← All changes | includes/settings/controls.php +9 -9 4.2.0 → 3.4.0-dev9 View file →

		@@ -69,13 +69,13 @@
69	69	?>
70	70	<input type="<?php echo esc_attr( $field['type'] ); ?>" id="<?php echo esc_attr( $field['id'] ); ?>" name="<?php echo esc_attr( $field['id'] ); ?>" value="<?php echo esc_attr( get_option( $field['id'], $field['std'] ) ); ?>" <?php Utils::print_html_attributes( $field['attributes'] ); ?>/>
71	71	<?php
72	72	if ( ! empty( $field['sub_desc'] ) ) :
73		- echo wp_kses_post( $field['sub_desc'] );
	73	+ echo esc_html( $field['sub_desc'] );
74	74	endif;
75	75	?>
76	76	<?php if ( ! empty( $field['desc'] ) ) : ?>
77		- <p class="description"><?php echo wp_kses_post( $field['desc'] ); ?></p>
	77	+ <p class="description"><?php echo esc_html( $field['desc'] ); ?></p>
78	78	<?php
79	79	endif;
80	80	}
81	81
		@@ -95,14 +95,14 @@
95	95	<label>
96	96	<input type="<?php echo esc_attr( $field['type'] ); ?>" id="<?php echo esc_attr( $field['id'] ); ?>" name="<?php echo esc_attr( $field['id'] ); ?>" value="<?php echo esc_attr( $field['value'] ); ?>"<?php checked( $field['value'], get_option( $field['id'], $field['std'] ) ); ?> />
97	97	<?php
98	98	if ( ! empty( $field['sub_desc'] ) ) :
99		- echo wp_kses_post( $field['sub_desc'] );
	99	+ echo esc_html( $field['sub_desc'] );
100	100	endif;
101	101	?>
102	102	</label>
103	103	<?php if ( ! empty( $field['desc'] ) ) : ?>
104		- <p class="description"><?php echo wp_kses_post( $field['desc'] ); ?></p>
	104	+ <p class="description"><?php echo esc_html( $field['desc'] ); ?></p>
105	105	<?php
106	106	endif;
107	107	}
108	108
		@@ -126,13 +126,13 @@
126	126	foreach ( $field['options'] as $option_key => $option_value ) :
127	127	?>
128	128	<label>
129	129	<input type="checkbox" name="<?php echo esc_attr( $field['id'] ); ?>[]" value="<?php echo esc_attr( $option_key ); ?>"<?php checked( in_array( $option_key, $old_value ), true ); ?> />
130		- <?php echo wp_kses_post( $option_value ); ?>
	130	+ <?php echo esc_html( $option_value ); ?>
131	131	</label><br />
132	132	<?php endforeach; ?>
133	133	<?php if ( ! empty( $field['desc'] ) ) : ?>
134		- <p class="description"><?php echo wp_kses_post( $field['desc'] ); ?></p>
	134	+ <p class="description"><?php echo esc_html( $field['desc'] ); ?></p>
135	135	<?php
136	136	endif;
137	137	}
138	138
		@@ -160,9 +160,9 @@
160	160	<?php endforeach; ?>
161	161	</select>
162	162
163	163	<?php if ( ! empty( $field['desc'] ) ) : ?>
164		- <p class="description"><?php echo wp_kses_post( $field['desc'] ); ?></p>
	164	+ <p class="description"><?php echo esc_html( $field['desc'] ); ?></p>
165	165	<?php
166	166	endif;
167	167	}
168	168
		@@ -270,13 +270,13 @@
270	270	<?php // PHPCS - This is a Raw HTML control, it is not escaped on purpose. ?>
271	271	<div><?php echo $field['html']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></div>
272	272	<?php
273	273	if ( ! empty( $field['sub_desc'] ) ) :
274		- echo wp_kses_post( $field['sub_desc'] );
	274	+ echo esc_html( $field['sub_desc'] );
275	275	endif;
276	276	?>
277	277	<?php if ( ! empty( $field['desc'] ) ) : ?>
278		- <p class="description"><?php echo wp_kses_post( $field['desc'] ); ?></p>
	278	+ <p class="description"><?php echo esc_html( $field['desc'] ); ?></p>
279	279	<?php endif; ?>
280	280	</div>
281	281	<?php
282	282	}