← All changes | includes/admin/ph-meta-box-functions.php +18 -2 2.2.4 → 2.3.1 View file →

		@@ -19,8 +19,9 @@
19	19	*/
20	20	function propertyhive_wp_text_input( $field ) {
21	21	global $thepostid, $post, $propertyhive;
22	22
	23	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
23	24	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
24	25
25	26	$field = apply_filters( 'propertyhive_meta_box_wp_text_field', $field, $thepostid );
26	27
		@@ -52,9 +53,12 @@
52	53
53	54	echo '
54	55	<p class="form-field ' . esc_attr( $field['id'] ) . '_field ' . esc_attr( $field['wrapper_class'] ) . '">
55	56	<label for="' . esc_attr( $field['id'] ) . '">' . wp_kses_post( $field['label'] ) . '</label>
56		- <input type="' . esc_attr( $field['type'] ) . '" class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['name'] ) . '" id="' . esc_attr( $field['id'] ) . '" value="' . esc_attr( $field['value'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" ' . implode( ' ', $custom_attributes ) . ' /> ';
	57	+ <input type="' . esc_attr( $field['type'] ) . '" class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['name'] ) . '" id="' . esc_attr( $field['id'] ) . '" value="' . esc_attr( $field['value'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" ';
	58	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Custom attributes come from the PHP field definition/filter; every name and value is escaped above before assembling this attribute fragment.
	59	+ echo implode( ' ', $custom_attributes );
	60	+ echo ' /> ';
57	61
58	62	if ( ! empty( $field['description'] ) ) {
59	63
60	64	if ( isset( $field['desc_tip'] ) && false !== $field['desc_tip'] ) {
		@@ -76,8 +80,9 @@
76	80	*/
77	81	function propertyhive_wp_photo_upload( $field ) {
78	82	global $thepostid, $post, $propertyhive;
79	83
	84	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
80	85	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
81	86
82	87	$field = apply_filters( 'propertyhive_meta_box_wp_photo_upload_field', $field, $thepostid );
83	88
		@@ -197,8 +202,9 @@
197	202	*/
198	203	function propertyhive_wp_file_upload( $field ) {
199	204	global $thepostid, $post, $propertyhive;
200	205
	206	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
201	207	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
202	208
203	209	$field = apply_filters( 'propertyhive_meta_box_wp_file_upload_field', $field, $thepostid );
204	210
		@@ -319,8 +325,9 @@
319	325	*/
320	326	function propertyhive_wp_hidden_input( $field ) {
321	327	global $thepostid, $post;
322	328
	329	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
323	330	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
324	331
325	332	$field = apply_filters( 'propertyhive_meta_box_wp_hidden_field', $field, $thepostid );
326	333
		@@ -338,8 +345,9 @@
338	345	*/
339	346	function propertyhive_wp_textarea_input( $field ) {
340	347	global $thepostid, $post, $propertyhive;
341	348
	349	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
342	350	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
343	351
344	352	$field = apply_filters( 'propertyhive_meta_box_wp_textarea_field', $field, $thepostid );
345	353
		@@ -355,9 +363,12 @@
355	363	if ( ! empty( $field['custom_attributes'] ) && is_array( $field['custom_attributes'] ) )
356	364	foreach ( $field['custom_attributes'] as $attribute => $value )
357	365	$custom_attributes[] = esc_attr( $attribute ) . '="' . esc_attr( $value ) . '"';
358	366
359		- echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field ' . esc_attr( $field['wrapper_class'] ) . '"><label for="' . esc_attr( $field['id'] ) . '">' . wp_kses_post( $field['label'] ) . '</label><textarea class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['name'] ) . '" id="' . esc_attr( $field['id'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" rows="2" cols="20" ' . implode( ' ', $custom_attributes ) . '>' . esc_textarea( $field['value'] ) . '</textarea> ';
	367	+ echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field ' . esc_attr( $field['wrapper_class'] ) . '"><label for="' . esc_attr( $field['id'] ) . '">' . wp_kses_post( $field['label'] ) . '</label><textarea class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['name'] ) . '" id="' . esc_attr( $field['id'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" rows="2" cols="20" ';
	368	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Custom attributes come from the PHP field definition/filter; every name and value is escaped above before assembling this attribute fragment.
	369	+ echo implode( ' ', $custom_attributes );
	370	+ echo '>' . esc_textarea( $field['value'] ) . '</textarea> ';
360	371
361	372	if ( ! empty( $field['description'] ) ) {
362	373
363	374	if ( isset( $field['desc_tip'] ) && false !== $field['desc_tip'] ) {
		@@ -379,8 +390,9 @@
379	390	*/
380	391	function propertyhive_wp_checkbox( $field ) {
381	392	global $thepostid, $post;
382	393
	394	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
383	395	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
384	396
385	397	$field = apply_filters( 'propertyhive_meta_box_wp_checkbox_field', $field, $thepostid );
386	398
		@@ -406,8 +418,9 @@
406	418	*/
407	419	function propertyhive_wp_checkboxes( $field ) {
408	420	global $thepostid, $post;
409	421
	422	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
410	423	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
411	424
412	425	$field = apply_filters( 'propertyhive_meta_box_wp_checkboxes_field', $field, $thepostid );
413	426
		@@ -438,8 +451,9 @@
438	451	*/
439	452	function propertyhive_wp_select( $field ) {
440	453	global $thepostid, $post, $propertyhive;
441	454
	455	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
442	456	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
443	457
444	458	$field = apply_filters( 'propertyhive_meta_box_wp_select_field', $field, $thepostid );
445	459
		@@ -479,8 +493,9 @@
479	493	*/
480	494	function propertyhive_wp_select_optgroups( $field ) {
481	495	global $thepostid, $post, $propertyhive;
482	496
	497	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
483	498	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
484	499
485	500	$field = apply_filters( 'propertyhive_meta_box_wp_select_optgroups_field', $field, $thepostid );
486	501
		@@ -529,8 +544,9 @@
529	544	*/
530	545	function propertyhive_wp_radio( $field ) {
531	546	global $thepostid, $post, $propertyhive;
532	547
	548	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared meta-box global contract; $thepostid is intentionally carried into the public Property Hive field-rendering helpers.
533	549	$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
534	550
535	551	$field = apply_filters( 'propertyhive_meta_box_wp_radio_field', $field, $thepostid );
536	552