| @@ -5,10 +5,9 @@ | ||
| 5 | 5 | |
| 6 | 6 | class CoolClock_Widget extends WP_Widget { |
| 7 | 7 | |
| 8 | 8 | /** PHP5+ constructor */ |
| 9 | - public function __construct() | |
| 10 | - { | |
| 9 | + public function __construct() { | |
| 11 | 10 | parent::__construct( |
| 12 | 11 | 'coolclock-widget', |
| 13 | 12 | __('Analog Clock', 'coolclock'), |
| 14 | 13 | array( |
| @@ -22,10 +21,9 @@ | ||
| 22 | 21 | ); |
| 23 | 22 | } |
| 24 | 23 | |
| 25 | 24 | /** @see WP_Widget::widget -- do not rename this */ |
| 26 | - public function widget( $args, $instance ) | |
| 27 | - { | |
| 25 | + public function widget( $args, $instance ) { | |
| 28 | 26 | extract( $args ); |
| 29 | 27 | |
| 30 | 28 | $defaults = array_merge( array('title'=>'','custom_skin'=>''), CoolClock::$defaults, CoolClock::$advanced_defaults ); |
| 31 | 29 | |
| @@ -32,23 +30,24 @@ | ||
| 32 | 30 | // backward compat |
| 33 | 31 | if ( isset($instance['digitalcolor']) && !isset($instance['fontcolor']) ) $instance['fontcolor'] = $instance['digitalcolor']; |
| 34 | 32 | |
| 35 | 33 | $title = !empty($instance['title']) ? apply_filters( 'widget_title', $instance['title'] ) : ''; |
| 36 | - $number = $this->number; | |
| 34 | + //$number = $this->number; | |
| 37 | 35 | |
| 38 | 36 | // set footer script flags |
| 39 | 37 | CoolClock::$add_script = true; |
| 40 | 38 | |
| 41 | 39 | // Print output |
| 42 | - echo $before_widget; | |
| 40 | + echo wp_kses_post( $before_widget ); | |
| 43 | 41 | |
| 44 | - if ( $title ) | |
| 45 | - echo $before_title . $title . $after_title; | |
| 42 | + if ( $title ) { | |
| 43 | + echo wp_kses_post( $before_title ) . esc_html( $title ) . wp_kses_post( $after_title ); | |
| 44 | + } | |
| 46 | 45 | |
| 47 | 46 | // set skin |
| 48 | 47 | $instance['skin'] = CoolClock::parse_skin( |
| 49 | - !empty( $instance['skin'] ) ? $instance['skin'] : $defaults['skin'], | |
| 50 | - !empty( $instance['custom_skin'] ) ? $instance['custom_skin'] : '' | |
| 48 | + ! empty( $instance['skin'] ) ? $instance['skin'] : $defaults['skin'], | |
| 49 | + ! empty( $instance['custom_skin'] ) ? $instance['custom_skin'] : '' | |
| 51 | 50 | ); |
| 52 | 51 | |
| 53 | 52 | // radius, used in wrapper style and coolclock fields |
| 54 | 53 | $instance['radius'] = !empty( $instance['radius'] ) && is_numeric( $instance['radius'] ) ? (int) $instance['radius'] : $defaults['radius']; |
| @@ -76,17 +75,29 @@ | ||
| 76 | 75 | $output .= CoolClock::canvas( $instance ); |
| 77 | 76 | // end wrapper |
| 78 | 77 | $output .= '</div>'; |
| 79 | 78 | |
| 80 | - // Print filtered output | |
| 81 | - echo apply_filters( 'coolclock_widget', $output, $args, $instance ); | |
| 79 | + // Print filtered output. wp_kses_post() strips <canvas>, so extend its | |
| 80 | + // allowed tags rather than using it directly (which would silently | |
| 81 | + // remove the clock). | |
| 82 | + $allowed_html = array_merge( | |
| 83 | + wp_kses_allowed_html( 'post' ), | |
| 84 | + array( | |
| 85 | + 'canvas' => array( | |
| 86 | + 'class' => true, | |
| 87 | + 'style' => true, | |
| 88 | + 'width' => true, | |
| 89 | + 'height' => true, | |
| 90 | + ), | |
| 91 | + ) | |
| 92 | + ); | |
| 93 | + echo wp_kses( apply_filters( 'coolclock_widget', $output, $args, $instance ), $allowed_html ); | |
| 82 | 94 | |
| 83 | - echo $after_widget; | |
| 95 | + echo wp_kses_post( $after_widget ); | |
| 84 | 96 | } |
| 85 | 97 | |
| 86 | 98 | /** @see WP_Widget::update -- do not rename this */ |
| 87 | - public function update( $new_instance, $old_instance ) | |
| 88 | - { | |
| 99 | + public function update( $new_instance, $old_instance ) { | |
| 89 | 100 | // parse custom skin code |
| 90 | 101 | $skin_array = !empty($new_instance['custom_skin']) ? CoolClock::skin_array( wp_strip_all_tags( $new_instance['custom_skin'] ) ) : array(); |
| 91 | 102 | |
| 92 | 103 | $instance['title'] = !empty($new_instance['title']) ? wp_strip_all_tags( $new_instance['title'] ) : ''; |
| @@ -104,10 +115,9 @@ | ||
| 104 | 115 | return apply_filters( 'coolclock_widget_update_advanced', $instance, $new_instance ); |
| 105 | 116 | } |
| 106 | 117 | |
| 107 | 118 | /** @see WP_Widget::form -- do not rename this */ |
| 108 | - public function form( $instance ) | |
| 109 | - { | |
| 119 | + public function form( $instance ) { | |
| 110 | 120 | $output = ''; |
| 111 | 121 | $advanced = ''; |
| 112 | 122 | |
| 113 | 123 | // backward compat |
| @@ -156,9 +166,9 @@ | ||
| 156 | 166 | ); |
| 157 | 167 | |
| 158 | 168 | // Translatable show digital options go here |
| 159 | 169 | $showdigital_names = array ( |
| 160 | - '' => translate('No'), | |
| 170 | + '' => __( 'No', 'coolclock' ), | |
| 161 | 171 | 'digital12' => __('time (am/pm)','coolclock'), |
| 162 | 172 | 'digital24' => __('time (24h)','coolclock'), |
| 163 | 173 | 'date' => __('date','coolclock'), |
| 164 | 174 | 'digital12+' => __('time + seconds (am/pm)','coolclock'), |
| @@ -165,21 +175,16 @@ | ||
| 165 | 175 | 'digital24+' => __('time + seconds (24h)','coolclock'), |
| 166 | 176 | 'text' => __('custom text','coolclock') |
| 167 | 177 | ); |
| 168 | 178 | |
| 169 | - // Misc translations | |
| 170 | - $stray = array( | |
| 171 | - 'extra_settings' => __('Extra settings for the CoolClock widget.', 'coolclock') | |
| 172 | - ); | |
| 173 | - | |
| 174 | 179 | // Title |
| 175 | 180 | $output .= '<style type="text/css">#available-widgets [class*=clock] .widget-title:before{content:"\f469"}</style> |
| 176 | - <p><label for="' . $this->get_field_id('title') . '">' . __('Title:') . '</label> '; | |
| 181 | + <p><label for="' . $this->get_field_id('title') . '">' . __( 'Title:', 'coolclock' ) . '</label> '; | |
| 177 | 182 | $output .= '<input class="widefat" id="' . $this->get_field_id('title') . '" name="' . $this->get_field_name('title') . '" type="text" value="' . $title . '" /></p>'; |
| 178 | 183 | |
| 179 | 184 | // Clock settings |
| 180 | - $output .= '<p><strong>' . __('Clock', 'coolclock') . '</strong></p>'; | |
| 181 | - $output .= '<p><a href="https://premium.status301.com/coolclock-widget-settings/" target="_blank">' . __('CoolClock widget instructions »', 'coolclock') . '</a></p>'; | |
| 185 | + $output .= '<fieldset><legend>' . __('Clock', 'coolclock') . '</legend>'; | |
| 186 | + $output .= '<p class="description"><a href="https://premium.status301.com/coolclock-widget-settings/" target="_blank">' . __('CoolClock widget instructions »', 'coolclock') . '</a></p>'; | |
| 182 | 187 | |
| 183 | 188 | $output .= '<p><label for="' . $this->get_field_id('skin') . '">' . __('Skin:', 'coolclock') . '</label> '; |
| 184 | 189 | $output .= '<select class="select" id="' . $this->get_field_id('skin') . '" name="' . $this->get_field_name('skin') . '">'; |
| 185 | 190 | $output .= '<option value="' . $defaults['skin'] . '" ' . selected( $defaults['skin'], $instance['skin'], false ) . '>'; |
| @@ -194,11 +199,16 @@ | ||
| 194 | 199 | $output .= __('Custom (define below)', 'coolclock') . '</option></select></p>'; |
| 195 | 200 | |
| 196 | 201 | // Custom skin field |
| 197 | 202 | $output .= '<p><label for="' . $this->get_field_id('custom_skin') . '">' . __('Custom skin parameters:', 'coolclock') . '</label> '; |
| 198 | - $output .= '<textarea class="widefat" id="' . $this->get_field_id('custom_skin') . '" name="' . $this->get_field_name('custom_skin') . '">' . $custom_skin . '</textarea> '; | |
| 199 | - $output .= '<em>' . sprintf( __('(set Skin to Custom above, then add %s here)', 'coolclock'), '<a href="https://premium.status301.com/coolclock-custom-skin/" target="_blank">' . __('parameters in JSON format', 'coolclock') . '</a>' ) . '</em></p>'; | |
| 203 | + $output .= '<textarea class="widefat" id="' . $this->get_field_id('custom_skin') . '" name="' . $this->get_field_name('custom_skin') . '">' . $custom_skin . '</textarea></p>'; | |
| 200 | 204 | |
| 205 | + $output .= '<p class="description"><em>' . sprintf( | |
| 206 | + /* translators: %s: link to the JSON parameters documentation */ | |
| 207 | + __( '(set Skin to Custom above, then add %s here)', 'coolclock' ), | |
| 208 | + '<a href="https://premium.status301.com/coolclock-custom-skin/" target="_blank">' . __( 'parameters in JSON format', 'coolclock' ) . '</a>' | |
| 209 | + ) . '</em></p>'; | |
| 210 | + | |
| 201 | 211 | // Radius |
| 202 | 212 | $output .= '<p><label for="' . $this->get_field_id('radius') . '">' . __('Radius:', 'coolclock') . '</label> '; |
| 203 | 213 | $output .= '<input class="small-text" id="' . $this->get_field_id('radius') . '" name="' . $this->get_field_name('radius') . '" type="number" min="10" value="' . $instance['radius'] . '" /></p>'; |
| 204 | 214 | |
| @@ -210,9 +220,9 @@ | ||
| 210 | 220 | // Align |
| 211 | 221 | $output .= '<p><label for="' . $this->get_field_id('align') . '">' . __('Align:', 'coolclock') . '</label> '; |
| 212 | 222 | $output .= '<select class="select" id="' . $this->get_field_id('align') . '" name="' . $this->get_field_name('align') . '">'; |
| 213 | 223 | $output .= '<option value="">'; |
| 214 | - $output .= translate('none') . '</option>'; | |
| 224 | + $output .= __( 'none', 'coolclock' ) . '</option>'; | |
| 215 | 225 | $output .= '<option value="left" ' . selected( $instance['align'], 'left', false ) . '>'; |
| 216 | 226 | $output .= __('left', 'coolclock') . '</option>'; |
| 217 | 227 | $output .= '<option value="right" ' . selected( $instance['align'], 'right', false ) . '>'; |
| 218 | 228 | $output .= __('right', 'coolclock') . '</option>'; |
| @@ -221,23 +231,23 @@ | ||
| 221 | 231 | $output .= '</select></p>'; |
| 222 | 232 | |
| 223 | 233 | // Subtext |
| 224 | 234 | $output .= '<p><label for="' . $this->get_field_id('subtext') . '">' . __('Subtext:', 'coolclock') . '</label> '; |
| 225 | - $output .= '<input class="widefat" id="' . $this->get_field_id('subtext') . '" name="' . $this->get_field_name('subtext') . '" type="text" value="' . $subtext . '" /> <em>' . __('(basic HTML allowed)', 'coolclock') . '</em></p>'; | |
| 235 | + $output .= '<input class="widefat" id="' . $this->get_field_id('subtext') . '" name="' . $this->get_field_name('subtext') . '" type="text" value="' . $subtext . '" /> <span class="description"><em>' . __('(basic HTML allowed)', 'coolclock') . '</em></span></p>'; | |
| 226 | 236 | |
| 227 | - $output .= '<div class="coolclock-advanced" style="background-color:rgba(0,0,0,.03);padding:1px 7px;border-radius:5px;margin-bottom:10px">'; | |
| 237 | + $output .= '</fieldset>'; //<div class="coolclock-advanced" style="background-color:rgba(0,0,0,.03);padding:1px 7px;border-radius:5px;margin-bottom:10px">'; | |
| 228 | 238 | |
| 229 | - $output .= '<p><strong>' . translate('Advanced') . '</strong></p>'; | |
| 239 | + $output .= '<fieldset><legend>' . __( 'Advanced', 'coolclock' ) . '</legend>'; | |
| 230 | 240 | |
| 231 | 241 | // Use GMT offset |
| 232 | 242 | $output .= '<p><label for="' . $this->get_field_id('gmtoffset') . '">' . __('GMT offset:', 'coolclock') . '</label> '; |
| 233 | - $output .= '<input class="small-text" id="' . $this->get_field_id('gmtoffset') . '" name="' . $this->get_field_name('gmtoffset') . '" type="number" step="0.5" value="' . $instance['gmtoffset'] . '" /> <em>' . __('(leave blank for visitor local time)', 'coolclock') . '</em></p>'; | |
| 243 | + $output .= '<input class="small-text" id="' . $this->get_field_id('gmtoffset') . '" name="' . $this->get_field_name('gmtoffset') . '" type="number" step="0.5" value="' . $instance['gmtoffset'] . '" /> <span class="description"><em>' . __('(leave blank for visitor local time)', 'coolclock') . '</em></span></p>'; | |
| 234 | 244 | |
| 235 | 245 | // Scale |
| 236 | 246 | $output .= '<p><label for="' . $this->get_field_id('scale') . '">' . __('Scale:', 'coolclock') . '</label> '; |
| 237 | 247 | $output .= '<select class="select" id="' . $this->get_field_id('scale') . '" name="' . $this->get_field_name('scale') . '">'; |
| 238 | 248 | foreach ( CoolClock::$clock_types as $key => $value ) { |
| 239 | - $output .= '<option value="' . $key . '" ' . selected( $key, strtolower($instance['scale']), false ) . '>'; | |
| 249 | + $output .= '<option value="' . $key . '" ' . selected( $key, strtolower($instance['scale']), false ) . '">'; | |
| 240 | 250 | $output .= ( isset($type_names[$key]) ) ? $type_names[$key] : $value; |
| 241 | 251 | $output .= '</option>'; |
| 242 | 252 | } |
| 243 | 253 | $output .= '</select></p>'; |
| @@ -255,12 +265,13 @@ | ||
| 255 | 265 | } |
| 256 | 266 | $output .= '</select></p>'; |
| 257 | 267 | |
| 258 | 268 | $output .= '<p><label for="' . $this->get_field_id('fontcolor') . '">' . __('Digital font color:', 'coolclock') . '</label> '; |
| 259 | - $output .= '<input id="' . $this->get_field_id('fontcolor') . '" name="' . $this->get_field_name('fontcolor') . '" type="text" value="' . $instance['fontcolor'] . '" /> <em>' . __('(use a valid HTML color code or name)', 'coolclock') . '</em></p>'; | |
| 269 | + $output .= '<input id="' . $this->get_field_id('fontcolor') . '" name="' . $this->get_field_name('fontcolor') . '" type="text" value="' . $instance['fontcolor'] . '" /> <span class="description"><em>' . __('(use a valid HTML color code or name)', 'coolclock') . '</em></span></p>'; | |
| 270 | + $output .= '</fieldset>'; | |
| 260 | 271 | |
| 261 | - $advanced .= '<p><a href="https://premium.status301.com/downloads/coolclock-advanced/">' . __('More digital font options »', 'coolclock') . '</a></p> | |
| 262 | - <p><strong>' . __('Background') . '</strong></p><p><a href="https://premium.status301.com/downloads/coolclock-advanced/">' . __('Available in the Advanced extension »', 'coolclock') . '</a></p>'; | |
| 272 | + $advanced .= '<p class="description"><a href="https://premium.status301.com/downloads/coolclock-advanced/">' . __('More digital font options »', 'coolclock') . '</a></p> | |
| 273 | + <fieldset><legend>' . __( 'Background', 'coolclock' ) . '</legend><p class="description"><a href="https://premium.status301.com/downloads/coolclock-advanced/">' . __('Available in the Advanced extension »', 'coolclock') . '</a></p></fieldset>'; | |
| 263 | 274 | |
| 264 | 275 | // Advanced filter |
| 265 | 276 | $output .= apply_filters( 'coolclock_widget_form_advanced', $advanced, $this, $instance, $defaults ); |
| 266 | 277 | |
| @@ -269,8 +280,40 @@ | ||
| 269 | 280 | if ( class_exists( 'CoolClockAdvanced' ) && isset(CoolClockAdvanced::$plugin_version) && version_compare( CoolClockAdvanced::$plugin_version, '7.1', '<' ) ) { // add an upgrade notice |
| 270 | 281 | $output .= '<div class="update-nag"><strong>' . __('Please upgrade the CoolClock - Advanced extension.', 'coolclock') . '</strong> '. ' <a href="https://premium.status301.com/account/" target="_blank">' . __('Please log in with your account credentials here.', 'coolclock') . '</a>' . __('You can download the new version using the link in the downloads list.', 'coolclock') . '</div>'; |
| 271 | 282 | } |
| 272 | 283 | |
| 273 | - echo $output; | |
| 284 | + // wp_kses_post() strips form controls (input/select/option/textarea/style), | |
| 285 | + // which would silently break this settings screen. Extend the allowed | |
| 286 | + // tags with what an admin settings form actually needs instead. | |
| 287 | + $allowed_html = array_merge( | |
| 288 | + wp_kses_allowed_html( 'post' ), | |
| 289 | + array( | |
| 290 | + 'style' => array( 'type' => true ), | |
| 291 | + 'input' => array( | |
| 292 | + 'id' => true, | |
| 293 | + 'class' => true, | |
| 294 | + 'name' => true, | |
| 295 | + 'type' => true, | |
| 296 | + 'value' => true, | |
| 297 | + 'min' => true, | |
| 298 | + 'step' => true, | |
| 299 | + 'checked' => true, | |
| 300 | + ), | |
| 301 | + 'select' => array( | |
| 302 | + 'id' => true, | |
| 303 | + 'class' => true, | |
| 304 | + 'name' => true, | |
| 305 | + ), | |
| 306 | + 'option' => array( | |
| 307 | + 'value' => true, | |
| 308 | + 'selected' => true, | |
| 309 | + ), | |
| 310 | + 'textarea' => array( | |
| 311 | + 'id' => true, | |
| 312 | + 'class' => true, | |
| 313 | + 'name' => true, | |
| 314 | + ), | |
| 315 | + ) | |
| 316 | + ); | |
| 317 | + echo wp_kses( $output, $allowed_html ); | |
| 274 | 318 | } |
| 275 | - | |
| 276 | 319 | } |
