| @@ -1,6 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | +defined( 'ABSPATH' ) || exit; | |
| 4 | + | |
| 5 | + | |
| 3 | 6 | class Dfrapi_SearchForm |
| 4 | 7 | { |
| 5 | 8 | function fields() { |
| 6 | 9 | |
| @@ -453,13 +456,13 @@ | ||
| 453 | 456 | ($this->useSelected ? $this->selectedNetworks() : $this->allNetworks()) : |
| 454 | 457 | $this->selectedMerchants(); |
| 455 | 458 | |
| 456 | 459 | foreach($all as $obj) { |
| 457 | - $id = $obj['_id']; | |
| 458 | - $nid = ($kind == 'network') ? $obj['_id'] : $obj['source_id']; | |
| 459 | - $group_class = $this->groupClass($nid); | |
| 460 | + $id = absint($obj['_id']); | |
| 461 | + $nid = absint(($kind == 'network') ? $obj['_id'] : $obj['source_id']); | |
| 462 | + $group_class = esc_attr($this->groupClass($nid)); | |
| 460 | 463 | |
| 461 | - $name = $obj['name']; | |
| 464 | + $name = esc_html($obj['name']); | |
| 462 | 465 | $checked = in_array($id, $value) ? "checked='checked'" : ""; |
| 463 | 466 | |
| 464 | 467 | $cells .= " |
| 465 | 468 | <div class='inline_frame_element nid_{$nid}'> |
| @@ -491,9 +494,9 @@ | ||
| 491 | 494 | $all = ($kind == 'network') ? $this->allNetworks() : dfrapi_api_get_merchants_by_id($value); |
| 492 | 495 | $names = array(); |
| 493 | 496 | foreach($all as $obj) { |
| 494 | 497 | if(in_array($obj['_id'], $value)) { |
| 495 | - $names []= "<span>{$obj['name']}</span>"; | |
| 498 | + $names []= '<span>' . esc_html($obj['name']) . '</span>'; | |
| 496 | 499 | if(count($names) >= $maxNames) |
| 497 | 500 | break; |
| 498 | 501 | } |
| 499 | 502 | } |
| @@ -505,9 +508,9 @@ | ||
| 505 | 508 | } |
| 506 | 509 | |
| 507 | 510 | function chooseBox($kind, $field, $index, $value) { |
| 508 | 511 | $pfx = $this->inputPrefix($index); |
| 509 | - $value = implode(',', $this->ary($value)); | |
| 512 | + $value = esc_attr(implode(',', $this->ary($value))); | |
| 510 | 513 | $choose = __( 'choose', 'datafeedr-api' ); |
| 511 | 514 | return " |
| 512 | 515 | <div class='dfrapi_choose_box' rel='{$kind}'> |
| 513 | 516 | <span class='names'></span> |
| @@ -518,9 +521,9 @@ | ||
| 518 | 521 | } |
| 519 | 522 | |
| 520 | 523 | function ajaxHandler() { |
| 521 | 524 | $command = $this->get( $_POST, 'command' ); |
| 522 | - $value = $this->ary( $this->get( $_POST, 'value' ) ); | |
| 525 | + $value = array_values( array_unique( array_filter( array_map( 'absint', $this->ary( $this->get( $_POST, 'value' ) ) ) ) ) ); | |
| 523 | 526 | $this->useSelected = (int) $this->get( $_POST, 'useSelected', 1 ); |
| 524 | 527 | |
| 525 | 528 | if ( $command === 'choose_network' ) { |
| 526 | 529 | return $this->networksMerchantsPopup( 'network', $value ); |
