← All changes | templates/settings.php +78 -15 2.16.2 → 3.4.5 View file →

		@@ -12,12 +12,37 @@
12	12	$description = __('A plugin for creating a Leaflet JS map with a shortcode. Boasts two free map tile services and three free geocoders.', 'leaflet-map');
13	13	$version = $plugin_data['Version'];
14	14	?>
15	15	<div class="wrap">
16		- <h1><?php echo $title; ?> <small>version: <?php echo $version; ?></small></h1>
17		- <p><?php echo $description; ?></p>
	16	+
	17	+<h1><?php echo esc_html($title); ?> <small>version: <?php echo esc_html($version); ?></small></h1>
	18	+
18	19	<?php
19		-if (isset($_POST['submit'])) {
	20	+/** START FORM SUBMISSION */
	21	+
	22	+// validate nonce!
	23	+define('NONCE_NAME', 'leaflet-map-nonce');
	24	+define('NONCE_ACTION', 'leaflet-map-action');
	25	+
	26	+function verify_nonce () {
	27	+ $verified = (
	28	+ isset($_POST[NONCE_NAME]) &&
	29	+ check_admin_referer(NONCE_ACTION, NONCE_NAME)
	30	+ );
	31	+
	32	+ if (!$verified) {
	33	+ // side-effects can be fun?
	34	+ ?>
	35	+ <div class="notice notice-error is-dismissible">
	36	+ <p><?php esc_html_e('Sorry, your nonce did not verify', 'leaflet-map'); ?></p>
	37	+ </div>
	38	+ <?php
	39	+ }
	40	+
	41	+ return $verified;
	42	+}
	43	+
	44	+if (isset($_POST['submit']) && verify_nonce()) {
20	45	/* copy and overwrite $post for checkboxes */
21	46	$form = $_POST;
22	47
23	48	foreach ($settings->options as $name => $option) {
		@@ -33,33 +58,69 @@
33	58	$settings->set($name, $value);
34	59	}
35	60	?>
36	61	<div class="notice notice-success is-dismissible">
37		- <p><?php _e('Options Updated!', 'leaflet-map'); ?></p>
	62	+ <p><?php esc_html_e('Options Updated!', 'leaflet-map'); ?></p>
38	63	</div>
39	64	<?php
40		-} elseif (isset($_POST['reset'])) {
	65	+} elseif (isset($_POST['reset']) && verify_nonce()) {
41	66	$settings->reset();
42	67	?>
43	68	<div class="notice notice-success is-dismissible">
44		- <p><?php _e('Options have been reset to default values!', 'leaflet-map'); ?></p>
	69	+ <p><?php esc_html_e('Options have been reset to default values!', 'leaflet-map'); ?></p>
45	70	</div>
46	71	<?php
47		-} elseif (isset($_POST['clear-geocoder-cache'])) {
	72	+} elseif (isset($_POST['clear-geocoder-cache']) && verify_nonce()) {
48	73	include_once LEAFLET_MAP__PLUGIN_DIR . 'class.geocoder.php';
49	74	Leaflet_Geocoder::remove_caches();
50	75	?>
51	76	<div class="notice notice-success is-dismissible">
52		- <p><?php _e('Location caches have been cleared!', 'leaflet-map'); ?></p>
	77	+ <p><?php esc_html_e('Location caches have been cleared!', 'leaflet-map'); ?></p>
53	78	</div>
54	79	<?php
55	80	}
	81	+/** END FORM SUBMISSION */
	82	+
	83	+/** CHECK LEAFLET VERSION */
	84	+$db_js_url = $settings->get('js_url');
	85	+$unpkg_url = "https://unpkg.com/leaflet";
	86	+$is_unpkg_url = substr_compare($db_js_url, $unpkg_url, 0, strlen($unpkg_url)) === 0;
	87	+
	88	+if ($is_unpkg_url && $db_js_url !== $settings->options[ 'js_url' ]->default) {
56	89	?>
	90	+ <div class="notice notice-info is-dismissible">
	91	+ <p><?php
	92	+ esc_html_e('Info: your leaflet version may be out-of-sync with the latest default version: ', 'leaflet-map');
	93	+ echo Leaflet_Map::$leaflet_version;
	94	+ ?></p>
	95	+ </div>
	96	+<?php
	97	+}
	98	+/** END LEAFLET VERSION */
	99	+?>
	100	+
	101	+<p><?php echo esc_html($description); ?></p>
	102	+<?php
	103	+/** FILTERS for helptext */
	104	+$allowed_helptext_tags = [
	105	+ 'a' => [ 'href' => [], 'title' => [], 'target' => [] ],
	106	+ 'code' => [],
	107	+ 'br' => [],
	108	+ 'p' => [],
	109	+ 'b' => [],
	110	+];
	111	+?>
	112	+
	113	+<h3><?php esc_html_e('Found an issue?', 'leaflet-map') ?></h3>
	114	+<p><?php esc_html_e('Post it to ', 'leaflet-map') ?><b><?php esc_html_e('WordPress Support', 'leaflet-map') ?></b>: <a href="https://wordpress.org/support/plugin/leaflet-map/" target="_blank">Leaflet Map (WordPress)</a></p>
	115	+<p><?php esc_html_e('Add an issue on ', 'leaflet-map') ?><b>GitHub</b>: <a href="https://github.com/bozdoz/wp-plugin-leaflet-map/issues" target="_blank">Leaflet Map (GitHub)</a></p>
	116	+
57	117	<div class="wrap">
58	118	<div class="wrap">
59	119	<form method="post">
	120	+ <?php wp_nonce_field(NONCE_ACTION, NONCE_NAME); ?>
60	121	<div class="container">
61		- <h2><?php _e('Settings', 'leaflet-map'); ?></h2>
	122	+ <h2><?php esc_html_e('Settings', 'leaflet-map'); ?></h2>
62	123	<hr>
63	124	</div>
64	125	<?php
65	126	foreach ($settings->options as $name => $option) {
		@@ -66,9 +127,9 @@
66	127	if (!$option->type) continue;
67	128	?>
68	129	<div class="container">
69	130	<label>
70		- <span class="label"><?php echo $option->display_name; ?></span>
	131	+ <span class="label"><?php echo esc_html($option->display_name); ?></span>
71	132	<span class="input-group">
72	133	<?php
73	134	$option->widget($name, $settings->get($name));
74	135	?>
		@@ -78,9 +139,11 @@
78	139	<?php
79	140	if ($option->helptext) {
80	141	?>
81	142	<div class="helptext">
82		- <p class="description"><?php echo $option->helptext; ?></p>
	143	+ <p class="description"><?php
	144	+ echo wp_kses( $option->helptext, $allowed_helptext_tags );
	145	+ ?></p>
83	146	</div>
84	147	<?php
85	148	}
86	149	?>
		@@ -92,25 +155,25 @@
92	155	<input type="submit"
93	156	name="submit"
94	157	id="submit"
95	158	class="button button-primary"
96		- value="<?php _e('Save Changes', 'leaflet-map'); ?>">
	159	+ value="<?php esc_html_e('Save Changes', 'leaflet-map'); ?>">
97	160	<input type="submit"
98	161	name="reset"
99	162	id="reset"
100	163	class="button button-secondary"
101		- value="<?php _e('Reset to Defaults', 'leaflet-map'); ?>">
	164	+ value="<?php esc_html_e('Reset to Defaults', 'leaflet-map'); ?>">
102	165	<input type="submit"
103	166	name="clear-geocoder-cache"
104	167	id="clear-geocoder-cache"
105	168	class="button button-secondary"
106		- value="<?php _e('Clear Geocoder Cache', 'leaflet-map'); ?>">
	169	+ value="<?php esc_html_e('Clear Geocoder Cache', 'leaflet-map'); ?>">
107	170	</div>
108	171
109	172	</form>
110	173
111	174	<div>
112		- <p>Leaf icon provided by <a href="https://fontawesome.com/" target="_blank">Font Awesome</a>, under their free license.</p>
	175	+ <p><?php esc_html_e('Leaf icon provided by ', 'leaflet-map') ?><a href="https://fontawesome.com/" target="_blank">Font Awesome</a><?php esc_html_e( ', under their free license.', 'leaflet-map' ) ?></p>
113	176	</div>
114	177
115	178	</div>
116	179	</div>