WordPress.org
Get WordPress

Plugin Directory

Changeset 3424939


Ignore:
Timestamp:
12/21/2025 09:31:13 PM (2 months ago)
Author:
vistawp
Message:

Update to version 1.4.3 from GitHub

Location:
vistawp
Files:
28 edited
1 copied

Legend:

Unmodified
Added
Removed

  • vistawp/tags/1.4.3/includes/api/get-params.php

    r2949654 r3424939  
    3838  public final function get_params(): array {
    3939    $params = array();
     40   
     41    if (!is_array($_GET)) {
     42      return $params;
     43    }
     44
     45    if (!isset($this->mappings) || !is_array($this->mappings)) {
     46      return $params;
     47    }
     48   
    4049    // Loop through mappings, retrieve each mapped field
    4150    foreach ($this->mappings as $getName => $paramName) {
     51      if (!is_string($getName) || !is_string($paramName)) {
     52        continue;
     53      }
    4254
    43       // Make sure mapped field has content
    44       if (empty($_GET[$getName]))
     55      if (!isset($_GET[$getName]) || empty($_GET[$getName])) {
    4556        continue;
     57      }
    4658
     59      $raw_value = $_GET[$getName];
     60     
    4761      // Maybe split to array
    48       if (is_string($_GET[$getName])) {
    49         // Sanitize input
    50         $field = \sanitize_text_field($_GET[$getName]);
     62      if (is_string($raw_value)) {
     63        $field = sanitize_text_field(wp_unslash($raw_value));
     64
     65        if (empty($field)) {
     66          continue;
     67        }
    5168       
    5269        // Split parameter if necessary
    5370        $param = preg_split("/(%2C\+)|(, )|\+/", $field);
    54         if ($param === false)
     71
     72        if ($param === false || empty($param)) {
    5573          $param = $field;
     74        } else {
     75          $param = array_map('sanitize_text_field', $param);
     76          $param = array_filter($param, function($value) {
     77            return !empty($value);
     78          });
     79
     80          if (empty($param)) {
     81            $param = $field;
     82          }
     83        }
     84      } else if (is_array($raw_value)) {
     85        $param = $this->sanitize_array_deep($raw_value);
     86
     87        if (empty($param)) {
     88          continue;
     89        }
    5690      } else {
    57         $param = $_GET[$getName];
     91        continue;
    5892      }
    5993     
    … …  
    69103        // We need to add the new values to the array
    70104        } else if (is_array($params[$paramName])) {
    71           foreach ($param as $value)
    72             $params[$paramName][] = $value;
     105          foreach ($param as $value) {
     106            // VALIDACIÓN: Solo añadir valores no vacíos
     107            if (!empty($value)) {
     108              $params[$paramName][] = $value;
     109            }
     110          }
    73111        }
    74112      } else if (is_string($param)) {
    75113        // We need to combine the old string and the new into an array
    76         if (!isset($params[$paramName]))
     114        if (!isset($params[$paramName])) {
    77115          // No previous value, simply set the param
    78116          $params[$paramName] = $param;
    79         else if (is_string($params[$paramName]))
     117        } else if (is_string($params[$paramName])) {
    80118          $params[$paramName] = array($params[$paramName], $param);
    81119        // We need to add the new value to the old array
    82         else if (is_array($params[$paramName]))
     120        } else if (is_array($params[$paramName])) {
    83121          $params[$paramName][] = $param;
     122        }
    84123      }
    85124    }
    … …  
    88127  }
    89128
     129  /**
     130   * Sanitiza un array de forma recursiva
     131   *
     132   * @param array $array Array a sanitizar
     133   * @return array Array sanitizado
     134   */
     135  private function sanitize_array_deep(array $array): array {
     136    $sanitized = array();
     137   
     138    foreach ($array as $key => $value) {
     139      $safe_key = sanitize_key($key);
     140     
     141      if (is_array($value)) {
     142        $sanitized[$safe_key] = $this->sanitize_array_deep($value);
     143      } else if (is_string($value)) {
     144        $sanitized[$safe_key] = sanitize_text_field(wp_unslash($value));
     145      } else if (is_numeric($value)) {
     146        $sanitized[$safe_key] = $value;
     147      }
     148    }
     149   
     150    return $sanitized;
     151  }
     152
    90153}

  • vistawp/tags/1.4.3/includes/functions.php

    r2990365 r3424939  
    102102        $dest = wp_validate_redirect($dest, $fallback_url);
    103103      // Uses JS instead of modifying headers
    104       echo("<script>location.href = '{$dest}'</script>");
    105     } else { // Headers haven't been sent, can redirect
     104      echo '<script>location.href = "' . esc_url($dest) . '"</script>';
     105    } else {
     106      // Headers haven't been sent, can redirect
    106107      wp_safe_redirect($dest, $status);
    107108    }

  • vistawp/tags/1.4.3/includes/multiple-display.php

    r2924340 r3424939  
    121121  public static final function url_querystring($atts, string $content): string {
    122122    // Ensure we have a page shortcode attribute
    123     if (!isset($atts['page']))
     123    if (!isset($atts['page']) || empty($atts['page'])) {
    124124      return self::NO_PAGE_PARAM;
    125    
     125    }
     126   
     127    // Sanitize the page URL
     128    $page_url = esc_url_raw($atts['page']);
     129   
     130    // Verify it's a valid URL after sanitization
     131    if (empty($page_url)) {
     132      return self::NO_PAGE_PARAM;
     133    }
     134   
     135    // Get and sanitize query string
     136    $query_string = '';
     137    if (isset($_SERVER['QUERY_STRING']) && !empty($_SERVER['QUERY_STRING'])) {
     138      // Sanitize the query string properly
     139      $query_string = sanitize_text_field(wp_unslash($_SERVER['QUERY_STRING']));
     140     
    126141      // Only allow [A-Za-z0-9 ,&=?%+] chars in validated string
    127     $validated = preg_replace("/[^A-Za-z0-9 ,&=?%+]/", '', $_SERVER['QUERY_STRING']);
    128    
    129     // Construct returned <a> element
    130     $query = $validated ? "?" . $validated : "";
    131     return "<a href='{$atts['page']}$query'>$content</a>";
     142      $query_string = preg_replace('/[^A-Za-z0-9_\-=&?%+]/', '', $query_string);
     143    }
     144   
     145    // Construct query parameter if exists
     146    $query = !empty($query_string) ? '?' . $query_string : '';
     147    $final_url = esc_url($page_url . $query);
     148   
     149    // Escape the content for safe HTML output
     150    $safe_content = wp_kses_post($content);
     151   
     152    // Return safely escaped HTML
     153    return sprintf(
     154      '<a href="%s">%s</a>',
     155      $final_url,
     156      $safe_content
     157    );
    132158  }
    133159
    … …  
    148174   */
    149175  public function pagination_button($atts, string $content): string {
    150     // Validate attributes
    151     if (!is_array($atts) || !($atts['type'] == 'forward' || $atts['type'] == 'backward'))
     176    if (!is_array($atts) || !isset($atts['type'])) {
    152177      return self::NO_TYPE_PARAM;
    153 
    154     // Make sure api is called
    155     $err = $this->ensure_api();
    156     if ($err)
    157       return $err;
    158 
    159     // Initialize parameters
    160     $disabled = ''; // Whether the button is disabled because we have no more listings in this direction
    161     $link = \get_page_link();
    162     $listing_count = (int) $this->api_headers['X-Total-Count'][0];
    163     $offset = intval($_GET['offset'] ?? 0); // Default offset is 0 as this is the start of the list
    164     $limit = intval($_GET['limit'] ?? self::DEFAULT_LIMIT); // No sanitization here or prev line as only intval is used
    165     $class = 'vista-listings-paginator ';
    166 
    167     // Assign button params based on type
    168     if ($atts['type'] == 'forward') {
    169       $class .= "listings-forward";
    170       $remainder = $listing_count - ($offset + $limit);
    171       if ($remainder <= 0)
    172         $disabled = 'disabled'; // Disable if we can't go further
    173       $link .= "?offset=" . strval($limit + $offset);
    174       if ($remainder < $limit) {
    175         $link .= "&limit=$remainder";
    176       } else {
    177         $link .= "&limit=$limit";
     178    }
     179   
     180    $type = sanitize_key($atts['type']);
     181    if ($type !== 'forward' && $type !== 'backward') {
     182      return self::NO_TYPE_PARAM;
     183    }
     184
     185    $query_args = array();
     186   
     187    if (is_array($_GET)) {
     188      foreach ($_GET as $param => $value) {
     189        $safe_param = sanitize_key($param);
     190       
     191        if ($safe_param === 'offset' || $safe_param === 'limit') {
     192          continue;
     193        }
     194
     195        if (is_array($value)) {
     196          $query_args[$safe_param] = array_map(
     197            'sanitize_text_field',
     198            array_map('wp_unslash', $value)
     199          );
     200        } else {
     201          $query_args[$safe_param] = sanitize_text_field(wp_unslash($value));
     202        }
    178203      }
    179     } else {
    180       $class .= "listings-backward";
    181       if ($offset == 0)
    182         $disabled = 'disabled'; // Disable if we can't go further
    183       $link .= "?offset=" . ($offset - $limit <= 0 ? 0 : $offset - $limit);
    184       // Only the last page can have <self::DEFAULT_LIMIT results,
    185       // so previous pages always have self::DEFAULT_LIMIT results
    186       $link .= "&limit=" . self::DEFAULT_LIMIT;
    187     }
    188     // Add other parameters
    189     foreach ($_GET as $param => $value) {
    190       // Sanitize variables
    191       $param = \sanitize_text_field($param);
    192       $value = \sanitize_text_field($value);
    193       if ($param == 'offset' || $param == 'limit') continue; // We've already recaclulated & included offset & limit
    194       $link .= "&$param=$value";
    195     }
    196 
    197     return "<button class='$class' onclick=\"window.location.href='$link'\" $disabled>$content</button>";
     204    }
     205   
     206    $query_args['offset'] = $new_offset;
     207    $query_args['limit'] = $new_limit;
     208   
     209    $safe_link = add_query_arg($query_args, $base_link);
     210
     211    return sprintf(
     212      '<button class="%s" onclick="window.location.href=\'%s\'" %s>%s</button>',
     213      esc_attr($class),
     214      esc_url($safe_link),
     215      $safe_disabled,
     216      wp_kses_post($content)
     217    );
    198218  }
    199219

  • vistawp/tags/1.4.3/includes/options/license-manager.php

    r2990365 r3424939  
    153153      $this->clear_key();
    154154      // Redirect to the same page after clearing the license key
    155       \vista_safe_redirect(\esc_url($_SERVER['REQUEST_URI']));
     155      \vista_safe_redirect(add_query_arg(array()));
    156156      exit;
    157157    }
    … …  
    196196    if ($tier && !array_key_exists($tier, self::TIER_ID)) {
    197197      throw new \InvalidArgumentException(
    198         "Invalid tier: " . $tier
     198        "Invalid tier: " . esc_html($tier)
    199199      );
    200200    }

  • vistawp/tags/1.4.3/readme.txt

    r3380981 r3424939  
    44Tags: IDX, MLS, idx search, Real Estate Search, IDX plugin, RETS, real-estate 
    55Requires at least: 4.7 
    6 Tested up to: 6.8.3 
    7 Stable tag: 1.4.2
     6Tested up to: 6.8 
     7Stable tag: 1.4.3
    88Requires PHP: 7.4.1 
    99License: GPLv2 or later 

  • vistawp/tags/1.4.3/templates/fields/checkbox.php

    r3106883 r3424939  
    11<?php
     2
     3if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     4
    25/**
    36 * Template for a form row containing a group of checkboxes rendered by vista_get_template().
    … …  
    1518    <div class="vista-field-checkbox">
    1619      <div class="vista-label">
    17         <label for="<?= esc_attr($name); ?>"><?= esc_html($title); ?></label>
     20        <label for="<?php echo esc_attr($name); ?>"><?php echo esc_html($title); ?></label>
    1821      </div>
    1922      <div class="vista-input">
    2023        <?php foreach ($options as $key => $value) : ?>
    21           <label for="<?= esc_attr($prefix . $value); ?>">
    22             <input type="checkbox" id="<?= esc_attr($prefix . $value); ?>" name="<?= esc_attr($name); ?>[]" value="<?= esc_attr($value); ?>" <?= (in_array($value, $checked_options)) ? 'checked' : ''; ?> >
    23             <?= esc_html($key); ?>
     24          <label for="<?php echo esc_attr($prefix . $value); ?>">
     25            <input type="checkbox" id="<?php echo esc_attr($prefix . $value); ?>" name="<?php echo esc_attr($name); ?>[]" value="<?php echo esc_attr($value); ?>" <?php echo (in_array($value, $checked_options)) ? 'checked' : ''; ?> >
     26            <?php echo esc_html($key); ?>
    2427          </label>
    2528        <?php endforeach; ?>

  • vistawp/tags/1.4.3/templates/fields/number-field.php

    r3106883 r3424939  
    1 <?php
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row containing a number input field rendered by vista_get_template().
    … …  
    1618    <div class="vista-field-number">
    1719      <div class="vista-label">
    18         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     20        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    1921      </div>
    2022      <div class="vista-input">
    21         <input type="number" step="1000" min="0" id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>" value="<?= esc_attr($value); ?>" placeholder="<?= esc_attr($placeholder); ?>">
     23        <input type="number" step="1000" min="0" id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>" value="<?php echo esc_attr($value); ?>" placeholder="<?php echo esc_attr($placeholder); ?>">
    2224      </div>
    2325    </div>

  • vistawp/tags/1.4.3/templates/fields/select.php

    r3106883 r3424939  
    1 <?php
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row containing a select input field rendered by vista_get_template().
    … …  
    1820    <div class="vista-field-select">
    1921      <div class="vista-label">
    20         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     22        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    2123      </div>
    2224      <div class="vista-input">
    23         <select id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>">
     25        <select id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>">
    2426          <?php foreach ($options as $value) : ?>
    25             <option value="<?= esc_attr($value); ?>" <?= '' === $value ? 'disabled' : ''; ?> <?= ($value === $selected) ? 'selected' : ''; ?>>
    26                 <?= '' === $value ? esc_html($placeholder) : esc_html($value); ?>
     27            <option value="<?php echo esc_attr($value); ?>" <?php echo '' === $value ? 'disabled' : ''; ?> <?php echo ($value === $selected) ? 'selected' : ''; ?>>
     28                <?php echo '' === $value ? esc_html($placeholder) : esc_html($value); ?>
    2729            </option>
    2830          <?php endforeach; ?>

  • vistawp/tags/1.4.3/templates/fields/text-field.php

    r3106883 r3424939  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row with a text input field rendered by vista_get_template().
    … …  
    1618    <div class="vista-field-text">
    1719      <div class="vista-label">
    18         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     20        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    1921      </div>
    2022      <div class="vista-input">
    21         <input type="text" id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>" value="<?= esc_attr($value); ?>" placeholder="<?= esc_attr($placeholder); ?>">
     23        <input type="text" id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>" value="<?php echo esc_attr($value); ?>" placeholder="<?php echo esc_attr($placeholder); ?>">
    2224      </div>
    2325    </div>

  • vistawp/tags/1.4.3/templates/notifications/general.php

    r3106883 r3424939  
    1 <div class="notice is-dismissible notice-<?= esc_attr($type); ?>">
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
     4?>
     5
     6<div class="notice is-dismissible notice-<?php echo  esc_attr($type); ?>">
    27  <div id="vistawp-banner">
    3     <img height="50" src="<?= esc_url(\vista_plugin_url('img/vista_banner_icon.svg')); ?>">
    4     <p class="vsta-text-<?= esc_attr($type); ?>"> <?= esc_html($text) ?> </p>
     8    <img height="50" src="<?php echo esc_url(\vista_plugin_url('img/vista_banner_icon.svg')); ?>">
     9    <p class="vsta-text-<?php echo  esc_attr($type); ?>"> <?php echo esc_html($text) ?> </p>
    510  </div>
    611</div>

  • vistawp/tags/1.4.3/templates/notifications/welcome.php

    r3171043 r3424939  
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
     4?>
     5
    16<div id="vistawp-welcome" class="notice is-dismissible">
    27  <div>
    3     <img width="100" src="<?= esc_html(\vista_plugin_url('img/vista_logo.png')); ?>">
     8    <img width="100" src="<?php echo esc_html(\vista_plugin_url('img/vista_logo.png')); ?>">
    49  </div>
    510  <div>
    611    <h3>Thanks for activating VistaWP</h3>
    7     <p>Head to the <a href="<?= \get_home_url() . '/wp-admin/admin.php?page=vista_main'; ?>">settings page</a> to get started</p>
     12    <p>Head to the <a href="<?php echo \get_home_url() . '/wp-admin/admin.php?page=vista_main'; ?>">settings page</a> to get started</p>
    813  </div>
    914</div>

  • vistawp/tags/1.4.3/templates/pages/main_page.php

    r3006497 r3424939  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for the main page of the VistaWP plugin, returned by vista_get_template().
    … …  
    3739  </p><br />
    3840
    39   <form method="post" action="<?php echo esc_url($_SERVER['REQUEST_URI']); ?>">
     41  <form method="post" action="<?php echo esc_url(add_query_arg(array())); ?>">
    4042    <input type="submit" name="generate_pages" value="Generate Vista Pages" class="button-primary vsta-gen-btn">
    4143  </form>

  • vistawp/tags/1.4.3/templates/shortcodes/simple-listings.php

    r3171043 r3424939  
    11<?php
     2 
     3if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     4
    25/**
    36 * Template for the shotcode simple listings, returned by vista_get_template().
    … …  
    1518<div class="vista-sl-pagination">
    1619  <div class="vista-sl-results">
    17     <label class="vista-sl-<?=$theme?>-results-label">[vista_listings_total] results</label>
     20    <label class="vista-sl-<?php echo esc_attr($theme); ?>-results-label">[vista_listings_total] results</label>
    1821  </div>
    19   <div class="vista-sl-<?=$theme?>-prev">
     22  <div class="vista-sl-<?php echo esc_attr($theme); ?>-prev">
    2023    [vista_listings_paginator type=backward]Prev[/vista_listings_paginator]
    2124  </div>
    22   <div class="vista-sl-<?=$theme?>-next">
     25  <div class="vista-sl-<?php echo esc_attr($theme); ?>-next">
    2326    [vista_listings_paginator type=forward]Next[/vista_listings_paginator]
    2427  </div>
    … …  
    2831<div class="vista-sl-container">
    2932  [vista_listings_list]
    30   <div class="vista-sl-card vista-sl-<?=$theme?>-card">
     33  <div class="vista-sl-card vista-sl-<?php echo esc_attr($theme); ?>-card">
    3134    <div class="vista-sl-photo">
    32       <a href="<?=$dest . '?listing='?>[mlsId]" class="vista-sl-photo-link">
     35      <a href="<?php echo esc_url($dest . '?listing='); ?>[mlsId]" class="vista-sl-photo-link">
    3336        [first-photo]
    3437      </a>
    3538    </div>
    3639   
    37     <div class="vista-sl-<?=$theme?>-address">
    38       <a href="<?=$dest . '?listing='?>[mlsId]" class="vista-sl-address-link">
     40    <div class="vista-sl-<?php echo esc_attr($theme); ?>-address">
     41      <a href="<?php echo esc_url($dest . '?listing='); ?>[mlsId]" class="vista-sl-address-link">
    3942        <h2>[address]</h2>
    4043      </a>
    4144    </div>
    4245
    43     <div class="vista-sl-<?=$theme?>-price">
     46    <div class="vista-sl-<?php echo esc_attr($theme); ?>-price">
    4447      <p>$[listPrice]</p>
    4548    </div>
    4649
    4750    <div class="vista-sl-info">
    48       <div class="vista-sl-<?=$theme?>-beds">
     51      <div class="vista-sl-<?php echo esc_attr($theme); ?>-beds">
    4952        <p>[bedrooms]</p><p>Beds</p>
    5053      </div>
    51       <div class="vista-sl-<?=$theme?>-baths">
     54      <div class="vista-sl-<?php echo esc_attr($theme); ?>-baths">
    5255        <p>[baths]</p><p>Baths</p>
    5356      </div>
    54       <div class="vista-sl-<?=$theme?>-sqft">
     57      <div class="vista-sl-<?php echo esc_attr($theme); ?>-sqft">
    5558        <p>[sqft]</p><p>Sq. Ft.</p>
    5659      </div>
    … …  
    5861
    5962    <div class="vista-sl-agent-info">
    60       <div class="vista-sl-<?=$theme?>-listingid">
     63      <div class="vista-sl-<?php echo esc_attr($theme); ?>-listingid">
    6164        <p>ID: #[listingId]</p>
    6265      </div>
    63       <div class="vista-sl-<?=$theme?>-status">
     66      <div class="vista-sl-<?php echo esc_attr($theme); ?>-status">
    6467        <p>Status: [status]</p>
    6568      </div>
    6669    </div>
    6770
    68     <div class="vista-sl-<?=$theme?>-btn">
    69       <a href="<?= \get_home_url() . $dest . '?listing='?>[mlsId]" class="vista-sl-<?=$theme?>-link">View Property</a>
     71    <div class="vista-sl-<?php echo esc_attr($theme); ?>-btn">
     72      <a href="<?php echo esc_url(\get_home_url() . $dest . '?listing='); ?>[mlsId]" class="vista-sl-<?php echo esc_attr($theme); ?>-link">View Property</a>
    7073    </div>
    7174
    … …  
    7982<div class="vista-sl-pagination">
    8083  <div class="vista-sl-results">
    81     <label class="vista-sl-<?=$theme?>-results-label">[vista_listings_total] results</label>
     84    <label class="vista-sl-<?php echo esc_attr($theme); ?>-results-label">[vista_listings_total] results</label>
    8285  </div>
    83   <div class="vista-sl-<?=$theme?>-prev">
     86  <div class="vista-sl-<?php echo esc_attr($theme); ?>-prev">
    8487    [vista_listings_paginator type=backward]Prev[/vista_listings_paginator]
    8588  </div>
    86   <div class="vista-sl-<?=$theme?>-next">
     89  <div class="vista-sl-<?php echo esc_attr($theme); ?>-next">
    8790    [vista_listings_paginator type=forward]Next[/vista_listings_paginator]
    8891  </div>

  • vistawp/tags/1.4.3/vista.php

    r3380981 r3424939  
    33* Plugin Name: VistaWP
    44* Description: Retrieves and displays real estate listings
    5 * Version: 1.4.2
     5* Version: 1.4.3
    66* Author: VistaWP
    77* Author URI: https://vistawp.com/
    … …  
    1515
    1616// general constants
    17 define( 'VISTA__PLUGIN_VERSION', '1.4.2' );
     17define( 'VISTA__PLUGIN_VERSION', '1.4.3' );
    1818define( 'VISTA__PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
    1919define( 'VISTA__PLUGIN_URL', plugin_dir_url( __FILE__ ) );
    … …  
    2828* @author VistaWP
    2929* @link https://vistawp.com/
    30 * @version 1.4.2
     30* @version 1.4.3
    3131*/
    3232class Main {
    … …  
    388388    <p>
    389389      The VistaWP plugin has encountered a fatal error and self-deactivated.
    390       Error message: <?php echo $GLOBALS['vista_error_message']; ?>
     390      Error message: <?php echo esc_html($GLOBALS['vista_error_message']); ?>
    391391    </p>
    392392 </div>

  • vistawp/trunk/includes/api/get-params.php

    r2949654 r3424939  
    3838  public final function get_params(): array {
    3939    $params = array();
     40   
     41    if (!is_array($_GET)) {
     42      return $params;
     43    }
     44
     45    if (!isset($this->mappings) || !is_array($this->mappings)) {
     46      return $params;
     47    }
     48   
    4049    // Loop through mappings, retrieve each mapped field
    4150    foreach ($this->mappings as $getName => $paramName) {
     51      if (!is_string($getName) || !is_string($paramName)) {
     52        continue;
     53      }
    4254
    43       // Make sure mapped field has content
    44       if (empty($_GET[$getName]))
     55      if (!isset($_GET[$getName]) || empty($_GET[$getName])) {
    4556        continue;
     57      }
    4658
     59      $raw_value = $_GET[$getName];
     60     
    4761      // Maybe split to array
    48       if (is_string($_GET[$getName])) {
    49         // Sanitize input
    50         $field = \sanitize_text_field($_GET[$getName]);
     62      if (is_string($raw_value)) {
     63        $field = sanitize_text_field(wp_unslash($raw_value));
     64
     65        if (empty($field)) {
     66          continue;
     67        }
    5168       
    5269        // Split parameter if necessary
    5370        $param = preg_split("/(%2C\+)|(, )|\+/", $field);
    54         if ($param === false)
     71
     72        if ($param === false || empty($param)) {
    5573          $param = $field;
     74        } else {
     75          $param = array_map('sanitize_text_field', $param);
     76          $param = array_filter($param, function($value) {
     77            return !empty($value);
     78          });
     79
     80          if (empty($param)) {
     81            $param = $field;
     82          }
     83        }
     84      } else if (is_array($raw_value)) {
     85        $param = $this->sanitize_array_deep($raw_value);
     86
     87        if (empty($param)) {
     88          continue;
     89        }
    5690      } else {
    57         $param = $_GET[$getName];
     91        continue;
    5892      }
    5993     
    … …  
    69103        // We need to add the new values to the array
    70104        } else if (is_array($params[$paramName])) {
    71           foreach ($param as $value)
    72             $params[$paramName][] = $value;
     105          foreach ($param as $value) {
     106            // VALIDACIÓN: Solo añadir valores no vacíos
     107            if (!empty($value)) {
     108              $params[$paramName][] = $value;
     109            }
     110          }
    73111        }
    74112      } else if (is_string($param)) {
    75113        // We need to combine the old string and the new into an array
    76         if (!isset($params[$paramName]))
     114        if (!isset($params[$paramName])) {
    77115          // No previous value, simply set the param
    78116          $params[$paramName] = $param;
    79         else if (is_string($params[$paramName]))
     117        } else if (is_string($params[$paramName])) {
    80118          $params[$paramName] = array($params[$paramName], $param);
    81119        // We need to add the new value to the old array
    82         else if (is_array($params[$paramName]))
     120        } else if (is_array($params[$paramName])) {
    83121          $params[$paramName][] = $param;
     122        }
    84123      }
    85124    }
    … …  
    88127  }
    89128
     129  /**
     130   * Sanitiza un array de forma recursiva
     131   *
     132   * @param array $array Array a sanitizar
     133   * @return array Array sanitizado
     134   */
     135  private function sanitize_array_deep(array $array): array {
     136    $sanitized = array();
     137   
     138    foreach ($array as $key => $value) {
     139      $safe_key = sanitize_key($key);
     140     
     141      if (is_array($value)) {
     142        $sanitized[$safe_key] = $this->sanitize_array_deep($value);
     143      } else if (is_string($value)) {
     144        $sanitized[$safe_key] = sanitize_text_field(wp_unslash($value));
     145      } else if (is_numeric($value)) {
     146        $sanitized[$safe_key] = $value;
     147      }
     148    }
     149   
     150    return $sanitized;
     151  }
     152
    90153}

  • vistawp/trunk/includes/functions.php

    r2990365 r3424939  
    102102        $dest = wp_validate_redirect($dest, $fallback_url);
    103103      // Uses JS instead of modifying headers
    104       echo("<script>location.href = '{$dest}'</script>");
    105     } else { // Headers haven't been sent, can redirect
     104      echo '<script>location.href = "' . esc_url($dest) . '"</script>';
     105    } else {
     106      // Headers haven't been sent, can redirect
    106107      wp_safe_redirect($dest, $status);
    107108    }

  • vistawp/trunk/includes/multiple-display.php

    r2924340 r3424939  
    121121  public static final function url_querystring($atts, string $content): string {
    122122    // Ensure we have a page shortcode attribute
    123     if (!isset($atts['page']))
     123    if (!isset($atts['page']) || empty($atts['page'])) {
    124124      return self::NO_PAGE_PARAM;
    125    
     125    }
     126   
     127    // Sanitize the page URL
     128    $page_url = esc_url_raw($atts['page']);
     129   
     130    // Verify it's a valid URL after sanitization
     131    if (empty($page_url)) {
     132      return self::NO_PAGE_PARAM;
     133    }
     134   
     135    // Get and sanitize query string
     136    $query_string = '';
     137    if (isset($_SERVER['QUERY_STRING']) && !empty($_SERVER['QUERY_STRING'])) {
     138      // Sanitize the query string properly
     139      $query_string = sanitize_text_field(wp_unslash($_SERVER['QUERY_STRING']));
     140     
    126141      // Only allow [A-Za-z0-9 ,&=?%+] chars in validated string
    127     $validated = preg_replace("/[^A-Za-z0-9 ,&=?%+]/", '', $_SERVER['QUERY_STRING']);
    128    
    129     // Construct returned <a> element
    130     $query = $validated ? "?" . $validated : "";
    131     return "<a href='{$atts['page']}$query'>$content</a>";
     142      $query_string = preg_replace('/[^A-Za-z0-9_\-=&?%+]/', '', $query_string);
     143    }
     144   
     145    // Construct query parameter if exists
     146    $query = !empty($query_string) ? '?' . $query_string : '';
     147    $final_url = esc_url($page_url . $query);
     148   
     149    // Escape the content for safe HTML output
     150    $safe_content = wp_kses_post($content);
     151   
     152    // Return safely escaped HTML
     153    return sprintf(
     154      '<a href="%s">%s</a>',
     155      $final_url,
     156      $safe_content
     157    );
    132158  }
    133159
    … …  
    148174   */
    149175  public function pagination_button($atts, string $content): string {
    150     // Validate attributes
    151     if (!is_array($atts) || !($atts['type'] == 'forward' || $atts['type'] == 'backward'))
     176    if (!is_array($atts) || !isset($atts['type'])) {
    152177      return self::NO_TYPE_PARAM;
    153 
    154     // Make sure api is called
    155     $err = $this->ensure_api();
    156     if ($err)
    157       return $err;
    158 
    159     // Initialize parameters
    160     $disabled = ''; // Whether the button is disabled because we have no more listings in this direction
    161     $link = \get_page_link();
    162     $listing_count = (int) $this->api_headers['X-Total-Count'][0];
    163     $offset = intval($_GET['offset'] ?? 0); // Default offset is 0 as this is the start of the list
    164     $limit = intval($_GET['limit'] ?? self::DEFAULT_LIMIT); // No sanitization here or prev line as only intval is used
    165     $class = 'vista-listings-paginator ';
    166 
    167     // Assign button params based on type
    168     if ($atts['type'] == 'forward') {
    169       $class .= "listings-forward";
    170       $remainder = $listing_count - ($offset + $limit);
    171       if ($remainder <= 0)
    172         $disabled = 'disabled'; // Disable if we can't go further
    173       $link .= "?offset=" . strval($limit + $offset);
    174       if ($remainder < $limit) {
    175         $link .= "&limit=$remainder";
    176       } else {
    177         $link .= "&limit=$limit";
     178    }
     179   
     180    $type = sanitize_key($atts['type']);
     181    if ($type !== 'forward' && $type !== 'backward') {
     182      return self::NO_TYPE_PARAM;
     183    }
     184
     185    $query_args = array();
     186   
     187    if (is_array($_GET)) {
     188      foreach ($_GET as $param => $value) {
     189        $safe_param = sanitize_key($param);
     190       
     191        if ($safe_param === 'offset' || $safe_param === 'limit') {
     192          continue;
     193        }
     194
     195        if (is_array($value)) {
     196          $query_args[$safe_param] = array_map(
     197            'sanitize_text_field',
     198            array_map('wp_unslash', $value)
     199          );
     200        } else {
     201          $query_args[$safe_param] = sanitize_text_field(wp_unslash($value));
     202        }
    178203      }
    179     } else {
    180       $class .= "listings-backward";
    181       if ($offset == 0)
    182         $disabled = 'disabled'; // Disable if we can't go further
    183       $link .= "?offset=" . ($offset - $limit <= 0 ? 0 : $offset - $limit);
    184       // Only the last page can have <self::DEFAULT_LIMIT results,
    185       // so previous pages always have self::DEFAULT_LIMIT results
    186       $link .= "&limit=" . self::DEFAULT_LIMIT;
    187     }
    188     // Add other parameters
    189     foreach ($_GET as $param => $value) {
    190       // Sanitize variables
    191       $param = \sanitize_text_field($param);
    192       $value = \sanitize_text_field($value);
    193       if ($param == 'offset' || $param == 'limit') continue; // We've already recaclulated & included offset & limit
    194       $link .= "&$param=$value";
    195     }
    196 
    197     return "<button class='$class' onclick=\"window.location.href='$link'\" $disabled>$content</button>";
     204    }
     205   
     206    $query_args['offset'] = $new_offset;
     207    $query_args['limit'] = $new_limit;
     208   
     209    $safe_link = add_query_arg($query_args, $base_link);
     210
     211    return sprintf(
     212      '<button class="%s" onclick="window.location.href=\'%s\'" %s>%s</button>',
     213      esc_attr($class),
     214      esc_url($safe_link),
     215      $safe_disabled,
     216      wp_kses_post($content)
     217    );
    198218  }
    199219

  • vistawp/trunk/includes/options/license-manager.php

    r2990365 r3424939  
    153153      $this->clear_key();
    154154      // Redirect to the same page after clearing the license key
    155       \vista_safe_redirect(\esc_url($_SERVER['REQUEST_URI']));
     155      \vista_safe_redirect(add_query_arg(array()));
    156156      exit;
    157157    }
    … …  
    196196    if ($tier && !array_key_exists($tier, self::TIER_ID)) {
    197197      throw new \InvalidArgumentException(
    198         "Invalid tier: " . $tier
     198        "Invalid tier: " . esc_html($tier)
    199199      );
    200200    }

  • vistawp/trunk/readme.txt

    r3380981 r3424939  
    44Tags: IDX, MLS, idx search, Real Estate Search, IDX plugin, RETS, real-estate 
    55Requires at least: 4.7 
    6 Tested up to: 6.8.3 
    7 Stable tag: 1.4.2
     6Tested up to: 6.8 
     7Stable tag: 1.4.3
    88Requires PHP: 7.4.1 
    99License: GPLv2 or later 

  • vistawp/trunk/templates/fields/checkbox.php

    r3106883 r3424939  
    11<?php
     2
     3if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     4
    25/**
    36 * Template for a form row containing a group of checkboxes rendered by vista_get_template().
    … …  
    1518    <div class="vista-field-checkbox">
    1619      <div class="vista-label">
    17         <label for="<?= esc_attr($name); ?>"><?= esc_html($title); ?></label>
     20        <label for="<?php echo esc_attr($name); ?>"><?php echo esc_html($title); ?></label>
    1821      </div>
    1922      <div class="vista-input">
    2023        <?php foreach ($options as $key => $value) : ?>
    21           <label for="<?= esc_attr($prefix . $value); ?>">
    22             <input type="checkbox" id="<?= esc_attr($prefix . $value); ?>" name="<?= esc_attr($name); ?>[]" value="<?= esc_attr($value); ?>" <?= (in_array($value, $checked_options)) ? 'checked' : ''; ?> >
    23             <?= esc_html($key); ?>
     24          <label for="<?php echo esc_attr($prefix . $value); ?>">
     25            <input type="checkbox" id="<?php echo esc_attr($prefix . $value); ?>" name="<?php echo esc_attr($name); ?>[]" value="<?php echo esc_attr($value); ?>" <?php echo (in_array($value, $checked_options)) ? 'checked' : ''; ?> >
     26            <?php echo esc_html($key); ?>
    2427          </label>
    2528        <?php endforeach; ?>

  • vistawp/trunk/templates/fields/number-field.php

    r3106883 r3424939  
    1 <?php
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row containing a number input field rendered by vista_get_template().
    … …  
    1618    <div class="vista-field-number">
    1719      <div class="vista-label">
    18         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     20        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    1921      </div>
    2022      <div class="vista-input">
    21         <input type="number" step="1000" min="0" id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>" value="<?= esc_attr($value); ?>" placeholder="<?= esc_attr($placeholder); ?>">
     23        <input type="number" step="1000" min="0" id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>" value="<?php echo esc_attr($value); ?>" placeholder="<?php echo esc_attr($placeholder); ?>">
    2224      </div>
    2325    </div>

  • vistawp/trunk/templates/fields/select.php

    r3106883 r3424939  
    1 <?php
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row containing a select input field rendered by vista_get_template().
    … …  
    1820    <div class="vista-field-select">
    1921      <div class="vista-label">
    20         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     22        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    2123      </div>
    2224      <div class="vista-input">
    23         <select id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>">
     25        <select id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>">
    2426          <?php foreach ($options as $value) : ?>
    25             <option value="<?= esc_attr($value); ?>" <?= '' === $value ? 'disabled' : ''; ?> <?= ($value === $selected) ? 'selected' : ''; ?>>
    26                 <?= '' === $value ? esc_html($placeholder) : esc_html($value); ?>
     27            <option value="<?php echo esc_attr($value); ?>" <?php echo '' === $value ? 'disabled' : ''; ?> <?php echo ($value === $selected) ? 'selected' : ''; ?>>
     28                <?php echo '' === $value ? esc_html($placeholder) : esc_html($value); ?>
    2729            </option>
    2830          <?php endforeach; ?>

  • vistawp/trunk/templates/fields/text-field.php

    r3106883 r3424939  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for a form row with a text input field rendered by vista_get_template().
    … …  
    1618    <div class="vista-field-text">
    1719      <div class="vista-label">
    18         <label for="<?= esc_attr($id); ?>"><?= esc_html($label); ?></label>
     20        <label for="<?php echo esc_attr($id); ?>"><?php echo esc_html($label); ?></label>
    1921      </div>
    2022      <div class="vista-input">
    21         <input type="text" id="<?= esc_attr($id); ?>" name="<?= esc_attr($name); ?>" value="<?= esc_attr($value); ?>" placeholder="<?= esc_attr($placeholder); ?>">
     23        <input type="text" id="<?php echo esc_attr($id); ?>" name="<?php echo esc_attr($name); ?>" value="<?php echo esc_attr($value); ?>" placeholder="<?php echo esc_attr($placeholder); ?>">
    2224      </div>
    2325    </div>

  • vistawp/trunk/templates/notifications/general.php

    r3106883 r3424939  
    1 <div class="notice is-dismissible notice-<?= esc_attr($type); ?>">
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
     4?>
     5
     6<div class="notice is-dismissible notice-<?php echo  esc_attr($type); ?>">
    27  <div id="vistawp-banner">
    3     <img height="50" src="<?= esc_url(\vista_plugin_url('img/vista_banner_icon.svg')); ?>">
    4     <p class="vsta-text-<?= esc_attr($type); ?>"> <?= esc_html($text) ?> </p>
     8    <img height="50" src="<?php echo esc_url(\vista_plugin_url('img/vista_banner_icon.svg')); ?>">
     9    <p class="vsta-text-<?php echo  esc_attr($type); ?>"> <?php echo esc_html($text) ?> </p>
    510  </div>
    611</div>

  • vistawp/trunk/templates/notifications/welcome.php

    r3171043 r3424939  
     1<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
     4?>
     5
    16<div id="vistawp-welcome" class="notice is-dismissible">
    27  <div>
    3     <img width="100" src="<?= esc_html(\vista_plugin_url('img/vista_logo.png')); ?>">
     8    <img width="100" src="<?php echo esc_html(\vista_plugin_url('img/vista_logo.png')); ?>">
    49  </div>
    510  <div>
    611    <h3>Thanks for activating VistaWP</h3>
    7     <p>Head to the <a href="<?= \get_home_url() . '/wp-admin/admin.php?page=vista_main'; ?>">settings page</a> to get started</p>
     12    <p>Head to the <a href="<?php echo \get_home_url() . '/wp-admin/admin.php?page=vista_main'; ?>">settings page</a> to get started</p>
    813  </div>
    914</div>

  • vistawp/trunk/templates/pages/main_page.php

    r3006497 r3424939  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     3
    24/**
    35 * Template for the main page of the VistaWP plugin, returned by vista_get_template().
    … …  
    3739  </p><br />
    3840
    39   <form method="post" action="<?php echo esc_url($_SERVER['REQUEST_URI']); ?>">
     41  <form method="post" action="<?php echo esc_url(add_query_arg(array())); ?>">
    4042    <input type="submit" name="generate_pages" value="Generate Vista Pages" class="button-primary vsta-gen-btn">
    4143  </form>

  • vistawp/trunk/templates/shortcodes/simple-listings.php

    r3171043 r3424939  
    11<?php
     2 
     3if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     4
    25/**
    36 * Template for the shotcode simple listings, returned by vista_get_template().
    … …  
    1518<div class="vista-sl-pagination">
    1619  <div class="vista-sl-results">
    17     <label class="vista-sl-<?=$theme?>-results-label">[vista_listings_total] results</label>
     20    <label class="vista-sl-<?php echo esc_attr($theme); ?>-results-label">[vista_listings_total] results</label>
    1821  </div>
    19   <div class="vista-sl-<?=$theme?>-prev">
     22  <div class="vista-sl-<?php echo esc_attr($theme); ?>-prev">
    2023    [vista_listings_paginator type=backward]Prev[/vista_listings_paginator]
    2124  </div>
    22   <div class="vista-sl-<?=$theme?>-next">
     25  <div class="vista-sl-<?php echo esc_attr($theme); ?>-next">
    2326    [vista_listings_paginator type=forward]Next[/vista_listings_paginator]
    2427  </div>
    … …  
    2831<div class="vista-sl-container">
    2932  [vista_listings_list]
    30   <div class="vista-sl-card vista-sl-<?=$theme?>-card">
     33  <div class="vista-sl-card vista-sl-<?php echo esc_attr($theme); ?>-card">
    3134    <div class="vista-sl-photo">
    32       <a href="<?=$dest . '?listing='?>[mlsId]" class="vista-sl-photo-link">
     35      <a href="<?php echo esc_url($dest . '?listing='); ?>[mlsId]" class="vista-sl-photo-link">
    3336        [first-photo]
    3437      </a>
    3538    </div>
    3639   
    37     <div class="vista-sl-<?=$theme?>-address">
    38       <a href="<?=$dest . '?listing='?>[mlsId]" class="vista-sl-address-link">
     40    <div class="vista-sl-<?php echo esc_attr($theme); ?>-address">
     41      <a href="<?php echo esc_url($dest . '?listing='); ?>[mlsId]" class="vista-sl-address-link">
    3942        <h2>[address]</h2>
    4043      </a>
    4144    </div>
    4245
    43     <div class="vista-sl-<?=$theme?>-price">
     46    <div class="vista-sl-<?php echo esc_attr($theme); ?>-price">
    4447      <p>$[listPrice]</p>
    4548    </div>
    4649
    4750    <div class="vista-sl-info">
    48       <div class="vista-sl-<?=$theme?>-beds">
     51      <div class="vista-sl-<?php echo esc_attr($theme); ?>-beds">
    4952        <p>[bedrooms]</p><p>Beds</p>
    5053      </div>
    51       <div class="vista-sl-<?=$theme?>-baths">
     54      <div class="vista-sl-<?php echo esc_attr($theme); ?>-baths">
    5255        <p>[baths]</p><p>Baths</p>
    5356      </div>
    54       <div class="vista-sl-<?=$theme?>-sqft">
     57      <div class="vista-sl-<?php echo esc_attr($theme); ?>-sqft">
    5558        <p>[sqft]</p><p>Sq. Ft.</p>
    5659      </div>
    … …  
    5861
    5962    <div class="vista-sl-agent-info">
    60       <div class="vista-sl-<?=$theme?>-listingid">
     63      <div class="vista-sl-<?php echo esc_attr($theme); ?>-listingid">
    6164        <p>ID: #[listingId]</p>
    6265      </div>
    63       <div class="vista-sl-<?=$theme?>-status">
     66      <div class="vista-sl-<?php echo esc_attr($theme); ?>-status">
    6467        <p>Status: [status]</p>
    6568      </div>
    6669    </div>
    6770
    68     <div class="vista-sl-<?=$theme?>-btn">
    69       <a href="<?= \get_home_url() . $dest . '?listing='?>[mlsId]" class="vista-sl-<?=$theme?>-link">View Property</a>
     71    <div class="vista-sl-<?php echo esc_attr($theme); ?>-btn">
     72      <a href="<?php echo esc_url(\get_home_url() . $dest . '?listing='); ?>[mlsId]" class="vista-sl-<?php echo esc_attr($theme); ?>-link">View Property</a>
    7073    </div>
    7174
    … …  
    7982<div class="vista-sl-pagination">
    8083  <div class="vista-sl-results">
    81     <label class="vista-sl-<?=$theme?>-results-label">[vista_listings_total] results</label>
     84    <label class="vista-sl-<?php echo esc_attr($theme); ?>-results-label">[vista_listings_total] results</label>
    8285  </div>
    83   <div class="vista-sl-<?=$theme?>-prev">
     86  <div class="vista-sl-<?php echo esc_attr($theme); ?>-prev">
    8487    [vista_listings_paginator type=backward]Prev[/vista_listings_paginator]
    8588  </div>
    86   <div class="vista-sl-<?=$theme?>-next">
     89  <div class="vista-sl-<?php echo esc_attr($theme); ?>-next">
    8790    [vista_listings_paginator type=forward]Next[/vista_listings_paginator]
    8891  </div>

  • vistawp/trunk/vista.php

    r3380981 r3424939  
    33* Plugin Name: VistaWP
    44* Description: Retrieves and displays real estate listings
    5 * Version: 1.4.2
     5* Version: 1.4.3
    66* Author: VistaWP
    77* Author URI: https://vistawp.com/
    … …  
    1515
    1616// general constants
    17 define( 'VISTA__PLUGIN_VERSION', '1.4.2' );
     17define( 'VISTA__PLUGIN_VERSION', '1.4.3' );
    1818define( 'VISTA__PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
    1919define( 'VISTA__PLUGIN_URL', plugin_dir_url( __FILE__ ) );
    … …  
    2828* @author VistaWP
    2929* @link https://vistawp.com/
    30 * @version 1.4.2
     30* @version 1.4.3
    3131*/
    3232class Main {
    … …  
    388388    <p>
    389389      The VistaWP plugin has encountered a fatal error and self-deactivated.
    390       Error message: <?php echo $GLOBALS['vista_error_message']; ?>
     390      Error message: <?php echo esc_html($GLOBALS['vista_error_message']); ?>
    391391    </p>
    392392 </div>
Note: See TracChangeset for help on using the changeset viewer.