← All changes | front/FrontViews/Archive/tmpl/view.php +17 -9 10.1.4 → 11.1.0 View file →

		@@ -1,30 +1,38 @@
	1	+<?php
	2	+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- View file, its variables are local to the include scope, not true globals.
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+?>
1	5	<div id="archive_view">
2	6	<?php
3	7	if (empty($data['receiver']->id)) {
4		- echo '<p class="acym_front_message_warning">'.acym_translation('ACYM_FRONT_ARCHIVE_NOT_CONNECTED').'</p>';
	8	+ echo '<p class="acym_front_message_warning">'.esc_html(acym_translation('ACYM_FRONT_ARCHIVE_NOT_CONNECTED')).'</p>';
5	9	}
6	10	?>
7		- <h1 class="contentheading"><?php echo $data['mail']->subject; ?></h1>
	11	+ <h1 class="contentheading"><?php echo esc_html($data['mail']->subject); ?></h1>
8	12
9		- <input type="hidden" id="archive_view__content" value="<?php echo acym_escape($data['mail']->body); ?>" />
10		- <div style="min-width:80%" id="archive_view__preview"><?php echo $data['mail']->body; ?></div>
	13	+ <input type="hidden" id="archive_view__content" value="<?php echo esc_attr($data['mail']->body); ?>" />
	14	+ <div style="min-width:80%" id="archive_view__preview">
	15	+ <?php
	16	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Campaign content, built by admin and cannot be escaped.
	17	+ echo $data['mail']->body;
	18	+ ?>
	19	+ </div>
11	20
12	21	<?php
13		- $attachments = json_decode(!empty($data['mail']->attachments) ? $data['mail']->attachments : '[]');
	22	+ $attachments = json_decode(!empty($data['mail']->attachments) ? $data['mail']->attachments : '[]', true);
14	23
15	24	if (!empty($attachments)) {
16	25	?>
17	26	<fieldset class="newsletter_attachments">
18		- <legend><?php echo acym_translation('ACYM_ATTACHMENTS'); ?></legend>
	27	+ <legend><?php echo esc_html(acym_translation('ACYM_ATTACHMENTS')); ?></legend>
19	28	<table>
20	29	<?php
21	30	foreach ($attachments as $attachment) {
22		- $onlyFilename = explode("/", $attachment->filename);
23		-
	31	+ $onlyFilename = explode('/', $attachment['filename']);
24	32	$onlyFilename = end($onlyFilename);
25	33
26		- echo '<tr><td><a href="'.acym_rootURI().$attachment->filename.'" target="_blank">'.$onlyFilename.'</a></td></tr>';
	34	+ echo '<tr><td><a href="'.esc_url(acym_rootURI().$attachment['filename']).'" target="_blank">'.esc_html($onlyFilename).'</a></td></tr>';
27	35	}
28	36	?>
29	37	</table>
30	38	</fieldset>