← All changes
|
includes/admin/views/html-admin-matching-applicants-email.php
+16
-4
2.2.4
→
2.4.0
View file →
| @@ -3,10 +3,18 @@ | ||
| 3 | 3 | exit; |
| 4 | 4 | } |
| 5 | 5 | |
| 6 | 6 | $current_user = wp_get_current_user(); |
| 7 | +$propertyhive_email_recipients = array(); | |
| 8 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only email composition view; the matching controller verifies propertyhive-matching-applicants before including it, and send authorization remains in the controller. | |
| 9 | +$propertyhive_recipient_input = isset( $_POST['email_contact_applicant_profile_id'] ) && is_array( $_POST['email_contact_applicant_profile_id'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['email_contact_applicant_profile_id'] ) ) : array(); | |
| 10 | +foreach ( $propertyhive_recipient_input as $propertyhive_recipient ) { | |
| 11 | + if ( is_string( $propertyhive_recipient ) && preg_match( '/^\d+\|\d+$/', $propertyhive_recipient ) ) { | |
| 12 | + $propertyhive_email_recipients[] = $propertyhive_recipient; | |
| 13 | + } | |
| 14 | +} | |
| 7 | 15 | ?> |
| 8 | -<h1>Emailing <?php echo esc_html($property->get_formatted_full_address()); ?> To <?php echo count($_POST['email_contact_applicant_profile_id']); ?> Suitable Applicant<?php echo count($_POST['email_contact_applicant_profile_id']) != 1 ? 's' : ''; ?></h1> | |
| 16 | +<h1>Emailing <?php echo esc_html($property->get_formatted_full_address()); ?> To <?php echo count( $propertyhive_email_recipients ); ?> Suitable Applicant<?php echo count( $propertyhive_email_recipients ) != 1 ? 's' : ''; ?></h1> | |
| 9 | 17 | |
| 10 | 18 | <table class="form-table"> |
| 11 | 19 | |
| 12 | 20 | <tr valign="top"> |
| @@ -12,16 +20,20 @@ | ||
| 12 | 20 | <tr valign="top"> |
| 13 | 21 | <th scope="row" class="titledesc"><?php echo esc_html(__( 'To', 'propertyhive' )); ?></th> |
| 14 | 22 | <td class="forminp"> |
| 15 | 23 | <?php |
| 16 | - foreach ( $_POST['email_contact_applicant_profile_id'] as $contact_applicant_profile_id ) | |
| 24 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 25 | + foreach ( $propertyhive_email_recipients as $contact_applicant_profile_id ) | |
| 17 | 26 | { |
| 27 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 18 | 28 | $explode_contact_applicant_profile_id = explode("|", $contact_applicant_profile_id); |
| 19 | 29 | |
| 30 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 20 | 31 | $contact_id = $explode_contact_applicant_profile_id[0]; |
| 32 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-local variable in an admin view; PHPCS analyzes the view file standalone even though WordPress includes it inside a method/function scope. | |
| 21 | 33 | $applicant_profile_id = $explode_contact_applicant_profile_id[1]; |
| 22 | 34 | |
| 23 | - echo get_the_title($contact_id) . ' (' . get_post_meta( $contact_id, '_email_address', TRUE ) . ')<br>'; | |
| 35 | + echo esc_html( get_the_title( $contact_id ) ) . ' (' . esc_html( get_post_meta( $contact_id, '_email_address', TRUE ) ) . ')<br>'; | |
| 24 | 36 | } |
| 25 | 37 | ?> |
| 26 | 38 | <div style="margin-top:5px;"><a href="" class="show-cc">Show Cc</a> | <a href="" class="show-bcc">Show Bcc</a></div> |
| 27 | 39 | </td> |
| @@ -64,9 +76,9 @@ | ||
| 64 | 76 | |
| 65 | 77 | <tr valign="top"> |
| 66 | 78 | <th scope="row" class="titledesc"><?php echo esc_html(__( 'Email Body', 'propertyhive' )); ?></th> |
| 67 | 79 | <td class="forminp"> |
| 68 | - <textarea name="body" style="width:100%; height:300px;"><?php echo $body; ?></textarea> | |
| 80 | + <textarea name="body" style="width:100%; height:300px;"><?php echo esc_textarea( $body ); ?></textarea> | |
| 69 | 81 | </td> |
| 70 | 82 | </tr> |
| 71 | 83 | |
| 72 | 84 | </table> |