PluginProbe
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar / 2.1.21
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar v2.1.21
2.1.22 2.1.21 2.1.20 2.1.4 2.1.5 2.1.6 2.1.7 2.1.8 2.1.9 trunk 1.1 2.0 2.0.1 2.0.10.2 2.0.11 2.0.12 2.0.13 2.0.14 2.0.15 2.0.16 2.0.17 2.0.18 2.0.2 2.0.20 2.0.21 All 56 releases
← All changes | core/wpbm-functions.php +375 -538 2.1.7 → 2.1.21 View file →
@@ -71,10 +71,10 @@
71 71 */
72 72 function wpbm_is_this_demo() {
73 73 //return ! true; //TODO: comment it. 2016-09-27 // Replaced!
74 74 if (
75 - ( ( isset( $_SERVER['SCRIPT_FILENAME'] ) ) && ( strpos( $_SERVER['SCRIPT_FILENAME'], 'oplugins.com' ) !== false ) )
76 - || ( ( isset( $_SERVER['HTTP_HOST'] ) ) && ( strpos( $_SERVER['HTTP_HOST'], 'oplugins.com' ) !== false ) )
75 + ( ( isset( $_SERVER['SCRIPT_FILENAME'] ) ) && ( strpos( sanitize_text_field( wp_unslash($_SERVER['SCRIPT_FILENAME']) ), 'oplugins.com' ) !== false ) )
76 + || ( ( isset( $_SERVER['HTTP_HOST'] ) ) && ( strpos( sanitize_text_field( wp_unslash($_SERVER['HTTP_HOST'])), 'oplugins.com' ) !== false ) )
77 77 )
78 78 return true;
79 79 else
80 80 return false;
@@ -89,193 +89,9 @@
89 89 /** Show System Info (status) at item > Settings General page
90 90 * Link: http://server.com/wp-admin/admin.php?page=wpbm-settings&system_info=show#wpbm_general_settings_system_info_metabox
91 91 */
92 92 function wpbm_system_info() {
93 -
94 - if ( wpbm_is_this_demo() ) return;
95 -
96 - if ( current_user_can( 'activate_plugins' ) ) { // Only for Administrator or Super admin. More here: https://codex.wordpress.org/Roles_and_Capabilities
97 -
98 - global $wpdb, $wp_version;
99 -
100 - $all_plugins = get_plugins();
101 - $active_plugins = get_option( 'active_plugins' );
102 -
103 - $mysql_info = $wpdb->get_results( "SHOW VARIABLES LIKE 'sql_mode'" );
104 - if ( is_array( $mysql_info ) ) $sql_mode = $mysql_info[0]->Value;
105 - if ( empty( $sql_mode ) ) $sql_mode = 'Not set';
106 -
107 - $safe_mode = ( ini_get( 'safe_mode' ) ) ? 'On' : 'Off';
108 - $allow_url_fopen = ( ini_get( 'allow_url_fopen' ) ) ? 'On' : 'Off';
109 - $upload_max_filesize = ( ini_get( 'upload_max_filesize' ) ) ? ini_get( 'upload_max_filesize' ) : 'N/A';
110 - $post_max_size = ( ini_get( 'post_max_size' ) ) ? ini_get( 'post_max_size' ) : 'N/A';
111 - $max_execution_time = ( ini_get( 'max_execution_time' ) ) ? ini_get( 'max_execution_time' ) : 'N/A';
112 - $memory_limit = ( ini_get( 'memory_limit' ) ) ? ini_get( 'memory_limit' ) : 'N/A';
113 - $memory_usage = ( function_exists( 'memory_get_usage' ) ) ? round( memory_get_usage() / 1024 / 1024, 2 ) . ' Mb' : 'N/A';
114 - $exif_read_data = ( is_callable( 'exif_read_data' ) ) ? 'Yes' . " ( V" . substr( phpversion( 'exif' ), 0, 4 ) . ")" : 'No';
115 - $iptcparse = ( is_callable( 'iptcparse' ) ) ? 'Yes' : 'No';
116 - $xml_parser_create = ( is_callable( 'xml_parser_create' ) ) ? 'Yes' : 'No';
117 - $theme = ( function_exists( 'wp_get_theme' ) ) ? wp_get_theme() : get_theme( get_current_theme() );
118 -
119 - if ( function_exists( 'is_multisite' ) ) {
120 - if ( is_multisite() ) $multisite = 'Yes';
121 - else $multisite = 'No';
122 - } else { $multisite = 'N/A';
123 - }
124 -
125 - $system_info = array(
126 - 'system_info' => '',
127 - 'php_info' => '',
128 - 'active_plugins' => array(), //FixIn: 2.0.25.1
129 - 'inactive_plugins' => array() //FixIn: 2.0.25.1
130 - );
131 -
132 - $ver_small_name = get_wpbm_version();
133 - if ( class_exists( 'wpbm_multiuser' ) ) $ver_small_name = 'multiuser';
134 -
135 - $system_info['system_info'] = array(
136 - 'Plugin Update' => ( defined( 'WPBM_VERSION' ) ) ? WPBM_VERSION : 'N/A',
137 - 'Plugin Version' => ucwords( $ver_small_name ),
138 - 'Plugin Update Date' => date( "Y-m-d", filemtime( WPBM_FILE ) ),
139 -
140 - 'WP Version' => $wp_version,
141 - 'WP DEBUG' => ( ( defined('WP_DEBUG') ) && ( WP_DEBUG ) ) ? 'On' : 'Off',
142 - 'WP DB Version' => get_option( 'db_version' ),
143 - 'Operating System' => PHP_OS,
144 - 'Server' => $_SERVER["SERVER_SOFTWARE"],
145 - 'PHP Version' => PHP_VERSION,
146 - 'PHP Safe Mode' => $safe_mode,
147 - 'MYSQL Version' => $wpdb->get_var( "SELECT VERSION() AS version" ),
148 - 'SQL Mode' => $sql_mode,
149 - 'Memory usage' => $memory_usage,
150 - 'Site URL' => get_option( 'siteurl' ),
151 - 'Home URL' => home_url(),
152 - 'SERVER[HTTP_HOST]' => $_SERVER['HTTP_HOST'],
153 - 'SERVER[SERVER_NAME]' => $_SERVER['SERVER_NAME'],
154 - 'Multisite' => $multisite,
155 - 'Active Theme' => $theme['Name'] . ' ' . $theme['Version']
156 - );
157 -
158 - $system_info['php_info'] = array(
159 - 'PHP Version' => PHP_VERSION,
160 - 'PHP Safe Mode' => $safe_mode,
161 - 'PHP Memory Limit' => '<strong>' . $memory_limit . '</strong>',
162 - 'PHP Max Script Execute Time' => '<strong>' . $max_execution_time . '</strong>',
163 -
164 - 'PHP Max Post Size' => '<strong>' . $post_max_size . '</strong>',
165 - 'PHP MAX Input Vars' => '<strong>' . ( ( ini_get( 'max_input_vars' ) ) ? ini_get( 'max_input_vars' ) : 'N/A' ) . '</strong>', //How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately).
166 -
167 - 'PHP Max Upload Size' => $upload_max_filesize,
168 - 'PHP Allow URL fopen' => $allow_url_fopen,
169 - 'PHP Exif support' => $exif_read_data,
170 - 'PHP IPTC support' => $iptcparse,
171 - 'PHP XML support' => $xml_parser_create
172 - );
173 -
174 - $system_info['php_info']['PHP cURL'] = ( function_exists('curl_init') ) ? 'On' : 'Off';
175 - $system_info['php_info']['Max Nesting Level'] = ( ( ini_get( 'max_input_nesting_level' ) ) ? ini_get( 'max_input_nesting_level' ) : 'N/A' );
176 - $system_info['php_info']['Max Time 4 script'] = ( ( ini_get( 'max_input_time' ) ) ? ini_get( 'max_input_time' ) : 'N/A' ); //Maximum amount of time each script may spend parsing request data
177 - $system_info['php_info']['Log'] = ( ( ini_get( 'error_log' ) ) ? ini_get( 'error_log' ) : 'N/A' );
178 -
179 - if ( ini_get( "suhosin.get.max_value_length" ) ) {
180 -
181 - $system_info['suhosin_info'] = array();
182 - $system_info['suhosin_info']['POST max_array_index_length'] = ( ( ini_get( 'suhosin.post.max_array_index_length' ) ) ? ini_get( 'suhosin.post.max_array_index_length' ) : 'N/A' );
183 - $system_info['suhosin_info']['REQUEST max_array_index_length'] = ( ( ini_get( 'suhosin.request.max_array_index_length' ) ) ? ini_get( 'suhosin.request.max_array_index_length' ) : 'N/A' );
184 -
185 - $system_info['suhosin_info']['POST max_totalname_length'] = ( ( ini_get( 'suhosin.post.max_totalname_length' ) ) ? ini_get( 'suhosin.post.max_totalname_length' ) : 'N/A' );
186 - $system_info['suhosin_info']['REQUEST max_totalname_length'] = ( ( ini_get( 'suhosin.request.max_totalname_length' ) ) ? ini_get( 'suhosin.request.max_totalname_length' ) : 'N/A' );
187 -
188 - $system_info['suhosin_info']['POST max_vars'] = ( ( ini_get( 'suhosin.post.max_vars' ) ) ? ini_get( 'suhosin.post.max_vars' ) : 'N/A' );
189 - $system_info['suhosin_info']['REQUEST max_vars'] = ( ( ini_get( 'suhosin.request.max_vars' ) ) ? ini_get( 'suhosin.request.max_vars' ) : 'N/A' );
190 -
191 - $system_info['suhosin_info']['POST max_value_length'] = ( ( ini_get( 'suhosin.post.max_value_length' ) ) ? ini_get( 'suhosin.post.max_value_length' ) : 'N/A' );
192 - $system_info['suhosin_info']['REQUEST max_value_length'] = ( ( ini_get( 'suhosin.request.max_value_length' ) ) ? ini_get( 'suhosin.request.max_value_length' ) : 'N/A' );
193 -
194 - $system_info['suhosin_info']['POST max_name_length'] = ( ( ini_get( 'suhosin.post.max_name_length' ) ) ? ini_get( 'suhosin.post.max_name_length' ) : 'N/A' );
195 - $system_info['suhosin_info']['REQUEST max_varname_length'] = ( ( ini_get( 'suhosin.request.max_varname_length' ) ) ? ini_get( 'suhosin.request.max_varname_length' ) : 'N/A' );
196 -
197 - $system_info['suhosin_info']['POST max_array_depth'] = ( ( ini_get( 'suhosin.post.max_array_depth' ) ) ? ini_get( 'suhosin.post.max_array_depth' ) : 'N/A' );
198 - $system_info['suhosin_info']['REQUEST max_array_depth'] = ( ( ini_get( 'suhosin.request.max_array_depth' ) ) ? ini_get( 'suhosin.request.max_array_depth' ) : 'N/A' );
199 - }
200 -
201 -
202 - if ( function_exists('gd_info') ) {
203 - $gd_info = gd_info();
204 - if ( isset( $gd_info['GD Version'] ) )
205 - $gd_info = $gd_info['GD Version'];
206 - else
207 - $gd_info = json_encode( $gd_info );
208 - } else {
209 - $gd_info = 'Off';
210 - }
211 - $system_info['php_info']['PHP GD'] = $gd_info;
212 -
213 - // More here https://docs.woocommerce.com/document/problems-with-large-amounts-of-data-not-saving-variations-rates-etc/
214 -
215 -
216 - foreach ( $all_plugins as $path => $plugin ) {
217 -
218 - if ( is_plugin_active( $path ) ) {
219 - $system_info['active_plugins'][ $plugin['Name'] ] = $plugin['Version'];
220 - } else {
221 - $system_info['inactive_plugins'][ $plugin['Name'] ] = $plugin['Version'];
222 - }
223 - }
224 -
225 - // Showing
226 - foreach ( $system_info as $section_name => $section_values ) {
227 - ?>
228 - <span class="wpdevelop">
229 - <table class="table table-striped table-bordered">
230 - <thead><tr><th colspan="2" style="border-bottom: 1px solid #eeeeee;padding: 10px;"><?php echo strtoupper( $section_name ); ?></th></tr></thead>
231 - <tbody>
232 - <?php
233 - if ( !empty( $section_values ) ) {
234 - foreach ( $section_values as $key => $value ) {
235 - ?>
236 - <tr>
237 - <td scope="row" style="width:18em;padding:4px 8px;"><?php echo $key; ?></td>
238 - <td scope="row" style="padding:4px 8px;"><?php echo $value; ?></td>
239 - </tr>
240 - <?php
241 - }
242 - }
243 - ?>
244 - </tbody>
245 - </table>
246 - </span>
247 - <div class="clear"></div>
248 - <?php
249 - }
250 -?>
251 -<hr>
252 -<div style="color:#777;">
253 -<h4 style="font-size:1.1em;">Commonly required configuration vars in php.ini file:</h4>
254 -<h4>General section:</h4>
255 -<pre><code>memory_limit = 256M
256 -max_execution_time = 120
257 -post_max_size = 8M
258 -upload_max_filesize = 8M
259 -max_input_vars = 20480
260 -post_max_size = 64M</code></pre>
261 -<h4>Suhosin section (if installed):</h4>
262 -<pre><code>suhosin.post.max_array_index_length = 1024
263 -suhosin.post.max_totalname_length = 65535
264 -suhosin.post.max_vars = 2048
265 -suhosin.post.max_value_length = 1000000
266 -suhosin.post.max_name_length = 256
267 -suhosin.post.max_array_depth = 1000
268 -suhosin.request.max_array_index_length = 1024
269 -suhosin.request.max_totalname_length = 65535
270 -suhosin.request.max_vars = 2048
271 -suhosin.request.max_value_length = 1000000
272 -suhosin.request.max_varname_length = 256
273 -suhosin.request.max_array_depth = 1000</code></pre>
274 -</div>
275 -<?php
276 - // phpinfo();
277 - }
93 + echo '---';
278 94 }
279 95
280 96
281 97
@@ -433,9 +249,9 @@
433 249 '', // Unknown/unhandled entities
434 250 ' ' // Runs of spaces, post-handling
435 251 );
436 252
437 - $newstring = preg_replace( $plain_search_array, $get_plain_replace_array, strip_tags( $string ) );
253 + $newstring = preg_replace( $plain_search_array, $get_plain_replace_array, wp_strip_all_tags( $string ) );
438 254
439 255 return $newstring;
440 256 }
441 257 // </editor-fold>
@@ -464,8 +280,10 @@
464 280 $replace = wp_parse_args( $replace_array, $defaults );
465 281
466 282 foreach ( $replace as $replace_shortcode => $replace_value ) {
467 283
284 + $replace_value = esc_js( $replace_value ); // FixIn:
285 +
468 286 $subject = str_replace( array( '[' . $replace_shortcode . ']'
469 287 , '{' . $replace_shortcode . '}' )
470 288 , $replace_value
471 289 , $subject );
@@ -478,10 +296,50 @@
478 296
479 297 return $subject;
480 298 }
481 299
300 +
301 +/**
302 + * Sanitize the frontend listing template.
303 + *
304 + * The listing template is stored as an option and rendered by the public
305 + * [booking-manager-listing] shortcode, so script-capable markup must never be
306 + * persisted or returned to visitors.
307 + *
308 + * @param string $template Template HTML with Booking Manager placeholders.
309 + * @return string Safe template HTML.
310 + */
311 +function wpbm_sanitize_listing_template( $template ) {
312 +
313 + if ( ! is_string( $template ) ) {
314 + $template = '';
315 + }
316 +
317 + $allowed_html = wp_kses_allowed_html( 'post' );
318 +
319 + // Keep compatibility with templates that embed safe external content.
320 + $allowed_html['iframe'] = array(
321 + 'src' => true
322 + , 'style' => true
323 + , 'id' => true
324 + , 'class' => true
325 + , 'width' => true
326 + , 'height' => true
327 + , 'title' => true
328 + , 'loading' => true
329 + , 'allowfullscreen' => true
330 + );
331 +
332 + if ( isset( $allowed_html['a'] ) ) {
333 + $allowed_html['a']['target'] = true;
334 + $allowed_html['a']['rel'] = true;
335 + }
336 +
337 + return wp_kses( $template, $allowed_html );
338 +}
339 +
482 340 /** Simple hack to make array strings lowercase
483 - *
341 + *
484 342 * @param type $array
485 343 * @return type
486 344 */
487 345 function wpbm_arraytolower( $array ){
@@ -508,22 +366,22 @@
508 366 }
509 367 }
510 368
511 369 /** Check if this valid timestamp
512 - *
370 + *
513 371 * @param string|int $timestamp
514 372 * @return bool
515 373 */
516 374 function wpbm_is_valid_timestamp( $timestamp ) {
517 - return ( ( (string) (int) $timestamp === $timestamp)
375 + return ( ( (string) (int) $timestamp === $timestamp)
518 376 && ($timestamp <= PHP_INT_MAX)
519 - && ($timestamp >= ~PHP_INT_MAX)
377 + && ($timestamp >= ~PHP_INT_MAX)
520 378 );
521 379 }
522 380 // </editor-fold>
523 381
524 -
525 -// <editor-fold defaultstate="collapsed" desc=" F i l e s && U R L s " >
382 +
383 +// <editor-fold defaultstate="collapsed" desc=" F i l e s && U R L s " >
526 384 ////////////////////////////////////////////////////////////////////////////////
527 385 // F i l e s && U R L s
528 386 ////////////////////////////////////////////////////////////////////////////////
529 387
@@ -548,9 +406,9 @@
548 406 return trailingslashit( WPBM_PLUGIN_URL ) . ltrim( $path, '/\\' );
549 407 }
550 408
551 409 /** Check if such file exist or not.
552 - *
410 + *
553 411 * @param string $path - relative path to file (relative to plugin folder).
554 412 * @return boolean true | false
555 413 */
556 414 function wpbm_is_file_exist( $path ) {
@@ -556,14 +414,14 @@
556 414 function wpbm_is_file_exist( $path ) {
557 415
558 416 if ( file_exists( trailingslashit( WPBM_PLUGIN_DIR ) . ltrim( $path, '/\\' ) ) ) // check if this file exist
559 417 return true;
560 - else
418 + else
561 419 return false;
562 420 }
563 -
421 +
564 422 /** Set URL from absolute to relative (starting from /)
565 - *
423 + *
566 424 * @param type $url
567 425 * @return type
568 426 */
569 427 function wpbm_set_relative_url( $url ){
@@ -576,24 +434,24 @@
576 434 $url = trim($url_path, '/');
577 435 return '/' . $url;
578 436 }
579 437
580 -/** Get Correct Relative URL
581 - *
438 +/** Get Correct Relative URL
439 + *
582 440 * @param type $link
583 441 * @return string
584 442 */
585 443 function wpbm_make_link_relative( $link ){
586 444
587 - if ( $link == get_option('siteurl') )
445 + if ( $link == get_option('siteurl') )
588 446 $link = '/';
589 - $link = '/' . trim( wp_make_link_relative( $link ), '/' );
447 + $link = '/' . trim( wp_make_link_relative( $link ), '/' );
590 448
591 - return $link;
449 + return $link;
592 450 }
593 451
594 -/** Get Correct Absolute URL
595 - *
452 +/** Get Correct Absolute URL
453 + *
596 454 * @param string $link
597 455 * @return type
598 456 */
599 457 function wpbm_make_link_absolute( $link ){
@@ -598,17 +456,17 @@
598 456 */
599 457 function wpbm_make_link_absolute( $link ){
600 458
601 459 if ( ( $link != get_option('siteurl') ) && ( strpos($link, 'http') !== 0 ) )
602 - $link = get_option('siteurl') . '/' . trim( wp_make_link_relative( $link ), '/' );
460 + $link = get_option('siteurl') . '/' . trim( wp_make_link_relative( $link ), '/' );
603 461 return esc_js( $link ) ;
604 462 }
605 463
606 464
607 465 if (!function_exists ('get_file_data_wpdev')) {
608 -
466 +
609 467 /** Get header info from this file, just for compatibility with WordPress 2.8 and older versions
610 - *
468 + *
611 469 * @param type $file
612 470 * @param type $default_headers
613 471 * @param type $context
614 472 * @return type
@@ -614,15 +472,15 @@
614 472 * @return type
615 473 */
616 474 function get_file_data_wpdev( $file, $default_headers, $context = '' ) {
617 475 // We don't need to write to the file, so just open for reading.
618 - $fp = fopen( $file, 'r' );
476 + $fp = fopen( $file, 'r' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
619 477
620 478 // Pull only the first 8kiB of the file in.
621 - $file_data = fread( $fp, 8192 );
479 + $file_data = fread( $fp, 8192 );// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fread
622 480
623 481 // PHP will close file handle, but we are good citizens.
624 - fclose( $fp );
482 + fclose( $fp );// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
625 483
626 484 if( $context != '' ) {
627 485 $extra_headers = array(); //apply_filters( "extra_$context".'_headers', array() );
628 486
@@ -650,9 +508,9 @@
650 508 }
651 509
652 510
653 511 /** Get content from specific URL
654 - *
512 + *
655 513 * @param string $url
656 514 * @return string|boolean (false on error)
657 515 */
658 516 function wpbm_get_ssl_page_content( $url ) {
@@ -664,10 +522,10 @@
664 522 'reject_unsafe_urls' => true, //FixIn: 2.0.29.1
665 523 'user-agent' => 'Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405' //FixIn: 2.0.12.1
666 524 // 'method' => 'GET',
667 525 // 'timeout' => 5, // timeout value for an HTTP request.
668 - // 'redirection' => 5, // number of redirects allowed during an HTTP request.
669 - // 'httpversion' => '1.0',
526 + // 'redirection' => 5, // number of redirects allowed during an HTTP request.
527 + // 'httpversion' => '1.0',
670 528 // 'user-agent' => 'WordPress/' . get_bloginfo( 'version' ) . '; ' . get_bloginfo( 'url' ),
671 529 // 'reject_unsafe_urls' => false,
672 530 // 'blocking' => true,
673 531 // 'headers' => array(),
@@ -679,14 +537,14 @@
679 537 // 'sslcertificates' => ABSPATH . WPINC . '/certificates/ca-bundle.crt',
680 538 // 'stream' => false,
681 539 // 'filename' => null,
682 540 // 'limit_response_size' => null
683 - )
541 + )
684 542 );
685 543
686 - if (
687 - ( ! is_wp_error( $result ) )
688 - && ( $result[ 'response' ][ 'code' ] == '200' )
544 + if (
545 + ( ! is_wp_error( $result ) )
546 + && ( $result[ 'response' ][ 'code' ] == '200' )
689 547 ) {
690 548
691 549 return $result[ 'body' ];
692 550
@@ -762,15 +620,15 @@
762 620
763 621 // </editor-fold>
764 622
765 623
766 -// <editor-fold defaultstate="collapsed" desc=" A d m i n M e n u L i n k s " >
624 +// <editor-fold defaultstate="collapsed" desc=" A d m i n M e n u L i n k s " >
767 625 ////////////////////////////////////////////////////////////////////////////
768 626 // A d m i n M e n u L i n k s
769 627 ////////////////////////////////////////////////////////////////////////////
770 628
771 629 /** Get URL to specific Admin Menu page
772 - *
630 + *
773 631 * @param string $menu_type - { item | add | resources | settings }
774 632 * @param boolean $is_absolute_url - Absolute or relative url { default: true }
775 633 * @return string - URL to menu
776 634 */
@@ -798,19 +656,19 @@
798 656 }
799 657
800 658 if ( $is_absolute_url ) {
801 659 $link = admin_url( 'admin.php' ) . '?page=' . $link ;
802 - }
660 + }
803 661
804 - return $link;
662 + return $link;
805 663 }
806 664
807 665 // // // // // // // // // // // // // // // // // // // // // // // // // /
808 666
809 667 /** Get URL of item Listing or Calendar Overview page
810 - *
668 + *
811 669 * @param boolean $is_absolute_url - Absolute or relative url { default: true }
812 - * @param boolean $is_old - { default: true }
670 + * @param boolean $is_old - { default: true }
813 671 * @return string - URL to menu
814 672 */
815 673 function wpbm_get_master_url( $is_absolute_url = true ) {
816 674 return wpbm_get_menu_url( 'master', $is_absolute_url );
@@ -815,12 +673,12 @@
815 673 function wpbm_get_master_url( $is_absolute_url = true ) {
816 674 return wpbm_get_menu_url( 'master', $is_absolute_url );
817 675 }
818 676
819 -/** Get URL of item > Add item page
820 - *
677 +/** Get URL of item > Add item page
678 + *
821 679 * @param boolean $is_absolute_url - Absolute or relative url { default: true }
822 - * @param boolean $is_old - { default: true }
680 + * @param boolean $is_old - { default: true }
823 681 * @return string - URL to menu
824 682 */
825 683 function wpbm_get_new_wpbm_url( $is_absolute_url = true ) {
826 684 return wpbm_get_menu_url( 'add', $is_absolute_url );
@@ -825,18 +683,18 @@
825 683 function wpbm_get_new_wpbm_url( $is_absolute_url = true ) {
826 684 return wpbm_get_menu_url( 'add', $is_absolute_url );
827 685 }
828 686
829 -/** Get URL of item > Settings page
830 - *
687 +/** Get URL of item > Settings page
688 + *
831 689 * @param boolean $is_absolute_url - Absolute or relative url { default: true }
832 - * @param boolean $is_old - { default: true }
690 + * @param boolean $is_old - { default: true }
833 691 * @return string - URL to menu
834 692 */
835 693 function wpbm_get_settings_url( $is_absolute_url = true ) {
836 694 return wpbm_get_menu_url( 'settings', $is_absolute_url );
837 695 }
838 -
696 +
839 697 // // // // // // // // // // // // // // // // // // // // // // // // // /
840 698
841 699 /** Check if this item Listing or Calendar Overview page
842 700 * @param string $server_param - 'REQUEST_URI' | 'HTTP_REFERER' Default: 'REQUEST_URI'
@@ -841,62 +699,62 @@
841 699 /** Check if this item Listing or Calendar Overview page
842 700 * @param string $server_param - 'REQUEST_URI' | 'HTTP_REFERER' Default: 'REQUEST_URI'
843 701 * @return boolean true | false
844 702 */
845 -function wpbm_is_master_page( $server_param = 'REQUEST_URI' ) {
703 +function wpbm_is_master_page( $server_param = 'REQUEST_URI' ) {
846 704
847 - if ( ( is_admin() ) &&
848 - ( strpos($_SERVER[ $server_param ],'page=oplugins') !== false ) &&
849 - ( strpos($_SERVER[ $server_param ],'tab=wpbm-') === false ) && // not the settings
850 - ( ( strpos($_SERVER[ $server_param ],'tab=wpbm') !== false ) // tab specified
851 - || ( strpos($_SERVER[ $server_param ],'tab=') === false ) ) // or tab not specified at all
705 + if ( ( is_admin() ) && isset($_SERVER[ $server_param ]) &&
706 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'page=oplugins') !== false ) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
707 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'tab=wpbm-') === false ) && // not the settings // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
708 + ( ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'tab=wpbm') !== false ) // tab specified // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
709 + || ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'tab=') === false ) ) // or tab not specified at all // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
852 710 ) {
853 711 return true;
854 - }
712 + }
855 713 return false;
856 714 }
857 715
858 -/** Check if this item > Add item page
716 +/** Check if this item > Add item page
859 717 * @param string $server_param - 'REQUEST_URI' | 'HTTP_REFERER' Default: 'REQUEST_URI'
860 718 * @return boolean true | false
861 719 */
862 720 function wpbm_is_new_wpbm_page( $server_param = 'REQUEST_URI' ) {
863 721
864 - if ( ( is_admin() ) &&
865 - ( strpos($_SERVER[ $server_param ],'page=oplugins') !== false ) &&
866 - ( strpos($_SERVER[ $server_param ],'tab=wpbm-new') !== false )
722 + if ( ( is_admin() ) && isset($_SERVER[ $server_param ]) &&
723 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'page=oplugins') !== false ) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
724 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'tab=wpbm-new') !== false ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
867 725 ) {
868 726 return true;
869 - }
727 + }
870 728 return false;
871 729 }
872 730
873 731
874 -/** Check if this item > Settings page
732 +/** Check if this item > Settings page
875 733 * @param string $server_param - 'REQUEST_URI' | 'HTTP_REFERER' Default: 'REQUEST_URI'
876 734 * @return boolean true | false
877 - */
735 + */
878 736 function wpbm_is_settings_page( $server_param = 'REQUEST_URI' ) {
879 737
880 - if ( ( is_admin() ) &&
881 - ( strpos($_SERVER[ $server_param ],'page=oplugins') !== false ) &&
882 - ( strpos($_SERVER[ $server_param ],'tab=wpbm-settings') !== false )
738 + if ( ( is_admin() ) && isset($_SERVER[ $server_param ]) &&
739 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'page=oplugins') !== false ) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
740 + ( strpos(sanitize_text_field( wp_unslash($_SERVER[ $server_param ])),'tab=wpbm-settings') !== false ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
883 741 ) {
884 742 return true;
885 - }
743 + }
886 744 return false;
887 745 }
888 746
889 747 // </editor-fold>
890 -
891 748
892 -// <editor-fold defaultstate="collapsed" desc=" A d m i n U I E l e m e n t s " >
749 +
750 +// <editor-fold defaultstate="collapsed" desc=" A d m i n U I E l e m e n t s " >
893 751 ////////////////////////////////////////////////////////////////////////////
894 752 // A d m i n U I E l e m e n t s
895 753 ////////////////////////////////////////////////////////////////////////////
896 754
897 755 /** Get Number of new items
898 - *
756 + *
899 757 * @return int
900 758 */
901 759 function wpbm_get_number_new_items(){
902 760 return 0;
@@ -903,9 +761,9 @@
903 761 }
904 762
905 763
906 764 /** Show Admin B A R .
907 - *
765 + *
908 766 * @global type $wp_admin_bar
909 767 * @return type
910 768 */
911 769 function wp_admin_bar_items_menu(){
@@ -993,33 +851,16 @@
993 851 // add_action( 'admin_bar_menu', 'wp_admin_bar_items_menu', 70 ); // Add Admin Bar
994 852
995 853
996 854 /** Show Rating link at footer */
997 -function wpbm_show_wpbm_footer(){
855 +function wpbm_show_wpbm_footer(){
998 856
999 - if ( ! wpbm_is_this_demo() ) {
857 + // Nothing here.
858 +}
859 +// </editor-fold>
1000 860
1001 - $message = sprintf( __( 'If you like %s please leave us a %s rating. A huge thank you in advance!', 'booking-manager')
1002 - , '<strong>Booking Manager</strong>' . ' ' . WPBM_VERSION_NUM
1003 - , '<a href="https://wordpress.org/support/plugin/booking-manager/reviews/#new-post" target="_blank" title="' . esc_attr__( 'Thanks :)', 'booking-manager') . '">'
1004 - . '&#9733;&#9733;&#9733;&#9733;&#9733;'
1005 - . '</a>'
1006 - );
1007 861
1008 - echo '<div id="wpbm-footer" style="position:absolute;bottom:40px;text-align:left;width:95%;font-size:0.9em;text-shadow:0 1px 0 #fff;margin:0;color:#888;">' . $message . '</div>';
1009 - ?>
1010 - <script type="text/javascript">
1011 - jQuery(document).ready(function(){
1012 - jQuery('#wpfooter').append( jQuery('#wpbm-footer') );
1013 - });
1014 - </script>
1015 - <?php
1016 - }
1017 -}
1018 -// </editor-fold>
1019 -
1020 -
1021 -// <editor-fold defaultstate="collapsed" desc=" DB - cheking if table, field or index exists " >
862 +// <editor-fold defaultstate="collapsed" desc=" DB - cheking if table, field or index exists " >
1022 863 ////////////////////////////////////////////////////////////////////////////
1023 864 // DB - cheking if table, field or index exists
1024 865 ////////////////////////////////////////////////////////////////////////////
1025 866
@@ -1024,9 +865,9 @@
1024 865 ////////////////////////////////////////////////////////////////////////////
1025 866
1026 867 /**
1027 868 * Check if table exist
1028 - *
869 + *
1029 870 * @global type $wpdb
1030 871 * @param string $tablename
1031 872 * @return 0|1
1032 873 */
@@ -1033,31 +874,23 @@
1033 874 function wpbm_is_table_exists( $tablename ) {
1034 875
1035 876 global $wpdb;
1036 877
1037 - if ( (! empty($wpdb->prefix) ) && ( strpos($tablename, $wpdb->prefix) === false ) )
1038 - $tablename = $wpdb->prefix . $tablename ;
878 + if ( ( ! empty( $wpdb->prefix ) ) && ( strpos( $tablename, $wpdb->prefix ) === false ) ) {
879 + $tablename = $wpdb->prefix . $tablename;
880 + }
1039 881
1040 - $sql_check_table = $wpdb->prepare("SHOW TABLES LIKE %s" , $tablename ); //FixIn 5.4.3
1041 882
1042 - $res = $wpdb->get_results( $sql_check_table );
1043 883
1044 - return count($res); //FixIn 5.4.3
1045 - /*
1046 - $sql_check_table = $wpdb->prepare("
1047 - SELECT COUNT(*) AS count
1048 - FROM information_schema.tables
1049 - WHERE table_schema = '". DB_NAME ."'
1050 - AND table_name = %s " , $tablename );
884 + $res = $wpdb->get_results( $wpdb->prepare( "SHOW TABLES LIKE %s", $tablename ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
1051 885
1052 - $res = $wpdb->get_results( $sql_check_table );
1053 - return $res[0]->count;*/
886 + return count( $res ); //FixIn 5.4.3.
1054 887 }
1055 888
1056 889
1057 890 /**
1058 891 * Check if table exist
1059 - *
892 + *
1060 893 * @global type $wpdb
1061 894 * @param string $tablename
1062 895 * @param type $fieldname
1063 896 * @return 0|1
@@ -1066,9 +899,9 @@
1066 899 global $wpdb;
1067 900 if ( (! empty($wpdb->prefix) ) && ( strpos($tablename, $wpdb->prefix) === false ) ) $tablename = $wpdb->prefix . $tablename ;
1068 901 $sql_check_table = "SHOW COLUMNS FROM {$tablename}" ;
1069 902
1070 - $res = $wpdb->get_results( $sql_check_table );
903 + $res = $wpdb->get_results( $sql_check_table ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
1071 904
1072 905 foreach ($res as $fld) {
1073 906 if ($fld->Field == $fieldname) return 1;
1074 907 }
@@ -1078,9 +911,9 @@
1078 911
1079 912
1080 913 /**
1081 914 * Check if index exist
1082 - *
915 + *
1083 916 * @global type $wpdb
1084 917 * @param string $tablename
1085 918 * @param type $fieldindex
1086 919 * @return 0|1
@@ -1087,24 +920,24 @@
1087 920 */
1088 921 function wpbm_is_index_in_table_exists( $tablename , $fieldindex) {
1089 922 global $wpdb;
1090 923 if ( (! empty($wpdb->prefix) ) && ( strpos($tablename, $wpdb->prefix) === false ) ) $tablename = $wpdb->prefix . $tablename ;
1091 - $sql_check_table = $wpdb->prepare("SHOW INDEX FROM {$tablename} WHERE Key_name = %s", $fieldindex );
1092 - $res = $wpdb->get_results( $sql_check_table );
924 +
925 + $res = $wpdb->get_results( $wpdb->prepare("SHOW INDEX FROM {$tablename} WHERE Key_name = %s", $fieldindex ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
1093 926 if (count($res)>0) return 1;
1094 927 else return 0;
1095 928 }
1096 929
1097 930 // </editor-fold>
1098 -
1099 -
1100 -// <editor-fold defaultstate="collapsed" desc=" E s c a p i n g " >
931 +
932 +
933 +// <editor-fold defaultstate="collapsed" desc=" E s c a p i n g " >
1101 934 ////////////////////////////////////////////////////////////////////////////
1102 935 // E s c a p i n g
1103 936 ////////////////////////////////////////////////////////////////////////////
1104 937
1105 938 /** Transform the REQESTS parameters (GET and POST) into URL
1106 - *
939 + *
1107 940 * @param type $page_param
1108 941 * @param array $exclude_params
1109 942 * @param type $only_these_parameters
1110 943 * @return type
@@ -1112,25 +945,25 @@
1112 945 function wpbm_get_params_in_url( $page_param , $exclude_params = array(), $only_these_parameters = false, $is_escape_url = false, $only_get = false ){
1113 946
1114 947 $exclude_params[] = 'page';
1115 948
1116 - if ( isset( $_GET['page'] ) )
1117 - $page_param = $_GET['page'];
949 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
950 + if ( isset( $_GET['page'] ) ) { $page_param = $_GET['page']; }
1118 951
1119 952 $get_paramaters = array( 'page' => $page_param );
1120 953
1121 954 if ( $only_get )
1122 - $check_params = $_GET;
1123 - else
1124 - $check_params = $_REQUEST;
1125 -//debuge($check_params);
955 + $check_params = $_GET; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
956 + else
957 + $check_params = $_REQUEST; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
958 +//debuge($check_params);
1126 959 foreach ( $check_params as $prm_key => $prm_value ) {
1127 960
1128 961 // Skip parameters arrays, like $_GET['rvaluation_to'] = Array ( [0] => 6, [1] => 14, [2] => 14 )
1129 - if (
1130 - ( is_string( $prm_value ) )
1131 - || ( is_numeric( $prm_value ) )
1132 - ) {
962 + if (
963 + ( is_string( $prm_value ) )
964 + || ( is_numeric( $prm_value ) )
965 + ) {
1133 966
1134 967 if ( strlen( $prm_value ) > 1000 ) { // Check about TOOO long parameters, if it exist then reset it.
1135 968 $prm_value = '';
1136 969 }
@@ -1139,9 +972,9 @@
1139 972 if ( ( $only_these_parameters === false ) || ( in_array( $prm_key, $only_these_parameters ) ) )
1140 973 $get_paramaters[ $prm_key ] = $prm_value;
1141 974 }
1142 975 }
1143 -//debuge($check_params, $get_paramaters, $exclude_params );
976 +//debuge($check_params, $get_paramaters, $exclude_params );
1144 977 $url = admin_url( add_query_arg( $get_paramaters , 'admin.php' ) );
1145 978
1146 979 if ( $is_escape_url )
1147 980 $url = esc_url( $url );
@@ -1150,9 +983,9 @@
1150 983
1151 984 /* // Old variant:
1152 985 if ( isset( $_GET['page'] ) ) $page_param = $_GET['page'];
1153 986
1154 - $url_start = 'admin.php?page=' . $page_param . '&';
987 + $url_start = 'admin.php?page=' . $page_param . '&';
1155 988 $exclude_params[] = 'page';
1156 989 foreach ( $_REQUEST as $prm_key => $prm_value ) {
1157 990
1158 991 if ( !in_array( $prm_key, $exclude_params ) )
@@ -1163,18 +996,18 @@
1163 996 }
1164 997 $url_start = substr( $url_start, 0, -1 );
1165 998
1166 999 return $url_start;
1167 - */
1000 + */
1168 1001 }
1169 1002
1170 1003
1171 1004 /** Clean Request Parameters
1172 - *
1005 + *
1173 1006 */
1174 -function wpbm_check_request_paramters() {
1007 +function wpbm_check_request_paramters() {
1175 1008
1176 - $clean_params = array();
1009 + $clean_params = array();
1177 1010
1178 1011 $clean_params[ 'wh_wpbm_id' ] = 'digit_or_csd'; // '0' | '1' | ''
1179 1012 $clean_params[ 'wh_wpbm_date' ] = 'digit_or_date'; // number | date 2016-07-20
1180 1013 $clean_params[ 'wh_wpbm_datenext' ] = 'd'; // '1' | '2' ....
@@ -1185,13 +1018,13 @@
1185 1018
1186 1019 // elements only listed in array::
1187 1020 if ( is_array( $clean_type ) ) { // check only values from the list in this array
1188 1021
1189 - if ( ( isset( $_REQUEST[ $request_key ] ) ) && ( ! in_array( $_REQUEST[ $request_key ], $clean_type ) ) )
1190 - $clean_type = 's';
1191 - else
1022 + if ( ( isset( $_REQUEST[ $request_key ] ) ) && ( ! in_array( $_REQUEST[ $request_key ], $clean_type ) ) ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1023 + $clean_type = 's';
1024 + else
1192 1025 $clean_type = 'checked_skip_it';
1193 - }
1026 + }
1194 1027
1195 1028 switch ( $clean_type ) {
1196 1029
1197 1030 case 'checked_skip_it':
@@ -1198,36 +1031,34 @@
1198 1031
1199 1032 break;
1200 1033
1201 1034 case 'digit_or_date': // digit or comma separated digit
1202 - if ( isset( $_REQUEST[ $request_key ] ) )
1203 - $_REQUEST[ $request_key ] = wpbm_clean_digit_or_date( $_REQUEST[ $request_key ] ); // nums
1035 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1036 + if ( isset( $_REQUEST[ $request_key ] ) ) { $_REQUEST[ $request_key ] = wpbm_clean_digit_or_date( $_REQUEST[ $request_key ] ); } // nums
1204 1037
1205 1038 break;
1206 1039
1207 1040 case 'digit_or_csd': // digit or comma separated digit
1208 - if ( isset( $_REQUEST[ $request_key ] ) )
1209 - $_REQUEST[ $request_key ] = wpbm_clean_digit_or_csd( $_REQUEST[ $request_key ] ); // nums
1041 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1042 + if ( isset( $_REQUEST[ $request_key ] ) ) { $_REQUEST[ $request_key ] = wpbm_clean_digit_or_csd( $_REQUEST[ $request_key ] ); } // nums
1210 1043
1211 1044 break;
1212 1045
1213 1046 case 's': // string
1214 - if ( isset( $_REQUEST[ $request_key ] ) )
1215 - $_REQUEST[ $request_key ] = wpbm_clean_like_string_for_db( $_REQUEST[ $request_key ] );
1047 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1048 + if ( isset( $_REQUEST[ $request_key ] ) ) { $_REQUEST[ $request_key ] = wpbm_clean_like_string_for_db( $_REQUEST[ $request_key ] ); }
1216 1049
1217 1050 break;
1218 1051
1219 1052 case 'd': // digit
1220 - if ( isset( $_REQUEST[ $request_key ] ) )
1221 - if ( $_REQUEST[ $request_key ] !== '' )
1222 - $_REQUEST[ $request_key ] = intval( $_REQUEST[ $request_key ] );
1053 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1054 + if (( isset( $_REQUEST[ $request_key ] ) ) && ( $_REQUEST[ $request_key ] !== '' )) { $_REQUEST[ $request_key ] = intval( $_REQUEST[ $request_key ] ); }
1223 1055
1224 1056 break;
1225 1057
1226 1058 default:
1227 - if ( isset( $_REQUEST[ $request_key ] ) ) {
1228 - $_REQUEST[ $request_key ] = intval( $_REQUEST[ $request_key ] );
1229 - }
1059 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1060 + if ( isset( $_REQUEST[ $request_key ] ) ) { $_REQUEST[ $request_key ] = intval( $_REQUEST[ $request_key ] ); }
1230 1061 break;
1231 1062 }
1232 1063
1233 1064
@@ -1234,15 +1065,15 @@
1234 1065 }
1235 1066
1236 1067 }
1237 1068
1238 -
1069 +
1239 1070 /** Check paramter if it number or comma separated list of numbers
1240 - *
1071 + *
1241 1072 * @global type $wpdb
1242 1073 * @param string $value
1243 1074 * @return string
1244 - *
1075 + *
1245 1076 * Exmaple:
1246 1077 wpbm_clean_digit_or_csd( '12,a,45,9' ) => '12,0,45,9'
1247 1078 * or
1248 1079 wpbm_clean_digit_or_csd( '10a' ) => '10
@@ -1248,9 +1079,9 @@
1248 1079 wpbm_clean_digit_or_csd( '10a' ) => '10
1249 1080 * or
1250 1081 wpbm_clean_digit_or_csd( array( '12,a,45,9', '10a' ) ) => array ( '12,0,45,9', '10' )
1251 1082 */
1252 -function wpbm_clean_digit_or_csd( $value ) { //FixIn:6.2.1.4
1083 +function wpbm_clean_digit_or_csd( $value ) { //FixIn:6.2.1.4
1253 1084
1254 1085 if ( $value === '' ) return $value;
1255 1086
1256 1087
@@ -1255,9 +1086,9 @@
1255 1086
1256 1087
1257 1088 if ( is_array( $value ) ) {
1258 1089 foreach ( $value as $key => $check_value ) {
1259 - $value[ $key ] = wpbm_clean_digit_or_csd( $check_value );
1090 + $value[ $key ] = wpbm_clean_digit_or_csd( $check_value );
1260 1091 }
1261 1092 return $value;
1262 1093 }
1263 1094
@@ -1274,12 +1105,12 @@
1274 1105 }
1275 1106 $result = implode(',', $result );
1276 1107 return $result;
1277 1108 }
1278 -
1279 -
1109 +
1110 +
1280 1111 /** Cehck about Valid date, like 2016-07-20 or digit
1281 - *
1112 + *
1282 1113 * @param string $value
1283 1114 * @return string or int
1284 1115 */
1285 1116 function wpbm_clean_digit_or_date( $value ) { //FixIn:6.2.1.4
@@ -1293,12 +1124,12 @@
1293 1124 return intval( $value );
1294 1125 }
1295 1126
1296 1127 }
1297 -
1298 1128
1129 +
1299 1130 /** Check $value for injection here
1300 - *
1131 + *
1301 1132 * @param type $value
1302 1133 * @return type
1303 1134 */
1304 1135 function wpbm_clean_parameter( $value ) {
@@ -1303,16 +1134,16 @@
1303 1134 */
1304 1135 function wpbm_clean_parameter( $value ) {
1305 1136
1306 1137 $value = preg_replace( '/<[^>]*>/', '', $value ); // clean any tags
1307 - $value = str_replace( '<', ' ', $value );
1308 - $value = str_replace( '>', ' ', $value );
1309 - $value = strip_tags( $value );
1138 + $value = str_replace( '<', ' ', $value );
1139 + $value = str_replace( '>', ' ', $value );
1140 + $value = wp_strip_all_tags( $value );
1310 1141
1311 - // Clean SQL injection
1142 + // Clean SQL injection
1312 1143 $value = esc_sql( $value );
1313 1144
1314 - return $value;
1145 + return $value;
1315 1146 }
1316 1147
1317 1148
1318 1149 function wpbm_esc_like( $value_trimmed ) {
@@ -1325,14 +1156,14 @@
1325 1156 }
1326 1157
1327 1158
1328 1159 /** Clean user string for using in SQL LIKE statement - append to LIKE sql
1329 - *
1160 + *
1330 1161 * @param string $value - to clean
1331 1162 * @return string - escaped
1332 - * Exmaple:
1163 + * Exmaple:
1333 1164 * $search_escaped_like_title = wpbm_clean_like_string_for_append_in_sql_for_db( $input_var );
1334 - *
1165 + *
1335 1166 * $where_sql = " WHERE title LIKE ". $search_escaped_like_title ." ";
1336 1167 */
1337 1168 function wpbm_clean_like_string_for_append_in_sql_for_db( $value ) {
1338 1169 global $wpdb;
@@ -1337,13 +1168,13 @@
1337 1168 function wpbm_clean_like_string_for_append_in_sql_for_db( $value ) {
1338 1169 global $wpdb;
1339 1170
1340 1171 $value_trimmed = trim( stripslashes( $value ) );
1341 -$wild = '%';
1342 -$like = $wild . wpbm_esc_like( $value_trimmed ) . $wild;
1343 -$sql = $wpdb->prepare( "'%s'", $like );
1172 + $wild = '%';
1173 + $like = $wild . wpbm_esc_like( $value_trimmed ) . $wild;
1174 + $sql = $wpdb->prepare( "'%s'", $like ); // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
1344 1175
1345 - return $sql;
1176 + return $sql;
1346 1177
1347 1178
1348 1179 /* Help:
1349 1180 * First half of escaping for LIKE special characters % and _ before preparing for MySQL.
@@ -1358,22 +1189,22 @@
1358 1189 *
1359 1190 * Example Escape Chain:
1360 1191 *
1361 1192 * $sql = esc_sql( wpbm_esc_like( $input ) );
1362 - */
1193 + */
1363 1194
1364 1195 }
1365 1196
1366 1197
1367 -/** Clean string for using in SQL LIKE requests inside single quotes: WHERE title LIKE '%". $escaped_search_title ."%'
1198 +/** Clean string for using in SQL LIKE requests inside single quotes: WHERE title LIKE '%". $escaped_search_title ."%'
1368 1199 * Replaced _ to \_ % to \% \ to \\
1369 1200 * @param string $value - to clean
1370 1201 * @return string - escaped
1371 - * Exmaple:
1202 + * Exmaple:
1372 1203 * $search_escaped_like_title = wpbm_clean_like_string_for_db( $input_var );
1373 - *
1204 + *
1374 1205 * $where_sql = " WHERE title LIKE '%". $search_escaped_like_title ."%' ";
1375 - *
1206 + *
1376 1207 * Important! Use SINGLE quotes after in SQL query: LIKE '%".$data."%'
1377 1208 */
1378 1209 function wpbm_clean_like_string_for_db( $value ){
1379 1210
@@ -1382,9 +1213,9 @@
1382 1213 $value_trimmed = trim( stripslashes( $value ) );
1383 1214
1384 1215 $value_trimmed = wpbm_esc_like( $value_trimmed );
1385 1216
1386 - $value = trim( $wpdb->prepare( "'%s'", $value_trimmed ) , "'" );
1217 + $value = trim( $wpdb->prepare( "'%s'", $value_trimmed ) , "'" ); // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
1387 1218
1388 1219 return $value;
1389 1220
1390 1221 /* Help:
@@ -1400,26 +1231,26 @@
1400 1231 *
1401 1232 * Example Escape Chain:
1402 1233 *
1403 1234 * $sql = esc_sql( wpbm_esc_like( $input ) );
1404 - */
1235 + */
1405 1236 }
1406 1237
1407 1238
1408 1239 /** Escape string from SQL for the HTML form field
1409 - *
1240 + *
1410 1241 * @param string $value
1411 1242 * @return string
1412 - *
1243 + *
1413 1244 * Used: esc_sql function.
1414 - *
1415 - * https://codex.wordpress.org/Function_Reference/esc_sql
1416 - * Note: Be careful to use this function correctly. It will only escape values to be used in strings in the query.
1417 - * That is, it only provides escaping for values that will be within quotes in the SQL (as in field = '{$escaped_value}').
1418 - * If your value is not going to be within quotes, your code will still be vulnerable to SQL injection.
1419 - * For example, this is vulnerable, because the escaped value is not surrounded by quotes in the SQL query:
1420 - * ORDER BY {$escaped_value}. As such, this function does not escape unquoted numeric values, field names, or SQL keywords.
1421 - *
1245 + *
1246 + * https://codex.wordpress.org/Function_Reference/esc_sql
1247 + * Note: Be careful to use this function correctly. It will only escape values to be used in strings in the query.
1248 + * That is, it only provides escaping for values that will be within quotes in the SQL (as in field = '{$escaped_value}').
1249 + * If your value is not going to be within quotes, your code will still be vulnerable to SQL injection.
1250 + * For example, this is vulnerable, because the escaped value is not surrounded by quotes in the SQL query:
1251 + * ORDER BY {$escaped_value}. As such, this function does not escape unquoted numeric values, field names, or SQL keywords.
1252 + *
1422 1253 */
1423 1254 function wpbm_clean_string_for_form( $value ){
1424 1255
1425 1256 global $wpdb;
@@ -1436,16 +1267,16 @@
1436 1267
1437 1268 }
1438 1269 // </editor-fold>
1439 1270
1440 -
1441 -// <editor-fold defaultstate="collapsed" desc=" U s e r s " >
1271 +
1272 +// <editor-fold defaultstate="collapsed" desc=" U s e r s " >
1442 1273 ////////////////////////////////////////////////////////////////////////////////
1443 1274 // U s e r s
1444 1275 ////////////////////////////////////////////////////////////////////////////////
1445 1276
1446 1277 /** Get ID of active user
1447 - *
1278 + *
1448 1279 * @return type
1449 1280 */
1450 1281 function get_wpbm_current_user_id() {
1451 1282 $user = wp_get_current_user();
@@ -1452,11 +1283,35 @@
1452 1283 return ( isset( $user->ID ) ? (int) $user->ID : 0 );
1453 1284 }
1454 1285
1455 1286
1287 +/**
1288 + * Resolve a requested per-user settings target to the current user.
1289 + *
1290 + * Booking Manager's established AJAX payloads include a user ID. The value is
1291 + * retained for request compatibility, but it must never authorize a write to
1292 + * another user's preferences.
1293 + *
1294 + * @param mixed $requested_user_id User ID supplied by the request.
1295 + *
1296 + * @return int Current user ID when the request target matches; otherwise 0.
1297 + */
1298 +function wpbm_get_authorized_user_option_target_id( $requested_user_id ) {
1299 + $current_user_id = get_wpbm_current_user_id();
1300 +
1301 + if ( 0 === $current_user_id || ! is_scalar( $requested_user_id ) ) {
1302 + return 0;
1303 + }
1304 +
1305 + $requested_user_id = absint( wp_unslash( (string) $requested_user_id ) );
1306 +
1307 + return ( $current_user_id === $requested_user_id ) ? $current_user_id : 0;
1308 +}
1309 +
1310 +
1456 1311 /** Check if Current User have specific Role
1457 - *
1458 - * @return bool Whether the current user has the given capability.
1312 + *
1313 + * @return bool Whether the current user has the given capability.
1459 1314 */
1460 1315 function wpbm_is_current_user_have_this_role( $user_role ) {
1461 1316
1462 1317 if ( $user_role == 'administrator' ) $user_role = 'activate_plugins';
@@ -1469,64 +1324,44 @@
1469 1324 }
1470 1325
1471 1326
1472 1327 function wpbm_get_user_ip() {
1473 -//return '84.243.195.114' ; // Test //90.36.89.174
1474 - if (isset($_SERVER['HTTP_CLIENT_IP'])) {
1475 - $userIP = $_SERVER['HTTP_CLIENT_IP'] ;
1476 - } elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
1477 - $userIP = $_SERVER['HTTP_X_FORWARDED_FOR'] ;
1478 - } elseif (isset($_SERVER['HTTP_X_FORWARDED'])) {
1479 - $userIP = $_SERVER['HTTP_X_FORWARDED'] ;
1480 - } elseif (isset($_SERVER['HTTP_FORWARDED_FOR'])) {
1481 - $userIP = $_SERVER['HTTP_FORWARDED_FOR'] ;
1482 - } elseif (isset($_SERVER['HTTP_FORWARDED'])) {
1483 - $userIP = $_SERVER['HTTP_FORWARDED'] ;
1484 - } elseif (isset($_SERVER['REMOTE_ADDR'])) {
1485 - $userIP = $_SERVER['REMOTE_ADDR'] ;
1486 - } else {
1487 - $userIP = "" ;
1488 - }
1489 -
1490 - $userIP = explode( ',', $userIP );
1491 - $userIP = array_map( 'trim', $userIP );
1492 -
1493 - return $userIP[0] ;
1328 + return '---';
1494 1329 }
1495 1330 add_wpbm_filter( 'wpbm_get_user_ip', 'wpbm_get_user_ip' );
1496 1331 // </editor-fold>
1497 1332
1498 1333
1499 -// <editor-fold defaultstate="collapsed" desc=" Mesages for Admin panel " >
1500 -////////////////////////////////////////////////////////////////////////////////
1501 -// Mesages for Admin panel
1502 -////////////////////////////////////////////////////////////////////////////////
1334 +// <editor-fold defaultstate="collapsed" desc=" Mesages for Admin panel " >
1335 +////////////////////////////////////////////////////////////////////////////////
1336 +// Mesages for Admin panel
1337 +////////////////////////////////////////////////////////////////////////////////
1503 1338
1504 1339 function wpbm_show_fixed_message( $message, $time_to_show , $message_type = 'updated' , $notice_id = 0, $is_dismissible = false ) {
1505 1340
1506 1341 // Generate unique HTML ID for the message
1507 1342 if ( $notice_id == 0 )
1508 - $notice_id = intval( time() * rand(10, 100) );
1343 + $notice_id = intval( time() * wp_rand(10, 100) );
1509 1344
1510 1345 $notice_id = 'wpbm_system_notice_' . $notice_id;
1511 1346
1512 1347 $is_dismissible = false;
1513 1348
1514 - if (
1349 + if (
1515 1350 ( ( $is_dismissible ) && ( ! wpbm_section_is_dismissed( $notice_id ) ) )
1516 1351 || ( ! $is_dismissible )
1517 - // || true
1352 + // || true
1518 1353 ){
1519 1354
1520 - ?><div id="<?php echo $notice_id; ?>"
1521 - class="wpbm_system_notice wpbm_is_dismissible wpbm_is_hideable <?php echo $message_type; ?>"
1522 - data-nonce="<?php echo wp_create_nonce( $nonce_name = $notice_id . '_wpbmnonce' ); ?>"
1523 - data-user-id="<?php echo get_current_user_id(); ?>"
1524 - ><?php
1355 + ?><div id="<?php echo esc_attr($notice_id); ?>"
1356 + class="wpbm_system_notice wpbm_is_dismissible wpbm_is_hideable <?php echo esc_attr( $message_type ); ?>"
1357 + data-nonce="<?php echo esc_attr(wp_create_nonce( $nonce_name = $notice_id . '_wpbmnonce' )); ?>"
1358 + data-user-id="<?php echo esc_attr(get_current_user_id()); ?>"
1359 + ><?php
1525 1360
1526 1361 wpbm_x_dismiss_button();
1527 1362
1528 - echo $message;
1363 + echo wp_kses_post($message);
1529 1364
1530 1365 ?></div><?php
1531 1366
1532 1367 // Get the time of message showing
@@ -1531,19 +1366,19 @@
1531 1366
1532 1367 // Get the time of message showing
1533 1368 $time_to_show = intval( $time_to_show ) * 1000;
1534 1369
1535 - if ( $time_to_show > 0 ) {
1536 - ?> <script type="text/javascript">
1537 - jQuery('#<?php echo $notice_id; ?>').animate({opacity: 1},<?php echo $time_to_show; ?>).fadeOut( 2000 );
1370 + if ( $time_to_show > 0 ) {
1371 + ?> <script type="text/javascript">
1372 + jQuery('#<?php echo esc_attr($notice_id); ?>').animate({opacity: 1},<?php echo esc_attr( $time_to_show ); ?>).fadeOut( 2000 );
1538 1373 </script> <?php
1539 - }
1540 - }
1374 + }
1375 + }
1541 1376 }
1542 1377
1543 1378
1544 1379 /** Show Ajax message at the top of page
1545 - *
1380 + *
1546 1381 * @param type $message
1547 1382 * @param type $time_to_show
1548 1383 * @param type $is_error
1549 1384 */
@@ -1555,24 +1390,24 @@
1555 1390 // Escape any JavaScript from message
1556 1391 $notice = html_entity_decode( esc_js( $message ) ,ENT_QUOTES) ;
1557 1392
1558 1393 ?><script type="text/javascript">
1559 - var my_message = '<?php echo $notice; ?>';
1560 - wpbm_admin_show_message( my_message, '<?php echo ( $is_error ? 'error' : 'success' ); ?>', <?php echo $time_to_show; ?> );
1394 + var my_message = '<?php echo esc_js( $notice ); ?>';
1395 + wpbm_admin_show_message( my_message, '<?php echo ( $is_error ? 'error' : 'success' ); ?>', <?php echo esc_attr($time_to_show); ?> );
1561 1396 </script><?php
1562 1397 }
1563 1398
1564 1399
1565 1400 /** Show "Saved Changes" message at the top of settings page.
1566 - *
1567 - */
1401 + *
1402 + */
1568 1403 function wpbm_show_changes_saved_message() {
1569 1404 wpbm_show_message ( __('Changes saved.', 'booking-manager'), 5 );
1570 -}
1405 +}
1571 1406
1572 1407
1573 1408 /** Show Message at Top of Admin Pages
1574 - *
1409 + *
1575 1410 * @param type $message - mesage to show
1576 1411 * @param type $time_to_show - number of seconds to show, if 0 or skiped, then unlimited time.
1577 1412 * @param type $message_type - Default: updated { updated | error | notice }
1578 1413 */
@@ -1578,9 +1413,9 @@
1578 1413 */
1579 1414 function wpbm_show_message ( $message, $time_to_show , $message_type = 'updated') {
1580 1415
1581 1416 // Generate unique HTML ID for the message
1582 - $inner_message_id = intval( time() * rand(10, 100) );
1417 + $inner_message_id = intval( time() * wp_rand(10, 100) );
1583 1418
1584 1419 // Get formated HTML message
1585 1420 $notice = wpbm_get_formated_message( $message, $message_type, $inner_message_id );
1586 1421
@@ -1587,13 +1422,16 @@
1587 1422 // Get the time of message showing
1588 1423 $time_to_show = intval( $time_to_show ) * 1000;
1589 1424
1590 1425 // Show this Message
1591 - ?> <script type="text/javascript">
1426 + ?> <script type="text/javascript">
1592 1427 if ( jQuery('.wpbm_admin_message').length ) {
1593 - jQuery('.wpbm_admin_message').append( '<?php echo $notice; ?>' );
1428 + jQuery('.wpbm_admin_message').append( '<?php
1429 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
1430 + echo ($notice);
1431 + ?>' );
1594 1432 <?php if ( $time_to_show > 0 ) { ?>
1595 - jQuery('#wpbm_inner_message_<?php echo $inner_message_id; ?>').animate({opacity: 1},<?php echo $time_to_show; ?>).fadeOut( 2000 );
1433 + jQuery('#wpbm_inner_message_<?php echo esc_attr($inner_message_id); ?>').animate({opacity: 1},<?php echo esc_attr($time_to_show); ?>).fadeOut( 2000 );
1596 1434 <?php } ?>
1597 1435 }
1598 1436 </script> <?php
1599 1437 }
@@ -1599,9 +1437,9 @@
1599 1437 }
1600 1438
1601 1439
1602 1440 /** Escape and prepare message to show it
1603 - *
1441 + *
1604 1442 * @param type $message - message
1605 1443 * @param type $message_type - Default: updated { updated | error | notice }
1606 1444 * @param string $inner_message_id - ID of message DIV, can be skipped
1607 1445 * @return string
@@ -1626,13 +1464,13 @@
1626 1464 }
1627 1465
1628 1466
1629 1467 /** Show system info in settings page
1630 - *
1631 - * @param string $message ...
1468 + *
1469 + * @param string $message ...
1632 1470 * @param string $message_type 'info' | 'warning' | 'error'
1633 1471 * @param string $title __('Important!' , 'booking-manager') | __('Note' , 'booking-manager')
1634 - *
1472 + *
1635 1473 * Exmaple: wpbm_show_message_in_settings( __( 'Nothing Found', 'booking-manager'), 'warning', __('Important!' , 'booking-manager') );
1636 1474 */
1637 1475 function wpbm_show_message_in_settings( $message, $message_type = 'info', $title = '' , $is_echo = true ) {
1638 1476
@@ -1651,9 +1489,9 @@
1651 1489
1652 1490 $message_content .= '<div class="clear"></div>';
1653 1491
1654 1492 if ( $is_echo )
1655 - echo $message_content;
1493 + echo wp_kses_post( $message_content );
1656 1494 else
1657 1495 return $message_content;
1658 1496
1659 1497 }
@@ -1659,12 +1497,12 @@
1659 1497 }
1660 1498 // </editor-fold>
1661 1499
1662 1500
1663 -// <editor-fold defaultstate="collapsed" desc=" Settings Meta Boxes " >
1664 -////////////////////////////////////////////////////////////////////////////////
1501 +// <editor-fold defaultstate="collapsed" desc=" Settings Meta Boxes " >
1502 +////////////////////////////////////////////////////////////////////////////////
1665 1503 // Settings Meta Boxes
1666 -////////////////////////////////////////////////////////////////////////////////
1504 +////////////////////////////////////////////////////////////////////////////////
1667 1505 function wpbm_open_meta_box_section( $metabox_id, $title ) {
1668 1506
1669 1507 $my_close_open_win_id = $metabox_id . '_metabox';
1670 1508 //FixIn: 2.0.16.1
@@ -1670,17 +1508,17 @@
1670 1508 //FixIn: 2.0.16.1
1671 1509 ?>
1672 1510 <div class='meta-box'>
1673 1511 <div
1674 - id="<?php echo $my_close_open_win_id; ?>"
1512 + id="<?php echo esc_attr($my_close_open_win_id); ?>"
1675 1513 class="postbox <?php if ( '1' == get_user_option( 'wpbm_win_' . $my_close_open_win_id ) ) echo 'closed'; ?>"
1676 1514 ><div class="postbox-header" style="display: flex;flex-flow: row nowrap;border-bottom: 1px solid #ccd0d4;"><?php //FixIn: 8.7.8.1 ?>
1677 1515 <h3 class='hndle' style="flex: 1 1 auto;border: none;">
1678 1516 <span><?php echo wp_kses_post( $title ); ?></span>
1679 1517 </h3>
1680 - <div title="<?php _e('Click to toggle','booking-manager'); ?>"
1518 + <div title="<?php echo esc_attr(__('Click to toggle','booking-manager')); ?>"
1681 1519 class="handlediv"
1682 - onclick="javascript:wpbm_verify_window_opening(<?php echo get_wpbm_current_user_id(); ?>, '<?php echo $my_close_open_win_id; ?>');"
1520 + onclick="javascript:wpbm_verify_window_opening(<?php echo esc_attr( get_wpbm_current_user_id() ); ?>, '<?php echo esc_attr($my_close_open_win_id); ?>');"
1683 1521 ><br/></div>
1684 1522 </div>
1685 1523 <div class="inside">
1686 1524 <?php
@@ -1687,11 +1525,11 @@
1687 1525 }
1688 1526
1689 1527 function wpbm_close_meta_box_section() {
1690 1528 ?>
1691 - </div>
1692 - </div>
1693 - </div>
1529 + </div>
1530 + </div>
1531 + </div>
1694 1532 <?php
1695 1533 }
1696 1534 // </editor-fold>
1697 1535
@@ -1696,23 +1534,23 @@
1696 1534 // </editor-fold>
1697 1535
1698 1536
1699 1537 // from Toolbar
1700 -// <editor-fold defaultstate="collapsed" desc=" M o d a l s " >
1701 -////////////////////////////////////////////////////////////////////////////////
1538 +// <editor-fold defaultstate="collapsed" desc=" M o d a l s " >
1539 +////////////////////////////////////////////////////////////////////////////////
1702 1540 // M o d a l s
1703 1541 ////////////////////////////////////////////////////////////////////////////////
1704 1542
1705 -/** Start Loyouts - Modal Window structure */
1543 +/** Start Loyouts - Modal Window structure */
1706 1544 function wpbm_write_content_for_modals_start_here() {
1707 -
1545 +
1708 1546 ?><span id="wpbm_content_for_modals"></span><?php
1709 1547 }
1710 -add_wpbm_action( 'wpbm_write_content_for_modals', 'wpbm_write_content_for_modals_start_here');
1548 +add_wpbm_action( 'wpbm_write_content_for_modals', 'wpbm_write_content_for_modals_start_here');
1711 1549 // </editor-fold>
1712 1550
1713 1551
1714 -// <editor-fold defaultstate="collapsed" desc=" Inline JavaScript " >
1552 +// <editor-fold defaultstate="collapsed" desc=" Inline JavaScript " >
1715 1553 ////////////////////////////////////////////////////////////////////////////////
1716 1554 // Inline J a v a S c r i p t to Footer page
1717 1555 ////////////////////////////////////////////////////////////////////////////////
1718 1556 /**
@@ -1748,9 +1586,9 @@
1748 1586
1749 1587 $wpbm_queued_js = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", $wpbm_queued_js );
1750 1588 $wpbm_queued_js = str_replace( "\r", '', $wpbm_queued_js );
1751 1589
1752 - echo $wpbm_queued_js . "});\n</script>\n<!-- End WPBM JavaScript -->\n";
1590 + echo $wpbm_queued_js . "});\n</script>\n<!-- End WPBM JavaScript -->\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
1753 1591
1754 1592 $wpbm_queued_js = '';
1755 1593 unset( $wpbm_queued_js );
1756 1594 }
@@ -1758,9 +1596,9 @@
1758 1596
1759 1597 // </editor-fold>
1760 1598
1761 1599 // from Toolbar
1762 -// <editor-fold defaultstate="collapsed" desc=" JS & CSS - Tooltips & Popover" >
1600 +// <editor-fold defaultstate="collapsed" desc=" JS & CSS - Tooltips & Popover" >
1763 1601 ////////////////////////////////////////////////////////////////////////////////
1764 1602 // JS & CSS
1765 1603 ////////////////////////////////////////////////////////////////////////////////
1766 1604
@@ -1765,15 +1603,15 @@
1765 1603 ////////////////////////////////////////////////////////////////////////////////
1766 1604
1767 1605 /** Load suport JavaScript for "Items" page*/
1768 1606 function wpbm_js_for_items_page() {
1769 -
1607 +
1770 1608 $is_use_hints = get_wpbm_option( 'wpbm_is_use_hints_at_admin_panel' );
1771 1609 if ( $is_use_hints == 'On' )
1772 1610 wpbm_bs_javascript_tooltips(); // JS Tooltips
1773 1611
1774 - wpbm_bs_javascript_popover(); // JS Popover
1775 -
1612 + wpbm_bs_javascript_popover(); // JS Popover
1613 +
1776 1614 //wpbm_datepicker_js(); // JS Datepicker
1777 1615 wpbm_datepicker_css(); // CSS DatePicker
1778 1616 }
1779 1617
@@ -1779,14 +1617,14 @@
1779 1617
1780 1618
1781 1619 /** Datepicker activation JavaScript */
1782 1620 function wpbm_datepicker_js() {
1783 -
1621 +
1784 1622 ?><script type="text/javascript">
1785 1623 jQuery(document).ready( function(){
1786 1624
1787 1625 function applyCSStoDays( date ){
1788 - return [true, 'date_available'];
1626 + return [true, 'date_available'];
1789 1627 }
1790 1628 jQuery('input.wpbm-filters-section-calendar').datepick(
1791 1629 { beforeShowDay: applyCSStoDays,
1792 1630 showOn: 'focus',
@@ -1797,9 +1635,9 @@
1797 1635 nextText: '&raquo;',
1798 1636 dateFormat: 'yy-mm-dd',
1799 1637 changeMonth: false,
1800 1638 changeYear: false,
1801 - minDate: null,
1639 + minDate: null,
1802 1640 maxDate: null, //'1Y',
1803 1641 showStatus: false,
1804 1642 multiSeparator: ', ',
1805 1643 closeAtTop: false,
@@ -1810,9 +1648,9 @@
1810 1648 mandatory: true
1811 1649 }
1812 1650 );
1813 1651 });
1814 - </script><?php
1652 + </script><?php
1815 1653 }
1816 1654
1817 1655
1818 1656 /** Support CSS - datepick, etc... */
@@ -1848,16 +1686,16 @@
1848 1686 height: auto;
1849 1687 }
1850 1688 </style>
1851 1689 <?php
1852 -}
1690 +}
1853 1691
1854 1692
1855 1693 /** Sortable Table JavaScript */
1856 1694 function wpbm_sortable_js() {
1857 1695 ?>
1858 - <script type="text/javascript">
1859 - // Activate Sortable Functionality
1696 + <script type="text/javascript">
1697 + // Activate Sortable Functionality
1860 1698 jQuery( document ).ready(function(){
1861 1699
1862 1700 jQuery('.wpbm_input_table tbody th').css('cursor','move');
1863 1701
@@ -1881,20 +1719,20 @@
1881 1719 });
1882 1720 });
1883 1721 </script>
1884 1722 <?php
1885 -
1723 +
1886 1724 }
1887 1725 // </editor-fold>
1888 1726
1889 1727
1890 -// <editor-fold defaultstate="collapsed" desc=" R e l o a d p a g e " >
1728 +// <editor-fold defaultstate="collapsed" desc=" R e l o a d p a g e " >
1891 1729 ////////////////////////////////////////////////////////////////////////////////
1892 1730 // R e l o a d p a g e
1893 1731 ////////////////////////////////////////////////////////////////////////////////
1894 1732 /**
1895 1733 * Reload page by using JavaScript
1896 - *
1734 + *
1897 1735 * @param string $url - URL of page to load
1898 1736 */
1899 1737 function wpbm_reload_page_by_js( $url ) {
1900 1738
@@ -1901,10 +1739,10 @@
1901 1739 $redir = html_entity_decode( esc_url( $url ) );
1902 1740
1903 1741 if ( ! empty( $redir ) ) {
1904 1742 ?>
1905 - <script type="text/javascript">
1906 - window.location.href = '<?php echo $redir ?>';
1743 + <script type="text/javascript">
1744 + window.location.href = '<?php echo esc_url($redir); ?>';
1907 1745 </script>
1908 1746 <?php
1909 1747 }
1910 1748 }
@@ -1910,9 +1748,9 @@
1910 1748 }
1911 1749
1912 1750
1913 1751 /** Redirect browser to a specific page
1914 - *
1752 + *
1915 1753 * @param string $url - URL of page to redirect
1916 1754 */
1917 1755 function wpbm_redirect( $url ) {
1918 1756
@@ -1920,20 +1758,20 @@
1920 1758
1921 1759 $url = html_entity_decode( esc_url( $url ) );
1922 1760
1923 1761 echo '<script type="text/javascript">';
1924 - echo 'window.location.href="'.$url.'";';
1762 + echo 'window.location.href="'.esc_url($url).'";';
1925 1763 echo '</script>';
1926 1764 echo '<noscript>';
1927 - echo '<meta http-equiv="refresh" content="0;url='.$url.'" />';
1765 + echo '<meta http-equiv="refresh" content="0;url='.esc_url($url).'" />';
1928 1766 echo '</noscript>';
1929 1767 }
1930 1768 // </editor-fold>
1931 1769
1932 1770
1933 -// <editor-fold defaultstate="collapsed" desc=" P a g i n a t i o n o f T a b l e L i s t i n g " >
1771 +// <editor-fold defaultstate="collapsed" desc=" P a g i n a t i o n o f T a b l e L i s t i n g " >
1934 1772 /** Show P a g i n a t i o n
1935 - *
1773 + *
1936 1774 * @param int $summ_number_of_items - total number of items
1937 1775 * @param int $active_page_num - number of activated page
1938 1776 * @param int $num_items_per_page - number of items per page
1939 1777 * @param array $only_these_parameters - array of keys to exclude from links
@@ -1949,11 +1787,10 @@
1949 1787 if ( $pages_number < 2 )
1950 1788 return;
1951 1789
1952 1790 //Fix: 5.1.4 - Just in case we are having tooo much resources, then we need to show all resources - and its empty string
1953 - if ( ( isset($_REQUEST['wh_wpbm_type'] ) ) && ( strlen($_REQUEST['wh_wpbm_type']) > 1000 ) ) {
1954 - $_REQUEST['wh_wpbm_type'] = '';
1955 - }
1791 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
1792 + if ( ( isset($_REQUEST['wh_wpbm_type'] ) ) && ( strlen($_REQUEST['wh_wpbm_type']) > 1000 ) ) { $_REQUEST['wh_wpbm_type'] = ''; }
1956 1793
1957 1794 // First parameter will overwriten by $_GET['page'] parameter
1958 1795 $bk_admin_url = wpbm_get_params_in_url( wpbm_get_master_url( false ), array('page_num'), $only_these_parameters );
1959 1796
@@ -1959,9 +1796,9 @@
1959 1796
1960 1797
1961 1798 ?>
1962 1799 <span class="wpdevelop wpbm-pagination">
1963 - <div class="container-fluid">
1800 + <div class="container-fluid">
1964 1801 <div class="row">
1965 1802 <div class="col-sm-12 text-center control-group0">
1966 1803 <nav class="btn-toolbar">
1967 1804 <div class="btn-group wpbm-no-margin" style="float:none;">
@@ -1966,13 +1803,13 @@
1966 1803 <nav class="btn-toolbar">
1967 1804 <div class="btn-group wpbm-no-margin" style="float:none;">
1968 1805
1969 1806 <?php if ( $pages_number > 1 ) { ?>
1970 - <a class="button button-secondary <?php echo ( $active_page_num == 1 ) ? ' disabled' : ''; ?>"
1971 - href="<?php echo $bk_admin_url; ?>&page_num=<?php if ($active_page_num == 1) { echo $active_page_num; } else { echo ($active_page_num-1); } echo $url_sufix; ?>">
1972 - <?php _e('Prev', 'booking-manager'); ?>
1807 + <a class="button button-secondary <?php echo ( $active_page_num == 1 ) ? ' disabled' : ''; ?>"
1808 + href="<?php echo esc_url($bk_admin_url); ?>&page_num=<?php if ($active_page_num == 1) { echo esc_attr( $active_page_num ); } else { echo esc_attr($active_page_num-1); } echo esc_attr( $url_sufix ); ?>">
1809 + <?php esc_html_e('Prev', 'booking-manager'); ?>
1973 1810 </a>
1974 - <?php }
1811 + <?php }
1975 1812
1976 1813 /** Number visible pages (links) that linked to active page, other pages skipped by "..." */
1977 1814 $num_closed_steps = 3;
1978 1815
@@ -1977,23 +1814,23 @@
1977 1814 $num_closed_steps = 3;
1978 1815
1979 1816 for ( $pg_num = 1; $pg_num <= $pages_number; $pg_num++ ) {
1980 1817
1981 - if ( ! (
1982 - ( $pages_number > ( $num_closed_steps * 4) )
1983 - && ( $pg_num > $num_closed_steps )
1984 - && ( ( $pages_number - $pg_num + 1 ) > $num_closed_steps )
1985 - && ( abs( $active_page_num - $pg_num ) > $num_closed_steps )
1818 + if ( ! (
1819 + ( $pages_number > ( $num_closed_steps * 4) )
1820 + && ( $pg_num > $num_closed_steps )
1821 + && ( ( $pages_number - $pg_num + 1 ) > $num_closed_steps )
1822 + && ( abs( $active_page_num - $pg_num ) > $num_closed_steps )
1986 1823 ) ) {
1987 - ?> <a class="button button-secondary <?php if ($pg_num == $active_page_num ) echo ' active'; ?>"
1988 - href="<?php echo $bk_admin_url; ?>&page_num=<?php echo $pg_num; echo $url_sufix; ?>">
1989 - <?php echo $pg_num; ?>
1990 - </a><?php
1824 + ?> <a class="button button-secondary <?php if ($pg_num == $active_page_num ) echo ' active'; ?>"
1825 + href="<?php echo esc_attr( $bk_admin_url ); ?>&page_num=<?php echo esc_attr( $pg_num); echo esc_attr( $url_sufix); ?>">
1826 + <?php echo esc_html($pg_num); ?>
1827 + </a><?php
1991 1828
1992 - if ( ( $pages_number > ( $num_closed_steps * 4) )
1993 - && ( ($pg_num+1) > $num_closed_steps )
1994 - && ( ( $pages_number - ( $pg_num + 1 ) ) > $num_closed_steps )
1995 - && ( abs($active_page_num - ( $pg_num + 1 ) ) > $num_closed_steps )
1829 + if ( ( $pages_number > ( $num_closed_steps * 4) )
1830 + && ( ($pg_num+1) > $num_closed_steps )
1831 + && ( ( $pages_number - ( $pg_num + 1 ) ) > $num_closed_steps )
1832 + && ( abs($active_page_num - ( $pg_num + 1 ) ) > $num_closed_steps )
1996 1833 ) {
1997 1834 echo ' <a class="button button-secondary disabled" href="javascript:void(0);">...</a> ';
1998 1835 }
1999 1836 }
@@ -1999,11 +1836,11 @@
1999 1836 }
2000 1837 }
2001 1838
2002 1839 if ( $pages_number > 1 ) { ?>
2003 - <a class="button button-secondary <?php echo ( $active_page_num == $pages_number ) ? ' disabled' : ''; ?>"
2004 - href="<?php echo $bk_admin_url; ?>&page_num=<?php if ($active_page_num == $pages_number) { echo $active_page_num; } else { echo ($active_page_num+1); } echo $url_sufix; ?>">
2005 - <?php _e('Next', 'booking-manager'); ?>
1840 + <a class="button button-secondary <?php echo ( $active_page_num == $pages_number ) ? ' disabled' : ''; ?>"
1841 + href="<?php echo esc_attr( $bk_admin_url ); ?>&page_num=<?php if ($active_page_num == $pages_number) { echo esc_attr( $active_page_num); } else { echo esc_attr($active_page_num+1); } echo esc_attr( $url_sufix); ?>">
1842 + <?php esc_html_e('Next', 'booking-manager'); ?>
2006 1843 </a>
2007 1844 <?php } ?>
2008 1845
2009 1846 </div>
@@ -2016,9 +1853,9 @@
2016 1853 }
2017 1854 // </editor-fold>
2018 1855
2019 1856
2020 -// <editor-fold defaultstate="collapsed" desc=" D a t e s " >
1857 +// <editor-fold defaultstate="collapsed" desc=" D a t e s " >
2021 1858 ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
2022 1859 // Dates Format
2023 1860 ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
2024 1861
@@ -2023,9 +1860,9 @@
2023 1860 ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
2024 1861
2025 1862
2026 1863 /** Get Formated Date & time
2027 - *
1864 + *
2028 1865 * @param string $date_sql - 2017-07-31 00:00:00 || 2017-07-31
2029 1866 * @param string $date_format - Optional. - "m / d / Y, D H:i:s"
2030 1867 * @param string $seperator - Optional. - " "
2031 1868 * @return string - July 29, 2014 12:00 am
@@ -2030,21 +1867,21 @@
2030 1867 * @param string $seperator - Optional. - " "
2031 1868 * @return string - July 29, 2014 12:00 am
2032 1869 */
2033 1870 function wpbm_get_date_time_formatted( $date_sql, $date_format = false, $seperator = ' ', $skip_midnight_time = false ) {
2034 -
1871 +
2035 1872 $return_date = wpbm_get_date_formatted( $date_sql, $date_format );
2036 -
2037 - $return_time = wpbm_get_time_formatted( $date_sql, $date_format, $skip_midnight_time );
1873 +
1874 + $return_time = wpbm_get_time_formatted( $date_sql, $date_format, $skip_midnight_time );
2038 1875 if ( ! empty( $return_time ) )
2039 1876 $return_date .= $seperator . $return_time;
2040 -
1877 +
2041 1878 return $return_date;
2042 1879 }
2043 1880
2044 1881
2045 1882 /** Get Formated Date
2046 - *
1883 + *
2047 1884 * @param string $date_sql - 2017-07-31 00:00:00 || 2017-07-31
2048 1885 * @param string $date_format - Optional. - "m / d / Y, D"
2049 1886 * @param bool $skip_midnight_time - Default false - if 00:00:00 then return '';
2050 1887 * @return string - July 29, 2014
@@ -2052,17 +1889,17 @@
2052 1889 function wpbm_get_date_formatted( $date_sql, $date_format = false ) {
2053 1890
2054 1891 if ( $date_format === false ) $date_format = get_wpbm_option( 'wpbm_date_format' );
2055 1892 if ( empty( $date_format ) ) $date_format = "m / d / Y, D";
2056 -
1893 +
2057 1894 $formated_date = date_i18n( $date_format, strtotime( $date_sql ) );
2058 -
1895 +
2059 1896 return $formated_date;
2060 1897 }
2061 1898
2062 1899
2063 1900 /** Get Formated Date & time
2064 - *
1901 + *
2065 1902 * @param string $date_sql - 2017-07-31 00:00:00 || 2017-07-31
2066 1903 * @param string $time_format - Optional. - "H:i:s"
2067 1904 * @return string - 12:00 am
2068 1905 */
@@ -2069,20 +1906,20 @@
2069 1906 function wpbm_get_time_formatted( $date_sql, $time_format = false , $skip_midnight_time = false ) {
2070 1907
2071 1908 if ( ( $skip_midnight_time ) && ( '00:00:00' == substr( $date_sql, -8 ) ) )
2072 1909 return '';
2073 -
1910 +
2074 1911 if ( $time_format === false ) $time_format = get_wpbm_option( 'wpbm_time_format' );
2075 1912 if ( empty( $time_format ) ) $time_format = 'h:i a';
2076 -
1913 +
2077 1914 $formated_date = date_i18n( $time_format, strtotime( $date_sql ) );
2078 -
2079 - return $formated_date;
1915 +
1916 + return $formated_date;
2080 1917 }
2081 1918
2082 1919
2083 1920 /** Check if "current_day" is tomorrow from "next_day"
2084 - *
1921 + *
2085 1922 * @param string $current_day_sql_check : 2015-02-29 00:00:00
2086 1923 * @param string $next_day_sql_check : 2015-02-30 00:00:00
2087 1924 * @return boolean : true | false
2088 1925 */
@@ -2089,28 +1926,28 @@
2089 1926 function wpbm_is_next_day( $current_day_sql_check, $next_day_sql_check ) {
2090 1927
2091 1928 // Current day
2092 1929 $current_day_unix = strtotime( $current_day_sql_check );
2093 -
1930 +
2094 1931 $current_day_midnight_sql = date_i18n( 'Y-m-d', $current_day_unix );
2095 1932 $current_day_midnight_unix = strtotime( $current_day_midnight_sql );
2096 -
1933 +
2097 1934 $calc_next_day_unix = strtotime( '+1 day', $current_day_midnight_unix );
2098 -
1935 +
2099 1936 // Next day
2100 - $next_day_unix = strtotime( $next_day_sql_check );
1937 + $next_day_unix = strtotime( $next_day_sql_check );
2101 1938 $next_day_midnight_sql = date_i18n( 'Y-m-d', $next_day_unix );
2102 1939 $next_day_midnight_unix = strtotime( $next_day_midnight_sql );
2103 -
2104 -
2105 - if ( $calc_next_day_unix == $next_day_midnight_unix )
2106 - return true;
2107 - else
2108 - return false;
1940 +
1941 +
1942 + if ( $calc_next_day_unix == $next_day_midnight_unix )
1943 + return true;
1944 + else
1945 + return false;
2109 1946 }
2110 1947
2111 1948 /** Check if "current_day" is same day of "other_day"
2112 - *
1949 + *
2113 1950 * @param string $current_day_sql_check : 2015-02-29 00:00:00
2114 1951 * @param string $other_day_sql_check : 2015-02-30 00:00:00
2115 1952 * @return boolean : true | false
2116 1953 */
@@ -2117,27 +1954,27 @@
2117 1954 function wpbm_is_this_same_day( $current_day_sql_check, $other_day_sql_check ) {
2118 1955
2119 1956 // Current day
2120 1957 $current_day_unix = strtotime( $current_day_sql_check );
2121 -
1958 +
2122 1959 $current_day_midnight_sql = date_i18n( 'Y-m-d', $current_day_unix );
2123 1960 $current_day_midnight_unix = strtotime( $current_day_midnight_sql );
2124 -
1961 +
2125 1962 // Other day
2126 - $other_day_unix = strtotime( $other_day_sql_check );
1963 + $other_day_unix = strtotime( $other_day_sql_check );
2127 1964 $other_day_midnight_sql = date_i18n( 'Y-m-d', $other_day_unix );
2128 1965 $other_day_midnight_unix = strtotime( $other_day_midnight_sql );
2129 -
2130 -
2131 - if ( $current_day_midnight_unix == $other_day_midnight_unix )
2132 - return true;
2133 - else
2134 - return false;
1966 +
1967 +
1968 + if ( $current_day_midnight_unix == $other_day_midnight_unix )
1969 + return true;
1970 + else
1971 + return false;
2135 1972 }
2136 1973
2137 1974
2138 1975 /** Get days in short format view
2139 - *
1976 + *
2140 1977 * @param string $days Dates: 15.05.2015, 16.05.2015, 17.05.2015
2141 1978 * @return string Dates in format: 15.05.2015 - 17.05.2015
2142 1979 */
2143 1980 function wpbm_get_dates_short_format( $dates_sql_csv ) { // $days - string with comma seperated dates
@@ -2151,24 +1988,24 @@
2151 1988 $result_string = '';
2152 1989 $last_show_day = '';
2153 1990
2154 1991 foreach ( $days as $day ) {
2155 -
1992 +
2156 1993 $is_fin_at_end = false;
2157 -
1994 +
2158 1995 if ( $previosday === false ) { // First Day
2159 -
1996 +
2160 1997 $result_string = wpbm_get_date_time_formatted( $day, false, ' ', true ); // echo format for first day
2161 1998 $last_show_day = $day;
2162 1999 $previosday = $day; // Set previos day for next loop
2163 -
2000 +
2164 2001 } else { // Not first day
2165 -
2166 - if (
2167 - wpbm_is_next_day( $previosday, $day )
2168 - || wpbm_is_this_same_day( $previosday, $day )
2002 +
2003 + if (
2004 + wpbm_is_next_day( $previosday, $day )
2005 + || wpbm_is_this_same_day( $previosday, $day )
2169 2006 ) { // Check if $day next day from previous
2170 -
2007 +
2171 2008 $previosday = $day; // Set previos day for next loop
2172 2009 $is_fin_at_end = true;
2173 2010 } else {
2174 2011 if ( $last_show_day !== $previosday ) { // check if previos day was show or no
@@ -2177,10 +2014,10 @@
2177 2014 $result_string .= ', ' . wpbm_get_date_time_formatted( $day, false, ' ', true ); // assign in needed format this day
2178 2015 $previosday = $day; // Set previos day for next loop
2179 2016 $last_show_day = $day;
2180 2017 }
2181 - }
2182 -
2018 + }
2019 +
2183 2020 }
2184 2021
2185 2022 if ( $is_fin_at_end ) {
2186 2023 $result_string .= ' - ' . wpbm_get_date_time_formatted( $day, false, ' ', true );
@@ -2188,5 +2025,5 @@
2188 2025
2189 2026 return $result_string;
2190 2027 }
2191 2028
2192 -// </editor-fold>
2029 +// </editor-fold>