| @@ -12,8 +12,9 @@ | ||
| 12 | 12 | * @package PropertyHive/Classes |
| 13 | 13 | * @category Class |
| 14 | 14 | * @author PropertyHive |
| 15 | 15 | */ |
| 16 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Viewing; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 16 | 17 | class PH_Viewing { |
| 17 | 18 | |
| 18 | 19 | /** @public int Viewing (post) ID */ |
| 19 | 20 | public $id; |
| @@ -133,9 +134,11 @@ | ||
| 133 | 134 | 'fields' => 'ids', |
| 134 | 135 | 'post_type' => 'viewing', |
| 135 | 136 | 'nopaging' => true, |
| 136 | 137 | 'post_status' => 'publish', |
| 138 | + // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Related viewings require matching this property and every applicant while excluding cancelled/no-show statuses in the existing metadata schema. | |
| 137 | 139 | 'meta_query' => $meta_query, |
| 140 | + // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- Excludes one current viewing ID so the related-viewing lists cannot contain themselves; this is not an unbounded exclusion list. | |
| 138 | 141 | 'post__not_in' => array($this->id), |
| 139 | 142 | 'orderby' => 'none' |
| 140 | 143 | ); |
| 141 | 144 | |
| @@ -194,9 +197,9 @@ | ||
| 194 | 197 | { |
| 195 | 198 | $applicant_contacts = array(); |
| 196 | 199 | foreach ($applicant_contact_ids as $applicant_contact_id) |
| 197 | 200 | { |
| 198 | - $applicant_name = get_the_title($applicant_contact_id); | |
| 201 | + $applicant_name = esc_html( get_the_title($applicant_contact_id) ); | |
| 199 | 202 | if ( $add_hyperlinks ) |
| 200 | 203 | { |
| 201 | 204 | $edit_link = get_edit_post_link( $applicant_contact_id ); |
| 202 | 205 | $applicant_name = '<a href="' . esc_url($edit_link) . '" target="' . esc_attr(apply_filters('propertyhive_subgrid_link_target', '')) . '">' . $applicant_name . '</a>'; |
| @@ -206,15 +209,15 @@ | ||
| 206 | 209 | $contact_details = array(); |
| 207 | 210 | $telephone_number = get_post_meta( $applicant_contact_id, '_telephone_number', true ); |
| 208 | 211 | if( !empty($telephone_number) ) |
| 209 | 212 | { |
| 210 | - $contact_details[] = 'T: ' . $telephone_number; | |
| 213 | + $contact_details[] = 'T: ' . esc_html($telephone_number); | |
| 211 | 214 | } |
| 212 | 215 | |
| 213 | 216 | $email_address = get_post_meta( $applicant_contact_id, '_email_address', true ); |
| 214 | 217 | if( !empty($email_address) ) |
| 215 | 218 | { |
| 216 | - $contact_details[] = 'E: ' . $email_address; | |
| 219 | + $contact_details[] = 'E: ' . esc_html($email_address); | |
| 217 | 220 | } |
| 218 | 221 | |
| 219 | 222 | $contact_details = apply_filters( 'propertyhive_viewing_applicant_contact_details', $contact_details, $applicant_contact_id ); |
| 220 | 223 | |
| @@ -273,9 +276,9 @@ | ||
| 273 | 276 | */ |
| 274 | 277 | public function get_status() |
| 275 | 278 | { |
| 276 | 279 | $status = $this->_status; |
| 277 | - $status_items = array( __( ucwords(str_replace("_", " ", $status)), 'propertyhive' ) ); | |
| 280 | + $status_items = array( propertyhive_get_status_label( $status ) ); | |
| 278 | 281 | |
| 279 | 282 | if ( $status == 'pending' ) |
| 280 | 283 | { |
| 281 | 284 | // confirmation status |
| @@ -312,9 +315,9 @@ | ||
| 312 | 315 | { |
| 313 | 316 | $status_items[] = ph_ordinal_suffix(count($related_viewings['previous'])+1) . ' ' . __( 'Viewing', 'propertyhive' ); |
| 314 | 317 | } |
| 315 | 318 | |
| 316 | - return implode('<br>', $status_items); | |
| 319 | + return implode('<br>', array_map( 'esc_html', $status_items )); | |
| 317 | 320 | } |
| 318 | 321 | |
| 319 | 322 | /** |
| 320 | 323 | * Get the full address of the property attached to the viewing |
| @@ -328,9 +331,9 @@ | ||
| 328 | 331 | |
| 329 | 332 | if ( !empty($property_id) ) |
| 330 | 333 | { |
| 331 | 334 | $property = new PH_Property( $property_id ); |
| 332 | - return '<a href="' . get_edit_post_link( $property_id, '' ) . '" target="' . apply_filters('propertyhive_subgrid_link_target', '') . '">' . $property->get_formatted_full_address() . '</a>'; | |
| 335 | + return '<a href="' . esc_url( get_edit_post_link( $property_id, '' ) ) . '" target="' . esc_attr( apply_filters('propertyhive_subgrid_link_target', '') ) . '">' . esc_html( $property->get_formatted_full_address() ) . '</a>'; | |
| 333 | 336 | } |
| 334 | 337 | else |
| 335 | 338 | { |
| 336 | 339 | return '-'; |
