| @@ -32,25 +32,29 @@ | ||
| 32 | 32 | foreach ($actions as $action) |
| 33 | 33 | { |
| 34 | 34 | $action['class'] = ( isset( $action['class'] ) ) ? $action['class'] : ''; |
| 35 | 35 | |
| 36 | - echo '<li class="' . $action['class'] . '"'; | |
| 36 | + echo ' | |
| 37 | + <li class="' . esc_attr($action['class']) . '"'; | |
| 37 | 38 | if ( isset( $action['parent_attributes'] ) && ! empty( $action['parent_attributes'] ) ) |
| 38 | 39 | { |
| 40 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable; the template is included through a helper/function scope, so PrefixAllGlobals misclassifies the file when checked standalone. | |
| 39 | 41 | foreach ( $action['parent_attributes'] as $key => $value ) |
| 40 | 42 | { |
| 41 | - echo ' ' . $key . '="' . $value . '"'; | |
| 43 | + echo ' ' . esc_attr( $key ) . '="' . esc_attr($value) . '"'; | |
| 42 | 44 | } |
| 43 | 45 | } |
| 44 | - echo '><a href="' . $action['href'] . '"'; | |
| 46 | + echo '><a href="' . esc_url($action['href']) . '"'; | |
| 45 | 47 | if ( isset( $action['attributes'] ) && ! empty( $action['attributes'] ) ) |
| 46 | 48 | { |
| 49 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable; the template is included through a helper/function scope, so PrefixAllGlobals misclassifies the file when checked standalone. | |
| 47 | 50 | foreach ( $action['attributes'] as $key => $value ) |
| 48 | 51 | { |
| 49 | - echo ' ' . $key . '="' . $value . '"'; | |
| 52 | + echo ' ' . esc_attr( $key ) . '="' . esc_attr($value) . '"'; | |
| 50 | 53 | } |
| 51 | 54 | } |
| 52 | - echo '>' . $action['label'] . '</a></li>'; | |
| 55 | + echo '>' . esc_html($action['label']) . '</a></li> | |
| 56 | + '; | |
| 53 | 57 | } |
| 54 | 58 | ?> |
| 55 | 59 | |
| 56 | 60 | <?php do_action( 'propertyhive_property_actions_list_end' ); ?> |
