← All changes | includes/class-metasync-seo-suite.php +88 -50 2.6.25 → 2.7.1 View file →

		@@ -69,9 +69,9 @@
69	69	* context so this box never engages in either.
70	70	*/
71	71	private function is_block_editor_request()
72	72	{
73		- if (!empty($_REQUEST['meta-box-loader'])) {
	73	+ if (!empty($_REQUEST['meta-box-loader'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only request flag for meta box registration
74	74	return true;
75	75	}
76	76	$screen = get_current_screen();
77	77	return $screen && $screen->is_block_editor();
		@@ -170,10 +170,33 @@
170	170	if (method_exists('Metasync_OpenGraph', 'strip_auto_draft_title')
171	171	&& defined('Metasync_OpenGraph::AUTO_DRAFT_PRONE_KEYS')
172	172	&& in_array($key, Metasync_OpenGraph::AUTO_DRAFT_PRONE_KEYS, true)
173	173	) {
174		- return Metasync_OpenGraph::strip_auto_draft_title($value);
	174	+ $value = Metasync_OpenGraph::strip_auto_draft_title($value);
175	175	}
	176	+ // A social title that merely mirrors the post title is the old pre-fill's
	177	+ // snapshot — stale the moment the post is renamed — not a customization.
	178	+ // Collapsed so the field renders empty (the default stays visible as the
	179	+ // placeholder) and the shared save handler stores nothing for it.
	180	+ // @phpstan-ignore-next-line function.alreadyNarrowedType
	181	+ if (method_exists('Metasync_OpenGraph', 'strip_title_snapshot')
	182	+ && defined('Metasync_OpenGraph::TITLE_DEFAULTED_KEYS')
	183	+ && in_array($key, Metasync_OpenGraph::TITLE_DEFAULTED_KEYS, true)
	184	+ && is_string($value)
	185	+ ) {
	186	+ $value = Metasync_OpenGraph::strip_title_snapshot($post_id, $key, $value);
	187	+ }
	188	+ // A social description that merely mirrors the resolved excerpt is the
	189	+ // same kind of snapshot — stale the moment the excerpt or content
	190	+ // changes — collapsed for the same reason as the title above.
	191	+ // @phpstan-ignore-next-line function.alreadyNarrowedType
	192	+ if (method_exists('Metasync_OpenGraph', 'strip_description_snapshot')
	193	+ && defined('Metasync_OpenGraph::DESCRIPTION_DEFAULTED_KEYS')
	194	+ && in_array($key, Metasync_OpenGraph::DESCRIPTION_DEFAULTED_KEYS, true)
	195	+ && is_string($value)
	196	+ ) {
	197	+ $value = Metasync_OpenGraph::strip_description_snapshot($post_id, $key, $value);
	198	+ }
176	199	return (string) $value;
177	200	}
178	201
179	202	private static function checked_attr($cond)
		@@ -204,9 +227,8 @@
204	227	public function render($post)
205	228	{
206	229	$P = $this->present;
207	230	$id = $post->ID;
208		- $a = 'esc_attr';
209	231
210	232	$managed = $this->is_managed_page($id);
211	233
212	234	$has_seo = isset($P['metasync-seo-meta']) || isset($P['metasync-seo-lps-notice']);
		@@ -304,10 +326,15 @@
304	326	$opengraph = class_exists('Metasync_OpenGraph') ? Metasync_OpenGraph::get_instance() : null;
305	327	if ($opengraph) {
306	328	$og_defaults = $opengraph->get_default_og_values($id);
307	329	}
308		- $og_title = self::v($id, '_metasync_og_title') ?: $og_defaults['title'];
309		- $og_desc = self::v($id, '_metasync_og_description') ?: $og_defaults['description'];
	330	+ // Social titles and descriptions render placeholder-only: the default
	331	+ // (the post title, the resolved excerpt) stays visible in the
	332	+ // placeholder but is never a form value, so submitting the page cannot
	333	+ // persist a snapshot of it. Images keep their computed default as a
	334	+ // real value, matching the standalone OG box.
	335	+ $og_title = self::v($id, '_metasync_og_title');
	336	+ $og_desc = self::v($id, '_metasync_og_description');
310	337	$og_image = self::v($id, '_metasync_og_image') ?: $og_defaults['image'];
311	338	$og_type = self::v($id, '_metasync_og_type') ?: 'article';
312	339	$og_url = self::v($id, '_metasync_og_url');
313	340	if ($og_url === '') {
		@@ -314,10 +341,17 @@
314	341	$og_url = $opengraph ? $opengraph->get_canonical_url($post) : $pretty;
315	342	}
316	343	$tw_card = self::v($id, '_metasync_twitter_card') ?: 'summary_large_image';
317	344	$tw_site = self::v($id, '_metasync_twitter_site');
318		- $tw_title = self::v($id, '_metasync_twitter_title') ?: $og_title;
319		- $tw_desc = self::v($id, '_metasync_twitter_description') ?: $og_desc;
	345	+ $tw_title = self::v($id, '_metasync_twitter_title');
	346	+ // Placeholder-only like the standalone box: when no twitter title is
	347	+ // stored the placeholder shows the og title if one is set, else the
	348	+ // default (post) title — the exact chain the standalone OG box uses.
	349	+ $tw_title_placeholder = ($og_title !== '') ? $og_title : $og_defaults['title'];
	350	+ // Same chain for the twitter description's placeholder: the og
	351	+ // description if one is set, else the resolved excerpt default.
	352	+ $tw_desc_placeholder = ($og_desc !== '') ? $og_desc : $og_defaults['description'];
	353	+ $tw_desc = self::v($id, '_metasync_twitter_description');
320	354	$tw_image = self::v($id, '_metasync_twitter_image') ?: $og_image;
321	355	$tw_alt = self::v($id, '_metasync_twitter_image_alt');
322	356	$tw_app_iphone = self::v($id, '_metasync_twitter_app_id_iphone');
323	357	$tw_app_ipad = self::v($id, '_metasync_twitter_app_id_ipad');
		@@ -378,9 +412,9 @@
378	412	<div class="rail">
379	413	<?php
380	414	$first = true;
381	415	$tab = function ($key, $icon, $label) use (&$first) {
382		- echo '<div class="nav' . ($first ? ' active' : '') . '" role="button" tabindex="0" onclick="mssGo(this,\'' . esc_attr($key) . '\')" onkeydown="mssKey(event,this)"><span class="ic">' . $icon . '</span> ' . $label . '</div>';
	416	+ echo '<div class="nav' . ($first ? ' active' : '') . '" role="button" tabindex="0" onclick="mssGo(this,\'' . esc_attr($key) . '\')" onkeydown="mssKey(event,this)"><span class="ic">' . esc_html($icon) . '</span> ' . esc_html($label) . '</div>';
383	417	$first = false;
384	418	};
385	419	if ($has_seo) { $tab('seo', '&#128269;', 'SEO'); }
386	420	if ($has_robots) { $tab('robots', '&#129302;', 'Robots'); }
		@@ -402,9 +436,9 @@
402	436	};
403	437	?>
404	438
405	439	<?php if ($has_seo): ?>
406		- <div class="<?php echo $pcls(); ?>" data-p="seo">
	440	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="seo">
407	441	<h2 class="p-title">&#128269; Search Appearance</h2>
408	442	<p class="p-sub">Set the SEO Title and Meta Description. Leave blank to use the OTTO suggestion.</p>
409	443	<?php if ($show_imported_note): ?>
410	444	<p class="p-sub">The greyed-out value below was imported from another SEO plugin. It is used only until OTTO has a suggestion for this page.</p>
		@@ -410,13 +444,13 @@
410	444	<p class="p-sub">The greyed-out value below was imported from another SEO plugin. It is used only until OTTO has a suggestion for this page.</p>
411	445	<?php endif; ?>
412	446	<div class="field">
413	447	<div class="lbl"><span>SEO Title</span><span class="cc"><span class="tC">0</span>/60</span></div>
414		- <input class="ctrl seoT" name="metasync_seo_title" value="<?php echo $a($seo_title); ?>" placeholder="<?php echo $a($ghost_title); ?>" oninput="mssRc()">
	448	+ <input class="ctrl seoT" name="metasync_seo_title" value="<?php echo esc_attr($seo_title); ?>" placeholder="<?php echo esc_attr($ghost_title); ?>" oninput="mssRc()">
415	449	</div>
416	450	<div class="field">
417	451	<div class="lbl"><span>Meta Description</span><span class="cc"><span class="dC">0</span>/160</span></div>
418		- <textarea class="ctrl seoD" name="metasync_seo_desc" placeholder="<?php echo $a($ghost_desc); ?>" oninput="mssRc()"><?php echo esc_textarea($seo_desc); ?></textarea>
	452	+ <textarea class="ctrl seoD" name="metasync_seo_desc" placeholder="<?php echo esc_attr($ghost_desc); ?>" oninput="mssRc()"><?php echo esc_textarea($seo_desc); ?></textarea>
419	453	</div>
420	454	<?php if ($otto_kw !== ''): ?>
421	455	<div class="field">
422	456	<div class="lbl"><span>Focus Keyword</span><span class="ro-badge">Managed by OTTO</span></div>
		@@ -433,9 +467,9 @@
433	467	</div>
434	468	<?php endif; ?>
435	469
436	470	<?php if ($has_robots): ?>
437		- <div class="<?php echo $pcls(); ?>" data-p="robots">
	471	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="robots">
438	472	<h2 class="p-title">&#129302; Robots Meta</h2>
439	473	<p class="p-sub">Crawler directives for this post. These are independent flags &mdash; combine as needed.</p>
440	474	<?php if ($has_crob): ?>
441	475	<div class="sec">Common directives</div>
		@@ -450,9 +484,10 @@
450	484	'nosnippet' => array('No Snippet', 'No text snippet in results'),
451	485	);
452	486	foreach ($common as $key => $c): ?>
453	487	<label class="chip">
454		- <input type="checkbox" name="common_robots_meta[<?php echo $a($key); ?>]" value="<?php echo $a($key); ?>"<?php echo isset($cr[$key]) ? self::checked_attr($cr[$key] === $key) : ''; ?>>
	488	+ <input type="checkbox" name="common_robots_meta[<?php echo esc_attr($key); ?>]" value="<?php echo esc_attr($key); ?>"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
	489	+ echo isset($cr[$key]) ? esc_attr(self::checked_attr($cr[$key] === $key)) : ''; ?>>
455	490	<span class="box">&#10003;</span><div><?php echo esc_html($c[0]); ?><small><?php echo esc_html($c[1]); ?></small></div>
456	491	</label>
457	492	<?php endforeach; ?>
458	493	</div>
		@@ -461,13 +496,13 @@
461	496	<div class="sec">Advanced limits <span class="sec-note">&mdash; tick a limit to apply it</span></div>
462	497	<div class="row">
463	498	<div class="field">
464	499	<label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-snippet][enable]" value="1"<?php checked('1', $ar_snip_e); ?>><span class="box">&#10003;</span><div>Max Snippet</div></label>
465		- <input class="ctrl" type="number" name="advanced_robots_meta[max-snippet][length]" value="<?php echo $a($ar_snip_l); ?>" min="-1" placeholder="e.g. 160">
	500	+ <input class="ctrl" type="number" name="advanced_robots_meta[max-snippet][length]" value="<?php echo esc_attr($ar_snip_l); ?>" min="-1" placeholder="e.g. 160">
466	501	<div class="hint">Max snippet length in characters.</div></div>
467	502	<div class="field">
468	503	<label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-video-preview][enable]" value="1"<?php checked('1', $ar_vid_e); ?>><span class="box">&#10003;</span><div>Max Video Preview</div></label>
469		- <input class="ctrl" type="number" name="advanced_robots_meta[max-video-preview][length]" value="<?php echo $a($ar_vid_l); ?>" min="-1" placeholder="e.g. -1">
	504	+ <input class="ctrl" type="number" name="advanced_robots_meta[max-video-preview][length]" value="<?php echo esc_attr($ar_vid_l); ?>" min="-1" placeholder="e.g. -1">
470	505	<div class="hint">Max preview duration in seconds.</div></div>
471	506	</div>
472	507	<div class="field">
473	508	<label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-image-preview][enable]" value="1"<?php checked('1', $ar_img_e); ?>><span class="box">&#10003;</span><div>Max Image Preview</div></label>
		@@ -480,14 +515,14 @@
480	515	</div>
481	516	<?php endif; ?>
482	517
483	518	<?php if ($has_canon): ?>
484		- <div class="<?php echo $pcls(); ?>" data-p="canonical">
	519	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="canonical">
485	520	<h2 class="p-title">&#128279; Canonical URL</h2>
486	521	<p class="p-sub">Point search engines to the preferred version of this content.</p>
487	522	<div class="field">
488	523	<div class="lbl"><span>Canonical URL</span></div>
489		- <input class="ctrl" type="text" name="post_canonical_url_meta" value="<?php echo $a($canon); ?>" placeholder="<?php echo $a($pretty); ?>">
	524	+ <input class="ctrl" type="text" name="post_canonical_url_meta" value="<?php echo esc_attr($canon); ?>" placeholder="<?php echo esc_attr($pretty); ?>">
490	525	<div class="hint">Leave blank to use this post's own URL.</div>
491	526	</div>
492	527	</div>
493	528	<?php endif; ?>
		@@ -492,13 +527,14 @@
492	527	</div>
493	528	<?php endif; ?>
494	529
495	530	<?php if ($has_redir): ?>
496		- <div class="<?php echo $pcls(); ?>" data-p="redirect">
	531	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="redirect">
497	532	<h2 class="p-title">&#8618;&#65039; Redirection</h2>
498	533	<p class="p-sub">Send visitors of this post somewhere else.</p>
499	534	<div class="switch-card">
500		- <label class="switch"><input type="checkbox" name="post_redirect_meta[enable]" value="true"<?php echo self::checked_attr($rd_en); ?>></label>
	535	+ <label class="switch"><input type="checkbox" name="post_redirect_meta[enable]" value="true"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
	536	+ echo esc_attr(self::checked_attr($rd_en)); ?>></label>
501	537	<div class="m"><b>Enable redirection</b><span>Send visitors of this post to another URL</span></div>
502	538	</div>
503	539	<div class="row">
504	540	<div class="field"><div class="lbl"><span>Type</span></div>
		@@ -509,36 +545,37 @@
509	545	<option value="410"<?php selected($rd_type, '410'); ?>>410 Content Deleted</option>
510	546	<option value="451"<?php selected($rd_type, '451'); ?>>451 Content Unavailable</option>
511	547	</select></div>
512	548	<div class="field"><div class="lbl"><span>Destination URL</span></div>
513		- <input class="ctrl" type="text" name="post_redirect_meta[url]" value="<?php echo $a($rd_url); ?>" placeholder="https://example.com/new-url/"></div>
	549	+ <input class="ctrl" type="text" name="post_redirect_meta[url]" value="<?php echo esc_attr($rd_url); ?>" placeholder="https://example.com/new-url/"></div>
514	550	</div>
515	551	</div>
516	552	<?php endif; ?>
517	553
518	554	<?php if ($has_social): ?>
519		- <div class="<?php echo $pcls(); ?>" data-p="social">
	555	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="social">
520	556	<h2 class="p-title">&#128226; Social &amp; Open Graph</h2>
521	557	<p class="p-sub">How this post looks when shared on social platforms.</p>
522	558	<div class="switch-card">
523		- <label class="switch"><input type="checkbox" name="_metasync_og_enabled" value="1"<?php echo self::checked_attr($og_en); ?>></label>
	559	+ <label class="switch"><input type="checkbox" name="_metasync_og_enabled" value="1"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
	560	+ echo esc_attr(self::checked_attr($og_en)); ?>></label>
524	561	<div class="m"><b>Enable Open Graph &amp; Social Media Tags</b><span>Adds Open Graph + Twitter Card tags for better sharing</span></div>
525	562	</div>
526	563
527	564	<div class="subhead"><span class="sq"></span> Open Graph</div>
528		- <div class="field"><div class="lbl"><span>Title (og:title)</span></div><input class="ctrl" name="_metasync_og_title" maxlength="60" value="<?php echo $a($og_title); ?>" placeholder="<?php echo $a(get_the_title($id)); ?>" oninput="mssSocial()"></div>
529		- <div class="field"><div class="lbl"><span>Description (og:description)</span></div><textarea class="ctrl" name="_metasync_og_description" maxlength="155" placeholder="Post excerpt&hellip;" oninput="mssSocial()"><?php echo esc_textarea($og_desc); ?></textarea></div>
	565	+ <div class="field"><div class="lbl"><span>Title (og:title)</span></div><input class="ctrl" name="_metasync_og_title" maxlength="60" value="<?php echo esc_attr($og_title); ?>" placeholder="<?php echo esc_attr($og_defaults['title']); ?>" oninput="mssSocial()"></div>
	566	+ <div class="field"><div class="lbl"><span>Description (og:description)</span></div><textarea class="ctrl" name="_metasync_og_description" maxlength="155" placeholder="<?php echo esc_attr($og_defaults['description']); ?>" oninput="mssSocial()"><?php echo esc_textarea($og_desc); ?></textarea></div>
530	567	<div class="field"><div class="lbl"><span>Image (og:image)</span></div>
531		- <div class="mss-imgrow"><input class="ctrl ogimg" type="url" name="_metasync_og_image" value="<?php echo $a($og_image); ?>" placeholder="https://example.com/image.jpg" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".ogimg" type="button">Select</button></div>
	568	+ <div class="mss-imgrow"><input class="ctrl ogimg" type="url" name="_metasync_og_image" value="<?php echo esc_attr($og_image); ?>" placeholder="https://example.com/image.jpg" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".ogimg" type="button">Select</button></div>
532	569	<div class="hint">Recommended 1200&times;630px.</div></div>
533	570	<div class="row">
534	571	<div class="field"><div class="lbl"><span>Type (og:type)</span></div>
535	572	<select class="ctrl" name="_metasync_og_type">
536	573	<?php foreach (array('article', 'website', 'blog', 'product', 'video', 'music') as $t): ?>
537		- <option value="<?php echo $a($t); ?>"<?php selected($og_type, $t); ?>><?php echo esc_html(ucfirst($t)); ?></option>
	574	+ <option value="<?php echo esc_attr($t); ?>"<?php selected($og_type, $t); ?>><?php echo esc_html(ucfirst($t)); ?></option>
538	575	<?php endforeach; ?>
539	576	</select></div>
540		- <div class="field"><div class="lbl"><span>URL (og:url)</span></div><input class="ctrl" type="url" name="_metasync_og_url" value="<?php echo $a($og_url); ?>" placeholder="<?php echo $a($pretty); ?>"<?php echo $post->post_status === 'auto-draft' ? ' disabled' : ''; ?>></div>
	577	+ <div class="field"><div class="lbl"><span>URL (og:url)</span></div><input class="ctrl" type="url" name="_metasync_og_url" value="<?php echo esc_attr($og_url); ?>" placeholder="<?php echo esc_attr($pretty); ?>"<?php echo $post->post_status === 'auto-draft' ? ' disabled' : ''; ?>></div>
541	578	</div>
542	579
543	580	<div class="subhead"><span class="sq"></span> Twitter Card</div>
544	581	<div class="field"><div class="lbl"><span>Card Type</span></div>
		@@ -548,36 +585,36 @@
548	585	<option value="app"<?php selected($tw_card, 'app'); ?>>App</option>
549	586	<option value="player"<?php selected($tw_card, 'player'); ?>>Player</option>
550	587	</select></div>
551	588	<div class="row">
552		- <div class="field"><div class="lbl"><span>Twitter Site</span></div><input class="ctrl" name="_metasync_twitter_site" value="<?php echo $a($tw_site); ?>" placeholder="@yoursite"></div>
553		- <div class="field"><div class="lbl"><span>Twitter Title</span></div><input class="ctrl" name="_metasync_twitter_title" maxlength="70" value="<?php echo $a($tw_title); ?>" placeholder="Falls back to OG title" oninput="mssSocial()"></div>
	589	+ <div class="field"><div class="lbl"><span>Twitter Site</span></div><input class="ctrl" name="_metasync_twitter_site" value="<?php echo esc_attr($tw_site); ?>" placeholder="@yoursite"></div>
	590	+ <div class="field"><div class="lbl"><span>Twitter Title</span></div><input class="ctrl" name="_metasync_twitter_title" maxlength="70" value="<?php echo esc_attr($tw_title); ?>" placeholder="<?php echo esc_attr($tw_title_placeholder); ?>" oninput="mssSocial()"></div>
554	591	</div>
555		- <div class="field"><div class="lbl"><span>Twitter Description</span></div><textarea class="ctrl" name="_metasync_twitter_description" maxlength="200" placeholder="Falls back to OG description" oninput="mssSocial()"><?php echo esc_textarea($tw_desc); ?></textarea></div>
	592	+ <div class="field"><div class="lbl"><span>Twitter Description</span></div><textarea class="ctrl" name="_metasync_twitter_description" maxlength="200" placeholder="<?php echo esc_attr($tw_desc_placeholder); ?>" oninput="mssSocial()"><?php echo esc_textarea($tw_desc); ?></textarea></div>
556	593	<div class="row">
557	594	<div class="field"><div class="lbl"><span>Twitter Image</span></div>
558		- <div class="mss-imgrow"><input class="ctrl twimg" type="url" name="_metasync_twitter_image" value="<?php echo $a($tw_image); ?>" placeholder="Falls back to OG image" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".twimg" type="button">Select</button></div></div>
559		- <div class="field"><div class="lbl"><span>Image Alt</span></div><input class="ctrl" name="_metasync_twitter_image_alt" maxlength="420" value="<?php echo $a($tw_alt); ?>" placeholder="Accessibility description"></div>
	595	+ <div class="mss-imgrow"><input class="ctrl twimg" type="url" name="_metasync_twitter_image" value="<?php echo esc_attr($tw_image); ?>" placeholder="Falls back to OG image" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".twimg" type="button">Select</button></div></div>
	596	+ <div class="field"><div class="lbl"><span>Image Alt</span></div><input class="ctrl" name="_metasync_twitter_image_alt" maxlength="420" value="<?php echo esc_attr($tw_alt); ?>" placeholder="Accessibility description"></div>
560	597	</div>
561	598
562	599	<div class="mssTwApp" style="display:<?php echo $tw_card === 'app' ? 'block' : 'none'; ?>">
563	600	<div class="subhead"><span class="sq"></span> App Card</div>
564	601	<div class="row">
565		- <div class="field"><div class="lbl"><span>iPhone App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_iphone" value="<?php echo $a($tw_app_iphone); ?>" placeholder="307234931"<?php echo $tw_app_disabled; ?>></div>
566		- <div class="field"><div class="lbl"><span>iPad App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_ipad" value="<?php echo $a($tw_app_ipad); ?>" placeholder="307234931"<?php echo $tw_app_disabled; ?>></div>
	602	+ <div class="field"><div class="lbl"><span>iPhone App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_iphone" value="<?php echo esc_attr($tw_app_iphone); ?>" placeholder="307234931"<?php echo esc_attr($tw_app_disabled); ?>></div>
	603	+ <div class="field"><div class="lbl"><span>iPad App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_ipad" value="<?php echo esc_attr($tw_app_ipad); ?>" placeholder="307234931"<?php echo esc_attr($tw_app_disabled); ?>></div>
567	604	</div>
568		- <div class="field"><div class="lbl"><span>Google Play App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_googleplay" value="<?php echo $a($tw_app_gp); ?>" placeholder="com.android.app"<?php echo $tw_app_disabled; ?>></div>
	605	+ <div class="field"><div class="lbl"><span>Google Play App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_googleplay" value="<?php echo esc_attr($tw_app_gp); ?>" placeholder="com.android.app"<?php echo esc_attr($tw_app_disabled); ?>></div>
569	606	<div class="row">
570		- <div class="field"><div class="lbl"><span>iPhone Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_iphone" value="<?php echo $a($tw_app_url_iphone); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
571		- <div class="field"><div class="lbl"><span>iPad Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_ipad" value="<?php echo $a($tw_app_url_ipad); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
	607	+ <div class="field"><div class="lbl"><span>iPhone Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_iphone" value="<?php echo esc_attr($tw_app_url_iphone); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
	608	+ <div class="field"><div class="lbl"><span>iPad Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_ipad" value="<?php echo esc_attr($tw_app_url_ipad); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
572	609	</div>
573	610	<div class="row">
574		- <div class="field"><div class="lbl"><span>Google Play Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_googleplay" value="<?php echo $a($tw_app_url_gp); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
	611	+ <div class="field"><div class="lbl"><span>Google Play Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_googleplay" value="<?php echo esc_attr($tw_app_url_gp); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
575	612	<div class="field"><div class="lbl"><span>App Store Country</span></div>
576		- <select class="ctrl" name="_metasync_twitter_app_country"<?php echo $tw_app_disabled; ?>>
	613	+ <select class="ctrl" name="_metasync_twitter_app_country"<?php echo esc_attr($tw_app_disabled); ?>>
577	614	<option value=""<?php selected($tw_app_country, ''); ?>>US (Default)</option>
578	615	<?php foreach (array('GB' => 'United Kingdom', 'CA' => 'Canada', 'AU' => 'Australia', 'DE' => 'Germany', 'FR' => 'France', 'JP' => 'Japan', 'IN' => 'India', 'BR' => 'Brazil', 'MX' => 'Mexico') as $code => $country): ?>
579		- <option value="<?php echo $a($code); ?>"<?php selected($tw_app_country, $code); ?>><?php echo esc_html($country); ?></option>
	616	+ <option value="<?php echo esc_attr($code); ?>"<?php selected($tw_app_country, $code); ?>><?php echo esc_html($country); ?></option>
580	617	<?php endforeach; ?>
581	618	</select>
582	619	<div class="hint">Required if your app is not available in the US App Store.</div>
583	620	</div>
		@@ -584,12 +621,12 @@
584	621	</div>
585	622	</div>
586	623	<div class="mssTwPlayer" style="display:<?php echo $tw_card === 'player' ? 'block' : 'none'; ?>">
587	624	<div class="subhead"><span class="sq"></span> Player Card</div>
588		- <div class="field"><div class="lbl"><span>Player URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_player" value="<?php echo $a($tw_player); ?>" placeholder="https://example.com/player"<?php echo $tw_player_disabled; ?>></div>
	625	+ <div class="field"><div class="lbl"><span>Player URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_player" value="<?php echo esc_attr($tw_player); ?>" placeholder="https://example.com/player"<?php echo esc_attr($tw_player_disabled); ?>></div>
589	626	<div class="row">
590		- <div class="field"><div class="lbl"><span>Width (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_width" min="1" value="<?php echo $a($tw_player_w); ?>" placeholder="1280"<?php echo $tw_player_disabled; ?>></div>
591		- <div class="field"><div class="lbl"><span>Height (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_height" min="1" value="<?php echo $a($tw_player_h); ?>" placeholder="720"<?php echo $tw_player_disabled; ?>></div>
	627	+ <div class="field"><div class="lbl"><span>Width (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_width" min="1" value="<?php echo esc_attr($tw_player_w); ?>" placeholder="1280"<?php echo esc_attr($tw_player_disabled); ?>></div>
	628	+ <div class="field"><div class="lbl"><span>Height (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_height" min="1" value="<?php echo esc_attr($tw_player_h); ?>" placeholder="720"<?php echo esc_attr($tw_player_disabled); ?>></div>
592	629	</div>
593	630	</div>
594	631
595	632	<div class="subhead"><span class="sq"></span> Social preview</div>
		@@ -631,9 +668,9 @@
631	668	</div>
632	669	<?php endif; ?>
633	670
634	671	<?php if ($has_schema): ?>
635		- <div class="<?php echo $pcls(); ?>" data-p="schema">
	672	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="schema">
636	673	<h2 class="p-title">&#128208; Schema Markup</h2>
637	674	<div class="mss-native">
638	675	<?php
639	676	if (!empty($this->schema_box['callback'])) {
		@@ -646,16 +683,16 @@
646	683	</div>
647	684	<?php endif; ?>
648	685
649	686	<?php if ($has_video): ?>
650		- <div class="<?php echo $pcls(); ?>" data-p="video">
	687	+ <div class="<?php echo esc_attr($pcls()); ?>" data-p="video">
651	688	<h2 class="p-title">&#127916; Video Sitemap</h2>
652	689	<p class="p-sub">Override auto-detected video data. Leave blank to use auto-detection.</p>
653		- <div class="field"><div class="lbl"><span>Video URL</span></div><input class="ctrl" type="url" name="metasync_video_url" value="<?php echo $a($v_url); ?>" placeholder="https://www.youtube.com/watch?v=..."></div>
654		- <div class="field"><div class="lbl"><span>Thumbnail URL</span></div><input class="ctrl" type="url" name="metasync_video_thumbnail" value="<?php echo $a($v_thumb); ?>" placeholder="https://img.youtube.com/vi/.../hqdefault.jpg"></div>
655		- <div class="field"><div class="lbl"><span>Video Title</span></div><input class="ctrl" name="metasync_video_title" value="<?php echo $a($v_title); ?>" placeholder="Defaults to post title"></div>
	690	+ <div class="field"><div class="lbl"><span>Video URL</span></div><input class="ctrl" type="url" name="metasync_video_url" value="<?php echo esc_attr($v_url); ?>" placeholder="https://www.youtube.com/watch?v=..."></div>
	691	+ <div class="field"><div class="lbl"><span>Thumbnail URL</span></div><input class="ctrl" type="url" name="metasync_video_thumbnail" value="<?php echo esc_attr($v_thumb); ?>" placeholder="https://img.youtube.com/vi/.../hqdefault.jpg"></div>
	692	+ <div class="field"><div class="lbl"><span>Video Title</span></div><input class="ctrl" name="metasync_video_title" value="<?php echo esc_attr($v_title); ?>" placeholder="Defaults to post title"></div>
656	693	<div class="field"><div class="lbl"><span>Video Description</span></div><textarea class="ctrl" name="metasync_video_description" placeholder="Defaults to post excerpt"><?php echo esc_textarea($v_desc); ?></textarea></div>
657		- <div class="field"><div class="lbl"><span>Duration (seconds)</span></div><input class="ctrl short" type="number" name="metasync_video_duration" min="0" step="1" value="<?php echo $a($v_dur); ?>" placeholder="300"></div>
	694	+ <div class="field"><div class="lbl"><span>Duration (seconds)</span></div><input class="ctrl short" type="number" name="metasync_video_duration" min="0" step="1" value="<?php echo esc_attr($v_dur); ?>" placeholder="300"></div>
658	695	</div>
659	696	<?php endif; ?>
660	697
661	698	</div>
		@@ -724,9 +761,10 @@
724	761	window.mssSocial=function(){
725	762	var seoT=root.querySelector('.seoT'), seoD=root.querySelector('.seoD');
726	763	var ogTitleEl=byName('_metasync_og_title');
727	764	var baseTitle=mssFld('_metasync_og_title') || (ogTitleEl&&ogTitleEl.getAttribute('placeholder')) || (seoT&&seoT.value.trim()) || 'Untitled';
728		- var baseDesc =mssFld('_metasync_og_description') || (seoD&&seoD.value.trim()) || 'No description set.';
	765	+ var ogDescEl=byName('_metasync_og_description');
	766	+ var baseDesc =mssFld('_metasync_og_description') || (ogDescEl&&ogDescEl.getAttribute('placeholder')) || (seoD&&seoD.value.trim()) || 'No description set.';
729	767	var baseImg =mssFld('_metasync_og_image');
730	768	var twTitle=mssFld('_metasync_twitter_title');
731	769	var twDesc =mssFld('_metasync_twitter_description');
732	770	var twImg =mssFld('_metasync_twitter_image');