← All changes | includes/Frontend/Form/View/Conversational/ConversationalHelpers.php +24 -10 3.1.3 → V3.3.2 View file →

		@@ -35,9 +35,9 @@
35	35	}
36	36	if (!empty($welcomePageSettings->title)) {
37	37	$welcomeTitle =
38	38	' <div class="bc' . $this->_formId . '-welcome-title">' . "\n"
39		- . ' <h2>' . $welcomePageSettings->title . '</h2>' . "\n"
	39	+ . ' <h2>' . $this->escHtml($welcomePageSettings->title) . '</h2>' . "\n"
40	40	. ' </div>';
41	41	}
42	42
43	43	$startBtnPreIcn = $this->conversationalSettingsIcon($welcomePageSettings, 'startBtnPreIcn', 'btn-pre-icon', 'Start Button Pre Icon');
		@@ -42,11 +42,12 @@
42	42
43	43	$startBtnPreIcn = $this->conversationalSettingsIcon($welcomePageSettings, 'startBtnPreIcn', 'btn-pre-icon', 'Start Button Pre Icon');
44	44	$startBtnSufIcn = $this->conversationalSettingsIcon($welcomePageSettings, 'startBtnSufIcn', 'btn-suf-icon', 'Start Button Suf Icon');
45	45
46		- $startBtnText = !empty($welcomePageSettings->btnTxt) ? $welcomePageSettings->btnTxt : 'Start';
	46	+ $startBtnText = $this->escHtml(!empty($welcomePageSettings->btnTxt) ? $welcomePageSettings->btnTxt : 'Start');
47	47
48		- $stepHints = !empty($welcomePageSettings->stepHints) ? $welcomePageSettings->stepHints : '';
	48	+ $stepHints = !empty($welcomePageSettings->stepHints) ? $this->ksesPost($welcomePageSettings->stepHints) : '';
	49	+ $welcomeContent = !empty($welcomePageSettings->content) ? $this->ksesPost($welcomePageSettings->content) : '';
49	50
50	51	$buttonMarkup =
51	52	' <div class="bc' . $this->_formId . '-step-btn-wrpr">' . "\n"
52	53	. ' <div class="bc' . $this->_formId . '-step-btn-inner-wrpr">' . "\n"
		@@ -65,9 +66,9 @@
65	66
66	67	$welcomePageMarkup =
67	68	' <div class="bc' . $this->_formId . '-welcome-content">' . "\n"
68	69	. ' ' . $welcomeTitle . "\n"
69		- . ' ' . $welcomePageSettings->content . "\n"
	70	+ . ' ' . $welcomeContent . "\n"
70	71	. ' ' . $buttonMarkup . "\n"
71	72	. ' </div>';
72	73	$imageContent = $this->conversationalSettingsIcon($welcomePageSettings, 'layoutImage', 'step-img', 'Background Image');
73	74	$welcomeLayout = $welcomePageSettings->layout;
		@@ -91,9 +92,9 @@
91	92	$hiddenCls = ($isPreview && !$navigationSettings->showProgressLabel) ? ' bc-live-hidden' : '';
92	93	$progressLabelMarkup =
93	94	' <div class="bc' . $formId . '-progress-lbl-wrpr' . $hiddenCls . '">' . "\n"
94	95	. ' <span class="bc' . $formId . '-progress-lbl">' . "\n"
95		- . ' ' . $navigationSettings->progressLabel . "\n"
	96	+ . ' ' . $this->escHtml($navigationSettings->progressLabel) . "\n"
96	97	. ' </span>' . "\n"
97	98	. ' </div>';
98	99	}
99	100
		@@ -168,13 +169,13 @@
168	169	public function getStepButtonsView($fieldData, $stepSettings)
169	170	{
170	171	$formId = $this->_formId;
171	172	$isFieldRequired = !empty($fieldData->valid->req) && $fieldData->valid->req;
172		- $btnTxt = $isFieldRequired ? $stepSettings->nextBtnTxt : $stepSettings->btnTxt;
	173	+ $btnTxt = $this->escHtml($isFieldRequired ? $stepSettings->nextBtnTxt : $stepSettings->btnTxt);
173	174	$btnPreIcn = $this->conversationalSettingsIcon($stepSettings, 'btnPreIcn', 'btn-pre-icon', 'Button Prefix Icon');
174	175	$btnSufIcn = $this->conversationalSettingsIcon($stepSettings, 'btnSufIcn', 'btn-suf-icon', 'Button Suffix Icon');
175	176	$hiddenClass = $isFieldRequired ? 'bc-grid-hide' : '';
176		- $stepHints = !empty($stepSettings->stepHints) ? $stepSettings->stepHints : '';
	177	+ $stepHints = !empty($stepSettings->stepHints) ? $this->ksesPost($stepSettings->stepHints) : '';
177	178
178	179	$dataBtnTxt = esc_attr(!empty($stepSettings->btnTxt) ? $stepSettings->btnTxt : 'Skip');
179	180	$dataNextBtnTxt = esc_attr(!empty($stepSettings->nextBtnTxt) ? $stepSettings->nextBtnTxt : 'Next');
180	181
		@@ -199,8 +200,9 @@
199	200	}
200	201
201	202	public static function getStepLayout($formID, $imageContent, $fieldContent, $layoutName, $layoutClassNames = '')
202	203	{
	204	+ $stepWrapperClass = esc_attr('bc' . $formID . '-step-wrapper bc' . $formID . '-step bc-step-deactive ' . $layoutClassNames);
203	205	$imageContentWrapper =
204	206	' <div class="bc' . $formID . '-step-img-cntnr">' . "\n"
205	207	. ' <picture class="bc' . $formID . '-step-img-wrpr">' . "\n"
206	208	. ' ' . $imageContent . "\n"
		@@ -209,9 +211,9 @@
209	211	$noImageLayouts = ['normal-layout', 'centered-card-layout'];
210	212	$imageContentWrapper = in_array($layoutName, $noImageLayouts, true) ? '' : $imageContentWrapper;
211	213
212	214	return
213		- ' <div class="bc' . $formID . '-step-wrapper bc' . $formID . '-step bc-step-deactive ' . $layoutClassNames . '">' . "\n"
	215	+ ' <div class="' . $stepWrapperClass . '">' . "\n"
214	216	. ' <div class="bc' . $formID . '-step-content">' . "\n"
215	217	. ' ' . $imageContentWrapper . "\n"
216	218	. ' <div class="bc' . $formID . '-step-fld-wrpr">' . "\n"
217	219	. ' ' . $fieldContent . "\n"
		@@ -223,13 +225,15 @@
223	225	public function conversationalSettingsIcon($data, $icnPropName, $element, $alt = 'Image')
224	226	{
225	227	if (Helpers::property_exists_nested($data, $icnPropName, '', 1)) {
226	228	$url = esc_url($data->$icnPropName);
	229	+ $class = esc_attr('bc' . $this->_formId . '-' . $element);
	230	+ $alt = esc_attr($alt);
227	231	return
228	232	' <img' . "\n"
229		- . ' class="bc' . $this->_formId . '-' . $element . '"' . "\n"
	233	+ . ' class="' . $class . '"' . "\n"
230	234	. ' src="' . $url . '"' . "\n"
231		- . ' alt=' . $alt . "\n"
	235	+ . ' alt="' . $alt . '"' . "\n"
232	236	. ' />';
233	237	}
234	238	return '';
235	239	}
		@@ -271,6 +275,16 @@
271	275	$stepSettings = !empty($this->_stepListObject->{$stepPropertyName}) ? $this->_stepListObject->{$stepPropertyName} : (object) [];
272	276	$mergedSettings = (object) array_merge((array) $allStepsSettings, (array) $stepSettings);
273	277
274	278	return $mergedSettings;
	279	+ }
	280	+
	281	+ private function escHtml($value)
	282	+ {
	283	+ return esc_html((string) $value);
	284	+ }
	285	+
	286	+ private function ksesPost($value)
	287	+ {
	288	+ return wp_kses_post((string) $value);
275	289	}
276	290	}