← All changes | includes/admin/views/html-admin-settings.php +16 -4 1.4.6 → 2.3.0 View file →

		@@ -1,10 +1,17 @@
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit;
	4	+}
	5	+?>
	6	+
1	7	<div class="wrap propertyhive">
2	8	<form method="post" id="mainform" action="" enctype="multipart/form-data">
3		- <div class="icon32 icon32-propertyhive-settings" id="icon-propertyhive"><br /></div><h2 class="nav-tab-wrapper woo-nav-tab-wrapper">
	9	+ <div class="icon32 icon32-propertyhive-settings" id="icon-propertyhive"><br /></div><h2 class="nav-tab-wrapper">
4	10	<?php
	11	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
5	12	foreach ( $tabs as $name => $label )
6		- echo '<a href="' . admin_url( 'admin.php?page=ph-settings&tab=' . $name ) . '" class="nav-tab ' . ( $current_tab == $name ? 'nav-tab-active' : '' ) . '">' . $label . '</a>';
	13	+ echo '<a href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=' . $name )) . '" class="nav-tab nav-tab-' . esc_attr(sanitize_title($name)) . ' ' . ( $current_tab == $name ? 'nav-tab-active' : '' ) . '">' . esc_html($label) . '</a>';
7	14
8	15	do_action( 'propertyhive_settings_tabs' );
9	16	?>
10	17	</h2>
		@@ -18,15 +25,17 @@
18	25	<p class="submit">
19	26	<?php
20	27	if ( ! isset( $GLOBALS['hide_save_button'] ) )
21	28	{
	29	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
22	30	$button_text = __( 'Save changes', 'propertyhive' );
23	31	if ( isset( $GLOBALS['save_button_text'] ) && ! empty( $GLOBALS['save_button_text'] ) )
24	32	{
	33	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
25	34	$button_text = $GLOBALS['save_button_text'];
26	35	}
27	36	?>
28		- <input name="save" class="button-primary" type="submit" value="<?php echo $button_text; ?>" />
	37	+ <button name="save" class="button-primary" type="submit" value="<?php echo esc_attr($button_text); ?>"><?php echo esc_html($button_text); ?></button>
29	38	<?php
30	39	}
31	40	?>
32	41	<?php
		@@ -31,19 +40,22 @@
31	40	?>
32	41	<?php
33	42	if ( isset( $GLOBALS['show_cancel_button'] ) && $GLOBALS['show_cancel_button'] === TRUE )
34	43	{
	44	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
35	45	$cancel_href = 'javascript:history.go(-1);';
36	46	if ( isset( $GLOBALS['cancel_button_href'] ) && ! empty( $GLOBALS['cancel_button_href'] ) )
37	47	{
	48	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
38	49	$cancel_href = $GLOBALS['cancel_button_href'];
39	50	}
40	51	?>
41		- <a href="<?php echo $cancel_href; ?>" class="button"><?php _e( 'Cancel', 'propertyhive' ); ?></a>
	52	+ <a href="<?php echo esc_url($cancel_href); ?>" class="button"><?php echo esc_html(__( 'Cancel', 'propertyhive' )); ?></a>
42	53	<?php
43	54	}
44	55	?>
45	56	<input type="hidden" name="subtab" id="last_tab" />
	57	+ <input type="hidden" name="redirect" value="<?php echo esc_url( !empty($redirect_after_save) ? $redirect_after_save : '' ); ?>">
46	58	<?php wp_nonce_field( 'propertyhive-settings' ); ?>
47	59	</p>
48	60	</form>
49	61	</div>