← All changes | front/FrontViews/Frontusers/tmpl/profile.php +83 -35 10.11.1 → 11.1.0 View file →

		@@ -1,26 +1,53 @@
1	1	<?php
	2	+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- View file, its variables are local to the include scope, not true globals.
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
	5	+use AcyMailing\Helpers\SecurityHelper;
	6	+
2	7	$formName = acym_getModuleFormName();
	8	+$allowedIntroTags = array_merge(SecurityHelper::ALLOWED_HTML_INTRO, [
	9	+ 'a' => [
	10	+ 'href' => true,
	11	+ 'target' => true,
	12	+ 'title' => true,
	13	+ 'class' => true,
	14	+ 'rel' => true,
	15	+ 'aria-label' => true,
	16	+ ],
	17	+]);
3	18	?>
4		-<div id="acym_fulldiv_<?php echo $formName; ?>" class="acym_front_page <?php echo empty($data['suffix']) ? '' : $data['suffix']; ?>">
	19	+<div id="acym_fulldiv_<?php echo esc_attr($formName); ?>" class="acym_front_page <?php echo empty($data['suffix']) ? '' : esc_attr($data['suffix']); ?>">
5	20	<?php
6	21	if (!empty($data['show_page_heading'])) {
7		- echo '<h1 class="contentheading'.$data['suffix'].'">'.$data['page_heading'].'</h1>';
	22	+ echo '<h1 class="contentheading'.esc_attr($data['suffix']).'">'.esc_html($data['page_heading']).'</h1>';
8	23	}
9	24
10	25	if (!empty($data['introtext'])) {
11		- echo '<span class="acym_introtext">'.$data['introtext'].'</span>';
	26	+ echo '<span class="acym_introtext">'.wp_kses(
	27	+ $data['introtext'],
	28	+ $allowedIntroTags
	29	+ ).'</span>';
12	30	}
13	31	?>
14	32
15	33	<form enctype="multipart/form-data"
16		- action="<?php echo acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : '')); ?>"
	34	+ action="<?php echo esc_url(acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : ''))); ?>"
17	35	method="post"
18		- name="<?php echo $formName; ?>"
19		- id="<?php echo $formName; ?>"
	36	+ name="<?php echo esc_attr($formName); ?>"
	37	+ id="<?php echo esc_attr($formName); ?>"
20	38	onsubmit="this.querySelector('input[type=submit]').click(); return false;" novalidate>
21	39	<fieldset class="adminform acy_user_info">
22		- <legend><span><?php echo acym_translation('ACYM_USER_INFORMATION'); ?></span></legend>
	40	+ <legend>
	41	+ <span>
	42	+ <?php
	43	+ echo wp_kses(
	44	+ acym_translation('ACYM_USER_INFORMATION'),
	45	+ SecurityHelper::ALLOWED_HTML_INTRO
	46	+ );
	47	+ ?>
	48	+ </span>
	49	+ </legend>
23	50	<div id="acyuserinfo">
24	51	<?php
25	52	foreach ($data['fields'] as $field) {
26	53	$field->option = !empty($field->option) ? json_decode($field->option) : new stdClass();
		@@ -43,15 +70,15 @@
43	70	foreach ($fromDB as $value) {
44	71	$valuesArray[$value->value] = $value->title;
45	72	}
46	73	}
47		- echo '<span class="onefield fieldacy'.$field->id.'" id="field_'.$field->id.'">';
	74	+ echo '<span class="onefield fieldacy'.esc_attr($field->id).'" id="field_'.esc_attr($field->id).'">';
48	75
49		- echo $data['fieldClass']->displayField($field, $field->default_value, $valuesArray, true, true, $data['user']);
	76	+ $data['fieldClass']->displayField($field, $field->default_value, $valuesArray, true, true, $data['user']);
50	77	echo '</span>';
51	78
52	79	if ($field->id == 2 && $this->config->get('email_confirmation')) {
53		- echo $data['fieldClass']->setEmailConfirmationField(true, $field, 'span', false);
	80	+ $data['fieldClass']->setEmailConfirmationField(true, $field, 'span', false);
54	81	}
55	82	}
56	83	?>
57	84	</div>
		@@ -56,14 +83,28 @@
56	83	?>
57	84	</div>
58	85
59	86	<?php
	87	+ if ($this->config->get('user_tracking_control', 0)) {
	88	+ $trackingChecked = isset($data['user']->tracking) ? (int)$data['user']->tracking === 1 : !$this->config->get('dont_track_by_default', 0);
	89	+ echo '<div class="onefield fieldacytracking" id="field_tracking_'.esc_attr($formName).'">';
	90	+ echo '<label for="mailingdata_tracking_'.esc_attr($formName).'">';
	91	+ echo '<input type="hidden" name="user[tracking]" value="0"/>';
	92	+ echo '<input id="mailingdata_tracking_'.esc_attr(
	93	+ $formName
	94	+ ).'" class="checkbox" type="checkbox" name="user[tracking]" value="1" '.checked($trackingChecked, true, false).'/> '.esc_html(
	95	+ acym_translation('ACYM_ALLOW_TRACKING')
	96	+ );
	97	+ echo '</label>';
	98	+ echo '</div>';
	99	+ }
	100	+
60	101	$exportButton = $this->config->get('gdpr_export', 0);
61	102	$deleteButton = $this->config->get('gdpr_delete', 0);
62	103	if (!empty($data['user']->id) && !(empty($exportButton) && empty($deleteButton))) {
63	104	?>
64	105	<div id="acyuseractions">
65		- <table>
	106	+ <table role="presentation">
66	107	<tr>
67	108	<?php
68	109	if ($exportButton == 1) {
69	110	?>
		@@ -70,9 +111,9 @@
70	111	<td id="acybutton_subscriber_download_data" <?php if ($deleteButton == 1) {
71	112	echo 'style="padding-right: 10px;"';
72	113	} ?>>
73	114	<button class="btn btn-secondary button" onclick="this.form.task.value='exportdata'; this.form.submit(); return false;">
74		- <?php echo acym_translation('ACYM_EXPORT_MY_DATA'); ?>
	115	+ <?php echo esc_html(acym_translation('ACYM_EXPORT_MY_DATA')); ?>
75	116	</button>
76	117	</td>
77	118	<?php
78	119	}
		@@ -80,9 +121,9 @@
80	121	?>
81	122	<td id="acybutton_subscriber_delete_data">
82	123	<button class="btn btn-secondary button"
83	124	onclick="if(confirm(ACYM_JS_TXT.ACYM_ARE_YOU_SURE + '\n' + ACYM_JS_TXT.ACYM_DELETE_MY_DATA_CONFIRM)){ this.form.task.value = 'gdprDelete'; this.form.submit(); } return false;">
84		- <?php echo acym_translation('ACYM_DELETE_MY_DATA'); ?>
	125	+ <?php echo esc_html(acym_translation('ACYM_DELETE_MY_DATA')); ?>
85	126	</button>
86	127	</td>
87	128	<?php
88	129	}
		@@ -95,9 +136,9 @@
95	136	<?php
96	137	if ($data['displayLists']) {
97	138	?>
98	139	<fieldset class="adminform acy_subscription_list margin-bottom-1">
99		- <legend><span><?php echo acym_translation('ACYM_SUBSCRIPTION'); ?></span></legend>
	140	+ <legend><span><?php echo esc_html(acym_translation('ACYM_SUBSCRIPTION')); ?></span></legend>
100	141
101	142	<div id="acyusersubscription">
102	143	<?php
103	144	if (empty($data['dropdown'])) {
		@@ -116,17 +157,19 @@
116	157	$row->status = -1;
117	158	}
118	159
119	160	echo '<div class="acym_list">
120		- <div class="acystatus">'.acym_radio(
121		- $values,
122		- 'data[listsub]['.$row->id.'][status]',
123		- $row->status,
124		- [],
125		- ['id' => 'status'.$k++],
126		- true
127		- ).'</div>
128		- <div class="list_name">'.(!empty($row->display_name) ? $row->display_name : $row->name).'</div>
	161	+ <div class="acystatus">';
	162	+ acym_radio(
	163	+ $values,
	164	+ 'data[listsub]['.$row->id.'][status]',
	165	+ $row->status,
	166	+ [],
	167	+ ['id' => 'status'.$k++],
	168	+ true
	169	+ );
	170	+ echo '</div>
	171	+ <div class="list_name">'.esc_html(!empty($row->display_name) ? $row->display_name : $row->name).'</div>
129	172	</div>';
130	173	}
131	174	} else {
132	175	$selectedIndex = '';
		@@ -142,14 +185,14 @@
142	185	if ($row->status == 1) {
143	186	$value = 1;
144	187	$selectedIndex = $k;
145	188	}
146		- echo '<input type="hidden" class="listsub-dropdown" name="data[listsub]['.$row->id.'][status]" value="'.$value.'">';
	189	+ echo '<input type="hidden" class="listsub-dropdown" name="data[listsub]['.esc_attr($row->id).'][status]" value="'.esc_attr($value).'">';
147	190
148	191	$k++;
149	192	}
150	193
151		- echo acym_select($dropdownOpts, 'data[listsubdropdown]', $selectedIndex);
	194	+ acym_select($dropdownOpts, 'data[listsubdropdown]', $selectedIndex, null, 'value', 'text', null, false, true);
152	195	}
153	196	?>
154	197	</div>
155	198	</fieldset>
		@@ -157,18 +200,19 @@
157	200	}
158	201
159	202	if (empty($data['user']->id) && $data['config']->get('captcha', 'none') !== 'none' && !empty($data['captchaHelper'])) {
160	203	echo '<div id="trcaptcha" class="acy_onefield">';
161		- echo $data['captchaHelper']->display($formName);
	204	+ $data['captchaHelper']->display($formName);
162	205	echo '</div>';
163	206	}
164	207
165	208	if (!empty($data['source'])) {
166		- echo '<input type="hidden" name="acy_source" value="'.acym_escape($data['source']).'" />';
	209	+ echo '<input type="hidden" name="acy_source" value="'.esc_attr($data['source']).'" />';
167	210	}
168	211
	212	+ // CMS specific things
169	213	if (!empty($data['Itemid'])) {
170		- echo '<input type="hidden" name="Itemid" value="'.acym_escape($data['Itemid']).'" />';
	214	+ echo '<input type="hidden" name="Itemid" value="'.esc_attr($data['Itemid']).'" />';
171	215	}
172	216
173	217	if (acym_isNoTemplate()) {
174	218	echo '<input type="hidden" name="tmpl" value="component"/>';
		@@ -173,8 +217,9 @@
173	217	if (acym_isNoTemplate()) {
174	218	echo '<input type="hidden" name="tmpl" value="component"/>';
175	219	}
176	220
	221	+ // Form params
177	222	acym_formOptions(true, 'savechanges', '', 'frontusers');
178	223
179	224	if (isset($data['disableButtons']) && $data['disableButtons']) {
180	225	$actionClick = 'return false;';
		@@ -182,12 +227,12 @@
182	227	$actionClick = 'return submitAcymForm(\'savechanges\',\''.$formName.'\', \'acym_checkChangeForm\');';
183	228	}
184	229	?>
185	230
186		- <input type="hidden" name="hiddenlists" value="<?php echo implode(',', $data['hiddenlists']); ?>" />
187		- <input type="hidden" name="user[id]" value="<?php echo acym_escape($data['user']->id); ?>" />
188		- <input type="hidden" name="userId" value="<?php echo acym_escape($data['user']->id); ?>" />
189		- <input type="hidden" name="userKey" value="<?php echo acym_escape($data['user']->key); ?>" />
	231	+ <input type="hidden" name="hiddenlists" value="<?php echo esc_attr(implode(',', $data['hiddenlists'])); ?>" />
	232	+ <input type="hidden" name="user[id]" value="<?php echo esc_attr($data['user']->id); ?>" />
	233	+ <input type="hidden" name="userId" value="<?php echo esc_attr($data['user']->id); ?>" />
	234	+ <input type="hidden" name="userKey" value="<?php echo esc_attr($data['user']->key ?? ''); ?>" />
190	235	<input type="hidden" name="ajax" value="1" />
191	236	<input type="hidden" name="acyprofile" value="1" />
192	237
193	238	<p class="acymodifybutton">
		@@ -192,13 +237,16 @@
192	237
193	238	<p class="acymodifybutton">
194	239	<button class="btn btn-primary"
195	240	type="submit"
196		- onclick="<?php echo $actionClick; ?>">
197		- <?php echo acym_escape(acym_translation(empty($data['user']->id) ? 'ACYM_SUBSCRIBE' : 'ACYM_SAVE_CHANGES')); ?>
	241	+ onclick="<?php echo esc_attr($actionClick); ?>">
	242	+ <?php echo esc_html(acym_translation(empty($data['user']->id) ? 'ACYM_SUBSCRIBE' : 'ACYM_SAVE_CHANGES')); ?>
198	243	</button>
199	244	</p>
200	245	</form>
201	246	<?php if (!empty($data['posttext'])) {
202		- echo '<span class="acym_posttext">'.$data['posttext'].'</span>';
	247	+ echo '<span class="acym_posttext">'.wp_kses(
	248	+ $data['posttext'],
	249	+ $allowedIntroTags
	250	+ ).'</span>';
203	251	} ?>
204	252	</div>