← All changes
|
includes/admin/settings/class-ph-settings-frontend.php
+266
-112
2.2.4
→
2.3.1
View file →
| @@ -1,5 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean | |
| 3 | +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. | |
| 4 | + | |
| 2 | 5 | /** |
| 3 | 6 | * PropertyHive Frontend Settings |
| 4 | 7 | * |
| 5 | 8 | * @author PropertyHive |
| @@ -16,8 +19,9 @@ | ||
| 16 | 19 | |
| 17 | 20 | /** |
| 18 | 21 | * PH_Settings_Frontend. |
| 19 | 22 | */ |
| 23 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Settings_Frontend; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 20 | 24 | class PH_Settings_Frontend extends PH_Settings_Page { |
| 21 | 25 | |
| 22 | 26 | /** |
| 23 | 27 | * Constructor. |
| @@ -39,13 +43,21 @@ | ||
| 39 | 43 | } |
| 40 | 44 | |
| 41 | 45 | public function check_for_reset_search_form() |
| 42 | 46 | { |
| 43 | - if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && $_GET['id'] != '' ) | |
| 47 | + if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' ) | |
| 44 | 48 | { |
| 49 | + if ( ! current_user_can( 'manage_options' ) ) | |
| 50 | + { | |
| 51 | + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) ); | |
| 52 | + } | |
| 53 | + | |
| 54 | + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) ); | |
| 55 | + check_admin_referer( 'ph_reset_search_form_' . $request_id ); | |
| 56 | + | |
| 45 | 57 | $current_settings = get_option( 'propertyhive_template_assistant', array() ); |
| 46 | 58 | |
| 47 | - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] ); | |
| 59 | + $current_id = sanitize_title( $request_id ); | |
| 48 | 60 | |
| 49 | 61 | $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() ); |
| 50 | 62 | |
| 51 | 63 | if ( !isset($existing_search_forms[$current_id]) ) |
| @@ -65,13 +77,21 @@ | ||
| 65 | 77 | } |
| 66 | 78 | |
| 67 | 79 | public function check_for_delete_search_form() |
| 68 | 80 | { |
| 69 | - if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' ) | |
| 81 | + if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' ) | |
| 70 | 82 | { |
| 83 | + if ( ! current_user_can( 'manage_options' ) ) | |
| 84 | + { | |
| 85 | + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) ); | |
| 86 | + } | |
| 87 | + | |
| 88 | + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) ); | |
| 89 | + check_admin_referer( 'ph_delete_search_form_' . $request_id ); | |
| 90 | + | |
| 71 | 91 | $current_settings = get_option( 'propertyhive_template_assistant', array() ); |
| 72 | 92 | |
| 73 | - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] ); | |
| 93 | + $current_id = sanitize_title( $request_id ); | |
| 74 | 94 | |
| 75 | 95 | $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() ); |
| 76 | 96 | |
| 77 | 97 | if ( !isset($existing_search_forms[$current_id]) ) |
| @@ -440,9 +460,10 @@ | ||
| 440 | 460 | { |
| 441 | 461 | $current_settings['search_forms']['default'] = array(); |
| 442 | 462 | } |
| 443 | 463 | |
| 444 | - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] ); | |
| 464 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes. | |
| 465 | + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : ''; | |
| 445 | 466 | |
| 446 | 467 | $search_form_details = array(); |
| 447 | 468 | |
| 448 | 469 | if ($current_id != '') |
| @@ -460,9 +481,9 @@ | ||
| 460 | 481 | } |
| 461 | 482 | |
| 462 | 483 | $settings = array( |
| 463 | 484 | |
| 464 | - array( 'title' => __( ( $current_section == 'addsearchform' ? 'Add Search Form' : 'Edit Search Form' ), 'propertyhive' ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ), | |
| 485 | + array( 'title' => ( $current_section == 'addsearchform' ? __( 'Add Search Form', 'propertyhive' ) : __( 'Edit Search Form', 'propertyhive' ) ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ), | |
| 465 | 486 | |
| 466 | 487 | ); |
| 467 | 488 | |
| 468 | 489 | $custom_attributes = array(); |
| @@ -536,18 +557,37 @@ | ||
| 536 | 557 | } |
| 537 | 558 | |
| 538 | 559 | if (!empty($search_forms)) |
| 539 | 560 | { |
| 540 | - foreach ($search_forms as $id => $search_form) | |
| 561 | + foreach ( $search_forms as $id => $search_form ) | |
| 541 | 562 | { |
| 563 | + $edit_url = admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=editsearchform&id=' . $id ); | |
| 564 | + | |
| 565 | + $reset_url = wp_nonce_url( | |
| 566 | + admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=search-forms&action=resetsearchform&id=' . $id ), | |
| 567 | + 'ph_reset_search_form_' . $id | |
| 568 | + ); | |
| 569 | + | |
| 542 | 570 | echo '<tr>'; |
| 543 | - echo '<td class="id">' . $id . '</td>'; | |
| 544 | - echo '<td class="shortcode"><pre style="background:#EEE; padding:5px; display:inline">[property_search_form id="' . $id . '"]</pre></td>'; | |
| 571 | + echo '<td class="id">' . esc_html( $id ) . '</td>'; | |
| 572 | + echo '<td class="shortcode"><pre style="background:#EEE; padding:5px; display:inline">[property_search_form id="' . esc_attr( $id ) . '"]</pre></td>'; | |
| 545 | 573 | echo '<td class="settings"> |
| 546 | - <a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=editsearchform&id=' . $id )) . '">' . esc_html(__( 'Edit Fields', 'propertyhive' )) . '</a> | |
| 547 | - <a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=search-forms&action=resetsearchform&id=' . $id )) . '">' . esc_html(__( 'Reset To Default Fields', 'propertyhive' )) . '</a> | |
| 548 | - ' . ( ( $id != 'default' ) ? '<a class="button" href="' . esc_url(admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=search-forms&action=deletesearchform&id=' . $id )) . '" onclick="var confirmBox = confirm(\'Are you sure you wish to delete this search form?\'); return confirmBox;">' . esc_html(__( 'Delete', 'propertyhive' )) . '</a>' : '' ) . ' | |
| 549 | - </td>'; | |
| 574 | + <a class="button" href="' . esc_url( $edit_url ) . '">' . esc_html__( 'Edit Fields', 'propertyhive' ) . '</a> | |
| 575 | + <a class="button" href="' . esc_url( $reset_url ) . '">' . esc_html__( 'Reset To Default Fields', 'propertyhive' ) . '</a>'; | |
| 576 | + | |
| 577 | + if ( $id != 'default' ) | |
| 578 | + { | |
| 579 | + $delete_url = wp_nonce_url( | |
| 580 | + admin_url( 'admin.php?page=ph-settings&tab=frontend§ion=search-forms&action=deletesearchform&id=' . $id ), | |
| 581 | + 'ph_delete_search_form_' . $id | |
| 582 | + ); | |
| 583 | + | |
| 584 | + echo ' | |
| 585 | + <a class="button" href="' . esc_url( $delete_url ) . '" onclick="return confirm(\'Are you sure you wish to delete this search form?\');">' . esc_html__( 'Delete', 'propertyhive' ) . '</a> | |
| 586 | + '; | |
| 587 | + } | |
| 588 | + | |
| 589 | + echo '</td>'; | |
| 550 | 590 | echo '</tr>'; |
| 551 | 591 | } |
| 552 | 592 | } |
| 553 | 593 | else |
| @@ -574,124 +614,167 @@ | ||
| 574 | 614 | |
| 575 | 615 | private function output_search_form_field( $id, $field ) |
| 576 | 616 | { |
| 577 | 617 | echo ' |
| 578 | - <div class="group" id="' . $id . '"> | |
| 579 | - <h3>' . trim( $id, '_' ) . '</h3> | |
| 618 | + <div class="group" id="' . esc_attr( $id ) . '"> | |
| 619 | + <h3>' . esc_html( trim( $id, '_' ) ) . '</h3> | |
| 580 | 620 | <div>'; |
| 581 | - if ( $id == 'department' ) | |
| 621 | + | |
| 622 | + if ( 'department' === $id ) | |
| 582 | 623 | { |
| 583 | - echo '<p><label for="type_'.$id.'">Type:</label> <select name="type[' . $id . ']" id="type_'.$id.'"> | |
| 624 | + echo '<p><label for="type_'. esc_attr( $id ) .'">Type:</label> <select name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'"> | |
| 584 | 625 | <option value="radio"' . ( ( !isset($field['type']) || ( isset($field['type']) && $field['type'] == 'radio' ) ) ? ' selected' : '' ) . '>Radio Buttons</option> |
| 585 | 626 | <option value="select"' . ( ( isset($field['type']) && $field['type'] == 'select' ) ? ' selected' : '' ) . '>Dropdown</option> |
| 586 | - ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . $field['type'] . '" selected>' . $field['type'] . '</option>' : '' ) . ' | |
| 627 | + ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . esc_attr( $field['type'] ) . '" selected>' . esc_attr( $field['type'] ) . '</option>' : '' ) . ' | |
| 587 | 628 | </select></p>'; |
| 588 | 629 | } |
| 589 | 630 | else |
| 590 | 631 | { |
| 591 | - echo '<input type="hidden" name="type[' . $id . ']" id="type_'.$id.'" value="' . ( ( isset($field['type']) ) ? $field['type'] : '' ) . '">'; | |
| 632 | + echo '<input type="hidden" name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'" value="' . ( ( isset($field['type']) ) ? esc_attr( $field['type'] ) : '' ) . '">'; | |
| 592 | 633 | } |
| 593 | 634 | |
| 594 | - echo ' <p><label for="show_label_'.$id.'">Show Label:</label> <input type="checkbox" name="show_label[' . $id . ']" id="show_label_'.$id.'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p> | |
| 635 | + echo ' <p><label for="show_label_'. esc_attr( $id ) .'">Show Label:</label> <input type="checkbox" name="show_label[' . esc_attr( $id ) . ']" id="show_label_'. esc_attr( $id ) .'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p> | |
| 595 | 636 | |
| 596 | - <p><label for="label_'.$id.'">Label:</label> <input type="text" name="label[' . $id . ']" id="label_'.$id.'" value="' . ( ( isset($field['label']) ) ? $field['label'] : '' ) . '"></p> | |
| 637 | + <p><label for="label_'. esc_attr( $id ) .'">Label:</label> <input type="text" name="label[' . esc_attr( $id ) . ']" id="label_'. esc_attr( $id ) .'" value="' . ( ( isset($field['label']) ) ? esc_attr( $field['label'] ) : '' ) . '"></p> | |
| 597 | 638 | |
| 598 | - <p><label for="before_'.$id.'">Before:</label> <input type="text" name="before[' . $id . ']" id="before_'.$id.'" value="' . ( ( isset($field['before']) ) ? htmlentities($field['before']) : '' ) . '"></p> | |
| 639 | + <p><label for="before_'. esc_attr( $id ) .'">Before:</label> <input type="text" name="before[' . esc_attr( $id ) . ']" id="before_'. esc_attr( $id ) .'" value="' . ( ( isset($field['before']) ) ? esc_attr($field['before']) : '' ) . '"></p> | |
| 599 | 640 | |
| 600 | - <p><label for="after_'.$id.'">After:</label> <input type="text" name="after[' . $id . ']" id="after_'.$id.'" value="' . ( ( isset($field['after']) ) ? htmlentities($field['after']) : '' ) . '"></p>'; | |
| 641 | + <p><label for="after_'. esc_attr( $id ) .'">After:</label> <input type="text" name="after[' . esc_attr( $id ) . ']" id="after_'. esc_attr( $id ) .'" value="' . ( ( isset($field['after']) ) ? esc_attr($field['after']) : '' ) . '"></p>'; | |
| 601 | 642 | |
| 602 | - if ( isset($field['type']) && in_array($field['type'], array('text', 'email', 'date', 'number', 'password')) ) | |
| 643 | + if ( | |
| 644 | + isset( $field['type'] ) && | |
| 645 | + in_array( $field['type'], array( 'text', 'email', 'date', 'number', 'password' ), true ) | |
| 646 | + ) | |
| 603 | 647 | { |
| 604 | 648 | echo ' |
| 605 | - <p><label for="placeholder_'.$id.'">Placeholder:</label> <input type="text" name="placeholder[' . $id . ']" id="placeholder_'.$id.'" value="' . ( ( isset($field['placeholder']) ) ? htmlentities($field['placeholder']) : '' ) . '"></p> | |
| 649 | + <p><label for="placeholder_'. esc_attr( $id ) .'">Placeholder:</label> <input type="text" name="placeholder[' . esc_attr( $id ) . ']" id="placeholder_'. esc_attr( $id ) .'" value="' . ( ( isset($field['placeholder']) ) ? esc_attr($field['placeholder']) : '' ) . '"></p> | |
| 606 | 650 | '; |
| 607 | 651 | } |
| 608 | 652 | |
| 609 | - if ( isset($field['type']) && in_array($field['type'], array('slider')) ) | |
| 653 | + if ( | |
| 654 | + isset( $field['type'] ) && | |
| 655 | + in_array( $field['type'], array( 'slider' ), true ) | |
| 656 | + ) | |
| 610 | 657 | { |
| 611 | 658 | echo ' |
| 612 | - <p><label for="min_'.$id.'">Min:</label> <input type="number" name="min[' . $id . ']" id="min_'.$id.'" value="' . ( ( isset($field['min']) ) ? htmlentities($field['min']) : '0' ) . '"></p> | |
| 659 | + <p><label for="min_'. esc_attr( $id ) .'">Min:</label> <input type="number" name="min[' . esc_attr( $id ) . ']" id="min_'. esc_attr( $id ) .'" value="' . ( ( isset($field['min']) ) ? esc_attr($field['min']) : '0' ) . '"></p> | |
| 613 | 660 | '; |
| 614 | 661 | |
| 615 | 662 | echo ' |
| 616 | - <p><label for="max_'.$id.'">Max:</label> <input type="number" name="max[' . $id . ']" id="max_'.$id.'" value="' . ( ( isset($field['max']) ) ? htmlentities($field['max']) : '' ) . '"></p> | |
| 663 | + <p><label for="max_'. esc_attr( $id ) .'">Max:</label> <input type="number" name="max[' . esc_attr( $id ) . ']" id="max_'. esc_attr( $id ) .'" value="' . ( ( isset($field['max']) ) ? esc_attr($field['max']) : '' ) . '"></p> | |
| 617 | 664 | '; |
| 618 | 665 | |
| 619 | 666 | echo ' |
| 620 | - <p><label for="step_'.$id.'">Step:</label> <input type="number" name="step[' . $id . ']" id="step_'.$id.'" value="' . ( ( isset($field['step']) ) ? htmlentities($field['step']) : '1' ) . '"></p> | |
| 667 | + <p><label for="step_'. esc_attr( $id ) .'">Step:</label> <input type="number" name="step[' . esc_attr( $id ) . ']" id="step_'. esc_attr( $id ) .'" value="' . ( ( isset($field['step']) ) ? esc_attr($field['step']) : '1' ) . '"></p> | |
| 621 | 668 | '; |
| 622 | 669 | } |
| 623 | 670 | |
| 624 | - if ( isset($field['type']) && in_array($field['type'], array('office')) ) | |
| 671 | + if ( | |
| 672 | + isset( $field['type'] ) && | |
| 673 | + in_array( $field['type'], array( 'office' ), true ) | |
| 674 | + ) | |
| 625 | 675 | { |
| 626 | 676 | echo ' |
| 627 | - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p> | |
| 677 | + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p> | |
| 628 | 678 | '; |
| 629 | 679 | } |
| 630 | 680 | |
| 631 | - if ( taxonomy_exists($id) || ( isset($field['custom_field']) && $field['custom_field'] === true && $field['type'] == 'select' ) ) | |
| 681 | + if ( | |
| 682 | + taxonomy_exists( $id ) || | |
| 683 | + ( | |
| 684 | + isset( $field['custom_field'] ) && | |
| 685 | + true === $field['custom_field'] && | |
| 686 | + isset( $field['type'] ) && | |
| 687 | + 'select' === $field['type'] | |
| 688 | + ) | |
| 689 | + ) | |
| 632 | 690 | { |
| 633 | 691 | echo ' |
| 634 | - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p> | |
| 692 | + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p> | |
| 635 | 693 | '; |
| 636 | 694 | |
| 637 | - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_multi_level_taxonomy_fields', array('property_type', 'commercial_property_type', 'location') ) ) ) | |
| 695 | + if ( | |
| 696 | + taxonomy_exists( $id ) && | |
| 697 | + in_array( | |
| 698 | + $id, | |
| 699 | + apply_filters( | |
| 700 | + 'propertyhive_template_assistant_multi_level_taxonomy_fields', | |
| 701 | + array( 'property_type', 'commercial_property_type', 'location' ) | |
| 702 | + ), | |
| 703 | + true | |
| 704 | + ) | |
| 705 | + ) | |
| 638 | 706 | { |
| 639 | 707 | echo ' |
| 640 | - <p><label for="parent_terms_only_'.$id.'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . $id . ']" id="parent_terms_only_'.$id.'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p> | |
| 708 | + <p><label for="parent_terms_only_'. esc_attr( $id ) .'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . esc_attr( $id ) . ']" id="parent_terms_only_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p> | |
| 641 | 709 | '; |
| 642 | 710 | |
| 643 | 711 | echo ' |
| 644 | - <p><label for="hide_empty_'.$id.'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . $id . ']" id="hide_empty_'.$id.'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p> | |
| 712 | + <p><label for="hide_empty_'. esc_attr( $id ) .'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . esc_attr( $id ) . ']" id="hide_empty_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p> | |
| 645 | 713 | '; |
| 646 | 714 | } |
| 647 | 715 | |
| 648 | - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_dynamic_population_taxonomy_fields', array('location') ) ) ) | |
| 716 | + if ( | |
| 717 | + taxonomy_exists( $id ) && | |
| 718 | + in_array( | |
| 719 | + $id, | |
| 720 | + apply_filters( | |
| 721 | + 'propertyhive_template_assistant_dynamic_population_taxonomy_fields', | |
| 722 | + array( 'location' ) | |
| 723 | + ), | |
| 724 | + true | |
| 725 | + ) | |
| 726 | + ) | |
| 649 | 727 | { |
| 650 | 728 | echo ' |
| 651 | - <p><label for="dynamic_population_'.$id.'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . $id . ']" id="dynamic_population_'.$id.'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p> | |
| 729 | + <p><label for="dynamic_population_'. esc_attr( $id ) .'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . esc_attr( $id ) . ']" id="dynamic_population_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p> | |
| 652 | 730 | '; |
| 653 | 731 | } |
| 654 | 732 | |
| 655 | 733 | echo ' |
| 656 | - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p> | |
| 734 | + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p> | |
| 657 | 735 | '; |
| 658 | 736 | } |
| 659 | 737 | |
| 660 | - if ( $id == 'office' ) | |
| 738 | + if ( 'office' === $id ) | |
| 661 | 739 | { |
| 662 | 740 | echo ' |
| 663 | - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p> | |
| 741 | + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p> | |
| 664 | 742 | '; |
| 665 | 743 | } |
| 666 | 744 | |
| 667 | - if ( isset($field['options']) && !taxonomy_exists($id) && ( !isset($field['custom_field']) || ( isset($field['custom_field']) && $field['custom_field'] === false ) ) ) | |
| 745 | + if ( | |
| 746 | + isset( $field['options'] ) && | |
| 747 | + ! taxonomy_exists( $id ) && | |
| 748 | + ( | |
| 749 | + ! isset( $field['custom_field'] ) || | |
| 750 | + false === $field['custom_field'] | |
| 751 | + ) | |
| 752 | + ) | |
| 668 | 753 | { |
| 669 | - echo '<p><label for="">Options: '; | |
| 754 | + echo '<p><label>Options: '; | |
| 670 | 755 | |
| 671 | - echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . $id . '">Add Option</a>'; | |
| 756 | + echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . esc_attr( $id ) . '">Add Option</a>'; | |
| 672 | 757 | |
| 673 | 758 | echo '</label><br>'; |
| 674 | 759 | |
| 675 | - echo '<span class="form-field-options" id="sortable_options_' . $id . '">'; | |
| 760 | + echo '<span class="form-field-options" id="sortable_options_' . esc_attr( $id ) . '">'; | |
| 676 | 761 | $i = 0; |
| 677 | 762 | foreach ( $field['options'] as $key => $value ) |
| 678 | 763 | { |
| 679 | 764 | echo '<span style="display:block"><i class="fa fa-reorder" style="cursor:pointer; opacity:0.3"></i> '; |
| 680 | - echo '<input type="text" name="option_keys[' . $id . '][]" value="' . $key . '">'; | |
| 681 | - echo '<input type="text" name="options_values[' . $id . '][]" value="' . $value . '">'; | |
| 765 | + echo '<input type="text" name="option_keys[' . esc_attr( $id ) . '][]" value="' . esc_attr( $key ) . '">'; | |
| 766 | + echo '<input type="text" name="options_values[' . esc_attr( $id ) . '][]" value="' . esc_attr( $value ) . '">'; | |
| 682 | 767 | echo '</span>'; |
| 768 | + } | |
| 683 | 769 | |
| 684 | - ++$i; | |
| 685 | - } | |
| 686 | 770 | echo '</span>'; |
| 687 | - | |
| 688 | 771 | echo '</p>'; |
| 689 | 772 | ?> |
| 690 | 773 | <script> |
| 691 | 774 | jQuery(document).ready(function($) |
| 692 | 775 | { |
| 693 | - $( "#sortable_options_<?php echo $id; ?>" ) | |
| 776 | + $( document.getElementById( <?php echo wp_json_encode( 'sortable_options_' . $id, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT ); ?> ) ) | |
| 694 | 777 | .sortable({ |
| 695 | 778 | axis: "y", |
| 696 | 779 | handle: "i", |
| 697 | 780 | stop: function( event, ui ) |
| @@ -711,10 +794,10 @@ | ||
| 711 | 794 | //$('#active_fields_order').val( fields_order.join("|") ); |
| 712 | 795 | } |
| 713 | 796 | }); |
| 714 | 797 | }); |
| 715 | - </script> | |
| 716 | -<?php | |
| 798 | + </script> | |
| 799 | + <?php | |
| 717 | 800 | } |
| 718 | 801 | |
| 719 | 802 | echo '</div> |
| 720 | 803 | </div>'; |
| @@ -739,9 +822,10 @@ | ||
| 739 | 822 | { |
| 740 | 823 | $current_settings['search_forms']['default'] = array(); |
| 741 | 824 | } |
| 742 | 825 | |
| 743 | - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] ); | |
| 826 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes. | |
| 827 | + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : ''; | |
| 744 | 828 | |
| 745 | 829 | $search_form_details = array(); |
| 746 | 830 | |
| 747 | 831 | if ($current_id != '') |
| @@ -1198,9 +1282,9 @@ | ||
| 1198 | 1282 | foreach ( $active_fields as $id => $field ) |
| 1199 | 1283 | { |
| 1200 | 1284 | $field_ids[] = $id; |
| 1201 | 1285 | } |
| 1202 | - echo implode("|", $field_ids); | |
| 1286 | + echo esc_attr( implode("|", $field_ids) ); | |
| 1203 | 1287 | ?>"> |
| 1204 | 1288 | <input type="hidden" name="inactive_fields_order" id="inactive_fields_order" value="<?php |
| 1205 | 1289 | $field_ids = array(); |
| 1206 | 1290 | foreach ( $inactive_fields as $id => $field ) |
| @@ -1206,9 +1290,9 @@ | ||
| 1206 | 1290 | foreach ( $inactive_fields as $id => $field ) |
| 1207 | 1291 | { |
| 1208 | 1292 | $field_ids[] = $id; |
| 1209 | 1293 | } |
| 1210 | - echo implode("|", $field_ids); | |
| 1294 | + echo esc_attr( implode("|", $field_ids) ); | |
| 1211 | 1295 | ?>"> |
| 1212 | 1296 | |
| 1213 | 1297 | <script> |
| 1214 | 1298 | jQuery(document).ready(function($) |
| @@ -1400,8 +1484,9 @@ | ||
| 1400 | 1484 | if ( $current_section ) |
| 1401 | 1485 | { |
| 1402 | 1486 | switch ($current_section) |
| 1403 | 1487 | { |
| 1488 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global. | |
| 1404 | 1489 | case "search-forms": { $hide_save_button = true; $settings = $this->get_search_forms_settings(); break; } |
| 1405 | 1490 | case "addsearchform": { $settings = $this->get_search_form_settings(); break; } |
| 1406 | 1491 | case "editsearchform": { $settings = $this->get_search_form_settings(); break; } |
| 1407 | 1492 | case "flags": { $settings = $this->get_flags_settings(); break; } |
| @@ -1420,8 +1505,12 @@ | ||
| 1420 | 1505 | * Save settings. |
| 1421 | 1506 | */ |
| 1422 | 1507 | public function save() |
| 1423 | 1508 | { |
| 1509 | + if ( ! current_user_can( 'manage_options' ) || ! isset( $_REQUEST['_wpnonce'] ) || ! is_string( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'propertyhive-settings' ) ) { | |
| 1510 | + return; | |
| 1511 | + } | |
| 1512 | + | |
| 1424 | 1513 | global $current_section; |
| 1425 | 1514 | |
| 1426 | 1515 | $current_settings = get_option( 'propertyhive_template_assistant', array() ); |
| 1427 | 1516 | |
| @@ -1430,14 +1519,26 @@ | ||
| 1430 | 1519 | switch ($current_section) |
| 1431 | 1520 | { |
| 1432 | 1521 | case "flags": |
| 1433 | 1522 | { |
| 1523 | + $flag_input = array(); | |
| 1524 | + foreach ( array( 'flags_active', 'flags_active_single', 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) { | |
| 1525 | + if ( isset( $_POST[$flag_key] ) && ! is_string( $_POST[$flag_key] ) ) { | |
| 1526 | + return; | |
| 1527 | + } | |
| 1528 | + $flag_input[$flag_key] = isset( $_POST[$flag_key] ) ? sanitize_text_field( wp_unslash( $_POST[$flag_key] ) ) : ''; | |
| 1529 | + } | |
| 1530 | + foreach ( array( 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) { | |
| 1531 | + if ( ! isset( $_POST[$flag_key] ) ) { | |
| 1532 | + return; | |
| 1533 | + } | |
| 1534 | + } | |
| 1434 | 1535 | $propertyhive_template_assistant = array( |
| 1435 | - 'flags_active' => ( ( isset($_POST['flags_active']) ) ? sanitize_text_field($_POST['flags_active']) : '' ), | |
| 1436 | - 'flags_active_single' => ( ( isset($_POST['flags_active_single']) ) ? sanitize_text_field($_POST['flags_active_single']) : '' ), | |
| 1437 | - 'flag_position' => sanitize_text_field($_POST['flag_position']), | |
| 1438 | - 'flag_bg_color' => sanitize_text_field($_POST['flag_bg_color']), | |
| 1439 | - 'flag_text_color' => sanitize_text_field($_POST['flag_text_color']), | |
| 1536 | + 'flags_active' => $flag_input['flags_active'], | |
| 1537 | + 'flags_active_single' => $flag_input['flags_active_single'], | |
| 1538 | + 'flag_position' => $flag_input['flag_position'], | |
| 1539 | + 'flag_bg_color' => $flag_input['flag_bg_color'], | |
| 1540 | + 'flag_text_color' => $flag_input['flag_text_color'], | |
| 1440 | 1541 | ); |
| 1441 | 1542 | |
| 1442 | 1543 | $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant); |
| 1443 | 1544 | |
| @@ -1446,9 +1547,9 @@ | ||
| 1446 | 1547 | } |
| 1447 | 1548 | case "addsearchform": |
| 1448 | 1549 | case "editsearchform": |
| 1449 | 1550 | { |
| 1450 | - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] ); | |
| 1551 | + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : ''; | |
| 1451 | 1552 | |
| 1452 | 1553 | $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() ); |
| 1453 | 1554 | |
| 1454 | 1555 | if ( $current_section == 'editsearchform' && $current_id != 'default' && !isset($existing_search_forms[$current_id]) ) |
| @@ -1460,9 +1561,32 @@ | ||
| 1460 | 1561 | { |
| 1461 | 1562 | unset($existing_search_forms[$current_id]); |
| 1462 | 1563 | } |
| 1463 | 1564 | |
| 1464 | - $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title($_POST['form_id'])) : $current_id ); | |
| 1565 | + $submitted_fields = array(); | |
| 1566 | + foreach ( array( 'show_label', 'label', 'type', 'before', 'after', 'placeholder', 'min', 'max', 'step', 'blank_option', 'parent_terms_only', 'dynamic_population', 'hide_empty', 'multiselect' ) as $input_key ) { | |
| 1567 | + if ( isset( $_POST[$input_key] ) && ! is_array( $_POST[$input_key] ) ) { | |
| 1568 | + return; | |
| 1569 | + } | |
| 1570 | + $submitted_fields[$input_key] = array(); | |
| 1571 | + if ( isset( $_POST[$input_key] ) ) { | |
| 1572 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use. | |
| 1573 | + foreach ( $_POST[$input_key] as $field_id => $value ) { | |
| 1574 | + if ( ! is_string( $value ) ) { | |
| 1575 | + return; | |
| 1576 | + } | |
| 1577 | + $value = wp_unslash( $value ); | |
| 1578 | + $submitted_fields[$input_key][$field_id] = in_array( $input_key, array( 'label', 'before', 'after' ), true ) ? wp_kses_post( $value ) : sanitize_text_field( $value ); | |
| 1579 | + } | |
| 1580 | + } | |
| 1581 | + } | |
| 1582 | + foreach ( array( 'form_id', 'active_fields_order', 'inactive_fields_order' ) as $input_key ) { | |
| 1583 | + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) { | |
| 1584 | + return; | |
| 1585 | + } | |
| 1586 | + } | |
| 1587 | + | |
| 1588 | + $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title( wp_unslash( $_POST['form_id'] ) )) : $current_id ); | |
| 1465 | 1589 | if ($current_section == 'addsearchform' && trim($current_id) == '' ) |
| 1466 | 1590 | { |
| 1467 | 1591 | $current_id = 'custom'; |
| 1468 | 1592 | } |
| @@ -1471,63 +1595,63 @@ | ||
| 1471 | 1595 | $inactive_fields = array(); |
| 1472 | 1596 | |
| 1473 | 1597 | if ( isset($_POST['active_fields_order']) && $_POST['active_fields_order'] != '' ) |
| 1474 | 1598 | { |
| 1475 | - $field_ids = explode("|", sanitize_text_field($_POST['active_fields_order'])); | |
| 1599 | + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['active_fields_order'] ) )); | |
| 1476 | 1600 | if ( !empty($field_ids) ) |
| 1477 | 1601 | { |
| 1478 | 1602 | foreach ( $field_ids as $field_id ) |
| 1479 | 1603 | { |
| 1480 | 1604 | $active_fields[$field_id] = array( |
| 1481 | - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ), | |
| 1482 | - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ), | |
| 1605 | + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ), | |
| 1606 | + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ), | |
| 1483 | 1607 | ); |
| 1484 | 1608 | |
| 1485 | - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' ) | |
| 1609 | + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' ) | |
| 1486 | 1610 | { |
| 1487 | - $active_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]); | |
| 1611 | + $active_fields[$field_id]['type'] = $submitted_fields['type'][$field_id]; | |
| 1488 | 1612 | } |
| 1489 | - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' ) | |
| 1613 | + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' ) | |
| 1490 | 1614 | { |
| 1491 | - $active_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]); | |
| 1615 | + $active_fields[$field_id]['before'] = $submitted_fields['before'][$field_id]; | |
| 1492 | 1616 | } |
| 1493 | - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' ) | |
| 1617 | + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' ) | |
| 1494 | 1618 | { |
| 1495 | - $active_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]); | |
| 1619 | + $active_fields[$field_id]['after'] = $submitted_fields['after'][$field_id]; | |
| 1496 | 1620 | } |
| 1497 | - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' ) | |
| 1621 | + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' ) | |
| 1498 | 1622 | { |
| 1499 | - $active_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]); | |
| 1623 | + $active_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id]; | |
| 1500 | 1624 | } |
| 1501 | - if ( isset($_POST['min'][$field_id]) && $_POST['min'][$field_id] != '' ) | |
| 1625 | + if ( isset($submitted_fields['min'][$field_id]) && $submitted_fields['min'][$field_id] != '' ) | |
| 1502 | 1626 | { |
| 1503 | - $active_fields[$field_id]['min'] = stripslashes($_POST['min'][$field_id]); | |
| 1627 | + $active_fields[$field_id]['min'] = $submitted_fields['min'][$field_id]; | |
| 1504 | 1628 | } |
| 1505 | - if ( isset($_POST['max'][$field_id]) && $_POST['max'][$field_id] != '' ) | |
| 1629 | + if ( isset($submitted_fields['max'][$field_id]) && $submitted_fields['max'][$field_id] != '' ) | |
| 1506 | 1630 | { |
| 1507 | - $active_fields[$field_id]['max'] = stripslashes($_POST['max'][$field_id]); | |
| 1631 | + $active_fields[$field_id]['max'] = $submitted_fields['max'][$field_id]; | |
| 1508 | 1632 | } |
| 1509 | - if ( isset($_POST['step'][$field_id]) && $_POST['step'][$field_id] != '' ) | |
| 1633 | + if ( isset($submitted_fields['step'][$field_id]) && $submitted_fields['step'][$field_id] != '' ) | |
| 1510 | 1634 | { |
| 1511 | - $active_fields[$field_id]['step'] = stripslashes($_POST['step'][$field_id]); | |
| 1635 | + $active_fields[$field_id]['step'] = $submitted_fields['step'][$field_id]; | |
| 1512 | 1636 | } |
| 1513 | - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' ) | |
| 1637 | + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' ) | |
| 1514 | 1638 | { |
| 1515 | - $active_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]); | |
| 1639 | + $active_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id]; | |
| 1516 | 1640 | } |
| 1517 | - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' ) | |
| 1641 | + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' ) | |
| 1518 | 1642 | { |
| 1519 | 1643 | $active_fields[$field_id]['parent_terms_only'] = true; |
| 1520 | 1644 | } |
| 1521 | - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' ) | |
| 1645 | + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' ) | |
| 1522 | 1646 | { |
| 1523 | 1647 | $active_fields[$field_id]['dynamic_population'] = true; |
| 1524 | 1648 | } |
| 1525 | - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' ) | |
| 1649 | + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' ) | |
| 1526 | 1650 | { |
| 1527 | 1651 | $active_fields[$field_id]['hide_empty'] = true; |
| 1528 | 1652 | } |
| 1529 | - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' ) | |
| 1653 | + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' ) | |
| 1530 | 1654 | { |
| 1531 | 1655 | $active_fields[$field_id]['multiselect'] = true; |
| 1532 | 1656 | } |
| 1533 | 1657 | |
| @@ -1533,11 +1657,15 @@ | ||
| 1533 | 1657 | |
| 1534 | 1658 | if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) ) |
| 1535 | 1659 | { |
| 1536 | 1660 | $options = array(); |
| 1661 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use. | |
| 1537 | 1662 | foreach ( $_POST['option_keys'][$field_id] as $i => $key ) |
| 1538 | 1663 | { |
| 1539 | - $options[$key] = $_POST['options_values'][$field_id][$i]; | |
| 1664 | + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) { | |
| 1665 | + return; | |
| 1666 | + } | |
| 1667 | + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) ); | |
| 1540 | 1668 | } |
| 1541 | 1669 | $active_fields[$field_id]['options'] = $options; |
| 1542 | 1670 | } |
| 1543 | 1671 | } |
| @@ -1545,51 +1673,51 @@ | ||
| 1545 | 1673 | } |
| 1546 | 1674 | |
| 1547 | 1675 | if ( isset($_POST['inactive_fields_order']) && $_POST['inactive_fields_order'] != '' ) |
| 1548 | 1676 | { |
| 1549 | - $field_ids = explode("|", sanitize_text_field($_POST['inactive_fields_order'])); | |
| 1677 | + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['inactive_fields_order'] ) )); | |
| 1550 | 1678 | if ( !empty($field_ids) ) |
| 1551 | 1679 | { |
| 1552 | 1680 | foreach ( $field_ids as $field_id ) |
| 1553 | 1681 | { |
| 1554 | 1682 | $inactive_fields[$field_id] = array( |
| 1555 | - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ), | |
| 1556 | - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ), | |
| 1683 | + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ), | |
| 1684 | + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ), | |
| 1557 | 1685 | ); |
| 1558 | 1686 | |
| 1559 | - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' ) | |
| 1687 | + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' ) | |
| 1560 | 1688 | { |
| 1561 | - $inactive_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]); | |
| 1689 | + $inactive_fields[$field_id]['type'] = $submitted_fields['type'][$field_id]; | |
| 1562 | 1690 | } |
| 1563 | - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' ) | |
| 1691 | + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' ) | |
| 1564 | 1692 | { |
| 1565 | - $inactive_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]); | |
| 1693 | + $inactive_fields[$field_id]['before'] = $submitted_fields['before'][$field_id]; | |
| 1566 | 1694 | } |
| 1567 | - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' ) | |
| 1695 | + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' ) | |
| 1568 | 1696 | { |
| 1569 | - $inactive_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]); | |
| 1697 | + $inactive_fields[$field_id]['after'] = $submitted_fields['after'][$field_id]; | |
| 1570 | 1698 | } |
| 1571 | - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' ) | |
| 1699 | + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' ) | |
| 1572 | 1700 | { |
| 1573 | - $inactive_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]); | |
| 1701 | + $inactive_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id]; | |
| 1574 | 1702 | } |
| 1575 | - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' ) | |
| 1703 | + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' ) | |
| 1576 | 1704 | { |
| 1577 | - $inactive_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]); | |
| 1705 | + $inactive_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id]; | |
| 1578 | 1706 | } |
| 1579 | - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' ) | |
| 1707 | + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' ) | |
| 1580 | 1708 | { |
| 1581 | 1709 | $inactive_fields[$field_id]['parent_terms_only'] = true; |
| 1582 | 1710 | } |
| 1583 | - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' ) | |
| 1711 | + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' ) | |
| 1584 | 1712 | { |
| 1585 | 1713 | $inactive_fields[$field_id]['dynamic_population'] = true; |
| 1586 | 1714 | } |
| 1587 | - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' ) | |
| 1715 | + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' ) | |
| 1588 | 1716 | { |
| 1589 | 1717 | $inactive_fields[$field_id]['hide_empty'] = true; |
| 1590 | 1718 | } |
| 1591 | - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' ) | |
| 1719 | + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' ) | |
| 1592 | 1720 | { |
| 1593 | 1721 | $inactive_fields[$field_id]['multiselect'] = true; |
| 1594 | 1722 | } |
| 1595 | 1723 | |
| @@ -1595,11 +1723,15 @@ | ||
| 1595 | 1723 | |
| 1596 | 1724 | if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) ) |
| 1597 | 1725 | { |
| 1598 | 1726 | $options = array(); |
| 1727 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use. | |
| 1599 | 1728 | foreach ( $_POST['option_keys'][$field_id] as $i => $key ) |
| 1600 | 1729 | { |
| 1601 | - $options[$key] = $_POST['options_values'][$field_id][$i]; | |
| 1730 | + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) { | |
| 1731 | + return; | |
| 1732 | + } | |
| 1733 | + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) ); | |
| 1602 | 1734 | } |
| 1603 | 1735 | $inactive_fields[$field_id]['options'] = $options; |
| 1604 | 1736 | } |
| 1605 | 1737 | } |
| @@ -1621,12 +1753,33 @@ | ||
| 1621 | 1753 | } |
| 1622 | 1754 | } |
| 1623 | 1755 | else |
| 1624 | 1756 | { |
| 1757 | + $frontend_input = array(); | |
| 1758 | + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_image_size', 'search_result_fields_custom_field', 'search_result_css' ) as $input_key ) { | |
| 1759 | + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) { | |
| 1760 | + return; | |
| 1761 | + } | |
| 1762 | + $frontend_input[$input_key] = isset( $_POST[$input_key] ) ? sanitize_text_field( wp_unslash( $_POST[$input_key] ) ) : ''; | |
| 1763 | + } | |
| 1764 | + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_css' ) as $input_key ) { | |
| 1765 | + if ( ! isset( $_POST[$input_key] ) ) { | |
| 1766 | + return; | |
| 1767 | + } | |
| 1768 | + } | |
| 1769 | + if ( isset( $_POST['search_result_fields'] ) && ! is_array( $_POST['search_result_fields'] ) ) { | |
| 1770 | + return; | |
| 1771 | + } | |
| 1625 | 1772 | $search_results_fields = array(); |
| 1626 | 1773 | if ( isset($_POST['search_result_fields']) && is_array($_POST['search_result_fields']) ) |
| 1627 | 1774 | { |
| 1628 | - $search_results_fields = $_POST['search_result_fields']; | |
| 1775 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use. | |
| 1776 | + foreach ( $_POST['search_result_fields'] as $search_result_field ) { | |
| 1777 | + if ( ! is_string( $search_result_field ) ) { | |
| 1778 | + return; | |
| 1779 | + } | |
| 1780 | + $search_results_fields[] = sanitize_text_field( wp_unslash( $search_result_field ) ); | |
| 1781 | + } | |
| 1629 | 1782 | |
| 1630 | 1783 | $new_search_results_fields = array(); |
| 1631 | 1784 | foreach ( $search_results_fields as $search_results_field ) |
| 1632 | 1785 | { |
| @@ -1633,9 +1786,9 @@ | ||
| 1633 | 1786 | if ( $search_results_field == 'custom_field' ) |
| 1634 | 1787 | { |
| 1635 | 1788 | if ( isset($_POST['search_result_fields_custom_field']) && $_POST['search_result_fields_custom_field'] != '' ) |
| 1636 | 1789 | { |
| 1637 | - $new_search_results_fields[] = ph_clean($_POST['search_result_fields_custom_field']); | |
| 1790 | + $new_search_results_fields[] = $frontend_input['search_result_fields_custom_field']; | |
| 1638 | 1791 | } |
| 1639 | 1792 | } |
| 1640 | 1793 | else |
| 1641 | 1794 | { |
| @@ -1646,14 +1799,15 @@ | ||
| 1646 | 1799 | $search_results_fields = $new_search_results_fields; |
| 1647 | 1800 | } |
| 1648 | 1801 | |
| 1649 | 1802 | $propertyhive_template_assistant = array( |
| 1650 | - 'search_result_default_order' => ph_clean($_POST['search_result_default_order']), | |
| 1651 | - 'search_result_columns' => (int)$_POST['search_result_columns'], | |
| 1652 | - 'search_result_layout' => (int)$_POST['search_result_layout'], | |
| 1803 | + 'search_result_default_order' => $frontend_input['search_result_default_order'], | |
| 1804 | + 'search_result_columns' => (int)$frontend_input['search_result_columns'], | |
| 1805 | + 'search_result_layout' => (int)$frontend_input['search_result_layout'], | |
| 1653 | 1806 | 'search_result_fields' => $search_results_fields, |
| 1654 | - 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? ph_clean($_POST['search_result_image_size']) : 'medium' ), | |
| 1655 | - 'search_result_css' => wp_unslash($_POST['search_result_css']), | |
| 1807 | + 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? $frontend_input['search_result_image_size'] : 'medium' ), | |
| 1808 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Administrator-authored CSS is intentionally preserved; the type is validated above and its stylesheet output protects the closing style boundary. | |
| 1809 | + 'search_result_css' => isset( $_POST['search_result_css'] ) ? wp_unslash($_POST['search_result_css']) : '', | |
| 1656 | 1810 | 'search_result_css_all_pages' => isset($_POST['search_result_css_all_pages']) ? 'yes' : '', |
| 1657 | 1811 | ); |
| 1658 | 1812 | |
| 1659 | 1813 | $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant); |