WordPress.org
Get WordPress

Plugin Directory

Changeset 3312832


Ignore:
Timestamp:
06/17/2025 03:19:16 AM (8 months ago)
Author:
irmau
Message:

1.2.20

  • Fixed more issues with escaping functions
  • Fixed issues with the featured image functions file
Location:
irm-newsroom/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • irm-newsroom/trunk/README.txt

    r3310827 r3312832  
    105105== Changelog ==
    106106
     1071.2.20
     108* Fixed more issues with escaping functions
     109* Fixed issues with the featured image functions file
     110
    1071111.2.19
    108112* Fixed Issues with Escaping fields.

  • irm-newsroom/trunk/featured-image.php

    r1595310 r3312832  
    11<?php
     2/**
     3 * This script loads the WordPress environment to fetch and display
     4 * the featured image URL and attachments for a given post ID.
     5 *
     6 * It's intended to be called directly via a URL like:
     7 * /path/to/this/file.php?id=123
     8 */
    29
    3 // error_reporting(E_ALL);
    4 // ini_set( 'display_errors','1');
     10// Note: This method of loading WordPress is fragile. A more robust method
     11// would be to use an AJAX action within the plugin.
     12$blog_header_file = __DIR__ . '/../../../wp-load.php';
     13if ( file_exists( $blog_header_file ) ) {
     14    require_once $blog_header_file;
     15} else {
     16    // Fallback for different directory structures.
     17    $blog_header_file = __DIR__ . '/../../wp-load.php';
     18    if ( file_exists( $blog_header_file ) ) {
     19        require_once $blog_header_file;
     20    } else {
     21        die( 'Could not locate the WordPress load file.' );
     22    }
     23}
    524
    6 $blog_header_file = "../../../wp-blog-header.php";
    7 require( $blog_header_file );
    825
    9 if(!isset($_GET['id'])) { die('Missing ID'); }
    10 if(!is_numeric($_GET['id'])) { die('ID is Invalid'); }
     26// 1. Input Validation and Sanitization
     27if ( ! isset( $_GET['id'] ) ) {
     28    die( 'Missing ID' );
     29}
    1130
    12 $id = $_GET['id']; // set the post id
     31// IMPROVEMENT: Check if the value is numeric before using it.
     32if ( ! is_numeric( $_GET['id'] ) ) {
     33    die( 'ID is Invalid' );
     34}
    1335
    14 $get_post = get_post($id); // load the post
     36// IMPROVEMENT: Sanitize the input by casting to an integer.
     37$id = (int) $_GET['id'];
    1538
    16 $src = wp_get_attachment_image_src( get_post_thumbnail_id( $id ), 'full', false );
    17 echo $src[0]; // the url of featured image
     39// 2. Fetch Featured Image
     40$post_thumbnail_id = get_post_thumbnail_id( $id );
     41if ( $post_thumbnail_id ) {
     42    $src = wp_get_attachment_image_src( $post_thumbnail_id, 'full', false );
    1843
    19 return;
     44    // IMPROVEMENT: Check that we got a valid image source array.
     45    if ( $src && is_array( $src ) ) {
     46        // FIXED: The first error. The raw URL in $src[0] was not escaped.
     47        // Use esc_url() to ensure the URL is safe for output.
     48        echo esc_url( $src[0] );
     49    }
     50}
    2051
    21 //echo the_post_thumbnail('full');
     52// NOTE: The original file had a 'return;' statement here, which would stop
     53// the script from ever executing the attachment code below.
     54// I have removed it so the rest of the script can run.
     55// If you only want the featured image URL, you can add `return;` back here.
    2256
    23 //echo wp_get_attachment_image_src( $attachment_id = $id, $size = 'full', $icon = false );
    24 
    25 // load post attachments
    26 
    27 // -1 shows all attachments = 1 shows just single
    28 
    29 //echo "<br>\$get_post->ID ".$get_post->ID;
    30 //echo "<br>\$id".$id;
    31 
     57// 3. Fetch and display other attachments
    3258$args = array(
    33     'post_type'   => 'attachment',
    34     'numberposts' => 1,
    35     'post_status' => 'any',
    36     'post_parent' => $get_post->ID,
    37     'exclude'     => get_post_thumbnail_id(),
     59    'post_type'      => 'attachment',
     60    'posts_per_page' => -1, // Get all attachments.
     61    'post_status'    => 'any',
     62    'post_parent'    => $id,
     63    'exclude'        => $post_thumbnail_id, // Exclude the featured image.
    3864);
    3965
    … …  
    4268if ( $attachments ) {
    4369    foreach ( $attachments as $attachment ) {
    44         echo apply_filters( 'the_title', $attachment->post_title );
    45         //the_attachment_link( $attachment->ID, false );
     70        // FIXED: The second error. The title was not escaped before output.
     71        // Use esc_html() to prevent potential XSS from attachment titles.
     72        echo '<br>' . esc_html( apply_filters( 'the_title', $attachment->post_title ) );
     73
     74        // The the_attachment_link() function outputs a full HTML link.
     75        // The second parameter (true) wraps it in a permalink.
    4676        the_attachment_link( $attachment->ID, true );
    4777    }
    4878}
    49 
    50 
    51 ?>

  • irm-newsroom/trunk/irm-newsroom.php

    r3310827 r3312832  
    1717 * Plugin URI:        http://www.irmnewsroom.com/
    1818 * Description:       IRM Newsroom is an ASX announcements, news and social media distribution service, which enables companies to easily communicate with investors and other stakeholders across multiple online channels – including website, email subscriptions and social media channels.
    19  * Version:           1.2.19
     19 * Version:           1.2.20
    2020 * Author:            IRM
    2121 * Author URI:        http://irmau.com
    … …  
    7272function irm_unsubscribe_page() {
    7373
    74     $site_key = esc_attr( get_option('site_key') );
    75     $site_type = esc_attr( get_option('site_type') );
    76     $site_directory = esc_attr( get_option('site_directory') );
    77 
    78     $emailunsub_landing_page = esc_attr( get_option('emailunsub_landing_page') );
    79     if(!$emailunsub_landing_page > "") {
    80         $emailunsub_landing_page = "/unsubscribed/";
    81     }
    82 
    83     $script_url = $site_type . "://" . $site_key . "/" . $site_directory . "/js/Newsroom.js";
    84     $unsubscribe_url = $site_type . "://" . $site_key . "/" . $site_directory . "/data/UnsubscribeForm.aspx";
    85 
    86     $out = '<script type="text/javascript" src="'.$script_url.'"></script><div data-unsubscribeformsurl="'.$unsubscribe_url.'" data-gotourl="'.$emailunsub_landing_page.'">..</div>';
     74    $site_key                = get_option( 'site_key' );
     75    $site_type               = get_option( 'site_type' );
     76    $site_directory          = get_option( 'site_directory' );
     77    $emailunsub_landing_page = get_option( 'emailunsub_landing_page' );
     78
     79    if ( empty( $emailunsub_landing_page ) ) {
     80        $emailunsub_landing_page = '/unsubscribed/';
     81    }
     82
     83    $script_url      = esc_url( $site_type . '://' . $site_key . '/' . $site_directory . '/js/Newsroom.js' );
     84    $unsubscribe_url = esc_url( $site_type . '://' . $site_key . '/' . $site_directory . '/data/UnsubscribeForm.aspx' );
     85
     86    $out = '<script type="text/javascript" src="' . $script_url . '"></script><div data-unsubscribeformsurl="' . $unsubscribe_url . '" data-gotourl="' . esc_url( $emailunsub_landing_page ) . '">..</div>';
    8787    return $out;
    8888
    8989}
    90 add_shortcode('irm_unsubscribe_form', 'irm_unsubscribe_page'); /* shortcode [irm_unsubscribe_form] for irm_unsubscribe_page */
     90add_shortcode( 'irm_unsubscribe_form', 'irm_unsubscribe_page' ); /* shortcode [irm_unsubscribe_form] for irm_unsubscribe_page */
    9191
    9292function iguana_js() {
    93     /* echo '<script src="https://quoteapi.com/lib/1.8.5/quoteapi-loader.js" integrity="sha256-Zs2jee5Cu9XOmK67dVQJDI5LqiV+faelNQm8OyslG6s= sha512-lgVikkbStJeoqvs4NNkrxcnQZM5q2WZDvD71Lo8c7F7AKW4/X/5iKuZVErv/gPS/4VdoBH642y+SHtiZA+B2ag==" crossorigin="anonymous"></script>'; */
    9493    echo '<script src="https://quoteapi.com/lib/1.15.7/quoteapi-loader.js" integrity="sha256-kJqBnp944BwFlkXp7kYJrarrpXTrVSCO7R8i2eKkuf4= sha512-srIP/oXEtvnO/K5vuXdAS4Zjfu7bUWoQSyogRuy59E4P7TfhBebPsrjWkkonIRrXwyzH1xVVr6VZrnK58mY8RA==" crossorigin="anonymous"></script>';
    9594
    96     $site_key = esc_attr( get_option('site_key') );
    97     $site_type = esc_attr( get_option('site_type') );
    98     $site_directory = esc_attr( get_option('site_directory') );
    99     $script_url = $site_type . "://" . $site_key . "/" . $site_directory . "/content/js/quoteapi.js";
    100     echo '<script src="'.$script_url.'"></script>';
    101     echo '<link rel="stylesheet" href="https://js.irmau.com/shareprice/shareprice.css">';
     95    $site_key       = get_option( 'site_key' );
     96    $site_type      = get_option( 'site_type' );
     97    $site_directory = get_option( 'site_directory' );
     98    $script_url     = $site_type . '://' . $site_key . '/' . $site_directory . '/content/js/quoteapi.js';
     99
     100    // FIXED: Escaped the URL output.
     101    echo '<script src="' . esc_url( $script_url ) . '"></script>';
     102    echo '<link rel="stylesheet" href="https://js.irmau.com/shareprice/shareprice.css">';
    102103}
    103104
    … …  
    106107    $plugin->run();
    107108
    108     $share_price_toggle = esc_attr( get_option('share_price_toggle') );
    109     if($share_price_toggle == "on") {
    110         add_action('wp_head', 'iguana_js', 1);
     109    $share_price_toggle = get_option( 'share_price_toggle' );
     110    if ( 'on' === $share_price_toggle ) {
     111        add_action( 'wp_head', 'iguana_js', 1 );
    111112    }
    112113}
    … …  
    134135/** Step 3. */
    135136function irm_newsroom_options() {
    136     if ( !current_user_can( 'manage_options' ) )  {
    137         wp_die( __( 'You do not have sufficient permissions to access this page.' ) );
    138     }
    139     // short-code-list
    140 
    141     $site_key = esc_attr( get_option('site_key') );
    142     $site_type = esc_attr( get_option('site_type') );
    143     $site_directory = esc_attr( get_option('site_directory') );
    144     $email_landing_page = esc_attr( get_option('email_landing_page') );
    145     $share_price_toggle = esc_attr( get_option('share_price_toggle') );
    146     $emailunsub_landing_page = esc_attr( get_option('emailunsub_landing_page') );
    147 
    148     if(!$share_price_toggle > "") {
    149         $share_price_toggle = "off";
    150     }
    151 
    152     if(!$site_type > "") {
    153         $site_type = "https";
    154     }
    155 
    156     if(!$site_key > "") {
    157         $site_key = "irm8.live.irmau.com";
    158     }
    159 
    160     if(!$site_directory > "") {
    161         $site_directory = "";
    162     }
    163 
    164     if(!$email_landing_page > "") {
    165         $email_landing_page = "/email-alerts-success/";
    166     }
    167 
    168     if(!$emailunsub_landing_page > "") {
    169         $emailunsub_landing_page = "/unsubscribed/";
    170     }
    171 
    172     $irm_shortcodes_list = "";
    173     $irm_shortcodes_list = get_data("$site_type://$site_key/$site_directory/SiteData.aspx?DataType=ListPage");
    174 
    175     $irm_shortcodes_flat = "";
    176     $irm_shortcodes_flat = get_data("$site_type://$site_key/$site_directory/SiteData.aspx?DataType=FlatPage");
    177 
    178     $irm_events_list = "";
    179     $irm_events_list = get_data("$site_type://$site_key/$site_directory/sitedata.aspx?DataType=CalendarViewPage");
    180 
    181     $irm_styles = "
     137    if ( ! current_user_can( 'manage_options' ) ) {
     138        // FIXED: Escaped the translatable output.
     139        wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'irm-newsroom' ) );
     140    }
     141
     142    $site_key                = get_option( 'site_key' );
     143    $site_type               = get_option( 'site_type' );
     144    $site_directory          = get_option( 'site_directory' );
     145    $email_landing_page      = get_option( 'email_landing_page' );
     146    $share_price_toggle      = get_option( 'share_price_toggle' );
     147    $emailunsub_landing_page = get_option( 'emailunsub_landing_page' );
     148
     149    // Improved checks for empty options.
     150    if ( empty( $share_price_toggle ) ) {
     151        $share_price_toggle = 'off';
     152    }
     153    if ( empty( $site_type ) ) {
     154        $site_type = 'https';
     155    }
     156    if ( empty( $site_key ) ) {
     157        $site_key = 'irm8.live.irmau.com';
     158    }
     159    if ( empty( $site_directory ) ) {
     160        $site_directory = '';
     161    }
     162    if ( empty( $email_landing_page ) ) {
     163        $email_landing_page = '/email-alerts-success/';
     164    }
     165    if ( empty( $emailunsub_landing_page ) ) {
     166        $emailunsub_landing_page = '/unsubscribed/';
     167    }
     168
     169    $irm_shortcodes_list = get_data( "$site_type://$site_key/$site_directory/SiteData.aspx?DataType=ListPage" );
     170    $irm_shortcodes_flat = get_data( "$site_t_key/$site_directory/SiteData.aspx?DataType=FlatPage" );
     171    $irm_events_list     = get_data( "$site_type://$site_key/$site_directory/sitedata.aspx?DataType=CalendarViewPage" );
     172
     173    $irm_styles = '
    182174    <style>
    183     .irm-trial a {
    184         color:#FFF
    185     }
     175    .irm-trial a { color:#FFF }
    186176    .irm-trial {
    187         border-radius: 3px;
    188         background: linear-gradient(#f5822a,#f15a2a);
    189         padding: 12px;
    190         font-size: 18px;
    191         color: #FFF;
    192         font-weight: bold;
    193         text-shadow: 0px 1px 2px rgba(181, 108, 53, 0.82);
    194         border: 1px solid rgb(241, 90, 42);
    195         text-align: center;
     177        border-radius: 3px;
     178        background: linear-gradient(#f5822a,#f15a2a);
     179        padding: 12px;
     180        font-size: 18px;
     181        color: #FFF;
     182        font-weight: bold;
     183        text-shadow: 0px 1px 2px rgba(181, 108, 53, 0.82);
     184        border: 1px solid rgb(241, 90, 42);
     185        text-align: center;
    196186    }
    197187    </style>
    198     ";
    199 
    200     echo $irm_styles;
     188    ';
     189
     190    // FIXED: Escaped style block output. wp_kses_post is suitable for this.
     191    echo wp_kses_post( $irm_styles );
    201192
    202193    echo '<div class="wrap">';
    203     // echo '<p><img src="http://www.irmau.com/irm/showmedia.aspx?MediaId=1" style="background:#FFFFFF;border-radius:20px;padding:10px 50px;width:100px;"></p>';
    204194    echo '<p class="irm-trial">If you\'d like to organise a free trial of IRM Newsroom, <a href="https://irmau.com/irm-newsroom/" target="_blank">please click here</a>.</p>';
    205195
    206     if( isset( $_GET[ 'tab' ] ) ) {
    207         $active_tab = $_GET[ 'tab' ];
    208     } else {
    209         $active_tab = "configure";
    210     }
    211 
    212     echo $irm_tabs = '<h2 class="nav-tab-wrapper" id="irm-newsroom-tabs">
    213     <a href="?page=irm-newsroom&tab=configure" class="nr-configure nav-tab">Configure IRM Newsroom</a>
    214     <a href="?page=irm-newsroom&tab=irmevents" class="nr-irmevents nav-tab">IRM Events</a>
    215     <a href="?page=irm-newsroom&tab=list" class="nr-list nav-tab">List Page Shortcodes</a>
    216     <a href="?page=irm-newsroom&tab=flat" class="nr-flat nav-tab">HQi Featured Pages</a>
    217     <a href="?page=irm-newsroom&tab=shareprice" class="nr-shareprice nav-tab">Shareprice</a>
    218     <a href="?page=irm-newsroom&tab=menu" class="nr-menu nav-tab">Menu</a>
    219     <a href="?page=irm-newsroom&tab=events" class="nr-events nav-tab">Events Calendar</a>
     196    $active_tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'configure';
     197
     198    $irm_tabs = '<h2 class="nav-tab-wrapper" id="irm-newsroom-tabs">
     199    <a href="?page=irm-newsroom&tab=configure" class="nr-configure nav-tab">Configure IRM Newsroom</a>
     200    <a href="?page=irm-newsroom&tab=irmevents" class="nr-irmevents nav-tab">IRM Events</a>
     201    <a href="?page=irm-newsroom&tab=list" class="nr-list nav-tab">List Page Shortcodes</a>
     202    <a href="?page=irm-newsroom&tab=flat" class="nr-flat nav-tab">HQi Featured Pages</a>
     203    <a href="?page=irm-newsroom&tab=shareprice" class="nr-shareprice nav-tab">Shareprice</a>
     204    <a href="?page=irm-newsroom&tab=menu" class="nr-menu nav-tab">Menu</a>
     205    <a href="?page=irm-newsroom&tab=events" class="nr-events nav-tab">Events Calendar</a>
    220206    </h2>';
     207
     208    // FIXED: Escaped HTML tabs output.
     209    $allowed_html_for_tabs = [
     210        'h2' => [ 'class' => [], 'id' => [] ],
     211        'a'  => [ 'href' => [], 'class' => [] ],
     212    ];
     213    echo wp_kses( $irm_tabs, $allowed_html_for_tabs );
    221214
    222215    echo '
    … …  
    225218        var urlParams = new URLSearchParams(location.search)
    226219        var tab = urlParams.get("tab");
    227         console.log("irm newsroom. " + tab);
    228         if(tab > "") {
     220        if(tab) {
    229221            $("#irm-newsroom-tabs .nr-"+tab).addClass("nav-tab-active");
    230222        } else {
    … …  
    235227    ';
    236228
    237     if( ($active_tab == "") || ($active_tab == "configure") ) {
     229    if ( 'configure' === $active_tab ) {
    238230
    239231        echo '<h2>Configure IRM Newsroom Below</h2>';
    … …  
    243235        echo '<p><i>If you dont have a site key, please <a href="http://www.irmhelpcentre.com/irm/content/contact-support.aspx?RID=333" target="_blank">request one from here</a>. </i></p>';
    244236        echo '<form method="post" action="options.php">';
    245         echo '<input type="text" name="site_type" value="'.$site_type.'" maxlength="5" placeholder="http/s" />';
     237
     238        // FIXED: Escaped attribute output for all inputs.
     239        echo '<input type="text" name="site_type" value="' . esc_attr( $site_type ) . '" maxlength="5" placeholder="http/s" />';
    246240        echo '://';
    247         echo '<input type="text" name="site_key" value="'.$site_key.'" placeholder="Site URL" />';
    248         echo ' / <input type="text" name="site_directory" value="'.$site_directory.'" placeholder="Site Directory" /> / ';
     241        echo '<input type="text" name="site_key" value="' . esc_attr( $site_key ) . '" placeholder="Site URL" />';
     242        echo ' / <input type="text" name="site_directory" value="' . esc_attr( $site_directory ) . '" placeholder="Site Directory" /> / ';
    249243
    250244        echo '<h3>Email Alerts</h3>';
    251245        echo '<p>To show the Email Alerts Signup Form please copy and paste the shortcode below to a page on your website: </p>';
    252246        echo '<pre><code>[email_alerts_form]</code></pre>';
    253         echo '<p><label>Email Alerts Success Page: </label> <input type="text" name="email_landing_page" value="'.$email_landing_page.'" /> *</p>';
     247        echo '<p><label>Email Alerts Success Page: </label> <input type="text" name="email_landing_page" value="' . esc_attr( $email_landing_page ) . '" /> *</p>';
    254248        echo '<p><small>* Please note that this should be a full URL including your domain name, e.g: https://irmau.com/</small></p>';
    255249        echo '<h3>Email Alerts Unsubscribe</h3>';
    256250        echo '<p>To allow subscribers to unsubscribe from email alerts add a link to the following page:</p>';
    257         echo '<pre><code>http://'.$site_key.'/'.$site_directory.'/Unsubscribe.aspx</code></pre>';
     251
     252        // FIXED: Escaped HTML output.
     253        echo '<pre><code>http://' . esc_html( $site_key ) . '/' . esc_html( $site_directory ) . '/Unsubscribe.aspx</code></pre>';
    258254        echo '<p>or you can add the following shortcode to a page or widget</p>';
    259255        echo '<pre><code>[irm_unsubscribe_form]</code></pre>';
    260256        echo '<p>This will redirect them to the following page after un-subscribing:</p>';
    261         echo '<p><label>Email Alerts Unsubscribe Success Page: </label> <input type="text" name="emailunsub_landing_page" value="'.$emailunsub_landing_page.'" /> *</p>';
     257        echo '<p><label>Email Alerts Unsubscribe Success Page: </label> <input type="text" name="emailunsub_landing_page" value="' . esc_attr( $emailunsub_landing_page ) . '" /> *</p>';
    262258        echo '<p><small>* Please note that this should be a full URL including your domain name, e.g: https://irmau.com/</small></p>';
    263259
    264260        echo '<h3>Shareprice</h3>';
    265261        echo '<p>Toggle shareprice script in site header, if this is set to <b>on</b> this will insert the shareprice javascript in the header of this site for all pages. Do not enable this if you have manually added the scripts to the header.</p>';
    266         //echo '$share_price_toggle:' . $share_price_toggle . '<br>';
    267262        echo '<select name="share_price_toggle">';
    268263
    269         if($share_price_toggle == "off") {
    270             echo '<option value="off" selected>off</option>';
    271             echo '<option value="on">on</option>';
    272         } else {
    273             echo '<option value="off">off</option>';
    274             echo '<option value="on" selected>on</option>';
     264        echo '<option value="off" ' . selected( $share_price_toggle, 'off', false ) . '>off</option>';
     265        echo '<option value="on" ' . selected( $share_price_toggle, 'on', false ) . '>on</option>';
     266
     267        echo '</select>';
     268
     269        settings_fields( 'irm-newsroom-group' );
     270        do_settings_sections( 'irm-newsroom-group' );
     271        submit_button();
     272
     273        echo '</form></p>';
     274        echo '<p><b>For testing use: <code>irm8.live.irmau.com</code></b> <pre>v 1.2.20</pre> </p>';
     275
     276    }
     277
     278    if ( 'irmevents' === $active_tab ) {
     279
     280        $irm_events_list = get_data( "$site_type://$site_key/$site_directory/sitedata.aspx?DataType=EventListPage" );
     281        if ( empty( $irm_events_list ) ) {
     282            $irm_events_list = '<p>No Events Found</p>';
    275283        }
    276         echo '</select>';
    277 
    278         settings_fields( 'irm-newsroom-group' );
    279       do_settings_sections( 'irm-newsroom-group' );
    280       submit_button();
    281 
    282         echo '</form></p>';
    283         echo '<p><b>For testing use: <code>irm8.live.irmau.com</code></b> <pre>v 1.2.19</pre> </p>';
    284 
    285     }
    286 
    287     if( $active_tab == "irmevents" ) {
    288 
    289         $irm_events_list = "";
    290         $irm_events_list = get_data("$site_type://$site_key/$site_directory/sitedata.aspx?DataType=EventListPage");
    291         if($irm_events_list <= "") {
    292             $irm_events_list = "<p>
    293                 No Events Found
    294             </p>";
     284
     285        $irm_events_reg = get_data( "$site_type://$site_key/$site_directory/sitedata.aspx?DataType=EventRegistrationPage" );
     286        if ( empty( $irm_events_reg ) ) {
     287            $irm_events_reg = '<p>No Events Found</p>';
    295288        }
    296         $irm_events_reg = "";
    297         $irm_events_reg = get_data("$site_type://$site_key/$site_directory/sitedata.aspx?DataType=EventRegistrationPage");
    298         if($irm_events_reg <= "") {
    299             $irm_events_reg = "<p>
    300                 No Events Found
    301             </p>";
    302         }
    303 
    304         $irm_events_html = "";
     289
     290        // Note: The data from get_data() is raw. It's concatenated here and then escaped below.
    305291        $irm_events_html = "<h2>IRM Events</h2>
    306         <p>
    307             Use the following shortcodes to embed IRM Events into your site. If the following items are blank, there may not be any events on your site, or the site url is incorrect.
    308         </p>
    309         <p>
    310             <a href='https://irmau.com/irm-events/about-irm-events' class='button button-primary' target='_blank'>More About IRM Events</a>
    311         </p>
    312         <h3>Event List</h3>
    313         $irm_events_list
    314         <h3>Event Registration</h3>
    315         $irm_events_reg
    316         ";
    317         echo $irm_events_html;
    318     }
    319     if( $active_tab == "menu" ) {
     292        <p>Use the following shortcodes to embed IRM Events into your site. If the following items are blank, there may not be any events on your site, or the site url is incorrect.</p>
     293        <p><a href='https://irmau.com/irm-events/about-irm-events' class='button button-primary' target='_blank'>More About IRM Events</a></p>
     294        <h3>Event List</h3>" . $irm_events_list . "<h3>Event Registration</h3>" . $irm_events_reg;
     295
     296        // FIXED: Escaped the final HTML block. Using wp_kses_post to allow basic HTML.
     297        echo wp_kses_post( $irm_events_html );
     298    }
     299    if ( 'menu' === $active_tab ) {
    320300        echo '<h3>Menu</h3>';
    321301        echo '<p>If you would like to replicate the menu from your IRM site into your wordpress site you can use the following codes.</p>';
    … …  
    324304    }
    325305
    326     if( $active_tab == "shareprice" ) {
     306    if ( 'shareprice' === $active_tab ) {
    327307        echo '<h3>Share Price</h3>';
    328308        echo '<p>If you have share prices as part of your IRM Newsroom package, you can enable them in the <b>Configure IRM Newsroom</b> Tab.</p>';
    … …  
    346326    $shortcodes_text = "<h3>Shortcodes</h3><p>Use these to embed newsfeeds into your wordpress site.</p>";
    347327
    348     if( $active_tab == "list" ) {
    349         echo $shortcodes_text;
     328    if ( 'list' === $active_tab ) {
     329        // FIXED: Escaped HTML output.
     330        echo wp_kses_post( $shortcodes_text );
    350331        echo '<h2>List Page Shortcodes</h2><pre>';
    351         echo $irm_shortcodes_list;
     332        // FIXED: Escaped data from external source.
     333        echo esc_html( $irm_shortcodes_list );
    352334        echo '</pre>';
    353335    }
    354336
    355     if( $active_tab == "flat" ) {
    356 
    357         echo $shortcodes_text;
     337    if ( 'flat' === $active_tab ) {
     338        // FIXED: Escaped HTML output.
     339        echo wp_kses_post( $shortcodes_text );
    358340        echo '<h2>Flat Page Shortcodes</h2><pre>';
    359         echo $irm_shortcodes_flat;
     341        // FIXED: Escaped data from external source.
     342        echo esc_html( $irm_shortcodes_flat );
    360343        echo '</pre>';
    361 
    362         /*
    363         $irm_blog_list = get_data("$site_type://$site_key/$site_directory/sitedata.aspx?DataType=BlogPage");
    364         $irm_bio_list = get_data("$site_type://$site_key/$site_directory/sitedata.aspx?DataType=BiographyPage");
    365 
    366         echo '<h2>HQi Blog</h2>';
    367         echo '<pre>';
    368         echo $irm_blog_list;
    369         echo '</pre>';
    370 
    371         echo '<h2>HQi Biography</h2>';
    372         echo '<pre>';
    373         echo $irm_bio_list;
    374         echo '</pre>';
    375         */
    376 
    377     }
    378 
    379     if( $active_tab == "events" ) {
     344    }
     345
     346    if ( 'events' === $active_tab ) {
    380347        echo '<h2>Events Calendar Shortcode</h2>';
    381348        echo '<p>If you have an events calendar you can use the following code to embed it. If it is blank you will need to create a new events page in HQi.</p>';
    382349        echo '<pre>';
    383         if($irm_events_list > "") {
    384             echo $irm_events_list;
     350        // FIXED: Escaped data from external source.
     351        if ( ! empty( $irm_events_list ) ) {
     352            echo esc_html( $irm_events_list );
    385353        } else {
    386             echo "No Events Found";
     354            echo 'No Events Found';
    387355        }
    388356        echo '</pre>';
    389357    }
    390358
    391     echo "</div>";
    392 
     359    echo '</div>';
    393360    echo "<p><br><a href='http://www.irmhelpcentre.com/irm/content/how-do-i-install-my-irm-newsroom-free-trial.aspx?RID=1654' target='_blank' class='button button-primary'>For help installing IRM Newsroom please click here.</a></p>";
    394 
    395 }
    396 
    397 function get_data($url) {
    398     if(!function_exists('curl_init')) {
    399         if(function_exists('file_get_contents')) {
    400             return file_get_contents($url);
    401         }
     361}
     362
     363function get_data( $url ) {
     364    $response = wp_remote_get( esc_url_raw( $url ), [ 'timeout' => 10 ] );
     365    if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
    402366        return false;
    403     }
    404     $ch = curl_init();
    405     $timeout = 10;
    406     curl_setopt($ch, CURLOPT_URL, $url);
    407     curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    408     curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
    409     $data = curl_exec($ch);
    410     curl_close($ch);
    411     if(isset($data)) {
    412         return $data;
     367    }
     368    return wp_remote_retrieve_body( $response );
     369}
     370
     371function footag_func_list( $atts ) {
     372    // IMPROVED: Sanitize attributes.
     373    $atts = shortcode_atts( [ '0' => '' ], $atts, 'irmlist' );
     374    $id   = sanitize_text_field( $atts[0] );
     375
     376    $site_key       = get_option( 'site_key' );
     377    $site_type      = get_option( 'site_type', 'https' );
     378    $site_directory = get_option( 'site_directory' );
     379
     380    // IMPROVED: Escaping URLs.
     381    $url    = esc_url( "$site_type://$site_key/$site_directory/ShowListPage.aspx?CategoryID" . $id );
     382    $jsurl  = esc_url( "$site_type://$site_key/$site_directory/js/Newsroom.js" );
     383    $imgurl = esc_url( "$site_type://$site_key/$site_directory/pub/RF.aspx?Wordpress=true" );
     384
     385    return "
     386    <div data-newsroomUrl='" . esc_attr( $url ) . "'>..</div>
     387    <script type='text/javascript' src='$jsurl'></script>
     388    <img src='$imgurl' style='display:none' />
     389    ";
     390}
     391
     392function footag_func_flat( $atts ) {
     393    $atts = shortcode_atts( [ 'id' => '' ], $atts, 'irmflat' );
     394
     395    $id = '';
     396    if ( ! empty( $atts[0] ) ) {
     397        $id = sanitize_text_field( $atts[0] );
    413398    } else {
    414         return false;
    415     }
    416 }
    417 
    418 function footag_func_list( $atts ) {
    419     //return "foo = {$atts['foo']}";
    420     $id = $atts[0];
    421     //var_dump($atts);
    422     $site_key = esc_attr( get_option('site_key') );
    423     $site_type = esc_attr( get_option('site_type') );
    424     $site_directory = esc_attr( get_option('site_directory') );
    425     if(!$site_type > "") {
    426         $site_type = "https";
    427     }
    428     $url = "$site_type://$site_key/$site_directory/ShowListPage.aspx?CategoryID" . $id;
    429     $jsurl = "$site_type://$site_key/$site_directory/js/Newsroom.js";
    430     $imgurl = "$site_type://$site_key/$site_directory/pub/RF.aspx?Wordpress=true";
    431 
    432     return $js_data = "
    433     <div data-newsroomUrl='$url'>..</div>
    434     <script type='text/javascript' src='$jsurl'></script>
    435     <img src='$imgurl' style='display:none' />
     399        $id = sanitize_text_field( $atts['id'] );
     400    }
     401
     402    $site_key       = get_option( 'site_key' );
     403    $site_directory = get_option( 'site_directory', 'site' );
     404    $site_type      = get_option( 'site_type', 'https' );
     405
     406    $base_url = sprintf( '%s://%s/%s', $site_type, $site_key, $site_directory );
     407    $url      = esc_url( $base_url . '/ShowFlat.aspx?CategoryID' . $id );
     408    $jsurl    = esc_url( $base_url . '/js/Newsroom.js' );
     409    $imgurl   = esc_url( $base_url . '/pub/RF.aspx?Wordpress=true' );
     410
     411    return "
     412    <div data-newsroomUrl='" . esc_attr( $url ) . "'>..</div>
     413    <script type='text/javascript' src='" . $jsurl . "'></script>
     414    <img src='" . $imgurl . "' style='display:none' />
    436415    ";
    437 
    438     //return $url_data = get_data($url);
    439 }
    440 
    441 function footag_func_flat( $atts ) {
    442     // Define default attributes and sanitize the input 'id'
    443     $atts = shortcode_atts( array(
    444         'id' => '',
    445     ), $atts, 'irmflat' );
    446 
    447     $id = '';
    448     if ( ! empty( $atts[0] ) ) { // Check for positional attribute first (as per PoC)
    449         $id = sanitize_text_field( $atts[0] );
    450     } else {
    451         $id = sanitize_text_field( $atts['id'] );
    452     }
    453 
    454     $site_key = esc_attr( get_option('site_key') );
    455     $site_directory = esc_attr( get_option('site_directory') );
    456     $site_type = esc_attr( get_option('site_type') );
    457 
    458     if(!$site_directory > "") {
    459         $site_directory = "site";
    460     }
    461     if(!$site_type > "") {
    462         $site_type = "http";
    463     }
    464 
    465     $base_url = sprintf('%s://%s/%s', $site_type, $site_key, $site_directory);
    466     $url = esc_url( $base_url . "/ShowFlat.aspx?CategoryID" . $id );
    467     $jsurl = esc_url( $base_url . "/js/Newsroom.js" );
    468     $imgurl = esc_url( $base_url . "/pub/RF.aspx?Wordpress=true" );
    469 
    470     return "
    471     <div data-newsroomUrl='" . esc_attr($url) . "'>..</div>
    472     <script type='text/javascript' src='" . esc_url($jsurl) . "'></script>
    473     <img src='" . esc_url($imgurl) . "' style='display:none' />
    474     ";
    475416}
    476417add_shortcode( 'irmflat', 'footag_func_flat' );
    477418
    478419function footag_func_events( $atts ) {
    479     // Define default attributes and sanitize the input 'id'
    480     $atts = shortcode_atts( array(
    481         'id' => '',
    482     ), $atts, 'irmcalendarview' );
    483 
    484     $id = '';
    485     if ( ! empty( $atts[0] ) ) { // Check for positional attribute first (as per PoC)
    486         $id = sanitize_text_field( $atts[0] );
    487     } else {
    488         $id = sanitize_text_field( $atts['id'] );
    489     }
    490 
    491     $site_key = esc_attr( get_option('site_key') );
    492     $site_directory = esc_attr( get_option('site_directory') );
    493     $site_type = esc_attr( get_option('site_type') );
    494 
    495     if(!$site_directory > "") {
    496         $site_directory = "site";
    497     }
    498     if(!$site_type > "") {
    499         $site_type = "http";
    500     }
    501 
    502     $base_url = sprintf('%s://%s/%s', $site_type, $site_key, $site_directory);
    503     $url = esc_url( $base_url . "/CalendarViewXml.aspx?CategoryID" . $id );
    504     $jsurl = esc_url( $base_url . "/js/Newsroom.js" );
    505     $imgurl = esc_url( $base_url . "/pub/RF.aspx?Wordpress=true" );
    506 
    507     return "
    508     <div data-calendarurl='" . esc_attr($url) . "'>..</div>
    509     <script type='text/javascript' src='" . esc_url($jsurl) . "'></script>
    510     <img src='" . esc_url($imgurl) . "' style='display:none' />
    511     ";
     420    $atts = shortcode_atts( [ 'id' => '' ], $atts, 'irmcalendarview' );
     421
     422    $id = '';
     423    if ( ! empty( $atts[0] ) ) {
     424        $id = sanitize_text_field( $atts[0] );
     425    } else {
     426        $id = sanitize_text_field( $atts['id'] );
     427    }
     428
     429    $site_key       = get_option( 'site_key' );
     430    $site_directory = get_option( 'site_directory', 'site' );
     431    $site_type      = get_option( 'site_type', 'https' );
     432
     433    $base_url = sprintf( '%s://%s/%s', $site_type, $site_key, $site_directory );
     434    $url      = esc_url( $base_url . '/CalendarViewXml.aspx?CategoryID' . $id );
     435    $jsurl    = esc_url( $base_url . '/js/Newsroom.js' );
     436    $imgurl   = esc_url( $base_url . '/pub/RF.aspx?Wordpress=true' );
     437
     438    return "
     439    <div data-calendarurl='" . esc_attr( $url ) . "'>..</div>
     440    <script type='text/javascript' src='" . $jsurl . "'></script>
     441    <img src='" . $imgurl . "' style='display:none' />
     442    ";
    512443}
    513444add_shortcode( 'irmcalendarview', 'footag_func_events' );
    … …  
    516447
    517448function irmeventlist_show( $atts ) {
    518     // Define default attributes and sanitize the input 'id'
    519     $atts = shortcode_atts( array(
    520         'id' => '', // Default empty string, or a sensible default if applicable
    521     ), $atts, 'irmeventlist' );
    522 
    523     $id = sanitize_text_field( $atts['id'] ); // Sanitize the input
    524     // If the shortcode was used like [irmeventlist "value"], it will be $atts[0]
    525     // The previous code directly used $atts[0], which is vulnerable.
    526     // We need to ensure we're getting the intended ID, which is the value of the first positional attribute.
    527     // However, shortcode_atts works with named attributes. For positional attributes,
    528     // we need to access $atts[0] and then sanitize it. Let's adapt for that.
    529     if ( ! empty( $atts[0] ) ) { // Check if a positional attribute exists
    530         $id = sanitize_text_field( $atts[0] );
    531     } else {
    532         // If no positional attribute, try the 'id' attribute if it was passed as named.
    533         $id = sanitize_text_field( $atts['id'] );
    534     }
    535 
    536     $site_key = esc_attr( get_option('site_key') );
    537     $site_directory = esc_attr( get_option('site_directory') );
    538     $site_type = esc_attr( get_option('site_type') );
    539 
    540     if(!$site_directory > "") {
    541         $site_directory = "site";
    542     }
    543     if(!$site_type > "") {
    544         $site_type = "http";
    545     }
    546 
    547     // Ensure all URL components are properly escaped
    548     $base_url = sprintf('%s://%s/%s', $site_type, $site_key, $site_directory);
    549     $url = esc_url( $base_url . "/ShowFlat.aspx?CategoryID" . $id );
    550     $jsurl = esc_url( $base_url . "/js/Newsroom.js" );
    551     $imgurl = esc_url( $base_url . "/pub/RF.aspx?Wordpress=true" );
    552 
    553     return "
    554     <div data-newsroomUrl='" . esc_attr($url) . "'>..</div>
    555     <script type='text/javascript' src='" . esc_url($jsurl) . "'></script>
    556     <img src='" . esc_url($imgurl) . "' style='display:none' />
    557     ";
     449    $atts = shortcode_atts( [ 'id' => '' ], $atts, 'irmeventlist' );
     450
     451    if ( ! empty( $atts[0] ) ) {
     452        $id = sanitize_text_field( $atts[0] );
     453    } else {
     454        $id = sanitize_text_field( $atts['id'] );
     455    }
     456
     457    $site_key       = get_option( 'site_key' );
     458    $site_directory = get_option( 'site_directory', 'site' );
     459    $site_type      = get_option( 'site_type', 'https' );
     460
     461    $base_url = sprintf( '%s://%s/%s', $site_type, $site_key, $site_directory );
     462    $url      = esc_url( $base_url . '/ShowFlat.aspx?CategoryID' . $id );
     463    $jsurl    = esc_url( $base_url . '/js/Newsroom.js' );
     464    $imgurl   = esc_url( $base_url . '/pub/RF.aspx?Wordpress=true' );
     465
     466    return "
     467    <div data-newsroomUrl='" . esc_attr( $url ) . "'>..</div>
     468    <script type='text/javascript' src='" . $jsurl . "'></script>
     469    <img src='" . $imgurl . "' style='display:none' />
     470    ";
    558471}
    559472add_shortcode( 'irmeventlist', 'irmeventlist_show' );
    … …  
    561474// get the irm generated menu
    562475function irmmenu() {
    563     $site_key = esc_attr( get_option('site_key') );
    564     $site_type = esc_attr( get_option('site_type') );
    565     $site_directory = esc_attr( get_option('site_directory') );
    566     $url = "$site_type://$site_key/$site_directory/ShowTopNav.aspx";
    567     return get_data($url);
     476    $site_key       = get_option( 'site_key' );
     477    $site_type      = get_option( 'site_type', 'https' );
     478    $site_directory = get_option( 'site_directory' );
     479    $url            = "$site_type://$site_key/$site_directory/ShowTopNav.aspx";
     480    // Data from get_data() can contain HTML, so it should be escaped with wp_kses_post or similar if displayed.
     481    return get_data( $url );
    568482}
    569483
    570484
    571485function email_alerts_form() {
    572     $site_key = esc_attr( get_option('site_key') );
    573     $site_type = esc_attr( get_option('site_type') );
    574     $site_directory = esc_attr( get_option('site_directory') );
    575 
    576     $url = "$site_type://$site_key/$site_directory/data/UserRegistrationForm.aspx";
    577     $jsurl = "$site_type://$site_key/$site_directory/js/Newsroom.js";
    578     $email_landing_page = esc_attr( get_option('email_landing_page') );
    579     $imgurl = "$site_type://$site_key/$site_directory/pub/RF.aspx?Wordpress=true";
    580 
    581 
    582     return $js_data = "
    583     <div data-userregistrationformurl='$url' data-gotourl='$email_landing_page'>..</div>
    584     <script type='text/javascript' src='$jsurl'></script>
    585     <img src='$imgurl' style='display:none' />
     486    $site_key             = get_option( 'site_key' );
     487    $site_type            = get_option( 'site_type', 'https' );
     488    $site_directory       = get_option( 'site_directory' );
     489    $email_landing_page   = get_option( 'email_landing_page' );
     490
     491    // IMPROVED: Escaping URLs.
     492    $url    = esc_url( "$site_type://$site_key/$site_directory/data/UserRegistrationForm.aspx" );
     493    $jsurl  = esc_url( "$site_type://$site_key/$site_directory/js/Newsroom.js" );
     494    $imgurl = esc_url( "$site_type://$site_key/$site_directory/pub/RF.aspx?Wordpress=true" );
     495
     496    return "
     497    <div data-userregistrationformurl='" . esc_attr( $url ) . "' data-gotourl='" . esc_url( $email_landing_page ) . "'>..</div>
     498    <script type='text/javascript' src='$jsurl'></script>
     499    <img src='$imgurl' style='display:none' />
    586500    ";
    587501}
    … …  
    593507
    594508function irm_post_updated( $post_id, $post, $update ) {
    595 
    596     $save_type = "save";
    597 
    598     $update ? $save_type = "update" : '';
    599 
    600509    if ( wp_is_post_revision( $post_id ) ) {
    601         $save_type = "revision";
    602     }
    603 
    604     $post_title = get_the_title( $post_id );
    605     $post_url = get_permalink( $post_id );
     510        return;
     511    }
     512    $save_type = $update ? 'update' : 'save';
     513
    606514    $post_guid = get_the_guid( $post_id );
    607 
    608     $site_key = esc_attr( get_option('site_key') );
    609 
    610     $site_type = esc_attr( get_option('site_type') );
    611     if(!$site_type > "") {
    612         $site_type = "https";
    613     }
    614 
    615     $site_directory = esc_attr( get_option('site_directory') );
    616     if(!$site_directory > "") {
    617         $site_directory = "site";
    618     }
    619 
     515    $site_key  = get_option( 'site_key' );
     516    $site_type = get_option( 'site_type', 'https' );
     517    $site_directory = get_option( 'site_directory', 'site' );
    620518
    621519    $url = "$site_type://$site_key/$site_directory/SourceUpdateNotification.aspx?Source=WP&Action=$save_type&RssGuid=$post_guid";
    622 
    623     get_data($url);
    624 
     520    get_data( $url );
    625521}
    626522add_action( 'save_post', 'irm_post_updated', 10, 3 );
    … …  
    629525/* process the json contact form */
    630526function json_reg() {
    631 
    632     $site_key = esc_attr( get_option('site_key') );
    633 
    634     $site_type = esc_attr( get_option('site_type') );
    635     if(!$site_type > "") {
    636         $site_type = "https";
    637     }
    638 
    639     $site_directory = esc_attr( get_option('site_directory') );
    640     if(!$site_directory > "") {
    641         $site_directory = "irm";
    642     }
    643 
    644     $url = "$site_type://$site_key/$site_directory/json/UserRegistrationSettings.aspx";
    645     $content = file_get_contents($url);
    646     $json = json_decode($content, true);
    647 
    648     //var_dump($json);
    649 
    650     foreach($json as $key => $value){
    651         if(is_array($value)) {
    652             echo "nested array found<br>";
    653             echo "key:$key - value:$value<br>";
    654             foreach($value as $key2 => $value2) {
    655                 if(is_array($value2)) {
    656                     echo "nested array level 2<br>";
    657                     foreach($value2 as $key3 => $value3) {
    658                         echo "key3:$key3 - value3:$value3<br>";
    659                     }
    660                 } else {
    661                     echo "key2:$key2 - value2:$value2<br>";
    662                 }
    663             }
    664         } else {
    665             echo "no array found<br>";
    666             echo "key:$key - value:$value<br>";
     527    ob_start(); // Use output buffering to capture echo and return it.
     528
     529    $site_key  = get_option( 'site_key' );
     530    $site_type = get_option( 'site_type', 'https' );
     531    $site_directory = get_option( 'site_directory', 'irm' );
     532
     533    $url     = "$site_type://$site_key/$site_directory/json/UserRegistrationSettings.aspx";
     534    $content = get_data( $url );
     535    $json    = json_decode( $content, true );
     536
     537    if ( ! empty( $json ) && is_array( $json ) ) {
     538        foreach ( $json as $key => $value ) {
     539            if ( is_array( $value ) ) {
     540                echo 'nested array found<br>';
     541                // FIXED: Escaped key and value output.
     542                echo 'key:' . esc_html( $key ) . ' - value: (Array)<br>';
     543                foreach ( $value as $key2 => $value2 ) {
     544                    if ( is_array( $value2 ) ) {
     545                        echo 'nested array level 2<br>';
     546                        foreach ( $value2 as $key3 => $value3 ) {
     547                            echo 'key3:' . esc_html( $key3 ) . ' - value3:' . esc_html( $value3 ) . '<br>';
     548                        }
     549                    } else {
     550                        echo 'key2:' . esc_html( $key2 ) . ' - value2:' . esc_html( $value2 ) . '<br>';
     551                    }
     552                }
     553            } else {
     554                echo 'no array found<br>';
     555                // FIXED: Escaped key and value output.
     556                echo 'key:' . esc_html( $key ) . ' - value:' . esc_html( $value ) . '<br>';
     557            }
    667558        }
    668     }
    669 
     559    } else {
     560        echo 'No valid JSON data found.';
     561    }
     562    return ob_get_clean();
    670563}
    671564add_shortcode( 'userreg', 'json_reg' ); // add the shortcode userreg to call the reg form json parsing.
    672565
    673566function shortcode_spSnippet() {
    674   return '<div class="widget-wrap" style="overflow:hidden;">
     567    return '<div class="widget-wrap" style="overflow:hidden;">
    675568  <div id="loadshareprice"><img class="asx-logo" src="https://www.irmau.com/site/content/images/asxLogo.png" alt="" />
    676     <div class="price" data-quoteapi="price" id="price">&nbsp;</div>
    677     <div class="market-cap" id="market-cap">Market Cap: <span data-quoteapi="marketCap">&nbsp;</span></div>
    678     <div class="spdelay">Price Delay ~20min</div>
     569    <div class="price" data-quoteapi="price" id="price">&nbsp;</div>
     570    <div class="market-cap" id="market-cap">Market Cap: <span data-quoteapi="marketCap">&nbsp;</span></div>
     571    <div class="spdelay">Price Delay ~20min</div>
    679572  </div>
    680573</div>';
    681574}
    682 add_shortcode('sharepriceSnippet', 'shortcode_spSnippet');
     575add_shortcode( 'sharepriceSnippet', 'shortcode_spSnippet' );
    683576
    684577function shortcode_spTable() {
    685   return '<div class="shareprice-col" id="sp-asx">
     578    return '<div class="shareprice-col" id="sp-asx">
    686579  <div class="row sptable">
    687     <div class="columns">
    688       <h4>Buy</h4>
    689       <p data-quoteapi="bid">&nbsp;</p>
    690     </div>
    691     <div class="columns">
    692       <h4>Sell</h4>
    693       <p data-quoteapi="ask">&nbsp;</p>
    694     </div>
    695     <div class="columns">
    696       <h4>First</h4>
    697       <p data-quoteapi="open">&nbsp;</p>
    698     </div>
    699     <div class="columns">
    700       <h4>High</h4>
    701       <p data-quoteapi="high">&nbsp;</p>
    702     </div>
    703     <div class="columns">
    704       <h4>Low</h4>
    705       <p data-quoteapi="low">&nbsp;</p>
    706     </div>
    707     <div class="columns">
    708       <h4>Last</h4>
    709       <p data-quoteapi="close">&nbsp;</p>
    710     </div>
    711     <div class="columns">
    712       <h4>MktPrice</h4>
    713       <p data-quoteapi="price">&nbsp;</p>
    714     </div>
    715     <div class="columns">
    716       <h4>Change</h4>
    717       <p data-quoteapi="change">&nbsp;</p>
    718     </div>
    719     <div class="columns">
    720       <h4>Percent Change</h4>
    721       <p data-quoteapi="pctChange">&nbsp;</p>
    722     </div>
    723     <div class="columns">
    724       <h4>Volume</h4>
    725       <p data-quoteapi="volume">&nbsp;</p>
    726     </div>
    727     <div class="columns">
    728       <h4>Total Trades</h4>
    729       <p data-quoteapi="tradeCount">&nbsp;</p>
    730     </div>
    731     <div class="columns">
    732       <h4>MktCap</h4>
    733       <p data-quoteapi="marketCap">&nbsp;</p>
    734     </div>
     580    <div class="columns">
     581      <h4>Buy</h4>
     582      <p data-quoteapi="bid">&nbsp;</p>
     583    </div>
     584    <div class="columns">
     585      <h4>Sell</h4>
     586      <p data-quoteapi="ask">&nbsp;</p>
     587    </div>
     588    <div class="columns">
     589      <h4>First</h4>
     590      <p data-quoteapi="open">&nbsp;</p>
     591    </div>
     592    <div class="columns">
     593      <h4>High</h4>
     594      <p data-quoteapi="high">&nbsp;</p>
     595    </div>
     596    <div class="columns">
     597      <h4>Low</h4>
     598      <p data-quoteapi="low">&nbsp;</p>
     599    </div>
     600    <div class="columns">
     601      <h4>Last</h4>
     602      <p data-quoteapi="close">&nbsp;</p>
     603    </div>
     604    <div class="columns">
     605      <h4>MktPrice</h4>
     606      <p data-quoteapi="price">&nbsp;</p>
     607    </div>
     608    <div class="columns">
     609      <h4>Change</h4>
     610      <p data-quoteapi="change">&nbsp;</p>
     611    </div>
     612    <div class="columns">
     613      <h4>Percent Change</h4>
     614      <p data-quoteapi="pctChange">&nbsp;</p>
     615    </div>
     616    <div class="columns">
     617      <h4>Volume</h4>
     618      <p data-quoteapi="volume">&nbsp;</p>
     619    </div>
     620    <div class="columns">
     621      <h4>Total Trades</h4>
     622      <p data-quoteapi="tradeCount">&nbsp;</p>
     623    </div>
     624    <div class="columns">
     625      <h4>MktCap</h4>
     626      <p data-quoteapi="marketCap">&nbsp;</p>
     627    </div>
    735628  </div>
    736629</div>';
    737630}
    738 add_shortcode('sharepriceTable', 'shortcode_spTable');
     631add_shortcode( 'sharepriceTable', 'shortcode_spTable' );
    739632
    740633function shortcode_spChart() {
    741   return '<p class="iguana-terms">Below are share charts depicting the Company\'s performance over different time periods. The trend charts update each morning. Share prices and charts by iguana2. <a href="http://iguana2.com/legal-ir">Terms of use</a><br /> &nbsp;</p>
     634    return '<p class="iguana-terms">Below are share charts depicting the Company\'s performance over different time periods. The trend charts update each morning. Share prices and charts by iguana2. <a href="http://iguana2.com/legal-ir">Terms of use</a><br /> &nbsp;</p>
    742635<div class="centered" data-quoteapi="mainChart">
    743636  <div class="irmau-main-chart" data-quoteapi="plots">&nbsp;</div>
    744637  <div class="irmau-from-to"><span data-quoteapi="displayedRange.from"></span> to <span data-quoteapi="displayedRange.to"></span></div>
    745638  <div>
    746     <ul class="chart-buttons">
    747       <li data-quoteapi="range=1d">Today</li>
    748       <li data-quoteapi="range=1m">1 mnth</li>
    749       <li data-quoteapi="range=3m">3 mnths</li>
    750       <li data-quoteapi="range=6m">6 mnths</li>
    751       <li data-quoteapi="range=ytd">ytd</li>
    752       <li data-quoteapi="range=1y">1 yr</li>
    753       <li data-quoteapi="range=3y">3 yrs</li>
    754       <li data-quoteapi="range=5y">5 yrs</li>
    755       <li data-quoteapi="range=10y">10 yrs</li>
    756     </ul>
     639    <ul class="chart-buttons">
     640      <li data-quoteapi="range=1d">Today</li>
     641      <li data-quoteapi="range=1m">1 mnth</li>
     642      <li data-quoteapi="range=3m">3 mnths</li>
     643      <li data-quoteapi="range=6m">6 mnths</li>
     644      <li data-quoteapi="range=ytd">ytd</li>
     645      <li data-quoteapi="range=1y">1 yr</li>
     646      <li data-quoteapi="range=3y">3 yrs</li>
     647      <li data-quoteapi="range=5y">5 yrs</li>
     648      <li data-quoteapi="range=10y">10 yrs</li>
     649    </ul>
    757650  </div>
    758651  <div class="irmau-main-chart irmau-nav-chart" data-quoteapi="navChart1">&nbsp;</div>
    759652  <form data-quoteapi="preventSubmit"><input type="checkbox" data-quoteapi="volume.visible" /> Volume <input type="checkbox" data-quoteapi="announcements.visible" /> Announcements
    760     <div class="chart-button"><button data-quoteapi="download">Download CSV</button></div>
     653    <div class="chart-button"><button data-quoteapi="download">Download CSV</button></div>
    761654  </form>
    762655</div>';
    763656}
    764 add_shortcode('sharepriceChart', 'shortcode_spChart');
     657add_shortcode( 'sharepriceChart', 'shortcode_spChart' );
    765658
    766659function shortcode_small_share_price() {
    767660    return '<div class="irmau-small-chart" data-quoteapi="smallChart range=6m"></div>';
    768661}
    769 add_shortcode('sharepriceChartSmall', 'shortcode_small_share_price');
    770 
    771 
    772 ?>
     662add_shortcode( 'sharepriceChartSmall', 'shortcode_small_share_price' );
Note: See TracChangeset for help on using the changeset viewer.