| @@ -212,8 +212,9 @@ | ||
| 212 | 212 | |
| 213 | 213 | /** |
| 214 | 214 | * Renders the donor view wrapper. |
| 215 | 215 | * |
| 216 | + * @since 4.16.8 Relinking donors is handled only through the nonce-protected edit action. | |
| 216 | 217 | * @since 1.0 |
| 217 | 218 | * |
| 218 | 219 | * @param string $view The View being requested. |
| 219 | 220 | * @param array $callbacks The Registered views and their callback functions. |
| @@ -236,16 +237,10 @@ | ||
| 236 | 237 | $render = false; |
| 237 | 238 | } |
| 238 | 239 | |
| 239 | 240 | $donor_id = (int) $_GET['id']; |
| 240 | - $reconnect_user_id = ! empty( $_GET['user_id'] ) ? (int) $_GET['user_id'] : ''; | |
| 241 | 241 | $donor = new Give_Donor( $donor_id ); |
| 242 | 242 | |
| 243 | - // Reconnect User with Donor profile. | |
| 244 | - if ( $reconnect_user_id ) { | |
| 245 | - give_connect_user_donor_profile( $donor, array( 'user_id' => $reconnect_user_id ), array() ); | |
| 246 | - } | |
| 247 | - | |
| 248 | 243 | if ( empty( $donor->id ) ) { |
| 249 | 244 | give_set_error( 'give-invalid_donor', __( 'Invalid Donor ID.', 'give' ) ); |
| 250 | 245 | $render = false; |
| 251 | 246 | } |
| @@ -307,8 +302,9 @@ | ||
| 307 | 302 | |
| 308 | 303 | /** |
| 309 | 304 | * View a donor |
| 310 | 305 | * |
| 306 | + * @since 4.16.4 Escaped the donor company and phone output. | |
| 311 | 307 | * @since 3.7.0 Add "phone" field |
| 312 | 308 | * @since 1.0 |
| 313 | 309 | * |
| 314 | 310 | * @param Give_Donor $donor The Donor object being displayed. |
| @@ -505,9 +501,9 @@ | ||
| 505 | 501 | </span> |
| 506 | 502 | |
| 507 | 503 | <span class="donor-user-id info-item editable"> |
| 508 | 504 | <?php |
| 509 | - echo $donor_phone_number; ?> | |
| 505 | + echo esc_html( $donor_phone_number ); ?> | |
| 510 | 506 | </span> |
| 511 | 507 | </td> |
| 512 | 508 | </tr> |
| 513 | 509 | <?php |
| @@ -518,13 +514,13 @@ | ||
| 518 | 514 | <label for="tablecell"><?php esc_html_e( 'Company Name:', 'give' ); ?></label> |
| 519 | 515 | </th> |
| 520 | 516 | <td> |
| 521 | 517 | <span class="donor-user-id info-item edit-item"> |
| 522 | - <input name="give_donor_company" value="<?php echo $donor_company; ?>" type="text"> | |
| 518 | + <input name="give_donor_company" value="<?php echo esc_attr( $donor_company ); ?>" type="text"> | |
| 523 | 519 | </span> |
| 524 | 520 | |
| 525 | 521 | <span class="donor-user-id info-item editable"> |
| 526 | - <?php echo $donor_company; ?> | |
| 522 | + <?php echo esc_html( $donor_company ); ?> | |
| 527 | 523 | </span> |
| 528 | 524 | </td> |
| 529 | 525 | </tr> |
| 530 | 526 | </tbody> |
| @@ -828,9 +824,9 @@ | ||
| 828 | 824 | |
| 829 | 825 | <?php foreach ( $donor->emails as $key => $email ) : ?> |
| 830 | 826 | <tr data-key="<?php echo $key; ?>"> |
| 831 | 827 | <td> |
| 832 | - <?php echo $email; ?> | |
| 828 | + <?php echo esc_html( $email ); ?> | |
| 833 | 829 | <?php if ( 'primary' === $key ) : ?> |
| 834 | 830 | <span class="dashicons dashicons-star-filled primary-email-icon"></span> |
| 835 | 831 | <?php endif; ?> |
| 836 | 832 | </td> |
| @@ -1039,8 +1035,9 @@ | ||
| 1039 | 1035 | |
| 1040 | 1036 | /** |
| 1041 | 1037 | * View the notes of a donor. |
| 1042 | 1038 | * |
| 1039 | + * @since 4.16.6 Escaped the donor name output in the donor notes header. | |
| 1043 | 1040 | * @since 4.6.0 Escape donor note |
| 1044 | 1041 | * @since 1.0 |
| 1045 | 1042 | * |
| 1046 | 1043 | * @param Give_Donor $donor The donor object being displayed. |
| @@ -1058,9 +1055,9 @@ | ||
| 1058 | 1055 | ?> |
| 1059 | 1056 | |
| 1060 | 1057 | <div id="donor-notes-wrapper"> |
| 1061 | 1058 | <div class="donor-notes-header"> |
| 1062 | - <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo $donor->name; ?></span> | |
| 1059 | + <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo esc_html( $donor->name ); ?></span> | |
| 1063 | 1060 | </div> |
| 1064 | 1061 | <h3><?php _e( 'Notes', 'give' ); ?></h3> |
| 1065 | 1062 | |
| 1066 | 1063 | <?php if ( 1 == $paged ) : ?> |
| @@ -1114,8 +1111,9 @@ | ||
| 1114 | 1111 | |
| 1115 | 1112 | /** |
| 1116 | 1113 | * The donor delete view. |
| 1117 | 1114 | * |
| 1115 | + * @since 4.16.6 Escaped the donor name output in the delete donor view. | |
| 1118 | 1116 | * @since 1.0 |
| 1119 | 1117 | * |
| 1120 | 1118 | * @param object $donor The donor object being displayed. |
| 1121 | 1119 | * |
| @@ -1140,9 +1138,9 @@ | ||
| 1140 | 1138 | <form id="delete-donor" method="post" |
| 1141 | 1139 | action="<?php echo admin_url( 'edit.php?post_type=give_forms&page=give-donors&view=delete&id=' . $donor->id ); ?>"> |
| 1142 | 1140 | |
| 1143 | 1141 | <div class="donor-notes-header"> |
| 1144 | - <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo $donor->name; ?></span> | |
| 1142 | + <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo esc_html( $donor->name ); ?></span> | |
| 1145 | 1143 | </div> |
| 1146 | 1144 | |
| 1147 | 1145 | |
| 1148 | 1146 | <div class="donor-info delete-donor"> |
