| @@ -148,30 +148,11 @@ | ||
| 148 | 148 | <?php |
| 149 | 149 | if ( count( $this->sections ) > 1 ) { |
| 150 | 150 | $this->display_section_nav( $active_section ); |
| 151 | 151 | } |
| 152 | + ?> | |
| 152 | 153 | |
| 153 | - /** | |
| 154 | - * Defines the settings form's method. | |
| 155 | - * | |
| 156 | - * @since 3.0.0 | |
| 157 | - * | |
| 158 | - * @param string $form_method The method of the form. | |
| 159 | - * @param string $active_section The active section. | |
| 160 | - */ | |
| 161 | - $form_method = apply_filters( 'convertkit_admin_settings_form_method', 'post', $active_section ); | |
| 162 | - | |
| 163 | - /** | |
| 164 | - * Defines the settings form's action URL. | |
| 165 | - * | |
| 166 | - * @since 3.0.0 | |
| 167 | - * | |
| 168 | - * @param string $form_action_url The URL to submit the form to. | |
| 169 | - * @param string $active_section The active section. | |
| 170 | - */ | |
| 171 | - $form_action_url = apply_filters( 'convertkit_admin_settings_form_action_url', admin_url( 'options.php' ), $active_section ); | |
| 172 | - ?> | |
| 173 | - <form method="<?php echo esc_attr( $form_method ); ?>" action="<?php echo esc_url( $form_action_url ); ?>" enctype="multipart/form-data"> | |
| 154 | + <form method="post" action="options.php" enctype="multipart/form-data"> | |
| 174 | 155 | <?php |
| 175 | 156 | // Iterate through sections to find the active section to render. |
| 176 | 157 | if ( isset( $this->sections[ $active_section ] ) ) { |
| 177 | 158 | $this->sections[ $active_section ]->render(); |
| @@ -206,10 +187,10 @@ | ||
| 206 | 187 | * @return string Tab Name |
| 207 | 188 | */ |
| 208 | 189 | private function get_active_section() { |
| 209 | 190 | |
| 210 | - if ( filter_has_var( INPUT_GET, 'tab' ) ) { | |
| 211 | - return filter_input( INPUT_GET, 'tab', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); | |
| 191 | + if ( isset( $_GET['tab'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification | |
| 192 | + return sanitize_text_field( wp_unslash( $_GET['tab'] ) ); // phpcs:ignore WordPress.Security.NonceVerification | |
| 212 | 193 | } |
| 213 | 194 | |
| 214 | 195 | // First registered section will be the active section. |
| 215 | 196 | return current( $this->sections )->name; |
| @@ -268,12 +249,9 @@ | ||
| 268 | 249 | ) |
| 269 | 250 | ), |
| 270 | 251 | ( $active_section === $section->name ? 'convertkit-tab-active' : '' ), |
| 271 | 252 | esc_html( $section->tab_text ), |
| 272 | - wp_kses( | |
| 273 | - $section->is_beta ? $this->get_beta_tab() : '', | |
| 274 | - convertkit_kses_allowed_html() | |
| 275 | - ) | |
| 253 | + $section->is_beta ? $this->get_beta_tab() : '' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 276 | 254 | ); |
| 277 | 255 | } |
| 278 | 256 | ?> |
| 279 | 257 | </ul> |
| @@ -288,9 +266,10 @@ | ||
| 288 | 266 | |
| 289 | 267 | } |
| 290 | 268 | |
| 291 | 269 | /** |
| 292 | - * Returns a 'beta' tab wrapped in a span. | |
| 270 | + * Returns a 'beta' tab wrapped in a span, using wp_kses to ensure only permitted | |
| 271 | + * HTML elements are included in the output. | |
| 293 | 272 | * |
| 294 | 273 | * @since 2.1.0 |
| 295 | 274 | * |
| 296 | 275 | * @return string |
| @@ -296,9 +275,16 @@ | ||
| 296 | 275 | * @return string |
| 297 | 276 | */ |
| 298 | 277 | private function get_beta_tab() { |
| 299 | 278 | |
| 300 | - return '<span class="convertkit-beta-label">' . esc_html__( 'Beta', 'convertkit' ) . '</span>'; | |
| 279 | + return wp_kses( | |
| 280 | + '<span class="convertkit-beta-label">' . esc_html__( 'Beta', 'convertkit' ) . '</span>', | |
| 281 | + array( | |
| 282 | + 'span' => array( | |
| 283 | + 'class' => array(), | |
| 284 | + ), | |
| 285 | + ) | |
| 286 | + ); | |
| 301 | 287 | |
| 302 | 288 | } |
| 303 | 289 | |
| 304 | 290 | /** |
