← All changes
|
includes/admin/views/html-key-dates-quick-edit.php
+79
-18
2.2.3
→
2.3.1
View file →
| @@ -1,51 +1,74 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean | |
| 3 | +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. | |
| 4 | + | |
| 2 | 5 | if ( ! defined( 'ABSPATH' ) ) { |
| 3 | 6 | exit; |
| 4 | 7 | } |
| 8 | +$propertyhive_ph_key_date_input = array(); | |
| 9 | +foreach ( array( 'description', 'status', 'due_date_time', 'type', 'date_post_id' ) as $propertyhive_ph_input_key ) { | |
| 10 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only AJAX controls; the save action separately verifies the nonce and CRM permissions. | |
| 11 | + $propertyhive_ph_key_date_input[$propertyhive_ph_input_key] = isset( $_POST[$propertyhive_ph_input_key] ) && is_string( $_POST[$propertyhive_ph_input_key] ) ? sanitize_text_field( wp_unslash( $_POST[$propertyhive_ph_input_key] ) ) : ''; | |
| 12 | +} | |
| 13 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only AJAX control; sanitize and escape its displayed contents. | |
| 14 | +$propertyhive_ph_key_date_input['notes'] = isset( $_POST['notes'] ) && is_string( $_POST['notes'] ) ? sanitize_textarea_field( wp_unslash( $_POST['notes'] ) ) : ''; | |
| 5 | 15 | ?><td colspan="5"> |
| 6 | 16 | <div class="propertyhive_meta_box"> |
| 7 | 17 | <div class="options_group"> |
| 8 | 18 | <p class="form-field"> |
| 9 | 19 | <label for="date_description">Description</label> |
| 10 | - <input type="text" id="date_description" class="short" value="<?php echo isset( $_POST['description'] ) ? esc_html(ph_clean($_POST['description'])) : ''; ?>"> | |
| 20 | + <input type="text" id="date_description" class="short" value="<?php | |
| 21 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 22 | + echo esc_attr( $propertyhive_ph_key_date_input['description'] ); ?>"> | |
| 11 | 23 | </p> |
| 12 | 24 | <p class="form-field"> |
| 13 | 25 | <label for="key_date_status">Status</label> |
| 14 | 26 | <?php |
| 27 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 15 | 28 | $output = '<select id="key_date_status" name="key_date_status">'; |
| 16 | 29 | |
| 17 | 30 | foreach ( array( 'pending', 'booked', 'complete', 'on_hold', 'cancelled' ) as $status ) |
| 18 | 31 | { |
| 19 | - $selected_value = isset( $_POST['status'] ) ? strtolower($_POST['status']) : ''; | |
| 32 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound, WordPress.Security.NonceVerification.Missing -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 33 | + $selected_value = strtolower( $propertyhive_ph_key_date_input['status'] ); | |
| 20 | 34 | if ( in_array($selected_value, array('overdue', 'upcoming') ) ) |
| 21 | 35 | { |
| 36 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 22 | 37 | $selected_value = 'pending'; |
| 23 | 38 | } |
| 39 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 24 | 40 | $output .= '<option value="' . esc_attr($status) . '"'; |
| 41 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 25 | 42 | $output .= selected($status, $selected_value, false ); |
| 43 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 26 | 44 | $output .= '>' . esc_html(ucwords(str_replace("_", " ", $status))) . '</option>'; |
| 27 | 45 | } |
| 28 | 46 | |
| 47 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 29 | 48 | $output .= '</select>'; |
| 30 | 49 | |
| 50 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Select options are escaped when assembled; selected() emits WordPress's fixed selected attribute. | |
| 31 | 51 | echo $output; |
| 32 | 52 | ?> |
| 33 | 53 | </p> |
| 34 | 54 | <p class="form-field"> |
| 35 | 55 | <?php |
| 36 | - $due_date_time = isset( $_POST['due_date_time'] ) ? strtotime($_POST['due_date_time']) : ''; | |
| 56 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound, WordPress.Security.NonceVerification.Missing -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 57 | + $due_date_time = strtotime( $propertyhive_ph_key_date_input['due_date_time'] ); | |
| 37 | 58 | ?> |
| 38 | 59 | <label for="date_due_quick_edit">Due Date</label> |
| 39 | - <input type="date" class="small" name="date_due_quick_edit" id="date_due_quick_edit" value="<?php echo esc_attr(date('Y-m-d', $due_date_time)); ?>" placeholder=""> | |
| 60 | + <input type="date" class="small" name="date_due_quick_edit" id="date_due_quick_edit" value="<?php echo esc_attr( $due_date_time !== false ? gmdate( 'Y-m-d', $due_date_time ) : '' ); ?>" placeholder=""> | |
| 40 | 61 | |
| 41 | 62 | <select id="date_due_hours_quick_edit" name="date_due_hours_quick_edit" class="select short" style="width:55px">'; |
| 42 | 63 | <?php |
| 64 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 43 | 65 | for ( $i = 0; $i < 23; ++$i ) |
| 44 | 66 | { |
| 67 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 45 | 68 | $j = str_pad($i, 2, '0', STR_PAD_LEFT); |
| 46 | 69 | echo '<option value="' . esc_attr($j) . '"'; |
| 47 | - if ( date('H', $due_date_time) == $j ) { echo ' selected'; } | |
| 70 | + if ( gmdate('H', $due_date_time) == $j ) { echo ' selected'; } | |
| 48 | 71 | echo '>' . esc_html($j) . '</option>'; |
| 49 | 72 | } |
| 50 | 73 | ?> |
| 51 | 74 | </select> |
| @@ -51,13 +74,15 @@ | ||
| 51 | 74 | </select> |
| 52 | 75 | : |
| 53 | 76 | <select id="date_due_minutes_quick_edit" name="date_due_minutes_quick_edit" class="select short" style="width:55px"> |
| 54 | 77 | <?php |
| 78 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 55 | 79 | for ( $i = 0; $i < 60; $i+=5 ) |
| 56 | 80 | { |
| 81 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 57 | 82 | $j = str_pad($i, 2, '0', STR_PAD_LEFT); |
| 58 | 83 | echo '<option value="' . esc_attr($j) . '"'; |
| 59 | - if ( date('i', $due_date_time) == $j ) { echo ' selected'; } | |
| 84 | + if ( gmdate('i', $due_date_time) == $j ) { echo ' selected'; } | |
| 60 | 85 | echo '>' . esc_html($j) . '</option>'; |
| 61 | 86 | } |
| 62 | 87 | ?> |
| 63 | 88 | </select> |
| @@ -65,25 +90,32 @@ | ||
| 65 | 90 | <p class="form-field"> |
| 66 | 91 | <label for="date_type"><?php echo esc_html(__('Key Date Type', 'propertyhive')); ?></label> |
| 67 | 92 | <select id="date_type" name="date_type" class="select short"> |
| 68 | 93 | <?php |
| 69 | - $key_date_type_terms = get_terms( 'management_key_date_type', array( | |
| 94 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 95 | + $key_date_type_terms = get_terms( array_merge( wp_parse_args( array( | |
| 70 | 96 | 'hide_empty' => false, |
| 71 | 97 | 'parent' => 0 |
| 72 | - ) ); | |
| 98 | + ) ), array( 'taxonomy' => 'management_key_date_type' ) ) ); | |
| 99 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 73 | 100 | $recurrence_rules = get_option( 'propertyhive_key_date_type', array() ); |
| 101 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 74 | 102 | $recurrence_rules = is_array( $recurrence_rules ) ? $recurrence_rules : array(); |
| 75 | 103 | |
| 104 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 76 | 105 | $parent_post_type = get_post_type( $post_id ); |
| 77 | 106 | if ( !empty( $key_date_type_terms ) && !is_wp_error( $key_date_type_terms ) ) |
| 78 | 107 | { |
| 108 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 79 | 109 | foreach ($key_date_type_terms as $key_date_type_term) |
| 80 | 110 | { |
| 111 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 81 | 112 | $recurrence_type = isset($recurrence_rules[$key_date_type_term->term_id]) ? $recurrence_rules[$key_date_type_term->term_id]['recurrence_type'] : ''; |
| 82 | 113 | if ( $parent_post_type == 'tenancy' || ( $parent_post_type == 'property' && $recurrence_type == 'property_management' ) ) |
| 83 | 114 | { |
| 84 | 115 | echo '<option value="' . esc_attr($key_date_type_term->term_id) . '"'; |
| 85 | - if ( isset( $_POST['type'] ) && $_POST['type'] == $key_date_type_term->term_id ) { echo ' selected'; } | |
| 116 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 117 | + if ( $propertyhive_ph_key_date_input['type'] !== '' && $propertyhive_ph_key_date_input['type'] == $key_date_type_term->term_id ) { echo ' selected'; } | |
| 86 | 118 | echo '>' . esc_html($key_date_type_term->name) . '</option>'; |
| 87 | 119 | } |
| 88 | 120 | } |
| 89 | 121 | } |
| @@ -91,17 +123,24 @@ | ||
| 91 | 123 | </select> |
| 92 | 124 | </p> |
| 93 | 125 | <p class="form-field"> |
| 94 | 126 | <label for="date_notes_quick_edit">Notes</label> |
| 95 | - <textarea id="date_notes_quick_edit" class="short"><?php echo ( isset( $_POST['notes'] ) && $_POST['notes'] != '-' ) ? stripslashes( sanitize_textarea_field($_POST['notes']) ) : ''; ?></textarea> | |
| 127 | + <textarea id="date_notes_quick_edit" class="short"><?php | |
| 128 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 129 | + echo esc_textarea( $propertyhive_ph_key_date_input['notes'] !== '-' ? $propertyhive_ph_key_date_input['notes'] : '' ); ?></textarea> | |
| 96 | 130 | </p> |
| 97 | 131 | <?php |
| 98 | - if ( isset($recurrence_rules[$_POST['type']]) && isset( $recurrence_rules[$_POST['type']]['recurrence_rule'] ) ) | |
| 132 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 133 | + if ( isset($recurrence_rules[$propertyhive_ph_key_date_input['type']]) && isset( $recurrence_rules[$propertyhive_ph_key_date_input['type']]['recurrence_rule'] ) ) | |
| 99 | 134 | { |
| 135 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 100 | 136 | $recurrence = array(); |
| 101 | 137 | |
| 102 | - foreach (explode(';', $recurrence_rules[$_POST['type']]['recurrence_rule']) as $key_value_pair){ | |
| 138 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound, WordPress.Security.NonceVerification.Missing -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 139 | + foreach (explode(';', $recurrence_rules[$propertyhive_ph_key_date_input['type']]['recurrence_rule']) as $key_value_pair){ | |
| 140 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 103 | 141 | list($key, $value) = explode('=', $key_value_pair); |
| 142 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 104 | 143 | $recurrence[strtolower($key)] = $value; |
| 105 | 144 | } |
| 106 | 145 | |
| 107 | 146 | if ( isset($recurrence['freq']) && $recurrence['freq'] != 'ONCE' ) |
| @@ -107,29 +146,39 @@ | ||
| 107 | 146 | if ( isset($recurrence['freq']) && $recurrence['freq'] != 'ONCE' ) |
| 108 | 147 | { |
| 109 | 148 | ?> |
| 110 | 149 | <p id="next_key_date_checkbox" class="form-field hidden"> |
| 111 | - <label for="book_next_key_date"><?php echo esc_html(__('Book Next ' . ( isset( $_POST['description'] ) ? esc_html(ph_clean($_POST['description'])) : 'Key Date' ) . '?', 'propertyhive')); ?></label> | |
| 150 | + <label for="book_next_key_date"><?php | |
| 151 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 152 | + echo /* translators: %s: Key date description. */ esc_html( sprintf( __( 'Book Next %s?', 'propertyhive' ), $propertyhive_ph_key_date_input['description'] !== '' ? $propertyhive_ph_key_date_input['description'] : __( 'Key Date', 'propertyhive' ) ) ); ?></label> | |
| 112 | 153 | <input type="checkbox" id="book_next_key_date" > |
| 113 | 154 | </p> |
| 114 | 155 | <?php |
| 156 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 115 | 157 | $next_key_date = ''; |
| 158 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 116 | 159 | $next_key_date_hours = '00'; |
| 160 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 117 | 161 | $next_key_date_minutes = '00'; |
| 118 | 162 | |
| 163 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 119 | 164 | $interval = isset($recurrence['interval']) ? $recurrence['interval'] : '1'; |
| 120 | 165 | switch( $recurrence['freq'] ) |
| 121 | 166 | { |
| 122 | 167 | case 'DAILY': |
| 168 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 123 | 169 | $frequency = 'day'; |
| 124 | 170 | break; |
| 125 | 171 | case 'WEEKLY': |
| 172 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 126 | 173 | $frequency = 'week'; |
| 127 | 174 | break; |
| 128 | 175 | case 'MONTHLY': |
| 176 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 129 | 177 | $frequency = 'month'; |
| 130 | 178 | break; |
| 131 | 179 | case 'YEARLY': |
| 180 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 132 | 181 | $frequency = 'year'; |
| 133 | 182 | break; |
| 134 | 183 | } |
| 135 | 184 | |
| @@ -134,12 +183,16 @@ | ||
| 134 | 183 | } |
| 135 | 184 | |
| 136 | 185 | if ( isset($frequency) ) |
| 137 | 186 | { |
| 187 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 138 | 188 | $next_key_timestamp = strtotime('+' . $interval . ' ' . $frequency, $due_date_time); |
| 139 | - $next_key_date = date('Y-m-d', $next_key_timestamp); | |
| 140 | - $next_key_date_hours = date('H', $next_key_timestamp); | |
| 141 | - $next_key_date_minutes = date('i', $next_key_timestamp); | |
| 189 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 190 | + $next_key_date = gmdate('Y-m-d', $next_key_timestamp); | |
| 191 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 192 | + $next_key_date_hours = gmdate('H', $next_key_timestamp); | |
| 193 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 194 | + $next_key_date_minutes = gmdate('i', $next_key_timestamp); | |
| 142 | 195 | } |
| 143 | 196 | ?> |
| 144 | 197 | <p id="next_key_date_field" class="form-field hidden"> |
| 145 | 198 | <label for="next_key_date"> </label> |
| @@ -146,10 +199,12 @@ | ||
| 146 | 199 | <input type="date" class="small" name="next_key_date" id="next_key_date" value="<?php echo esc_attr($next_key_date); ?>" placeholder=""> |
| 147 | 200 | |
| 148 | 201 | <select id="next_key_date_hours" name="next_key_date_hours" class="select short" style="width:55px">'; |
| 149 | 202 | <?php |
| 203 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 150 | 204 | for ( $i = 0; $i < 23; ++$i ) |
| 151 | 205 | { |
| 206 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 152 | 207 | $j = str_pad($i, 2, '0', STR_PAD_LEFT); |
| 153 | 208 | echo '<option value="' . esc_attr($j) . '"'; |
| 154 | 209 | if ( $next_key_date_hours == $j ) { echo ' selected'; } |
| 155 | 210 | echo '>' . esc_html($j) . '</option>'; |
| @@ -158,10 +213,12 @@ | ||
| 158 | 213 | </select> |
| 159 | 214 | : |
| 160 | 215 | <select id="next_key_date_minutes" name="next_key_date_minutes" class="select short" style="width:55px"> |
| 161 | 216 | <?php |
| 217 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 162 | 218 | for ( $i = 0; $i < 60; $i+=5 ) |
| 163 | 219 | { |
| 220 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 164 | 221 | $j = str_pad($i, 2, '0', STR_PAD_LEFT); |
| 165 | 222 | echo '<option value="' . esc_attr($j) . '"'; |
| 166 | 223 | if ( $next_key_date_minutes == $j ) { echo ' selected'; } |
| 167 | 224 | echo '>' . esc_html($j) . '</option>'; |
| @@ -172,9 +229,13 @@ | ||
| 172 | 229 | <?php |
| 173 | 230 | } |
| 174 | 231 | } |
| 175 | 232 | ?> |
| 176 | - <button type="button" id="<?php echo esc_attr((int)$_POST['date_post_id']); ?>" class="button button-primary save-quick-edit">Update</button> | |
| 177 | - <button type="button" id="<?php echo esc_attr((int)$_POST['date_post_id']); ?>" class="button cancel-quick-edit">Cancel</button> | |
| 233 | + <button type="button" id="<?php | |
| 234 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 235 | + echo esc_attr( (int) $propertyhive_ph_key_date_input['date_post_id'] ); ?>" class="button button-primary save-quick-edit">Update</button> | |
| 236 | + <button type="button" id="<?php | |
| 237 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This authorized AJAX template only renders controls; key-date writes separately verify their nonce and CRM capability. | |
| 238 | + echo esc_attr( (int) $propertyhive_ph_key_date_input['date_post_id'] ); ?>" class="button cancel-quick-edit">Cancel</button> | |
| 178 | 239 | </div> |
| 179 | 240 | </div> |
| 180 | 241 | </td> |