| @@ -10,10 +10,11 @@ | ||
| 10 | 10 | ?> |
| 11 | 11 | <div class="wrap propertyhive"> |
| 12 | 12 | <nav class="nav-tab-wrapper"> |
| 13 | 13 | <?php |
| 14 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 14 | 15 | foreach ( $reports as $key => $report_group ) { |
| 15 | - echo '<a href="' . admin_url( 'admin.php?page=ph-reports&tab=' . urlencode( $key ) ) . '" class="nav-tab '; | |
| 16 | + echo '<a href="' . esc_url( admin_url( 'admin.php?page=ph-reports&tab=' . urlencode( $key ) ) ) . '" class="nav-tab '; | |
| 16 | 17 | if ( $current_tab == $key ) { |
| 17 | 18 | echo 'nav-tab-active'; |
| 18 | 19 | } |
| 19 | 20 | echo '">' . esc_html( $report_group[ 'title' ] ) . '</a>'; |
| @@ -18,8 +19,9 @@ | ||
| 18 | 19 | } |
| 19 | 20 | echo '">' . esc_html( $report_group[ 'title' ] ) . '</a>'; |
| 20 | 21 | } |
| 21 | 22 | |
| 23 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook ph_reports_tabs; changing the established name would detach installed callbacks. | |
| 22 | 24 | do_action( 'ph_reports_tabs' ); |
| 23 | 25 | ?> |
| 24 | 26 | </nav> |
| 25 | 27 | <?php //if ( sizeof( $reports[ $current_tab ]['reports'] ) > 1 ) { |
| @@ -26,24 +28,31 @@ | ||
| 26 | 28 | ?> |
| 27 | 29 | <ul class="subsubsub"> |
| 28 | 30 | <li><?php |
| 29 | 31 | |
| 32 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 30 | 33 | $links = array(); |
| 31 | 34 | |
| 35 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 32 | 36 | foreach ( $reports[ $current_tab ]['reports'] as $key => $report ) { |
| 33 | 37 | |
| 34 | - $link = '<a href="admin.php?page=ph-reports&tab=' . urlencode( $current_tab ) . '&report=' . urlencode( $key ) . '" class="'; | |
| 38 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup. | |
| 39 | + $link = '<a href="' . esc_url( 'admin.php?page=ph-reports&tab=' . urlencode( $current_tab ) . '&report=' . urlencode( $key ) ) . '" class="'; | |
| 35 | 40 | |
| 36 | 41 | if ( $key == $current_report ) { |
| 42 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup. | |
| 37 | 43 | $link .= 'current'; |
| 38 | 44 | } |
| 39 | 45 | |
| 40 | - $link .= '">' . $report['title'] . '</a>'; | |
| 46 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup. | |
| 47 | + $link .= '">' . esc_html( $report['title'] ) . '</a>'; | |
| 41 | 48 | |
| 49 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 42 | 50 | $links[] = $link; |
| 43 | 51 | |
| 44 | 52 | } |
| 45 | 53 | |
| 54 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Locally assembled navigation links: URLs and titles are escaped above; class values and separators are fixed markup. | |
| 46 | 55 | echo implode( ' | </li><li>', $links ); |
| 47 | 56 | |
| 48 | 57 | ?></li> |
| 49 | 58 | </ul> |
| @@ -52,8 +61,9 @@ | ||
| 52 | 61 | //} |
| 53 | 62 | |
| 54 | 63 | if ( isset( $reports[ $current_tab ][ 'reports' ][ $current_report ] ) ) { |
| 55 | 64 | |
| 65 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 56 | 66 | $report = $reports[ $current_tab ][ 'reports' ][ $current_report ]; |
| 57 | 67 | |
| 58 | 68 | if ( ! isset( $report['hide_title'] ) || $report['hide_title'] != true ) { |
| 59 | 69 | echo '<h1>' . esc_html( $report['title'] ) . '</h1>'; |
| @@ -61,8 +71,9 @@ | ||
| 61 | 71 | echo '<h1 class="screen-reader-text">' . esc_html( $report['title'] ) . '</h1>'; |
| 62 | 72 | } |
| 63 | 73 | |
| 64 | 74 | if ( $report['description'] ) { |
| 75 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Trusted HTML from PHP report registrations via propertyhive_admin_reports (core descriptions are empty). Extension callbacks own escaping of dynamic values in their descriptions. | |
| 65 | 76 | echo '<p>' . $report['description'] . '</p>'; |
| 66 | 77 | } |
| 67 | 78 | |
| 68 | 79 | if ( $report['callback'] && ( is_callable( $report['callback'] ) ) ) { |
