| @@ -1375,9 +1375,9 @@ | ||
| 1375 | 1375 | $status_title_header = 'Not Synced - Heartbeat API not responding or unreachable'; |
| 1376 | 1376 | $status_text_header = 'Not Synced'; |
| 1377 | 1377 | } |
| 1378 | 1378 | ?> |
| 1379 | - <div class="metasync-integration-status <?php echo esc_attr($status_class_header); ?>" | |
| 1379 | + <div class="metasync-integration-status <?php echo $status_class_header; ?>" | |
| 1380 | 1380 | title="<?php echo esc_attr($status_title_header); ?>"> |
| 1381 | 1381 | <span class="status-indicator"></span> |
| 1382 | 1382 | <span class="status-text"><?php echo esc_html($status_text_header); ?></span> |
| 1383 | 1383 | </div> |
| @@ -1637,9 +1637,9 @@ | ||
| 1637 | 1637 | * @param string $description Optional subtitle shown below the title. |
| 1638 | 1638 | */ |
| 1639 | 1639 | public function render_layout_open($page_title = '', $current_page = '', $description = '') |
| 1640 | 1640 | { |
| 1641 | - $theme = get_option('metasync_theme', 'dark'); | |
| 1641 | + $theme = esc_attr(get_option('metasync_theme', 'dark')); | |
| 1642 | 1642 | $plugin_name = Metasync::get_effective_plugin_name(); |
| 1643 | 1643 | $general = Metasync::get_option('general') ?? []; |
| 1644 | 1644 | $is_connected = Metasync_Heartbeat_Manager::instance()->is_heartbeat_connected($general); |
| 1645 | 1645 | // badge reflects confirmed heartbeat health (connected / stale / |
| @@ -1648,9 +1648,9 @@ | ||
| 1648 | 1648 | $logo = $this->resolve_logo_data(); |
| 1649 | 1649 | |
| 1650 | 1650 | $current_theme = get_option('metasync_theme', 'dark'); |
| 1651 | 1651 | ?> |
| 1652 | - <div class="wrap metasync-dashboard-wrap" data-theme="<?php echo esc_attr($theme); ?>"> | |
| 1652 | + <div class="wrap metasync-dashboard-wrap" data-theme="<?php echo $theme; ?>"> | |
| 1653 | 1653 | |
| 1654 | 1654 | <?php |
| 1655 | 1655 | // Inject whitelabel color palette overrides |
| 1656 | 1656 | $wl_settings = Metasync::get_whitelabel_settings(); |
| @@ -1680,9 +1680,8 @@ | ||
| 1680 | 1680 | $vars .= '--' . esc_attr($grad_var) . ':linear-gradient(135deg,' . esc_attr($from) . ' 0%,' . esc_attr($to) . ' 100%);'; |
| 1681 | 1681 | } |
| 1682 | 1682 | } |
| 1683 | 1683 | if ($vars) { |
| 1684 | - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSS custom properties inside a raw <style> element; every value is a regex-validated hex color and HTML entities are not decoded in raw text elements | |
| 1685 | 1684 | echo $selector . '{' . $vars . '}'; |
| 1686 | 1685 | } |
| 1687 | 1686 | } |
| 1688 | 1687 | } |
| @@ -1842,12 +1841,12 @@ | ||
| 1842 | 1841 | <ul> |
| 1843 | 1842 | <?php foreach ($seo_items as $key => $item): |
| 1844 | 1843 | $is_active = ($current_page === $key); |
| 1845 | 1844 | $icon = $icons[$key] ?? 'admin-generic'; |
| 1846 | - $url = admin_url('admin.php?page=' . $page_slug . $item['slug_suffix']); | |
| 1845 | + $url = esc_url(admin_url('admin.php?page=' . $page_slug . $item['slug_suffix'])); | |
| 1847 | 1846 | ?> |
| 1848 | 1847 | <li class="<?php echo $is_active ? 'metasync-sidenav-active' : ''; ?>"> |
| 1849 | - <a href="<?php echo esc_url($url); ?>"> | |
| 1848 | + <a href="<?php echo $url; ?>"> | |
| 1850 | 1849 | <span class="metasync-sidenav-icon"><span class="dashicons dashicons-<?php echo esc_attr($icon); ?>"></span></span> |
| 1851 | 1850 | <?php echo esc_html($item['title']); ?> |
| 1852 | 1851 | </a> |
| 1853 | 1852 | </li> |
| @@ -1862,12 +1861,12 @@ | ||
| 1862 | 1861 | <?php foreach ($plugin_items as $key => $item): |
| 1863 | 1862 | if ($key === 'report_issue') continue; |
| 1864 | 1863 | $is_active = ($current_page === $key); |
| 1865 | 1864 | $icon = $icons[$key] ?? 'admin-generic'; |
| 1866 | - $url = admin_url('admin.php?page=' . $page_slug . $item['slug_suffix']); | |
| 1865 | + $url = esc_url(admin_url('admin.php?page=' . $page_slug . $item['slug_suffix'])); | |
| 1867 | 1866 | ?> |
| 1868 | 1867 | <li class="<?php echo $is_active ? 'metasync-sidenav-active' : ''; ?>"> |
| 1869 | - <a href="<?php echo esc_url($url); ?>"> | |
| 1868 | + <a href="<?php echo $url; ?>"> | |
| 1870 | 1869 | <span class="metasync-sidenav-icon"><span class="dashicons dashicons-<?php echo esc_attr($icon); ?>"></span></span> |
| 1871 | 1870 | <?php echo esc_html($item['title']); ?> |
| 1872 | 1871 | </a> |
| 1873 | 1872 | </li> |
| @@ -1918,9 +1917,9 @@ | ||
| 1918 | 1917 | public function render_promo_sidebar() |
| 1919 | 1918 | { |
| 1920 | 1919 | $plugin_name = Metasync::get_effective_plugin_name(); |
| 1921 | 1920 | $otto_name = Metasync::get_whitelabel_otto_name(); |
| 1922 | - $settings_url = admin_url('admin.php?page=' . Metasync_Admin::$page_slug); | |
| 1921 | + $settings_url = esc_url(admin_url('admin.php?page=' . Metasync_Admin::$page_slug)); | |
| 1923 | 1922 | $homepage = Metasync::HOMEPAGE_DOMAIN; |
| 1924 | 1923 | $docs_url = Metasync::DOCUMENTATION_DOMAIN; |
| 1925 | 1924 | // These links point at Search Atlas properties, so they only belong |
| 1926 | 1925 | // here while the plugin runs under its own name AND branding — a |
| @@ -1948,9 +1947,9 @@ | ||
| 1948 | 1947 | <li><span class="promo-check">✓</span> Real-time keyword tracking</li> |
| 1949 | 1948 | <li><span class="promo-check">✓</span> Automated schema markup</li> |
| 1950 | 1949 | <li><span class="promo-check">✓</span> Instant Google indexing</li> |
| 1951 | 1950 | </ul> |
| 1952 | - <a href="<?php echo esc_url($settings_url); ?>" class="metasync-promo-btn metasync-promo-btn--primary"> | |
| 1951 | + <a href="<?php echo $settings_url; ?>" class="metasync-promo-btn metasync-promo-btn--primary"> | |
| 1953 | 1952 | Connect Now |
| 1954 | 1953 | </a> |
| 1955 | 1954 | </div> |
| 1956 | 1955 | |
