← All changes
|
Libs/adminify-framework/classes/metabox-options.class.php
+5
-15
4.2.6
→
4.0.5.4
View file →
| @@ -205,9 +205,9 @@ | ||
| 205 | 205 | |
| 206 | 206 | $tab_error = ( ! empty( $errors['sections'][$tab_key] ) ) ? '<i class="adminify-label-error adminify-error">!</i>' : ''; |
| 207 | 207 | $tab_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-tab-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 208 | 208 | |
| 209 | - echo '<li><a href="#">'. wp_kses_post( $tab_icon ) . esc_html( $section['title'] ) . wp_kses_post( $tab_error ) .'</a></li>'; | |
| 209 | + echo '<li><a href="#">'. $tab_icon . $section['title'] . $tab_error .'</a></li>'; | |
| 210 | 210 | |
| 211 | 211 | $tab_key++; |
| 212 | 212 | |
| 213 | 213 | } |
| @@ -236,10 +236,10 @@ | ||
| 236 | 236 | $section_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-section-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 237 | 237 | |
| 238 | 238 | echo '<div class="adminify-section hidden'. esc_attr( $section_onload . $section_class ) .'">'; |
| 239 | 239 | |
| 240 | - echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. wp_kses_post( $section_icon ) . esc_html( $section_title ) .'</h3></div>' : ''; | |
| 241 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 240 | + echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. $section_icon . $section_title .'</h3></div>' : ''; | |
| 241 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 242 | 242 | |
| 243 | 243 | if ( ! empty( $section['fields'] ) ) { |
| 244 | 244 | |
| 245 | 245 | foreach ( $section['fields'] as $field ) { |
| @@ -306,16 +306,11 @@ | ||
| 306 | 306 | if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'adminify_metabox_nonce' ) ) { |
| 307 | 307 | return $post_id; |
| 308 | 308 | } |
| 309 | 309 | |
| 310 | - // Authorization: a valid nonce proves intent, not permission. | |
| 311 | - if ( ! current_user_can( 'edit_post', $post_id ) ) { | |
| 312 | - return $post_id; | |
| 313 | - } | |
| 314 | - | |
| 315 | 310 | // XSS ok. |
| 316 | 311 | // No worries, This "POST" requests is sanitizing in the below foreach. |
| 317 | - $request = ( ! empty( $_POST[ $this->unique ] ) ) ? wp_unslash( $_POST[ $this->unique ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers. | |
| 312 | + $request = ( ! empty( $_POST[ $this->unique ] ) ) ? $_POST[ $this->unique ] : array(); | |
| 318 | 313 | |
| 319 | 314 | if ( ! empty( $request ) ) { |
| 320 | 315 | |
| 321 | 316 | foreach ( $this->sections as $section ) { |
| @@ -343,14 +338,9 @@ | ||
| 343 | 338 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 344 | 339 | |
| 345 | 340 | } else { |
| 346 | 341 | |
| 347 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 348 | - if ( is_array( $field_value ) ) { | |
| 349 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 350 | - } else { | |
| 351 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 352 | - } | |
| 342 | + $data[$field_id] = $field_value; | |
| 353 | 343 | |
| 354 | 344 | } |
| 355 | 345 | |
| 356 | 346 | // Validate "post" request of field. |