← All changes
|
includes/admin/settings/class-ph-settings-features.php
+11
-9
2.2.6
→
2.3.1
View file →
| @@ -16,8 +16,9 @@ | ||
| 16 | 16 | |
| 17 | 17 | /** |
| 18 | 18 | * PH_Settings_Features |
| 19 | 19 | */ |
| 20 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Settings_Features; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 20 | 21 | class PH_Settings_Features extends PH_Settings_Page { |
| 21 | 22 | |
| 22 | 23 | /** |
| 23 | 24 | * Constructor. |
| @@ -64,13 +65,12 @@ | ||
| 64 | 65 | 'data-bridges' => 'Data Bridges', |
| 65 | 66 | 'free' => 'Free', |
| 66 | 67 | ); |
| 67 | 68 | |
| 68 | - $selected_category = ''; | |
| 69 | - if ( isset($_GET['profilter']) && array_key_exists(sanitize_text_field($_GET['profilter']), $categories) ) | |
| 70 | - { | |
| 71 | - $selected_category = sanitize_text_field($_GET['profilter']); | |
| 72 | - } | |
| 69 | + // Read-only category selection: no settings are changed by this query parameter. | |
| 70 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Publicly linkable display filter only; no state mutation. | |
| 71 | + $requested_category = isset( $_GET['profilter'] ) && is_string( $_GET['profilter'] ) ? sanitize_text_field( wp_unslash( $_GET['profilter'] ) ) : ''; | |
| 72 | + $selected_category = array_key_exists( $requested_category, $categories ) ? $requested_category : ''; | |
| 73 | 73 | |
| 74 | 74 | echo '<div class="pro-filters">'; |
| 75 | 75 | echo '<ul>'; |
| 76 | 76 | $i = 0; |
| @@ -129,9 +129,9 @@ | ||
| 129 | 129 | $links[] = '<a href="https://ai-property-search.com/?src=plugin-feature-settings" target="_blank" style="text-decoration:none; color:#FFF;">' . esc_html(__( 'More Info', 'propertyhive' )) . '</a>'; |
| 130 | 130 | |
| 131 | 131 | |
| 132 | 132 | echo '<div style="float:right; padding-top:6px;">'; |
| 133 | - echo implode(" | ", $links); | |
| 133 | + echo wp_kses_post( implode( " | ", $links ) ); | |
| 134 | 134 | echo '</div>'; |
| 135 | 135 | |
| 136 | 136 | echo '<label class="switch"> |
| 137 | 137 | <input type="checkbox" name="" disabled value=""> |
| @@ -155,8 +155,9 @@ | ||
| 155 | 155 | echo esc_attr(implode(" ", $feature['categories'])); |
| 156 | 156 | } |
| 157 | 157 | |
| 158 | 158 | $pro = false; |
| 159 | + $can_use = true; | |
| 159 | 160 | |
| 160 | 161 | echo '"> |
| 161 | 162 | <div class="inner"' . ( !$can_use ? ' style="border:1px solid #900"' : '' ) . '> |
| 162 | 163 | <h3>' . ( ( isset($feature['dashicon']) && !empty($feature['dashicon']) ) ? '<span class="dashicons ' . esc_attr($feature['dashicon']) . '"></span> ' : '' ) . esc_html($feature['name']) . '</h3> |
| @@ -166,9 +167,9 @@ | ||
| 166 | 167 | $links = array(); |
| 167 | 168 | $links[] = 'This feature has moved. <a href="https://wp-property-hive.com/template-assistant-is-now-part-of-property-hive-core-plugin?src=plugin-feature-settings" target="_blank" style="text-decoration:none">' . esc_html(__( 'Read More', 'propertyhive' )) . '</a>'; |
| 168 | 169 | |
| 169 | 170 | echo '<div style="float:right; padding-top:6px;">'; |
| 170 | - echo implode(" | ", $links); | |
| 171 | + echo wp_kses_post( implode( " | ", $links ) ); | |
| 171 | 172 | echo '</div>'; |
| 172 | 173 | |
| 173 | 174 | echo '<label class="switch"> |
| 174 | 175 | <input type="checkbox" name="" disabled value=""> |
| @@ -200,9 +201,9 @@ | ||
| 200 | 201 | echo esc_attr(implode(" ", $feature['categories'])); |
| 201 | 202 | } |
| 202 | 203 | |
| 203 | 204 | $pro = false; |
| 204 | - $plans = (isset($feature['plans']) & is_array($feature['plans'])) ? $feature['plans'] : array(); | |
| 205 | + $plans = (isset($feature['plans']) && is_array($feature['plans'])) ? $feature['plans'] : array(); | |
| 205 | 206 | if ( !in_array('free', $plans) ) |
| 206 | 207 | { |
| 207 | 208 | $pro = true; |
| 208 | 209 | } |
| @@ -247,9 +248,9 @@ | ||
| 247 | 248 | } |
| 248 | 249 | } |
| 249 | 250 | |
| 250 | 251 | echo '<div style="float:right; padding-top:6px;">'; |
| 251 | - echo implode(" | ", $links); | |
| 252 | + echo wp_kses_post( implode( " | ", $links ) ); | |
| 252 | 253 | echo '</div>'; |
| 253 | 254 | |
| 254 | 255 | echo '<label class="switch"> |
| 255 | 256 | <input type="checkbox" name="active_plugins[]" value="' . esc_attr($slug) . '"' . ( $feature_status == 'active' ? ' checked' : '' ) . '> |
| @@ -278,8 +279,9 @@ | ||
| 278 | 279 | */ |
| 279 | 280 | public function output() { |
| 280 | 281 | global $current_section, $hide_save_button; |
| 281 | 282 | |
| 283 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global. | |
| 282 | 284 | $hide_save_button = true; |
| 283 | 285 | $settings = $this->get_settings(); |
| 284 | 286 | |
| 285 | 287 | PH_Admin_Settings::output_fields( $settings ); |