PluginProbe
Property Hive / 2.3.0
Property Hive v2.3.0
2.3.1 2.3.0 2.2.6 2.2.5 2.2.4 2.2.3 2.2.2 1.4.46 1.4.47 1.4.48 1.4.49 1.4.5 1.4.50 1.4.51 1.4.52 1.4.53 1.4.54 1.4.55 1.4.56 1.4.57 1.4.58 1.4.59 1.4.6 1.4.60 1.4.61 All 261 releases
← All changes | includes/admin/settings/class-ph-settings-offices.php +111 -51 1.4.55 → 2.3.0 View file →
@@ -1,5 +1,8 @@
1 1 <?php
2 +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
3 +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
4 +
2 5 /**
3 6 * PropertyHive Office Settings
4 7 *
5 8 * @author PropertyHive
@@ -14,8 +17,9 @@
14 17
15 18 /**
16 19 * PH_Settings_Offices
17 20 */
21 +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Settings_Offices; preserving the existing PH_* class name is required for plugin and extension compatibility.
18 22 class PH_Settings_Offices extends PH_Settings_Page {
19 23
20 24 /**
21 25 * Constructor.
@@ -29,8 +33,27 @@
29 33 add_action( 'propertyhive_settings_save_' . $this->id, array( $this, 'save' ) );
30 34 add_action( 'propertyhive_sections_' . $this->id, array( $this, 'output_sections' ) );
31 35 add_action( 'propertyhive_admin_field_offices', array( $this, 'offices_setting' ) );
32 36 }
37 +
38 + /**
39 + * Read one scalar value from the verified office settings form.
40 + *
41 + * @param string $key Posted field name.
42 + * @return string
43 + */
44 + private function get_posted_text( $key ) {
45 + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- save() verifies the settings nonce and manage_options before calling this helper; arrays are rejected before the scalar is copied.
46 + if ( ! isset( $_POST[ $key ] ) || ! is_scalar( $_POST[ $key ] ) ) {
47 + return '';
48 + }
49 +
50 + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- save() verifies the settings nonce before this helper is called; the copied scalar is unslashed immediately below and sanitized before use.
51 + $raw_value = $_POST[ $key ];
52 + $raw_value = wp_unslash( (string) $raw_value );
53 +
54 + return ph_clean( $raw_value );
55 + }
33 56
34 57 /**
35 58 * Get settings array
36 59 *
@@ -59,13 +82,14 @@
59 82 public function get_office_settings() {
60 83
61 84 global $current_section;
62 85
63 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
86 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings selection; no state change occurs while building the form.
87 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
64 88
65 89 $args = array(
66 90
67 - array( 'title' => __( ( $current_section == 'add' ? 'Add New Office' : 'Edit Office Details' ), 'propertyhive' ), 'type' => 'title', 'desc' => '', 'id' => 'office_options' ),
91 + array( 'title' => ( $current_section == 'add' ? __( 'Add New Office', 'propertyhive' ) : __( 'Edit Office Details', 'propertyhive' ) ), 'type' => 'title', 'desc' => '', 'id' => 'office_options' ),
68 92
69 93 array(
70 94 'title' => __( 'Office Name', 'propertyhive' ),
71 95 'id' => 'office_name',
@@ -132,9 +156,13 @@
132 156 {
133 157 if ( get_option( 'propertyhive_active_departments_' . str_replace("residential-", "", $key) ) == 'yes' )
134 158 {
135 159 $args[] = array(
136 - 'title' => __( 'Telephone Number (' . $value . ')', 'propertyhive' ),
160 + 'title' => sprintf(
161 + /* translators: %s: department (e.g. Sales, Lettings, Commercial) */
162 + __( 'Telephone Number (%s)', 'propertyhive' ),
163 + $value
164 + ),
137 165 'id' => '_office_telephone_number_' . str_replace("residential-", "", $key),
138 166 //'css' => 'width:50px;',
139 167 'default' => get_post_meta($current_id, '_office_telephone_number_' . str_replace("residential-", "", $key), TRUE),
140 168 'type' => 'text',
@@ -141,9 +169,13 @@
141 169 'desc_tip' => false,
142 170 );
143 171
144 172 $args[] = array(
145 - 'title' => __( 'Email Address (' . $value . ')', 'propertyhive' ),
173 + 'title' => sprintf(
174 + /* translators: %s: department (e.g. Sales, Lettings, Commercial) */
175 + __( 'Email Address (%s)', 'propertyhive' ),
176 + $value
177 + ),
146 178 'id' => '_office_email_address_' . str_replace("residential-", "", $key),
147 179 //'css' => 'width:50px;',
148 180 'default' => get_post_meta($current_id, '_office_email_address_' . str_replace("residential-", "", $key), TRUE),
149 181 'type' => 'text',
@@ -188,17 +220,22 @@
188 220 public function get_office_delete() {
189 221
190 222 global $save_button_text, $post;
191 223
224 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
192 225 $save_button_text = __( 'Delete', 'propertyhive' );
193 226
227 + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This POST field only selects the delete confirmation display; save() performs the mutation after nonce and capability checks.
194 228 if ( isset($_POST['confirm_removal']) && $_POST['confirm_removal'] == 1 )
195 229 {
196 230 // A term has just been deleted
197 231 global $hide_save_button, $show_cancel_button, $cancel_button_href;
198 232
233 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
199 234 $hide_save_button = TRUE;
235 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
200 236 $show_cancel_button = TRUE;
237 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
201 238 $cancel_button_href = admin_url( 'admin.php?page=ph-settings&tab=offices' );
202 239
203 240 $args = array();
204 241
@@ -215,9 +252,10 @@
215 252 $args[] = array( 'type' => 'sectionend', 'id' => 'office_delete' );
216 253 }
217 254 else
218 255 {
219 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
256 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings selection; no state change occurs while building the form.
257 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
220 258
221 259 if ($current_id == '')
222 260 {
223 261 die("ID not passed");
@@ -236,8 +274,9 @@
236 274 $query_args = array(
237 275 'post_type' => 'property',
238 276 'nopaging' => true,
239 277 'post_status' => array( 'pending', 'auto-draft', 'draft', 'private', 'publish', 'future', 'trash' ),
278 + // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Count all properties assigned through _office_id across the existing statuses before offering office deletion/reassignment choices.
240 279 'meta_query' => array(
241 280 array(
242 281 'key' => '_office_id',
243 282 'value' => $current_id,
@@ -252,13 +291,14 @@
252 291 // Get number of applicants assigned to this term (future)
253 292
254 293 if ($num_properties > 0)
255 294 {
256 - $alternative_offices = array();
295 + $alternative_terms = array();
257 296
258 297 $query_args = array(
259 298 'post_type' => 'office',
260 299 'nopaging' => true,
300 + // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- The delete form must offer every other office as a reassignment target and must exclude the office currently being deleted.
261 301 'post__not_in' => array( $current_id ),
262 302 'orderby' => 'title',
263 303 'order' => 'ASC'
264 304 );
@@ -309,9 +349,9 @@
309 349 /**
310 350 * Output the settings
311 351 */
312 352 public function output() {
313 - global $current_section;
353 + global $current_section, $redirect_after_save;
314 354
315 355 if ( $current_section == 'add' ) {
316 356
317 357 remove_action('propertyhive_admin_field_offices', array( $this, 'offices_setting' ));
@@ -317,24 +357,25 @@
317 357 remove_action('propertyhive_admin_field_offices', array( $this, 'offices_setting' ));
318 358
319 359 $settings = $this->get_office_settings();
320 360
361 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
362 + $redirect_after_save = admin_url('admin.php?page=ph-settings&tab=offices');
363 +
321 364 PH_Admin_Settings::output_fields( $settings );
322 -
323 - /*foreach ( $shipping_methods as $method ) {
324 - if ( strtolower( get_class( $method ) ) == strtolower( $current_section ) && $method->has_settings() ) {
325 - $method->admin_options();
326 - break;
327 - }
328 - }*/
365 +
329 366 } elseif ( $current_section == 'edit' ) {
330 367
331 368 remove_action('propertyhive_admin_field_offices', array( $this, 'offices_setting' ));
332 369
333 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
370 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings selection; no state change occurs while building the form.
371 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
334 372
335 373 $settings = $this->get_office_settings();
336 374
375 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
376 + $redirect_after_save = admin_url('admin.php?page=ph-settings&tab=offices');
377 +
337 378 PH_Admin_Settings::output_fields( $settings );
338 379
339 380 } elseif ( $current_section == 'delete' ) {
340 381
@@ -339,9 +380,10 @@
339 380 } elseif ( $current_section == 'delete' ) {
340 381
341 382 remove_action('propertyhive_admin_field_offices', array( $this, 'offices_setting' ));
342 383
343 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
384 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings selection; no state change occurs while building the form.
385 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
344 386
345 387 $settings = $this->get_office_delete();
346 388
347 389 PH_Admin_Settings::output_fields( $settings );
@@ -367,21 +409,22 @@
367 409 <th scope="row" class="titledesc">
368 410 &nbsp;
369 411 </th>
370 412 <td class="forminp forminp-button">
371 - <a href="<?php echo admin_url( 'admin.php?page=ph-settings&tab=offices&section=add' ); ?>" class="button alignright"><?php echo __( 'Add New Office', 'propertyhive' ); ?></a>
413 + <a href="<?php echo esc_url(admin_url( 'admin.php?page=ph-settings&tab=offices&section=add' )); ?>" class="button alignright"><?php echo esc_html(__( 'Add New Office', 'propertyhive' )); ?></a>
372 414 </td>
373 415 </tr>
374 416 <tr valign="top">
375 - <th scope="row" class="titledesc"><?php _e( 'Offices', 'propertyhive' ) ?></th>
417 + <th scope="row" class="titledesc"><?php echo esc_html(__( 'Offices', 'propertyhive' )); ?></th>
376 418 <td class="forminp">
377 419 <table class="ph_offices widefat" cellspacing="0">
378 420 <thead>
379 421 <tr>
380 - <th class="primary"><?php _e( 'Primary', 'propertyhive' ); ?></th>
381 - <th class="name"><?php _e( 'Name', 'propertyhive' ); ?></th>
382 - <th class="address"><?php _e( 'Address', 'propertyhive' ); ?></th>
383 - <th class="contact"><?php _e( 'Contact Details', 'propertyhive' ); ?></th>
422 + <th class="primary"><?php echo esc_html(__( 'Primary', 'propertyhive' )); ?></th>
423 + <th class="name"><?php echo esc_html(__( 'Name', 'propertyhive' )); ?></th>
424 + <th class="address"><?php echo esc_html(__( 'Address', 'propertyhive' )); ?></th>
425 + <th class="contact"><?php echo esc_html(__( 'Contact Details', 'propertyhive' )); ?></th>
426 + <?php do_action( 'propertyhive_office_table_header_columns' ); ?>
384 427 <th class="settings">&nbsp;</th>
385 428 </tr>
386 429 </thead>
387 430 <tbody>
@@ -421,10 +464,10 @@
421 464 foreach ( $departments as $key => $value )
422 465 {
423 466 if ( get_option( 'propertyhive_active_departments_' . str_replace("residential-", "", $key) ) == 'yes' )
424 467 {
425 - $contact_details .= 'T: ' . get_post_meta($post->ID, '_office_telephone_number_' . str_replace("residential-", "", $key), TRUE) . '<br>';
426 - $contact_details .= 'E: ' . get_post_meta($post->ID, '_office_email_address_' . str_replace("residential-", "", $key), TRUE) . '<br>';
468 + $contact_details .= 'T: ' . esc_html(get_post_meta($post->ID, '_office_telephone_number_' . str_replace("residential-", "", $key), TRUE)) . '<br>';
469 + $contact_details .= 'E: ' . esc_html(get_post_meta($post->ID, '_office_email_address_' . str_replace("residential-", "", $key), TRUE)) . '<br>';
427 470 }
428 471 }
429 472
430 473 echo '<tr>
@@ -431,22 +474,24 @@
431 474 <td width="1%" class="primary">
432 475 <input type="radio" name="primary" value="' . esc_attr( $post->ID ) . '" ' . checked( get_post_meta($post->ID, 'primary', TRUE), '1', false ) . ' />
433 476 </td>
434 477 <td class="name">
435 - ' . get_the_title() . '
478 + ' . esc_html(get_the_title()) . '
436 479 </td>
437 480 <td class="address">
438 - ' . $address . '
481 + ' . esc_html($address) . '
439 482 </td>
440 483 <td class="contact">
441 - ' . $contact_details . '
442 - </td>
484 + ' . wp_kses_post( $contact_details ) . '
485 + </td>';
486 + do_action( 'propertyhive_office_table_row_columns', get_the_ID() );
487 + echo '
443 488 <td class="settings">
444 - <a class="button" href="' . admin_url( 'admin.php?page=ph-settings&tab=offices&section=edit&id=' . $post->ID ) . '">' . __( 'Edit', 'propertyhive' ) . '</a>
489 + <a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=offices&section=edit&id=' . $post->ID )) . '">' . esc_html(__( 'Edit', 'propertyhive' )) . '</a>
445 490 ';
446 491 if ( $num_offices > 1 && get_post_meta($post->ID, 'primary', TRUE) != '1' )
447 492 {
448 - echo '<a class="button" href="' . admin_url( 'admin.php?page=ph-settings&tab=offices&section=delete&id=' . $post->ID ) . '">' . __( 'Delete', 'propertyhive' ) . '</a>';
493 + echo '<a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=offices&section=delete&id=' . $post->ID )) . '">' . esc_html(__( 'Delete', 'propertyhive' )) . '</a>';
449 494 }
450 495 echo '
451 496 </td>
452 497 </tr>';
@@ -462,9 +507,9 @@
462 507 <th scope="row" class="titledesc">
463 508 &nbsp;
464 509 </th>
465 510 <td class="forminp forminp-button">
466 - <a href="<?php echo admin_url( 'admin.php?page=ph-settings&tab=offices&section=add' ); ?>" class="button alignright"><?php echo __( 'Add New Office', 'propertyhive' ); ?></a>
511 + <a href="<?php echo esc_url(admin_url( 'admin.php?page=ph-settings&tab=offices&section=add' )); ?>" class="button alignright"><?php echo esc_html(__( 'Add New Office', 'propertyhive' )); ?></a>
467 512 </td>
468 513 </tr>
469 514 <?php
470 515 }
@@ -472,10 +517,22 @@
472 517 /**
473 518 * Save settings
474 519 */
475 520 public function save() {
521 + if ( ! current_user_can( 'manage_options' ) || ! isset( $_REQUEST['_wpnonce'] ) || ! is_string( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'propertyhive-settings' ) ) {
522 + return;
523 + }
524 +
476 525 global $current_section, $post;
477 526
527 + if ( in_array( $current_section, array( 'edit', 'delete' ), true ) ) {
528 + $office_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
529 + if ( ! $office_id || 'office' !== get_post_type( $office_id ) ) {
530 + PH_Admin_Settings::add_error( __( 'Please select a valid office.', 'propertyhive' ) );
531 + return;
532 + }
533 + }
534 +
478 535 if ( $current_section == 'add' ) {
479 536
480 537 // TODO: Validate (check for blank fields, and that office name doest exist already)
481 538
@@ -480,9 +537,9 @@
480 537 // TODO: Validate (check for blank fields, and that office name doest exist already)
481 538
482 539 // Insert office
483 540 $office_post = array(
484 - 'post_title' => ph_clean( $_POST['office_name'] ),
541 + 'post_title' => wp_slash( $this->get_posted_text( 'office_name' ) ),
485 542 'post_content' => '',
486 543 'post_status' => 'publish',
487 544 'post_type' => 'office',
488 545 'comment_status' => 'closed',
@@ -498,18 +555,17 @@
498 555 PH_Admin_Settings::add_message( __( 'Office added successfully', 'propertyhive' ) . ' ' . '<a href="' . admin_url( 'admin.php?page=ph-settings&tab=offices' ) . '">' . __( 'Return to offices', 'propertyhive' ) . '</a>' );
499 556
500 557 } elseif ( $current_section == 'edit' ) {
501 558
502 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
559 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
503 560
504 561 // TODO: Validate
505 - // TODO: Make sure this ID belongs to an office
506 562 // TODO: Update slug?
507 563
508 564 // Update office
509 565 $office_post = array(
510 566 'ID' => $current_id,
511 - 'post_title' => ph_clean( $_POST['office_name'] )
567 + 'post_title' => wp_slash( $this->get_posted_text( 'office_name' ) )
512 568 );
513 569
514 570 wp_update_post( $office_post );
515 571
@@ -521,11 +577,11 @@
521 577 PH_Admin_Settings::add_message( __( 'Office details updated successfully', 'propertyhive' ) . ' ' . '<a href="' . admin_url( 'admin.php?page=ph-settings&tab=offices' ) . '">' . __( 'Return to offices', 'propertyhive' ) . '</a>' );
522 578
523 579 } elseif ( $current_section == 'delete' ) {
524 580
525 - if ( isset($_POST['confirm_removal']) && $_POST['confirm_removal'] == '1' )
581 + if ( '1' === $this->get_posted_text( 'confirm_removal' ) )
526 582 {
527 - $current_id = empty( $_REQUEST['id'] ) ? '' : (int)$_REQUEST['id'];
583 + $current_id = isset( $_REQUEST['id'] ) && is_scalar( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : 0;
528 584
529 585 // Get number of properties assigned to this term
530 586 $query_args = array(
531 587 'post_type' => 'property',
@@ -530,8 +586,9 @@
530 586 $query_args = array(
531 587 'post_type' => 'property',
532 588 'nopaging' => true,
533 589 'post_status' => array( 'pending', 'auto-draft', 'draft', 'private', 'publish', 'future', 'trash' ),
590 + // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Office deletion must find every property assigned to this office so each one can be reassigned before the office is removed; the office ID is read from the verified admin form.
534 591 'meta_query' => array(
535 592 array(
536 593 'key' => '_office_id',
537 594 'value' => $current_id,
@@ -548,13 +605,14 @@
548 605 die("Not assigning properties to new office. Please try again");
549 606 }
550 607 else
551 608 {
552 - $post_type = get_post_type( (int)$_POST['reassign_to'] );
609 + $reassign_to = absint( $this->get_posted_text( 'reassign_to' ) );
610 + $post_type = get_post_type( $reassign_to );
553 611
554 612 if ( $post_type != 'office' )
555 613 {
556 - die("New office isn't of type office. It's of type: " . $post_type);
614 + die("New office isn't of type office. It's of type: " . esc_html($post_type));
557 615 }
558 616 }
559 617
560 618 while ( $property_query->have_posts() )
@@ -560,9 +618,9 @@
560 618 while ( $property_query->have_posts() )
561 619 {
562 620 $property_query->the_post();
563 621
564 - update_post_meta( $post->ID, '_office_id', (int)$_POST['reassign_to'] );
622 + update_post_meta( $post->ID, '_office_id', $reassign_to );
565 623
566 624 // TODO: Check for WP_ERROR
567 625 }
568 626 }
@@ -601,17 +659,17 @@
601 659
602 660 wp_reset_postdata();
603 661
604 662 // Set selected office as primary
605 - update_post_meta( (int)$_POST['primary'], 'primary', '1');
663 + update_post_meta( absint( $this->get_posted_text( 'primary' ) ), 'primary', '1');
606 664 }
607 665 else
608 666 {
609 - update_post_meta($office_post_id, '_office_address_1', ph_clean( $_POST['_office_address_1'] ));
610 - update_post_meta($office_post_id, '_office_address_2', ph_clean( $_POST['_office_address_2'] ));
611 - update_post_meta($office_post_id, '_office_address_3', ph_clean( $_POST['_office_address_3'] ));
612 - update_post_meta($office_post_id, '_office_address_4', ph_clean( $_POST['_office_address_4'] ));
613 - update_post_meta($office_post_id, '_office_address_postcode', ph_clean( $_POST['_office_address_postcode'] ));
667 + update_post_meta($office_post_id, '_office_address_1', wp_slash( $this->get_posted_text( '_office_address_1' ) ));
668 + update_post_meta($office_post_id, '_office_address_2', wp_slash( $this->get_posted_text( '_office_address_2' ) ));
669 + update_post_meta($office_post_id, '_office_address_3', wp_slash( $this->get_posted_text( '_office_address_3' ) ));
670 + update_post_meta($office_post_id, '_office_address_4', wp_slash( $this->get_posted_text( '_office_address_4' ) ));
671 + update_post_meta($office_post_id, '_office_address_postcode', wp_slash( $this->get_posted_text( '_office_address_postcode' ) ));
614 672
615 673 $departments = ph_get_departments();
616 674
617 675 foreach ( $departments as $key => $value )
@@ -617,15 +675,17 @@
617 675 foreach ( $departments as $key => $value )
618 676 {
619 677 if ( get_option( 'propertyhive_active_departments_' . str_replace("residential-", "", $key) ) == 'yes' )
620 678 {
621 - update_post_meta($office_post_id, '_office_telephone_number_' . str_replace("residential-", "", $key), (isset($_POST['_office_telephone_number_' . str_replace("residential-", "", $key)])) ? ph_clean( $_POST['_office_telephone_number_' . str_replace("residential-", "", $key)] ) : '');
622 - update_post_meta($office_post_id, '_office_email_address_' . str_replace("residential-", "", $key), (isset($_POST['_office_email_address_' . str_replace("residential-", "", $key)])) ? ph_clean( $_POST['_office_email_address_' . str_replace("residential-", "", $key)] ) : '');
679 + $ph_contact_telephone_value = ( isset( $_POST['_office_telephone_number_' . str_replace("residential-", "", $key)] ) && is_string( $_POST['_office_telephone_number_' . str_replace("residential-", "", $key)] ) ) ? sanitize_text_field( wp_unslash( $_POST['_office_telephone_number_' . str_replace("residential-", "", $key)] ) ) : '';
680 + update_post_meta( $office_post_id, '_office_telephone_number_' . str_replace("residential-", "", $key), wp_slash( $ph_contact_telephone_value ) );
681 + $ph_contact_email_value = ( isset( $_POST['_office_email_address_' . str_replace("residential-", "", $key)] ) && is_string( $_POST['_office_email_address_' . str_replace("residential-", "", $key)] ) ) ? sanitize_text_field( wp_unslash( $_POST['_office_email_address_' . str_replace("residential-", "", $key)] ) ) : '';
682 + update_post_meta( $office_post_id, '_office_email_address_' . str_replace("residential-", "", $key), wp_slash( $ph_contact_email_value ) );
623 683 }
624 684 }
625 685
626 - update_post_meta($office_post_id, '_office_latitude', ph_clean( $_POST['_office_latitude'] ));
627 - update_post_meta($office_post_id, '_office_longitude', ph_clean( $_POST['_office_longitude'] ));
686 + update_post_meta($office_post_id, '_office_latitude', wp_slash( $this->get_posted_text( '_office_latitude' ) ));
687 + update_post_meta($office_post_id, '_office_longitude', wp_slash( $this->get_posted_text( '_office_longitude' ) ));
628 688
629 689 do_action( 'propertyhive_save_office', $office_post_id );
630 690 }
631 691 }
@@ -634,5 +694,5 @@
634 694 }
635 695
636 696 endif;
637 697
638 -return new PH_Settings_Offices();
698 +return new PH_Settings_Offices();