← All changes | widgets/profile/widget.php +45 -23 10.10.2 → 11.1.0 View file →

		@@ -1,6 +1,8 @@
1	1	<?php
2	2
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
3	5	use AcyMailing\Classes\ListClass;
4	6	use AcyMailing\FrontControllers\FrontusersController;
5	7	use AcyMailing\Core\AcymParameter;
6	8
		@@ -16,8 +18,9 @@
16	18	['description' => acym_translation('ACYM_MENU_PROFILE_DESC')]
17	19	);
18	20	}
19	21
	22	+ // Configuration
20	23	public function form($instance)
21	24	{
22	25	$this->loadAcyMailing();
23	26
		@@ -65,51 +68,68 @@
65	68
66	69	echo '<div class="acym_toggle_zone">
67	70	<div class="acyblock" id="mainopt_profilewidget">
68	71	<div class="acym_toggle_div_title">
69		- <h3>'.acym_translation('ACYM_MAIN_OPTIONS').'</h3>
	72	+ <h3>'.esc_html(acym_translation('ACYM_MAIN_OPTIONS')).'</h3>
70	73	</div>
71	74	<div class="acym_toggle_div" style="display: none;">';
72	75
73		- echo '<p><label class="acyWPconfig" for="'.$this->get_field_id('title').'">'.acym_translation('ACYM_TITLE').'</label>
74		- <input type="text" class="widefat" id="'.$this->get_field_id('title').'" name="'.$this->get_field_name('title').'" value="'.$params['title'].'" /></p>';
	76	+ echo '<p><label class="acyWPconfig" for="'.esc_attr($this->get_field_id('title')).'">'.esc_html(acym_translation('ACYM_TITLE')).'</label>
	77	+ <input type="text" class="widefat" id="'.esc_attr($this->get_field_id('title')).'" name="'.esc_attr($this->get_field_name('title')).'" value="'.esc_attr(
	78	+ $params['title']
	79	+ ).'" /></p>';
75	80
76	81
77		- echo '<p><label class="acyWPconfig" title="'.acym_translation('ACYM_VISIBLE_LISTS_DESC').'">'.acym_translation('ACYM_VISIBLE_LISTS').'</label>';
78		- echo acym_displayParam('lists', $params['lists'], $this->get_field_name('lists')).'</p>';
	82	+ echo '<p><label class="acyWPconfig" title="'.esc_attr(acym_translation('ACYM_VISIBLE_LISTS_DESC')).'">'.esc_html(acym_translation('ACYM_VISIBLE_LISTS')).'</label>';
	83	+ acym_displayParam('lists', $params['lists'], $this->get_field_name('lists')).'</p>';
79	84
80		- echo '<p><label class="acyWPconfig" title="'.acym_translation('ACYM_DROPDOWN_LISTS_DESC').'">'.acym_translation('ACYM_DROPDOWN_LISTS').'</label>';
81		- echo acym_boolean($this->get_field_name('dropdown'), $params['dropdown'], $this->get_field_id('dropdown')).'</p>';
	85	+ echo '<p><label class="acyWPconfig" title="'.esc_attr(acym_translation('ACYM_DROPDOWN_LISTS_DESC')).'">'.esc_html(acym_translation('ACYM_DROPDOWN_LISTS')).'</label>';
	86	+ acym_boolean($this->get_field_name('dropdown'), $params['dropdown'], $this->get_field_id('dropdown')).'</p>';
82	87
83		- echo '<p><label class="acyWPconfig" title="'.acym_translation('ACYM_LISTS_CHECKED_DEFAULT_DESC').'">'.acym_translation('ACYM_LISTS_CHECKED_DEFAULT').'</label>';
84		- echo acym_displayParam('lists', $params['listschecked'], $this->get_field_name('listschecked')).'</p>';
	88	+ echo '<p><label class="acyWPconfig" title="'.esc_attr(acym_translation('ACYM_LISTS_CHECKED_DEFAULT_DESC')).'">'.esc_html(
	89	+ acym_translation('ACYM_LISTS_CHECKED_DEFAULT')
	90	+ ).'</label>';
	91	+ acym_displayParam('lists', $params['listschecked'], $this->get_field_name('listschecked')).'</p>';
85	92
86		- echo '<p><label class="acyWPconfig" title="'.acym_translation('ACYM_AUTO_SUBSCRIBE_TO_DESC').'">'.acym_translation('ACYM_AUTO_SUBSCRIBE_TO').'</label>';
87		- echo acym_displayParam('lists', $params['hiddenlists'], $this->get_field_name('hiddenlists')).'</p>';
	93	+ echo '<p><label class="acyWPconfig" title="'.esc_attr(acym_translation('ACYM_AUTO_SUBSCRIBE_TO_DESC')).'">'.esc_html(acym_translation('ACYM_AUTO_SUBSCRIBE_TO')).'</label>';
	94	+ acym_displayParam('lists', $params['hiddenlists'], $this->get_field_name('hiddenlists')).'</p>';
88	95
89		- echo '<p><label class="acyWPconfig" title="'.acym_translation('ACYM_FIELDS_TO_DISPLAY_DESC').'">'.acym_translation('ACYM_FIELDS_TO_DISPLAY').'</label>';
90		- echo acym_displayParam('fields', $params['fields'], $this->get_field_name('fields')).'</p>';
	96	+ echo '<p><label class="acyWPconfig" title="'.esc_attr(acym_translation('ACYM_FIELDS_TO_DISPLAY_DESC')).'">'.esc_html(acym_translation('ACYM_FIELDS_TO_DISPLAY')).'</label>';
	97	+ acym_displayParam('fields', $params['fields'], $this->get_field_name('fields')).'</p>';
91	98
92	99	echo '</div>
93	100	</div>
94	101	<div class="acyblock" id="advopt_profilewidget">
95	102	<div class="acym_toggle_div_title">
96		- <h3>'.acym_translation('ACYM_ADVANCED_OPTIONS').'</h3>
	103	+ <h3>'.esc_html(acym_translation('ACYM_ADVANCED_OPTIONS')).'</h3>
97	104	</div>
98	105	<div class="acym_toggle_div" style="display: none;">';
99	106
100		- echo '<p><label class="acyWPconfig" for="'.$this->get_field_id('introtext').'" title="'.acym_translation('ACYM_INTRO_TEXT_DESC').'">'.acym_translation('ACYM_INTRO_TEXT').'</label>
101		- <textarea class="widefat" id="'.$this->get_field_id('introtext').'" name="'.$this->get_field_name('introtext').'" >'.$params['introtext'].'</textarea></p>';
	107	+ echo '<p><label class="acyWPconfig" for="'.esc_attr($this->get_field_id('introtext')).'" title="'.esc_attr(acym_translation('ACYM_INTRO_TEXT_DESC')).'">'.esc_html(
	108	+ acym_translation('ACYM_INTRO_TEXT')
	109	+ ).'</label>
	110	+ <textarea class="widefat" id="'.esc_attr($this->get_field_id('introtext')).'" name="'.esc_attr($this->get_field_name('introtext')).'" >'.esc_html(
	111	+ $params['introtext']
	112	+ ).'</textarea></p>';
102	113
103		- echo '<p><label class="acyWPconfig" for="'.$this->get_field_id('posttext').'" title="'.acym_translation('ACYM_POST_TEXT_DESC').'">'.acym_translation('ACYM_POST_TEXT').'</label>
104		- <textarea class="widefat" id="'.$this->get_field_id('posttext').'" name="'.$this->get_field_name('posttext').'" >'.$params['posttext'].'</textarea></p>';
	114	+ echo '<p><label class="acyWPconfig" for="'.esc_attr($this->get_field_id('posttext')).'" title="'.esc_attr(acym_translation('ACYM_POST_TEXT_DESC')).'">'.esc_html(
	115	+ acym_translation('ACYM_POST_TEXT')
	116	+ ).'</label>
	117	+ <textarea class="widefat" id="'.esc_attr($this->get_field_id('posttext')).'" name="'.esc_attr($this->get_field_name('posttext')).'" >'.esc_html(
	118	+ $params['posttext']
	119	+ ).'</textarea></p>';
105	120
106		- echo '<p><label class="acyWPconfig" for="'.$this->get_field_id('source').'" title="'.acym_translation('ACYM_SOURCE_DESC').'">'.acym_translation('ACYM_SOURCE').'</label>
107		- <input type="text" class="widefat" id="'.$this->get_field_id('source').'" name="'.$this->get_field_name('source').'" value="'.$params['source'].'" /></p>';
	121	+ echo '<p><label class="acyWPconfig" for="'.esc_attr($this->get_field_id('source')).'" title="'.esc_attr(acym_translation('ACYM_SOURCE_DESC')).'">'.esc_html(
	122	+ acym_translation('ACYM_SOURCE')
	123	+ ).'</label>
	124	+ <input type="text" class="widefat" id="'.esc_attr($this->get_field_id('source')).'" name="'.esc_attr($this->get_field_name('source')).'" value="'.esc_attr(
	125	+ $params['source']
	126	+ ).'" /></p>';
108	127
109	128	echo '</div></div></div>';
110	129	}
111	130
	131	+ // Widget's output
112	132	public function widget($args, $instance)
113	133	{
114	134	$this->loadAcyMailing();
115	135
		@@ -116,14 +136,16 @@
116	136	if (!acym_isElementorEdition()) {
117	137	acym_loadAssets('frontusers', 'profile');
118	138	}
119	139
120		- echo $args['before_widget'];
	140	+ echo wp_kses_post($args['before_widget']);
121	141
122	142	if (!isset($instance['title'])) $instance['title'] = '';
123	143	$title = apply_filters('widget_title', $instance['title'], $instance, $args['widget_id']);
124	144	if (!empty($title)) {
125		- echo $args['before_title'].$title.$args['after_title'];
	145	+ echo wp_kses_post($args['before_title']);
	146	+ echo esc_html($title);
	147	+ echo wp_kses_post($args['after_title']);
126	148	}
127	149
128	150	acym_setVar('page', ACYM_COMPONENT.'_front');
129	151	$params = new AcymParameter($instance);
		@@ -139,9 +161,9 @@
139	161
140	162	acym_setVar('layout', 'profile');
141	163	$userController->display($data);
142	164
143		- echo $args['after_widget'];
	165	+ echo wp_kses_post($args['after_widget']);
144	166	}
145	167
146	168	private function loadAcyMailing(): void
147	169	{