← All changes | includes/widgets/Magazine_Grid/Magazine_Grid.php +57 -50 51.1.64 → 51.1.83 View file →

		@@ -1023,10 +1023,9 @@
1023	1023	]
1024	1024	]
1025	1025	);
1026	1026
1027		- Core::renderUpgradeProNotice($repeater, Controls_Manager::RAW_HTML, 'magazine-grid', 'element_select', ['pro-lk', 'pro-shr']);
1028		- Core::renderUpgradeProNotice($repeater, Controls_Manager::RAW_HTML, 'magazine-grid', 'element_select', ['pro-cf']);
	1027	+ Core::renderUpgradeProNotice($repeater, Controls_Manager::RAW_HTML, 'magazine-grid', 'element_select', ['pro-lk', 'pro-shr', 'pro-cf']);
1029	1028
1030	1029	$repeater->add_control(
1031	1030	'element_display',
1032	1031	[
		@@ -5019,9 +5018,9 @@
5019	5018	}
5020	5019
5021	5020	public function get_main_query_args($slide_offset)
5022	5021	{
5023		- $settings = $this->get_settings();
	5022	+ $settings = Core::displaySettings($this);
5024	5023	$author = !empty($settings['query_author']) ? implode(',', $settings['query_author']) : '';
5025	5024	$paged = get_query_var('paged') ?: (get_query_var('page') ?: 1);
5026	5025
5027	5026	// Handle no-premium settings
		@@ -5143,9 +5142,9 @@
5143	5142	}
5144	5143
5145	5144	public function get_tax_query_args()
5146	5145	{
5147		- $settings = $this->get_settings();
	5146	+ $settings = Core::displaySettings($this);
5148	5147
5149	5148	// If "related" source
5150	5149	if ('related' === $settings['query_source']) {
5151	5150	return [
		@@ -5177,17 +5176,18 @@
5177	5176	}
5178	5177
5179	5178	private function get_animation_class($data, $object)
5180	5179	{
5181		- if ('none' === $data[$object . '_animation']) {
	5180	+ $animation = Grid_Ajax_Security::sanitize_animation($data[$object . '_animation'] ?? 'none');
	5181	+ if ('none' === $animation) {
5182	5182	return '';
5183	5183	}
5184	5184
5185		- $class = ' king-addons-' . $object . '-' . $data[$object . '_animation'];
5186		- $class .= ' king-addons-anim-size-' . $data[$object . '_animation_size'];
5187		- $class .= ' king-addons-animation-timing-' . $data[$object . '_animation_timing'];
	5185	+ $class = ' king-addons-' . sanitize_html_class($object) . '-' . $animation;
	5186	+ $class .= ' king-addons-anim-size-' . Grid_Ajax_Security::sanitize_animation_size($data[$object . '_animation_size'] ?? 'large');
	5187	+ $class .= ' king-addons-animation-timing-' . Grid_Ajax_Security::sanitize_animation_timing($data[$object . '_animation_timing'] ?? 'ease-default');
5188	5188
5189		- if ('yes' === $data[$object . '_animation_tr']) {
	5189	+ if ('yes' === Grid_Ajax_Security::sanitize_yes_no_switcher($data[$object . '_animation_tr'] ?? '')) {
5190	5190	$class .= ' king-addons-anim-transparency';
5191	5191	}
5192	5192	return $class;
5193	5193	}
		@@ -5234,20 +5234,23 @@
5234	5234	}
5235	5235
5236	5236	public function render_post_title($settings, $class)
5237	5237	{
5238		- $open_links_in_new_tab = ('yes' === $settings['open_links_in_new_tab']) ? '_blank' : '_self';
	5238	+ $open_links_in_new_tab = ('yes' === ($settings['open_links_in_new_tab'] ?? '')) ? '_blank' : '_self';
5239	5239
5240	5240	// If premium unavailable, fallback pointer settings
5241		- $title_pointer = king_addons_freemius()->can_use_premium_code__premium_only() ? $settings['title_pointer'] : 'none';
5242		- $title_pointer_animation = king_addons_freemius()->can_use_premium_code__premium_only() ? $settings['title_pointer_animation'] : 'fade';
	5241	+ $title_pointer = king_addons_freemius()->can_use_premium_code__premium_only()
	5242	+ ? Grid_Ajax_Security::sanitize_class_token($settings['title_pointer'] ?? 'none')
	5243	+ : 'none';
	5244	+ $title_pointer_animation = king_addons_freemius()->can_use_premium_code__premium_only()
	5245	+ ? Grid_Ajax_Security::sanitize_class_token($settings['title_pointer_animation'] ?? 'fade')
	5246	+ : 'fade';
5243	5247
5244	5248	$pointer_item_class = ('none' !== $title_pointer) ? 'class="king-addons-pointer-item"' : '';
5245	5249	$class .= ' king-addons-pointer-' . $title_pointer;
5246	5250	$class .= ' king-addons-pointer-line-fx king-addons-pointer-fx-' . $title_pointer_animation;
5247	5251
5248		- $tags_whitelist = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span', 'p'];
5249		- $element_title_tag = Core::validateHTMLTags($settings['element_title_tag'], 'h2', $tags_whitelist);
	5252	+ $element_title_tag = Grid_Ajax_Security::sanitize_html_tag($settings['element_title_tag'] ?? 'h2');
5250	5253	$trim_type = $settings['element_trim_text_by'];
5251	5254	$limit = $trim_type === 'word_count' ? $settings['element_word_count'] : $settings['element_letter_count'];
5252	5255	$title_text = ($trim_type === 'word_count')
5253	5256	? wp_trim_words(get_the_title(), $limit)
		@@ -5252,14 +5255,14 @@
5252	5255	$title_text = ($trim_type === 'word_count')
5253	5256	? wp_trim_words(get_the_title(), $limit)
5254	5257	: mb_substr(html_entity_decode(get_the_title()), 0, $limit) . '...';
5255	5258
5256		- echo "<$element_title_tag class=\"$class\">";
	5259	+ echo '<' . esc_attr($element_title_tag) . ' class="' . esc_attr($class) . '">';
5257	5260	echo '<div class="inner-block">';
5258		- echo "<a target=\"$open_links_in_new_tab\" $pointer_item_class href=\"" . esc_url(get_the_permalink()) . "\">";
	5261	+ echo '<a target="' . esc_attr($open_links_in_new_tab) . '" ' . $pointer_item_class . ' href="' . esc_url(get_the_permalink()) . '">';
5259	5262	echo esc_html($title_text);
5260	5263	echo '</a></div>';
5261		- echo "</$element_title_tag>";
	5264	+ echo '</' . esc_attr($element_title_tag) . '>';
5262	5265	}
5263	5266
5264	5267	public function render_post_content($settings, $class)
5265	5268	{
		@@ -5267,9 +5270,9 @@
5267	5270	return;
5268	5271	}
5269	5272	$class .= ('yes' === $settings['element_dropcap']) ? ' king-addons-enable-dropcap' : '';
5270	5273
5271		- echo "<div class=\"$class\">";
	5274	+ echo '<div class="' . esc_attr($class) . '">';
5272	5275	echo '<div class="inner-block">';
5273	5276	echo wp_kses_post(apply_filters('the_content', get_the_content()));
5274	5277	echo '</div></div>';
5275	5278	}
		@@ -5280,9 +5283,9 @@
5280	5283	return;
5281	5284	}
5282	5285	$class .= ('yes' === $settings['element_dropcap']) ? ' king-addons-enable-dropcap' : '';
5283	5286
5284		- echo "<div class=\"$class\">";
	5287	+ echo '<div class="' . esc_attr($class) . '">';
5285	5288	echo '<div class="inner-block">';
5286	5289	if ('word_count' === $settings['element_trim_text_by']) {
5287	5290	echo '<p>' . esc_html(wp_trim_words(get_the_excerpt(), $settings['element_word_count'])) . '</p>';
5288	5291	} else {
		@@ -5293,9 +5296,9 @@
5293	5296	}
5294	5297
5295	5298	public function render_post_date($settings, $class)
5296	5299	{
5297		- echo "<div class=\"$class\"><div class=\"inner-block\"><span>";
	5300	+ echo '<div class="' . esc_attr($class) . '"><div class="inner-block"><span>';
5298	5301	$this->render_extra_text_and_icon($settings, 'before');
5299	5302
5300	5303	// Show modified time or published time
5301	5304	echo ('yes' === $settings['show_last_update_date'])
		@@ -5307,9 +5310,9 @@
5307	5310	}
5308	5311
5309	5312	public function render_post_time($settings, $class)
5310	5313	{
5311		- echo "<div class=\"$class\"><div class=\"inner-block\"><span>";
	5314	+ echo '<div class="' . esc_attr($class) . '"><div class="inner-block"><span>';
5312	5315	$this->render_extra_text_and_icon($settings, 'before');
5313	5316
5314	5317	echo esc_html(get_the_time());
5315	5318
		@@ -5320,9 +5323,9 @@
5320	5323	public function render_post_author($settings, $class)
5321	5324	{
5322	5325	$author_id = get_post_field('post_author');
5323	5326
5324		- echo "<div class=\"$class\"><div class=\"inner-block\">";
	5327	+ echo '<div class="' . esc_attr($class) . '"><div class="inner-block">';
5325	5328	$this->render_extra_text_and_icon($settings, 'before');
5326	5329
5327	5330	echo '<a href="' . esc_url(get_author_posts_url($author_id)) . '">';
5328	5331	$this->render_extra_text_and_icon($settings, 'before', true);
		@@ -5351,9 +5354,9 @@
5351	5354	} else {
5352	5355	$text = $settings['element_comments_text_1'];
5353	5356	}
5354	5357
5355		- echo "<div class=\"$class\"><div class=\"inner-block\">";
	5358	+ echo '<div class="' . esc_attr($class) . '"><div class="inner-block">';
5356	5359	$this->render_extra_text_and_icon($settings, 'before');
5357	5360
5358	5361	echo '<a href="' . esc_url(get_comments_link()) . '">';
5359	5362	$this->render_extra_text_and_icon($settings, 'before', true);
		@@ -5371,10 +5374,10 @@
5371	5374	$read_more_animation = king_addons_freemius()->can_use_premium_code__premium_only()
5372	5375	? $settings['read_more_animation']
5373	5376	: 'king-addons-button-none';
5374	5377
5375		- echo "<div class=\"$class\"><div class=\"inner-block\">";
5376		- echo "<a target=\"$open_links_in_new_tab\" href=\"" . esc_url(get_the_permalink()) . "\" class=\"king-addons-button-effect " . esc_attr($read_more_animation) . "\">";
	5378	+ echo '<div class="' . esc_attr($class) . '"><div class="inner-block">';
	5379	+ echo '<a target="' . esc_attr($open_links_in_new_tab) . '" href="' . esc_url(get_the_permalink()) . '" class="king-addons-button-effect ' . esc_attr($read_more_animation) . '">';
5377	5380	$this->render_extra_text_and_icon($settings, 'before', true);
5378	5381	echo '<span>' . esc_html($settings['element_read_more_text']) . '</span>';
5379	5382	$this->render_extra_text_and_icon($settings, 'after', true);
5380	5383	echo '</a>';
		@@ -5397,9 +5400,9 @@
5397	5400	}
5398	5401
5399	5402	public function render_post_element_separator($settings, $class)
5400	5403	{
5401		- echo "<div class=\"$class {$settings['element_separator_style']}\">";
	5404	+ echo '<div class="' . esc_attr($class . ' ' . ($settings['element_separator_style'] ?? '')) . '">';
5402	5405	echo '<div class="inner-block"><span></span></div>';
5403	5406	echo '</div>';
5404	5407	}
5405	5408
		@@ -5409,12 +5412,12 @@
5409	5412	$count = 0;
5410	5413	$pointer = king_addons_freemius()->can_use_premium_code__premium_only();
5411	5414
5412	5415	// Pointer settings
5413		- $tax1_pointer = $pointer ? $this->get_settings()['tax1_pointer'] : 'none';
5414		- $tax1_pointer_animation = $pointer ? $this->get_settings()['tax1_pointer_animation'] : 'fade';
5415		- $tax2_pointer = $pointer ? $this->get_settings()['tax2_pointer'] : 'none';
5416		- $tax2_pointer_animation = $pointer ? $this->get_settings()['tax2_pointer_animation'] : 'fade';
	5416	+ $tax1_pointer = $pointer ? Grid_Ajax_Security::sanitize_class_token(Core::displaySettings($this)['tax1_pointer'] ?? 'none') : 'none';
	5417	+ $tax1_pointer_animation = $pointer ? Grid_Ajax_Security::sanitize_class_token(Core::displaySettings($this)['tax1_pointer_animation'] ?? 'fade') : 'fade';
	5418	+ $tax2_pointer = $pointer ? Grid_Ajax_Security::sanitize_class_token(Core::displaySettings($this)['tax2_pointer'] ?? 'none') : 'none';
	5419	+ $tax2_pointer_animation = $pointer ? Grid_Ajax_Security::sanitize_class_token(Core::displaySettings($this)['tax2_pointer_animation'] ?? 'fade') : 'fade';
5417	5420
5418	5421	if ($settings['element_tax_style'] === 'king-addons-grid-tax-style-1') {
5419	5422	$class .= " king-addons-pointer-$tax1_pointer king-addons-pointer-fx-$tax1_pointer_animation";
5420	5423	} else {
		@@ -5422,13 +5425,13 @@
5422	5425	}
5423	5426	$class .= ' king-addons-pointer-line-fx';
5424	5427
5425	5428	$pointer_item_class = (
5426		- (isset($this->get_settings()['tax1_pointer']) && $this->get_settings()['tax1_pointer'] !== 'none') ||
5427		- (isset($this->get_settings()['tax2_pointer']) && $this->get_settings()['tax2_pointer'] !== 'none')
	5429	+ (isset(Core::displaySettings($this)['tax1_pointer']) && Core::displaySettings($this)['tax1_pointer'] !== 'none') ||
	5430	+ (isset(Core::displaySettings($this)['tax2_pointer']) && Core::displaySettings($this)['tax2_pointer'] !== 'none')
5428	5431	) ? 'king-addons-pointer-item' : '';
5429	5432
5430		- echo "<div class=\"$class {$settings['element_tax_style']}\">";
	5433	+ echo '<div class="' . esc_attr($class . ' ' . ($settings['element_tax_style'] ?? '')) . '">';
5431	5434	echo '<div class="inner-block">';
5432	5435
5433	5436	$this->render_extra_text_and_icon($settings, 'before');
5434	5437
		@@ -5433,21 +5436,25 @@
5433	5436	$this->render_extra_text_and_icon($settings, 'before');
5434	5437
5435	5438	foreach ($terms as $term) {
5436	5439	// Check if premium color styling
5437		- $enable_custom_colors = $pointer ? $this->get_settings()['tax1_custom_color_switcher'] : '';
	5440	+ $enable_custom_colors = $pointer ? Core::displaySettings($this)['tax1_custom_color_switcher'] : '';
5438	5441	if ('yes' === $enable_custom_colors) {
5439		- $cfc_text = get_term_meta($term->term_id, $this->get_settings()['tax1_custom_color_field_text'], true);
5440		- $cfc_bg = get_term_meta($term->term_id, $this->get_settings()['tax1_custom_color_field_bg'], true);
	5442	+ $cfc_text = Grid_Ajax_Security::sanitize_css_color(
	5443	+ get_term_meta($term->term_id, sanitize_key(Core::displaySettings($this)['tax1_custom_color_field_text'] ?? ''), true)
	5444	+ );
	5445	+ $cfc_bg = Grid_Ajax_Security::sanitize_css_color(
	5446	+ get_term_meta($term->term_id, sanitize_key(Core::displaySettings($this)['tax1_custom_color_field_bg'] ?? ''), true)
	5447	+ );
5441	5448
5442	5449	if ($cfc_text || $cfc_bg) {
5443		- $style_block = "color:$cfc_text; background-color:$cfc_bg; border-color:$cfc_bg;";
5444		- $css_selector = '.elementor-element' . $this->get_unique_selector() . " .king-addons-grid-tax-style-1 .inner-block a.king-addons-tax-id-$term->term_id";
5445		- echo "<style>$css_selector{{$style_block}}</style>";
	5450	+ $style_block = 'color:' . esc_html($cfc_text) . '; background-color:' . esc_html($cfc_bg) . '; border-color:' . esc_html($cfc_bg) . ';';
	5451	+ $css_selector = '.elementor-element' . $this->get_unique_selector() . ' .king-addons-grid-tax-style-1 .inner-block a.king-addons-tax-id-' . absint($term->term_id);
	5452	+ echo '<style>' . esc_html($css_selector) . '{' . $style_block . '}</style>';
5446	5453	}
5447	5454	}
5448	5455
5449		- echo "<a class=\"$pointer_item_class king-addons-tax-id-$term->term_id\" href=\"" . esc_url(get_term_link($term->term_id)) . "\">";
	5456	+ echo '<a class="' . esc_attr($pointer_item_class . ' king-addons-tax-id-' . $term->term_id) . '" href="' . esc_url(get_term_link($term->term_id)) . '">';
5450	5457	echo esc_html($term->name);
5451	5458	if (++$count !== count($terms)) {
5452	5459	echo '<span class="tax-sep">' . esc_html($settings['element_tax_sep']) . '</span>';
5453	5460	}
		@@ -5576,12 +5583,12 @@
5576	5583	echo '<div class="king-addons-cv-container"><div class="king-addons-cv-outer"><div class="king-addons-cv-inner">';
5577	5584	}
5578	5585	echo '<div class="king-addons-grid-media-hover-' . esc_attr($align) . ' elementor-clearfix">';
5579	5586	foreach ($elements as $data) {
5580		- $class = 'king-addons-grid-item-' . $data['element_select'] .
5581		- ' elementor-repeater-item-' . $data['_id'] .
5582		- ' king-addons-grid-item-display-' . $data['element_display'] .
5583		- ' king-addons-grid-item-align-' . $data['element_align_hr'] .
	5587	+ $class = 'king-addons-grid-item-' . sanitize_html_class($data['element_select'] ?? '') .
	5588	+ ' elementor-repeater-item-' . sanitize_html_class($data['_id'] ?? '') .
	5589	+ ' king-addons-grid-item-display-' . sanitize_html_class($data['element_display'] ?? '') .
	5590	+ ' king-addons-grid-item-align-' . sanitize_html_class($data['element_align_hr'] ?? '') .
5584	5591	$this->get_animation_class($data, 'element');
5585	5592	$this->get_elements($data['element_select'], $data, $class, $post_id);
5586	5593	}
5587	5594	echo '</div>';
		@@ -5591,12 +5598,12 @@
5591	5598	}
5592	5599	} else {
5593	5600	echo '<div class="king-addons-grid-item-' . esc_attr($location) . '-content elementor-clearfix">';
5594	5601	foreach ($locations[$location] as $data) {
5595		- $class = 'king-addons-grid-item-' . $data['element_select'] .
5596		- ' elementor-repeater-item-' . $data['_id'] .
5597		- ' king-addons-grid-item-display-' . $data['element_display'] .
5598		- ' king-addons-grid-item-align-' . $data['element_align_hr'];
	5602	+ $class = 'king-addons-grid-item-' . sanitize_html_class($data['element_select'] ?? '') .
	5603	+ ' elementor-repeater-item-' . sanitize_html_class($data['_id'] ?? '') .
	5604	+ ' king-addons-grid-item-display-' . sanitize_html_class($data['element_display'] ?? '') .
	5605	+ ' king-addons-grid-item-align-' . sanitize_html_class($data['element_align_hr'] ?? '');
5599	5606	$this->get_elements($data['element_select'], $data, $class, $post_id);
5600	5607	}
5601	5608	echo '</div>';
5602	5609	}
		@@ -5650,9 +5657,9 @@
5650	5657	while ($posts->have_posts()) :
5651	5658	$posts->the_post();
5652	5659	$post_class = implode(' ', get_post_class('king-addons-magazine-grid-item elementor-clearfix', get_the_ID()));
5653	5660
5654		- echo "<article class=\"$post_class\">";
	5661	+ echo '<article class="' . esc_attr($post_class) . '">';
5655	5662	$this->render_password_protected_input();
5656	5663
5657	5664	echo '<div class="king-addons-grid-item-inner">';
5658	5665	echo '<div class="king-addons-grid-media-wrap" data-overlay-link="' . esc_attr($settings['overlay_post_link']) . '">';
		@@ -5674,9 +5681,9 @@
5674	5681	}
5675	5682
5676	5683	protected function render()
5677	5684	{
5678		- $settings = $this->get_settings();
	5685	+ $settings = Core::displaySettings($this);
5679	5686	$render_attribute = '';
5680	5687
5681	5688	// If no premium, reset slider options
5682	5689	if (!king_addons_freemius()->can_use_premium_code__premium_only()) {