← All changes | front/FrontViews/Frontusers/tmpl/profile.php +45 -14 11.0.2 → 11.1.0 View file →

		@@ -1,8 +1,21 @@
1	1	<?php
2	2	// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- View file, its variables are local to the include scope, not true globals.
3	3	defined('ABSPATH') || die('Restricted Access');
	4	+
	5	+use AcyMailing\Helpers\SecurityHelper;
	6	+
4	7	$formName = acym_getModuleFormName();
	8	+$allowedIntroTags = array_merge(SecurityHelper::ALLOWED_HTML_INTRO, [
	9	+ 'a' => [
	10	+ 'href' => true,
	11	+ 'target' => true,
	12	+ 'title' => true,
	13	+ 'class' => true,
	14	+ 'rel' => true,
	15	+ 'aria-label' => true,
	16	+ ],
	17	+]);
5	18	?>
6	19	<div id="acym_fulldiv_<?php echo esc_attr($formName); ?>" class="acym_front_page <?php echo empty($data['suffix']) ? '' : esc_attr($data['suffix']); ?>">
7	20	<?php
8	21	if (!empty($data['show_page_heading'])) {
		@@ -9,20 +22,32 @@
9	22	echo '<h1 class="contentheading'.esc_attr($data['suffix']).'">'.esc_html($data['page_heading']).'</h1>';
10	23	}
11	24
12	25	if (!empty($data['introtext'])) {
13		- echo '<span class="acym_introtext">'.esc_html($data['introtext']).'</span>';
	26	+ echo '<span class="acym_introtext">'.wp_kses(
	27	+ $data['introtext'],
	28	+ $allowedIntroTags
	29	+ ).'</span>';
14	30	}
15	31	?>
16	32
17	33	<form enctype="multipart/form-data"
18		- action="<?php echo esc_url(acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : ''))); ?>"
19		- method="post"
20		- name="<?php echo esc_attr($formName); ?>"
21		- id="<?php echo esc_attr($formName); ?>"
22		- onsubmit="this.querySelector('input[type=submit]').click(); return false;" novalidate>
	34	+ action="<?php echo esc_url(acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : ''))); ?>"
	35	+ method="post"
	36	+ name="<?php echo esc_attr($formName); ?>"
	37	+ id="<?php echo esc_attr($formName); ?>"
	38	+ onsubmit="this.querySelector('input[type=submit]').click(); return false;" novalidate>
23	39	<fieldset class="adminform acy_user_info">
24		- <legend><span><?php echo esc_html(acym_translation('ACYM_USER_INFORMATION')); ?></span></legend>
	40	+ <legend>
	41	+ <span>
	42	+ <?php
	43	+ echo wp_kses(
	44	+ acym_translation('ACYM_USER_INFORMATION'),
	45	+ SecurityHelper::ALLOWED_HTML_INTRO
	46	+ );
	47	+ ?>
	48	+ </span>
	49	+ </legend>
25	50	<div id="acyuserinfo">
26	51	<?php
27	52	foreach ($data['fields'] as $field) {
28	53	$field->option = !empty($field->option) ? json_decode($field->option) : new stdClass();
		@@ -58,13 +83,16 @@
58	83	?>
59	84	</div>
60	85
61	86	<?php
62		- if ($this->config->get('user_tracking_control', 0) && !empty($data['user']->id)) {
	87	+ if ($this->config->get('user_tracking_control', 0)) {
	88	+ $trackingChecked = isset($data['user']->tracking) ? (int)$data['user']->tracking === 1 : !$this->config->get('dont_track_by_default', 0);
63	89	echo '<div class="onefield fieldacytracking" id="field_tracking_'.esc_attr($formName).'">';
64	90	echo '<label for="mailingdata_tracking_'.esc_attr($formName).'">';
65	91	echo '<input type="hidden" name="user[tracking]" value="0"/>';
66		- echo '<input id="mailingdata_tracking_'.esc_attr($formName).'" class="checkbox" type="checkbox" name="user[tracking]" value="1" '.((int)$data['user']->tracking === 1 ? 'checked="checked"' : '').'/> '.esc_html(
	92	+ echo '<input id="mailingdata_tracking_'.esc_attr(
	93	+ $formName
	94	+ ).'" class="checkbox" type="checkbox" name="user[tracking]" value="1" '.checked($trackingChecked, true, false).'/> '.esc_html(
67	95	acym_translation('ACYM_ALLOW_TRACKING')
68	96	);
69	97	echo '</label>';
70	98	echo '</div>';
		@@ -74,9 +102,9 @@
74	102	$deleteButton = $this->config->get('gdpr_delete', 0);
75	103	if (!empty($data['user']->id) && !(empty($exportButton) && empty($deleteButton))) {
76	104	?>
77	105	<div id="acyuseractions">
78		- <table>
	106	+ <table role="presentation">
79	107	<tr>
80	108	<?php
81	109	if ($exportButton == 1) {
82	110	?>
		@@ -92,9 +120,9 @@
92	120	if ($deleteButton == 1) {
93	121	?>
94	122	<td id="acybutton_subscriber_delete_data">
95	123	<button class="btn btn-secondary button"
96		- onclick="if(confirm(ACYM_JS_TXT.ACYM_ARE_YOU_SURE + '\n' + ACYM_JS_TXT.ACYM_DELETE_MY_DATA_CONFIRM)){ this.form.task.value = 'gdprDelete'; this.form.submit(); } return false;">
	124	+ onclick="if(confirm(ACYM_JS_TXT.ACYM_ARE_YOU_SURE + '\n' + ACYM_JS_TXT.ACYM_DELETE_MY_DATA_CONFIRM)){ this.form.task.value = 'gdprDelete'; this.form.submit(); } return false;">
97	125	<?php echo esc_html(acym_translation('ACYM_DELETE_MY_DATA')); ?>
98	126	</button>
99	127	</td>
100	128	<?php
		@@ -208,14 +236,17 @@
208	236	<input type="hidden" name="acyprofile" value="1" />
209	237
210	238	<p class="acymodifybutton">
211	239	<button class="btn btn-primary"
212		- type="submit"
213		- onclick="<?php echo esc_attr($actionClick); ?>">
	240	+ type="submit"
	241	+ onclick="<?php echo esc_attr($actionClick); ?>">
214	242	<?php echo esc_html(acym_translation(empty($data['user']->id) ? 'ACYM_SUBSCRIBE' : 'ACYM_SAVE_CHANGES')); ?>
215	243	</button>
216	244	</p>
217	245	</form>
218	246	<?php if (!empty($data['posttext'])) {
219		- echo '<span class="acym_posttext">'.esc_html($data['posttext']).'</span>';
	247	+ echo '<span class="acym_posttext">'.wp_kses(
	248	+ $data['posttext'],
	249	+ $allowedIntroTags
	250	+ ).'</span>';
220	251	} ?>
221	252	</div>