Changeset 3412365

Timestamp:

12/05/2025 03:38:22 PM (8 days ago)

Author:

bastho

Message:

Escape outputs in taxonomy page

Location:

event-post/trunk/inc

Files:

• class-taxonomies.php (modified) (3 diffs)
• export/ics.php (modified) (1 diff)

event-post/trunk/inc/class-taxonomies.php

@@ -42 +42 @@
     foreach($fields as $field => $components){
       ?>
-      <div class="form-field event-color-section <?php echo $field ?>-wrap">
-        <?php echo $components['label']?>
-        <?php echo $components['field']?>
-        <p><?php echo $components['desc'] ?></p>
+      <div class="form-field event-color-section <?php echo esc_attr($field) ?>-wrap">
+        <?php echo wp_kses($components['label'], EventPost()->kses_tags)?>
+        <?php echo wp_kses($components['field'], EventPost()->kses_tags)?>
+        <p><?php echo esc_html($components['desc']) ?></p>
       </div>
       <?php
@@ -83 +83 @@
     foreach($fields as $field => $components){
       ?>
-      <tr class='form-field <?php echo $field ?>-wrap'>
+      <tr class='form-field <?php echo esc_attr($field) ?>-wrap'>
         <th scope='row' valign='top'>
-          <?php echo $components['label']?>
+          <?php echo wp_kses($components['label'], EventPost()->kses_tags)?>
         </th>
         <td>
-          <?php echo $components['field']?>
-          <p class='description'><?php echo $components['desc'] ?></p>
+          <?php echo wp_kses($components['field'], EventPost()->kses_tags); ?>
+          <p class='description'><?php echo esc_html($components['desc']) ?></p>
         </td>
       </tr>
@@ -114 +114 @@
       $icon = $this->get_taxonomy_icon($term_id, "location");
       $color = $this->get_taxonomy_color($term_id, "#000000");
-        echo '<span class="dashicons dashicons-'.$icon.'" style="color : #'.$color.'"></span>';
+        echo '<span class="dashicons dashicons-'.esc_attr($icon).'" style="color : #'.esc_attr($color).'"></span>';
     }
     return $content;

event-post/trunk/inc/export/ics.php

@@ -71 +71 @@
         $props[] =  'END:VCALENDAR';
 
-    echo implode($separator, $props);
+    echo wp_kses_post(implode($separator, $props));
 }