WordPress.org
Get WordPress

Plugin Directory

Changeset 3270053


Ignore:
Timestamp:
04/10/2025 12:42:00 AM (11 months ago)
Author:
MarkODonnell
Message:

Committing version 4.8 for wordpress review.

Location:
team-rosters
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • team-rosters/tags/4.7/css/mstw-tr-styles.css

    r2823832 r3270053  
    367367div.player-select-list,
    368368div.player-select-button {
    369     /*float         : left;*/
     369    float         : left;
    370370    margin-left   : 5px;
    371371    margin-right  : 5px;

  • team-rosters/trunk/includes/mstw-tr-admin.php

    r3240856 r3270053  
    5252if ( !is_admin( ) ) {
    5353
    54     die( __( 'You is no admin. You a cheater!', 'team-rosters' ) );
     54    die( esc_html__( 'You is no admin. You a cheater!', 'team-rosters' ) );
    5555}
    5656//
    … …  
    241241    global $current_screen;
    242242   
    243     wp_enqueue_style( 'tr-admin-styles', plugins_url( 'css/mstw-tr-admin-styles.css', dirname( __FILE__ ) ), array(), false, 'all' );
     243    wp_enqueue_style( 'tr-admin-styles',
     244                                        plugins_url( 'css/mstw-tr-admin-styles.css', dirname( __FILE__ ) ),
     245                                        array( ),
     246                                        '4.9',
     247                                        array( )
     248                                        );
    244249   
    245250    // This function loads in the required media files for the media manager
    … …  
    250255    wp_enqueue_media();
    251256   
    252     wp_enqueue_script( 'another-media', plugins_url( 'team-rosters/js/tr-another-media.js' ), null, false, true );
    253    
    254     wp_enqueue_style('thickbox');
     257    wp_enqueue_script(  'another-media',
     258                                            plugins_url( 'team-rosters/js/tr-another-media.js' ),
     259                                            array( ),
     260                                            '4.9',
     261                                            array( )
     262                                            );
     263   
     264    wp_enqueue_style( 'thickbox' );
    255265   
    256266    //
    … …  
    264274                           plugins_url( 'js/tr-manage-rosters.js', dirname( __FILE__ ) ),
    265275                           array( ),
    266                            false, true );
     276                           '4.9',
     277                             array( )
     278                             );
    267279    }
    268280   
    … …  
    274286                           plugins_url( 'js/tr-manage-teams.js', dirname( __FILE__ ) ),
    275287                           array( ),
    276                            false, true );
     288                           '4.9',
     289                             array( )
     290                             );
    277291
    278292    }
    … …  
    282296                           plugins_url( 'js/tr-load-teams.js', dirname( __FILE__ ) ),
    283297                           array( ),
    284                            false, true );
     298                           '4.9',
     299                             array( )
     300                             );
    285301    }
    286302   
    … …  
    812828?>
    813829<div class="wrap">
    814     <h2><?php _e( 'Team Rosters - Quick Start', 'team-rosters') ?></h2>
     830    <h2><?php esc_html_e( 'Team Rosters - Quick Start', 'team-rosters') ?></h2>
    815831    <h3>GETTING STARTED</h3>
    816832    <ol>
    817     <li><a href="<?php echo admin_url( '/edit-tags.php?taxonomy=mstw_tr_team&post_type=mstw_tr_player' ) ?>">TEAMS</a>. <?php _e('At least one team must exist before anything can be displayed via the shortcodes on the front end. Teams can be entered on this screen, or can be imported in bulk using the CSV IMPORT screen described below.', 'team-rosters' ) ?></li>
    818     <li><a href="<?php echo admin_url( '/edit.php?post_type=mstw_tr_player' ) ?>">MANAGE PLAYERS</a>. <?php _e( 'After creating one or more teams, players must be added to them. Players may be added, edited, and deleted on this screen. However, there are faster ways to add players in bulk. See ADD PLAYERS TO ROSTERS and CSV IMPORT below.', 'team-rosters' )?></li>
    819     <li><a href="<?php echo admin_url( '/admin.php?page=add-players-screen' ) ?>">ADD PLAYERS TO ROSTERS</a>.<?php _e( 'Multiple players may be added to a roster via this screen. While the same data as on the MANAGE PLAYERS screen must be entered, it can be entered more quickly on this screen.', 'team-rosters' )?></li>
    820     <li><a href="<?php echo admin_url( '/admin.php?page=manage-team-rosters' ) ?>">EDIT ROSTERS</a>. <?php _e( 'Entire rosters may be edited or updated via this screen. While the same data as on the MANAGE PLAYERS screen must be entered, it can entered more quickly on this screen.', 'team-rosters' )?></li>
    821     <li><a href="<?php echo admin_url( '/admin.php?page=mstw-tr-settings' ) ?>">SETTINGS</a>. <?php _e( 'Provides a rich set of controls for ROSTER TABLES, ROSTER GALLERIES, and SINGLE PLAYER PROFILES.', 'team-rosters' )?></li>
    822     <li><a href="<?php echo admin_url( '/admin.php?page=mstw-tr-csv-import' ) ?>">CSV IMPORT</a>. <?php _e( 'Provides the ability to upload Teams and Players (including player photos) from CSV formatted files. Note that these CSV files can generated from previous version of MSTW Team Rosters using the MSTW CSV Exporter plugin, or created by hand using an editor. (Excel works great.)', 'team-rosters' )?></li>
     833    <li><a href="<?php echo esc_url( admin_url( '/edit-tags.php?taxonomy=mstw_tr_team&post_type=mstw_tr_player' ) ) ?>">TEAMS</a>. <?php esc_html_e('At least one team must exist before anything can be displayed via the shortcodes on the front end. Teams can be entered on this screen, or can be imported in bulk using the CSV IMPORT screen described below.', 'team-rosters' ) ?></li>
     834    <li><a href="<?php echo esc_url( admin_url( '/edit.php?post_type=mstw_tr_player' ) ) ?>">MANAGE PLAYERS</a>. <?php esc_html_e( 'After creating one or more teams, players must be added to them. Players may be added, edited, and deleted on this screen. However, there are faster ways to add players in bulk. See ADD PLAYERS TO ROSTERS and CSV IMPORT below.', 'team-rosters' )?></li>
     835    <li><a href="<?php echo esc_url( admin_url( '/admin.php?page=add-players-screen' ) ) ?>">ADD PLAYERS TO ROSTERS</a>.<?php esc_html_e( 'Multiple players may be added to a roster via this screen. While the same data as on the MANAGE PLAYERS screen must be entered, it can be entered more quickly on this screen.', 'team-rosters' )?></li>
     836    <li><a href="<?php echo esc_url( admin_url( '/admin.php?page=manage-team-rosters' ) ) ?>">EDIT ROSTERS</a>. <?php esc_html_e( 'Entire rosters may be edited or updated via this screen. While the same data as on the MANAGE PLAYERS screen must be entered, it can entered more quickly on this screen.', 'team-rosters' )?></li>
     837    <li><a href="<?php echo esc_url( admin_url( '/admin.php?page=mstw-tr-settings' ) ) ?>">SETTINGS</a>. <?php esc_html_e( 'Provides a rich set of controls for ROSTER TABLES, ROSTER GALLERIES, and SINGLE PLAYER PROFILES.', 'team-rosters' )?></li>
     838    <li><a href="<?php echo esc_url( admin_url( '/admin.php?page=mstw-tr-csv-import' ) ) ?>">CSV IMPORT</a>. <?php esc_html_e( 'Provides the ability to upload Teams and Players (including player photos) from CSV formatted files. Note that these CSV files can generated from previous version of MSTW Team Rosters using the MSTW CSV Exporter plugin, or created by hand using an editor. (Excel works great.)', 'team-rosters' )?></li>
    823839   
    824840    </ol>
    … …  
    828844    printf(
    829845    /* Translators: the arguments here are simply html formatting that does not require translation */
    830     __( 'Team Rosters may be displayed in two formats: roster tables and roster galleries. Roster tables are displayed using the shortcode %1$s[mstw-tr-roster team=team-slug]%2$s Roster Galleries my be displayed using the shortcode %1$s[mstw-tr-gallery team=team-slug]%2$s or via the %3$staxonomy_team.php%4$s template. See the %5$sshortcodes man page%6$s for complete details.', 'team-rosters' ), '<blockquote><code>', '</code></blockquote>', '<strong><code>', '</code></strong>', '<a href="http://shoalsummitsolutions.com/tr-shortcodes/">', '</a>' ) ?>
     846    esc_html__( 'Team Rosters may be displayed in two formats: roster tables and roster galleries. Roster tables are displayed using the shortcode %1$s[mstw-tr-roster team=team-slug]%2$s Roster Galleries my be displayed using the shortcode %1$s[mstw-tr-gallery team=team-slug]%2$s or via the %3$staxonomy_team.php%4$s template. See the %5$sshortcodes man page%6$s for complete details.', 'team-rosters' ), '<blockquote><code>', '</code></blockquote>', '<strong><code>', '</code></strong>', '<a href="http://shoalsummitsolutions.com/tr-shortcodes/">', '</a>' ) ?>
    831847    </p>
    832848   

  • team-rosters/trunk/includes/mstw-tr-csv-import-class.php

    r3240856 r3270053  
    8484            <div class="wrap">
    8585                <?php //echo get_screen_icon(); ?>
    86                 <h2><?php _e( 'Import CSV Files', 'team-rosters' ) ?></h2>
     86                <h2><?php esc_html_e( 'Import CSV Files', 'team-rosters' ) ?></h2>
    8787               
    8888                <p class='mstw-lm-admin-instructions'>
    89                   <?php _e( 'Read the contextual help tab on the top right of this screen.', 'team-rosters' ) ?>
     89                  <?php esc_html_e( 'Read the contextual help tab on the top right of this screen.', 'team-rosters' ) ?>
    9090                </p>
    9191
    9292                <!-- TEAMS import form -->
    9393                <form class="add:the-list: validate" method="post" enctype="multipart/form-data" action="">
     94                    <?php wp_nonce_field( 'import-teams', 'mstw-tr-nonce' ); ?>
    9495                   
    9596                    <table class='form-table'>
    96                     <thead><tr><th><?php _e( 'Teams', 'team-rosters' ) ?></th></tr></thead>
     97                    <thead><tr><th><?php esc_html_e( 'Teams', 'team-rosters' ) ?></th></tr></thead>
    9798                       
    9899                        <tr>  <!-- CSV file selection field -->
    99                             <td><label for="csv_teams_import"><?php _e( 'Teams CSV file:', 'team-rosters' ); ?></label></td>
     100                            <td><label for="csv_teams_import"><?php esc_html_e( 'Teams CSV file:', 'team-rosters' ); ?></label></td>
    100101                            <td><input name="csv_teams_import" id="csv_teams_import" type="file" value="" aria-required="true" />
    101102                            <br/>
    … …  
    104105                       
    105106                        <tr> <!-- Submit button -->
    106                         <td colspan="2" class="submit tr-action-button"><input type="submit" class="button" name="submit" value="<?php _e( 'Import Teams', 'team-rosters' ); ?>"/></td>
     107                        <td colspan="2" class="submit tr-action-button"><input type="submit" class="button" name="submit" value="<?php esc_html_e( 'Import Teams', 'team-rosters' ); ?>"/></td>
    107108                        </tr>
    108109                   
    109110                    </table>
    110111                </form> <!--End: Teams import form -->
    111                
    112                 <!--<div id = "roster-progress">
    113                   <img src = "/wp-includes/js/thickbox/loadingAnimation.gif" />
    114                   <p class='mstw-lm-admin-instructions'><?php //_e( 'Processing ...', 'team-rosters' )?></p>
    115                 </div> -->
    116                
    117112               
    118113                <!-- PLAYERS import form -->
    … …  
    139134               
    140135                <form class="add:the-list: validate" method="post" enctype="multipart/form-data">
    141 
     136                    <?php wp_nonce_field( 'import-players', 'mstw-tr-nonce' ); ?>
    142137                    <table class='form-table'>
    143138                        <thead>
    144139                            <tr><th colspan=2>
    145                                 <?php _e( 'Players', 'team-rosters' ) ?>
     140                                <?php esc_html_e( 'Players', 'team-rosters' ) ?>
    146141                                <br/>
    147142                                <span class='description' style='font-weight: normal'><?php printf(
    148143                                        /* translators: %1s: HTML newline that should not be translated */
    149                                         __( 'The importer will use the "player-teams" column in the CSV file to assign teams to a player if that column is not empty.%1$s Otherwise, the player will be assigned to the team selected in the "Select Team to Import" dropdown. %1$sOtherwise, the player will be imported but will not be assigned to a team.', 'team-rosters' ), '<br/>' ) ?></span>
     144                                        esc_html__( 'The importer will use the "player-teams" column in the CSV file to assign teams to a player if that column is not empty.%1$s Otherwise, the player will be assigned to the team selected in the "Select Team to Import" dropdown. %1$sOtherwise, the player will be imported but will not be assigned to a team.', 'team-rosters' ), '<br/>' ) ?></span>
    150145                            </th></tr>
    151146                        </thead>   
    … …  
    153148                        <tbody>
    154149                            <tr>  <!-- Team (to import) selection field -->
    155                                 <td><label for="csv_import_team"><?php _e( 'Select Team to Import:', 'team-rosters' ) ?></label></td>
     150                                <td><label for="csv_import_team"><?php esc_html_e( 'Select Team to Import:', 'team-rosters' ) ?></label></td>
    156151                                <td><?php wp_dropdown_categories( $args ) ?>
    157152                                <br/>
    158                                 <span class='description' ><?php _e( 'This team will be used as the default if there is no entry for a player in the player_teams column.', 'team-rosters' ) ?></span>
     153                                <span class='description' ><?php esc_html_e( 'This team will be used as the default if there is no entry for a player in the player_teams column.', 'team-rosters' ) ?></span>
    159154                                </td>
    160155                            </tr>
    161156                            <tr>
    162                                 <td><label for="csv_move_photos"><?php _e( 'Move Player Photos:', 'team-rosters') ?></label></td>
     157                                <td><label for="csv_move_photos"><?php esc_html_e( 'Move Player Photos:', 'team-rosters') ?></label></td>
    163158                                <td><input name="csv_move_photos" id="csv_move_photos" type="checkbox" value="1" />
    164159                                <br/>
    165                                 <span class='description' ><?php _e( 'If checked, photo files will be imported from their current locations to the media library.If unchecked, photo files will remain in their current locations.', 'team-rosters' ) ?></span>
     160                                <span class='description' ><?php esc_html_e( 'If checked, photo files will be imported from their current locations to the media library.If unchecked, photo files will remain in their current locations.', 'team-rosters' ) ?></span>
    166161                                </td>
    167162                            </tr>
    168163                            <tr> <!-- CSV file selection field -->
    169                                 <td><label for="csv_players_import"><?php _e( 'Players CSV file:', 'team-rosters') ?></label></td>
     164                                <td><label for="csv_players_import"><?php esc_html_e( 'Players CSV file:', 'team-rosters') ?></label></td>
    170165                                <td><input name="csv_players_import" id="csv_players_import" type="file" value="" aria-required="true" />
    171166                                <br/>
    172                                 <span class='description' ><?php _e( 'Select the CSV players file to import.', 'team-rosters' ) ?></span>
     167                                <span class='description' ><?php esc_html_e( 'Select the CSV players file to import.', 'team-rosters' ) ?></span>
    173168                                </td>
    174169                            </tr>
    … …  
    189184        function print_messages() {
    190185            //mstw_tr_log_msg( "MSTW_TR_ImporterPlugin.print_messages:" );
    191             //mstw_tr_log_msg( $this -> log );
    192186           
    193187            if ( !empty( $this->log ) ) { ?>
    … …  
    198192                    <div class="error">
    199193                        <?php foreach ($this->log['error'] as $error): ?>
    200                             <p><?php echo $error; ?></p>
     194                            <p><?php echo esc_html( $error ); ?></p>
    201195                        <?php endforeach; ?>
    202196                    </div>
    … …  
    206200                    <div class="updated fade">
    207201                        <?php foreach ($this->log['notice'] as $notice): ?>
    208                             <p><?php echo $notice; ?></p>
     202                            <p><?php echo esc_html( $notice ); ?></p>
    209203                        <?php endforeach; ?>
    210204                    </div>
    … …  
    226220        function post( $options ) {
    227221            //mstw_tr_log_msg( "MSTW_TR_ImporterPlugin.post:" );
    228             //mstw_tr_log_msg( $options );
    229222           
    230223            if ( !$options ) {
    … …  
    235228            switch( $options['submit_value'] ) {
    236229                case __( 'Import Teams', 'team-rosters' ):
     230                    // First check for nonce
     231                    if ( isset( $_POST['mstw-tr-nonce'] ) ) {
     232                        //wp_verify_nonce( sanitize_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     233                        $safeNonce = wp_esc_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     234                        if ( !wp_verify_nonce( $safeNonce, 'import-teams' ) ) {
     235                            mstw_tr_add_admin_notice( 'error', __( 'Problem encountered with CSV file. Exiting.', 'team-rosters' ) );
     236                            mstw_log_msg( 'MSTW_TR_CSV_IMPORT_CLASS.post: Problem encountered loading CSV file; bad nonce. Exiting.' );
     237                            return;
     238                        }   
     239                    } else {  //nonce non found
     240                        mstw_tr_add_admin_notice( 'error', __( 'Problem encountered with CSV file. Exiting.', 'team-rosters' ) );
     241                        mstw_log_msg( 'MSTW_TR_CSV_IMPORT_CLASS.post: Problem encountered updating roster; nonce missing. Exiting.' );
     242                        return;
     243                    }
     244                   
     245                    // Nonce ok. Proceed with progessing.
    237246                    $file_id = 'csv_teams_import';
    238247                    //$msg_str is only used in summary messages
    … …  
    241250                   
    242251                case __( 'Import Players', 'team-rosters' ):
     252                    // First check for nonce
     253                    if ( isset( $_POST['mstw-tr-nonce'] ) ) {
     254                        //wp_verify_nonce( sanitize_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     255                        $safeNonce = wp_esc_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     256                       
     257                        if ( !wp_verify_nonce( $safeNonce, 'import-teams' ) ) {
     258                            mstw_tr_add_admin_notice( 'error', __( 'Problem encountered with CSV file. Exiting.', 'team-rosters' ) );
     259                            mstw_log_msg( 'MSTW_TR_CSV_IMPORT_CLASS.post: Problem encountered loading CSV file; bad nonce. Exiting.' );
     260                            return;
     261                        }
     262                       
     263                    } else {  //nonce non found
     264                        mstw_tr_add_admin_notice( 'error', __( 'Problem encountered with CSV file. Exiting.', 'team-rosters' ) );
     265                        mstw_log_msg( 'MSTW_TR_CSV_IMPORT_CLASS.post: Problem encountered updating roster; nonce missing. Exiting.' );
     266                        return;
     267                       
     268                    }
     269                   
    243270                    $file_id = 'csv_players_import';
    244271                    //$msg_str is only used in summary messages
    … …  
    314341            }
    315342
    316             if (file_exists($file)) {
    317                 @unlink($file);
     343            if ( file_exists($file) ) {
     344                $deleteFile = wp_delete_file( $file );
     345                if ( !$deleteFile ) {
     346                    mstw_log_msg( "CSV Import: Error deleting file $file" );
     347                }
    318348            }
    319349
    … …  
    329359           
    330360            //always add notice for records imported and elapsed time
    331             //$format = _n( 'Imported %1$s %2$s in %4$.2f seconds.', 'Imported %1$s %3$s in %4$.2f seconds.', $imported, 'team-rosters' );
    332             //$admin_notice = sprintf( $format, $imported, $msg_str[0], $msg_str[1], $exec_time );
    333361            $admin_notice = sprintf(
    334362                /* translators: %1$s/%2$s 'record' or 'records' processed */
    … …  
    592620           
    593621            // Split the $url into two pars with the wp-content directory as the separator
    594             $parsed_url = explode( parse_url( WP_CONTENT_URL, PHP_URL_HOST ), $url );
     622            $parsed_url = explode( wp_parse_url( WP_CONTENT_URL, PHP_URL_HOST ), $url );
    595623           
    596624            // Get the host of the current site and the host of the $url, ignoring www
    597             $this_host = str_ireplace( 'www.', '', parse_url( home_url( ), PHP_URL_HOST ) );
    598             $file_host = str_ireplace( 'www.', '', parse_url( $url, PHP_URL_HOST ) );
     625            $this_host = str_ireplace( 'www.', '', wp_parse_url( home_url( ), PHP_URL_HOST ) );
     626            $file_host = str_ireplace( 'www.', '', wp_parse_url( $url, PHP_URL_HOST ) );
    599627
    600628            // Return nothing if there aren't any $url parts or if the current host and $url host do not match
    … …  
    606634                // Example: /uploads/2013/05/test-image.jpg
    607635                global $wpdb;
    608 
    609                 $attachment = $wpdb->get_col( $wpdb->prepare( "SELECT ID FROM {$wpdb->prefix}posts WHERE guid RLIKE %s;", $parsed_url[1] ) );
     636                //
     637                // I have no idea how to address the PCP warnings about direct database calls here
     638                // Is there a better "wordpress" way to accomplish this?
     639                //
     640                $attachment = $wpdb->get_col( $wpdb->prepare( "SELECT ID FROM {$wpdb->prefix} posts WHERE guid RLIKE %s;", $parsed_url[1] ) );
    610641       
    611642                // Returns -1 if no attachment is found
    … …  
    724755                if ($bytes == pack('CCC', 0xef, 0xbb, 0xbf)) {
    725756                    $this->log['notice'][] = 'Getting rid of byte order mark...';
    726                     fclose($res);
     757                    fclose( $res );
    727758
    728759                    $contents = file_get_contents( $fname );
    … …  
    788819            //mstw_tr_log_msg( "MSTW_TR_ImporterPlugin.add_help:" );
    789820            ?>
    790             <p><?php _e( 'This screen allows the import of teams and players from files in CSV format. Sample file formats are available in the Users Manual (link below).', 'team-rosters' ) ?></p>
    791            
    792             <p><?php _e( 'To import teams, simply choose the CSV file and click "Import Teams".', 'team-rosters' ) ?></p>
    793            
    794             <p><?php _e( 'To import players, first select the CSV file containing the players, then you have some options:.', 'team-rosters' ) ?></p>
     821            <p><?php esc_html_e( 'This screen allows the import of teams and players from files in CSV format. Sample file formats are available in the Users Manual (link below).', 'team-rosters' ) ?></p>
     822           
     823            <p><?php esc_html_e( 'To import teams, simply choose the CSV file and click "Import Teams".', 'team-rosters' ) ?></p>
     824           
     825            <p><?php esc_html_e( 'To import players, first select the CSV file containing the players, then you have some options:.', 'team-rosters' ) ?></p>
    795826           
    796827            <ul>
    797             <li><?php _e( 'Select an existing team. Players will be addeded to that team.', 'team-rosters' ) ?></li>
    798             <li><?php _e( 'Don\'t elect an existing team, and provide the team(s) in the player_teams column of the CSV file. This allows players to be added to multiple teams (or no team) using one CSV file.', 'team-rosters' ) ?></li>
    799             <li><?php _e( 'Choose whether you want the player photos (provided in the CSV file) to be moved to the Media Library. If you are moving teams from a different site, you probably want to do this. If you are moving players on the same site, you probably do not want to do this since it will create duplicate image files in the Media Library.', 'team-rosters' ) ?></li>
     828            <li><?php esc_html_e( 'Select an existing team. Players will be addeded to that team.', 'team-rosters' ) ?></li>
     829            <li><?php esc_html_e( 'Don\'t elect an existing team, and provide the team(s) in the player_teams column of the CSV file. This allows players to be added to multiple teams (or no team) using one CSV file.', 'team-rosters' ) ?></li>
     830            <li><?php esc_html_e( 'Choose whether you want the player photos (provided in the CSV file) to be moved to the Media Library. If you are moving teams from a different site, you probably want to do this. If you are moving players on the same site, you probably do not want to do this since it will create duplicate image files in the Media Library.', 'team-rosters' ) ?></li>
    800831            </ul>
    801832           
    802             <p><?php _e( 'NOTE THAT IT CAN TAKE A SIGNFICANT AMOUNT OF TIME TO IMPORT PLAYERS. In fact, if the CSV file is too large, WordPress process can time out at the server. If so, simply divide the players up across two or more CSV files.', 'team-rosters' ) ?></p>
    803            
    804             <p><a href="http://shoalsummitsolutions.com/loading-rosters-from-csv-files-v-4-0/" target="_blank"><?php _e( 'See the plugin Users Manual on shoalsummitsolutions.com', 'team-rosters' ) ?></a></p>
     833            <p><?php esc_html_e( 'NOTE THAT IT CAN TAKE A SIGNFICANT AMOUNT OF TIME TO IMPORT PLAYERS. In fact, if the CSV file is too large, WordPress process can time out at the server. If so, simply divide the players up across two or more CSV files.', 'team-rosters' ) ?></p>
     834           
     835            <p><a href="http://shoalsummitsolutions.com/loading-rosters-from-csv-files-v-4-0/" target="_blank"><?php esc_html_e( 'See the plugin Users Manual on shoalsummitsolutions.com', 'team-rosters' ) ?></a></p>
    805836           
    806837            <?php

  • team-rosters/trunk/includes/mstw-tr-data-fields-columns-settings.php

    r3240856 r3270053  
    2727    function mstw_tr_data_fields_setup( ) {
    2828        //mstw_log_msg( 'mstw_tr_data_fields_setup:' );
    29        
    3029        mstw_tr_data_fields_left_setup( );
    3130        mstw_tr_data_fields_center_setup( );
    3231        mstw_tr_data_fields_right_setup( );
    33        
    3432    }
    3533   
    … …  
    4341        $display_on_page   = 'mstw-tr-data-fields-labels';
    4442        $page_section      = 'mstw-tr-fields-labels';
    45         $instruct_callback = null; //'mstw_tr_data_fields_inst';
     43        $instruct_callback = null;
    4644        $section_title     = __( 'Data Fields Labels', 'team-rosters' );
    4745       
    … …  
    222220        $display_on_page   = 'mstw-tr-fields-show-hide';
    223221        $page_section      = 'mstw-tr-fields-show-hide';
    224         $instruct_callback = null; //'mstw_tr_data_fields_inst';
     222        $instruct_callback = null;
    225223        $section_title     = __( 'Visibility', 'team-rosters' );
    226224       
    … …  
    400398        $display_on_page   = 'mstw-tr-fields-order';
    401399        $page_section      = 'mstw-tr-fields-order';
    402         $instruct_callback = null; //'mstw_tr_data_fields_inst';
     400        $instruct_callback = null;
    403401        $section_title     = __( 'Order', 'team-rosters' );
    404402       
    … …  
    568566       
    569567    } //End: mstw_tr_data_fields_right_setup()
    570 
    571    
    572    
    573 //-----------------------------------------------------------------
    574 //  Colors table section instructions   
    575 // 
    576     if( !function_exists( 'mstw_tr_data_fields_inst' ) ) {
    577         function mstw_tr_data_fields_inst( ) {
    578             echo '<p>' . __( 'Field Labels. ', 'team-rosters' ) .'</p>';
    579         } //End: mstw_tr_data_fields_inst()
    580     }

  • team-rosters/trunk/includes/mstw-tr-player-cpt-admin.php

    r3240856 r3270053  
    3636            do_meta_boxes(get_current_screen( ), 'advanced', $post);
    3737            unset( $wp_meta_boxes[get_post_type($post)]['advanced'] );
    38             echo "<p class='player-bio-admin-head'>" . __( 'Player Bio:', 'team-rosters' ) . "</p>";
     38            ?>
     39            <p class='player-bio-admin-head'><?php esc_html_e( 'Player Bio:', 'team-rosters' ) ?></p>
     40            <?php
    3941        }
    4042    }  //End: mstw_tr_build_player_screen
    … …  
    334336            if ( $_POST['post_type'] == 'mstw_tr_player' ) {
    335337                update_post_meta( $post_id, 'player_first_name',
    336                         strip_tags( $_POST['player_first_name'] ) );
     338                        wp_strip_all_tags( $_POST['player_first_name'] ) );
    337339                       
    338340                update_post_meta( $post_id, 'player_last_name',
    339                         strip_tags( $_POST['player_last_name'] ) );
     341                        wp_strip_all_tags( $_POST['player_last_name'] ) );
    340342                       
    341343                update_post_meta( $post_id, 'player_number',
    342                         strip_tags( $_POST['player_number'] ) );
     344                        wp_strip_all_tags( $_POST['player_number'] ) );
    343345                       
    344346                update_post_meta( $post_id, 'player_position',
    345                         strip_tags( $_POST['player_position'] ) );
     347                        wp_strip_all_tags( $_POST['player_position'] ) );
    346348                       
    347349                update_post_meta( $post_id, 'player_position_long',
    348                         strip_tags( $_POST['player_position_long'] ) );
     350                        wp_strip_all_tags( $_POST['player_position_long'] ) ); 
    349351                       
    350352                update_post_meta( $post_id, 'player_height',
    351353                        //$_POST['player_height'] );
    352                         strip_tags( $_POST['player_height'] ) );
     354                        wp_strip_all_tags( $_POST['player_height'] ) );
    353355                       
    354356                update_post_meta( $post_id, 'player_weight', 
    355                         strip_tags( $_POST['player_weight'] ) );
     357                        wp_strip_all_tags( $_POST['player_weight'] ) );
    356358                       
    357359                update_post_meta( $post_id, 'player_year', 
    358                         strip_tags( $_POST['player_year'] ) );
     360                        wp_strip_all_tags( $_POST['player_year'] ) );
    359361                       
    360362                update_post_meta( $post_id, 'player_year_long', 
    361                         strip_tags( $_POST['player_year_long'] ) );
     363                        wp_strip_all_tags( $_POST['player_year_long'] ) );
    362364                       
    363365                update_post_meta( $post_id, 'player_experience',
    364                         strip_tags( $_POST['player_experience'] ) );
     366                        wp_strip_all_tags( $_POST['player_experience'] ) );
    365367               
    366368                update_post_meta( $post_id, 'player_age',
    367                         strip_tags( $_POST['player_age'] ) );
     369                        wp_strip_all_tags( $_POST['player_age'] ) );
    368370                       
    369371                update_post_meta( $post_id, 'player_home_town',
    370                         strip_tags( $_POST['player_home_town'] ) );
     372                        wp_strip_all_tags( $_POST['player_home_town'] ) );
    371373                       
    372374                update_post_meta( $post_id, 'player_last_school',
    373                         strip_tags( $_POST['player_last_school'] ) );
     375                        wp_strip_all_tags( $_POST['player_last_school'] ) );
    374376                       
    375377                update_post_meta( $post_id, 'player_country',
    376                         strip_tags( $_POST['player_country'] ) );
     378                        wp_strip_all_tags( $_POST['player_country'] ) );
    377379                       
    378380                update_post_meta( $post_id, 'player_bats',
    379                         strip_tags( $_POST['player_bats'] ) );
     381                        wp_strip_all_tags( $_POST['player_bats'] ) );
    380382                       
    381383                update_post_meta( $post_id, 'player_throws',
    382                         strip_tags( $_POST['player_throws'] ) );
     384                        wp_strip_all_tags( $_POST['player_throws'] ) );
    383385                       
    384386                update_post_meta( $post_id, 'player_other',
    385                         strip_tags( $_POST['player_other'] ) );
     387                        wp_strip_all_tags( $_POST['player_other'] ) );
    386388                       
    387389            } //End: if ( $_POST['post_type'] == 'mstw_tr_player' )
    … …  
    442444                        $teams[$key] =  '<a href="' . $edit_link . '">' . $team->name . '</a>';
    443445                    }
    444                         echo implode( ' | ', $teams );
     446                        echo wp_kses_post( implode( ' | ', $teams ) );
    445447                }
    446448                break;
    … …  
    448450            case 'first-name' :
    449451                //printf( '%s', get_post_meta( $post_id, 'player_first_name', true ) );
    450                 echo( get_post_meta( $post_id, 'player_first_name', true ) );
     452                echo esc_html( get_post_meta( $post_id, 'player_first_name', true ) );
    451453                break;
    452454               
    453455            case 'last-name' :
    454                 printf( '%s', get_post_meta( $post_id, 'player_last_name', true ) );
     456                echo esc_html( get_post_meta( $post_id, 'player_last_name', true ) );
    455457                break;
    456458           
    457459            case 'number' :
    458                 printf( '%s', get_post_meta( $post_id, 'player_number', true ) );
     460                echo esc_html( get_post_meta( $post_id, 'player_number', true ) );
    459461                break;
    460462                   
    461463            case 'position' :
    462                 printf( '%s', get_post_meta( $post_id, 'player_position', true ) );
     464                echo esc_html( get_post_meta( $post_id, 'player_position', true ) );
    463465                break;
    464466               
    465467            case 'position_long' :
    466                 printf( '%s', get_post_meta( $post_id, 'player_position_long', true ) );
     468                echo esc_html( get_post_meta( $post_id, 'player_position_long', true ) );
    467469                break;
    468470               
    469471            case 'height' :
    470                 printf( '%s', get_post_meta( $post_id, 'player_height', true ) );
     472                echo esc_html( get_post_meta( $post_id, 'player_height', true ) );
    471473                break;
    472474               
    473475            case 'weight' :
    474                 printf( '%s', get_post_meta( $post_id, 'player_weight', true ) );
     476                echo esc_html( get_post_meta( $post_id, 'player_weight', true ) );
    475477                break;
    476478
    477479            case 'year' :
    478                 printf( '%s', get_post_meta( $post_id, 'player_year', true ) );
     480                echo esc_html( get_post_meta( $post_id, 'player_year', true ) );
    479481                break;
    480482               
    481483            case 'experience' :
    482                 printf( '%s', get_post_meta( $post_id, 'player_experience', true ) );
     484                echo esc_html( get_post_meta( $post_id, 'player_experience', true ) );
    483485                break;
    484486               
    … …  
    533535                   
    534536                //output the html for the drop down menu
    535                 echo "<select name='$tax_slug' id='$tax_slug' class='postform'>";
    536                 echo "<option value=''>" . __( 'Show All Teams', 'team-rosters') . "</option>";
     537                ?>
     538                <select name='<?php echo esc_html( $tax_slug ) ?>' id='<?php echo esc_html( $tax_slug ) ?>' class='<?php echo esc_html( 'postform' ) ?>'>" );
     539                <option value=""> <?php esc_html_e( 'Show All Teams', 'team-rosters') ?> </option>
     540                <?php
    537541               
    538542                //output each select option line
    … …  
    545549                        $selected = '';
    546550                    }
    547                     echo '<option value=' . $term->slug . $selected . '>' . $term->name . ' (' . $term->count . ')</option>';
     551                    ?>
     552                    <option value='<?php echo esc_html( $term->slug . $selected ) ?>' > <?php echo esc_html( $term->name . '(' . $term->count . ')' ) ?> </option>
     553        <?php
    548554                }
    549                 echo '</select>';
     555                ?></select><?php
    550556            }   
    551557        }
    … …  
    652658            case 'players-screen-help':
    653659                ?>
    654                 <p><?php _e( 'This screen provides a list of selected data fields for all players. The list may be filtered to show only one team using the Teams filter.', 'team-rosters' ) ?></p>
    655                
    656                 <p><?php _e( 'To add a player, click the "Add New Player" button at the top of the screen. Players may also be added using the "Add Players to Roster" screen or the "CSV Import" screen.', 'team-rosters' ) ?></p>
    657                
    658                 <p><?php _e( 'To edit a player, roll over the "Name" field and selecte "Edit".', 'team-rosters' ) ?></p>
    659                
    660                 <p><?php _e( 'To delete a player, roll over the "Name" field and selecte "Trash". Note that the player is moved to the trash BUT NOT REMOVED FROM THE DB. To delete the player from the DB, or to restore the player, click on the "Trash" link and delete selected players permanently or empty the trash.', 'team-rosters' ) ?></p>
    661                
    662                 <p><a href="http://shoalsummitsolutions.com/tr-data-entry-players/" target="_blank"><?php _e( 'See the Data Entry - Players man page for more details.', 'team-rosters' ) ?></a></p>
     660                <p><?php esc_html_e( 'This screen provides a list of selected data fields for all players. The list may be filtered to show only one team using the Teams filter.', 'team-rosters' ) ?></p>
     661               
     662                <p><?php esc_html_e( 'To add a player, click the "Add New Player" button at the top of the screen. Players may also be added using the "Add Players to Roster" screen or the "CSV Import" screen.', 'team-rosters' ) ?></p>
     663               
     664                <p><?php esc_html_e( 'To edit a player, roll over the "Name" field and selecte "Edit".', 'team-rosters' ) ?></p>
     665               
     666                <p><?php esc_html_e( 'To delete a player, roll over the "Name" field and selecte "Trash". Note that the player is moved to the trash BUT NOT REMOVED FROM THE DB. To delete the player from the DB, or to restore the player, click on the "Trash" link and delete selected players permanently or empty the trash.', 'team-rosters' ) ?></p>
     667               
     668                <p><a href="http://shoalsummitsolutions.com/tr-data-entry-players/" target="_blank"><?php esc_html_e( 'See the Data Entry - Players man page for more details.', 'team-rosters' ) ?></a></p>
    663669                <?php               
    664670                break;
    … …  
    666672            case 'edit-player-help':
    667673                ?>
    668                 <p><?php _e( 'Title. The player title should always be entered. However, it does not appear anywhere on the front end.', 'team-rosters' ) ?></p>
    669                
    670                 <p><?php _e( 'First Name and Last Name. At least one of these fields should be entered; otherwise, no name will appear on the front end.', 'team-rosters' ) ?></p>
    671                
    672                 <p><?php _e( 'Use the Manage Teams metabox to add a player to one or more teams; otherwise, the player will not appear on the front end.', 'team-rosters' ) ?></p>
    673                
    674                 <p><?php _e( 'Use the Manage Teams metabox to add a player to one or more teams; otherwise, the player will not appear on the front end.', 'team-rosters' ) ?></p>
    675                
    676                 <p><?php _e( 'Use the Player Photo metabox to add a player photo from the Media Gallery.', 'team-rosters' ) ?></p>
    677                
    678                 <p><?php _e( 'Use the Player Bio metabox to add a player profile/bio. Note that you can add HTML to this field to add photos, tables, links, etc.', 'team-rosters' ) ?></p>
    679                
    680                 <p><?php _e( 'Delete a player by clicking the "Move to Trash" link in the Publish metabox. See the instructions on deleting players above.', 'team-rosters' ) ?></p>
    681 
    682                 <p><a href="http://shoalsummitsolutions.com/tr-data-entry-players/" target="_blank"><?php _e( 'See the Data Entry - Players man page for more details.', 'team-rosters' ) ?></a></p>
     674                <p><?php esc_html_e( 'Title. The player title should always be entered. However, it does not appear anywhere on the front end.', 'team-rosters' ) ?></p>
     675               
     676                <p><?php esc_html_e( 'First Name and Last Name. At least one of these fields should be entered; otherwise, no name will appear on the front end.', 'team-rosters' ) ?></p>
     677               
     678                <p><?php esc_html_e( 'Use the Manage Teams metabox to add a player to one or more teams; otherwise, the player will not appear on the front end.', 'team-rosters' ) ?></p>
     679               
     680                <p><?php esc_html_e( 'Use the Manage Teams metabox to add a player to one or more teams; otherwise, the player will not appear on the front end.', 'team-rosters' ) ?></p>
     681               
     682                <p><?php esc_html_e( 'Use the Player Photo metabox to add a player photo from the Media Gallery.', 'team-rosters' ) ?></p>
     683               
     684                <p><?php esc_html_e( 'Use the Player Bio metabox to add a player profile/bio. Note that you can add HTML to this field to add photos, tables, links, etc.', 'team-rosters' ) ?></p>
     685               
     686                <p><?php esc_html_e( 'Delete a player by clicking the "Move to Trash" link in the Publish metabox. See the instructions on deleting players above.', 'team-rosters' ) ?></p>
     687
     688                <p><a href="http://shoalsummitsolutions.com/tr-data-entry-players/" target="_blank"><?php esc_html_e( 'See the Data Entry - Players man page for more details.', 'team-rosters' ) ?></a></p>
    683689                <?php               
    684690                break;
    … …  
    700706            case 'update-games-overview':
    701707                ?>
    702                 <p><?php _e( 'This screen allows updating the status of all games in a league and season.', 'team-rosters' ) ?></p>
    703                 <p><?php _e( 'Select a LEAGUE and SEASON then press the Update Games Table button.', 'team-rosters' ) ?></p>
    704                 <p><?php _e( 'Enter the status in information for each game.', 'team-rosters' ) ?></p>
    705                 <p><a href="http://shoalsummitsolutions.com/lm-update-games/" target="_blank"><?php _e( 'See the Update Games man page for more details.', 'team-rosters' ) ?></a></p>
     708                <p><?php esc_html_e( 'This screen allows updating the status of all games in a league and season.', 'team-rosters' ) ?></p>
     709                <p><?php esc_html_e( 'Select a LEAGUE and SEASON then press the Update Games Table button.', 'team-rosters' ) ?></p>
     710                <p><?php esc_html_e( 'Enter the status in information for each game.', 'team-rosters' ) ?></p>
     711                <p><a href="http://shoalsummitsolutions.com/lm-update-games/" target="_blank"><?php esc_html_e( 'See the Update Games man page for more details.', 'team-rosters' ) ?></a></p>
    706712                <?php               
    707713                break;

  • team-rosters/trunk/includes/mstw-tr-player-profiles-galleries-settings.php

    r3240856 r3270053  
    185185    if( !function_exists( 'mstw_tr_bio_gallery_inst' ) ) {
    186186        function mstw_tr_bio_gallery_inst( ) {
    187             echo '<p>' . __( 'Unless otherwise noted, these settings will apply to both the Single Player Profile and Team Gallery pages. ', 'team-rosters' ) .'</p>';
     187            echo '<p>', esc_html__( 'Unless otherwise noted, these settings will apply to both the Single Player Profile and Team Gallery pages. ', 'team-rosters' ), '</p>';
    188188        } //End: mstw_tr_bio_gallery_inst()
    189189    }

  • team-rosters/trunk/includes/mstw-tr-roster-color-settings.php

    r3240856 r3270053  
    264264        //mstw_log_msg( 'mstw_tr_table_color_inst:' );
    265265       
    266         echo '<p>' . __( 'These settings will apply to ALL the roster tables [mstw-roster-table], overriding the default styles. However they can be overridden by more specific stylesheet rules for specific teams. See the plugin documentation for more details.', 'team-rosters' ) . '</p>';
     266        echo '<p>', esc_html__( 'These settings will apply to ALL the roster tables [mstw-roster-table], overriding the default styles. However they can be overridden by more specific stylesheet rules for specific teams. See the plugin documentation for more details.', 'team-rosters' ), '</p>';
    267267   
    268268    } //End: mstw_tr_table_color_inst()
    … …  
    275275        //mstw_log_msg( 'mstw_tr_table2_color_inst:' );
    276276
    277         echo '<p>' . __( 'These settings will apply to ALL the table 2 roster tables [mstw-tr-roster-2], overriding the default styles. However they can be overridden by more specific stylesheet rules for specific teams. See the plugin documentation for more details. NOTE: this shortcode does not support team colors and does not have borders.', 'team-rosters' ) . '</p>';
     277        echo '<p>', esc_html__( 'These settings will apply to ALL the table 2 roster tables [mstw-tr-roster-2], overriding the default styles. However they can be overridden by more specific stylesheet rules for specific teams. See the plugin documentation for more details. NOTE: this shortcode does not support team colors and does not have borders.', 'team-rosters' ), '</p>';
    278278   
    279279    } //End: mstw_tr_table2_color_inst()

  • team-rosters/trunk/includes/mstw-tr-roster-table-settings.php

    r3240856 r3270053  
    300300        //mstw_log_msg( 'mstw_tr_roster_table_inst:' );
    301301   
    302         echo '<p>' . __( 'These settings will apply to all the [mstw-tr-roster] shortcode tables, overriding the settings defaults. In most cases, these settings can be overridden by shortcode arguments.', 'team-rosters' ) .'</p>';
     302        echo '<p>', esc_html__( 'These settings will apply to all the [mstw-tr-roster] shortcode tables, overriding the settings defaults. In most cases, these settings can be overridden by shortcode arguments.', 'team-rosters' ),'</p>';
    303303       
    304304    } //End: mstw_tr_roster_table_inst()
    … …  
    307307        //mstw_log_msg( 'mstw_tr_roster_table_2_inst:' );   
    308308   
    309         echo '<p>' . __( 'These settings will apply to all the [mstw-tr-roster-2] shortcode tables, overriding the settings defaults. In most cases, these settings can be overridden by shortcode arguments.', 'team-rosters' ) .'</p>';
     309        echo '<p>', esc_html__( 'These settings will apply to all the [mstw-tr-roster-2] shortcode tables, overriding the settings defaults. In most cases, these settings can be overridden by shortcode arguments.', 'team-rosters' ), '</p>';
    310310       
    311311    } //End: mstw_tr_roster_table_2_inst()

  • team-rosters/trunk/includes/mstw-tr-roster-tables-class.php

    r3240856 r3270053  
    22 /*---------------------------------------------------------------------------
    33 *  mstw-tr-roster-tables-class.php
    4  *  Contains the classes for the MSTW League Manager Sport schedule table
    5  *  shortcodes [mstw_lm_sport_schedule]
     4 *  Contains the classes for the MSTW Roster Tables (2)
     5 *  shortcodes [mstw_tr_roster_2]
    66 *
    77 *  MSTW Wordpress Plugins (http://shoalsummitsolutions.com)
    … …  
    6060               
    6161                // tableID allows multiple tables on the same page
    62                 $tableID = $this -> safeGet( 'table_id', $args, mt_rand( 1000, 9999 ) );
     62                $tableID = $this -> safeGet( 'table_id', $args, wp_rand( 1000, 9999 ) );
    6363               
    6464                // merge the shortcode arguments and the settings/options
    … …  
    6868                   
    6969                    ?>
    70                     <div class='mstw-tr-roster-table-container mstw-tr-roster-table-container-<?php echo $teamSlug ?>' id='mstw-tr-roster-table-container-<?php echo $tableID ?>'>
    71                    
    72    
     70                    <div class='mstw-tr-roster-table-container mstw-tr-roster-table-container-<?php echo esc_html( $teamSlug )?>' id='mstw-tr-roster-table-container-<?php echo esc_html( $tableID ) ?>'>   
    7371                            <?php $noControls = $this -> safeGet( 'no_controls', $args, null );
    7472                            //mstw_log_msg( "noControls= $noControls" );
    … …  
    7775                                <!--<div class='mstw-tr-roster-title-controls mstw-tr-roster-title-controls-<?php //echo $teamSlug ?>'>-->
    7876                                    <?php //echo $this -> build_roster_title( $teamSlug, $attribs ); ?>
    79                                     <div class='roster-sort-controls roster-sort-controls-<?php echo $teamSlug ?> MSTW-flex-row'>
    80                                         <?php echo $this -> build_roster_sort_controls( $teamSlug, $attribs, $args, $argsStr, $tableID ); ?>
     77                                    <div class='roster-sort-controls roster-sort-controls-<?php echo esc_html( $teamSlug ) ?> MSTW-flex-row'>
     78                                        <?php
     79                                        // build_roster_sort_controls buffers the output so I am escaping earlier then here
     80                                        $controls_escaped = $this -> build_roster_sort_controls( $teamSlug, $attribs, $args, $argsStr, $tableID );
     81                                        echo $controls_escaped;
     82                                        //echo $this -> build_roster_sort_controls( $teamSlug, $attribs, $args, $argsStr, $tableID );
     83                                        ?>
    8184                                    </div>
    8285                                <!-- </div> .mstw-tr-roster-title-controls -->
    8386                            <?php
    8487                            } ?>
    85                        
    86                        
    87                         <div class= 'mstw-tr-roster-players mstw-tr-roster-players-<?php echo $teamSlug ?>' id='mstw-tr-roster-players-<?php echo $tableID ?>'>
     88
     89                        <div class= 'mstw-tr-roster-players mstw-tr-roster-players-<?php echo esc_html( $teamSlug )?>' id='mstw-tr-roster-players-<?php echo esc_html( $tableID ) ?>'>
    8890                        <?php
    89                            
    9091                            // get the players
    9192                            $players = mstw_tr_build_player_list( $teamSlug, 'objects', $attribs );
    9293                       
    9394                            // build the html
    94                             echo $this -> buildTableHTML( $teamSlug, $players, $attribs, $shortcode, $tableID );
     95                            $table_escaped = $this -> buildTableHTML( $teamSlug, $players, $attribs, $shortcode, $tableID );
     96                            // I can't seem to escape late because I'm buffering the html then I output it
     97                            echo $table_escaped;
    9598                            ?>
    9699                        </div>
    … …  
    123126       
    124127        ?>
    125         <ul class='mstw-tr-roster-player-list mstw-tr-roster-player-list-<?php echo $teamSlug ?> mstw-tr-roster-player-list-<?php echo $tableID ?>'>
     128        <ul class='mstw-tr-roster-player-list mstw-tr-roster-player-list-<?php echo esc_html( $teamSlug ) ?> mstw-tr-roster-player-list-<?php echo esc_html( $tableID ) ?>'>
    126129           
    127130            <!-- Why is this needed ?? -->
    128131            <?php $team_class = 'mstw-tr-table_' . $teamSlug; ?>
    129             <div style='display:none' id='table-id'><?php echo $team_class ?></div>
     132            <div style='display:none' id='table-id'><?php echo esc_html( $team_class )?></div>
    130133       
    131134            <?php
    … …  
    141144                ?>
    142145                <li class='mstw-tr-roster-player'>
    143                     <div class='mstw-tr-roster-player-container mstw-tr-roster-player-container-<?php echo $teamSlug ?> MSTW-flex-row'>
     146                    <div class='mstw-tr-roster-player-container mstw-tr-roster-player-container-<?php echo esc_html( $teamSlug ) ?> MSTW-flex-row'>
    144147               
    145148                    <?php //PRIMARY INFO COLUMN ?>
    … …  
    149152                            // PHOTO COLUMN
    150153                            // 'profile' prevents link
    151                             echo $this -> buildPlayerPhoto( $player, $teamSlug, $attribs );
     154                            echo wp_kses_post( $this -> buildPlayerPhoto( $player, $teamSlug, $attribs ) );
    152155                        ?>
    153156                        </div>
    … …  
    158161                       
    159162                            <div class='mstw-tr-roster-player-position MSTW-uppercase'>
    160                                 <?php echo $this -> get_player_position( $player ); ?>
     163                                <?php echo esc_html( $this -> get_player_position( $player ) ); ?>
    161164                            </div>
    162165                           
    163166                            <div class='mstw-tr-roster-player-number-name MSTW-uppercase'>
    164167                                <?php
    165                                 $playerName = $this -> buildPlayerName( $player, $teamSlug, $attribs, 0 );
     168                                $playerNameLink_escaped = $this -> buildPlayerName( $player, $teamSlug, $attribs, 1 );
    166169                                $playerNumber = get_post_meta( $player->ID, 'player_number', true );
    167170                                ?>
    168                                 <span class='jersey'><?php echo $playerNumber ?></span><h3 class='player-name MSTW-uppercase'><?php echo $playerName ?> </h3>
     171                                <span class='jersey'><?php echo esc_html( $playerNumber ) ?></span>
     172                                <h3 class='player-name MSTW-uppercase'><?php echo $playerNameLink_escaped ?> </h3>
    169173                            </div>
    170174                           
    … …  
    175179                    <div class='mstw-tr-roster-player-other'>
    176180                        <div class='mstw-tr-roster-player-other-data'>                         
    177                             <span class='mstw-tr-player-data-1'><?php echo $dataField1 ?></span>
    178                             <span class='mstw-tr-player-data-2'><?php echo $dataField2 ?></span>
    179                             <span class='mstw-tr-player-data-3'><?php echo $dataField3 ?></span>                        </div>
     181                            <span class='mstw-tr-player-data-1'><?php echo esc_html( $dataField1 ) ?></span>
     182                            <span class='mstw-tr-player-data-2'><?php echo esc_html( $dataField2 ) ?></span>
     183                            <span class='mstw-tr-player-data-3'><?php echo esc_html( $dataField3 ) ?></span>                        </div>
    180184                        <div class='mstw-tr-roster-player-bio'>
    181                             <?php $playerLink = '<a href="' .  get_permalink( $player->ID ) . '?roster_type=' . $this -> safeGet( 'roster_type', $attribs, 'custom' ) . '&' . 'team=' . $teamSlug . '"'; ?>
    182                             <?php echo $playerLink ?>>> FULL BIO </a>  <!-- &#9654; -->
     185                            <?php $playerLink = get_permalink( $player->ID ) . '?roster_type=' . $this -> safeGet( 'roster_type', $attribs, 'custom' ) . '&' . 'team=' . $teamSlug . '"'; ?>
     186                            <a href="<?php echo esc_html( $playerLink ) ?>"> FULL BIO</a>
     187                           
    183188                        </div>
    184189                    </div> <?php // .mstw=tr=roster-player-other-data ?>
    … …  
    235240            $last_name = get_post_meta($player->ID, 'player_last_name', true );
    236241            $alt = "$first_name $last_name";
    237             $photo_html = "<img src='$photo_file_url' alt='$alt' />";
     242            $attr = "alt=$alt";
     243
     244            $photo_html = wp_get_attachment_image( get_post_thumbnail_id( $player->ID ),                                                                                         'thumbnail',
     245                                                                                         false,
     246                                                                                         $attr
     247                                                                                         );
    238248           
    239249        } else {
    … …  
    272282    //      $player - player CPT object (mstw_tr_player)
    273283    //      $options - shortcode args and team roster settings merged
    274     //      $addProfileLink - include a like to the player profile
     284    //      $addProfileLink - include a link to the player profile
    275285    //  RETURNS
    276286    //      $player_name in the specified format
    … …  
    298308        }
    299309       
    300         $player_html = $player_name;
    301        
    302         $paramStr = '?roster_type=' . $options['roster_type'];
    303         if ( $teamSlug ) {
    304             $paramStr .= "&team=$teamSlug";
     310        //$player_html = $player_name;
     311       
     312        if ( $addProfileLink ) {
     313            $paramStr = '?roster_type=' . $options['roster_type'];
     314            if ( $teamSlug ) {
     315                $paramStr .= "&team=$teamSlug";
     316            }
     317            $ret_html = '<a href="' .  esc_url( get_permalink( $player->ID ) ) . esc_html( $paramStr ) . '" ';
     318            $ret_html .= '>' . esc_html( $player_name ) . '</a>';
     319           
     320            //$ret_html = get_permalink( $player->ID ) . $paramStr . '" ';
     321            //$ret_html .= '>' . $player_html;
    305322        }
    306        
    307         $ret_html = '<a href="' .  get_permalink( $player->ID ) . $paramStr . '" ';
    308         $ret_html .= '>' . $player_html . '</a>';
    309        
    310         //if( $addProfileLink ) {
    311             //if ( $options['links_to_profiles'] ) {
    312                 //$player_html = '<a href="' .  get_permalink( $player->ID ) . '?roster_type=' . $options['roster_type'] . '" ';
    313                 //$player_html .= '>' . $player_name . '</a>';
    314             //}
    315         //}
    316    
    317         //return $player_html;
     323        else {
     324            $ret_html = $player_name;
     325           
     326        }
     327       
    318328        return $ret_html;
    319329       
    320     } //End: buildPlayerName()
     330    } //End: buildPlayerName( )
    321331
    322332    //-----------------------------------------------------------------------------
    … …  
    484494                //
    485495                // the team must be provided in the shortcode args;
    486                 //
    487                 /*
    488                 $team = $this -> safeGet( 'team', $atts, null );
    489                 if ( null === $team ) {
    490                     return '<h3>No team specified in shortcode.</h3>';
    491                 }
    492                 */
    493                
    494                 //
    495496                // the roster type comes from the shortcode args; defaults to 'custom'
    496497                //
    … …  
    530531       
    531532    //--------------------------------------------------------------------------------------
    532     // build_roster_sort_control - Returns the HTML for a team roster sort controls
     533    // build_roster_sort_controls - Returns the HTML for a team roster sort controls
    533534    //
    534535    //  ARGUMENTS:
    … …  
    558559           
    559560        ob_start( );
    560             echo $this -> build_roster_title( $team, $attribs );
     561            echo esc_html( $this -> build_roster_title( $team, $attribs ) );
    561562            ?>
    562563            <form id='tr-sort-controls' class='MSTW-flex-row' >
    563                 <input type='hidden' id='roster-team' value='<?php echo $team ?>'/>
    564                 <input type="hidden" id='tableID' value="<?php echo $tableID ?>" />
    565                 <input type="hidden" id='args_<?php echo $tableID ?>' value="<?php echo $argsStr ?>" />
     564                <input type='hidden' id='roster-team' value='<?php echo esc_html( $team ) ?>'/>
     565                <input type="hidden" id='tableID' value="<?php echo esc_html( $tableID ) ?>" />
     566                <input type="hidden" id='args_<?php echo esc_html( $tableID ) ?>' value="<?php echo esc_html( $argsStr )?>" />
    566567               
    567568                <div class='tr-sort-menu'>
    568                     <select name='tr-sort-menu' id='tr-sort-menu_<?php echo $tableID ?>'>
     569                    <select name='tr-sort-menu' id='tr-sort-menu_<?php echo esc_html( $tableID ) ?>'>
    569570                        <?php
    570571                        foreach( $choices as $slug => $label ) {
    571572                            $selected = ( $currentSortOrder == $slug ) ? 'selected="selected"' : '';
    572573                            ?>
    573                             <option value=<?php echo "$slug $selected" ?>> <?php echo $label ?></option>
     574                            <option value=<?php echo esc_html( "$slug $selected" ) ?>> <?php echo esc_html( $label ) ?></option>
    574575                            <?php
    575576                        }
    … …  
    579580               
    580581                <div class='tr-sort-button'>
    581                     <input type='button' class='secondary tr-sort-submit' id='<?php echo $tableID ?>' name='<?php echo $team ?>' value=<?php _e( 'Sort Roster', 'team-rosters' ) ?>/>
     582                    <input type='button' class='secondary tr-sort-submit' id='<?php echo esc_html( $tableID ) ?>' name='<?php echo esc_html( $team )?>' value=<?php esc_html_e( 'Sort Roster', 'team-rosters' ) ?>/>
    582583                </div>
    583584               

  • team-rosters/trunk/includes/mstw-tr-settings.php

    r3240856 r3270053  
    4848        <!-- The settings screen main form; includes all tabs -->
    4949        <div class="wrap">
    50             <h2><?php echo __( 'Team Rosters Plugin Settings', 'team-rosters') ?></h2>
     50            <h2><?php esc_html_e( 'Team Rosters Plugin Settings', 'team-rosters') ?></h2>
    5151           
    5252            <?php
    … …  
    136136                <tr>
    137137                    <td>
    138                         <input name="Submit" type="submit" class="button-primary" value="<?php _e( 'Save Changes', 'team-rosters' ) ?>" />
    139                    
    140                         <input type="submit" class="button-secondary" id="reset_btn" name="<?php echo $options_name ?>" onclick="tr_confirm_reset_defaults()" value="<?php _e( 'Reset Defaults', 'team-rosters' ) ?>" />
     138                        <input name="Submit" type="submit" class="button-primary" value="<?php esc_html_e( 'Save Changes', 'team-rosters' ) ?>" />
     139                   
     140                        <input type="submit" class="button-secondary" id="reset_btn" name="<?php echo esc_html( $options_name ) ?>" onclick="tr_confirm_reset_defaults()" value="<?php esc_html_e( 'Reset Defaults', 'team-rosters' ) ?>" />
    141141                    </td>
    142142                </tr>
    … …  
    164164            $class = ( $tab == $current_tab ) ? ' nav-tab-active' : '';
    165165            //echo "<a class='nav-tab$class' href='edit.php?post_type=mstw_tr_player&page=mstw-tr-settings&tab=$tab'>$name</a>";
    166             echo "<a class='nav-tab$class' href='admin.php?page=mstw-tr-settings&tab=$tab'>$name</a>";
     166            echo wp_kses_post( "<a class='nav-tab$class' href='admin.php?page=mstw-tr-settings&tab=$tab'>$name</a>" );
    167167        }
    168168        echo '</h2>';
    … …  
    222222                '<p>' . __('Note that these settings apply to ALL roster and player displays (tables, profiles, galleries) on the site. To control individual displays by team, set the corresponding arguments in the shortcodes.', 'team-rosters' ) . "</p>\n" .
    223223                '<p><a href="http://shoalsummitsolutions.com/tr-data-fields-columns/" target="_blank">' . __( 'See the Team Rosters Users Manual for more documentation.', 'team-rosters' ) . "</a></p>\n";
    224         echo $help;
     224        echo wp_kses_post( $help );
    225225    } //End:mstw_tr_data_fields_columns_help( )
    226226
    … …  
    231231                '<p><a href="http://shoalsummitsolutions.com/tr-roster-tables/" target="_blank">' . __( 'See the Team Rosters Users Manual for more documentation.', 'team-rosters' ) . "</a></p>\n";
    232232               
    233         echo $help;
     233        echo wp_kses_post( $help );
    234234    } //End: mstw_tr_roster_tables_help( )
    235235       
    … …  
    247247                "</a></p>\n";
    248248               
    249         echo $help;
     249        echo wp_kses_post( $help );
    250250    } //End: mstw_tr_roster_table_colors_help( )
    251251
    … …  
    256256                '<p>' . __('Note that these settings apply to ALL player profiles and galleries on the site. There are a number of other ways to customize the displays for individual teams, including shortcode arguments and custom stylesheets (CSS). See the Users Manual (link below) for more information.', 'team-rosters' ) . "</p>\n" .
    257257                '<p><a href="http://shoalsummitsolutions.com/tr-player-profiles-galleries/" target="_blank">' . __( 'See the Team Rosters Users Manual for more documentation.', 'team-rosters' ) . "</a></p>\n";
    258         echo $help;
     258        echo wp_kses_post( $help );
    259259    } //End: mstw_tr_player_profiles_galleries_help( )
    260260

  • team-rosters/trunk/includes/mstw-tr-team-roster-admin-class.php

    r3240856 r3270053  
    112112        if ( 'POST' == $_SERVER['REQUEST_METHOD'] ) {
    113113           
    114             $submit_value = array_key_exists( 'submit', $_POST ) ? stripslashes( $_POST[ 'submit' ] ) : null;
     114            $submit_value = array_key_exists( 'submit', $_POST ) ? wp_unslash( $_POST[ 'submit' ] ) : null;
    115115           
    116116            $this->post( compact( 'submit_value' ) );
    … …  
    122122        <div class="wrap">
    123123       
    124         <h1><?php echo $screen_titles[$edit] ?></h1>
     124        <h1><?php echo esc_html(  $screen_titles[$edit] ) ?></h1>
    125125       
    126126        <p class='mstw-lm-admin-instructions'>
    127          <?php _e( 'Read the contextual help tab on the top right of this screen.', 'team-rosters' ) ?>
     127         <?php esc_html_e( 'Read the contextual help tab on the top right of this screen.', 'team-rosters' ) ?>
    128128        </p>
    129129       
    … …  
    168168                ?>
    169169                    <h1 class='mstw-lm-admin-instructions'>
    170                       <?php _e( 'Create a team before editting it\'s roster.', 'team-rosters' );
     170                      <?php esc_html_e( 'Create a team before editting it\'s roster.', 'team-rosters' );
    171171                      ?>
    172172                    </h1>
    … …  
    180180                   
    181181                    if ( $edit ) {
    182                         // Don't want button on the Add Games Screen
     182                        // Don't want button on the Add Players Screen
    183183                        // Nothing to do if team is changed (ajax still fires)
    184184                        ?>
    185                         <a href="<?php  echo admin_url( 'admin.php?page=manage-team-rosters' )?>" class="button mstw-lm-control-button"><?php _e( 'Change Team', 'team-rosters' ) ?></a>
     185                        <a href="<?php  echo esc_url( admin_url( 'admin.php?page=manage-team-rosters' ) )?>" class="button mstw-lm-control-button"><?php esc_html_e( 'Change Team', 'team-rosters' ) ?></a>
    186186                       
    187187                        <?php
    188                         // Don't need pagination on the Add Games Screen
    189188                        $this -> build_pagination_links( $paged, $players_list -> max_num_pages );
    190189                       
    … …  
    193192               
    194193                        <br/><p class="description">
    195                           <?php _e( 'Caution! This button will update the table with the selected team roster WITHOUT SAVING any changes. Use the Update Roster button at the bottom of the screen to save any changes.', 'team-rosters' ) ?>
     194                          <?php esc_html_e( 'Caution! This button will update the table with the selected team roster WITHOUT SAVING any changes. Use the Update Roster button at the bottom of the screen to save any changes.', 'team-rosters' ) ?>
    196195                        <br/></p>
    197196                   
    … …  
    201200                        ?>
    202201                        <br/><p class="description">
    203                           <?php _e( 'Enter players for the selected team. No data will be processed on or after the first row with blank first and last names.', 'team-rosters' ) ?>
     202                          <?php esc_html_e( 'Enter players for the selected team. No data will be processed on or after the first row with blank first and last names.', 'team-rosters' ) ?>
    204203                        <br/></p>
    205204                        <?php
    … …  
    229228             
    230229              <!-- Submit button -->
     230                <?php wp_nonce_field( 'add-edit-players', 'mstw-tr-nonce' ); ?>
    231231              <tbody>
    232232              <tr>
    … …  
    276276          <tr>
    277277          <?php foreach ( $data_fields as $data_field ) { ?>
    278            <th><?php echo $data_field[0] ?></th>
     278           <th><?php echo esc_html( $data_field[0] ) ?></th>
    279279           
    280280          <?php } ?>
    … …  
    376376        if ( null === $player ) {
    377377            ?>
    378             <input type="hidden" name="<?php echo $this -> make_tag( "player_slug", $row_nbr ) ?>" value="<?php echo $this -> make_tag( '-1', $row_nbr ) ?>"/>
     378            <input type="hidden" name="<?php echo esc_html( $this -> make_tag( "player_slug", $row_nbr ) ) ?>" value="<?php echo esc_html( $this -> make_tag( '-1', $row_nbr ) ) ?>"/>
    379379            <?php
    380380            foreach ( $blank_player as $slug => $value ) {
    … …  
    398398            ?>
    399399           
    400             <input type="hidden" name="<?php echo $this -> make_tag( "player_slug", $row_nbr ) ?>" value="<?php echo $this -> make_tag( $player -> post_name, $row_nbr ) ?>"/>
     400            <input type="hidden" name="<?php echo esc_html( $this -> make_tag( "player_slug", $row_nbr ) ) ?>" value="<?php echo esc_html( $this -> make_tag( $player -> post_name, $row_nbr ) ) ?>"/>
    401401           
    402402            <?php
    … …  
    440440        ?>
    441441        <td>
    442           <input type='text' size='<?php echo $size ?>' maxlength = '<?php echo $maxlength ?>' id="<?php echo $tag?>" name="<?php echo $tag?>" value="<?php echo $value ?>" />
     442          <input type='text' size='<?php echo esc_html( $size ) ?>' maxlength = '<?php echo esc_html( $maxlength ) ?>' id="<?php echo esc_html( $tag ) ?>" name="<?php echo esc_html( $tag) ?>" value="<?php echo esc_html( $value ) ?>" />
    443443        </td>
    444444       
    … …  
    468468       
    469469        <td>
    470           <select id="<?php echo $tag?>" name="<?php echo $tag?>">
     470          <select id="<?php echo esc_html( $tag ) ?>" name="<?php echo esc_html( $tag ) ?>">
    471471            <?php foreach ( $options as $key => $value ) { ?>
    472                 <option value = "<?php echo $key ?>" <?php selected( $current_value, $key, true )?> > <?php echo $value ?> </option>
     472                <option value = "<?php echo esc_html( $key ) ?>" <?php selected( $current_value, $key, true )?> > <?php echo esc_html( $value ) ?> </option>
    473473            <?php } ?>
    474474          </select>
    … …  
    502502        ?>
    503503        <span class="tr-paginate-links">
    504           <?php echo paginate_links( $args ); ?>
     504          <?php echo wp_kses_post( paginate_links( $args ) ); ?>
    505505        </span>
    506506       
    … …  
    566566        if ( $team_list ) {
    567567            ?>
    568             <select name='<?php echo $css_tag ?>' id='<?php echo $css_tag ?>' >
     568            <select name='<?php echo esc_html( $css_tag ) ?>' id='<?php echo esc_html( $css_tag ) ?>' >
    569569            <?php
    570570            if ( !$edit ) {
    … …  
    577577                $selected = selected( $slug, $current_team, false );
    578578                ?>
    579                 <option value=<?php echo "$slug $selected" ?>><?php echo $name ?> </option>
     579                <option value=<?php echo esc_html( "$slug $selected" ) ?>><?php echo esc_html( $name ) ?> </option>
    580580            <?php       
    581581            }
    … …  
    655655    function post( $options ) {
    656656        //mstw_log_msg( 'MSTW_TR_TEAM_ROSTERS_ADMIN.post:' );
     657        //
     658        //first, do a few checks on form
     659        //
     660       
     661        if ( isset( $_POST['mstw-tr-nonce'] ) ) {
     662            //wp_verify_nonce( sanitize_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     663            $safeNonce = wp_esc_key( wp_unslash( $_POST['mstw-tr-nonce'] ) );
     664           
     665            if ( !wp_verify_nonce( $safeNonce, 'add-edit-players' ) ) {
     666                mstw_tr_add_admin_notice( 'error', __( 'Problem encountered updating roster. Exiting.', 'team-rosters' ) );
     667                mstw_log_msg( 'MSTW_TR_TEAM_ROSTERS_ADMIN.post: Problem encountered updating roster; bad nonce. Exiting.' );
     668                return;
     669            }
     670           
     671        } else {
     672            mstw_tr_add_admin_notice( 'error', __( 'Problem encountered updating roster. Exiting.', 'team-rosters' ) );
     673            mstw_log_msg( 'MSTW_TR_TEAM_ROSTERS_ADMIN.post: Problem encountered updating roster; nonce missing. Exiting.' );
     674            return;
     675           
     676        }
    657677       
    658678        if ( !$options ) {
    659             mstw_tr_add_admin_notice( 'error', __( 'Problem encountered updating games. Exiting.', 'team-rosters' ) );
    660             mstw_log_msg( 'MSTW_TR_TEAM_ROSTERS_ADMIN.post: Problem encountered updating games. Exiting.' );
     679            mstw_tr_add_admin_notice( 'error', __( 'Problem encountered updating roster; $options array missing. Exiting.', 'team-rosters' ) );
     680            mstw_log_msg( 'MSTW_TR_TEAM_ROSTERS_ADMIN.post: Problem encountered updating roster; nonce missing. Exiting.' );
    661681            return;
    662682        }
    … …  
    951971        //mstw_log_msg( "MSTW_TR_TEAM_ROSTERS_ADMIN.edit_rosters_help_content:" );
    952972                ?>
    953                 <p><?php _e( 'Use this screen to edit the players on a roster in bulk - up to 20 at time. First use the drop-down menu to select the team roster to be edited.', 'team-rosters' ) ?></p>
    954                
    955                 <p><?php _e( 'While players can be edited on this screen much faster than the Manage Players screen, there are some restrictions. The Player Title, Player Slug, Player Team(s), Player Photo, and Player Profile fields cannot be edited on this screen. Use the Manage Players screen.', 'team-rosters' ) ?></p>
     973                <p><?php esc_html_e( 'Use this screen to edit the players on a roster in bulk - up to 20 at time. First use the drop-down menu to select the team roster to be edited.', 'team-rosters' ) ?></p>
     974               
     975                <p><?php esc_html_e( 'While players can be edited on this screen much faster than the Manage Players screen, there are some restrictions. The Player Title, Player Slug, Player Team(s), Player Photo, and Player Profile fields cannot be edited on this screen. Use the Manage Players screen.', 'team-rosters' ) ?></p>
    956976               
    957977                <p>See the <a href="http://shoalsummitsolutions.com/category/users-manuals/tr-plugin/" target="_blank">MSTW Team Rosters users manual</a> for more details.</p>
    … …  
    973993        //mstw_log_msg( "MSTW_TR_TEAM_ROSTERS_ADMIN.add_players_help_content:" );       
    974994                ?>
    975                 <p><?php _e( 'Use this screen to add players to rosters in bulk - up to 20 at time. First use the drop-down menu to select the team to which to add players.', 'team-rosters' ) ?></p>
    976                
    977                 <p><?php _e( 'While players can be added on this screen much faster than the Manage Players screen, there are the following restrictions:', 'team-rosters' ) ?></p>
     995                <p><?php esc_html_e( 'Use this screen to add players to rosters in bulk - up to 20 at time. First use the drop-down menu to select the team to which to add players.', 'team-rosters' ) ?></p>
     996               
     997                <p><?php esc_html_e( 'While players can be added on this screen much faster than the Manage Players screen, there are the following restrictions:', 'team-rosters' ) ?></p>
    978998               
    979999                <ul>
    980                   <li><?php _e( 'The Player Title will be set to "First_Name Last_Name.', 'team-rosters' ) ?> </li>
    981                   <li><?php _e( 'The Player Slug will be set to "first_name-last_name.', 'team-rosters' ) ?> </li>
    982                   <li><?php _e( 'Each Player will be added to only the selected team. Use the Manage Players screen to add a player to muliple teams.', 'team-rosters' ) ?> </li>
    983                   <li><?php _e( 'Use the Manage Players screen to add Player Photos and Player Profiles.', 'team-rosters' ) ?> </li>
     1000                  <li><?php esc_html_e( 'The Player Title will be set to "First_Name Last_Name.', 'team-rosters' ) ?> </li>
     1001                  <li><?php esc_html_e( 'The Player Slug will be set to "first_name-last_name.', 'team-rosters' ) ?> </li>
     1002                  <li><?php esc_html_e( 'Each Player will be added to only the selected team. Use the Manage Players screen to add a player to muliple teams.', 'team-rosters' ) ?> </li>
     1003                  <li><?php esc_html_e( 'Use the Manage Players screen to add Player Photos and Player Profiles.', 'team-rosters' ) ?> </li>
    9841004                </ul>
    9851005               
    986                 <p><a href="http://shoalsummitsolutions.com/category/users-manuals/tr-plugin/" target="_blank"><?php _e( 'See the MSTW Team Rosters users manual for more details.', 'team-rosters' ) ?></a></p>
     1006                <p><a href="http://shoalsummitsolutions.com/category/users-manuals/tr-plugin/" target="_blank"><?php esc_html_e( 'See the MSTW Team Rosters users manual for more details.', 'team-rosters' ) ?></a></p>
    9871007               
    9881008                <?php               

  • team-rosters/trunk/includes/mstw-tr-team-tax-admin-class.php

    r3240856 r3270053  
    9494              <div class="form-field">
    9595                    <p class="plugin-not-installed">
    96                     <?php esc_html( printf( '%s', $value['warning'] ) ); ?>
     96                    <?php //printf( '%s', $value['warning'] );
     97                    echo esc_html( $value['warning'] ) ?>
    9798                    </p>
    9899              </div>
    … …  
    107108               
    108109                <div class="form-field">
    109                   <label for=<?php echo $id ?>><?php echo $value['title'] ?></label>
     110                  <label for=<?php echo esc_html( $id ) ?>><?php echo esc_html( $value['title'] ) ?></label>
    110111                 
    111                   <select id='<?php echo $key ?>' name='<?php echo $key ?>' class='mstw-tr-tax-select-team' >
     112                  <select id='<?php echo esc_html( $key ) ?>' name='<?php echo esc_html( $key ) ?>' class='mstw-tr-tax-select-team' >
    112113                    <?php
    113114                    $options = $this -> build_teams_list( $value['post_type'] );
    … …  
    116117                        $selected = selected( -1, $v, false );
    117118                        ?>
    118                         <option value='<?php echo $v ?>' <?php echo $selected?>><?php echo $k ?></option>
     119                        <option value='<?php echo esc_html( $v ) ?>' <?php echo esc_html( $selected ) ?>><?php echo esc_html( $k ) ?></option>
    119120                    <?php } ?>
    120121                  </select>
    … …  
    175176            ?>
    176177              <td>
    177                 <p class="plugin-not-installed"><?php echo $value['warning'] ?></p>
     178                <p class="plugin-not-installed"><?php echo esc_html( $value['warning'] )?></p>
    178179              </td>
    179180             
    … …  
    183184                ?>
    184185                <td>
    185                   <select id='<?php echo $key ?>' name='<?php echo $key ?>' class='mstw-tr-tax-select-team' >
     186                  <select id='<?php echo esc_html( $key ) ?>' name='<?php echo esc_html( $key ) ?>' class='mstw-tr-tax-select-team' >
    186187                    <?php
    187188                    $options = $this -> build_teams_list( $value['post_type'] );
    … …  
    194195                        }
    195196                        ?>
    196                         <option value='<?php echo $v ?>' <?php echo $selected ?>><?php echo $k ?></option>
     197                        <option value='<?php echo esc_html( $v )?>' <?php echo esc_html( $selected ) ?>><?php echo esc_html( $k ) ?></option>
    197198                    <?php } ?>
    198199                  </select>
    199200                 
    200                   <?php echo $value['title'] ?>
     201                  <?php echo esc_html( $value['title'] )?>
    201202               
    202203                </td> <!-- .form-field -->
    … …  
    427428            case 'manage-teams-help':
    428429                ?>
    429                 <p><?php _e( 'This screen provides management (add, edit, delete) of teams.', 'team-rosters' ) ?></p>
    430                 <p><?php _e( 'Each team may be linked to a team in the MSTW Schedules & Scoreboards or the MSTW League Manager database. These links will allow team logos to be pulled from the database, and team colors for links  the Schedules & Scoreboard', 'team-rosters' ) ?></p>
    431                 <p><?php _e( 'Teams may be added on this page. They may also be added in bulk via the CSV Import screen.', 'team-rosters' ) ?></p>
    432                 <p><?php _e( 'Roll over a team name, and select "Edit" to modify the data for an existing team." ', 'team-rosters' ) ?></p>
    433                 <p><?php _e( 'Roll over a team name, and select "Delete" to remove a team. Any players assigned to the team will be removed from the team, but will remain in the players database." ', 'team-rosters' ) ?></p>
    434                
    435                 <p><a href="http://shoalsummitsolutions.com/tr-data-entry-teams/" target="_blank"><?php _e( 'See the Data Entry - Teams man page for more details.', 'team-rosters' ) ?></a></p>
     430                <p><?php esc_html_e( 'This screen provides management (add, edit, delete) of teams.', 'team-rosters' ) ?></p>
     431                <p><?php esc_html_e( 'Each team may be linked to a team in the MSTW Schedules & Scoreboards or the MSTW League Manager database. These links will allow team logos to be pulled from the database, and team colors for links  the Schedules & Scoreboard', 'team-rosters' ) ?></p>
     432                <p><?php esc_html_e( 'Teams may be added on this page. They may also be added in bulk via the CSV Import screen.', 'team-rosters' ) ?></p>
     433                <p><?php esc_html_e( 'Roll over a team name, and select "Edit" to modify the data for an existing team." ', 'team-rosters' ) ?></p>
     434                <p><?php esc_html_e( 'Roll over a team name, and select "Delete" to remove a team. Any players assigned to the team will be removed from the team, but will remain in the players database." ', 'team-rosters' ) ?></p>
     435               
     436                <p><a href="http://shoalsummitsolutions.com/tr-data-entry-teams/" target="_blank"><?php esc_html_e( 'See the Data Entry - Teams man page for more details.', 'team-rosters' ) ?></a></p>
    436437               
    437438                <?php               
    … …  
    440441            case 'edit-team-help':
    441442                ?>
    442                 <p><?php _e( 'Use this screen to modify the information for an existing team.', 'team-rosters' ) ?></p>
    443                
    444                 <p><a href="http://shoalsummitsolutions.com/tr-data-entry-teams/" target="_blank"><?php _e( 'See the Data Entry - Teams man page for more details.', 'team-rosters' ) ?></a></p>
     443                <p><?php esc_html_e( 'Use this screen to modify the information for an existing team.', 'team-rosters' ) ?></p>
     444               
     445                <p><a href="http://shoalsummitsolutions.com/tr-data-entry-teams/" target="_blank"><?php esc_html_e( 'See the Data Entry - Teams man page for more details.', 'team-rosters' ) ?></a></p>
    445446               
    446447               

  • team-rosters/trunk/includes/mstw-tr-utility-functions.php

    r3240856 r3270053  
    736736            $output = sprintf(
    737737                /* translators: %s: team slug (permalink)*/
    738                 __( "No players found on team: '%s'", 'team-rosters' ), $team_slug );
     738                esc_html__( "No players found on team: '%s'", 'team-rosters' ), $team_slug );
    739739        }
    740740
    … …  
    11551155 //         null if logo can't be found/built
    11561156 //         logo html with alt, and with link to team site, if available
     1157 //         1. Use the team logo from the S&S or LM DB, if available,
     1158 //         2. Else use the team logo in the theme's /team-rosters/images/ dir
     1159 //         3. Else use the default-logo-team-slug.png from the plugin images dir
     1160 //         4. Else use the default-logo.png (mystery player) from the plugin images dir
     1161
    11571162 //
    11581163 if ( !function_exists( 'mstw_tr_build_team_logo' ) ) {
    11591164    function mstw_tr_build_team_logo( $team_slug = null, $type='player' ) {
    1160         //1. Use the team logo from the S&S or LM DB, if available,
    1161         //2. Else use the team logo in the theme's /team-rosters/images/ dir
    1162         //3. Else use the default-logo-team-slug.png from the plugin images dir
    1163         //4. Else use the default-logo.png (mystery player) from the plugin images dir
    1164 
    1165         //mstw_tr_log_msg( 'mstw_tr_build_team_logo:' );
     1165        //mstw_log_msg( 'mstw_tr_build_team_logo:' );
    11661166
    11671167        if( null === $team_slug ) {
    … …  
    16311631                ?>
    16321632                <tr class='mstw-divider-spacer'><td>&nbsp;&nbsp;</td></tr>
    1633                 <tr class='mstw-divider'><th colspan=2 ><?php echo $divider_msg ?></th></tr>
     1633                <tr class='mstw-divider'><th colspan=2 ><?php echo esc_html( $divider_msg ) ?></th></tr>
    16341634                <?php
    16351635            }
    … …  
    16471647                <tr>
    16481648                <?php //if ( "" != $label ) { ?>
    1649                     <th><label for '<?php echo $field_data['id']?>' >
    1650                         <?php echo $label ?>
     1649                    <th><label for '<?php echo esc_html( $field_data['id'] )?>' >
     1650                        <?php echo esc_html( $label ) ?>
    16511651                    </label></th>
    16521652            <?php //} ?>
    … …  
    17181718        $name = ( !empty( $name ) ) ? $name : $id;
    17191719       
    1720         // pass the standard value if the option is not yet set in the database
    1721         //if ( !isset( $options[$id] ) && $options[ != 'checkbox' && ) {
    1722         //  $options[$id] = ( isset( $default ) ? $default : 'default_field' );
    1723         //}
    1724        
    17251720        // Additional field class. Output only if the class is defined in the $args()
    17261721        $class_str = ( !empty( $class ) ) ? "class='$class'" : '' ;
    … …  
    17351730            case 'color':   // color field is just a text field with associated JavaScript
    17361731            ?>
    1737                 <input type="text" id="<?php echo $id ?>" name="<?php echo $name ?>" value="<?php echo $curr_value ?>" <?php echo $attrib_str ?> />
     1732                <input type="text" id="<?php echo esc_html( $id ) ?>" name="<?php echo esc_html( $name ) ?>" value="<?php echo esc_html( $curr_value ) ?>" <?php echo esc_attr( $attrib_str ) ?> />
    17381733            <?php
    1739                 echo ( !empty( $desc ) ) ? "<br /><span class='description'>$desc</span>\n" : "";
     1734                echo ( !empty( $desc ) ) ? "<br /><span class='description'>" . esc_html( $desc ) . "</span>\n" : "";
    17401735                break;
    17411736               
    … …  
    17471742                $options = $args['options'];
    17481743                   
    1749                 echo "<select id='$id' name='$name' $attrib_str >";
     1744                echo "<select id='" . esc_html( $id ) . "' name='" . esc_html( $name ) . "'" . esc_attr( $attrib_str ) . "'>";
    17501745                    foreach( $options as $key=>$value ) {
    17511746                        $selected = ( $curr_value == $value ) ? 'selected="selected"' : '';
    1752                         echo "<option value='$value' $selected>$key</option>";
     1747                        echo "<option value='" . esc_html( $value ) . "'" . esc_html( $selected ) . ">" . esc_html( $key ) . "</option>";
    17531748                    }
    17541749                echo "</select>";
    1755                 echo ( !empty( $desc ) ) ? "<br /><span class='description'>$desc</span>" : "";
     1750                echo ( !empty( $desc ) ) ? "<br /><span class='description'>" . esc_html( $desc ) . "</span>" : "";
    17561751                break;
    17571752           
    17581753            // CHECKBOX
    17591754            case 'checkbox':
    1760                 echo "<input class='checkbox $class_str' type='checkbox' id='$id' name='$name' value=1 " . checked( $curr_value, 1, false ) . " />";
    1761                 echo ($desc != '') ? "<br /><span class='description'>$desc</span>" : "";   
     1755                echo "<input class='checkbox " . esc_html( $class_str ) . "' type='checkbox' id='" . esc_html( $id ) . "' name='" . esc_html( $name ) . "' value=1 " . checked( esc_html( $curr_value ), 1, false ) . " />";
     1756                //echo "<input class='checkbox $class_str' type='checkbox' id='$id' name='$name' value=1 " . checked( $curr_value, 1, false ) . " />";
     1757                echo ($desc != '') ? "<br /><span class='description'>". esc_html( $desc ) . "</span>" : "";   
    17621758                break;
    17631759               
    17641760            // LABEL
    17651761            case 'label':
    1766                 echo "<span class='description'>" . $curr_value . "</span>";
    1767                 echo ( '' != $desc ) ? "<br /><span class='description'>$desc</span>" : "";
     1762                echo "<span class='description'>" . esc_html( $curr_value ) . "</span>";
     1763                echo ( '' != $desc ) ? "<br /><span class='description'>" . esc_html( $desc ) . "</span>" : "";
    17681764                break;
    17691765               
    … …  
    17721768                ?>
    17731769                <td class="uploader">
    1774                     <input type="text" name="<?php echo $id  ?>" id="<?php echo $id ?>" class="mstw_logo_text" size="30" value="<?php echo $curr_value ?>"/>
    1775                     <?php echo ($desc != '') ? "<br /><span class='description'>$desc</span>" : ""; ?>
     1770                    <input type="text" name="<?php echo esc_html( $id ) ?>" id="<?php echo esc_html( $id ) ?>" class="mstw_logo_text" size="30" value="<?php echo esc_html( $curr_value ) ?>"/>
     1771                    <?php echo ($desc != '') ? "<br /><span class='description'>" . esc_html( $desc ) . "</span>" : ""; ?>
    17761772                </td>
    17771773               
    17781774                <td class="uploader">
    1779                   <input type="button" class="button" name="<?php echo $id . '_btn'?>" id="<?php echo $id . '_btn'?>" value="<?php echo $btn_label ?>" />
     1775                  <input type="button" class="button" name="<?php echo esc_html( $id ) . '_btn'?>" id="<?php echo esc_html( $id ) . '_btn'?>" value="<?php echo esc_html( $btn_label ) ?>" />
    17801776                <!-- </div> -->
    17811777                </td>
    17821778                <td>
    1783                 <img id="<?php echo $id . '_img' ?>" width="<?php echo $img_width ?>" src="<?php echo $curr_value ?>" />
     1779                <img id="<?php echo esc_html( $id ) . '_img' ?>" width="<?php echo esc_html( $img_width  )?>" src="<?php echo esc_html( $curr_value ) ?>" />
    17841780                </td>
    17851781        <?php
    … …  
    17901786            // THE FOLLOWING CASES HAVE NOT BEEN TESTED/USED
    17911787           
     1788            /*
    17921789            case "multi-text":
    17931790                foreach($options as $item) {
    … …  
    18431840                    }
    18441841                   
    1845                     echo "<input class='checkbox$field_class' type='checkbox' id='$id|$item[1]' name='" . $wptuts_option_name . "[$id|$item[1]]' value='1' $checked /> $item[0] <br/>";
     1842                    //echo "<input class='checkbox'. esc_html( $field_class) . "' type='checkbox' id='" . esc_html( $id) . "|" esc_html( $item[1]) . "' name='" . esc_html( $wptuts_option_name ) . "[$id|$item[1]]' value='1' $checked /> $item[0] <br/>";
    18461843                }
    1847                 echo ($desc != '') ? "<br /><span class='description'>$desc</span>" : "";
     1844                echo ($desc != '') ? "<br /><span class='description'>" . esc_html( $desc ) . "</span>" : "";
    18481845            break;
     1846            */
    18491847           
    18501848            default:
    18511849                mstw_tr_log_msg( "CONTROL TYPE $type NOT RECOGNIZED." );
    1852                 echo "CONTROL TYPE $type NOT RECOGNIZED.";
     1850                echo "CONTROL TYPE ", esc_html( $type ), " NOT RECOGNIZED.";
    18531851            break;
    18541852           
    … …  
    20302028// NEW STUFF FOR NEW MSTW TEAM ROSTERS
    20312029//
    2032 
     2030/*
    20332031//------------------------------------------------------------------------------------
    20342032// a. mstw_tr_get_current_sport - gets the current sport from the options DB
    … …  
    20482046    } //End: mstw_tr_get_current_sport()
    20492047}
    2050 
     2048*/
     2049
     2050/*
    20512051//------------------------------------------------------------------------------------
    20522052// b. mstw_tr_set_current_sport - sets the current sport in the options DB
    … …  
    20662066    } //End: mstw_tr_set_current_sport()
    20672067}
     2068*/
    20682069
    20692070// ------------------------------------------------------------------------------
    … …  
    20782079//      Outputs the HTML control and returns the number of sports found
    20792080//      Otherwise, returns -1 if no sports are found
    2080 //     
     2081//
     2082/*
    20812083if ( !function_exists( 'mstw_tr_build_sport_select' ) ) {
    20822084    function mstw_tr_build_sport_select( $current_sport = '', $id = '', $showDefault = false ) {
    … …  
    20982100       
    20992101            ?>
    2100             <select name=<?php echo $id ?> id=<?php echo $id ?> >
     2102            <select name=<?php echo esc_html( $id ) ?> id=<?php echo esc_html( $id ) ?> >
    21012103            <?php foreach ( $sports as $slug => $name ) {
    21022104                $selected = selected( $slug, $current_sport, false );
    21032105                ?>
    2104                 <option value=<?php echo "$slug $selected" ?>><?php echo $name ?> </option>
     2106                <option value=<?php echo esc_html( $slug ) . " " . esc_html( $selected) ?>><?php echo esc_html( $name ) ?> </option>
    21052107               
    21062108                <?php
    … …  
    21162118    } //End: mstw_tr_build_sport_select()
    21172119}
    2118 
     2120*/
     2121   
     2122/*
    21192123// ------------------------------------------------------------------------------
    21202124// d. mstw_tr_build_sports_list - Returns a default array of sports as
    … …  
    21972201    } //End: mstw_lm_build_sports_list( )
    21982202}
     2203*/

  • team-rosters/trunk/includes/mstw-utility-functions.php

    r3240856 r3270053  
    2626 * 1. mstw_log_msg - writes debug messages to /wp-content/debug.log
    2727 *                   if the WP_DEBUG settings in wp-config are correct
    28  * 2. mstw_requires_wordpress_version - checks for the right WordPress version
     28 * 2. mstw_requires_wordpress_version - checks for the right WordPress version 
    2929 * 3. mstw_safe_ref - prevents uninitialized string errors
    3030 * 3.1  mstw_safe_get - Safely get value for a key from an array
    … …  
    5454//------------------------------------------------------------------------------
    5555//  1. mstw_log_msg - logs messages to /wp-content/debug IF WP_DEBUG is true
     56//              this function is used for DEBUGGING. It's not intended for production
     57//              unless there is a REAL ERROR.
    5658//      ARGUMENTS:
    5759//          $msg - string, array, or object to log
    … …  
    7577    } //End: mstw_log_msg( )
    7678}
     79
    7780
    7881//------------------------------------------------------------------------------
    … …  
    8487//  THIS FUNCTION ONLY WORKS IN ADMIN (because it calls get_plugin_data()
    8588//
    86 if ( !function_exists( 'mstw_requires_wordpress_version' ) ) {
    87     function mstw_requires_wordpress_version( $version = '3.9.2' ) {
    88         global $wp_version;
    89        
    90         $plugin = MSTW_SS_PLUGIN_NAME;
    91         //$plugin_data = get_plugin_data( __FILE__, false );
    92         $plugin_data = get_plugin_data( MSTW_SS_PLUGIN_DIR . '/mstw-schedules-scoreboards.php',
    93                                         false );
    94 
    95         if ( version_compare( $wp_version, $version, "<" ) ) {
    96             if( is_plugin_active( $plugin ) ) {
    97                 deactivate_plugins( $plugin );
    98                 $die_msg = $plugin_data['Name'] . " requires WordPress $version or higher, and has been deactivated! <br/> Please upgrade WordPress and try again.<br /><br /><a href='".admin_url()."'>Back to admin dashboard</a>.";
    99                 die( $die_msg );
    100             }
    101         }
    102     } //end mstw_requires_wordpress_version()
    103 }
     89/*
     90 * Removed from team rosters version
     91 */
    10492
    10593// ----------------------------------------------------------------
    … …  
    237225                    break;
    238226                case 'D' :
    239                     $return .= $param_D[date('N', $timestamp)];
     227                    $return .= $param_D[gmdate('N', $timestamp)];
    240228                    break;
    241229                case 'l' :
    242                     $return .= $param_l[date('N', $timestamp)];
     230                    $return .= $param_l[gmdate('N', $timestamp)];
    243231                    break;
    244232                case 'F' :
    245                     $return .= $param_F[date('n', $timestamp)];
     233                    $return .= $param_F[gmdate('n', $timestamp)];
    246234                    break;
    247235                case 'M' :
    248                     $return .= $param_M[date('n', $timestamp)];
     236                    $return .= $param_M[gmdate('n', $timestamp)];
    249237                    break;
    250238                default :
    251                     $return .= date($format[$i], $timestamp);
     239                    $return .= gmdate($format[$i], $timestamp);
    252240                    break;
    253241            }
    … …  
    274262//  );
    275263//
    276 if( !function_exists( 'mstw_build_admin_edit_screen' ) ) { 
    277     function mstw_build_admin_edit_screen( $fields ) {
    278        
    279         foreach( $fields as $field_id=>$field_data ) {
    280             //HANDLE table dividers here ... NEW
    281             if ( $field_data['type'] == 'divider' ) {
    282                 $divider_msg = ( isset( $field_data['curr_value'] ) ) ? $field_data['curr_value'] : '&nbsp;&nbsp;';
    283                 ?>
    284                 <tr class='mstw-divider-spacer'><td>&nbsp;&nbsp;</td></tr>
    285                 <tr class='mstw-divider'><th colspan=2 ><?php echo $divider_msg ?></th></tr>
    286                 <?php
    287             }
    288             else {
    289                 $field_data['id'] = ( !isset( $field_data['id'] ) || empty( $field_data['id'] ) ) ? $field_id : $field_data['id'];
    290                 $field_data['name'] = ( !isset( $field_data['name'] ) || empty( $field_data['name'] ) ) ? $field_id : $field_data['name'];
    291                
    292                 // check the field label/title
    293                 if ( array_key_exists( 'label', $field_data ) && !empty( $field_data['label'] ) )
    294                     $label = $field_data['label'];
    295                 else
    296                     $label = '';
    297                 ?>
    298                
    299                 <tr>
    300                     <th><label for '<?php echo $field_data['id']?>' >
    301                         <?php echo $label ?>
    302                     </label></th>
    303                     <?php
    304                     // media-uploader will add it's own cells (3 of theme)
    305                     if ( $field_data['type'] != 'media-uploader' ) {
    306                         echo "<td>\n";
    307                     }
    308 
    309                        
    310                         mstw_build_admin_edit_field( $field_data );
    311 
    312                     if ( $field_data['type'] != 'media-uploader' ) {
    313                         echo "</td>\n";
    314                     }
    315                     ?>
    316                     </tr>
    317                 <?php
    318             }
    319         }
    320        
    321     } //End: mstw_build_admin_edit_screen()
    322 }
     264/*
     265 * Removed from team rosters version
     266 */
    323267
    324268//-------------------------------------------------------------------------------
    … …  
    339283//     
    340284//
    341 if( !function_exists( 'mstw_build_admin_edit_field' ) ) {
    342     function mstw_build_admin_edit_field( $args ) {
    343    
    344         $defaults = array(
    345                 'type'         => 'text',
    346                 'id'         => 'default_field', // the ID of the setting in our options array, and the ID of the HTML form element
    347                 'title'      => __( 'Default Field', 'team-rosters' ), // the label for the HTML form element
    348                 'label'      => __( 'Default Label', 'team-rosters' ), // the label for the HTML form element
    349                 'desc'         => '', // the description displayed under the HTML form element
    350                 'default'      => '',  // the default value for this setting
    351                 'type'       => 'text', // the HTML form element to use
    352                 'options'    => array(), // (optional): the values in radio buttons or a drop-down menu
    353                 'name'         => '', //name of HTML form element. should be options_array[option]
    354                 'class'      => '',  // the HTML form element class. Also used for validation purposes!
    355                 'curr_value' => '',  // the current value of the setting
    356                 'maxlength'  => '',  // maxlength attrib of some input controls
    357                 'size'         => '',  // size attrib of some input controls
    358                 'img_width'  => 60,
    359                 'btn_label'  => 'Upload from Media Library',
    360                 );
    361        
    362         // "extract" to be able to use the array keys as variables in our function output below
    363         $args = wp_parse_args( $args, $defaults );
    364    
    365         extract( $args );
    366        
    367         // default name to id
    368         $name = ( !empty( $name ) ) ? $name : $id;
    369        
    370         $name = esc_attr( $name );
    371        
    372         $id   = esc_attr( $id );
    373        
    374         // pass the standard value if the option is not yet set in the database
    375        
    376         // Additional field class. Output only if the class is defined in the $args()
    377         $class_str = ( !empty( $class ) ) ? "class='$class'" : '';
    378         $maxlength_str = ( !empty( $maxlength ) ) ? "maxlength='$maxlength'" : '' ;
    379         $size_str = ( !empty( $size ) ) ? "size='$size'" : '' ;
    380         $attrib_str = " $class_str $maxlength_str $size_str ";
    381        
    382         $desc = esc_html( $desc );
    383         $desc_html = ( !empty( $desc ) ) ? "<br /><span class='description'>$desc</span>" : "";
    384        
    385 
    386         // switch html display based on the setting type.
    387         switch ( $args['type'] ) {
    388             //TEXT & COLOR CONTROLS
    389             case 'text':    // this is the default type
    390             case 'color':   // color field is just a text field with associated JavaScript
    391             ?>
    392                 <input type="text" id="<?php echo $id ?>" name="<?php echo $name ?>" value="<?php echo $curr_value ?>" <?php echo $attrib_str ?> />
    393             <?php
    394                 echo $desc_html;
    395                 break;
    396                
    397             //SELECT OPTION CONTROL
    398             case 'select-option':
    399                 //not sure why this is needed given the extract() above
    400                 //but without it you get an extra option with the
    401                 //'option-name' displayed (huh??)
    402                 $options = $args['options'];
    403                    
    404                 echo "<select id='$id' name='$name' $attrib_str >";
    405                     foreach( $options as $key=>$value ) {
    406                         $selected = ( $curr_value == $value ) ? 'selected="selected"' : '';
    407                         $value = esc_attr( $value );
    408                         $key   = esc_html( $key );
    409                         echo "<option value='$value' $selected>$key</option>";
    410                     }
    411                 echo "</select>";
    412                 echo $desc_html;
    413                 break;
    414            
    415             // CHECKBOX
    416             case 'checkbox':
    417                 echo "<input class='checkbox $class_str' type='checkbox' id='$id' name='$name' value=1 " . checked( $curr_value, 1, false ) . " />";
    418                 echo $desc_html;
    419                 break;
    420                
    421             // LABEL
    422             case 'label':
    423                 echo "<span class='description'>" . esc_html( $curr_value ) . "</span>";
    424                 echo $desc_html;
    425                 break;
    426                
    427             // MEDIA UPLOADER
    428             case 'media-uploader':
    429                 ?>
    430                 <td class="uploader">
    431                     <input type="text" name="<?php echo $id  ?>" id="<?php echo $id ?>" class="mstw_logo_text" size="32" value="<?php echo esc_attr( $curr_value )?>"/>
    432                     <?php echo $desc_html; ?>
    433                 </td>
    434                
    435                 <td class="uploader">
    436                   <input type="button" class="button" name="<?php echo $id . '_btn'?>" id="<?php echo $id . '_btn'?>" value="<?php echo esc_attr( $btn_label ) ?>" />
    437                 <!-- </div> -->
    438                 </td>
    439                 <td>
    440                 <img id="<?php echo $id . '_img' ?>" width="<?php echo esc_attr( $img_width )?>" src="<?php echo esc_attr( $curr_value ) ?>" />
    441                 </td>
    442         <?php
    443                 break;
    444                
    445             default:
    446                 echo "CONTROL TYPE $type NOT RECOGNIZED.";
    447                 break;
    448            
    449         }   //End: switch ( $args['type'] ) {
    450            
    451     } //End: mstw_build_admin_edit_field()
    452 }
     285/*
     286 * Removed from team rosters version
     287 */
     288
    453289
    454290//-------------------------------------------------------------------------------
    … …  
    459295//          None. HTML is ouput/echoed to the screen by mstw_build_settings_field()
    460296//
    461 if( !function_exists( 'mstw_build_settings_screen' ) ) {   
    462     function mstw_build_settings_screen( $arguments ) {
    463         foreach ( $arguments as $args ) {
    464             mstw_build_settings_field( $args );
    465         }
    466     }  //End: mstw_build_settings_screen()
    467 }
     297/*
     298 * Removed from team rosters version
     299 */
    468300
    469301//-------------------------------------------------------------------------------
    … …  
    476308//          None. HTML is output/echoed to screen
    477309//     
    478 if( !function_exists( 'mstw_build_settings_field' ) ) {
    479     function mstw_build_settings_field( $args ) {
    480         // default array to overwrite when calling the function
    481        
    482         $defaults = array(
    483             'id'      => 'default_field', // the ID of the setting in our options array, and the ID of the HTML form element
    484             'title'   => 'Default Field',  // the label for the HTML form element
    485             'desc'    => '', // the description displayed under the HTML form element
    486             'default'     => '',  // the default value for this setting
    487             'type'    => 'text', // the HTML form element to use
    488             'section' => '', // settings section to which this setting belongs
    489             'page' => '', //page on which the section belongs
    490             'options' => array(), // (optional): the values in radio buttons or a drop-down menu
    491             'name' => '', //name of HTML form element. should be options_array[option]
    492             'class'   => '',  // the HTML form element class. Also used for validation purposes!
    493             'value' => ''  // the current value of the setting
    494         );
    495        
    496         //  ARGUMENTS: $field_args = array(
    497         //      'type'       => $type,  *
    498         //      'id'         => $id,    *
    499         //      'desc'       => $desc,  *
    500         //      'curr_value' => $value, *
    501         //      'options'    => $options,   *
    502         //      'label_for'  => $id,    * (use id)
    503         //      'class'      => $class, *
    504         //      'name'       => $name,
    505         //  );
    506        
    507         // "extract" to be able to use the array keys as variables in our function output below
    508         extract( wp_parse_args( $args, $defaults ) );
    509        
    510         //Handle some MSTW custom field types; convert for generic select-option
    511         switch ( $type ) {
    512             case 'show-hide':
    513                 $type = 'select-option';
    514                 $options = array(   __( 'Show', 'team-rosters' ) => 1,
    515                                     __( 'Hide', 'team-rosters' ) => 0,
    516                                   );
    517                 break;
    518             case 'date-time':
    519                 $type = 'select-option';
    520                
    521                 $options = array (  __( 'Custom', 'team-rosters' ) => 'custom',
    522                                     __( 'Tuesday, 07 April 01:15 pm', 'team-rosters' ) => 'l, d M h:i a',
    523                                     __( 'Tuesday, 7 April 01:15 pm', 'team-rosters' ) => 'l, j M h:i a',
    524                                     __( 'Tuesday, 07 April 1:15 pm', 'team-rosters' ) => 'l, d M g:i a',
    525                                     __( 'Tuesday, 7 April 1:15 pm', 'team-rosters' ) => 'l, j M g:i a',
    526                                     __( 'Tuesday, 7 April 13:15', 'team-rosters' ) => 'l, d M H:i',
    527                                     __( 'Tuesday, 7 April 13:15', 'team-rosters' ) => 'l, j M H:i',
    528                                     __( '07 April 13:15', 'team-rosters' ) => 'd M H:i',
    529                                     __( '7 April 13:15', 'team-rosters' ) => 'j M H:i',
    530                                     __( '07 April 01:15 pm', 'team-rosters' ) => 'd M g:i a',
    531                                     __( '7 April 01:15 pm', 'team-rosters' ) => 'j M g:i a',       
    532                                     );
    533                
    534                 if ( isset( $custom_format ) && $custom_format == 0 ) {
    535                     //remove the custom option
    536                     unset( $options[ __( 'Custom', 'team-rosters' ) ] );
    537                 }
    538                
    539                 if ( $desc == '' ) {
    540                     $desc = __( 'Formats for 7 April 2013 13:15.', 'team-rosters' );
    541                 }
    542                
    543                 break;
    544             case 'date-only':
    545                 $type = 'select-option';
    546                 $options = array (  __( 'Custom', 'team-rosters' ) => 'custom',
    547                                     '2013-04-07' => 'Y-m-d',
    548                                     '13-04-07' => 'y-m-d',
    549                                     '04/07/13' => 'm/d/y',
    550                                     '4/7/13' => 'n/j/y',
    551                                     __( '07 Apr 2013', 'team-rosters' ) => 'd M Y',
    552                                     __( '7 Apr 2013', 'team-rosters' ) => 'j M Y',
    553                                     __( 'Tues, 07 Apr 2013', 'team-rosters' ) => 'D, d M Y',
    554                                     __( 'Tues, 7 Apr 13', 'team-rosters' ) => 'D, j M y',
    555                                     __( 'Tuesday, 7 Apr', 'team-rosters' ) => 'l, j M',
    556                                     __( 'Tuesday, 07 April 2013', 'team-rosters' ) => 'l, d F Y',
    557                                     __( 'Tuesday, 7 April 2013', 'team-rosters' ) => 'l, j F Y',
    558                                     __( 'Tues, 07 Apr', 'team-rosters' ) => 'D, d M',
    559                                     __( 'Tues, 7 Apr', 'team-rosters' ) => 'D, j M',
    560                                     __( '07 Apr', 'team-rosters' ) => 'd M',
    561                                     __( '7 Apr', 'team-rosters' ) => 'j M',
    562                                     );
    563                                    
    564                 if ( isset( $custom_format ) && $custom_format == 0 ) {
    565                     //remove the custom option
    566                     unset( $options[ __( 'Custom', 'team-rosters' ) ] );
    567                 }
    568                 if ( $desc == '' ) {
    569                     $desc = __( 'Formats for 7 Apr 2013. Default: 2013-04-07', 'team-rosters' );
    570                 }
    571                 break;
    572             case 'time-only':
    573                 $type = 'select-option';
    574                 $options = array (  __( 'Custom', 'team-rosters' )  => 'custom',
    575                                     __( '08:00 (24hr)', 'team-rosters' ) => 'H:i',
    576                                     __( '8:00 (24hr)', 'team-rosters' )     => 'G:i',
    577                                     __( '08:00 am', 'team-rosters' )    => 'h:i a',
    578                                     __( '08:00 AM', 'team-rosters' )    => 'h:i A',
    579                                     __( '8:00 am', 'team-rosters' )         => 'g:i a',
    580                                     __( '8:00 AM', 'team-rosters' )         => 'g:i A',
    581                                     );
    582                                    
    583                 if ( isset( $custom_format ) && $custom_format == 0 ) {
    584                     //remove the custom option
    585                     unset( $options[ __( 'Custom', 'team-rosters' ) ] );
    586                 }
    587                 if ( $desc == '' ) {
    588                     $desc = __( 'Formats for eight in the morning. Default: 08:00', 'team-rosters' );
    589                 }
    590                 break;
    591             default:
    592                 break;
    593                                
    594         }
    595        
    596         //
    597         // map arguments used by mstw_display_form_field() to create HTML output
    598         //
    599         $field_args = array(
    600             'type'       => $type,
    601             'id'         => $id,
    602             'desc'       => $desc,
    603             'curr_value' => $value,
    604             'options'    => $options,
    605             'label_for'  => $id,
    606             'class'      => $class,
    607             'name'       => $name,
    608         );
    609        
    610         add_settings_field( $id,
    611             $title,
    612             'mstw_build_admin_edit_field',
    613             $page,
    614             $section,
    615             $field_args
    616             );
    617        
    618     } //End: mstw_build_settings_field()
    619 }
     310/*
     311 * Removed from team rosters version
     312 */
    620313
    621314//-------------------------------------------------------------------------------
    … …  
    623316//      Returns input string if valid hex color (or ''); returns null otherwise     
    624317//
    625 if( !function_exists( 'mstw_sanitize_hex_color' ) ) {
    626     function mstw_sanitize_hex_color( $color ) {
    627         // the empty string is ok
    628         if ( '' === $color )
    629             return '';
    630 
    631         // 3 or 6 hex digits, or the empty string.
    632         if ( preg_match('|^#([A-Fa-f0-9]{3}){1,2}$|', $color ) )
    633             return $color;
    634        
    635         // return null if input $color is not valid
    636         return null;
    637        
    638     } //End: mstw_sanitize_hex_color()
    639 }
     318/*
     319 * Removed from team rosters version
     320 */
    640321
    641322//-------------------------------------------------------------------------------
    … …  
    708389        elseif( $current_screen and $current_screen->post_type )
    709390            return $current_screen->post_type;
    710      
     391      /**
     392            * IDK how to fix the warning from the plugin checker:
     393            *   Processing form data without nonce verification.
     394            * This utility function is just trying to find a post type??
     395            */
    711396        elseif( isset( $_REQUEST['post_type'] ) )
    712397            return sanitize_key( $_REQUEST['post_type'] );
    … …  
    812497                $msg_type = ( $msg_type == 'warning' ) ? $msg_type . ' updated' : $msg_type ;
    813498            ?>
    814                 <div class="<?php echo $msg_type; ?>">
    815                     <p><?php echo $msg_notice; ?></p>
     499                <div class="<?php echo esc_html( $msg_type ); ?>">
     500                    <p><?php echo esc_html( $msg_notice ); ?></p>
    816501                </div>
    817502           

  • team-rosters/trunk/mstw-team-rosters.php

    r3240856 r3270053  
    11<?php
    22/*
    3  * Plugin Name:  MSTW Team Rosters
     3 * Plugin Name:  Team Rosters
    44 * Plugin URI:   http://shoalsummitsolutions.com
    55 * Description:  Manage & display team rosters. Front end displays include roster tables, player galleries, and single player profiles.
    … …  
    617617    if ( file_exists( $plugin_stylesheet ) ) { 
    618618        $plugin_style_url = plugins_url( '/css/mstw-tr-styles.css', __FILE__ );
    619         wp_enqueue_style( 'mstw_tr_style', $plugin_style_url );
     619        wp_enqueue_style( 'mstw_tr_style',
     620                                            $plugin_style_url,
     621                                            array( ),
     622                                            '4.9',
     623                                            'all'
     624                                             );
    620625    }
    621626
    … …  
    628633        wp_register_style( 'mstw_tr_custom_style', $custom_stylesheet_url );
    629634        wp_enqueue_style( 'mstw_tr_custom_style' );
     635        wp_enqueue_style( 'mstw_tr_custom_style',
     636                                            $custom_stylesheet_url,
     637                                            array( ),
     638                                            '4.9',
     639                                            'all'
     640                                             );
    630641    }
    631642   
    … …  
    641652                            plugins_url( 'team-rosters/js/tr-load-team-colors.js' ),
    642653                            array( 'jquery' ),
    643                             false,
    644                             true
     654                            '4.9',
     655                            array( )
    645656                         );
    646657   
    … …  
    649660                            plugins_url( 'team-rosters/js/tr-sort-roster-table.js' ),
    650661                            array( 'jquery' ),
    651                             false,
    652                             true
     662                            '4.9',
     663                            array( )
    653664                         );
    654665                         
    … …  
    657668                            plugins_url( 'team-rosters/js/tr-select-player.js' ),
    658669                            array( 'jquery' ),
    659                             false,
    660                             true
     670                            '4.9',
     671                            array( )
    661672                         );
    662673                         
    … …  
    665676                            plugins_url( 'team-rosters/js/tr-team-roster-2-ajax.js' ),
    666677                            array( 'jquery' ),
    667                             false,
    668                             true
     678                            '4.9',
     679                            array( )
    669680                         );
    670681       

  • team-rosters/trunk/readme.txt

    r3240856 r3270053  
    4444
    4545= 4.8 =
    46 * Corrected a security issue identified by the Wordpress team
     46* Corrected a security issues identified by the Wordpress team
    4747* Added a .pot file in the /lang directory so the plugin is now translatable.
    4848* Tested on PHP 8.2.23 and WP 6.7.2.

  • team-rosters/trunk/theme-templates/single-player.php

    r3240856 r3270053  
    9393                // Set up the hidden fields for jScript CSS
    9494                $hidden_fields = mstw_tr_build_team_colors_html( $team_slug, $options, 'profile' );
    95                 echo $hidden_fields;
     95                echo wp_kses_post( $hidden_fields );
    9696                ?>
    9797   
    … …  
    102102                        // Build the single player page title
    103103                        if ( $options['sp_show_title'] ) { 
    104                             echo "<h1 class='player-head-title player-head-title_$team_slug'>$team_name</h1>";
     104                            echo "<h1 class='player-head-title player-head-title_" . esc_html( $team_slug ) . "'>" . esc_html( $team_name) . "</h1>";
    105105                        }
    106106                        ?>
    … …  
    114114                            ?>
    115115                           
    116                             <form id="single-player-profile" method="POST" action= "<?php echo $formAction; ?>">
    117                                 <input type='hidden' name='current-player' id='current-player' value= <?php echo $post->post_name ?> />
     116                            <form id="single-player-profile" method="POST" action= "<?php echo esc_url( $formAction ); ?>">
     117                                <input type='hidden' name='current-player' id='current-player' value= <?php echo esc_html( $post->post_name ) ?> />
    118118                                <div class="player-select-list ms-control">
    119119                                    <?php
    120120                                    if ( null != $team_slug ) {
    121121                                        $selectionHTML = mstw_tr_build_player_selection( $team_slug, $options, $post -> post_name );
    122                                         echo $selectionHTML;
     122                                        $allowed_html = array( 'option' => array( 'value' => true, 'selected' => true ), 'select' => array( 'name' => true, 'id' => true ) );
     123                                        echo wp_kses( $selectionHTML, $allowed_html );
    123124                                    }
    124125                                    ?>
    125126                                </div>
    126127                                <div class="player-select-button ms-control">
    127                                     <input type="submit" class="secondary tr-ps-submit" id="tr-ps-submit" name="<?php echo $team_slug?>" value='<?php _e( 'Update Player', 'team-rosters' ) ?>'/>
     128                                    <input type="submit" class="secondary tr-ps-submit" id="tr-ps-submit" name="<?php echo esc_html( $team_slug )?>" value='<?php esc_html_e( 'Update Player', 'team-rosters' ) ?>'/>
    128129                                </div>
    129130                            </form>     
    … …  
    132133                    </div> <!-- <div class='tr-header-controls'> -->
    133134               
    134                     <div class="player-header player-header_<?php echo( $team_slug ) ?> MSTW-flex-row">
     135                    <div class="player-header player-header_<?php echo esc_html( $team_slug ) ?> MSTW-flex-row">
    135136                        <div id = "player-photo">
    136137                            <?php
    137                             echo mstw_tr_build_player_photo( $post, $team_slug, $options, 'profile' );
     138                            echo wp_kses_post( mstw_tr_build_player_photo( $post, $team_slug, $options, 'profile' ) );
    138139                            ?>
    139140                        </div> <!-- #player-photo -->
    … …  
    143144                            <?php if ( $options['show_number'] ) { ?>
    144145                                <div id="number">
    145                                     <?php echo get_post_meta($post->ID, 'player_number', true ); ?>
     146                                    <?php echo wp_kses_post( get_post_meta( $post->ID, 'player_number', true ) ); ?>
    146147                                </div><!-- #number -->
    147148                            <?php } ?>
    … …  
    152153                                //Convert 'last, first' to 'first last'
    153154                                $options['name_format'] = ( $options['name_format'] == 'last-first' ) ? 'first-last' : $options['name_format'] ;
    154                                 echo mstw_tr_build_player_name( $post, $options, 'profile' );
     155                                echo wp_kses_post( mstw_tr_build_player_name( $post, $options, 'profile' ) );
    155156                                ?>
    156157                            </div><!-- #player-name -->
    … …  
    167168                                // the first two rows are (now almost) the same in all formats
    168169                                if ( $options['show_position'] ) {
    169                                     echo $row_start . $options['position_label'] . $new_cell .  get_post_meta($post->ID, 'player_position', true ) . $row_end;
     170                                    echo wp_kses_post( $row_start . $options['position_label'] . $new_cell .  get_post_meta($post->ID, 'player_position', true ) . $row_end );
    170171                                }
    171172                               
    … …  
    175176                                    $throws = get_post_meta($post->ID, 'player_throws', true );
    176177                                    $throws = ( $throws == 0 ) ? '' : $throws ;
    177                                     echo $row_start . $options['bats_throws_label'] . $new_cell
    178                                                     .  mstw_tr_build_bats_throws( $post ) . $row_end;
     178                                    echo wp_kses_post( $row_start . $options['bats_throws_label'] . $new_cell
     179                                                    .  mstw_tr_build_bats_throws( $post ) . $row_end );
    179180                                }
    180181                               
    … …  
    182183                                // Otherwise show just one or the other
    183184                                if ( $options['show_height'] and $options['show_weight'] ) {
    184                                     echo $row_start . $options['height_label'] . '/' . $options['weight_label'] . $new_cell .  get_post_meta($post->ID, 'player_height', true ) . '/' . get_post_meta($post->ID, 'player_weight', true ) . $row_end;
     185                                    echo wp_kses_post( $row_start . $options['height_label'] . '/' . $options['weight_label'] . $new_cell .  get_post_meta($post->ID, 'player_height', true ) . '/' . get_post_meta($post->ID, 'player_weight', true ) . $row_end );
    185186                                }
    186187                                else  if ( $options['show_weight'] ) {
    187                                         echo $row_start . $options['weight_label'] . $new_cell .  get_post_meta($post->ID, 'player_weight', true ) . $row_end;
     188                                        echo wp_kses_post( $row_start . $options['weight_label'] . $new_cell .  get_post_meta($post->ID, 'player_weight', true ) . $row_end );
    188189                                }
    189190                                else if ( $options['show_height'] ) {
    190                                         echo $row_start . $options['height_label'] . $new_cell .  get_post_meta($post->ID, 'player_height', true ) . $row_end;
     191                                        echo wp_kses_post( $row_start . $options['height_label'] . $new_cell .  get_post_meta($post->ID, 'player_height', true ) . $row_end );
    191192                                }       
    192193                               
    193194                                //Year
    194195                                if ( $options['show_year'] ) {
    195                                     echo $row_start . $options['year_label'] . $new_cell . get_post_meta( $post->ID, 'player_year', true ) . $row_end;
     196                                    echo wp_kses_post( $row_start . $options['year_label'] . $new_cell . get_post_meta( $post->ID, 'player_year', true ) . $row_end );
    196197                                }
    197198                                //Age
    198199                                if ( $options['show_age'] ) {
    199                                     echo $row_start . $options['age_label'] . $new_cell . get_post_meta( $post->ID, 'player_age', true ) . $row_end;
     200                                    echo wp_kses_post( $row_start . $options['age_label'] . $new_cell . get_post_meta( $post->ID, 'player_age', true ) . $row_end );
    200201                                }
    201202                                //Experience
    202203                                if ( $options['show_experience'] ) {
    203                                     echo $row_start . $options['experience_label'] . $new_cell . get_post_meta( $post->ID, 'player_experience', true ) . $row_end;
     204                                    echo wp_kses_post( $row_start . $options['experience_label'] . $new_cell . get_post_meta( $post->ID, 'player_experience', true ) . $row_end );
    204205                                }
    205206                                //Hometown
    206207                                if ( $options['show_home_town'] ) {
    207                                     echo $row_start . $options['home_town_label'] . $new_cell . get_post_meta( $post->ID, 'player_home_town', true ) . $row_end;
     208                                    echo wp_kses_post( $row_start . $options['home_town_label'] . $new_cell . get_post_meta( $post->ID, 'player_home_town', true ) . $row_end );
    208209                                }
    209210                                //Last School
    210211                                if ( $options['show_last_school'] ) {
    211                                     echo $row_start . $options['last_school_label'] . $new_cell . get_post_meta( $post->ID, 'player_last_school', true ) . $row_end;
     212                                    echo wp_kses_post( $row_start . $options['last_school_label'] . $new_cell . get_post_meta( $post->ID, 'player_last_school', true ) . $row_end );
    212213                                }
    213214                                //Country
    214215                                if ( $options['show_country'] ) {
    215                                     echo $row_start . $options['country_label'] . $new_cell . get_post_meta( $post->ID, 'player_country', true ) . $row_end;
     216                                    echo wp_kses_post($row_start . $options['country_label'] . $new_cell . get_post_meta( $post->ID, 'player_country', true ) . $row_end );
    216217                                }
    217218                               
    218219                                //Other
    219220                                if ( $options['show_other_info'] ) {
    220                                     echo $row_start . $options['other_info_label'] . $new_cell . get_post_meta( $post->ID, 'player_other', true ) . $row_end;
     221                                    echo wp_kses_post( $row_start . $options['other_info_label'] . $new_cell . get_post_meta( $post->ID, 'player_other', true ) . $row_end );
    221222                                }
    222223                                ?>
    … …  
    227228                        <div id='team-logo'>
    228229                            <?php
    229                             echo mstw_tr_build_profile_logo( $team_slug );
     230                            echo wp_kses_post( mstw_tr_build_profile_logo( $team_slug ) );
    230231                            ?>
    231232                        </div> <!-- #team-logo -->
    … …  
    236237                   
    237238                    if ( !empty( $bio ) ) {  ?>
    238                         <div class="player-bio player-bio_<?php echo $team_slug; ?> "> 
     239                        <div class="player-bio player-bio_<?php echo esc_html( $team_slug ); ?> "> 
    239240                            <?php $sp_content_title = ( $options['sp_content_title'] == '' ) ?
    240241                                    __( 'Player Bio', 'team-rosters' ) :
    241242                                    $options['sp_content_title']; ?>           
    242                             <h1><?php echo $sp_content_title ?></h1>
     243                            <h1><?php echo esc_html( $sp_content_title ) ?></h1>
    243244                           
    244245                            <!--add the bio content (format it as desired in the post)-->
    245                             <?php echo apply_filters( 'the_content', $bio ); ?>
     246                            <!--NOTE: can't escape $bio - it could contain links, lists, formatting, etc entered by the site builder -->
     247                            <?php echo wp_kses_post( apply_filters( 'the_content', $bio ) ); ?>
    246248                        </div><!-- .player-bio -->
    247249                               

  • team-rosters/trunk/theme-templates/taxonomy-team.php

    r3240856 r3270053  
    2525    $siteURL = "//".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
    2626   
    27     $parsedURL = parse_url( $siteURL, PHP_URL_QUERY );
     27    $parsedURL = wp_parse_url( $siteURL, PHP_URL_QUERY );
    2828   
    2929    parse_str( $parsedURL, $atts );
    … …  
    8282    <div id="content-player-gallery" role="main" >
    8383
    84     <header class="page-header page-header_<?php echo $team_slug ?>">
    85         <?php echo "<h1 class='team-head-title team-head-title_$team_slug'>$team_name</h1>"; ?>
     84    <header class="page-header page-header_<?php echo esc_html( $team_slug ) ?>">
     85        <?php //echo "<h1 class='team-head-title team-head-title_$team_slug'>$team_name</h1>"; ?>
     86        <?php echo "<h1 class='team-head-title team-head-title_", esc_html( $team_slug ), "'>", esc_html( $team_name ), "</h1>\n"; ?>
    8687    </header>
    8788
    8889    <?php   
    89     //echo mstw_tr_build_gallery( $team_slug, $roster_type, $options );
    90     echo mstw_tr_build_gallery( $team_slug, $roster_type, $attribs );
     90    // mstw_tr_build_gallery() output is escaped in that function (includes/mstw-tr-utility-functions.php)
     91    echo wp_kses_post( mstw_tr_build_gallery( $team_slug, $roster_type, $attribs ) );
    9192    ?>
    9293
Note: See TracChangeset for help on using the changeset viewer.