| @@ -92,8 +92,9 @@ | ||
| 92 | 92 | $notification = false; |
| 93 | 93 | |
| 94 | 94 | if (isset($_GET['bulk_trashed']) && $_GET['bulk_trashed'] > 0) { |
| 95 | 95 | $count = intval($_GET['bulk_trashed']); |
| 96 | + /* translators: %s: number of items. */ | |
| 96 | 97 | easy_invoice_display_notification('success', sprintf(_n('%s payment moved to trash.', '%s payments moved to trash.', $count, 'easy-invoice'), $count)); |
| 97 | 98 | $notification = true; |
| 98 | 99 | } |
| 99 | 100 | |
| @@ -98,8 +99,9 @@ | ||
| 98 | 99 | } |
| 99 | 100 | |
| 100 | 101 | if (isset($_GET['bulk_restored']) && $_GET['bulk_restored'] > 0) { |
| 101 | 102 | $count = intval($_GET['bulk_restored']); |
| 103 | + /* translators: %s: number of items. */ | |
| 102 | 104 | easy_invoice_display_notification('success', sprintf(_n('%s payment restored from trash.', '%s payments restored from trash.', $count, 'easy-invoice'), $count)); |
| 103 | 105 | $notification = true; |
| 104 | 106 | } |
| 105 | 107 | |
| @@ -104,8 +106,9 @@ | ||
| 104 | 106 | } |
| 105 | 107 | |
| 106 | 108 | if (isset($_GET['bulk_deleted']) && $_GET['bulk_deleted'] > 0) { |
| 107 | 109 | $count = intval($_GET['bulk_deleted']); |
| 110 | + /* translators: %s: number of items. */ | |
| 108 | 111 | easy_invoice_display_notification('success', sprintf(_n('%s payment permanently deleted.', '%s payments permanently deleted.', $count, 'easy-invoice'), $count)); |
| 109 | 112 | $notification = true; |
| 110 | 113 | } |
| 111 | 114 | |
| @@ -127,10 +130,10 @@ | ||
| 127 | 130 | <div class="p-8"> |
| 128 | 131 | <div class="ei-app-page-header bg-white border-b border-gray-200 px-6" style="margin-left: -2rem; margin-top: -2rem; margin-right: -2rem; padding-left: 2rem; padding-right: 2rem;"> |
| 129 | 132 | <div class="flex items-center justify-between"> |
| 130 | 133 | <div> |
| 131 | - <h1 class="text-2xl font-bold text-gray-900"><?php _e('Payments', 'easy-invoice'); ?></h1> | |
| 132 | - <p class="mt-1 text-sm text-gray-500"><?php _e('Manage all payment records', 'easy-invoice'); ?></p> | |
| 134 | + <h1 class="text-2xl font-bold text-gray-900"><?php esc_html_e('Payments', 'easy-invoice'); ?></h1> | |
| 135 | + <p class="mt-1 text-sm text-gray-500"><?php esc_html_e('Manage all payment records', 'easy-invoice'); ?></p> | |
| 133 | 136 | </div> |
| 134 | 137 | <div class="flex items-center space-x-3"> |
| 135 | 138 | <?php |
| 136 | 139 | // "Export All" is part of the bulk_operations addon |
| @@ -140,14 +143,14 @@ | ||
| 140 | 143 | ?> |
| 141 | 144 | <?php if ($ei_bulk_ops_loaded): ?> |
| 142 | 145 | <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" style="display:inline;"> |
| 143 | 146 | <input type="hidden" name="action" value="easy_invoice_export_all_payments" /> |
| 144 | - <input type="hidden" name="_wpnonce" value="<?php echo wp_create_nonce('easy_invoice_export_all_payments'); ?>" /> | |
| 147 | + <input type="hidden" name="_wpnonce" value="<?php echo esc_attr(wp_create_nonce('easy_invoice_export_all_payments')); ?>" /> | |
| 145 | 148 | <button type="submit" class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-indigo-700 bg-indigo-100 hover:bg-indigo-200 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"> |
| 146 | 149 | <svg class="w-4 h-4 mr-2 text-indigo-500" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 147 | 150 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"></path> |
| 148 | 151 | </svg> |
| 149 | - <?php _e('Export All', 'easy-invoice'); ?> | |
| 152 | + <?php esc_html_e('Export All', 'easy-invoice'); ?> | |
| 150 | 153 | </button> |
| 151 | 154 | </form> |
| 152 | 155 | <?php elseif (!easy_invoice_has_pro()): ?> |
| 153 | 156 | <button type="button" id="export-all-payments-btn" class="premium-export-btn inline-flex items-center px-4 py-2 border border-gray-300 text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 transition-colors duration-200 relative"> |
| @@ -153,9 +156,9 @@ | ||
| 153 | 156 | <button type="button" id="export-all-payments-btn" class="premium-export-btn inline-flex items-center px-4 py-2 border border-gray-300 text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 transition-colors duration-200 relative"> |
| 154 | 157 | <svg class="w-4 h-4 mr-2 text-gray-500" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 155 | 158 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"></path> |
| 156 | 159 | </svg> |
| 157 | - <?php _e('Export All', 'easy-invoice'); ?> | |
| 160 | + <?php esc_html_e('Export All', 'easy-invoice'); ?> | |
| 158 | 161 | <svg class="ml-2 w-5 h-5 text-purple-600 crown-icon" fill="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 159 | 162 | <path d="M12 8L15 13.2L18 10.5L17.3 14H6.7L6 10.5L9 13.2L12 8M12 4L8.5 10L3 5L5 16H19L21 5L15.5 10L12 4Z"/> |
| 160 | 163 | </svg> |
| 161 | 164 | </button> |
| @@ -172,14 +175,16 @@ | ||
| 172 | 175 | }); |
| 173 | 176 | </script> |
| 174 | 177 | <?php endif; ?> |
| 175 | 178 | |
| 176 | - <a href="?page=easy-invoice-payment-new" class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"> | |
| 179 | + <?php if (easy_invoice_user_can('ei_record_payment')) : ?> | |
| 180 | +<a href="?page=easy-invoice-payment-new" class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"> | |
| 177 | 181 | <svg class="w-4 h-4 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 178 | 182 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 6v6m0 0v6m0-6h6m-6 0H6"></path> |
| 179 | 183 | </svg> |
| 180 | - <?php _e('Add New Payment', 'easy-invoice'); ?> | |
| 184 | + <?php esc_html_e('Add New Payment', 'easy-invoice'); ?> | |
| 181 | 185 | </a> |
| 186 | +<?php endif; ?> | |
| 182 | 187 | </div> |
| 183 | 188 | </div> |
| 184 | 189 | </div> |
| 185 | 190 | |
| @@ -191,10 +196,10 @@ | ||
| 191 | 196 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"></path> |
| 192 | 197 | </svg> |
| 193 | 198 | </div> |
| 194 | 199 | <div> |
| 195 | - <h3 class="text-sm font-medium text-gray-500">Total Payments</h3> | |
| 196 | - <p class="mt-1 text-2xl font-bold text-gray-900"><?php echo $stats['total_payments']; ?></p> | |
| 200 | + <h3 class="text-sm font-medium text-gray-500"><?php esc_html_e('Total Payments', 'easy-invoice'); ?></h3> | |
| 201 | + <p class="mt-1 text-2xl font-bold text-gray-900"><?php echo esc_html($stats['total_payments']); ?></p> | |
| 197 | 202 | </div> |
| 198 | 203 | </div> |
| 199 | 204 | </div> |
| 200 | 205 | <div class="bg-white rounded-lg shadow p-6 transition-transform duration-300 hover:shadow-md hover:-translate-y-1"> |
| @@ -204,20 +209,20 @@ | ||
| 204 | 209 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8c-1.657 0-3 .895-3 2s1.343 2 3 2 3 .895 3 2-1.343 2-3 2m0-8c1.11 0 2.08.402 2.599 1M12 8V7m0 1v8m0 0v1m0-1c-1.11 0-2.08-.402-2.599-1M21 12a9 9 0 11-18 0 9 9 0 0118 0z"></path> |
| 205 | 210 | </svg> |
| 206 | 211 | </div> |
| 207 | 212 | <div> |
| 208 | - <h3 class="text-sm font-medium text-gray-500">Total Amount</h3> | |
| 213 | + <h3 class="text-sm font-medium text-gray-500"><?php esc_html_e('Total Amount', 'easy-invoice'); ?></h3> | |
| 209 | 214 | <?php if (!empty($amounts_by_currency)): ?> |
| 210 | 215 | <div class="mt-1"> |
| 211 | 216 | <?php foreach ($amounts_by_currency as $currency => $data): ?> |
| 212 | 217 | <p class="text-lg font-bold text-gray-900"> |
| 213 | - <?php echo $data['symbol'] . number_format($data['amount'], 2); ?> | |
| 214 | - <span class="text-sm font-normal text-gray-500"><?php echo strtoupper($currency ?? 'USD'); ?></span> | |
| 218 | + <?php echo esc_html($data['symbol'] . number_format($data['amount'], 2)); ?> | |
| 219 | + <span class="text-sm font-normal text-gray-500"><?php echo esc_html(strtoupper($currency ?? 'USD')); ?></span> | |
| 215 | 220 | </p> |
| 216 | 221 | <?php endforeach; ?> |
| 217 | 222 | </div> |
| 218 | 223 | <?php else: ?> |
| 219 | - <p class="mt-1 text-lg font-bold text-gray-900"><?php echo get_option('easy_invoice_currency_symbol', '$') . '0.00'; ?></p> | |
| 224 | + <p class="mt-1 text-lg font-bold text-gray-900"><?php echo esc_html(get_option('easy_invoice_currency_symbol', '$') . '0.00'); ?></p> | |
| 220 | 225 | <?php endif; ?> |
| 221 | 226 | </div> |
| 222 | 227 | </div> |
| 223 | 228 | </div> |
| @@ -228,10 +233,10 @@ | ||
| 228 | 233 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"></path> |
| 229 | 234 | </svg> |
| 230 | 235 | </div> |
| 231 | 236 | <div> |
| 232 | - <h3 class="text-sm font-medium text-gray-500">Completed Payments</h3> | |
| 233 | - <p class="mt-1 text-2xl font-bold text-green-600"><?php echo $stats['completed_payments']; ?></p> | |
| 237 | + <h3 class="text-sm font-medium text-gray-500"><?php esc_html_e('Completed Payments', 'easy-invoice'); ?></h3> | |
| 238 | + <p class="mt-1 text-2xl font-bold text-green-600"><?php echo esc_html($stats['completed_payments']); ?></p> | |
| 234 | 239 | </div> |
| 235 | 240 | </div> |
| 236 | 241 | </div> |
| 237 | 242 | <div class="bg-white rounded-lg shadow p-6 transition-transform duration-300 hover:shadow-md hover:-translate-y-1"> |
| @@ -241,10 +246,10 @@ | ||
| 241 | 246 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"></path> |
| 242 | 247 | </svg> |
| 243 | 248 | </div> |
| 244 | 249 | <div> |
| 245 | - <h3 class="text-sm font-medium text-gray-500">Pending Payments</h3> | |
| 246 | - <p class="mt-1 text-2xl font-bold text-yellow-600"><?php echo $stats['pending_payments']; ?></p> | |
| 250 | + <h3 class="text-sm font-medium text-gray-500"><?php esc_html_e('Pending Payments', 'easy-invoice'); ?></h3> | |
| 251 | + <p class="mt-1 text-2xl font-bold text-yellow-600"><?php echo esc_html($stats['pending_payments']); ?></p> | |
| 247 | 252 | </div> |
| 248 | 253 | </div> |
| 249 | 254 | </div> |
| 250 | 255 | </div> |
| @@ -306,9 +311,9 @@ | ||
| 306 | 311 | if ($link && strpos($link, 'bg-indigo-50') === false && strpos($link, 'bg-white') === false) { |
| 307 | 312 | $link = easy_invoice_str_replace('border-gray-300', 'border-gray-300 bg-white text-gray-500 hover:bg-gray-50', $link); |
| 308 | 313 | } |
| 309 | 314 | |
| 310 | - echo $link; | |
| 315 | + echo wp_kses_post($link); | |
| 311 | 316 | } |
| 312 | 317 | echo '</div>'; |
| 313 | 318 | } |
| 314 | 319 | ?> |
| @@ -334,11 +339,11 @@ | ||
| 334 | 339 | $class = $is_current |
| 335 | 340 | ? 'border-b-2 border-indigo-500 text-indigo-600 bg-white' |
| 336 | 341 | : 'border-b-2 border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300'; |
| 337 | 342 | ?> |
| 338 | - <a href="?page=easy-invoice-payments&view=<?php echo $view . $status_param; ?>" | |
| 339 | - class="flex items-center whitespace-nowrap py-4 px-6 font-medium text-sm transition-colors duration-200 <?php echo $class; ?>"> | |
| 340 | - <?php echo $label; ?> | |
| 343 | + <a href="?page=easy-invoice-payments&view=<?php echo esc_attr($view . $status_param); ?>" | |
| 344 | + class="flex items-center whitespace-nowrap py-4 px-6 font-medium text-sm transition-colors duration-200 <?php echo esc_attr($class); ?>"> | |
| 345 | + <?php echo esc_html($label); ?> | |
| 341 | 346 | </a> |
| 342 | 347 | <?php } ?> |
| 343 | 348 | </nav> |
| 344 | 349 | </div> |
| @@ -351,16 +356,16 @@ | ||
| 351 | 356 | <form id="bulk-action-form" method="post" class="flex items-center gap-2"> |
| 352 | 357 | <?php wp_nonce_field('easy_invoice_payment_bulk_action', 'easy_invoice_payment_bulk_nonce'); ?> |
| 353 | 358 | <input type="hidden" name="action" value="easy_invoice_payment_bulk_action"> |
| 354 | 359 | |
| 355 | - <select name="bulk_action" class="block w-full px-3 py-2 border border-gray-300 rounded-md leading-5 bg-white text-gray-700 placeholder-gray-500 focus:outline-none focus:placeholder-gray-400 focus:ring-1 focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm"> | |
| 356 | - <option value="">Bulk Actions</option> | |
| 360 | + <select name="bulk_action" aria-label="Bulk action for selected payments" class="block w-full px-3 py-2 border border-gray-300 rounded-md leading-5 bg-white text-gray-700 placeholder-gray-500 focus:outline-none focus:placeholder-gray-400 focus:ring-1 focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm"> | |
| 361 | + <option value=""><?php esc_html_e('Bulk Actions', 'easy-invoice'); ?></option> | |
| 357 | 362 | <?php if ($current_view === 'trash'): ?> |
| 358 | - <option value="restore">Restore</option> | |
| 359 | - <option value="delete">Delete Permanently</option> | |
| 363 | + <option value="restore"><?php esc_html_e('Restore', 'easy-invoice'); ?></option> | |
| 364 | + <option value="delete"><?php esc_html_e('Delete Permanently', 'easy-invoice'); ?></option> | |
| 360 | 365 | <?php else: ?> |
| 361 | - <option value="trash">Move to Trash</option> | |
| 362 | - <option value="delete">Delete Permanently</option> | |
| 366 | + <option value="trash"><?php esc_html_e('Move to Trash', 'easy-invoice'); ?></option> | |
| 367 | + <option value="delete"><?php esc_html_e('Delete Permanently', 'easy-invoice'); ?></option> | |
| 363 | 368 | <?php endif; ?> |
| 364 | 369 | </select> |
| 365 | 370 | |
| 366 | 371 | <button type="submit" class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"> |
| @@ -378,13 +383,13 @@ | ||
| 378 | 383 | <table class="min-w-full divide-y divide-gray-200 ei-payments-table"> |
| 379 | 384 | <thead class="bg-gray-50"> |
| 380 | 385 | <tr> |
| 381 | 386 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider"> |
| 382 | - <input type="checkbox" id="select-all-payments" class="rounded border-gray-300 text-indigo-600 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50"> | |
| 387 | + <input type="checkbox" id="select-all-payments" aria-label="Select all payments on this page" class="rounded border-gray-300 text-indigo-600 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50"> | |
| 383 | 388 | </th> |
| 384 | 389 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="id"> |
| 385 | 390 | <div class="flex items-center space-x-1"> |
| 386 | - <span>Payment ID</span> | |
| 391 | + <span><?php esc_html_e('Payment ID', 'easy-invoice'); ?></span> | |
| 387 | 392 | <div class="sort-indicator"> |
| 388 | 393 | <i class="fas fa-sort text-gray-400"></i> |
| 389 | 394 | </div> |
| 390 | 395 | </div> |
| @@ -390,9 +395,9 @@ | ||
| 390 | 395 | </div> |
| 391 | 396 | </th> |
| 392 | 397 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="invoice"> |
| 393 | 398 | <div class="flex items-center space-x-1"> |
| 394 | - <span>Invoice</span> | |
| 399 | + <span><?php esc_html_e('Invoice', 'easy-invoice'); ?></span> | |
| 395 | 400 | <div class="sort-indicator"> |
| 396 | 401 | <i class="fas fa-sort text-gray-400"></i> |
| 397 | 402 | </div> |
| 398 | 403 | </div> |
| @@ -398,9 +403,9 @@ | ||
| 398 | 403 | </div> |
| 399 | 404 | </th> |
| 400 | 405 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="amount"> |
| 401 | 406 | <div class="flex items-center space-x-1"> |
| 402 | - <span>Amount</span> | |
| 407 | + <span><?php esc_html_e('Amount', 'easy-invoice'); ?></span> | |
| 403 | 408 | <div class="sort-indicator"> |
| 404 | 409 | <i class="fas fa-sort text-gray-400"></i> |
| 405 | 410 | </div> |
| 406 | 411 | </div> |
| @@ -406,9 +411,9 @@ | ||
| 406 | 411 | </div> |
| 407 | 412 | </th> |
| 408 | 413 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="method"> |
| 409 | 414 | <div class="flex items-center space-x-1"> |
| 410 | - <span>Method</span> | |
| 415 | + <span><?php esc_html_e('Method', 'easy-invoice'); ?></span> | |
| 411 | 416 | <div class="sort-indicator"> |
| 412 | 417 | <i class="fas fa-sort text-gray-400"></i> |
| 413 | 418 | </div> |
| 414 | 419 | </div> |
| @@ -414,9 +419,9 @@ | ||
| 414 | 419 | </div> |
| 415 | 420 | </th> |
| 416 | 421 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="status"> |
| 417 | 422 | <div class="flex items-center space-x-1"> |
| 418 | - <span>Status</span> | |
| 423 | + <span><?php esc_html_e('Status', 'easy-invoice'); ?></span> | |
| 419 | 424 | <div class="sort-indicator"> |
| 420 | 425 | <i class="fas fa-sort text-gray-400"></i> |
| 421 | 426 | </div> |
| 422 | 427 | </div> |
| @@ -422,9 +427,9 @@ | ||
| 422 | 427 | </div> |
| 423 | 428 | </th> |
| 424 | 429 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100" data-sort="date"> |
| 425 | 430 | <div class="flex items-center space-x-1"> |
| 426 | - <span>Date</span> | |
| 431 | + <span><?php esc_html_e('Date', 'easy-invoice'); ?></span> | |
| 427 | 432 | <div class="sort-indicator"> |
| 428 | 433 | <i class="fas fa-sort text-gray-400"></i> |
| 429 | 434 | </div> |
| 430 | 435 | </div> |
| @@ -430,9 +435,9 @@ | ||
| 430 | 435 | </div> |
| 431 | 436 | </th> |
| 432 | 437 | <th scope="col" class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider cursor-pointer hover:bg-gray-100 hidden sm:table-cell" data-sort="type"> |
| 433 | 438 | <div class="flex items-center space-x-1"> |
| 434 | - <span>Type</span> | |
| 439 | + <span><?php esc_html_e('Type', 'easy-invoice'); ?></span> | |
| 435 | 440 | <div class="sort-indicator"> |
| 436 | 441 | <i class="fas fa-sort text-gray-400"></i> |
| 437 | 442 | </div> |
| 438 | 443 | </div> |
| @@ -454,12 +459,12 @@ | ||
| 454 | 459 | // Temporarily show all payments regardless of invoice |
| 455 | 460 | ?> |
| 456 | 461 | <tr> |
| 457 | 462 | <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900"> |
| 458 | - <input type="checkbox" name="payment_ids[]" value="<?php echo $payment->getId(); ?>" form="bulk-action-form" class="payment-checkbox rounded border-gray-300 text-indigo-600 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50"> | |
| 463 | + <input type="checkbox" name="payment_ids[]" value="<?php echo (int) $payment->getId(); ?>" form="bulk-action-form" class="payment-checkbox rounded border-gray-300 text-indigo-600 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50"> | |
| 459 | 464 | </td> |
| 460 | 465 | <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900"> |
| 461 | - #<?php echo $payment->getId(); ?> | |
| 466 | + #<?php echo (int) $payment->getId(); ?> | |
| 462 | 467 | </td> |
| 463 | 468 | <td class="px-6 py-4 text-sm text-gray-500"> |
| 464 | 469 | <?php if ($invoice_id): ?> |
| 465 | 470 | <?php |
| @@ -467,10 +472,10 @@ | ||
| 467 | 472 | if ($invoice_post && $invoice_post->post_type === 'easy_invoice'): |
| 468 | 473 | $invoice = new \EasyInvoice\Models\Invoice($invoice_id); |
| 469 | 474 | ?> |
| 470 | 475 | <div> |
| 471 | - <a href="<?php echo get_permalink($invoice->getId()); ?>" class="text-indigo-600 hover:text-indigo-900 font-medium" target="_blank"> | |
| 472 | - <?php echo $invoice->getNumber(); ?> | |
| 476 | + <a href="<?php echo esc_url(get_permalink($invoice->getId())); ?>" class="text-indigo-600 hover:text-indigo-900 font-medium" target="_blank"> | |
| 477 | + <?php echo esc_html($invoice->getNumber()); ?> | |
| 473 | 478 | </a> |
| 474 | 479 | <div class="text-xs text-gray-400 mt-1"> |
| 475 | 480 | <?php echo esc_html($invoice->getTitle() ?: __('Untitled Invoice', 'easy-invoice')); ?> |
| 476 | 481 | </div> |
| @@ -476,22 +481,22 @@ | ||
| 476 | 481 | </div> |
| 477 | 482 | </div> |
| 478 | 483 | <?php else: ?> |
| 479 | 484 | <span class="text-gray-400"> |
| 480 | - <?php _e('Invoice not found', 'easy-invoice'); ?> | |
| 485 | + <?php esc_html_e('Invoice not found', 'easy-invoice'); ?> | |
| 481 | 486 | <?php if (current_user_can('manage_options')): ?> |
| 482 | - <br><small class="text-xs text-gray-500">ID: <?php echo $invoice_id; ?> (Type: <?php echo $invoice_post ? $invoice_post->post_type : 'null'; ?>)</small> | |
| 487 | + <br><small class="text-xs text-gray-500">ID: <?php echo (int) $invoice_id; ?> (Type: <?php echo esc_html($invoice_post ? $invoice_post->post_type : 'null'); ?>)</small> | |
| 483 | 488 | <?php endif; ?> |
| 484 | 489 | </span> |
| 485 | 490 | <?php endif; ?> |
| 486 | 491 | <?php else: ?> |
| 487 | 492 | <span class="text-gray-400"> |
| 488 | - <?php _e('No invoice ID', 'easy-invoice'); ?> | |
| 493 | + <?php esc_html_e('No invoice ID', 'easy-invoice'); ?> | |
| 489 | 494 | </span> |
| 490 | 495 | <?php endif; ?> |
| 491 | 496 | </td> |
| 492 | 497 | <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500"> |
| 493 | - <?php echo $payment->getCurrencySymbol() . number_format($payment->getAmount(), 2); ?> | |
| 498 | + <?php echo esc_html($payment->getCurrencySymbol() . number_format((float) $payment->getAmount(), 2)); ?> | |
| 494 | 499 | </td> |
| 495 | 500 | <td class="px-6 py-4 text-sm text-gray-500"> |
| 496 | 501 | <?php |
| 497 | 502 | // Get payment method label dynamically from registered gateways |
| @@ -540,27 +545,27 @@ | ||
| 540 | 545 | $status_class = 'bg-gray-100 text-gray-800'; |
| 541 | 546 | $status_text = ucfirst($status); |
| 542 | 547 | } |
| 543 | 548 | ?> |
| 544 | - <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium <?php echo $status_class; ?>"> | |
| 545 | - <?php echo $status_text; ?> | |
| 549 | + <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium <?php echo esc_attr($status_class); ?>"> | |
| 550 | + <?php echo esc_html($status_text); ?> | |
| 546 | 551 | </span> |
| 547 | 552 | </td> |
| 548 | 553 | <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500"> |
| 549 | - <?php echo $payment->getPaymentDate() ? date('M j, Y', strtotime($payment->getPaymentDate())) : date('M j, Y', strtotime($payment->getPost()->post_date)); ?> | |
| 554 | + <?php echo esc_html($payment->getPaymentDate() ? gmdate('M j, Y', strtotime($payment->getPaymentDate())) : gmdate('M j, Y', strtotime((string) get_post_field('post_date', $payment->getId())) ?: time())); ?> | |
| 550 | 555 | </td> |
| 551 | 556 | <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500 hidden sm:table-cell"> |
| 552 | - <?php echo ucfirst($payment->getPaymentType() ?: 'one-time'); ?> | |
| 557 | + <?php echo esc_html(ucfirst($payment->getPaymentType() ?: 'one-time')); ?> | |
| 553 | 558 | </td> |
| 554 | 559 | <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium"> |
| 555 | 560 | <div class="flex items-center space-x-2"> |
| 556 | - <a href="?page=easy-invoice-payments&action=view&id=<?php echo $payment->getId(); ?>" class="text-indigo-600 hover:text-indigo-900"> | |
| 561 | + <a href="?page=easy-invoice-payments&action=view&id=<?php echo (int) $payment->getId(); ?>" class="text-indigo-600 hover:text-indigo-900"> | |
| 557 | 562 | <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 558 | 563 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path> |
| 559 | 564 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path> |
| 560 | 565 | </svg> |
| 561 | 566 | </a> |
| 562 | - <a href="?page=easy-invoice-payments&action=edit&id=<?php echo $payment->getId(); ?>" class="text-blue-600 hover:text-blue-900"> | |
| 567 | + <a href="?page=easy-invoice-payments&action=edit&id=<?php echo (int) $payment->getId(); ?>" class="text-blue-600 hover:text-blue-900"> | |
| 563 | 568 | <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 564 | 569 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"></path> |
| 565 | 570 | </svg> |
| 566 | 571 | </a> |
| @@ -565,11 +570,11 @@ | ||
| 565 | 570 | </svg> |
| 566 | 571 | </a> |
| 567 | 572 | <?php if (in_array($status, ['pending', 'pending-bank', 'pending-cheque'])): ?> |
| 568 | 573 | <button type="button" class="approve-payment-btn text-green-600 hover:text-green-900" |
| 569 | - data-payment-id="<?php echo $payment->getId(); ?>" | |
| 570 | - data-invoice-id="<?php echo $payment->getInvoiceId(); ?>" | |
| 571 | - data-nonce="<?php echo wp_create_nonce('easy_invoice_approve_payment'); ?>"> | |
| 574 | + data-payment-id="<?php echo (int) $payment->getId(); ?>" | |
| 575 | + data-invoice-id="<?php echo esc_attr($payment->getInvoiceId()); ?>" | |
| 576 | + data-nonce="<?php echo esc_attr(wp_create_nonce('easy_invoice_approve_payment')); ?>"> | |
| 572 | 577 | <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> |
| 573 | 578 | <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"></path> |
| 574 | 579 | </svg> |
| 575 | 580 | </button> |
| @@ -584,10 +589,25 @@ | ||
| 584 | 589 | </tr> |
| 585 | 590 | <?php endforeach; ?> |
| 586 | 591 | <?php else : ?> |
| 587 | 592 | <tr> |
| 588 | - <td colspan="9" class="px-6 py-4 whitespace-nowrap text-sm text-gray-500 text-center"> | |
| 589 | - <?php _e('No payments found.', 'easy-invoice'); ?> | |
| 593 | + <?php | |
| 594 | + // Was a bare "No payments found." with no way forward. Every | |
| 595 | + // other empty state in the plugin offers the next action, so | |
| 596 | + // this one now points at Add New Payment too. | |
| 597 | + // | |
| 598 | + // `whitespace-nowrap` also had to go: it is meant for table | |
| 599 | + // cells holding short values, and on a 9-column empty row it | |
| 600 | + // stopped the message wrapping. | |
| 601 | + $ei_add_payment_link = '<a href="' . esc_url(admin_url('admin.php?page=easy-invoice-payment-new')) . '" class="text-indigo-600 hover:text-indigo-900">' | |
| 602 | + . esc_html__('Record your first payment', 'easy-invoice') | |
| 603 | + . '</a>'; | |
| 604 | + ?> | |
| 605 | + <td colspan="9" class="px-6 py-4 text-sm text-gray-500 text-center"> | |
| 606 | + <?php | |
| 607 | + /* translators: %s: link reading "Record your first payment". */ | |
| 608 | + printf(esc_html__('No payments found. %s.', 'easy-invoice'), wp_kses_post($ei_add_payment_link)); | |
| 609 | + ?> | |
| 590 | 610 | </td> |
| 591 | 611 | </tr> |
| 592 | 612 | <?php endif; ?> |
| 593 | 613 | </tbody> |
| @@ -652,9 +672,9 @@ | ||
| 652 | 672 | if ($link && strpos($link, 'bg-indigo-50') === false && strpos($link, 'bg-white') === false) { |
| 653 | 673 | $link = easy_invoice_str_replace('border-gray-300', 'border-gray-300 bg-white text-gray-500 hover:bg-gray-50', $link); |
| 654 | 674 | } |
| 655 | 675 | |
| 656 | - echo $link; | |
| 676 | + echo wp_kses_post($link); | |
| 657 | 677 | } |
| 658 | 678 | echo '</div>'; |
| 659 | 679 | } |
| 660 | 680 | ?> |
| @@ -678,19 +698,19 @@ | ||
| 678 | 698 | </svg> |
| 679 | 699 | </div> |
| 680 | 700 | <div class="mt-3 text-center sm:mt-0 sm:ml-4 sm:text-left"> |
| 681 | 701 | <h3 class="text-lg leading-6 font-medium text-gray-900" id="modal-title"> |
| 682 | - <?php _e('Approve Payment', 'easy-invoice'); ?> | |
| 702 | + <?php esc_html_e('Approve Payment', 'easy-invoice'); ?> | |
| 683 | 703 | </h3> |
| 684 | 704 | <div class="mt-2"> |
| 685 | 705 | <p class="text-sm text-gray-500"> |
| 686 | - <?php _e('You are about to approve this payment. This will mark the invoice as paid and update the payment records.', 'easy-invoice'); ?> | |
| 706 | + <?php esc_html_e('You are about to approve this payment. This will mark the invoice as paid and update the payment records.', 'easy-invoice'); ?> | |
| 687 | 707 | </p> |
| 688 | 708 | <div class="mt-4"> |
| 689 | 709 | <label for="approval-notes" class="block text-sm font-medium text-gray-700"> |
| 690 | - <?php _e('Notes (optional)', 'easy-invoice'); ?> | |
| 710 | + <?php esc_html_e('Notes (optional)', 'easy-invoice'); ?> | |
| 691 | 711 | </label> |
| 692 | - <textarea id="approval-notes" name="notes" rows="3" class="mt-1 block w-full border border-gray-300 rounded-md shadow-sm py-2 px-3 focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm" placeholder="<?php _e('Add any notes about this payment approval...', 'easy-invoice'); ?>"></textarea> | |
| 712 | + <textarea id="approval-notes" name="notes" rows="3" class="mt-1 block w-full border border-gray-300 rounded-md shadow-sm py-2 px-3 focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm" placeholder="<?php echo esc_js(__('Add any notes about this payment approval...', 'easy-invoice')); ?>"></textarea> | |
| 693 | 713 | </div> |
| 694 | 714 | </div> |
| 695 | 715 | </div> |
| 696 | 716 | </div> |
| @@ -696,12 +716,12 @@ | ||
| 696 | 716 | </div> |
| 697 | 717 | </div> |
| 698 | 718 | <div class="bg-gray-50 px-4 py-3 sm:px-6 sm:flex sm:flex-row-reverse"> |
| 699 | 719 | <button type="button" id="confirm-approve-btn" class="w-full inline-flex justify-center rounded-md border border-transparent shadow-sm px-4 py-2 bg-green-600 text-base font-medium text-white hover:bg-green-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-green-500 sm:ml-3 sm:w-auto sm:text-sm"> |
| 700 | - <?php _e('Approve Payment', 'easy-invoice'); ?> | |
| 720 | + <?php esc_html_e('Approve Payment', 'easy-invoice'); ?> | |
| 701 | 721 | </button> |
| 702 | 722 | <button type="button" id="cancel-approve-btn" class="mt-3 w-full inline-flex justify-center rounded-md border border-gray-300 shadow-sm px-4 py-2 bg-white text-base font-medium text-gray-700 hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 sm:mt-0 sm:ml-3 sm:w-auto sm:text-sm"> |
| 703 | - <?php _e('Cancel', 'easy-invoice'); ?> | |
| 723 | + <?php esc_html_e('Cancel', 'easy-invoice'); ?> | |
| 704 | 724 | </button> |
| 705 | 725 | </div> |
| 706 | 726 | </div> |
| 707 | 727 | </div> |
| @@ -751,9 +771,9 @@ | ||
| 751 | 771 | </style> |
| 752 | 772 | |
| 753 | 773 | <script> |
| 754 | 774 | // Define ajaxurl for AJAX requests |
| 755 | -var ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>'; | |
| 775 | +var ajaxurl = '<?php echo esc_url(admin_url('admin-ajax.php')); ?>'; | |
| 756 | 776 | |
| 757 | 777 | jQuery(document).ready(function($) { |
| 758 | 778 | // Variables to store the current payment being approved |
| 759 | 779 | let currentInvoiceId = null; |
