| @@ -212,8 +212,9 @@ | ||
| 212 | 212 | |
| 213 | 213 | /** |
| 214 | 214 | * Renders the donor view wrapper. |
| 215 | 215 | * |
| 216 | + * @since 4.16.8 Relinking donors is handled only through the nonce-protected edit action. | |
| 216 | 217 | * @since 1.0 |
| 217 | 218 | * |
| 218 | 219 | * @param string $view The View being requested. |
| 219 | 220 | * @param array $callbacks The Registered views and their callback functions. |
| @@ -236,16 +237,10 @@ | ||
| 236 | 237 | $render = false; |
| 237 | 238 | } |
| 238 | 239 | |
| 239 | 240 | $donor_id = (int) $_GET['id']; |
| 240 | - $reconnect_user_id = ! empty( $_GET['user_id'] ) ? (int) $_GET['user_id'] : ''; | |
| 241 | 241 | $donor = new Give_Donor( $donor_id ); |
| 242 | 242 | |
| 243 | - // Reconnect User with Donor profile. | |
| 244 | - if ( $reconnect_user_id ) { | |
| 245 | - give_connect_user_donor_profile( $donor, array( 'user_id' => $reconnect_user_id ), array() ); | |
| 246 | - } | |
| 247 | - | |
| 248 | 243 | if ( empty( $donor->id ) ) { |
| 249 | 244 | give_set_error( 'give-invalid_donor', __( 'Invalid Donor ID.', 'give' ) ); |
| 250 | 245 | $render = false; |
| 251 | 246 | } |
| @@ -1040,8 +1035,9 @@ | ||
| 1040 | 1035 | |
| 1041 | 1036 | /** |
| 1042 | 1037 | * View the notes of a donor. |
| 1043 | 1038 | * |
| 1039 | + * @since 4.16.6 Escaped the donor name output in the donor notes header. | |
| 1044 | 1040 | * @since 4.6.0 Escape donor note |
| 1045 | 1041 | * @since 1.0 |
| 1046 | 1042 | * |
| 1047 | 1043 | * @param Give_Donor $donor The donor object being displayed. |
| @@ -1059,9 +1055,9 @@ | ||
| 1059 | 1055 | ?> |
| 1060 | 1056 | |
| 1061 | 1057 | <div id="donor-notes-wrapper"> |
| 1062 | 1058 | <div class="donor-notes-header"> |
| 1063 | - <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo $donor->name; ?></span> | |
| 1059 | + <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo esc_html( $donor->name ); ?></span> | |
| 1064 | 1060 | </div> |
| 1065 | 1061 | <h3><?php _e( 'Notes', 'give' ); ?></h3> |
| 1066 | 1062 | |
| 1067 | 1063 | <?php if ( 1 == $paged ) : ?> |
| @@ -1115,8 +1111,9 @@ | ||
| 1115 | 1111 | |
| 1116 | 1112 | /** |
| 1117 | 1113 | * The donor delete view. |
| 1118 | 1114 | * |
| 1115 | + * @since 4.16.6 Escaped the donor name output in the delete donor view. | |
| 1119 | 1116 | * @since 1.0 |
| 1120 | 1117 | * |
| 1121 | 1118 | * @param object $donor The donor object being displayed. |
| 1122 | 1119 | * |
| @@ -1141,9 +1138,9 @@ | ||
| 1141 | 1138 | <form id="delete-donor" method="post" |
| 1142 | 1139 | action="<?php echo admin_url( 'edit.php?post_type=give_forms&page=give-donors&view=delete&id=' . $donor->id ); ?>"> |
| 1143 | 1140 | |
| 1144 | 1141 | <div class="donor-notes-header"> |
| 1145 | - <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo $donor->name; ?></span> | |
| 1142 | + <?php echo get_avatar( $donor->email, 30 ); ?> <span><?php echo esc_html( $donor->name ); ?></span> | |
| 1146 | 1143 | </div> |
| 1147 | 1144 | |
| 1148 | 1145 | |
| 1149 | 1146 | <div class="donor-info delete-donor"> |
