', 'likebtn-like-button');
    2091     $href = "javascript:likebtnPopup('".__('https://likebtn.com/en/', 'likebtn-like-button')."referral-program');void(0)";
    2092 
    2093     $html =<<<HTML
    2094 <center><a href="{$href}" class="likebtn_ttip" title="{$title}" style="display:block"><img src="{$public_url}img/rp.png" style="max-width:60%"/></a></center>
    2095 HTML;
     2070    $html = '<center><a href="javascript:likebtnPopup(\''.__('https://likebtn.com/en/', 'likebtn-like-button').'referral-program\');void(0)" class="likebtn_ttip" title="'.__('Earn Money With LikeBtn!', 'likebtn-like-button').'" style="display:block"><img src="'._likebtn_get_public_url().'img/rp.png" style="max-width:60%"/></a></center>';
    20962071
    20972072    return $html;
    … …  
    21162091
    21172092    if (isset($likebtn_plans[$likebtn_plan]) && $plan_synced) {
    2118         // <a href="javascript: likebtnPopup(\''.__('http://likebtn.com/en/', 'likebtn-like-button').'?add_website='.$_SERVER['SERVER_NAME'].'#plans_pricing\'); void(0)" class="likebtn_ttip" title="'.__('Plans & Pricing', 'likebtn-like-button').'"><strong>'.$likebtn_plans[$likebtn_plan].'</strong></a>
     2093        // <a href="javascript: likebtnPopup(\''.__('http://likebtn.com/en/', 'likebtn-like-button').'?add_website='.esc_attr($_SERVER['SERVER_NAME']).'#plans_pricing\'); void(0)" class="likebtn_ttip" title="'.__('Plans & Pricing', 'likebtn-like-button').'"><strong>'.$likebtn_plans[$likebtn_plan].'</strong></a>
    21192094        $plan_html = '<strong>'.$likebtn_plans[$likebtn_plan].'</strong>'.$refresh_html;
    21202095
    … …  
    25732548
    25742549    // Poll
    2575     $script = basename($_SERVER['REQUEST_URI']);
     2550    $script = basename(sanitize_text_field($_SERVER['REQUEST_URI']));
    25762551    if (!$script) {
    2577         $script = basename($_SERVER['SCRIPT_NAME']);
     2552        $script = basename(sanitize_text_field($_SERVER['SCRIPT_NAME']));
    25782553    }
    25792554    if (!$script) {
    2580         $script = basename($_SERVER['SCRIPT_FILENAME']);
     2555        $script = basename(sanitize_text_field($_SERVER['SCRIPT_FILENAME']));
    25812556    }
    25822557    $script = preg_replace("/\?.*/", '', $script);
    … …  
    26612636            <select name="likebtn_entity_name" >
    26622637                <?php foreach ($likebtn_entities as $entity_name_value => $entity_title): ?>
    2663                     <option value="<?php echo esc_attr($entity_name_value); ?>" <?php selected($entity_name, $entity_name_value); ?> ><?php _e($entity_title, 'likebtn-like-button'); ?></option>
     2638                    <option value="<?php echo esc_attr($entity_name_value); ?>" <?php selected($entity_name, $entity_name_value); ?> ><?php echo esc_html(__($entity_title, 'likebtn-like-button')); ?></option>
    26642639                <?php endforeach ?>
    26652640            </select></nobr>
    … …  
    26782653                <div class="inside">
    26792654                    <label><?php _e('ID', 'likebtn-like-button'); ?>:</label>
    2680                     <input type="text" name="likebtn_post_id" value="<?php echo htmlspecialchars($post_id) ?>" size="5" />
     2655                    <input type="text" name="likebtn_post_id" value="<?php echo esc_attr($post_id) ?>" size="5" />
    26812656                    &nbsp;&nbsp;
    26822657                    <label><?php _e('Title'); ?>:</label>
    2683                     <input type="text" name="likebtn_post_title" value="<?php echo htmlspecialchars($post_title) ?>" size="25"/>
     2658                    <input type="text" name="likebtn_post_title" value="<?php echo esc_attr($post_title) ?>" size="25"/>
    26842659                    &nbsp;&nbsp;
    26852660                    <label><?php _e('Status', 'likebtn-like-button'); ?>:</label>
    … …  
    26872662                        <option value=""></option>
    26882663                        <?php foreach ($likebtn_post_statuses as $post_status_value => $post_status_title): ?>
    2689                             <option value="<?php echo esc_attr($post_status_value); ?>" <?php selected($post_status, $post_status_value); ?> ><?php echo _e($post_status_title) ?></option>
     2664                            <option value="<?php echo esc_attr($post_status_value); ?>" <?php selected($post_status, $post_status_value); ?> ><?php echo esc_html(__($post_status_title)) ?></option>
    26902665                        <?php endforeach ?>
    26912666                    </select>
    … …  
    35793554    }
    35803555
     3556    $items = array();
     3557    foreach ($_POST['item'] as $item) {
     3558        $items[] = sanitize_text_field($item);
     3559    }
     3560
    35813561    switch ($_POST['bulk_action']) {
    35823562        case 'reset':
    35833563            // $_POST['item'] must be able to contain any symbols
    3584             $reseted = _likebtn_reset($entity_name, sanitize_text_field($_POST['item']));
     3564            $reseted = _likebtn_reset($entity_name, $items);
    35853565            _likebtn_add_notice(array(
    35863566                'msg' => __('Likes and dislikes for the following number of items have been successfully reseted:', 'likebtn-like-button').' '.$reseted,
    … …  
    35903570        case 'delete':
    35913571            // $_POST['item'] must be able to contain any symbols
    3592             $reseted = _likebtn_delete($entity_name, sanitize_text_field($_POST['item']));
     3572            $reseted = _likebtn_delete($entity_name, $items);
    35933573            _likebtn_add_notice(array(
    35943574                'msg' => __('The following number of items have been successfully deleted:', 'likebtn-like-button').' '.$reseted,
    … …  
    36013581    }
    36023582
    3603     wp_redirect($_SERVER['REQUEST_URI']);
     3583    wp_redirect(sanitize_url($_SERVER['REQUEST_URI']));
    36043584    exit();
    36053585}
    … …  
    41664146        $identifier = _likebtn_entity_to_identifier($entity_name, $entity_id);
    41674147    }
    4168     $data = ' data-identifier="' . $identifier . '" ';
     4148    $data = ' data-identifier="' . esc_attr($identifier) . '" ';
    41694149
    41704150    // Site ID
    41714151    if (get_option('likebtn_site_id')) {
    4172         $data .= ' data-site_id="' . get_option('likebtn_site_id') . '" ';
     4152        $data .= ' data-site_id="' . esc_attr(get_option('likebtn_site_id')) . '" ';
    41734153    }
    41744154
    … …  
    41764156    if (_likebtn_get_option($use_entity_name, 'likebtn_user_logged_in', $values) == LIKEBTN_USER_LOGGED_IN_MODAL && !is_user_logged_in()) {
    41774157        $values['voting_enabled'] = '0';
    4178         $data .= ' data-clk_modal="' . htmlspecialchars(_likebtn_get_user_logged_in_alert($use_entity_name)) . '" ';
     4158        $data .= ' data-clk_modal="' . esc_attr(htmlspecialchars(_likebtn_get_user_logged_in_alert($use_entity_name))) . '" ';
    41794159    }
    41804160
    … …  
    42624242        $values['group_identifier'] = $entity_name;
    42634243    }
    4264    
    42654244
    42664245    $likebtn_settings = _likebtn_get_all_settings();
    … …  
    42944273                $option_value_prepared = likebtn_cur_lang();
    42954274            }
    4296             $data .= ' data-' . $option_name . '="' . $option_value_prepared . '" ';
     4275            $data .= ' data-' . $option_name . '="' . esc_attr($option_value_prepared) . '" ';
    42974276        }
    42984277    }
    … …  
    43004279    // Add item options
    43014280    if ($entity_url && !$prepared_settings['item_url']) {
    4302         $data .= ' data-item_url="' . $entity_url . '" ';
     4281        $data .= ' data-item_url="' . esc_attr($entity_url) . '" ';
    43034282    }
    43044283    if ($entity_title && !$prepared_settings['item_title']) {
    … …  
    43074286        $entity_title = htmlspecialchars($entity_title);
    43084287
    4309         $data .= ' data-item_title="' . $entity_title . '" ';
     4288        $data .= ' data-item_title="' . esc_attr($entity_title) . '" ';
    43104289    }
    43114290    if ($entity_image && !$prepared_settings['item_image']) {
    4312         $data .= ' data-item_image="' . $entity_image . '" ';
     4291        $data .= ' data-item_image="' . esc_attr($entity_image) . '" ';
    43134292    }
    43144293    if ($entity_date && !$prepared_settings['item_date']) {
    4315         $data .= ' data-item_date="' . $entity_date . '" ';
     4294        $data .= ' data-item_date="' . esc_attr($entity_date) . '" ';
    43164295    }
    43174296
    … …  
    43204299        $vt = _likebtn_get_vote_type($identifier, $prepared_settings['voting_frequency']);
    43214300        if ($vt) {
    4322             $data .= ' data-vt="'.$vt.'" ';
     4301            $data .= ' data-vt="'.esc_attr($vt).'" ';
    43234302        }
    43244303    }
    … …  
    43294308    $plugin_v = LIKEBTN_VERSION;
    43304309    if ($plugin_v) {
    4331         $data .= ' data-plugin_v="' . $plugin_v . '" ';
     4310        $data .= ' data-plugin_v="' . esc_attr($plugin_v) . '" ';
    43324311    }
    43334312
    … …  
    43414320        }
    43424321
    4343         $data .= ' data-prx="' . $prx . '" ';
     4322        $data .= ' data-prx="' . esc_attr($prx) . '" ';
    43444323    }
    43454324    // Event handler
    … …  
    43554334    $widget_url = LIKEBTN_WIDGET_URL;
    43564335    if ($include_script) {
    4357         $markup = <<<MARKUP
    4358 <!-- LikeBtn.com BEGIN --><span class="likebtn-wrapper" {$data}></span><script>(function(d, e, s) {a = d.createElement(e);m = d.getElementsByTagName(e)[0];a.async = 1;a.src = s;m.parentNode.insertBefore(a, m)})(document, 'script', '//{$widget_url}'); if (typeof(LikeBtn) != "undefined") { LikeBtn.init(); }</script><!-- LikeBtn.com END -->
    4359 MARKUP;
     4336        // $data is prepared and escaped above
     4337        $markup = '<!-- LikeBtn.com BEGIN --><span class="likebtn-wrapper" '.$data.'></span><script>(function(d, e, s) {a = d.createElement(e);m = d.getElementsByTagName(e)[0];a.async = 1;a.src = s;m.parentNode.insertBefore(a, m)})(document, \'script\', \'//'.esc_attr($widget_url).'\'); if (typeof(LikeBtn) != "undefined") { LikeBtn.init(); }</script><!-- LikeBtn.com END -->';
    43604338    } else {
    4361         $markup = <<<MARKUP
    4362 <!-- LikeBtn.com BEGIN --><span class="likebtn-wrapper" {$data}></span><!-- LikeBtn.com END -->
    4363 MARKUP;
     4339        // $data is prepared and escaped above
     4340        $markup = '<!-- LikeBtn.com BEGIN --><span class="likebtn-wrapper" '.$data.'></span><!-- LikeBtn.com END -->';
    43644341    }
    43654342
    … …  
    43724349    }
    43734350    $html_before = apply_filters('likebtn_html_before', $html_before, $entity_name, $entity_id, $values);
    4374     $markup = $html_before . $markup;
     4351    $markup = wp_kses($html_before, 'post') . $markup;
    43754352
    43764353
    … …  
    43844361
    43854362    $html_after = apply_filters('likebtn_html_after', $html_after, $entity_name, $entity_id, $values);
    4386     $markup = $markup . $html_after;
     4363    $markup = $markup . wp_kses($html_after, 'post');
    43874364
    43884365    if (($wrap || !empty($values['wrap']) || !empty($values['alignment']) || !empty($values['newline'])) && !is_admin()) {
    … …  
    44024379            if ($alignment == LIKEBTN_ALIGNMENT_RIGHT) {
    44034380                $style .= 'text-align:right;';
    4404                 $markup = '<div class="likebtn_container" style="'.$style.'">' . $markup . '</div>';
     4381                $markup = '<div class="likebtn_container" style="'.esc_attr($style).'">' . $markup . '</div>';
    44054382            } elseif ($alignment == LIKEBTN_ALIGNMENT_CENTER) {
    44064383                $style .= 'text-align:center;';
    4407                 $markup = '<div class="likebtn_container" style="'.$style.'">' . $markup . '</div>';
     4384                $markup = '<div class="likebtn_container" style="'.esc_attr($style).'">' . $markup . '</div>';
    44084385            } else {
    4409                 $markup = '<div class="likebtn_container" style="'.$style.'">' . $markup . '</div>';
     4386                $markup = '<div class="likebtn_container" style="'.esc_attr($style).'">' . $markup . '</div>';
    44104387            }
    44114388        }
    … …  
    51825159        );
    51835160
     5161        // Options sanitizing is done in likebtn_send_vote_notification() function
    51845162        $result = likebtn_send_vote_notification($vars, stripslashes_deep($_POST['options']));
    51855163
    … …  
    68716849        $client_identifier = $user_id;
    68726850    } else {
     6851        // $_SERVER do not need sanitizing here, we need them intact in md5 function();
    68736852        $client_identifier = md5($ip.$_SERVER['HTTP_USER_AGENT'].$_SERVER['HTTP_ACCEPT'].$_SERVER['HTTP_ACCEPT_LANGUAGE']);
    68746853    }
    … …  
    71177096            // If suhosin.get.max_value_length is set
    71187097            $_GET = array();
    7119             $params = explode('&', $_SERVER['QUERY_STRING']);
     7098            $params = explode('&', sanitize_text_field($_SERVER['QUERY_STRING']));
    71207099            foreach ($params as $pair) {
    71217100                list($key, $value) = explode('=', $pair);
    … …  
    71747153                        try {
    71757154                            $http = new WP_Http();
     7155                            // S_SERVER vars do not need sanitizing here - we pass them as is to the external system
    71767156                            $headers = array(
    71777157                                "User-Agent" => $_SERVER['HTTP_USER_AGENT'],
    … …  
    77247704    // global $likebtn_cf_ip_ranges_ipv6;
    77257705
    7726     $ip = $_SERVER['REMOTE_ADDR'];
     7706    $ip = sanitize_text_field($_SERVER['REMOTE_ADDR']);
    77277707
    77287708    // Behind CloudFlare
    … …  
    77337713            foreach ($likebtn_cf_ip_ranges_ipv6 as $range) {
    77347714                if (_likebtn_ip_in_range_ipv6($ip, $range)) {
    7735                     return $_SERVER['HTTP_CF_CONNECTING_IP'];
     7715                    return sanitize_text_field($_SERVER['HTTP_CF_CONNECTING_IP']);
    77367716                }
    77377717            }
    … …  
    77417721            foreach ($likebtn_cf_ip_ranges as $range) {
    77427722                if (_likebtn_ip_in_range($ip, $range)) {
    7743                     return $_SERVER['HTTP_CF_CONNECTING_IP'];
     7723                    return sanitize_text_field($_SERVER['HTTP_CF_CONNECTING_IP']);
    77447724                }
    77457725            }
    … …  
    77517731    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    77527732        if (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') > 0) {
    7753             $addr = explode(",", $_SERVER['HTTP_X_FORWARDED_FOR']);
     7733            $addr = explode(",", sanitize_text_field($_SERVER['HTTP_X_FORWARDED_FOR']));
    77547734            $x_ip = trim($addr[0]);
    77557735        } else {
    7756             $x_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
     7736            $x_ip = sanitize_text_field($_SERVER['HTTP_X_FORWARDED_FOR']);
    77577737        }
    77587738        if ($x_ip != $_SERVER['SERVER_ADDR']) {
    … …  
    77607740        }
    77617741    } else {
    7762         $ip = $_SERVER['REMOTE_ADDR'];
     7742        $ip = sanitize_text_field($_SERVER['REMOTE_ADDR']);
    77637743    }
    77647744
    … …  
    79797959function likebtn_build_sort_by($sort_by, $order)
    79807960{
    7981     parse_str($_SERVER['QUERY_STRING'], $args);
     7961    parse_str(sanitize_text_field($_SERVER['QUERY_STRING']), $args);
    79827962    $args['likebtn_sort_by'] = $sort_by;
    79837963    $args['likebtn_sort_by_order'] = $order;
    … …  
    79887968function likebtn_get_script_name()
    79897969{
    7990     $script_name = $_SERVER['SCRIPT_NAME'];
     7970    $script_name = sanitize_text_field($_SERVER['SCRIPT_NAME']);
    79917971    if (!$script_name) {
    7992         $script_name = $_SERVER['SCRIPT_URL'];
     7972        $script_name = sanitize_text_field($_SERVER['SCRIPT_URL']);
    79937973    }
    79947974    if (!$script_name) {
    7995         $script_name = $_SERVER['PHP_SELF'];
     7975        $script_name = sanitize_text_field($_SERVER['PHP_SELF']);
    79967976    }
    79977977    return $script_name;
    … …  
    84378417function likebtn_default_notify_text()
    84388418{
    8439     $text = <<<TEXT
     8419    $text = '
    84408420New {vote_type} on {domain}
    84418421
    … …  
    84488428IP address: <a href="{vote_ip_url}">{vote_ip}</a>
    84498429User: <a href="{user_url}">{user_login}</a> <small>(<a href="{user_votes_url}">view user votes</a>)</small>
    8450 TEXT;
     8430';
    84518431    return $text;
    84528432}
    … …  
    84688448        'error_message' => ''
    84698449    );
     8450
     8451    if (!is_array($options)) {
     8452        $options = array();
     8453    }
    84708454
    84718455    if (!empty($options['likebtn_notify_to'])) {
    … …  
    84818465        return $return;
    84828466    }
     8467    // Sanitize emails.
     8468    foreach ($to_emails as $i => $email) {
     8469        $to_emails[$i] = sanitize_email($email);
     8470    }
    84838471
    84848472    if (!empty($options['likebtn_notify_from'])) {
    8485         $from = $options['likebtn_notify_from'];
     8473        $from = sanitize_email($options['likebtn_notify_from']);
    84868474    } else {
    84878475        $from = get_option('likebtn_notify_from');
    … …  
    84938481
    84948482    if (!empty($options['likebtn_notify_subject'])) {
    8495         $subject = $options['likebtn_notify_subject'];
     8483        $subject = sanitize_text_field($options['likebtn_notify_subject']);
    84968484    } else {
    84978485        $subject = get_option('likebtn_notify_subject');
    … …  
    85038491
    85048492    if (!empty($options['likebtn_notify_text'])) {
    8505         $template = $options['likebtn_notify_text'];
     8493        $template = sanitize_textarea_field($options['likebtn_notify_text']);
    85068494    } else {
    85078495        $template = get_option('likebtn_notify_text');

  • likebtn-like-button/tags/2.6.44/templates/like-box.php

    r2719548 r2721774  
    1313        <?php if ($text): ?>
    1414            <div class="likebtn-likebox-txt">
    15                 <?php echo $text; ?>
     15                <?php echo wp_kses($text, 'post'); ?>
    1616            </div>
    1717        <?php endif ?>
    … …  
    1919        <?php foreach ($user_loop as $user): ?>
    2020            <div class="likebtn-likebox-user" >
    21                 <a href="<?php echo $user['url']?>" title="<?php echo $user['name'] ?>" class="likebtn-likebox-lnk"><img width="32" height="32" alt="<?php echo $user['name'] ?>" class="avatar avatar-32 user-<?php echo $user['user_id']?>-avatar gravatar" src="<?php echo $user['avatar']?>"></a>
     21                <a href="<?php echo esc_attr($user['url']) ?>" title="<?php echo esc_attr($user['name']) ?>" class="likebtn-likebox-lnk"><img width="32" height="32" alt="<?php echo esc_attr($user['name']) ?>" class="avatar avatar-32 user-<?php echo esc_attr($user['user_id']) ?>-avatar gravatar" src="<?php echo esc_attr($user['avatar']) ?>"></a>
    2222            </div>
    2323        <?php endforeach; ?>

  • likebtn-like-button/tags/2.6.44/templates/liked-by-user-widget.php

    r2719548 r2721774  
    1010
    1111<?php if (!empty($before_widget)): ?>
    12     <?php echo $before_widget; ?>
     12    <?php echo wp_kses($before_widget, 'post'); ?>
    1313<?php endif ?>
    1414
    1515<?php if (!empty($title)): ?>
    1616    <?php if (!empty($before_title)): ?>
    17         <?php echo $before_title; ?>
     17        <?php echo wp_kses($before_title, 'post'); ?>
    1818    <?php endif ?>
    19     <?php echo $title; ?>
     19    <?php echo wp_kses($title, 'post'); ?>
    2020    <?php if (!empty($after_title)): ?>
    21         <?php echo $after_title; ?>
     21        <?php echo wp_kses($after_title, 'post'); ?>
    2222    <?php endif ?>
    2323<?php endif ?>
    … …  
    2626    <ul class="likebtn-mlw">
    2727    <?php foreach ($post_loop as $post): ?>
    28         <li id="post-<?php echo $post['id'] ?>" class="likebtn-mlw-item" >
    29             <a href="<?php echo $post['link'] ?>" title="<?php echo $post['title'] ?>">
     28        <li id="post-<?php echo esc_attr($post['id']) ?>" class="likebtn-mlw-item" >
     29            <a href="<?php echo esc_attr($post['link']) ?>" title="<?php echo esc_attr($post['title']) ?>">
    3030                <?php if ($show_thumbnail): ?>
    3131                    <?php if ('image/' == substr( $post['post_mime_type'], 0, 6 ) ): ?>
    … …  
    3636                <?php endif ?>
    3737                <div class="likebtn-mlw-title">
    38                     <?php echo $post['title'] ?><?php if ($show_likes || $show_dislikes): ?>&nbsp;<span class="likebtn-item-likes"><nobr>(
     38                    <?php echo esc_html($post['title']) ?><?php if ($show_likes || $show_dislikes): ?>&nbsp;<span class="likebtn-item-likes"><nobr>(
    3939                    <?php endif ?>
    40                     <?php echo $show_likes ? $post['likes'] : ''; ?>
     40                    <?php echo $show_likes ? (int)$post['likes'] : ''; ?>
    4141                    <?php if ($show_likes && $show_dislikes): ?>
    4242                        /
    4343                    <?php endif ?>
    44                     <?php echo $show_dislikes ? $post['dislikes'] : ''; ?>
     44                    <?php echo $show_dislikes ? (int)$post['dislikes'] : ''; ?>
    4545                    <?php if ($show_likes || $show_dislikes): ?>
    4646                        )</nobr></span>
    … …  
    5555                    <small>/</small>
    5656                <?php endif ?>
    57                 <small class="likebtn-mlw-author"><i><?php echo $post['author_name'] ?></i></small>
     57                <small class="likebtn-mlw-author"><i><?php echo esc_html($post['author_name']) ?></i></small>
    5858            <?php endif ?>
    5959            <?php if ($show_excerpt): ?>
    60                 <div class="likebtn-mlw-excerpt"><?php echo $post['excerpt'] ?></div>
     60                <div class="likebtn-mlw-excerpt"><?php echo esc_html($post['excerpt']) ?></div>
    6161            <?php endif ?>
    6262            <?php if ($post['button_html']): ?>
    63                 <div class="likebtn-mlw-button"><?php echo $post['button_html']; ?></div>
     63                <div class="likebtn-mlw-button"><?php echo wp_kses($post['button_html'], 'post'); ?></div>
    6464            <?php endif ?>
    6565            <?php if ($show_thumbnail || $show_excerpt): ?>
    … …  
    7878
    7979<?php if (!empty($after_widget)): ?>
    80     <?php echo $after_widget; ?>
     80    <?php echo wp_kses($after_widget, 'post'); ?>
    8181<?php endif ?>

  • likebtn-like-button/tags/2.6.44/templates/most-liked-widget.php

    r2719548 r2721774  
    1010
    1111<?php if (!empty($before_widget)): ?>
    12     <?php echo $before_widget; ?>
     12    <?php echo wp_kses($before_widget, 'post'); ?>
    1313<?php endif ?>
    1414
    1515<?php if (!empty($title)): ?>
    1616    <?php if (!empty($before_title)): ?>
    17         <?php echo $before_title; ?>
     17        <?php echo wp_kses($before_title, 'post'); ?>
    1818    <?php endif ?>
    19     <?php echo $title; ?>
     19    <?php echo wp_kses($title, 'post'); ?>
    2020    <?php if (!empty($after_title)): ?>
    21         <?php echo $after_title; ?>
     21        <?php echo wp_kses($after_title, 'post'); ?>
    2222    <?php endif ?>
    2323<?php endif ?>
    … …  
    2626    <ul class="likebtn-mlw">
    2727    <?php foreach ($post_loop as $post): ?>
    28         <li id="post-<?php echo $post['id'] ?>" class="likebtn-mlw-item" >
    29             <a href="<?php echo $post['link'] ?>" title="<?php echo esc_attr($post['title']) ?>">
     28        <li id="post-<?php echo esc_attr($post['id']) ?>" class="likebtn-mlw-item" >
     29            <a href="<?php echo esc_attr($post['link']) ?>" title="<?php echo esc_attr($post['title']) ?>">
    3030                <?php if ($show_thumbnail): ?>
    3131                    <?php if ('image/' == substr( $post['post_mime_type'], 0, 6 ) ): ?>
    … …  
    3636                <?php endif ?>
    3737                <div class="likebtn-mlw-title">
    38                     <?php echo $post['title'] ?><?php if ($show_likes || $show_dislikes): ?>&nbsp;<span class="likebtn-item-likes"><nobr>(
     38                    <?php echo esc_html($post['title']) ?><?php if ($show_likes || $show_dislikes): ?>&nbsp;<span class="likebtn-item-likes"><nobr>(
    3939                    <?php endif ?>
    40                     <?php echo $show_likes ? $post['likes'] : ''; ?>
     40                    <?php echo $show_likes ? (int)$post['likes'] : ''; ?>
    4141                    <?php if ($show_likes && $show_dislikes): ?>
    4242                        /
    4343                    <?php endif ?>
    44                     <?php echo $show_dislikes ? $post['dislikes'] : ''; ?>
     44                    <?php echo $show_dislikes ? (int)$post['dislikes'] : ''; ?>
    4545                    <?php if ($show_likes || $show_dislikes): ?>
    4646                        )</nobr></span>
    … …  
    5555                    <small>/</small>
    5656                <?php endif ?>
    57                 <small class="likebtn-mlw-author"><i><?php echo $post['author_name'] ?></i></small>
     57                <small class="likebtn-mlw-author"><i><?php echo esc_html($post['author_name']) ?></i></small>
    5858            <?php endif ?>
    5959            <?php if ($show_excerpt): ?>
    60                 <div class="likebtn-mlw-excerpt"><?php echo $post['excerpt'] ?></div>
     60                <div class="likebtn-mlw-excerpt"><?php echo esc_html($post['excerpt']) ?></div>
    6161            <?php endif ?>
    6262            <?php if ($post['button_html']): ?>
    63                 <div class="likebtn-mlw-button"><?php echo $post['button_html']; ?></div>
     63                <div class="likebtn-mlw-button"><?php echo wp_kses($post['button_html'], 'post'); ?></div>
    6464            <?php endif ?>
    6565            <?php if ($show_thumbnail || $show_excerpt): ?>
    … …  
    8484
    8585<?php if (!empty($after_widget)): ?>
    86     <?php echo $after_widget; ?>
     86    <?php echo wp_kses($after_widget, 'post'); ?>
    8787<?php endif ?>

  • likebtn-like-button/tags/2.6.44/templates/um-liked-content.php

    r2719548 r2721774  
    2222                    <i class="um-icon-ios-paper"></i>
    2323                <?php endif ?>
    24                 <a href="<?php echo $post['link'] ?>"><?php echo $post['title'] ?></a>
     24                <a href="<?php echo esc_attr($post['link']) ?>"><?php echo esc_html($post['title']) ?></a>
    2525            </div>
    2626            <div class="um-item-meta">
Note: See TracChangeset for help on using the changeset viewer.