← All changes | includes/avada-widgets/property-reference-number-shortcode.php +10 -3 2.2.5 → 2.3.1 View file →

		@@ -1,6 +1,11 @@
1	1	<?php
2	2
	3	+if ( ! defined( 'ABSPATH' ) ) {
	4	+ exit;
	5	+}
	6	+
	7	+
3	8	add_shortcode( 'avada_property_reference_number', function( $atts ) {
4	9	$atts = shortcode_atts( array(
5	10	'content_align' => 'left',
6	11	'fusion_font_family_reference_number_font' => '',
		@@ -25,8 +30,9 @@
25	30	global $property;
26	31
27	32	if ( empty($property) )
28	33	{
	34	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared frontend property global used by the Avada shortcode contract; changing $property would break the existing property context passed to these widgets.
29	35	$property = new PH_Property(get_the_ID());
30	36	}
31	37
32	38	if ( $property->reference_number == '' )
		@@ -53,10 +59,11 @@
53	59	}
54	60
55	61	ob_start();
56	62
	63	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- FusionBuilder::attributes() returns the complete HTML attribute fragment and escapes each attribute name and value.
57	64	echo '<div ' . FusionBuilder::attributes( 'property-reference-number-shortcode' ) . '>
58		- <div style="' . $style . '">';
	65	+ <div style="' . esc_attr( safecss_filter_attr( $style ) ) . '">';
59	66
60	67	if ( ! empty($atts['icon']) )
61	68	{
62	69	echo '<span class="' . esc_attr($atts['icon']) . '"></span> ';
		@@ -63,14 +70,14 @@
63	70	}
64	71
65	72	if ( isset($atts['before']) && !empty($atts['before']) )
66	73	{
67		- echo $atts['before'] . ' ';
	74	+ echo wp_kses_post( $atts['before'] ) . ' ';
68	75	}
69	76	echo esc_html($property->reference_number);
70	77	if ( isset($atts['after']) && !empty($atts['after']) )
71	78	{
72		- echo ' ' . $atts['after'];
	79	+ echo ' ' . wp_kses_post( $atts['after'] );
73	80	}
74	81	echo '
75	82	</div>
76	83	</div>';