| @@ -12,8 +12,9 @@ | ||
| 12 | 12 | * @package PropertyHive/Classes |
| 13 | 13 | * @category Class |
| 14 | 14 | * @author PropertyHive |
| 15 | 15 | */ |
| 16 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Sale; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 16 | 17 | class PH_Sale { |
| 17 | 18 | |
| 18 | 19 | /** @public int Sale (post) ID */ |
| 19 | 20 | public $id; |
| @@ -124,9 +125,9 @@ | ||
| 124 | 125 | { |
| 125 | 126 | $applicants = array(); |
| 126 | 127 | foreach ( $applicant_contact_ids as $applicant_contact_id ) |
| 127 | 128 | { |
| 128 | - $applicant_name = get_the_title($applicant_contact_id); | |
| 129 | + $applicant_name = esc_html( get_the_title( $applicant_contact_id ) ); | |
| 129 | 130 | if ( $add_hyperlinks ) |
| 130 | 131 | { |
| 131 | 132 | $edit_link = get_edit_post_link( $applicant_contact_id ); |
| 132 | 133 | $applicant_name = '<a href="' . esc_url( $edit_link ) . '">' . $applicant_name . '</a>'; |
| @@ -136,15 +137,15 @@ | ||
| 136 | 137 | $contact_details = array(); |
| 137 | 138 | $telephone_number = get_post_meta( $applicant_contact_id, '_telephone_number', true ); |
| 138 | 139 | if( !empty($telephone_number) ) |
| 139 | 140 | { |
| 140 | - $contact_details[] = 'T: ' . $telephone_number; | |
| 141 | + $contact_details[] = 'T: ' . esc_html( $telephone_number ); | |
| 141 | 142 | } |
| 142 | 143 | |
| 143 | 144 | $email_address = get_post_meta( $applicant_contact_id, '_email_address', true ); |
| 144 | 145 | if( !empty($email_address) ) |
| 145 | 146 | { |
| 146 | - $contact_details[] = 'E: ' . $email_address; | |
| 147 | + $contact_details[] = 'E: ' . esc_html( $email_address ); | |
| 147 | 148 | } |
| 148 | 149 | |
| 149 | 150 | $contact_details = apply_filters( 'propertyhive_sale_applicant_contact_details', $contact_details, $applicant_contact_id ); |
| 150 | 151 | |
| @@ -175,9 +176,9 @@ | ||
| 175 | 176 | |
| 176 | 177 | if ( !empty($property_id) ) |
| 177 | 178 | { |
| 178 | 179 | $property = new PH_Property( $property_id ); |
| 179 | - return '<a href="' . get_edit_post_link( $property_id, '' ) . '" target="' . apply_filters('propertyhive_subgrid_link_target', '') . '">' . $property->get_formatted_full_address() . '</a>'; | |
| 180 | + return '<a href="' . esc_url( get_edit_post_link( $property_id, '' ) ) . '" target="' . esc_attr( apply_filters('propertyhive_subgrid_link_target', '') ) . '">' . esc_html( $property->get_formatted_full_address() ) . '</a>'; | |
| 180 | 181 | } |
| 181 | 182 | else |
| 182 | 183 | { |
| 183 | 184 | return '-'; |
| @@ -229,19 +230,20 @@ | ||
| 229 | 230 | private function formatted_contact_meta_box_data( $contact_post_id, $add_edit_link = true ) |
| 230 | 231 | { |
| 231 | 232 | if ( $add_edit_link ) |
| 232 | 233 | { |
| 233 | - $contact_text = '<a href="' . get_edit_post_link( $contact_post_id, '' ) . '" target="' . apply_filters('propertyhive_subgrid_link_target', '') . '">' . get_the_title($contact_post_id) . '</a>'; | |
| 234 | + $contact_text = '<a href="' . esc_url( get_edit_post_link( $contact_post_id, '' ) ) . '" target="' . esc_attr( apply_filters('propertyhive_subgrid_link_target', '') ) . '">' . esc_html( get_the_title($contact_post_id) ) . '</a>'; | |
| 234 | 235 | } |
| 235 | 236 | else |
| 236 | 237 | { |
| 237 | - $contact_text = get_the_title($contact_post_id); | |
| 238 | + $contact_text = esc_html( get_the_title($contact_post_id) ); | |
| 238 | 239 | } |
| 239 | 240 | |
| 241 | + $contact_details = ''; | |
| 240 | 242 | $telephone_number = get_post_meta( $contact_post_id, '_telephone_number', true ); |
| 241 | 243 | if( !empty($telephone_number) ) |
| 242 | 244 | { |
| 243 | - $contact_details = 'T: ' . $telephone_number; | |
| 245 | + $contact_details = 'T: ' . esc_html($telephone_number); | |
| 244 | 246 | } |
| 245 | 247 | |
| 246 | 248 | $email_address = get_post_meta( $contact_post_id, '_email_address', true ); |
| 247 | 249 | if( !empty($email_address) ) |
| @@ -246,9 +248,9 @@ | ||
| 246 | 248 | $email_address = get_post_meta( $contact_post_id, '_email_address', true ); |
| 247 | 249 | if( !empty($email_address) ) |
| 248 | 250 | { |
| 249 | 251 | $contact_details .= ( $contact_details != '' ) ? '<br>' : ''; |
| 250 | - $contact_details .= 'E: ' . $email_address; | |
| 252 | + $contact_details .= 'E: ' . esc_html($email_address); | |
| 251 | 253 | } |
| 252 | 254 | |
| 253 | 255 | if ( $contact_details != '' ) |
| 254 | 256 | { |
