PluginProbe
Property Hive / 2.3.1
Property Hive v2.3.1
2.3.1 2.3.0 2.2.6 2.2.5 2.2.4 2.2.3 2.2.2 1.4.46 1.4.47 1.4.48 1.4.49 1.4.5 1.4.50 1.4.51 1.4.52 1.4.53 1.4.54 1.4.55 1.4.56 1.4.57 1.4.58 1.4.59 1.4.6 1.4.60 1.4.61 All 261 releases
← All changes | includes/admin/settings/class-ph-settings-frontend.php +266 -112 2.2.42.3.1 View file →
@@ -1,5 +1,8 @@
1 1 <?php
2 +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
3 +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
4 +
2 5 /**
3 6 * PropertyHive Frontend Settings
4 7 *
5 8 * @author PropertyHive
@@ -16,8 +19,9 @@
16 19
17 20 /**
18 21 * PH_Settings_Frontend.
19 22 */
23 +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Settings_Frontend; preserving the existing PH_* class name is required for plugin and extension compatibility.
20 24 class PH_Settings_Frontend extends PH_Settings_Page {
21 25
22 26 /**
23 27 * Constructor.
@@ -39,13 +43,21 @@
39 43 }
40 44
41 45 public function check_for_reset_search_form()
42 46 {
43 - if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && $_GET['id'] != '' )
47 + if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' )
44 48 {
49 + if ( ! current_user_can( 'manage_options' ) )
50 + {
51 + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
52 + }
53 +
54 + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) );
55 + check_admin_referer( 'ph_reset_search_form_' . $request_id );
56 +
45 57 $current_settings = get_option( 'propertyhive_template_assistant', array() );
46 58
47 - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] );
59 + $current_id = sanitize_title( $request_id );
48 60
49 61 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
50 62
51 63 if ( !isset($existing_search_forms[$current_id]) )
@@ -65,13 +77,21 @@
65 77 }
66 78
67 79 public function check_for_delete_search_form()
68 80 {
69 - if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' )
81 + if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' )
70 82 {
83 + if ( ! current_user_can( 'manage_options' ) )
84 + {
85 + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
86 + }
87 +
88 + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) );
89 + check_admin_referer( 'ph_delete_search_form_' . $request_id );
90 +
71 91 $current_settings = get_option( 'propertyhive_template_assistant', array() );
72 92
73 - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] );
93 + $current_id = sanitize_title( $request_id );
74 94
75 95 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
76 96
77 97 if ( !isset($existing_search_forms[$current_id]) )
@@ -440,9 +460,10 @@
440 460 {
441 461 $current_settings['search_forms']['default'] = array();
442 462 }
443 463
444 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
464 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes.
465 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
445 466
446 467 $search_form_details = array();
447 468
448 469 if ($current_id != '')
@@ -460,9 +481,9 @@
460 481 }
461 482
462 483 $settings = array(
463 484
464 - array( 'title' => __( ( $current_section == 'addsearchform' ? 'Add Search Form' : 'Edit Search Form' ), 'propertyhive' ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ),
485 + array( 'title' => ( $current_section == 'addsearchform' ? __( 'Add Search Form', 'propertyhive' ) : __( 'Edit Search Form', 'propertyhive' ) ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ),
465 486
466 487 );
467 488
468 489 $custom_attributes = array();
@@ -536,18 +557,37 @@
536 557 }
537 558
538 559 if (!empty($search_forms))
539 560 {
540 - foreach ($search_forms as $id => $search_form)
561 + foreach ( $search_forms as $id => $search_form )
541 562 {
563 + $edit_url = admin_url( 'admin.php?page=ph-settings&tab=frontend&section=editsearchform&id=' . $id );
564 +
565 + $reset_url = wp_nonce_url(
566 + admin_url( 'admin.php?page=ph-settings&tab=frontend&section=search-forms&action=resetsearchform&id=' . $id ),
567 + 'ph_reset_search_form_' . $id
568 + );
569 +
542 570 echo '<tr>';
543 - echo '<td class="id">' . $id . '</td>';
544 - echo '<td class="shortcode"><pre style="background:#EEE; padding:5px; display:inline">[property_search_form id="' . $id . '"]</pre></td>';
571 + echo '<td class="id">' . esc_html( $id ) . '</td>';
572 + echo '<td class="shortcode"><pre style="background:#EEE; padding:5px; display:inline">[property_search_form id="' . esc_attr( $id ) . '"]</pre></td>';
545 573 echo '<td class="settings">
546 - <a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend&section=editsearchform&id=' . $id )) . '">' . esc_html(__( 'Edit Fields', 'propertyhive' )) . '</a>
547 - <a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend&section=search-forms&action=resetsearchform&id=' . $id )) . '">' . esc_html(__( 'Reset To Default Fields', 'propertyhive' )) . '</a>
548 - ' . ( ( $id != 'default' ) ? '<a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend&section=search-forms&action=deletesearchform&id=' . $id )) . '" onclick="var confirmBox = confirm(\'Are you sure you wish to delete this search form?\'); return confirmBox;">' . esc_html(__( 'Delete', 'propertyhive' )) . '</a>' : '' ) . '
549 - </td>';
574 + <a class="button" href="' . esc_url( $edit_url ) . '">' . esc_html__( 'Edit Fields', 'propertyhive' ) . '</a>
575 + <a class="button" href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset To Default Fields', 'propertyhive' ) . '</a>';
576 +
577 + if ( $id != 'default' )
578 + {
579 + $delete_url = wp_nonce_url(
580 + admin_url( 'admin.php?page=ph-settings&tab=frontend&section=search-forms&action=deletesearchform&id=' . $id ),
581 + 'ph_delete_search_form_' . $id
582 + );
583 +
584 + echo '
585 + <a class="button" href="' . esc_url( $delete_url ) . '" onclick="return confirm(\'Are you sure you wish to delete this search form?\');">' . esc_html__( 'Delete', 'propertyhive' ) . '</a>
586 + ';
587 + }
588 +
589 + echo '</td>';
550 590 echo '</tr>';
551 591 }
552 592 }
553 593 else
@@ -574,124 +614,167 @@
574 614
575 615 private function output_search_form_field( $id, $field )
576 616 {
577 617 echo '
578 - <div class="group" id="' . $id . '">
579 - <h3>' . trim( $id, '_' ) . '</h3>
618 + <div class="group" id="' . esc_attr( $id ) . '">
619 + <h3>' . esc_html( trim( $id, '_' ) ) . '</h3>
580 620 <div>';
581 - if ( $id == 'department' )
621 +
622 + if ( 'department' === $id )
582 623 {
583 - echo '<p><label for="type_'.$id.'">Type:</label> <select name="type[' . $id . ']" id="type_'.$id.'">
624 + echo '<p><label for="type_'. esc_attr( $id ) .'">Type:</label> <select name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'">
584 625 <option value="radio"' . ( ( !isset($field['type']) || ( isset($field['type']) && $field['type'] == 'radio' ) ) ? ' selected' : '' ) . '>Radio Buttons</option>
585 626 <option value="select"' . ( ( isset($field['type']) && $field['type'] == 'select' ) ? ' selected' : '' ) . '>Dropdown</option>
586 - ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . $field['type'] . '" selected>' . $field['type'] . '</option>' : '' ) . '
627 + ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . esc_attr( $field['type'] ) . '" selected>' . esc_attr( $field['type'] ) . '</option>' : '' ) . '
587 628 </select></p>';
588 629 }
589 630 else
590 631 {
591 - echo '<input type="hidden" name="type[' . $id . ']" id="type_'.$id.'" value="' . ( ( isset($field['type']) ) ? $field['type'] : '' ) . '">';
632 + echo '<input type="hidden" name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'" value="' . ( ( isset($field['type']) ) ? esc_attr( $field['type'] ) : '' ) . '">';
592 633 }
593 634
594 - echo ' <p><label for="show_label_'.$id.'">Show Label:</label> <input type="checkbox" name="show_label[' . $id . ']" id="show_label_'.$id.'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p>
635 + echo ' <p><label for="show_label_'. esc_attr( $id ) .'">Show Label:</label> <input type="checkbox" name="show_label[' . esc_attr( $id ) . ']" id="show_label_'. esc_attr( $id ) .'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p>
595 636
596 - <p><label for="label_'.$id.'">Label:</label> <input type="text" name="label[' . $id . ']" id="label_'.$id.'" value="' . ( ( isset($field['label']) ) ? $field['label'] : '' ) . '"></p>
637 + <p><label for="label_'. esc_attr( $id ) .'">Label:</label> <input type="text" name="label[' . esc_attr( $id ) . ']" id="label_'. esc_attr( $id ) .'" value="' . ( ( isset($field['label']) ) ? esc_attr( $field['label'] ) : '' ) . '"></p>
597 638
598 - <p><label for="before_'.$id.'">Before:</label> <input type="text" name="before[' . $id . ']" id="before_'.$id.'" value="' . ( ( isset($field['before']) ) ? htmlentities($field['before']) : '' ) . '"></p>
639 + <p><label for="before_'. esc_attr( $id ) .'">Before:</label> <input type="text" name="before[' . esc_attr( $id ) . ']" id="before_'. esc_attr( $id ) .'" value="' . ( ( isset($field['before']) ) ? esc_attr($field['before']) : '' ) . '"></p>
599 640
600 - <p><label for="after_'.$id.'">After:</label> <input type="text" name="after[' . $id . ']" id="after_'.$id.'" value="' . ( ( isset($field['after']) ) ? htmlentities($field['after']) : '' ) . '"></p>';
641 + <p><label for="after_'. esc_attr( $id ) .'">After:</label> <input type="text" name="after[' . esc_attr( $id ) . ']" id="after_'. esc_attr( $id ) .'" value="' . ( ( isset($field['after']) ) ? esc_attr($field['after']) : '' ) . '"></p>';
601 642
602 - if ( isset($field['type']) && in_array($field['type'], array('text', 'email', 'date', 'number', 'password')) )
643 + if (
644 + isset( $field['type'] ) &&
645 + in_array( $field['type'], array( 'text', 'email', 'date', 'number', 'password' ), true )
646 + )
603 647 {
604 648 echo '
605 - <p><label for="placeholder_'.$id.'">Placeholder:</label> <input type="text" name="placeholder[' . $id . ']" id="placeholder_'.$id.'" value="' . ( ( isset($field['placeholder']) ) ? htmlentities($field['placeholder']) : '' ) . '"></p>
649 + <p><label for="placeholder_'. esc_attr( $id ) .'">Placeholder:</label> <input type="text" name="placeholder[' . esc_attr( $id ) . ']" id="placeholder_'. esc_attr( $id ) .'" value="' . ( ( isset($field['placeholder']) ) ? esc_attr($field['placeholder']) : '' ) . '"></p>
606 650 ';
607 651 }
608 652
609 - if ( isset($field['type']) && in_array($field['type'], array('slider')) )
653 + if (
654 + isset( $field['type'] ) &&
655 + in_array( $field['type'], array( 'slider' ), true )
656 + )
610 657 {
611 658 echo '
612 - <p><label for="min_'.$id.'">Min:</label> <input type="number" name="min[' . $id . ']" id="min_'.$id.'" value="' . ( ( isset($field['min']) ) ? htmlentities($field['min']) : '0' ) . '"></p>
659 + <p><label for="min_'. esc_attr( $id ) .'">Min:</label> <input type="number" name="min[' . esc_attr( $id ) . ']" id="min_'. esc_attr( $id ) .'" value="' . ( ( isset($field['min']) ) ? esc_attr($field['min']) : '0' ) . '"></p>
613 660 ';
614 661
615 662 echo '
616 - <p><label for="max_'.$id.'">Max:</label> <input type="number" name="max[' . $id . ']" id="max_'.$id.'" value="' . ( ( isset($field['max']) ) ? htmlentities($field['max']) : '' ) . '"></p>
663 + <p><label for="max_'. esc_attr( $id ) .'">Max:</label> <input type="number" name="max[' . esc_attr( $id ) . ']" id="max_'. esc_attr( $id ) .'" value="' . ( ( isset($field['max']) ) ? esc_attr($field['max']) : '' ) . '"></p>
617 664 ';
618 665
619 666 echo '
620 - <p><label for="step_'.$id.'">Step:</label> <input type="number" name="step[' . $id . ']" id="step_'.$id.'" value="' . ( ( isset($field['step']) ) ? htmlentities($field['step']) : '1' ) . '"></p>
667 + <p><label for="step_'. esc_attr( $id ) .'">Step:</label> <input type="number" name="step[' . esc_attr( $id ) . ']" id="step_'. esc_attr( $id ) .'" value="' . ( ( isset($field['step']) ) ? esc_attr($field['step']) : '1' ) . '"></p>
621 668 ';
622 669 }
623 670
624 - if ( isset($field['type']) && in_array($field['type'], array('office')) )
671 + if (
672 + isset( $field['type'] ) &&
673 + in_array( $field['type'], array( 'office' ), true )
674 + )
625 675 {
626 676 echo '
627 - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p>
677 + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p>
628 678 ';
629 679 }
630 680
631 - if ( taxonomy_exists($id) || ( isset($field['custom_field']) && $field['custom_field'] === true && $field['type'] == 'select' ) )
681 + if (
682 + taxonomy_exists( $id ) ||
683 + (
684 + isset( $field['custom_field'] ) &&
685 + true === $field['custom_field'] &&
686 + isset( $field['type'] ) &&
687 + 'select' === $field['type']
688 + )
689 + )
632 690 {
633 691 echo '
634 - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p>
692 + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p>
635 693 ';
636 694
637 - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_multi_level_taxonomy_fields', array('property_type', 'commercial_property_type', 'location') ) ) )
695 + if (
696 + taxonomy_exists( $id ) &&
697 + in_array(
698 + $id,
699 + apply_filters(
700 + 'propertyhive_template_assistant_multi_level_taxonomy_fields',
701 + array( 'property_type', 'commercial_property_type', 'location' )
702 + ),
703 + true
704 + )
705 + )
638 706 {
639 707 echo '
640 - <p><label for="parent_terms_only_'.$id.'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . $id . ']" id="parent_terms_only_'.$id.'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p>
708 + <p><label for="parent_terms_only_'. esc_attr( $id ) .'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . esc_attr( $id ) . ']" id="parent_terms_only_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p>
641 709 ';
642 710
643 711 echo '
644 - <p><label for="hide_empty_'.$id.'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . $id . ']" id="hide_empty_'.$id.'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p>
712 + <p><label for="hide_empty_'. esc_attr( $id ) .'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . esc_attr( $id ) . ']" id="hide_empty_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p>
645 713 ';
646 714 }
647 715
648 - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_dynamic_population_taxonomy_fields', array('location') ) ) )
716 + if (
717 + taxonomy_exists( $id ) &&
718 + in_array(
719 + $id,
720 + apply_filters(
721 + 'propertyhive_template_assistant_dynamic_population_taxonomy_fields',
722 + array( 'location' )
723 + ),
724 + true
725 + )
726 + )
649 727 {
650 728 echo '
651 - <p><label for="dynamic_population_'.$id.'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . $id . ']" id="dynamic_population_'.$id.'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p>
729 + <p><label for="dynamic_population_'. esc_attr( $id ) .'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . esc_attr( $id ) . ']" id="dynamic_population_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p>
652 730 ';
653 731 }
654 732
655 733 echo '
656 - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
734 + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
657 735 ';
658 736 }
659 737
660 - if ( $id == 'office' )
738 + if ( 'office' === $id )
661 739 {
662 740 echo '
663 - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
741 + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
664 742 ';
665 743 }
666 744
667 - if ( isset($field['options']) && !taxonomy_exists($id) && ( !isset($field['custom_field']) || ( isset($field['custom_field']) && $field['custom_field'] === false ) ) )
745 + if (
746 + isset( $field['options'] ) &&
747 + ! taxonomy_exists( $id ) &&
748 + (
749 + ! isset( $field['custom_field'] ) ||
750 + false === $field['custom_field']
751 + )
752 + )
668 753 {
669 - echo '<p><label for="">Options: ';
754 + echo '<p><label>Options: ';
670 755
671 - echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . $id . '">Add Option</a>';
756 + echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . esc_attr( $id ) . '">Add Option</a>';
672 757
673 758 echo '</label><br>';
674 759
675 - echo '<span class="form-field-options" id="sortable_options_' . $id . '">';
760 + echo '<span class="form-field-options" id="sortable_options_' . esc_attr( $id ) . '">';
676 761 $i = 0;
677 762 foreach ( $field['options'] as $key => $value )
678 763 {
679 764 echo '<span style="display:block"><i class="fa fa-reorder" style="cursor:pointer; opacity:0.3"></i> ';
680 - echo '<input type="text" name="option_keys[' . $id . '][]" value="' . $key . '">';
681 - echo '<input type="text" name="options_values[' . $id . '][]" value="' . $value . '">';
765 + echo '<input type="text" name="option_keys[' . esc_attr( $id ) . '][]" value="' . esc_attr( $key ) . '">';
766 + echo '<input type="text" name="options_values[' . esc_attr( $id ) . '][]" value="' . esc_attr( $value ) . '">';
682 767 echo '</span>';
768 + }
683 769
684 - ++$i;
685 - }
686 770 echo '</span>';
687 -
688 771 echo '</p>';
689 772 ?>
690 773 <script>
691 774 jQuery(document).ready(function($)
692 775 {
693 - $( "#sortable_options_<?php echo $id; ?>" )
776 + $( document.getElementById( <?php echo wp_json_encode( 'sortable_options_' . $id, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT ); ?> ) )
694 777 .sortable({
695 778 axis: "y",
696 779 handle: "i",
697 780 stop: function( event, ui )
@@ -711,10 +794,10 @@
711 794 //$('#active_fields_order').val( fields_order.join("|") );
712 795 }
713 796 });
714 797 });
715 - </script>
716 -<?php
798 + </script>
799 + <?php
717 800 }
718 801
719 802 echo '</div>
720 803 </div>';
@@ -739,9 +822,10 @@
739 822 {
740 823 $current_settings['search_forms']['default'] = array();
741 824 }
742 825
743 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
826 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes.
827 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
744 828
745 829 $search_form_details = array();
746 830
747 831 if ($current_id != '')
@@ -1198,9 +1282,9 @@
1198 1282 foreach ( $active_fields as $id => $field )
1199 1283 {
1200 1284 $field_ids[] = $id;
1201 1285 }
1202 - echo implode("|", $field_ids);
1286 + echo esc_attr( implode("|", $field_ids) );
1203 1287 ?>">
1204 1288 <input type="hidden" name="inactive_fields_order" id="inactive_fields_order" value="<?php
1205 1289 $field_ids = array();
1206 1290 foreach ( $inactive_fields as $id => $field )
@@ -1206,9 +1290,9 @@
1206 1290 foreach ( $inactive_fields as $id => $field )
1207 1291 {
1208 1292 $field_ids[] = $id;
1209 1293 }
1210 - echo implode("|", $field_ids);
1294 + echo esc_attr( implode("|", $field_ids) );
1211 1295 ?>">
1212 1296
1213 1297 <script>
1214 1298 jQuery(document).ready(function($)
@@ -1400,8 +1484,9 @@
1400 1484 if ( $current_section )
1401 1485 {
1402 1486 switch ($current_section)
1403 1487 {
1488 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
1404 1489 case "search-forms": { $hide_save_button = true; $settings = $this->get_search_forms_settings(); break; }
1405 1490 case "addsearchform": { $settings = $this->get_search_form_settings(); break; }
1406 1491 case "editsearchform": { $settings = $this->get_search_form_settings(); break; }
1407 1492 case "flags": { $settings = $this->get_flags_settings(); break; }
@@ -1420,8 +1505,12 @@
1420 1505 * Save settings.
1421 1506 */
1422 1507 public function save()
1423 1508 {
1509 + if ( ! current_user_can( 'manage_options' ) || ! isset( $_REQUEST['_wpnonce'] ) || ! is_string( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'propertyhive-settings' ) ) {
1510 + return;
1511 + }
1512 +
1424 1513 global $current_section;
1425 1514
1426 1515 $current_settings = get_option( 'propertyhive_template_assistant', array() );
1427 1516
@@ -1430,14 +1519,26 @@
1430 1519 switch ($current_section)
1431 1520 {
1432 1521 case "flags":
1433 1522 {
1523 + $flag_input = array();
1524 + foreach ( array( 'flags_active', 'flags_active_single', 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) {
1525 + if ( isset( $_POST[$flag_key] ) && ! is_string( $_POST[$flag_key] ) ) {
1526 + return;
1527 + }
1528 + $flag_input[$flag_key] = isset( $_POST[$flag_key] ) ? sanitize_text_field( wp_unslash( $_POST[$flag_key] ) ) : '';
1529 + }
1530 + foreach ( array( 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) {
1531 + if ( ! isset( $_POST[$flag_key] ) ) {
1532 + return;
1533 + }
1534 + }
1434 1535 $propertyhive_template_assistant = array(
1435 - 'flags_active' => ( ( isset($_POST['flags_active']) ) ? sanitize_text_field($_POST['flags_active']) : '' ),
1436 - 'flags_active_single' => ( ( isset($_POST['flags_active_single']) ) ? sanitize_text_field($_POST['flags_active_single']) : '' ),
1437 - 'flag_position' => sanitize_text_field($_POST['flag_position']),
1438 - 'flag_bg_color' => sanitize_text_field($_POST['flag_bg_color']),
1439 - 'flag_text_color' => sanitize_text_field($_POST['flag_text_color']),
1536 + 'flags_active' => $flag_input['flags_active'],
1537 + 'flags_active_single' => $flag_input['flags_active_single'],
1538 + 'flag_position' => $flag_input['flag_position'],
1539 + 'flag_bg_color' => $flag_input['flag_bg_color'],
1540 + 'flag_text_color' => $flag_input['flag_text_color'],
1440 1541 );
1441 1542
1442 1543 $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant);
1443 1544
@@ -1446,9 +1547,9 @@
1446 1547 }
1447 1548 case "addsearchform":
1448 1549 case "editsearchform":
1449 1550 {
1450 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
1551 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
1451 1552
1452 1553 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
1453 1554
1454 1555 if ( $current_section == 'editsearchform' && $current_id != 'default' && !isset($existing_search_forms[$current_id]) )
@@ -1460,9 +1561,32 @@
1460 1561 {
1461 1562 unset($existing_search_forms[$current_id]);
1462 1563 }
1463 1564
1464 - $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title($_POST['form_id'])) : $current_id );
1565 + $submitted_fields = array();
1566 + foreach ( array( 'show_label', 'label', 'type', 'before', 'after', 'placeholder', 'min', 'max', 'step', 'blank_option', 'parent_terms_only', 'dynamic_population', 'hide_empty', 'multiselect' ) as $input_key ) {
1567 + if ( isset( $_POST[$input_key] ) && ! is_array( $_POST[$input_key] ) ) {
1568 + return;
1569 + }
1570 + $submitted_fields[$input_key] = array();
1571 + if ( isset( $_POST[$input_key] ) ) {
1572 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1573 + foreach ( $_POST[$input_key] as $field_id => $value ) {
1574 + if ( ! is_string( $value ) ) {
1575 + return;
1576 + }
1577 + $value = wp_unslash( $value );
1578 + $submitted_fields[$input_key][$field_id] = in_array( $input_key, array( 'label', 'before', 'after' ), true ) ? wp_kses_post( $value ) : sanitize_text_field( $value );
1579 + }
1580 + }
1581 + }
1582 + foreach ( array( 'form_id', 'active_fields_order', 'inactive_fields_order' ) as $input_key ) {
1583 + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) {
1584 + return;
1585 + }
1586 + }
1587 +
1588 + $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title( wp_unslash( $_POST['form_id'] ) )) : $current_id );
1465 1589 if ($current_section == 'addsearchform' && trim($current_id) == '' )
1466 1590 {
1467 1591 $current_id = 'custom';
1468 1592 }
@@ -1471,63 +1595,63 @@
1471 1595 $inactive_fields = array();
1472 1596
1473 1597 if ( isset($_POST['active_fields_order']) && $_POST['active_fields_order'] != '' )
1474 1598 {
1475 - $field_ids = explode("|", sanitize_text_field($_POST['active_fields_order']));
1599 + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['active_fields_order'] ) ));
1476 1600 if ( !empty($field_ids) )
1477 1601 {
1478 1602 foreach ( $field_ids as $field_id )
1479 1603 {
1480 1604 $active_fields[$field_id] = array(
1481 - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ),
1482 - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ),
1605 + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ),
1606 + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ),
1483 1607 );
1484 1608
1485 - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' )
1609 + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' )
1486 1610 {
1487 - $active_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]);
1611 + $active_fields[$field_id]['type'] = $submitted_fields['type'][$field_id];
1488 1612 }
1489 - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' )
1613 + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' )
1490 1614 {
1491 - $active_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]);
1615 + $active_fields[$field_id]['before'] = $submitted_fields['before'][$field_id];
1492 1616 }
1493 - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' )
1617 + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' )
1494 1618 {
1495 - $active_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]);
1619 + $active_fields[$field_id]['after'] = $submitted_fields['after'][$field_id];
1496 1620 }
1497 - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' )
1621 + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' )
1498 1622 {
1499 - $active_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]);
1623 + $active_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id];
1500 1624 }
1501 - if ( isset($_POST['min'][$field_id]) && $_POST['min'][$field_id] != '' )
1625 + if ( isset($submitted_fields['min'][$field_id]) && $submitted_fields['min'][$field_id] != '' )
1502 1626 {
1503 - $active_fields[$field_id]['min'] = stripslashes($_POST['min'][$field_id]);
1627 + $active_fields[$field_id]['min'] = $submitted_fields['min'][$field_id];
1504 1628 }
1505 - if ( isset($_POST['max'][$field_id]) && $_POST['max'][$field_id] != '' )
1629 + if ( isset($submitted_fields['max'][$field_id]) && $submitted_fields['max'][$field_id] != '' )
1506 1630 {
1507 - $active_fields[$field_id]['max'] = stripslashes($_POST['max'][$field_id]);
1631 + $active_fields[$field_id]['max'] = $submitted_fields['max'][$field_id];
1508 1632 }
1509 - if ( isset($_POST['step'][$field_id]) && $_POST['step'][$field_id] != '' )
1633 + if ( isset($submitted_fields['step'][$field_id]) && $submitted_fields['step'][$field_id] != '' )
1510 1634 {
1511 - $active_fields[$field_id]['step'] = stripslashes($_POST['step'][$field_id]);
1635 + $active_fields[$field_id]['step'] = $submitted_fields['step'][$field_id];
1512 1636 }
1513 - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' )
1637 + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' )
1514 1638 {
1515 - $active_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]);
1639 + $active_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id];
1516 1640 }
1517 - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' )
1641 + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' )
1518 1642 {
1519 1643 $active_fields[$field_id]['parent_terms_only'] = true;
1520 1644 }
1521 - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' )
1645 + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' )
1522 1646 {
1523 1647 $active_fields[$field_id]['dynamic_population'] = true;
1524 1648 }
1525 - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' )
1649 + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' )
1526 1650 {
1527 1651 $active_fields[$field_id]['hide_empty'] = true;
1528 1652 }
1529 - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' )
1653 + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' )
1530 1654 {
1531 1655 $active_fields[$field_id]['multiselect'] = true;
1532 1656 }
1533 1657
@@ -1533,11 +1657,15 @@
1533 1657
1534 1658 if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) )
1535 1659 {
1536 1660 $options = array();
1661 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1537 1662 foreach ( $_POST['option_keys'][$field_id] as $i => $key )
1538 1663 {
1539 - $options[$key] = $_POST['options_values'][$field_id][$i];
1664 + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) {
1665 + return;
1666 + }
1667 + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) );
1540 1668 }
1541 1669 $active_fields[$field_id]['options'] = $options;
1542 1670 }
1543 1671 }
@@ -1545,51 +1673,51 @@
1545 1673 }
1546 1674
1547 1675 if ( isset($_POST['inactive_fields_order']) && $_POST['inactive_fields_order'] != '' )
1548 1676 {
1549 - $field_ids = explode("|", sanitize_text_field($_POST['inactive_fields_order']));
1677 + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['inactive_fields_order'] ) ));
1550 1678 if ( !empty($field_ids) )
1551 1679 {
1552 1680 foreach ( $field_ids as $field_id )
1553 1681 {
1554 1682 $inactive_fields[$field_id] = array(
1555 - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ),
1556 - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ),
1683 + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ),
1684 + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ),
1557 1685 );
1558 1686
1559 - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' )
1687 + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' )
1560 1688 {
1561 - $inactive_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]);
1689 + $inactive_fields[$field_id]['type'] = $submitted_fields['type'][$field_id];
1562 1690 }
1563 - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' )
1691 + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' )
1564 1692 {
1565 - $inactive_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]);
1693 + $inactive_fields[$field_id]['before'] = $submitted_fields['before'][$field_id];
1566 1694 }
1567 - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' )
1695 + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' )
1568 1696 {
1569 - $inactive_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]);
1697 + $inactive_fields[$field_id]['after'] = $submitted_fields['after'][$field_id];
1570 1698 }
1571 - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' )
1699 + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' )
1572 1700 {
1573 - $inactive_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]);
1701 + $inactive_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id];
1574 1702 }
1575 - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' )
1703 + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' )
1576 1704 {
1577 - $inactive_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]);
1705 + $inactive_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id];
1578 1706 }
1579 - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' )
1707 + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' )
1580 1708 {
1581 1709 $inactive_fields[$field_id]['parent_terms_only'] = true;
1582 1710 }
1583 - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' )
1711 + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' )
1584 1712 {
1585 1713 $inactive_fields[$field_id]['dynamic_population'] = true;
1586 1714 }
1587 - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' )
1715 + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' )
1588 1716 {
1589 1717 $inactive_fields[$field_id]['hide_empty'] = true;
1590 1718 }
1591 - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' )
1719 + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' )
1592 1720 {
1593 1721 $inactive_fields[$field_id]['multiselect'] = true;
1594 1722 }
1595 1723
@@ -1595,11 +1723,15 @@
1595 1723
1596 1724 if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) )
1597 1725 {
1598 1726 $options = array();
1727 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1599 1728 foreach ( $_POST['option_keys'][$field_id] as $i => $key )
1600 1729 {
1601 - $options[$key] = $_POST['options_values'][$field_id][$i];
1730 + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) {
1731 + return;
1732 + }
1733 + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) );
1602 1734 }
1603 1735 $inactive_fields[$field_id]['options'] = $options;
1604 1736 }
1605 1737 }
@@ -1621,12 +1753,33 @@
1621 1753 }
1622 1754 }
1623 1755 else
1624 1756 {
1757 + $frontend_input = array();
1758 + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_image_size', 'search_result_fields_custom_field', 'search_result_css' ) as $input_key ) {
1759 + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) {
1760 + return;
1761 + }
1762 + $frontend_input[$input_key] = isset( $_POST[$input_key] ) ? sanitize_text_field( wp_unslash( $_POST[$input_key] ) ) : '';
1763 + }
1764 + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_css' ) as $input_key ) {
1765 + if ( ! isset( $_POST[$input_key] ) ) {
1766 + return;
1767 + }
1768 + }
1769 + if ( isset( $_POST['search_result_fields'] ) && ! is_array( $_POST['search_result_fields'] ) ) {
1770 + return;
1771 + }
1625 1772 $search_results_fields = array();
1626 1773 if ( isset($_POST['search_result_fields']) && is_array($_POST['search_result_fields']) )
1627 1774 {
1628 - $search_results_fields = $_POST['search_result_fields'];
1775 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1776 + foreach ( $_POST['search_result_fields'] as $search_result_field ) {
1777 + if ( ! is_string( $search_result_field ) ) {
1778 + return;
1779 + }
1780 + $search_results_fields[] = sanitize_text_field( wp_unslash( $search_result_field ) );
1781 + }
1629 1782
1630 1783 $new_search_results_fields = array();
1631 1784 foreach ( $search_results_fields as $search_results_field )
1632 1785 {
@@ -1633,9 +1786,9 @@
1633 1786 if ( $search_results_field == 'custom_field' )
1634 1787 {
1635 1788 if ( isset($_POST['search_result_fields_custom_field']) && $_POST['search_result_fields_custom_field'] != '' )
1636 1789 {
1637 - $new_search_results_fields[] = ph_clean($_POST['search_result_fields_custom_field']);
1790 + $new_search_results_fields[] = $frontend_input['search_result_fields_custom_field'];
1638 1791 }
1639 1792 }
1640 1793 else
1641 1794 {
@@ -1646,14 +1799,15 @@
1646 1799 $search_results_fields = $new_search_results_fields;
1647 1800 }
1648 1801
1649 1802 $propertyhive_template_assistant = array(
1650 - 'search_result_default_order' => ph_clean($_POST['search_result_default_order']),
1651 - 'search_result_columns' => (int)$_POST['search_result_columns'],
1652 - 'search_result_layout' => (int)$_POST['search_result_layout'],
1803 + 'search_result_default_order' => $frontend_input['search_result_default_order'],
1804 + 'search_result_columns' => (int)$frontend_input['search_result_columns'],
1805 + 'search_result_layout' => (int)$frontend_input['search_result_layout'],
1653 1806 'search_result_fields' => $search_results_fields,
1654 - 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? ph_clean($_POST['search_result_image_size']) : 'medium' ),
1655 - 'search_result_css' => wp_unslash($_POST['search_result_css']),
1807 + 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? $frontend_input['search_result_image_size'] : 'medium' ),
1808 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Administrator-authored CSS is intentionally preserved; the type is validated above and its stylesheet output protects the closing style boundary.
1809 + 'search_result_css' => isset( $_POST['search_result_css'] ) ? wp_unslash($_POST['search_result_css']) : '',
1656 1810 'search_result_css_all_pages' => isset($_POST['search_result_css_all_pages']) ? 'yes' : '',
1657 1811 );
1658 1812
1659 1813 $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant);