← All changes
|
Libs/adminify-framework/classes/profile-options.class.php
+4
-14
4.2.21
→
4.0.3.7
View file →
| @@ -104,10 +104,10 @@ | ||
| 104 | 104 | |
| 105 | 105 | $section_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-section-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 106 | 106 | $section_title = ( ! empty( $section['title'] ) ) ? $section['title'] : ''; |
| 107 | 107 | |
| 108 | - echo ( $section_title || $section_icon ) ? '<h2>'. wp_kses_post( $section_icon ) . esc_html( $section_title ) .'</h2>' : ''; | |
| 109 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 108 | + echo ( $section_title || $section_icon ) ? '<h2>'. $section_icon . $section_title .'</h2>' : ''; | |
| 109 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 110 | 110 | |
| 111 | 111 | if ( ! empty( $section['fields'] ) ) { |
| 112 | 112 | |
| 113 | 113 | foreach ( $section['fields'] as $field ) { |
| @@ -144,16 +144,11 @@ | ||
| 144 | 144 | if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'adminify_profile_nonce' ) ) { |
| 145 | 145 | return $user_id; |
| 146 | 146 | } |
| 147 | 147 | |
| 148 | - // Authorization: a valid nonce proves intent, not permission. | |
| 149 | - if ( ! current_user_can( 'edit_user', $user_id ) ) { | |
| 150 | - return $user_id; | |
| 151 | - } | |
| 152 | - | |
| 153 | 148 | // XSS ok. |
| 154 | 149 | // No worries, This "POST" requests is sanitizing in the below foreach. |
| 155 | - $request = ( ! empty( $_POST[ $this->unique ] ) ) ? wp_unslash( $_POST[ $this->unique ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers. | |
| 150 | + $request = ( ! empty( $_POST[ $this->unique ] ) ) ? $_POST[ $this->unique ] : array(); | |
| 156 | 151 | |
| 157 | 152 | if ( ! empty( $request ) ) { |
| 158 | 153 | |
| 159 | 154 | foreach ( $this->sections as $section ) { |
| @@ -181,14 +176,9 @@ | ||
| 181 | 176 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 182 | 177 | |
| 183 | 178 | } else { |
| 184 | 179 | |
| 185 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 186 | - if ( is_array( $field_value ) ) { | |
| 187 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 188 | - } else { | |
| 189 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 190 | - } | |
| 180 | + $data[$field_id] = $field_value; | |
| 191 | 181 | |
| 192 | 182 | } |
| 193 | 183 | |
| 194 | 184 | // Validate "post" request of field. |