| @@ -12,8 +12,9 @@ | ||
| 12 | 12 | * @package PropertyHive/Classes |
| 13 | 13 | * @category Class |
| 14 | 14 | * @author PropertyHive |
| 15 | 15 | */ |
| 16 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Offer; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 16 | 17 | class PH_Offer { |
| 17 | 18 | |
| 18 | 19 | /** @public int Offer (post) ID */ |
| 19 | 20 | public $id; |
| @@ -124,9 +125,9 @@ | ||
| 124 | 125 | { |
| 125 | 126 | $applicants = array(); |
| 126 | 127 | foreach ( $applicant_contact_ids as $applicant_contact_id ) |
| 127 | 128 | { |
| 128 | - $applicant_name = get_the_title($applicant_contact_id); | |
| 129 | + $applicant_name = esc_html( get_the_title( $applicant_contact_id ) ); | |
| 129 | 130 | if ( $add_hyperlinks ) |
| 130 | 131 | { |
| 131 | 132 | $edit_link = get_edit_post_link( $applicant_contact_id ); |
| 132 | 133 | $applicant_name = '<a href="' . esc_url( $edit_link ) . '">' . $applicant_name . '</a>'; |
| @@ -136,15 +137,15 @@ | ||
| 136 | 137 | $contact_details = array(); |
| 137 | 138 | $telephone_number = get_post_meta( $applicant_contact_id, '_telephone_number', true ); |
| 138 | 139 | if( !empty($telephone_number) ) |
| 139 | 140 | { |
| 140 | - $contact_details[] = 'T: ' . $telephone_number; | |
| 141 | + $contact_details[] = 'T: ' . esc_html( $telephone_number ); | |
| 141 | 142 | } |
| 142 | 143 | |
| 143 | 144 | $email_address = get_post_meta( $applicant_contact_id, '_email_address', true ); |
| 144 | 145 | if( !empty($email_address) ) |
| 145 | 146 | { |
| 146 | - $contact_details[] = 'E: ' . $email_address; | |
| 147 | + $contact_details[] = 'E: ' . esc_html( $email_address ); | |
| 147 | 148 | } |
| 148 | 149 | |
| 149 | 150 | $contact_details = apply_filters( 'propertyhive_offer_applicant_contact_details', $contact_details, $applicant_contact_id ); |
| 150 | 151 | |
| @@ -190,9 +191,9 @@ | ||
| 190 | 191 | |
| 191 | 192 | if ( !empty($property_id) ) |
| 192 | 193 | { |
| 193 | 194 | $property = new PH_Property( $property_id ); |
| 194 | - return '<a href="' . get_edit_post_link( $property_id, '' ) . '" target="' . apply_filters('propertyhive_subgrid_link_target', '') . '">' . $property->get_formatted_full_address() . '</a>'; | |
| 195 | + return '<a href="' . esc_url( get_edit_post_link( $property_id, '' ) ) . '" target="' . esc_attr( apply_filters('propertyhive_subgrid_link_target', '') ) . '">' . esc_html( $property->get_formatted_full_address() ) . '</a>'; | |
| 195 | 196 | } |
| 196 | 197 | else |
| 197 | 198 | { |
| 198 | 199 | return '-'; |
| @@ -244,19 +245,20 @@ | ||
| 244 | 245 | private function formatted_contact_meta_box_data( $contact_post_id, $add_edit_link = true ) |
| 245 | 246 | { |
| 246 | 247 | if ( $add_edit_link ) |
| 247 | 248 | { |
| 248 | - $contact_text = '<a href="' . get_edit_post_link( $contact_post_id, '' ) . '" target="' . apply_filters('propertyhive_subgrid_link_target', '') . '">' . get_the_title($contact_post_id) . '</a>'; | |
| 249 | + $contact_text = '<a href="' . esc_url( get_edit_post_link( $contact_post_id, '' ) ) . '" target="' . esc_attr( apply_filters('propertyhive_subgrid_link_target', '') ) . '">' . esc_html( get_the_title($contact_post_id) ) . '</a>'; | |
| 249 | 250 | } |
| 250 | 251 | else |
| 251 | 252 | { |
| 252 | - $contact_text = get_the_title($contact_post_id); | |
| 253 | + $contact_text = esc_html( get_the_title($contact_post_id) ); | |
| 253 | 254 | } |
| 254 | 255 | |
| 256 | + $contact_details = ''; | |
| 255 | 257 | $telephone_number = get_post_meta( $contact_post_id, '_telephone_number', true ); |
| 256 | 258 | if( !empty($telephone_number) ) |
| 257 | 259 | { |
| 258 | - $contact_details = 'T: ' . $telephone_number; | |
| 260 | + $contact_details = 'T: ' . esc_html($telephone_number); | |
| 259 | 261 | } |
| 260 | 262 | |
| 261 | 263 | $email_address = get_post_meta( $contact_post_id, '_email_address', true ); |
| 262 | 264 | if( !empty($email_address) ) |
| @@ -261,9 +263,9 @@ | ||
| 261 | 263 | $email_address = get_post_meta( $contact_post_id, '_email_address', true ); |
| 262 | 264 | if( !empty($email_address) ) |
| 263 | 265 | { |
| 264 | 266 | $contact_details .= ( $contact_details != '' ) ? '<br>' : ''; |
| 265 | - $contact_details .= 'E: ' . $email_address; | |
| 267 | + $contact_details .= 'E: ' . esc_html($email_address); | |
| 266 | 268 | } |
| 267 | 269 | |
| 268 | 270 | if ( $contact_details != '' ) |
| 269 | 271 | { |
