← All changes
|
Libs/adminify-framework/classes/comment-options.class.php
+5
-15
4.2.21
→
4.0.3.7
View file →
| @@ -132,9 +132,9 @@ | ||
| 132 | 132 | |
| 133 | 133 | $tab_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-tab-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 134 | 134 | $tab_error = ( ! empty( $errors['sections'][$tab_key] ) ) ? '<i class="adminify-label-error adminify-error">!</i>' : ''; |
| 135 | 135 | |
| 136 | - echo '<li><a href="#">'. wp_kses_post( $tab_icon ) . esc_html( $section['title'] ) . wp_kses_post( $tab_error ) .'</a></li>'; | |
| 136 | + echo '<li><a href="#">'. $tab_icon . $section['title'] . $tab_error .'</a></li>'; | |
| 137 | 137 | |
| 138 | 138 | $tab_key++; |
| 139 | 139 | |
| 140 | 140 | } |
| @@ -159,10 +159,10 @@ | ||
| 159 | 159 | $section_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-section-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 160 | 160 | |
| 161 | 161 | echo '<div class="adminify-section hidden'. esc_attr( $section_onload . $section_class ) .'">'; |
| 162 | 162 | |
| 163 | - echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. wp_kses_post( $section_icon ) . esc_html( $section_title ) .'</h3></div>' : ''; | |
| 164 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 163 | + echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. $section_icon . $section_title .'</h3></div>' : ''; | |
| 164 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 165 | 165 | |
| 166 | 166 | if ( ! empty( $section['fields'] ) ) { |
| 167 | 167 | |
| 168 | 168 | foreach ( $section['fields'] as $field ) { |
| @@ -229,16 +229,11 @@ | ||
| 229 | 229 | if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'adminify_comment_metabox_nonce' ) ) { |
| 230 | 230 | return $comment_id; |
| 231 | 231 | } |
| 232 | 232 | |
| 233 | - // Authorization: a valid nonce proves intent, not permission. | |
| 234 | - if ( ! current_user_can( 'edit_comment', $comment_id ) ) { | |
| 235 | - return $comment_id; | |
| 236 | - } | |
| 237 | - | |
| 238 | 233 | // XSS ok. |
| 239 | 234 | // No worries, This "POST" requests is sanitizing in the below foreach. |
| 240 | - $request = ( ! empty( $_POST[ $this->unique ] ) ) ? wp_unslash( $_POST[ $this->unique ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers. | |
| 235 | + $request = ( ! empty( $_POST[ $this->unique ] ) ) ? $_POST[ $this->unique ] : array(); | |
| 241 | 236 | |
| 242 | 237 | if ( ! empty( $request ) ) { |
| 243 | 238 | |
| 244 | 239 | foreach ( $this->sections as $section ) { |
| @@ -266,14 +261,9 @@ | ||
| 266 | 261 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 267 | 262 | |
| 268 | 263 | } else { |
| 269 | 264 | |
| 270 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 271 | - if ( is_array( $field_value ) ) { | |
| 272 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 273 | - } else { | |
| 274 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 275 | - } | |
| 265 | + $data[$field_id] = $field_value; | |
| 276 | 266 | |
| 277 | 267 | } |
| 278 | 268 | |
| 279 | 269 | // Validate "post" request of field. |