WordPress.org
Get WordPress

Plugin Directory

Changeset 3368635


Ignore:
Timestamp:
09/26/2025 06:04:46 PM (4 months ago)
Author:
spwebguy
Message:

Escaping

Location:
team-members
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • team-members/tags/5.3.6/inc/tmm-metaboxes-members.php

    r3364663 r3368635  
    110110            switch ($field) {
    111111                default:
    112                     $member[$field] = (isset($team_member[$field])) ? esc_attr($team_member[$field]) : '';
     112                    $member[$field] = (isset($team_member[$field])) ? $team_member[$field] : '';
    113113                    break;
    114114            }

  • team-members/tags/5.3.6/inc/tmm-metaboxes-settings.php

    r3364663 r3368635  
    139139        <select class="dmb_side_select" name="team_columns">
    140140            <?php foreach ($team_columns as $label => $value) { ?>
    141             <option value="<?php echo wp_kses_post($value); ?>"
     141            <option value="<?php echo esc_attr($value); ?>"
    142142                <?php selected((isset($settings['_tmm_columns'])) ? $settings['_tmm_columns'] : '3', $value); ?>>
    143143                <?php echo esc_attr($label); ?>
    … …  
    154154        <select class="dmb_side_select" name="team_piclink_beh">
    155155            <?php foreach ($team_piclink_beh as $label => $value) { ?>
    156             <option value="<?php echo wp_kses_post($value); ?>"
     156            <option value="<?php echo esc_attr($value); ?>"
    157157                <?php selected((isset($settings['_tmm_piclink_beh'])) ? $settings['_tmm_piclink_beh'] : 'new', $value); ?>>
    158158                <?php echo esc_attr($label); ?>
    … …  
    173173        <select class="dmb_side_select" name="team_display_order">
    174174            <?php foreach ($team_display_order as $label => $value) { ?>
    175             <option value="<?php echo wp_kses_post($value); ?>"
     175            <option value="<?php echo esc_attr($value); ?>"
    176176                <?php selected((isset($settings['_tmm_display_order'])) ? $settings['_tmm_display_order'] : 'default', $value); ?>>
    177                 <?php esc_attr($label); ?>
     177                <?php echo esc_attr($label); ?>
    178178            </option>
    179179            <?php } ?>
    … …  
    188188        <select class="dmb_side_select" name="team_force_font">
    189189            <?php foreach ($team_force_font as $label => $value) { ?>
    190             <option value="<?php echo wp_kses_post($value); ?>"
     190            <option value="<?php echo esc_attr($value); ?>"
    191191                <?php selected((isset($settings['_tmm_original_font'])) ? $settings['_tmm_original_font'] : 'yes', $value); ?>>
    192192                <?php echo esc_attr($label); ?>
    … …  
    202202        </div>
    203203        <input class="dmb_color_picker dmb_field dmb_color_of_team" name="team_color" type="text"
    204             value="<?php echo (isset($settings['_tmm_color'])) ? wp_kses_post(esc_attr($settings['_tmm_color'])) : '#333333'; ?>" />
     204            value="<?php echo (isset($settings['_tmm_color'])) ? esc_attr($settings['_tmm_color']) : '#333333'; ?>" />
    205205    </div>
    206206

  • team-members/tags/5.3.6/inc/tmm-shortcode.php

    r3364663 r3368635  
    3232        /* Checks if member links open in new window. */
    3333        $tmm_piclink_beh = get_post_meta($post->ID, '_tmm_piclink_beh', true);
    34         'new' == $tmm_piclink_beh ? $tmm_plb = 'target="_blank"' : $tmm_plb = '';
     34        'new' == $tmm_piclink_beh ? $tmm_plb = 'target="_blank" rel="noopener noreferrer"' : $tmm_plb = '';
    3535
    3636        /* Checks if forcing original fonts. */
    … …  
    4747
    4848        $team_view .= '<div class="tmm tmm_'.esc_attr($name).'">';
    49         $team_view .= '<div class="tmm_'.esc_attr($tmm_columns).'_columns tmm_wrap '.$ori_f.'">';
     49        $allowed_columns = array('1','2','3','4','5');
     50        $safe_columns = in_array((string) $tmm_columns, $allowed_columns, true) ? (string) $tmm_columns : '3';
     51        $team_view .= '<div class="tmm_'.esc_attr($safe_columns).'_columns tmm_wrap '.$ori_f.'">';
    5052
    5153        if (is_array($members) || is_object($members)) {
    … …  
    5658                    $team_view .= '<span class="tmm_two_containers_tablet"></span>';
    5759                }
    58                 if (0 == $key % $tmm_columns) {
     60                if (0 == $key % (int) $safe_columns) {
    5961                    /* Checks if first div of group and closes. */
    6062                    if ($key > 0) {
    … …  
    7375
    7476                if (!empty($member['_tmm_photo'])) {
    75                     $team_view .= '<div class="tmm_photo tmm_pic_'.$name.'_'.$key.'" style="background: url('.esc_url($member['_tmm_photo']).'); margin-left: auto; margin-right:auto; background-size:cover !important;"></div>';
     77                    $team_view .= '<div class="tmm_photo tmm_pic_'.sanitize_html_class($name).'_'.absint($key).'" style="background: url('.esc_url($member['_tmm_photo']).'); margin-left: auto; margin-right:auto; background-size:cover !important;"></div>';
    7678                }
    7779
    … …  
    110112                    if ('nada' != $member['_tmm_sc_type'.$i]) {
    111113                        if ('email' == $member['_tmm_sc_type'.$i]) {
    112                             $team_view .= '<a class="tmm_sociallink" href="mailto:'.(!empty($member['_tmm_sc_url'.$i]) ? esc_attr($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     114                            $team_view .= '<a class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url('mailto:'.antispambot($member['_tmm_sc_url'.$i])) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    113115                        } elseif ('phone' == $member['_tmm_sc_type'.$i]) {
    114                             $team_view .= '<a class="tmm_sociallink" href="tel:'.(!empty($member['_tmm_sc_url'.$i]) ? esc_attr($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     116                            $team_view .= '<a class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url('tel:'.preg_replace('/[^0-9+]/', '', $member['_tmm_sc_url'.$i])) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    115117                        } else {
    116                             $team_view .= '<a target="_blank" class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     118                            $team_view .= '<a target="_blank" class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    117119                        }
    118120                    }

  • team-members/trunk/inc/tmm-metaboxes-members.php

    r3364663 r3368635  
    110110            switch ($field) {
    111111                default:
    112                     $member[$field] = (isset($team_member[$field])) ? esc_attr($team_member[$field]) : '';
     112                    $member[$field] = (isset($team_member[$field])) ? $team_member[$field] : '';
    113113                    break;
    114114            }

  • team-members/trunk/inc/tmm-metaboxes-settings.php

    r3364663 r3368635  
    139139        <select class="dmb_side_select" name="team_columns">
    140140            <?php foreach ($team_columns as $label => $value) { ?>
    141             <option value="<?php echo wp_kses_post($value); ?>"
     141            <option value="<?php echo esc_attr($value); ?>"
    142142                <?php selected((isset($settings['_tmm_columns'])) ? $settings['_tmm_columns'] : '3', $value); ?>>
    143143                <?php echo esc_attr($label); ?>
    … …  
    154154        <select class="dmb_side_select" name="team_piclink_beh">
    155155            <?php foreach ($team_piclink_beh as $label => $value) { ?>
    156             <option value="<?php echo wp_kses_post($value); ?>"
     156            <option value="<?php echo esc_attr($value); ?>"
    157157                <?php selected((isset($settings['_tmm_piclink_beh'])) ? $settings['_tmm_piclink_beh'] : 'new', $value); ?>>
    158158                <?php echo esc_attr($label); ?>
    … …  
    173173        <select class="dmb_side_select" name="team_display_order">
    174174            <?php foreach ($team_display_order as $label => $value) { ?>
    175             <option value="<?php echo wp_kses_post($value); ?>"
     175            <option value="<?php echo esc_attr($value); ?>"
    176176                <?php selected((isset($settings['_tmm_display_order'])) ? $settings['_tmm_display_order'] : 'default', $value); ?>>
    177                 <?php esc_attr($label); ?>
     177                <?php echo esc_attr($label); ?>
    178178            </option>
    179179            <?php } ?>
    … …  
    188188        <select class="dmb_side_select" name="team_force_font">
    189189            <?php foreach ($team_force_font as $label => $value) { ?>
    190             <option value="<?php echo wp_kses_post($value); ?>"
     190            <option value="<?php echo esc_attr($value); ?>"
    191191                <?php selected((isset($settings['_tmm_original_font'])) ? $settings['_tmm_original_font'] : 'yes', $value); ?>>
    192192                <?php echo esc_attr($label); ?>
    … …  
    202202        </div>
    203203        <input class="dmb_color_picker dmb_field dmb_color_of_team" name="team_color" type="text"
    204             value="<?php echo (isset($settings['_tmm_color'])) ? wp_kses_post(esc_attr($settings['_tmm_color'])) : '#333333'; ?>" />
     204            value="<?php echo (isset($settings['_tmm_color'])) ? esc_attr($settings['_tmm_color']) : '#333333'; ?>" />
    205205    </div>
    206206

  • team-members/trunk/inc/tmm-shortcode.php

    r3364663 r3368635  
    3232        /* Checks if member links open in new window. */
    3333        $tmm_piclink_beh = get_post_meta($post->ID, '_tmm_piclink_beh', true);
    34         'new' == $tmm_piclink_beh ? $tmm_plb = 'target="_blank"' : $tmm_plb = '';
     34        'new' == $tmm_piclink_beh ? $tmm_plb = 'target="_blank" rel="noopener noreferrer"' : $tmm_plb = '';
    3535
    3636        /* Checks if forcing original fonts. */
    … …  
    4747
    4848        $team_view .= '<div class="tmm tmm_'.esc_attr($name).'">';
    49         $team_view .= '<div class="tmm_'.esc_attr($tmm_columns).'_columns tmm_wrap '.$ori_f.'">';
     49        $allowed_columns = array('1','2','3','4','5');
     50        $safe_columns = in_array((string) $tmm_columns, $allowed_columns, true) ? (string) $tmm_columns : '3';
     51        $team_view .= '<div class="tmm_'.esc_attr($safe_columns).'_columns tmm_wrap '.$ori_f.'">';
    5052
    5153        if (is_array($members) || is_object($members)) {
    … …  
    5658                    $team_view .= '<span class="tmm_two_containers_tablet"></span>';
    5759                }
    58                 if (0 == $key % $tmm_columns) {
     60                if (0 == $key % (int) $safe_columns) {
    5961                    /* Checks if first div of group and closes. */
    6062                    if ($key > 0) {
    … …  
    7375
    7476                if (!empty($member['_tmm_photo'])) {
    75                     $team_view .= '<div class="tmm_photo tmm_pic_'.$name.'_'.$key.'" style="background: url('.esc_url($member['_tmm_photo']).'); margin-left: auto; margin-right:auto; background-size:cover !important;"></div>';
     77                    $team_view .= '<div class="tmm_photo tmm_pic_'.sanitize_html_class($name).'_'.absint($key).'" style="background: url('.esc_url($member['_tmm_photo']).'); margin-left: auto; margin-right:auto; background-size:cover !important;"></div>';
    7678                }
    7779
    … …  
    110112                    if ('nada' != $member['_tmm_sc_type'.$i]) {
    111113                        if ('email' == $member['_tmm_sc_type'.$i]) {
    112                             $team_view .= '<a class="tmm_sociallink" href="mailto:'.(!empty($member['_tmm_sc_url'.$i]) ? esc_attr($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     114                            $team_view .= '<a class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url('mailto:'.antispambot($member['_tmm_sc_url'.$i])) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    113115                        } elseif ('phone' == $member['_tmm_sc_type'.$i]) {
    114                             $team_view .= '<a class="tmm_sociallink" href="tel:'.(!empty($member['_tmm_sc_url'.$i]) ? esc_attr($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     116                            $team_view .= '<a class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url('tel:'.preg_replace('/[^0-9+]/', '', $member['_tmm_sc_url'.$i])) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    115117                        } else {
    116                             $team_view .= '<a target="_blank" class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.plugins_url('img/links/', __FILE__).esc_attr($member['_tmm_sc_type'.$i]).'.png"/></a>';
     118                            $team_view .= '<a target="_blank" class="tmm_sociallink" href="'.(!empty($member['_tmm_sc_url'.$i]) ? esc_url($member['_tmm_sc_url'.$i]) : '').'" title="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'"><img alt="'.(!empty($member['_tmm_sc_title'.$i]) ? esc_attr($member['_tmm_sc_title'.$i]) : '').'" src="'.esc_url(plugins_url('img/links/'.sanitize_key($member['_tmm_sc_type'.$i]).'.png', __FILE__)).'"/></a>';
    117119                        }
    118120                    }
Note: See TracChangeset for help on using the changeset viewer.