WordPress.org
Get WordPress

Plugin Directory

Changeset 3403213


Ignore:
Timestamp:
11/26/2025 10:33:44 AM (3 weeks ago)
Author:
ThemeHigh
Message:

V1.5.3

Location:
advanced-faq-manager/trunk
Files:
2 added
7 edited

Legend:

Unmodified
Added
Removed

  • advanced-faq-manager/trunk/advanced-faq-manager.php

    r3133378 r3403213  
    33 * Plugin Name: Advanced FAQ Manager (Best FAQ Plugin for WordPress)
    44 * Description: FAQ Plugin for WordPress lets you create and manage FAQs in your WordPress pages.
    5  * Version:     1.5.2
     5 * Version:     1.5.3
    66 * Author:      ThemeHigh
    77 * Author URI:  https://www.themehigh.com
    … …  
    2424
    2525        public function init() {
    26             define('THFAQF_VERSION', '1.5.2');
     26            define('THFAQF_VERSION', '1.5.3');
    2727            !defined('THFAQF_BASE_NAME') && define('THFAQF_BASE_NAME', plugin_basename( __FILE__ ));
    2828            !defined('THFAQF_PATH') && define('THFAQF_PATH', plugin_dir_path( __FILE__ ));

  • advanced-faq-manager/trunk/includes/admin/class-thfaqf-admin-settings-faq.php

    r2932615 r3403213  
    154154                    <td class="pl-10">
    155155                        <label class="thpladmin-switch">
    156                             <input type="checkbox" id="override_global_settings" name="override_global_settings" value= yes <?php echo $override_checked; ?> onchange="thfaqfEnableDisableOverrideSettings(this)"/>
     156                            <input type="checkbox" id="override_global_settings" name="override_global_settings" value= yes <?php echo esc_attr($override_checked); ?> onchange="thfaqfEnableDisableOverrideSettings(this)"/>
    157157                            <span class="thpladmin-slider"></span>
    158158                        </label>
    … …  
    196196
    197197    public function render_meta_box_shortcode_display(){
    198         $post_id = get_the_ID();
     198        $post_id = absint(get_the_ID());
    199199        $shortcode = '[faq id="'. $post_id .'"]';
    200200
    … …  
    212212
    213213    public function render_meta_box_shortcode_display_faq_group(){
    214         $post_id = get_the_ID();
     214        $post_id = absint(get_the_ID());
    215215        $shortcode = '[thfaq_group category="category_1,category_2,etc.." limit="-1"]';
    216216
    … …  
    276276        $rand_editor_id = $random_editor_id ? $random_editor_id : rand(1,10000);
    277277        ?>
    278         <div class="thfaqf-single-form-wrapper <?php echo $wrapper_class; ?>" >
     278        <div class="thfaqf-single-form-wrapper <?php echo esc_attr($wrapper_class); ?>" >
    279279            <div class="thfaqf-single-form-header">
    280                 <span class="faq-title"><?php echo wordwrap($title); ?></span>
     280                <span class="faq-title"><?php echo esc_html(wordwrap($title)); ?></span>
    281281                <span class="faq-delete dashicons dashicons-trash" onclick="thfaqfDeleteFaqItem(this)"></span>
    282282                <span class="faq-edit dashicons dashicons-edit" onclick="thfaqfEditFaqItem(this)"></span>
    … …  
    286286                <p>
    287287                    <label class="faq-label">Title:</label>
    288                     <input type="text"  name="faq_title[]" value="<?php echo $title; ?>" placeholder="FAQ title" class="faq-input-title">
     288                    <input type="text"  name="faq_title[]" value="<?php echo esc_attr($title); ?>" placeholder="FAQ title" class="faq-input-title">
    289289                </p>
    290290
    … …  
    294294                    <span class="thfaqf-media-button-icon"></span> Add Media
    295295                </button>
    296                 <textarea name="faq_content[]" id = "<?php echo 'thfaq_editor_tinymce_'.$rand_editor_id; ?>" class="faq-input-content"><?php echo $content; ?></textarea>
    297                 <input type="hidden"  name="faq_comment[]" value="<?php echo $faq_comment; ?>"/>
    298                 <input type="hidden"  name="like_user_ids[]" value="<?php echo $like_user_ids; ?>"/>
    299                 <input type="hidden"  name="dislike_user_ids[]" value="<?php echo $dislike_user_ids; ?>"/>
    300                 <input type="hidden" class="random-editor-id" name="random_editor_id[]" value="<?php echo $rand_editor_id; ?>"/>
     296                <textarea name="faq_content[]" id = "<?php echo esc_attr('thfaq_editor_tinymce_'.$rand_editor_id); ?>" class="faq-input-content"><?php echo esc_textarea($content); ?></textarea>
     297                <input type="hidden"  name="faq_comment[]" value="<?php echo esc_attr($faq_comment); ?>"/>
     298                <input type="hidden"  name="like_user_ids[]" value="<?php echo esc_attr($like_user_ids); ?>"/>
     299                <input type="hidden"  name="dislike_user_ids[]" value="<?php echo esc_attr($dislike_user_ids); ?>"/>
     300                <input type="hidden" class="random-editor-id" name="random_editor_id[]" value="<?php echo esc_attr($rand_editor_id); ?>"/>
    301301
    302302            </div>
    … …  
    324324                        $faq_field_value  = isset($_POST[$key][$i]) ? $_POST[$key][$i] : array();
    325325
    326                         if($type == 'f_text' || $type == 'f_textarea'){
    327                             $faq_field_value = htmlspecialchars($faq_field_value);
     326                        if($type == 'f_text'){
     327                            $faq_field_value = sanitize_post_field('post_title', stripslashes($faq_field_value), 0, 'db');
     328                        }elseif($type == 'f_textarea'){
     329                            $faq_field_value = sanitize_post_field('post_content', stripslashes($faq_field_value), 0, 'db');
    328330                        }else {
    329                            
    330                             $faq_field_value = sanitize_text_field($faq_field_value);
     331                            $faq_field_value = sanitize_text_field(stripslashes($faq_field_value));
    331332                        }
    332333
    … …  
    399400        $posttype = get_post_type();
    400401        if($post_columns === 'Shortcode' && $posttype == 'faq'){
     402            $post_id = absint($post_id);
    401403            $shortcode = '[FAQ id="'. $post_id .'"]'
    402404            ?>

  • advanced-faq-manager/trunk/includes/admin/class-thfaqf-admin-settings-general.php

    r2671153 r3403213  
    9797                        ?>
    9898                    </tr>
    99                       <tr class="thfaq-icon-poss <?php echo $enable_icon_options; ?>">
     99                      <tr class="thfaq-icon-poss <?php echo esc_attr($enable_icon_options); ?>">
    100100                        <?php
    101101                        $this->render_form_field_element($this->settings_fields['icon_picker'], $settings, $this->cell_props_L);
    … …  
    166166                        ?>
    167167                    </tr>
    168                     <tr class="thfaqf-additonal-css-wrapper <?php echo $thfaq_custom_css; ?>">
     168                    <tr class="thfaqf-additonal-css-wrapper <?php echo esc_attr($thfaq_custom_css); ?>">
    169169                        <?php
    170170                        $this->render_form_field_element($this->settings_fields['thfaq_custom_css'], $settings, $this->cell_props_L);
    … …  
    177177                    <input type="submit" name="reset_settings" class="button" value="Reset to default" onclick="return confirm('Are you sure you want to reset to default settings? all your changes will be deleted.');">
    178178                </p>
    179                 <p class="mt-20">Here you can <a href="<?php echo $eurl.'export.php'; ?>"><i>Export</i></a>/ <a href="<?php echo $eurl.'import.php'; ?>"> <i>Import</i></a> FAQs</p>
     179                <p class="mt-20">Here you can <a href="<?php echo esc_url($eurl.'export.php'); ?>"><i>Export</i></a>/ <a href="<?php echo esc_url($eurl.'import.php'); ?>"> <i>Import</i></a> FAQs</p>
    180180            </form>
    181181        </div>       
    … …  
    185185    private function wp_verify_nonce() {
    186186        ?>
    187         <input type="hidden" name="wp_thfaqgs_nonce" value="<?php echo wp_create_nonce('thfaqgs_nonce'); ?>">
    188         <input type="hidden" name="wp_thfaqrs_nonce" value="<?php echo wp_create_nonce('thfaqrs_nonce'); ?>">
     187        <input type="hidden" name="wp_thfaqgs_nonce" value="<?php echo esc_attr(wp_create_nonce('thfaqgs_nonce')); ?>">
     188        <input type="hidden" name="wp_thfaqrs_nonce" value="<?php echo esc_attr(wp_create_nonce('thfaqrs_nonce')); ?>">
    189189        <?php
    190190    }

  • advanced-faq-manager/trunk/includes/admin/class-thfaqf-admin-settings.php

    r2671153 r3403213  
    161161            }else if($ftype == 'switch'){
    162162                $field_props .= isset($field['checked']) && $field['checked'] ? ' checked' : '';
    163                 $field_html .= '<label class="'.$class.' thpladmin-switch">';
     163                $field_html .= '<label class="'.esc_attr($class).' thpladmin-switch">';
    164164                $field_html .= '<input type="checkbox" '. $field_props .' />';
    165165                $field_html .= '<span class="thpladmin-slider"></span>';
    … …  
    197197                ?>
    198198               
    199                 <td <?php echo $label_cell_props ?> > <?php
    200                     echo $flabel; echo $required_html;
     199                <td <?php echo esc_attr($label_cell_props); ?> > <?php
     200                    echo esc_html($flabel);
     201                    echo wp_kses_post($required_html);
    201202                   
    202203                    if(isset($field['sub_label']) && !empty($field['sub_label'])){
    203204                        ?>
    204                         <br /><span class="thpladmin-subtitle"><?php _e($field['sub_label'], 'advanced-faq-manager'); ?></span>
     205                        <br /><span class="thpladmin-subtitle"><?php esc_html_e($field['sub_label'], 'advanced-faq-manager'); ?></span>
    205206                        <?php
    206207                    }
    … …  
    215216                ?>
    216217               
    217                 <td <?php echo $input_cell_props ?> ><?php echo $field_html; ?></td>
     218                <td <?php echo esc_attr($input_cell_props); ?> ><?php echo $field_html; ?></td>
    218219               
    219220                <?php
    … …  
    249250        if($render_cell){
    250251        ?>
    251             <td <?php echo $args['cell_props']; ?> ><?php echo $field_html; ?></td>
     252            <td <?php echo esc_attr($args['cell_props']); ?> ><?php echo $field_html; ?></td>
    252253        <?php
    253254        }else{
    … …  
    260261    public function render_form_section_separator($props, $atts=array()){
    261262        ?>
    262         <tr valign="top"><td colspan="<?php echo $props['colspan']; ?>" style="height:10px;"></td></tr>
    263         <tr valign="top"><td colspan="<?php echo $props['colspan']; ?>" class="thpladmin-form-section-title" ><?php echo $props['title']; ?></td></tr>
    264         <tr valign="top"><td colspan="<?php echo $props['colspan']; ?>" style="height:0px;"></td></tr>
     263        <tr valign="top"><td colspan="<?php echo esc_attr($props['colspan']); ?>" style="height:10px;"></td></tr>
     264        <tr valign="top"><td colspan="<?php echo esc_attr($props['colspan']); ?>" class="thpladmin-form-section-title" ><?php echo esc_html($props['title']); ?></td></tr>
     265        <tr valign="top"><td colspan="<?php echo esc_attr($props['colspan']); ?>" style="height:0px;"></td></tr>
    265266        <?php
    266267    }
    … …  
    268269    public function render_form_section_subtitle($props, $atts=array()){
    269270        ?>
    270         <tr valign="top"><td colspan="<?php echo $props['colspan']; ?>" class="thpladmin-form-section-subtitle" ><?php echo $props['title']; ?></td></tr>
     271        <tr valign="top"><td colspan="<?php echo esc_attr($props['colspan']); ?>" class="thpladmin-form-section-subtitle" ><?php echo esc_html($props['title']); ?></td></tr>
    271272        <?php
    272273    }

  • advanced-faq-manager/trunk/includes/admin/class-thfaqf-admin.php

    r2671153 r3403213  
    66
    77class THFAQF_Admin{
     8
     9    private $screen_id;
    810
    911    public function faq_general_setting_menu(){
    … …  
    5658    public function output_settings(){
    5759        if(!current_user_can('manage_options')){
    58             wp_die( __( 'You do not have sufficient permissions to access this page.' ) );
     60            wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'advanced-faq-manager' ) );
    5961        }     
    6062        $settings = THFAQF_Admin_Settings_General::instance();

  • advanced-faq-manager/trunk/includes/public/class-thfaqf-public.php

    r2990764 r3403213  
    4141        ob_start();
    4242        foreach($faq_post_ids as  $key => $faq_post_id){
     43            $faq_post_id = absint($faq_post_id);
     44           
    4345            $post_status = get_post_status($faq_post_id);
    4446            $post_type = get_post_type($faq_post_id);
    … …  
    5254
    5355        $invalid_ids = implode(',', $invalid_ids);
    54         echo $invalid_faq_html = !empty($invalid_ids) ? '[FAQ id="'.$invalid_ids.'"]' : '';
     56        // Escape output to prevent XSS
     57        echo !empty($invalid_ids) ? esc_html('[FAQ id="'.$invalid_ids.'"]') : '';
    5558        return ob_get_clean();
    5659    }
    … …  
    6467        ), $atts );
    6568
    66         $faq_category = $sh_args['category'];
    67         $limit = $sh_args['limit'];
     69        $faq_category = isset($sh_args['category']) ? sanitize_text_field($sh_args['category']) : '';
     70        $limit = isset($sh_args['limit']) ? intval($sh_args['limit']) : '';
    6871        $category_array = explode (",", $faq_category);
    6972        $pst_args = array( 
    … …  
    9093        $theme_wrapper_class = $this->get_theme_wrapper_class();
    9194        ?>
    92         <div class="thfaqf-layout-wrapper thfaqf-faq-list <?php echo $theme_wrapper_class; ?>">
     95        <div class="thfaqf-layout-wrapper thfaqf-faq-list <?php echo esc_attr($theme_wrapper_class); ?>">
    9396            <?php
    9497            $faq_index1 = 0;
    … …  
    98101            while($loop->have_posts()) : $loop->the_post();
    99102                $faq_index1++;
     103                $post_id = absint(get_the_ID());
    100104                ?>
    101                 <div class="<?php echo 'thfaqf-tab-id_'.get_the_ID(); ?> thfaqf-tabcontent-wrapper  <?php echo $faq_index1 != 1 ? 'thfaqf-hide' : ''; ?>">
     105                <div class="<?php echo 'thfaqf-tab-id_'.esc_attr($post_id); ?> thfaqf-tabcontent-wrapper  <?php echo esc_attr($faq_index1 != 1 ? 'thfaqf-hide' : ''); ?>">
    102106                    <?php
    103107                    echo $enable_search_option_faq_layout ? $this->faq_search_option($show_updated_date) : '';
    104                     $last_updated = get_the_modified_date(get_option('date_format'), get_the_ID());
     108                    $last_updated = get_the_modified_date(get_option('date_format'), $post_id);
    105109                    echo $show_updated_date ? '<p class="thfaqf-faq-updated-date">'.esc_html($last_updated).'</p>' :  '';
    106110                    ?>
    … …  
    116120                    $tab_title = get_the_title(get_the_ID());
    117121                    $tab_title =  $tab_title ?  $tab_title : 'Title '.$tab_index;
     122                    $tab_id = absint(get_the_ID());
    118123                    ?>
    119                     <h3 class="thfaqf-tablinks thfaqf-tablinks-<?php echo get_the_ID(); ?>  <?php echo $tab_index == 1 ? 'active' : ''; ?>" onclick="FaqTabOnClick(this, 'thfaqf-tab-id_<?php echo get_the_ID(); ?>')"><?php echo $tab_title; ?></h3>
     124                    <h3 class="thfaqf-tablinks thfaqf-tablinks-<?php echo esc_attr($tab_id); ?>  <?php echo $tab_index == 1 ? 'active' : ''; ?>" onclick="FaqTabOnClick(this, 'thfaqf-tab-id_<?php echo esc_js($tab_id); ?>')"><?php echo esc_html($tab_title); ?></h3>
    120125                <?php endwhile; ?>
    121126            </div>
    … …  
    124129            while( $loop->have_posts()) : $loop->the_post();
    125130                $faq_index++;
     131                $post_id = absint(get_the_ID());
    126132                ?>
    127                 <div class="<?php echo 'thfaqf-tab-id_'.get_the_ID(); ?> thfaqf-tabcontent-wrapper thfaqf-tabcontent  <?php echo $faq_index != 1 ? 'thfaqf-hide' : ''; ?>">
    128                     <?php $this->faq_list(get_the_ID(),'layout'); ?>
     133                <div class="<?php echo 'thfaqf-tab-id_'.esc_attr($post_id); ?> thfaqf-tabcontent-wrapper thfaqf-tabcontent  <?php echo $faq_index != 1 ? 'thfaqf-hide' : ''; ?>">
     134                    <?php $this->faq_list($post_id,'layout'); ?>
    129135                </div>
    130136            <?php endwhile; ?>
    … …  
    134140
    135141    public function faq_list($post_id,$type){
     142        $post_id = absint($post_id);
    136143        $faqs = get_post_meta($post_id, THFAQF_Utils::OPTION_KEY_FAQ_ITEMS, true);
    137144        if(empty($faqs)){
    … …  
    194201        $this->get_additional_css_for_faqs($post_id);
    195202        ?>
    196         <div class="thfaqf-faq-list <?php echo $theme_wrapper_class ?>">
     203        <div class="thfaqf-faq-list <?php echo esc_attr($theme_wrapper_class); ?>">
    197204            <?php
    198             echo $type == 'faq' ? '<h3 class="thfaqf-faq-list-title">'.get_the_title($post_id).'</h3>' : '';
    199             echo ($enable_search_option === 'yes' || $enable_search_option === true) && $type != 'layout'  ? $this->faq_search_option($show_updated_date ) : '';
    200             if(($show_updated_date === "yes" || $show_updated_date == 1) && $type != 'layout'){
     205            echo $type == 'faq' ? '<h3 class="thfaqf-faq-list-title">'.esc_html(get_the_title($post_id)).'</h3>' : '';
     206            echo (($enable_search_option === 'yes' || $enable_search_option === true) && $type !== 'layout') ? wp_kses_post((string) $this->faq_search_option($show_updated_date)) : '';
     207            if(($show_updated_date === "yes" || $show_updated_date == 1) && $type != 'layout'){
    201208                $last_updated = get_the_modified_date(get_option('date_format'), $post_id);
    202209                echo '<p class="thfaqf-faq-last-updated">'. esc_html($last_updated).'</p>';
    … …  
    210217                $dislike_user_ids = !empty ($faq_item['dislike_user_ids']) ? $faq_item['dislike_user_ids'] : '';
    211218                $display_none = $key < $visible_faq_count ? '' : 'thfaqf-div-none';
    212                 $this->display_faq_item($faq_item, $item_wrapper_class, $item_wrapper_style, $item_title_style, $item_content_style, $title_text_style,$item_expnd_icon_style,$post_id,$key,$like_user_ids,$dislike_user_ids,$faq_title_icon,$enable_icon_options,$user_id,$display_none,$title_active_color);
     219                $this->display_faq_item($faq_item, $item_wrapper_class, $item_wrapper_style, $item_title_style, $item_content_style, $title_text_style,$item_expnd_icon_style,$post_id,$key,$like_user_ids,$dislike_user_ids,$faq_title_icon,$enable_icon_options,$user_id,esc_attr($display_none),$title_active_color);
    213220                $index++;
    214221            }
    … …  
    230237                        $display_none = $i>4? 'thfaqf-div-none' : '';
    231238                        ?>
    232                         <span class="thfaqf-page-no <?php echo $display_none; ?>" data-number="<?php echo $i; ?>">
    233                         <a class="thfaqf-pnumber <?php echo $active; ?>"href="#" onclick="ThfaqEachPage(this)" ><?php echo $i; ?></a>
     239                        <span class="thfaqf-page-no <?php echo esc_attr($display_none); ?>" data-number="<?php echo esc_attr($i); ?>">
     240                        <a class="thfaqf-pnumber <?php echo esc_attr($active); ?>"href="#" onclick="ThfaqEachPage(this)" ><?php echo esc_html($i); ?></a>
    234241                        </span>
    235242                        <?php
    … …  
    239246                    }
    240247                    ?>
    241                     <span onclick="ThfaqPagination(this,'next_page')" data-page_count="<?php echo $page_count; ?>"><a class="thfaqf-next-page <?php echo $pagination_panel == 1 ? 'thfaqf-div-none': ''; ?>" href="#">>></a></span>
     248                    <span onclick="ThfaqPagination(this,'next_page')" data-page_count="<?php echo esc_attr($page_count); ?>"><a class="thfaqf-next-page <?php echo esc_attr($pagination_panel == 1 ? 'thfaqf-div-none': ''); ?>" href="#">>></a></span>
    242249                </span>
    243250                <input type="hidden" class="thfaqf-count-faq-number"name="count_faq" value="<?php echo esc_attr($visible_faq_count);?>"/>
    … …  
    252259        $faq_content = isset($faq_item['faq_content']) ? $faq_item['faq_content'] : '';
    253260        $faq_title = htmlspecialchars_decode($faq_title);
    254         $faq_content = htmlspecialchars_decode($faq_content);
     261        // $faq_content = htmlspecialchars_decode($faq_content); // --- IGNORE ---
     262        $faq_content = apply_filters('thfaq_faq_content_single_page', $faq_content, $faq_item);
    255263        $enable_like_dislike = THFAQF_Utils::get_faq_settings('','like_and_dislike_option');
    256264        $enable_comment_box = THFAQF_Utils::get_faq_settings('','enable_disable_comment');
    … …  
    261269
    262270        ?>
    263         <div id="thfaqf-faq-item-<?php echo $post_id.'_'.$key; ?>" class="thfaqf-faq-item  thfaqf-faq-item-<?php echo $post_id; ?>  <?php echo esc_attr($display_none).' '.esc_attr($item_wrapper_class).' thfaqf-post-id-'.esc_attr($post_id); ?> thfaqf-count-dsply-setngs" style="<?php echo esc_attr($item_wrapper_style); ?>" >
    264             <div data-active_color="<?php echo $title_active_color; ?>" class="thfaqf-faq-item-title" style="<?php echo esc_attr($item_title_style); ?>">
     271        <div id="thfaqf-faq-item-<?php echo esc_attr($post_id.'_'.$key); ?>" class="thfaqf-faq-item  thfaqf-faq-item-<?php echo esc_attr($post_id); ?>  <?php echo esc_attr($display_none).' '.esc_attr($item_wrapper_class).' thfaqf-post-id-'.esc_attr($post_id); ?> thfaqf-count-dsply-setngs" style="<?php echo esc_attr($item_wrapper_style); ?>" >
     272            <div data-active_color="<?php echo esc_attr($title_active_color); ?>" class="thfaqf-faq-item-title" style="<?php echo esc_attr($item_title_style); ?>">
    265273                <h4>
    266274                <?php
    … …  
    269277                    <?php } ?>
    270278                    <span class="<?php echo esc_attr($expand_style);?> thfaqf-toggle-icon" style="<?php echo esc_attr($item_expnd_icon_style); ?>"></span>
    271                     <span class="thfaqf-title-text " style="<?php echo esc_attr($title_text_style); ?>" ><?php echo $faq_title; ?></span>
     279                    <span class="thfaqf-title-text " style="<?php echo esc_attr($title_text_style); ?>" ><?php echo esc_html($faq_title); ?></span>
    272280                </h4>   
    273281            </div>
    274282            <div class="thfaqf-faq-item-content" style="<?php echo esc_attr($item_content_style); ?>" >
    275283                <?php
    276                 echo wpautop($faq_content);
    277                 echo $enable_like_dislike == true ?  $this->like_option($post_id,$key,$like_user_ids,$dislike_user_ids,$user_id) : '';
     284
     285                echo wp_kses_post(wpautop($faq_content));
     286                echo $enable_like_dislike == true ? wp_kses_post($this->like_option($post_id,$key,$like_user_ids,$dislike_user_ids,$user_id)) : '';
    278287           
    279288                if($enable_comment_box == true){
    … …  
    294303
    295304    public function display_comment_box($faq_id,$faq_index){
     305        // Cast IDs to integers for security
     306        $faq_id = absint($faq_id);
     307        $faq_index = absint($faq_index);
     308       
     309        if($faq_id <= 0){
     310            return;
     311        }
     312       
    296313        ?>
    297314        <div class="thfaqf-comment-wrapper">
    … …  
    304321                <p><textarea placeholder="Add a Comment..."name="user_msg" class="thfaqf-comment-box thfaqf-ucomment"></textarea></p>
    305322                <p class="threq-comment"></p>
    306                 <input type="hidden" name="wp_thfaqc_nonce" value="<?php echo wp_create_nonce('thfaqc_nonce'); ?>"/>
     323                <input type="hidden" name="wp_thfaqc_nonce" value="<?php echo esc_attr(wp_create_nonce('thfaqc_nonce')); ?>"/>
    307324                <p><button type="submit" name="thfaqf_comment_submt" class="thfaqf-submt-cmmt button primary is-xsmall" onclick="submitFaqfComment(this)">Send</button></p><p class="thfaqf-comment-validetion"></p>
    308325            </form>
    … …  
    310327            <?php
    311328            $faq_data = get_post_meta($faq_id, THFAQF_Utils::OPTION_KEY_FAQ_ITEMS, true);
     329            // Validate array key exists before access
     330            if(!isset($faq_data[$faq_index])){
     331                return;
     332            }
     333           
    312334            $faq_comment_id = isset($faq_data[$faq_index]['faq_comment']) ? $faq_data[$faq_index]['faq_comment'] : '';
    313335            $faq_comments_array = isset($faq_comment_id) ? explode(',', $faq_comment_id) : array();
    … …  
    316338                $arr =array();
    317339                foreach($faq_comments_array as $key =>$faq_single_comment_ids){
     340                    // Cast comment ID to integer
     341                    $faq_single_comment_ids = absint($faq_single_comment_ids);
     342                    if($faq_single_comment_ids <= 0){
     343                        continue;
     344                    }
     345                   
    318346                    $post_status = get_post_status($faq_single_comment_ids);
    319347                    $post_type = get_post_type($faq_single_comment_ids);
    … …  
    330358                                <span class="thfaq-cmmt-user-name"><i class="fas fa-user"></i><spam style="margin-left:7px;"><?php echo esc_html($faq_cmmted_user).' ';?><?php echo !empty($faq_cmmted_user) ? 'Commented' : ''?></spam></span>
    331359                            </div>
    332                             <br><div class="thfaq-cmmted-data"><?php echo  do_shortcode( $content );?></div>
     360                            <br><div class="thfaq-cmmted-data"><?php  echo $content; ?></div>
    333361                        </div>
    334362                        <?php
    … …  
    365393            $faq_id = isset($_REQUEST['faq_id']) ? trim($_REQUEST['faq_id']) : false;
    366394            $faq_index = isset($_REQUEST['faq_index']) ? trim($_REQUEST['faq_index']) : false;
     395           
     396            // Cast IDs to integers
     397            $faq_id = absint($faq_id);
     398            $faq_index = absint($faq_index);
     399           
    367400            $post_status = get_post_status($faq_id);
    368401
    369402            $user_name = sanitize_text_field(stripslashes($user_name));
    370403            $user_msg = wp_filter_post_kses(stripslashes($user_msg));
    371             $faq_id  = sanitize_text_field($faq_id);
    372             $faq_index  = sanitize_text_field($faq_index);
    373404            $message = array();
    374405
    … …  
    532563
    533564    public function like_option($post_id,$key,$like_user_ids,$dislike_user_ids,$user_id){
     565        ob_start(); // start capturing output
    534566        $liked_user = !empty($like_user_ids) ? explode(',', $like_user_ids): array();
    535567        $dislikeliked_user = !empty($dislike_user_ids) ? explode(',', $dislike_user_ids): array();
    … …  
    542574
    543575        <span class="th-like-wrapper">     
    544             <a href="<?php echo esc_attr($user_login); ?>" onclick="likeDislikeOption(this)" data-user_id="<?php echo esc_attr($user_id); ?>" class="thfaq-thums-up" data-_wp_thfaqld_nonce="<?php echo wp_create_nonce('thfaqld_nonce');?>" data-post_id="<?php echo esc_attr($post_id);?>" data-uid="<?php echo esc_attr($key);?>" data-value="like" data-action="like_dislike_option"><i style="<?php echo esc_attr($l_color); ?>" class="thfaq-icomoon icon-thumb_up_alt"></i></a>
     576            <a href="<?php echo esc_attr($user_login); ?>" onclick="likeDislikeOption(this)" data-user_id="<?php echo esc_attr($user_id); ?>" class="thfaq-thums-up" data-_wp_thfaqld_nonce="<?php echo esc_attr(wp_create_nonce('thfaqld_nonce'));?>" data-post_id="<?php echo esc_attr($post_id);?>" data-uid="<?php echo esc_attr($key);?>" data-value="like" data-action="like_dislike_option"><i style="<?php echo esc_attr($l_color); ?>" class="thfaq-icomoon icon-thumb_up_alt"></i></a>
    545577            <span class="thfaq-like-count"><?php echo esc_html($like_count);?></span> 
    546             <a href="<?php echo esc_attr($user_login); ?>" onclick="likeDislikeOption(this)" data-user_id="<?php echo esc_attr($user_id); ?>" class="thfaq-thums-down" data-post_id="<?php echo esc_attr($post_id);?>" data-_wp_thfaqld_nonce="<?php echo wp_create_nonce('thfaqld_nonce');?>" data-uid="<?php echo esc_attr($key);?>" data-value="dislike"  data-action="like_dislike_option"><span class="th-dislike-img"><i style="<?php echo esc_attr($d_color); ?>" class="thfaq-icomoon icon-thumb_down"></i></span></a>
     578            <a href="<?php echo esc_attr($user_login); ?>" onclick="likeDislikeOption(this)" data-user_id="<?php echo esc_attr($user_id); ?>" class="thfaq-thums-down" data-post_id="<?php echo esc_attr($post_id);?>" data-_wp_thfaqld_nonce="<?php echo esc_attr(wp_create_nonce('thfaqld_nonce'));?>" data-uid="<?php echo esc_attr($key);?>" data-value="dislike"  data-action="like_dislike_option"><span class="th-dislike-img"><i style="<?php echo esc_attr($d_color); ?>" class="thfaq-icomoon icon-thumb_down"></i></span></a>
    547579            <span class="thfaq-dislike-count"><?php echo esc_html($dislike_count);?></span>
    548580        </span>
    549581        <?php
     582        return ob_get_clean(); // return the HTML safely as a string
    550583    }
    551584
    … …  
    573606            $faq_uid = isset($_REQUEST['uid']) ? trim($_REQUEST['uid']) : false;
    574607            $post_id = isset($_REQUEST['post_id']) ? trim($_REQUEST['post_id']) : false;
     608           
     609            // Sanitize and validate inputs
     610            $value = sanitize_text_field($value);
     611           
     612            // Cast numeric values with absint() before use
     613            $faq_uid = absint($faq_uid);
     614            $post_id = absint($post_id);   
    575615            $faq_data = get_post_meta($post_id, THFAQF_Utils::OPTION_KEY_FAQ_ITEMS, true);
    576             $value = sanitize_text_field($value);
    577             $faq_uid  = sanitize_text_field($faq_uid);
    578             $post_id  = sanitize_text_field($post_id);
    579616            $result = array();
    580617
    … …  
    659696        <style type="text/css">
    660697            <?php echo $enable ? esc_attr($css) : ''; ?>
    661             .thfaqf-tab h3.thfaqf-tablinks-<?=$id?>.active {
    662                 background-color: <?=$tab_bg_color?>!important;
    663                 color: <?=$tab_active_color?>!important;
     698            .thfaqf-tab h3.thfaqf-tablinks-<?php echo esc_attr($id); ?>.active {
     699                background-color: <?php echo esc_attr($tab_bg_color); ?>!important;
     700                color: <?php echo esc_attr($tab_active_color); ?>!important;
    664701            }
    665             .thfaqf-tab h3.thfaqf-tablinks-<?=$id?>:hover {
    666                 background-color: <?=$tab_bg_color?>!important;
     702            .thfaqf-tab h3.thfaqf-tablinks-<?php echo esc_attr($id); ?>:hover {
     703                background-color: <?php echo esc_attr($tab_bg_color); ?>!important;
    667704            }
    668             .thfaqf-faq-item-<?=$id?>.thfaqf-active .thfaqf-title-text{
    669                 color: <?=$title_active_color?>!important;
     705            .thfaqf-faq-item-<?php echo esc_attr($id); ?>.thfaqf-active .thfaqf-title-text{
     706                color: <?php echo esc_attr($title_active_color); ?>!important;
    670707            }
    671708         

  • advanced-faq-manager/trunk/readme.txt

    r3133378 r3403213  
    44Tags: Accordion FAQ, WordPress FAQ Plugin, FAQ Plugin, WordPress FAQ, FAQ Widget
    55Requires at least: 5.0
    6 Tested up to: 6.6
    7 Stable tag: 1.5.2
     6Tested up to: 6.8
     7Stable tag: 1.5.3
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    146146== Changelog ==
    147147
     148= 1.5.3 =
     149* Added WordPress 6.8 compatibility.
     150* Security: Fixed an XSS vulnerability reported by PatchStack.
     151
    148152= 1.5.2 =
    149153* Added WordPress 6.6 compatibility.
Note: See TracChangeset for help on using the changeset viewer.