← All changes
|
features/email-confirmation/class-email-confirmation.php
+25
-10
4.0.0
→
4.0.3
View file →
| @@ -75,9 +75,9 @@ | ||
| 75 | 75 | **************************************************************************/ |
| 76 | 76 | function column_default($item, $column_name){ |
| 77 | 77 | switch($column_name){ |
| 78 | 78 | case 'email': |
| 79 | - return $item[$column_name]; | |
| 79 | + return esc_html( $item[$column_name] ); | |
| 80 | 80 | case 'registered': |
| 81 | 81 | return date_i18n( "Y-m-d G:i:s", wppb_add_gmt_offset( strtotime( $item[$column_name] ) ) ); |
| 82 | 82 | case 'user-meta': |
| 83 | 83 | global $wpdb; |
| @@ -103,8 +103,22 @@ | ||
| 103 | 103 | } |
| 104 | 104 | } |
| 105 | 105 | |
| 106 | 106 | |
| 107 | + /** | |
| 108 | + * Unconfirmed-user row action. Args live on data attributes so the email is never interpolated into JavaScript. | |
| 109 | + */ | |
| 110 | + function wppb_ec_action_link( $url, $todo, $email, $confirm_message, $label ) { | |
| 111 | + return sprintf( | |
| 112 | + '<a href="#" class="wppb-ec-action" data-url="%1$s" data-todo="%2$s" data-email="%3$s" data-message="%4$s">%5$s</a>', | |
| 113 | + esc_url( $url ), | |
| 114 | + esc_attr( $todo ), | |
| 115 | + esc_attr( $email ), | |
| 116 | + esc_attr( $confirm_message ), | |
| 117 | + esc_html( $label ) | |
| 118 | + ); | |
| 119 | + } | |
| 120 | + | |
| 107 | 121 | /** ************************************************************************ |
| 108 | 122 | * Recommended. This is a custom column method and is responsible for what |
| 109 | 123 | * is rendered in any column with a name/slug of 'username'. Every time the class |
| 110 | 124 | * needs to render a column, it first looks for a method named |
| @@ -119,23 +133,24 @@ | ||
| 119 | 133 | * @see PB_WP_List_Table::::single_row_columns() |
| 120 | 134 | * @param array $item A singular item (one full row's worth of data) |
| 121 | 135 | * @return string Text to be placed inside the column <td> |
| 122 | 136 | **************************************************************************/ |
| 123 | - function column_username($item){ | |
| 137 | + function column_username( $item ) { | |
| 124 | 138 | |
| 125 | 139 | $GRavatar = get_avatar( $item['email'], 32, '' ); |
| 126 | - | |
| 127 | - //Build row actions | |
| 140 | + $current_url = wppb_curpageurl(); | |
| 141 | + $email = $item['ID']; | |
| 142 | + | |
| 128 | 143 | $actions = array( |
| 129 | - 'delete' => sprintf( '<a href="javascript:confirmECAction( \'%s\', \'%s\', \'%s\', \'' . addslashes( __( 'delete this user from the _signups table?', 'profile-builder' ) ) . '\' )">' . __( 'Delete', 'profile-builder' ) . '</a>', wppb_curpageurl(), 'delete', $item['ID'] ), | |
| 130 | - 'confirm' => sprintf( '<a href="javascript:confirmECAction( \'%s\', \'%s\', \'%s\', \'' . addslashes( __( 'confirm this email yourself?', 'profile-builder' ) ) . '\' )">' . __( 'Confirm Email', 'profile-builder' ) . '</a>', wppb_curpageurl(), 'confirm', $item['ID'] ), | |
| 131 | - 'resend' => sprintf( '<a href="javascript:confirmECAction( \'%s\', \'%s\', \'%s\', \'' . addslashes( __( 'resend the activation link?', 'profile-builder' ) ) . '\' )">' . __( 'Resend Activation Email', 'profile-builder' ) . '</a>', wppb_curpageurl(), 'resend', $item['ID'] ) | |
| 144 | + 'delete' => $this->wppb_ec_action_link( $current_url, 'delete', $email, __( 'delete this user from the _signups table?', 'profile-builder' ), __( 'Delete', 'profile-builder' ) ), | |
| 145 | + 'confirm' => $this->wppb_ec_action_link( $current_url, 'confirm', $email, __( 'confirm this email yourself?', 'profile-builder' ), __( 'Confirm Email', 'profile-builder' ) ), | |
| 146 | + 'resend' => $this->wppb_ec_action_link( $current_url, 'resend', $email, __( 'resend the activation link?', 'profile-builder' ), __( 'Resend Activation Email', 'profile-builder' ) ), | |
| 132 | 147 | ); |
| 133 | 148 | |
| 134 | 149 | //Return the user row |
| 135 | 150 | return sprintf('%1$s <strong>%2$s</strong> %3$s', |
| 136 | 151 | /*$1%s*/ $GRavatar, |
| 137 | - /*$2%s*/ $item['username'], | |
| 152 | + /*$2%s*/ esc_html( $item['username'] ), | |
| 138 | 153 | /*$3%s*/ $this->row_actions($actions) |
| 139 | 154 | ); |
| 140 | 155 | } |
| 141 | 156 | |
| @@ -150,10 +165,10 @@ | ||
| 150 | 165 | **************************************************************************/ |
| 151 | 166 | function column_cb($item){ |
| 152 | 167 | return sprintf( |
| 153 | 168 | '<input type="checkbox" name="%1$s[]" value="%2$s" />', |
| 154 | - /*$1%s*/ $this->_args['singular'], //Let's simply repurpose the table's singular label | |
| 155 | - /*$2%s*/ $item['ID'] //The value of the checkbox should be the record's id | |
| 169 | + /*$1%s*/ esc_attr( $this->_args['singular'] ), | |
| 170 | + /*$2%s*/ esc_attr( $item['ID'] ) | |
| 156 | 171 | ); |
| 157 | 172 | } |
| 158 | 173 | |
| 159 | 174 | |