← All changes | includes/admin/views/html-admin-page-reports.php +14 -3 2.2.4 → 2.3.1 View file →

		@@ -10,10 +10,11 @@
10	10	?>
11	11	<div class="wrap propertyhive">
12	12	<nav class="nav-tab-wrapper">
13	13	<?php
	14	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
14	15	foreach ( $reports as $key => $report_group ) {
15		- echo '<a href="' . admin_url( 'admin.php?page=ph-reports&tab=' . urlencode( $key ) ) . '" class="nav-tab ';
	16	+ echo '<a href="' . esc_url( admin_url( 'admin.php?page=ph-reports&tab=' . urlencode( $key ) ) ) . '" class="nav-tab ';
16	17	if ( $current_tab == $key ) {
17	18	echo 'nav-tab-active';
18	19	}
19	20	echo '">' . esc_html( $report_group[ 'title' ] ) . '</a>';
		@@ -18,8 +19,9 @@
18	19	}
19	20	echo '">' . esc_html( $report_group[ 'title' ] ) . '</a>';
20	21	}
21	22
	23	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook ph_reports_tabs; changing the established name would detach installed callbacks.
22	24	do_action( 'ph_reports_tabs' );
23	25	?>
24	26	</nav>
25	27	<?php //if ( sizeof( $reports[ $current_tab ]['reports'] ) > 1 ) {
		@@ -26,24 +28,31 @@
26	28	?>
27	29	<ul class="subsubsub">
28	30	<li><?php
29	31
	32	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
30	33	$links = array();
31	34
	35	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
32	36	foreach ( $reports[ $current_tab ]['reports'] as $key => $report ) {
33	37
34		- $link = '<a href="admin.php?page=ph-reports&tab=' . urlencode( $current_tab ) . '&amp;report=' . urlencode( $key ) . '" class="';
	38	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup.
	39	+ $link = '<a href="' . esc_url( 'admin.php?page=ph-reports&tab=' . urlencode( $current_tab ) . '&report=' . urlencode( $key ) ) . '" class="';
35	40
36	41	if ( $key == $current_report ) {
	42	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup.
37	43	$link .= 'current';
38	44	}
39	45
40		- $link .= '">' . $report['title'] . '</a>';
	46	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local report navigation markup.
	47	+ $link .= '">' . esc_html( $report['title'] ) . '</a>';
41	48
	49	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
42	50	$links[] = $link;
43	51
44	52	}
45	53
	54	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Locally assembled navigation links: URLs and titles are escaped above; class values and separators are fixed markup.
46	55	echo implode( ' | </li><li>', $links );
47	56
48	57	?></li>
49	58	</ul>
		@@ -52,8 +61,9 @@
52	61	//}
53	62
54	63	if ( isset( $reports[ $current_tab ][ 'reports' ][ $current_report ] ) ) {
55	64
	65	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope.
56	66	$report = $reports[ $current_tab ][ 'reports' ][ $current_report ];
57	67
58	68	if ( ! isset( $report['hide_title'] ) || $report['hide_title'] != true ) {
59	69	echo '<h1>' . esc_html( $report['title'] ) . '</h1>';
		@@ -61,8 +71,9 @@
61	71	echo '<h1 class="screen-reader-text">' . esc_html( $report['title'] ) . '</h1>';
62	72	}
63	73
64	74	if ( $report['description'] ) {
	75	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Trusted HTML from PHP report registrations via propertyhive_admin_reports (core descriptions are empty). Extension callbacks own escaping of dynamic values in their descriptions.
65	76	echo '<p>' . $report['description'] . '</p>';
66	77	}
67	78
68	79	if ( $report['callback'] && ( is_callable( $report['callback'] ) ) ) {