PluginProbe
Property Hive / 2.3.1
Property Hive v2.3.1
2.3.1 2.3.0 2.2.6 2.2.5 2.2.4 2.2.3 2.2.2 1.4.46 1.4.47 1.4.48 1.4.49 1.4.5 1.4.50 1.4.51 1.4.52 1.4.53 1.4.54 1.4.55 1.4.56 1.4.57 1.4.58 1.4.59 1.4.6 1.4.60 1.4.61 All 261 releases
← All changes | includes/admin/settings/class-ph-settings-frontend.php +230 -109 2.2.6 → 2.3.1 View file →
@@ -1,5 +1,8 @@
1 1 <?php
2 +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
3 +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
4 +
2 5 /**
3 6 * PropertyHive Frontend Settings
4 7 *
5 8 * @author PropertyHive
@@ -16,8 +19,9 @@
16 19
17 20 /**
18 21 * PH_Settings_Frontend.
19 22 */
23 +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Settings_Frontend; preserving the existing PH_* class name is required for plugin and extension compatibility.
20 24 class PH_Settings_Frontend extends PH_Settings_Page {
21 25
22 26 /**
23 27 * Constructor.
@@ -39,20 +43,21 @@
39 43 }
40 44
41 45 public function check_for_reset_search_form()
42 46 {
43 - if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && $_GET['id'] != '' )
47 + if ( isset($_GET['action']) && $_GET['action'] == 'resetsearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' )
44 48 {
45 49 if ( ! current_user_can( 'manage_options' ) )
46 50 {
47 - wp_die( __( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
51 + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
48 52 }
49 53
50 - check_admin_referer( 'ph_reset_search_form_' . $_GET['id'] );
54 + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) );
55 + check_admin_referer( 'ph_reset_search_form_' . $request_id );
51 56
52 57 $current_settings = get_option( 'propertyhive_template_assistant', array() );
53 58
54 - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] );
59 + $current_id = sanitize_title( $request_id );
55 60
56 61 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
57 62
58 63 if ( !isset($existing_search_forms[$current_id]) )
@@ -72,20 +77,21 @@
72 77 }
73 78
74 79 public function check_for_delete_search_form()
75 80 {
76 - if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' )
81 + if ( isset($_GET['action']) && $_GET['action'] == 'deletesearchform' && isset($_GET['id']) && is_string($_GET['id']) && $_GET['id'] != '' && $_GET['id'] != 'default' )
77 82 {
78 83 if ( ! current_user_can( 'manage_options' ) )
79 84 {
80 - wp_die( __( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
85 + wp_die( esc_html__( 'Sorry, you are not allowed to do this.', 'propertyhive' ) );
81 86 }
82 87
83 - check_admin_referer( 'ph_delete_search_form_' . $_GET['id'] );
88 + $request_id = sanitize_text_field( wp_unslash( $_GET['id'] ) );
89 + check_admin_referer( 'ph_delete_search_form_' . $request_id );
84 90
85 91 $current_settings = get_option( 'propertyhive_template_assistant', array() );
86 92
87 - $current_id = ( !isset( $_GET['id'] ) ) ? '' : sanitize_title( $_GET['id'] );
93 + $current_id = sanitize_title( $request_id );
88 94
89 95 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
90 96
91 97 if ( !isset($existing_search_forms[$current_id]) )
@@ -454,9 +460,10 @@
454 460 {
455 461 $current_settings['search_forms']['default'] = array();
456 462 }
457 463
458 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
464 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes.
465 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
459 466
460 467 $search_form_details = array();
461 468
462 469 if ($current_id != '')
@@ -474,9 +481,9 @@
474 481 }
475 482
476 483 $settings = array(
477 484
478 - array( 'title' => __( ( $current_section == 'addsearchform' ? 'Add Search Form' : 'Edit Search Form' ), 'propertyhive' ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ),
485 + array( 'title' => ( $current_section == 'addsearchform' ? __( 'Add Search Form', 'propertyhive' ) : __( 'Edit Search Form', 'propertyhive' ) ), 'type' => 'title', 'desc' => '', 'id' => 'searchforms' ),
479 486
480 487 );
481 488
482 489 $custom_attributes = array();
@@ -607,124 +614,167 @@
607 614
608 615 private function output_search_form_field( $id, $field )
609 616 {
610 617 echo '
611 - <div class="group" id="' . $id . '">
612 - <h3>' . trim( $id, '_' ) . '</h3>
618 + <div class="group" id="' . esc_attr( $id ) . '">
619 + <h3>' . esc_html( trim( $id, '_' ) ) . '</h3>
613 620 <div>';
614 - if ( $id == 'department' )
621 +
622 + if ( 'department' === $id )
615 623 {
616 - echo '<p><label for="type_'.$id.'">Type:</label> <select name="type[' . $id . ']" id="type_'.$id.'">
624 + echo '<p><label for="type_'. esc_attr( $id ) .'">Type:</label> <select name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'">
617 625 <option value="radio"' . ( ( !isset($field['type']) || ( isset($field['type']) && $field['type'] == 'radio' ) ) ? ' selected' : '' ) . '>Radio Buttons</option>
618 626 <option value="select"' . ( ( isset($field['type']) && $field['type'] == 'select' ) ? ' selected' : '' ) . '>Dropdown</option>
619 - ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . $field['type'] . '" selected>' . $field['type'] . '</option>' : '' ) . '
627 + ' . ( ( isset($field['type']) && $field['type'] != 'select' && $field['type'] != 'radio' ) ? '<option value="' . esc_attr( $field['type'] ) . '" selected>' . esc_attr( $field['type'] ) . '</option>' : '' ) . '
620 628 </select></p>';
621 629 }
622 630 else
623 631 {
624 - echo '<input type="hidden" name="type[' . $id . ']" id="type_'.$id.'" value="' . ( ( isset($field['type']) ) ? $field['type'] : '' ) . '">';
632 + echo '<input type="hidden" name="type[' . esc_attr( $id ) . ']" id="type_'. esc_attr( $id ) .'" value="' . ( ( isset($field['type']) ) ? esc_attr( $field['type'] ) : '' ) . '">';
625 633 }
626 634
627 - echo ' <p><label for="show_label_'.$id.'">Show Label:</label> <input type="checkbox" name="show_label[' . $id . ']" id="show_label_'.$id.'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p>
635 + echo ' <p><label for="show_label_'. esc_attr( $id ) .'">Show Label:</label> <input type="checkbox" name="show_label[' . esc_attr( $id ) . ']" id="show_label_'. esc_attr( $id ) .'" value="1"' . ( ( isset($field['show_label']) && $field['show_label'] === true ) ? ' checked' : '' ) . '></p>
628 636
629 - <p><label for="label_'.$id.'">Label:</label> <input type="text" name="label[' . $id . ']" id="label_'.$id.'" value="' . ( ( isset($field['label']) ) ? $field['label'] : '' ) . '"></p>
637 + <p><label for="label_'. esc_attr( $id ) .'">Label:</label> <input type="text" name="label[' . esc_attr( $id ) . ']" id="label_'. esc_attr( $id ) .'" value="' . ( ( isset($field['label']) ) ? esc_attr( $field['label'] ) : '' ) . '"></p>
630 638
631 - <p><label for="before_'.$id.'">Before:</label> <input type="text" name="before[' . $id . ']" id="before_'.$id.'" value="' . ( ( isset($field['before']) ) ? htmlentities($field['before']) : '' ) . '"></p>
639 + <p><label for="before_'. esc_attr( $id ) .'">Before:</label> <input type="text" name="before[' . esc_attr( $id ) . ']" id="before_'. esc_attr( $id ) .'" value="' . ( ( isset($field['before']) ) ? esc_attr($field['before']) : '' ) . '"></p>
632 640
633 - <p><label for="after_'.$id.'">After:</label> <input type="text" name="after[' . $id . ']" id="after_'.$id.'" value="' . ( ( isset($field['after']) ) ? htmlentities($field['after']) : '' ) . '"></p>';
641 + <p><label for="after_'. esc_attr( $id ) .'">After:</label> <input type="text" name="after[' . esc_attr( $id ) . ']" id="after_'. esc_attr( $id ) .'" value="' . ( ( isset($field['after']) ) ? esc_attr($field['after']) : '' ) . '"></p>';
634 642
635 - if ( isset($field['type']) && in_array($field['type'], array('text', 'email', 'date', 'number', 'password')) )
643 + if (
644 + isset( $field['type'] ) &&
645 + in_array( $field['type'], array( 'text', 'email', 'date', 'number', 'password' ), true )
646 + )
636 647 {
637 648 echo '
638 - <p><label for="placeholder_'.$id.'">Placeholder:</label> <input type="text" name="placeholder[' . $id . ']" id="placeholder_'.$id.'" value="' . ( ( isset($field['placeholder']) ) ? htmlentities($field['placeholder']) : '' ) . '"></p>
649 + <p><label for="placeholder_'. esc_attr( $id ) .'">Placeholder:</label> <input type="text" name="placeholder[' . esc_attr( $id ) . ']" id="placeholder_'. esc_attr( $id ) .'" value="' . ( ( isset($field['placeholder']) ) ? esc_attr($field['placeholder']) : '' ) . '"></p>
639 650 ';
640 651 }
641 652
642 - if ( isset($field['type']) && in_array($field['type'], array('slider')) )
653 + if (
654 + isset( $field['type'] ) &&
655 + in_array( $field['type'], array( 'slider' ), true )
656 + )
643 657 {
644 658 echo '
645 - <p><label for="min_'.$id.'">Min:</label> <input type="number" name="min[' . $id . ']" id="min_'.$id.'" value="' . ( ( isset($field['min']) ) ? htmlentities($field['min']) : '0' ) . '"></p>
659 + <p><label for="min_'. esc_attr( $id ) .'">Min:</label> <input type="number" name="min[' . esc_attr( $id ) . ']" id="min_'. esc_attr( $id ) .'" value="' . ( ( isset($field['min']) ) ? esc_attr($field['min']) : '0' ) . '"></p>
646 660 ';
647 661
648 662 echo '
649 - <p><label for="max_'.$id.'">Max:</label> <input type="number" name="max[' . $id . ']" id="max_'.$id.'" value="' . ( ( isset($field['max']) ) ? htmlentities($field['max']) : '' ) . '"></p>
663 + <p><label for="max_'. esc_attr( $id ) .'">Max:</label> <input type="number" name="max[' . esc_attr( $id ) . ']" id="max_'. esc_attr( $id ) .'" value="' . ( ( isset($field['max']) ) ? esc_attr($field['max']) : '' ) . '"></p>
650 664 ';
651 665
652 666 echo '
653 - <p><label for="step_'.$id.'">Step:</label> <input type="number" name="step[' . $id . ']" id="step_'.$id.'" value="' . ( ( isset($field['step']) ) ? htmlentities($field['step']) : '1' ) . '"></p>
667 + <p><label for="step_'. esc_attr( $id ) .'">Step:</label> <input type="number" name="step[' . esc_attr( $id ) . ']" id="step_'. esc_attr( $id ) .'" value="' . ( ( isset($field['step']) ) ? esc_attr($field['step']) : '1' ) . '"></p>
654 668 ';
655 669 }
656 670
657 - if ( isset($field['type']) && in_array($field['type'], array('office')) )
671 + if (
672 + isset( $field['type'] ) &&
673 + in_array( $field['type'], array( 'office' ), true )
674 + )
658 675 {
659 676 echo '
660 - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p>
677 + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p>
661 678 ';
662 679 }
663 680
664 - if ( taxonomy_exists($id) || ( isset($field['custom_field']) && $field['custom_field'] === true && $field['type'] == 'select' ) )
681 + if (
682 + taxonomy_exists( $id ) ||
683 + (
684 + isset( $field['custom_field'] ) &&
685 + true === $field['custom_field'] &&
686 + isset( $field['type'] ) &&
687 + 'select' === $field['type']
688 + )
689 + )
665 690 {
666 691 echo '
667 - <p><label for="blank_option_'.$id.'">Blank Option:</label> <input type="text" name="blank_option[' . $id . ']" id="blank_option_'.$id.'" value="' . ( ( isset($field['blank_option']) ) ? htmlentities($field['blank_option']) : __( 'No Preference', 'propertyhive' ) ) . '"></p>
692 + <p><label for="blank_option_'. esc_attr( $id ) .'">Blank Option:</label> <input type="text" name="blank_option[' . esc_attr( $id ) . ']" id="blank_option_'. esc_attr( $id ) .'" value="' . ( ( isset($field['blank_option']) ) ? esc_attr($field['blank_option']) : esc_attr__( 'No Preference', 'propertyhive' ) ) . '"></p>
668 693 ';
669 694
670 - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_multi_level_taxonomy_fields', array('property_type', 'commercial_property_type', 'location') ) ) )
695 + if (
696 + taxonomy_exists( $id ) &&
697 + in_array(
698 + $id,
699 + apply_filters(
700 + 'propertyhive_template_assistant_multi_level_taxonomy_fields',
701 + array( 'property_type', 'commercial_property_type', 'location' )
702 + ),
703 + true
704 + )
705 + )
671 706 {
672 707 echo '
673 - <p><label for="parent_terms_only_'.$id.'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . $id . ']" id="parent_terms_only_'.$id.'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p>
708 + <p><label for="parent_terms_only_'. esc_attr( $id ) .'">Top-Level Terms Only:</label> <input type="checkbox" name="parent_terms_only[' . esc_attr( $id ) . ']" id="parent_terms_only_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['parent_terms_only']) && $field['parent_terms_only'] === true ) ? ' checked' : '' ) . '></p>
674 709 ';
675 710
676 711 echo '
677 - <p><label for="hide_empty_'.$id.'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . $id . ']" id="hide_empty_'.$id.'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p>
712 + <p><label for="hide_empty_'. esc_attr( $id ) .'">Hide Terms With No Properties Assigned:</label> <input type="checkbox" name="hide_empty[' . esc_attr( $id ) . ']" id="hide_empty_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['hide_empty']) && $field['hide_empty'] === true ) ? ' checked' : '' ) . '></p>
678 713 ';
679 714 }
680 715
681 - if ( taxonomy_exists($id) && in_array( $id, apply_filters( 'propertyhive_template_assistant_dynamic_population_taxonomy_fields', array('location') ) ) )
716 + if (
717 + taxonomy_exists( $id ) &&
718 + in_array(
719 + $id,
720 + apply_filters(
721 + 'propertyhive_template_assistant_dynamic_population_taxonomy_fields',
722 + array( 'location' )
723 + ),
724 + true
725 + )
726 + )
682 727 {
683 728 echo '
684 - <p><label for="dynamic_population_'.$id.'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . $id . ']" id="dynamic_population_'.$id.'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p>
729 + <p><label for="dynamic_population_'. esc_attr( $id ) .'">Dynamically Populate Cascading Dropdowns:</label> <input type="checkbox" name="dynamic_population[' . esc_attr( $id ) . ']" id="dynamic_population_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['dynamic_population']) && $field['dynamic_population'] === true ) ? ' checked' : '' ) . '></p>
685 730 ';
686 731 }
687 732
688 733 echo '
689 - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
734 + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
690 735 ';
691 736 }
692 737
693 - if ( $id == 'office' )
738 + if ( 'office' === $id )
694 739 {
695 740 echo '
696 - <p><label for="multiselect_'.$id.'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . $id . ']" id="multiselect_'.$id.'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
741 + <p><label for="multiselect_'. esc_attr( $id ) .'">Multi-Select:</label> <input type="checkbox" name="multiselect[' . esc_attr( $id ) . ']" id="multiselect_'. esc_attr( $id ) .'" value="yes"' . ( ( isset($field['multiselect']) && $field['multiselect'] === true ) ? ' checked' : '' ) . '></p>
697 742 ';
698 743 }
699 744
700 - if ( isset($field['options']) && !taxonomy_exists($id) && ( !isset($field['custom_field']) || ( isset($field['custom_field']) && $field['custom_field'] === false ) ) )
745 + if (
746 + isset( $field['options'] ) &&
747 + ! taxonomy_exists( $id ) &&
748 + (
749 + ! isset( $field['custom_field'] ) ||
750 + false === $field['custom_field']
751 + )
752 + )
701 753 {
702 - echo '<p><label for="">Options: ';
754 + echo '<p><label>Options: ';
703 755
704 - echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . $id . '">Add Option</a>';
756 + echo '<a href="" class="add-search-form-field-option" id="add_search_form_field_option_' . esc_attr( $id ) . '">Add Option</a>';
705 757
706 758 echo '</label><br>';
707 759
708 - echo '<span class="form-field-options" id="sortable_options_' . $id . '">';
760 + echo '<span class="form-field-options" id="sortable_options_' . esc_attr( $id ) . '">';
709 761 $i = 0;
710 762 foreach ( $field['options'] as $key => $value )
711 763 {
712 764 echo '<span style="display:block"><i class="fa fa-reorder" style="cursor:pointer; opacity:0.3"></i> ';
713 - echo '<input type="text" name="option_keys[' . $id . '][]" value="' . $key . '">';
714 - echo '<input type="text" name="options_values[' . $id . '][]" value="' . $value . '">';
765 + echo '<input type="text" name="option_keys[' . esc_attr( $id ) . '][]" value="' . esc_attr( $key ) . '">';
766 + echo '<input type="text" name="options_values[' . esc_attr( $id ) . '][]" value="' . esc_attr( $value ) . '">';
715 767 echo '</span>';
768 + }
716 769
717 - ++$i;
718 - }
719 770 echo '</span>';
720 -
721 771 echo '</p>';
722 772 ?>
723 773 <script>
724 774 jQuery(document).ready(function($)
725 775 {
726 - $( "#sortable_options_<?php echo $id; ?>" )
776 + $( document.getElementById( <?php echo wp_json_encode( 'sortable_options_' . $id, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT ); ?> ) )
727 777 .sortable({
728 778 axis: "y",
729 779 handle: "i",
730 780 stop: function( event, ui )
@@ -744,10 +794,10 @@
744 794 //$('#active_fields_order').val( fields_order.join("|") );
745 795 }
746 796 });
747 797 });
748 - </script>
749 -<?php
798 + </script>
799 + <?php
750 800 }
751 801
752 802 echo '</div>
753 803 </div>';
@@ -772,9 +822,10 @@
772 822 {
773 823 $current_settings['search_forms']['default'] = array();
774 824 }
775 825
776 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
826 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selection of a search-form editor; save() verifies its settings nonce and capability before writes.
827 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
777 828
778 829 $search_form_details = array();
779 830
780 831 if ($current_id != '')
@@ -1231,9 +1282,9 @@
1231 1282 foreach ( $active_fields as $id => $field )
1232 1283 {
1233 1284 $field_ids[] = $id;
1234 1285 }
1235 - echo implode("|", $field_ids);
1286 + echo esc_attr( implode("|", $field_ids) );
1236 1287 ?>">
1237 1288 <input type="hidden" name="inactive_fields_order" id="inactive_fields_order" value="<?php
1238 1289 $field_ids = array();
1239 1290 foreach ( $inactive_fields as $id => $field )
@@ -1239,9 +1290,9 @@
1239 1290 foreach ( $inactive_fields as $id => $field )
1240 1291 {
1241 1292 $field_ids[] = $id;
1242 1293 }
1243 - echo implode("|", $field_ids);
1294 + echo esc_attr( implode("|", $field_ids) );
1244 1295 ?>">
1245 1296
1246 1297 <script>
1247 1298 jQuery(document).ready(function($)
@@ -1433,8 +1484,9 @@
1433 1484 if ( $current_section )
1434 1485 {
1435 1486 switch ($current_section)
1436 1487 {
1488 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared admin settings-view state; this global is intentionally used to control the common settings template and is not an arbitrary application global.
1437 1489 case "search-forms": { $hide_save_button = true; $settings = $this->get_search_forms_settings(); break; }
1438 1490 case "addsearchform": { $settings = $this->get_search_form_settings(); break; }
1439 1491 case "editsearchform": { $settings = $this->get_search_form_settings(); break; }
1440 1492 case "flags": { $settings = $this->get_flags_settings(); break; }
@@ -1453,8 +1505,12 @@
1453 1505 * Save settings.
1454 1506 */
1455 1507 public function save()
1456 1508 {
1509 + if ( ! current_user_can( 'manage_options' ) || ! isset( $_REQUEST['_wpnonce'] ) || ! is_string( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'propertyhive-settings' ) ) {
1510 + return;
1511 + }
1512 +
1457 1513 global $current_section;
1458 1514
1459 1515 $current_settings = get_option( 'propertyhive_template_assistant', array() );
1460 1516
@@ -1463,14 +1519,26 @@
1463 1519 switch ($current_section)
1464 1520 {
1465 1521 case "flags":
1466 1522 {
1523 + $flag_input = array();
1524 + foreach ( array( 'flags_active', 'flags_active_single', 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) {
1525 + if ( isset( $_POST[$flag_key] ) && ! is_string( $_POST[$flag_key] ) ) {
1526 + return;
1527 + }
1528 + $flag_input[$flag_key] = isset( $_POST[$flag_key] ) ? sanitize_text_field( wp_unslash( $_POST[$flag_key] ) ) : '';
1529 + }
1530 + foreach ( array( 'flag_position', 'flag_bg_color', 'flag_text_color' ) as $flag_key ) {
1531 + if ( ! isset( $_POST[$flag_key] ) ) {
1532 + return;
1533 + }
1534 + }
1467 1535 $propertyhive_template_assistant = array(
1468 - 'flags_active' => ( ( isset($_POST['flags_active']) ) ? sanitize_text_field($_POST['flags_active']) : '' ),
1469 - 'flags_active_single' => ( ( isset($_POST['flags_active_single']) ) ? sanitize_text_field($_POST['flags_active_single']) : '' ),
1470 - 'flag_position' => sanitize_text_field($_POST['flag_position']),
1471 - 'flag_bg_color' => sanitize_text_field($_POST['flag_bg_color']),
1472 - 'flag_text_color' => sanitize_text_field($_POST['flag_text_color']),
1536 + 'flags_active' => $flag_input['flags_active'],
1537 + 'flags_active_single' => $flag_input['flags_active_single'],
1538 + 'flag_position' => $flag_input['flag_position'],
1539 + 'flag_bg_color' => $flag_input['flag_bg_color'],
1540 + 'flag_text_color' => $flag_input['flag_text_color'],
1473 1541 );
1474 1542
1475 1543 $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant);
1476 1544
@@ -1479,9 +1547,9 @@
1479 1547 }
1480 1548 case "addsearchform":
1481 1549 case "editsearchform":
1482 1550 {
1483 - $current_id = ( !isset( $_REQUEST['id'] ) ) ? '' : sanitize_title( $_REQUEST['id'] );
1551 + $current_id = ( isset( $_REQUEST['id'] ) && is_string( $_REQUEST['id'] ) ) ? sanitize_title( wp_unslash( $_REQUEST['id'] ) ) : '';
1484 1552
1485 1553 $existing_search_forms = ( (isset($current_settings['search_forms'])) ? $current_settings['search_forms'] : array() );
1486 1554
1487 1555 if ( $current_section == 'editsearchform' && $current_id != 'default' && !isset($existing_search_forms[$current_id]) )
@@ -1493,9 +1561,32 @@
1493 1561 {
1494 1562 unset($existing_search_forms[$current_id]);
1495 1563 }
1496 1564
1497 - $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title($_POST['form_id'])) : $current_id );
1565 + $submitted_fields = array();
1566 + foreach ( array( 'show_label', 'label', 'type', 'before', 'after', 'placeholder', 'min', 'max', 'step', 'blank_option', 'parent_terms_only', 'dynamic_population', 'hide_empty', 'multiselect' ) as $input_key ) {
1567 + if ( isset( $_POST[$input_key] ) && ! is_array( $_POST[$input_key] ) ) {
1568 + return;
1569 + }
1570 + $submitted_fields[$input_key] = array();
1571 + if ( isset( $_POST[$input_key] ) ) {
1572 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1573 + foreach ( $_POST[$input_key] as $field_id => $value ) {
1574 + if ( ! is_string( $value ) ) {
1575 + return;
1576 + }
1577 + $value = wp_unslash( $value );
1578 + $submitted_fields[$input_key][$field_id] = in_array( $input_key, array( 'label', 'before', 'after' ), true ) ? wp_kses_post( $value ) : sanitize_text_field( $value );
1579 + }
1580 + }
1581 + }
1582 + foreach ( array( 'form_id', 'active_fields_order', 'inactive_fields_order' ) as $input_key ) {
1583 + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) {
1584 + return;
1585 + }
1586 + }
1587 +
1588 + $current_id = ( ( isset($_POST['form_id']) && $_POST['form_id'] != '' ) ? str_replace("-", "_", sanitize_title( wp_unslash( $_POST['form_id'] ) )) : $current_id );
1498 1589 if ($current_section == 'addsearchform' && trim($current_id) == '' )
1499 1590 {
1500 1591 $current_id = 'custom';
1501 1592 }
@@ -1504,63 +1595,63 @@
1504 1595 $inactive_fields = array();
1505 1596
1506 1597 if ( isset($_POST['active_fields_order']) && $_POST['active_fields_order'] != '' )
1507 1598 {
1508 - $field_ids = explode("|", sanitize_text_field($_POST['active_fields_order']));
1599 + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['active_fields_order'] ) ));
1509 1600 if ( !empty($field_ids) )
1510 1601 {
1511 1602 foreach ( $field_ids as $field_id )
1512 1603 {
1513 1604 $active_fields[$field_id] = array(
1514 - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ),
1515 - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ),
1605 + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ),
1606 + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ),
1516 1607 );
1517 1608
1518 - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' )
1609 + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' )
1519 1610 {
1520 - $active_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]);
1611 + $active_fields[$field_id]['type'] = $submitted_fields['type'][$field_id];
1521 1612 }
1522 - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' )
1613 + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' )
1523 1614 {
1524 - $active_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]);
1615 + $active_fields[$field_id]['before'] = $submitted_fields['before'][$field_id];
1525 1616 }
1526 - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' )
1617 + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' )
1527 1618 {
1528 - $active_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]);
1619 + $active_fields[$field_id]['after'] = $submitted_fields['after'][$field_id];
1529 1620 }
1530 - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' )
1621 + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' )
1531 1622 {
1532 - $active_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]);
1623 + $active_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id];
1533 1624 }
1534 - if ( isset($_POST['min'][$field_id]) && $_POST['min'][$field_id] != '' )
1625 + if ( isset($submitted_fields['min'][$field_id]) && $submitted_fields['min'][$field_id] != '' )
1535 1626 {
1536 - $active_fields[$field_id]['min'] = stripslashes($_POST['min'][$field_id]);
1627 + $active_fields[$field_id]['min'] = $submitted_fields['min'][$field_id];
1537 1628 }
1538 - if ( isset($_POST['max'][$field_id]) && $_POST['max'][$field_id] != '' )
1629 + if ( isset($submitted_fields['max'][$field_id]) && $submitted_fields['max'][$field_id] != '' )
1539 1630 {
1540 - $active_fields[$field_id]['max'] = stripslashes($_POST['max'][$field_id]);
1631 + $active_fields[$field_id]['max'] = $submitted_fields['max'][$field_id];
1541 1632 }
1542 - if ( isset($_POST['step'][$field_id]) && $_POST['step'][$field_id] != '' )
1633 + if ( isset($submitted_fields['step'][$field_id]) && $submitted_fields['step'][$field_id] != '' )
1543 1634 {
1544 - $active_fields[$field_id]['step'] = stripslashes($_POST['step'][$field_id]);
1635 + $active_fields[$field_id]['step'] = $submitted_fields['step'][$field_id];
1545 1636 }
1546 - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' )
1637 + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' )
1547 1638 {
1548 - $active_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]);
1639 + $active_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id];
1549 1640 }
1550 - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' )
1641 + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' )
1551 1642 {
1552 1643 $active_fields[$field_id]['parent_terms_only'] = true;
1553 1644 }
1554 - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' )
1645 + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' )
1555 1646 {
1556 1647 $active_fields[$field_id]['dynamic_population'] = true;
1557 1648 }
1558 - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' )
1649 + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' )
1559 1650 {
1560 1651 $active_fields[$field_id]['hide_empty'] = true;
1561 1652 }
1562 - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' )
1653 + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' )
1563 1654 {
1564 1655 $active_fields[$field_id]['multiselect'] = true;
1565 1656 }
1566 1657
@@ -1566,11 +1657,15 @@
1566 1657
1567 1658 if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) )
1568 1659 {
1569 1660 $options = array();
1661 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1570 1662 foreach ( $_POST['option_keys'][$field_id] as $i => $key )
1571 1663 {
1572 - $options[$key] = $_POST['options_values'][$field_id][$i];
1664 + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) {
1665 + return;
1666 + }
1667 + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) );
1573 1668 }
1574 1669 $active_fields[$field_id]['options'] = $options;
1575 1670 }
1576 1671 }
@@ -1578,51 +1673,51 @@
1578 1673 }
1579 1674
1580 1675 if ( isset($_POST['inactive_fields_order']) && $_POST['inactive_fields_order'] != '' )
1581 1676 {
1582 - $field_ids = explode("|", sanitize_text_field($_POST['inactive_fields_order']));
1677 + $field_ids = explode("|", sanitize_text_field( wp_unslash( $_POST['inactive_fields_order'] ) ));
1583 1678 if ( !empty($field_ids) )
1584 1679 {
1585 1680 foreach ( $field_ids as $field_id )
1586 1681 {
1587 1682 $inactive_fields[$field_id] = array(
1588 - 'show_label' => ( ( isset($_POST['show_label'][$field_id]) && $_POST['show_label'][$field_id] == '1' ) ? true : false ),
1589 - 'label' => ( isset($_POST['label'][$field_id]) ? stripslashes($_POST['label'][$field_id]) : '' ),
1683 + 'show_label' => ( ( isset($submitted_fields['show_label'][$field_id]) && $submitted_fields['show_label'][$field_id] == '1' ) ? true : false ),
1684 + 'label' => ( isset($submitted_fields['label'][$field_id]) ? $submitted_fields['label'][$field_id] : '' ),
1590 1685 );
1591 1686
1592 - if ( isset($_POST['type'][$field_id]) && $_POST['type'][$field_id] != '' )
1687 + if ( isset($submitted_fields['type'][$field_id]) && $submitted_fields['type'][$field_id] != '' )
1593 1688 {
1594 - $inactive_fields[$field_id]['type'] = stripslashes($_POST['type'][$field_id]);
1689 + $inactive_fields[$field_id]['type'] = $submitted_fields['type'][$field_id];
1595 1690 }
1596 - if ( isset($_POST['before'][$field_id]) && $_POST['before'][$field_id] != '' )
1691 + if ( isset($submitted_fields['before'][$field_id]) && $submitted_fields['before'][$field_id] != '' )
1597 1692 {
1598 - $inactive_fields[$field_id]['before'] = stripslashes($_POST['before'][$field_id]);
1693 + $inactive_fields[$field_id]['before'] = $submitted_fields['before'][$field_id];
1599 1694 }
1600 - if ( isset($_POST['after'][$field_id]) && $_POST['after'][$field_id] != '' )
1695 + if ( isset($submitted_fields['after'][$field_id]) && $submitted_fields['after'][$field_id] != '' )
1601 1696 {
1602 - $inactive_fields[$field_id]['after'] = stripslashes($_POST['after'][$field_id]);
1697 + $inactive_fields[$field_id]['after'] = $submitted_fields['after'][$field_id];
1603 1698 }
1604 - if ( isset($_POST['placeholder'][$field_id]) && $_POST['placeholder'][$field_id] != '' )
1699 + if ( isset($submitted_fields['placeholder'][$field_id]) && $submitted_fields['placeholder'][$field_id] != '' )
1605 1700 {
1606 - $inactive_fields[$field_id]['placeholder'] = stripslashes($_POST['placeholder'][$field_id]);
1701 + $inactive_fields[$field_id]['placeholder'] = $submitted_fields['placeholder'][$field_id];
1607 1702 }
1608 - if ( isset($_POST['blank_option'][$field_id]) && $_POST['blank_option'][$field_id] != '' )
1703 + if ( isset($submitted_fields['blank_option'][$field_id]) && $submitted_fields['blank_option'][$field_id] != '' )
1609 1704 {
1610 - $inactive_fields[$field_id]['blank_option'] = stripslashes($_POST['blank_option'][$field_id]);
1705 + $inactive_fields[$field_id]['blank_option'] = $submitted_fields['blank_option'][$field_id];
1611 1706 }
1612 - if ( isset($_POST['parent_terms_only'][$field_id]) && $_POST['parent_terms_only'][$field_id] != '' )
1707 + if ( isset($submitted_fields['parent_terms_only'][$field_id]) && $submitted_fields['parent_terms_only'][$field_id] != '' )
1613 1708 {
1614 1709 $inactive_fields[$field_id]['parent_terms_only'] = true;
1615 1710 }
1616 - if ( isset($_POST['dynamic_population'][$field_id]) && $_POST['dynamic_population'][$field_id] != '' )
1711 + if ( isset($submitted_fields['dynamic_population'][$field_id]) && $submitted_fields['dynamic_population'][$field_id] != '' )
1617 1712 {
1618 1713 $inactive_fields[$field_id]['dynamic_population'] = true;
1619 1714 }
1620 - if ( isset($_POST['hide_empty'][$field_id]) && $_POST['hide_empty'][$field_id] != '' )
1715 + if ( isset($submitted_fields['hide_empty'][$field_id]) && $submitted_fields['hide_empty'][$field_id] != '' )
1621 1716 {
1622 1717 $inactive_fields[$field_id]['hide_empty'] = true;
1623 1718 }
1624 - if ( isset($_POST['multiselect'][$field_id]) && $_POST['multiselect'][$field_id] != '' )
1719 + if ( isset($submitted_fields['multiselect'][$field_id]) && $submitted_fields['multiselect'][$field_id] != '' )
1625 1720 {
1626 1721 $inactive_fields[$field_id]['multiselect'] = true;
1627 1722 }
1628 1723
@@ -1628,11 +1723,15 @@
1628 1723
1629 1724 if ( isset($_POST['option_keys'][$field_id]) && is_array($_POST['option_keys'][$field_id]) && !empty($_POST['option_keys'][$field_id]) )
1630 1725 {
1631 1726 $options = array();
1727 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1632 1728 foreach ( $_POST['option_keys'][$field_id] as $i => $key )
1633 1729 {
1634 - $options[$key] = $_POST['options_values'][$field_id][$i];
1730 + if ( ! is_string( $key ) || ! isset( $_POST['options_values'][$field_id][$i] ) || ! is_string( $_POST['options_values'][$field_id][$i] ) ) {
1731 + return;
1732 + }
1733 + $options[sanitize_text_field( wp_unslash( $key ) )] = sanitize_text_field( wp_unslash( $_POST['options_values'][$field_id][$i] ) );
1635 1734 }
1636 1735 $inactive_fields[$field_id]['options'] = $options;
1637 1736 }
1638 1737 }
@@ -1654,12 +1753,33 @@
1654 1753 }
1655 1754 }
1656 1755 else
1657 1756 {
1757 + $frontend_input = array();
1758 + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_image_size', 'search_result_fields_custom_field', 'search_result_css' ) as $input_key ) {
1759 + if ( isset( $_POST[$input_key] ) && ! is_string( $_POST[$input_key] ) ) {
1760 + return;
1761 + }
1762 + $frontend_input[$input_key] = isset( $_POST[$input_key] ) ? sanitize_text_field( wp_unslash( $_POST[$input_key] ) ) : '';
1763 + }
1764 + foreach ( array( 'search_result_default_order', 'search_result_columns', 'search_result_layout', 'search_result_css' ) as $input_key ) {
1765 + if ( ! isset( $_POST[$input_key] ) ) {
1766 + return;
1767 + }
1768 + }
1769 + if ( isset( $_POST['search_result_fields'] ) && ! is_array( $_POST['search_result_fields'] ) ) {
1770 + return;
1771 + }
1658 1772 $search_results_fields = array();
1659 1773 if ( isset($_POST['search_result_fields']) && is_array($_POST['search_result_fields']) )
1660 1774 {
1661 - $search_results_fields = $_POST['search_result_fields'];
1775 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Iteration preserves the raw element type for validation; accepted strings are unslashed and sanitized inside this loop before use.
1776 + foreach ( $_POST['search_result_fields'] as $search_result_field ) {
1777 + if ( ! is_string( $search_result_field ) ) {
1778 + return;
1779 + }
1780 + $search_results_fields[] = sanitize_text_field( wp_unslash( $search_result_field ) );
1781 + }
1662 1782
1663 1783 $new_search_results_fields = array();
1664 1784 foreach ( $search_results_fields as $search_results_field )
1665 1785 {
@@ -1666,9 +1786,9 @@
1666 1786 if ( $search_results_field == 'custom_field' )
1667 1787 {
1668 1788 if ( isset($_POST['search_result_fields_custom_field']) && $_POST['search_result_fields_custom_field'] != '' )
1669 1789 {
1670 - $new_search_results_fields[] = ph_clean($_POST['search_result_fields_custom_field']);
1790 + $new_search_results_fields[] = $frontend_input['search_result_fields_custom_field'];
1671 1791 }
1672 1792 }
1673 1793 else
1674 1794 {
@@ -1679,14 +1799,15 @@
1679 1799 $search_results_fields = $new_search_results_fields;
1680 1800 }
1681 1801
1682 1802 $propertyhive_template_assistant = array(
1683 - 'search_result_default_order' => ph_clean($_POST['search_result_default_order']),
1684 - 'search_result_columns' => (int)$_POST['search_result_columns'],
1685 - 'search_result_layout' => (int)$_POST['search_result_layout'],
1803 + 'search_result_default_order' => $frontend_input['search_result_default_order'],
1804 + 'search_result_columns' => (int)$frontend_input['search_result_columns'],
1805 + 'search_result_layout' => (int)$frontend_input['search_result_layout'],
1686 1806 'search_result_fields' => $search_results_fields,
1687 - 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? ph_clean($_POST['search_result_image_size']) : 'medium' ),
1688 - 'search_result_css' => wp_unslash($_POST['search_result_css']),
1807 + 'search_result_image_size' => ( isset($_POST['search_result_image_size']) ? $frontend_input['search_result_image_size'] : 'medium' ),
1808 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Administrator-authored CSS is intentionally preserved; the type is validated above and its stylesheet output protects the closing style boundary.
1809 + 'search_result_css' => isset( $_POST['search_result_css'] ) ? wp_unslash($_POST['search_result_css']) : '',
1689 1810 'search_result_css_all_pages' => isset($_POST['search_result_css_all_pages']) ? 'yes' : '',
1690 1811 );
1691 1812
1692 1813 $propertyhive_template_assistant = array_merge($current_settings, $propertyhive_template_assistant);