← All changes | includes/classes/Frontend/Manage_Compare.php +51 -35 1.2.4 → trunk View file →

		@@ -1,6 +1,8 @@
1	1	<?php
2	2	namespace EverCompare\Frontend;
	3	+
	4	+defined( 'ABSPATH' ) || exit;
3	5	/**
4	6	* Button handlers class
5	7	*/
6	8	class Manage_Compare {
		@@ -124,15 +126,8 @@
124	126	if( ever_compare_get_option( 'open_popup', 'ever_compare_settings_tabs', 'on' ) === 'on' ){
125	127	add_action( 'wp_footer', [ $this, 'pop_up_html' ] );
126	128	}
127	129
128		- /**
129		- * Manage maximum product added message
130		- */
131		- if( isset( $_COOKIE[ 'ever_compare_max_limit' ] ) && $_COOKIE[ 'ever_compare_max_limit' ] == 'yes' ) {
132		- setcookie( 'ever_compare_max_limit', 'no', 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
133		- $this->reached_max_limit = true;
134		- }
135	130
136	131
137	132	}
138	133
		@@ -155,13 +150,23 @@
155	150	return ever_compare_get_template( 'evercompare-table.php', $table_attr, false );
156	151	}
157	152
158	153	/**
	154	+ * [count_html] Count HTML
	155	+ * @param [type] $atts
	156	+ * @return [HTML]
	157	+ */
	158	+ public function count_html( $atts ) {
	159	+ $button_attr = apply_filters( 'evercompare_count_arg', $atts );
	160	+ return ever_compare_get_template( 'evercompare-count.php', $button_attr, false );
	161	+ }
	162	+
	163	+ /**
159	164	* [pop_up_html]
160	165	* @return [void]
161	166	*/
162	167	public function pop_up_html(){
163		- echo '<div class="htcompare-popup"><div class="htcompare-popup-content-area"><span class="htcompare-popup-close">&nbsp;</span>'.do_shortcode( '[evercompare_table]' ).'</div></div>';
	168	+ echo '<div class="htcompare-popup"><div class="htcompare-popup-content-area"><button type="button" class="htcompare-popup-close" aria-label="' . esc_attr__( 'Close compare popup', 'ever-compare' ) . '">&nbsp;</button><div class="htcompare-table" data-ajax-load="true"></div></div></div>';
164	169	}
165	170
166	171	/**
167	172	* [reached_max_limit_message]
		@@ -189,12 +194,12 @@
189	194	}
190	195
191	196	$ids = $this->get_compared_products();
192	197
193		- if ( isset( $_GET['evcompare'] ) ) {
194		- $query_perametter_ids = sanitize_text_field( $_GET['evcompare'] );
	198	+ if ( ! empty( $_GET['evcompare'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
	199	+ $query_perametter_ids = sanitize_text_field( wp_unslash($_GET['evcompare']) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
195	200	if( !empty( $query_perametter_ids ) ){
196		- $ids = explode( ',', $query_perametter_ids );
	201	+ $ids = array_filter( array_map( 'absint', explode( ',', $query_perametter_ids ) ) );
197	202	}
198	203	}
199	204
200	205	$buttonText = ever_compare_get_option( 'shareable_link_button_text','ever_compare_table_settings_tabs','Copy shareable link' ) ? ever_compare_get_option( 'shareable_link_button_text','ever_compare_table_settings_tabs','Copy shareable link' ) : esc_html__( 'Copy shareable link', 'ever-compare' );
		@@ -204,10 +209,10 @@
204	209	$idsString = is_array( $ids ) ? implode( ',', $ids ) : '';
205	210	$shareablelink = $this->get_compare_page_url() . '?evcompare='.$idsString;
206	211	?>
207	212	<div class="ever-compare-shareable-link <?php echo esc_attr( $button_pos );?>">
208		- <button class="evercompare-copy-link" data-copytext="<?php echo esc_attr( $aftercopy_buttonText ); ?>" data-btntext="<?php echo esc_attr( $buttonText ); ?>"><?php echo $buttonText; ?></button>
209		- <p style="display: none;" class="evercompare-share-link"><?php echo $shareablelink; ?></p>
	213	+ <button class="evercompare-copy-link" data-copytext="<?php echo esc_attr( $aftercopy_buttonText ); ?>" data-btntext="<?php echo esc_attr( $buttonText ); ?>"><?php echo esc_html($buttonText); ?></button>
	214	+ <p style="display: none;" class="evercompare-share-link"><?php echo esc_html($shareablelink); ?></p>
210	215	</div>
211	216	<?php
212	217
213	218	}
		@@ -226,17 +231,16 @@
226	231	$products = $this->get_compared_products();
227	232
228	233	// Reached Maximum Limit
229	234	if( $this->reached_max_limit() ) {
230		- setcookie( 'ever_compare_max_limit', 'yes', 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
231	235	$this->compare_json_response();
232	236	}
233	237
234	238	$products[] = $id;
235	239
236		- setcookie( $cookie_name, json_encode( $products ), 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
	240	+ setcookie( $cookie_name, wp_json_encode( $products ), 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
237	241
238		- $_COOKIE[$cookie_name] = json_encode( $products );
	242	+ $_COOKIE[$cookie_name] = wp_json_encode( $products );
239	243
240	244	$this->compare_json_response();
241	245
242	246	}
		@@ -278,14 +282,16 @@
278	282	$this->reached_max_limit = false;
279	283	}
280	284	}
281	285
	286	+ $products = array_values( $products );
	287	+
282	288	if ( empty( $products ) ) {
283	289	setcookie( $cookie_name, false, 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
284	290	$_COOKIE[$cookie_name] = false;
285	291	} else {
286		- setcookie( $cookie_name, json_encode( $products ), 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
287		- $_COOKIE[$cookie_name] = json_encode( $products );
	292	+ setcookie( $cookie_name, wp_json_encode( $products ), 0, COOKIEPATH, COOKIE_DOMAIN, false, false );
	293	+ $_COOKIE[$cookie_name] = wp_json_encode( $products );
288	294	}
289	295
290	296	$this->compare_json_response();
291	297	}
		@@ -326,12 +332,12 @@
326	332	$ids = $this->get_compared_products();
327	333
328	334	// For shareable link
329	335	$shareable_link = ever_compare_get_option('enable_shareable_link','ever_compare_table_settings_tabs','off');
330		- if ( ( $shareable_link === 'on' ) && isset( $_GET['evcompare'] ) ) {
331		- $query_perametter_ids = sanitize_text_field( $_GET['evcompare'] );
	336	+ if ( ( $shareable_link === 'on' ) && ! empty( $_GET['evcompare'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
	337	+ $query_perametter_ids = sanitize_text_field( wp_unslash($_GET['evcompare']) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
332	338	if( !empty( $query_perametter_ids ) ){
333		- $ids = explode( ',', $query_perametter_ids );
	339	+ $ids = array_filter( array_map( 'absint', explode( ',', $query_perametter_ids ) ) );
334	340	}
335	341	}
336	342
337	343	if ( empty( $ids ) ) {
		@@ -408,9 +414,9 @@
408	414	);
409	415
410	416	$default_show = array(
411	417	'title' => esc_html__( 'title', 'ever-compare' ),
412		- 'ratting' => esc_html__( 'ratting', 'ever-compare' ),
	418	+ 'ratting' => esc_html__( 'Rating', 'ever-compare' ),
413	419	'price' => esc_html__( 'price', 'ever-compare' ),
414	420	'add_to_cart' => esc_html__( 'add_to_cart', 'ever-compare' ),
415	421	'description' => esc_html__( 'description', 'ever-compare' ),
416	422	'availability' => esc_html__( 'availability', 'ever-compare' ),
		@@ -462,11 +468,12 @@
462	468	switch ( $type ) {
463	469	case 'primary':
464	470	?>
465	471	<div class="htcompare-primary-content-area">
466		- <a href="#" class="htcompare-remove" data-product_id="<?php echo esc_attr( $product['id'] ); ?>">&nbsp;</a>
467		- <a href="<?php echo get_permalink( $product['id'] ); ?>" class="htcompare-product-image">
468		- <?php echo $product['primary']['image']; ?>
	472	+ <?php /* translators: %s: product title */ ?>
	473	+ <a href="#" class="htcompare-remove" data-product_title="<?php echo esc_attr( $product['title'] ); ?>" data-product_id="<?php echo esc_attr( $product['id'] ); ?>" aria-label="<?php echo esc_attr( sprintf( __( 'Remove %s from compare', 'ever-compare' ), $product['title'] ) ); ?>">&nbsp;</a>
	474	+ <a href="<?php echo esc_url(get_permalink( $product['id'] )); ?>" class="htcompare-product-image">
	475	+ <?php echo wp_kses_post($product['primary']['image']); ?>
469	476	</a>
470	477	</div>
471	478	<?php
472	479	break;
		@@ -471,9 +478,9 @@
471	478	<?php
472	479	break;
473	480
474	481	case 'title':
475		- echo '<a href="'.get_permalink( $product['id'] ).'" class="htcompare-product-title">'.$product[ $field_id ].'</a>';
	482	+ echo '<a href="'.esc_url(get_permalink( $product['id'] )).'" class="htcompare-product-title">'.esc_html($product[ $field_id ]).'</a>';
476	483	break;
477	484
478	485	case 'ratting':
479	486	echo '<span class="htcompare-product-ratting">'.wp_kses_post( $product[ $field_id ] ).'</span>';
		@@ -483,9 +490,9 @@
483	490	echo '<div class="htcompare-product-price">'.wp_kses_post( $product[ $field_id ] ).'</div>';
484	491	break;
485	492
486	493	case 'add_to_cart':
487		- echo apply_filters( 'htcompare_add_to_cart_btn', $product[ $field_id ] );
	494	+ echo wp_kses_post(apply_filters( 'htcompare_add_to_cart_btn', $product[ $field_id ] ));
488	495	break;
489	496
490	497	case 'attribute':
491	498	echo wp_kses_post( $product[ $field_id ] );
		@@ -493,14 +500,14 @@
493	500
494	501	case 'weight':
495	502	if ( $product[ $field_id ] ) {
496	503	$unit = $product[ $field_id ] !== '-' ? get_option( 'woocommerce_weight_unit' ) : '';
497		- echo wc_format_localized_decimal( $product[ $field_id ] ) . ' ' . esc_attr( $unit );
	504	+ echo wp_kses_post(wc_format_localized_decimal( $product[ $field_id ] )) . ' ' . esc_attr( $unit );
498	505	}
499	506	break;
500	507
501	508	case 'description':
502		- echo apply_filters( 'woocommerce_short_description', $product[ $field_id ] );
	509	+ echo wp_kses_post(apply_filters( 'woocommerce_short_description', $product[ $field_id ] ));
503	510	break;
504	511
505	512	default:
506	513	echo wp_kses_post( $product[ $field_id ] );
		@@ -533,9 +540,9 @@
533	540
534	541	$args = apply_filters( 'woocommerce_loop_add_to_cart_args', $defaults, $product );
535	542
536	543	if ( isset( $args['attributes']['aria-label'] ) ) {
537		- $args['attributes']['aria-label'] = strip_tags( $args['attributes']['aria-label'] );
	544	+ $args['attributes']['aria-label'] = wp_strip_all_tags( $args['attributes']['aria-label'] );
538	545	}
539	546
540	547	return apply_filters( 'woocommerce_loop_add_to_cart_link',
541	548	sprintf( '<a href="%s" data-quantity="%s" class="%s add-to-cart-loop" %s><span>%s</span></a>',
		@@ -557,9 +564,9 @@
557	564	$html = '';
558	565	$availability = $product->get_availability();
559	566
560	567	if( empty( $availability['availability'] ) ) {
561		- $availability['availability'] = __( 'In stock', 'woocommerce' );
	568	+ $availability['availability'] = __( 'In stock', 'ever-compare' );
562	569	}
563	570
564	571	if ( ! empty( $availability['availability'] ) ) {
565	572	ob_start();
		@@ -594,9 +601,9 @@
594	601	* @return [array] product id list
595	602	*/
596	603	public function is_product_in_compare( $id ) {
597	604	$list = $this->get_compared_products();
598		- return in_array( $id, $list, true );
	605	+ return in_array( absint($id), $list, true );
599	606	}
600	607
601	608	/**
602	609	* [get_compared_products]
		@@ -603,9 +610,15 @@
603	610	* @return [json]
604	611	*/
605	612	public function get_compared_products() {
606	613	$cookie_name = $this->get_cookie_name();
607		- return isset( $_COOKIE[ $cookie_name ] ) ? json_decode( wp_unslash( $_COOKIE[ $cookie_name ] ), true ) : array();
	614	+ if(!empty( $_COOKIE[ $cookie_name ] )) {
	615	+ $decoded = json_decode( sanitize_text_field(wp_unslash( $_COOKIE[ $cookie_name ] )), true );
	616	+ if ( is_array( $decoded ) ) {
	617	+ return array_filter( array_map( 'absint', $decoded ) );
	618	+ }
	619	+ }
	620	+ return [];
608	621	}
609	622
610	623	/**
611	624	* [compare_json_response]
		@@ -624,12 +637,15 @@
624	637	if ( is_array( $products ) ) {
625	638	$count = count( $products );
626	639	}
627	640
628		- wp_send_json( array(
	641	+ $res = [
629	642	'count' => $count,
630	643	'table' => $table_html,
631		- ) );
	644	+ 'products' => $products,
	645	+ 'limitReached' => '<div class="ever-compare-message-error"><p>'. wp_kses_post( esc_html__( 'You have already added the maximum number of products.', 'ever-compare' ) ).'</p></div>'
	646	+ ];
	647	+ wp_send_json( $res );
632	648
633	649	}
634	650
635	651	/**