WordPress.org
Get WordPress

Plugin Directory

Changeset 3347835


Ignore:
Timestamp:
08/21/2025 02:57:33 AM (6 months ago)
Author:
wp.insider
Message:

Added proper output escaping to admin input fields.

Location:
recurring-donation/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • recurring-donation/trunk/donate_plugin.php

    r3084775 r3347835  
    55Description: Plugin for accepting recurring PayPal donations via a simple shortcode
    66Author: wpecommerce
    7 Version: 1.8
     7Version: 1.9
    88Author URI: https://wp-ecommerce.net/
    99License: GPLv2 or later
    … …  
    103103            <?php if ( $message != '' && isset( $_POST['dntplgn_submit'] ) && is_email( $_POST['dntplgn_paypal_account'] ) ) { ?>
    104104                <div class="updated fade">
    105                     <p><strong><?php echo $message; ?></strong></p>
     105                    <p><strong><?php echo esc_attr($message); ?></strong></p>
    106106                </div>
    107             <?php } elseif ( '' != $error_message && ! is_email( $_POST['dntplgn_paypal_account'] ) ) { ?>
     107            <?php } elseif ( isset($error_message) ) { ?>
    108108                <div class="error">
    109                     <p><strong><?php echo $error_message; ?></strong></p>
     109                    <p><strong><?php echo esc_attr($error_message); ?></strong></p>
    110110                </div>
    111111            <?php } ?>
    … …  
    144144                        </th>
    145145                        <td class='dnt_account_row'>
    146                             <input type='text' name='dntplgn_paypal_account' size='70' id='dntplgn_paypal_account' value="<?php if ( '' != $dntplgn_options['dntplgn_paypal_email'] ) echo $dntplgn_options['dntplgn_paypal_email']; ?>" />
     146                            <input type='text' name='dntplgn_paypal_account' size='70' id='dntplgn_paypal_account' value="<?php if ( '' != $dntplgn_options['dntplgn_paypal_email'] ) echo esc_attr($dntplgn_options['dntplgn_paypal_email']); ?>" />
    147147                                                        <p class="description">The donation will go to this PayPal account.</p>
    148148                            <input type='hidden' id='dnt_tab_paypal' name='dnt_tab_paypal' value='1' />
    … …  
    197197                        </th>
    198198                        <td class='dnt_account_row'>
    199                             <input type='text' name='dntplgn_currency_symbol' size='10' id='dntplgn_currency_symbol' value="<?php echo $dntplgn_currency_symbol; ?>" />
     199                            <input type='text' name='dntplgn_currency_symbol' size='10' id='dntplgn_currency_symbol' value="<?php echo esc_attr($dntplgn_currency_symbol); ?>" />
    200200                                                        <p class="description">This symbol is shown next to the recurring amount values. By default it will use the $ symbol if you don't specify a currency symbol.</p>
    201201                        </td>
    … …  
    207207                        </th>
    208208                        <td class='dnt_account_row'>
    209                             <input type='text' name='dntplgn_return_url' size='70' id='dntplgn_return_url' value="<?php echo $dntplgn_return_url; ?>" />
     209                            <input type='text' name='dntplgn_return_url' size='70' id='dntplgn_return_url' value="<?php echo esc_attr($dntplgn_return_url); ?>" />
    210210                                                        <p class="description">PayPal will send the user to this page after the payment.</p>
    211211                        </td>
    … …  
    217217                        </th>
    218218                        <td class='dnt_account_row'>
    219                             <input type='text' name='dntplgn_cancel_return' size='70' id='dntplgn_cancel_return' value="<?php echo $dntplgn_cancel_return; ?>" />
     219                            <input type='text' name='dntplgn_cancel_return' size='70' id='dntplgn_cancel_return' value="<?php echo esc_attr($dntplgn_cancel_return); ?>" />
    220220                                                        <p class="description">PayPal will send the user to this page if the user clicks on the cancel link on the PayPal checkout page.</p>
    221221                        </td>
    … …  
    227227                        </th>
    228228                        <td class='dnt_account_row'>
    229                             <input type='text' name='dntplgn_pm_label' size='30' id='dntplgn_pm_label' value="<?php echo $dntplgn_pm_label; ?>" />
     229                            <input type='text' name='dntplgn_pm_label' size='30' id='dntplgn_pm_label' value="<?php echo esc_attr($dntplgn_pm_label); ?>" />
    230230                                                        <p class="description">This label is used next to the recurring amount select options. Example: you can use a vlaue of p/m (short for per month). Leave this field empty to hide this label.</p>
    231231                        </td>
    … …  
    358358                    <!-- Donate Amount -->
    359359                    <input id="first_button" type="radio" name="a3" checked="checked" value="<?php echo esc_attr($dntplgn_atts['recurring_amt1']); ?>" />
    360                     <label for="first_button"> <?php echo $currency_symbol; ?><?php echo esc_attr($dntplgn_atts['recurring_amt1']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
     360                    <label for="first_button"> <?php echo esc_attr($currency_symbol); ?><?php echo esc_attr($dntplgn_atts['recurring_amt1']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
    361361                    <input id="second_button" type="radio" name="a3" value="<?php echo esc_attr($dntplgn_atts['recurring_amt2']); ?>" />
    362                     <label for="second_button"> <?php echo $currency_symbol; ?><?php echo esc_attr($dntplgn_atts['recurring_amt2']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
     362                    <label for="second_button"> <?php echo esc_attr($currency_symbol); ?><?php echo esc_attr($dntplgn_atts['recurring_amt2']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
    363363                    <input id="third_button" type="radio" name="a3" value="<?php echo esc_attr($dntplgn_atts['recurring_amt3']); ?>" />
    364                     <label for="third_button"> <?php echo $currency_symbol; ?><?php echo esc_attr($dntplgn_atts['recurring_amt3']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
     364                    <label for="third_button"> <?php echo esc_attr($currency_symbol); ?><?php echo esc_attr($dntplgn_atts['recurring_amt3']); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label>
    365365                    <input id="fourth_button" type="radio" name="a3" value="other" />
    366366                    <label for="fourth_button"> <?php _e( 'Other', 'donateplugin' ); ?> <span class="dntplgn_pm_label"><?php echo esc_attr($per_month_label); ?></span></label></br>
    … …  
    413413register_activation_hook( __FILE__, 'dntplgn_register_settings' );
    414414
     415//Add the link to settings menu in plugin's dashboard menu.
     416function dntplgn_add_settings_link( $links, $file ) {
     417    if ( $file == plugin_basename( __FILE__ ) ) {
     418        $settings_link = '<a href="admin.php?page=dntplgn_plugin">' . (__( "Settings", "donateplugin" )) . '</a>';
     419        array_unshift( $links, $settings_link );
     420    }
     421    return $links;
     422}
     423add_filter( 'plugin_action_links', 'dntplgn_add_settings_link', 10, 2 );
     424
     425
    415426add_action( 'init', 'dntplgn_plugin_init' );
    416427add_action( 'admin_init', 'dntplgn_plugin_init' );

  • recurring-donation/trunk/readme.txt

    r3271705 r3347835  
    33Donate link: https://wp-ecommerce.net/
    44Tags: subscription, donate, donation, paypal, recurring, payment, donations, paypal donation, button, shortcode, monthly
    5 Requires at least: 3.0
     5Requires at least: 5.0
    66Tested up to: 6.8
    7 Stable tag: 1.8
     7Stable tag: 1.9
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    8686== Changelog ==
    8787
     88= 1.9 =
     89* Added proper output escaping to admin input fields.
     90
    8891= 1.8 =
    8992* Added output escaping to the shortcode parameters.
Note: See TracChangeset for help on using the changeset viewer.