| @@ -1,6 +1,11 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 4 | + exit; | |
| 5 | +} | |
| 6 | + | |
| 7 | + | |
| 3 | 8 | add_shortcode( 'avada_property_meta', function( $atts ) { |
| 4 | 9 | $atts = shortcode_atts( array( |
| 5 | 10 | 'content_align' => 'left', |
| 6 | 11 | 'fusion_font_family_meta_font' => '', |
| @@ -22,8 +27,9 @@ | ||
| 22 | 27 | global $property; |
| 23 | 28 | |
| 24 | 29 | if ( empty($property) ) |
| 25 | 30 | { |
| 31 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared frontend property global used by the Avada shortcode contract; changing $property would break the existing property context passed to these widgets. | |
| 26 | 32 | $property = new PH_Property(get_the_ID()); |
| 27 | 33 | } |
| 28 | 34 | |
| 29 | 35 | $style = Fusion_Builder_Element_Helper::get_font_styling( $atts, 'meta_font' ); |
| @@ -45,10 +51,11 @@ | ||
| 45 | 51 | } |
| 46 | 52 | |
| 47 | 53 | ob_start(); |
| 48 | 54 | |
| 55 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- FusionBuilder::attributes() returns the complete HTML attribute fragment and escapes each attribute name and value. | |
| 49 | 56 | echo '<div ' . FusionBuilder::attributes( 'property-meta-shortcode' ) . '> |
| 50 | - <div style="' . $style . '">'; | |
| 57 | + <div style="' . esc_attr( safecss_filter_attr( $style ) ) . '">'; | |
| 51 | 58 | propertyhive_template_single_meta(); |
| 52 | 59 | echo ' |
| 53 | 60 | </div> |
| 54 | 61 | </div>'; |
