| @@ -45,14 +45,86 @@ | ||
| 45 | 45 | $required_markup = $required ? ' data-required="true" required' : ''; |
| 46 | 46 | |
| 47 | 47 | $output .= '<fieldset class="usp-checkbox">'; |
| 48 | 48 | $output .= '<input id="user-submitted-checkbox" name="'. esc_attr($name) .'" type="checkbox" value=""'. $required_markup .'> '; |
| 49 | - $output .= '<label for="user-submitted-checkbox">'. $text .'</label>'; | |
| 49 | + $output .= '<label for="user-submitted-checkbox">'. wp_kses($text, usp_allowed_post_tags()) .'</label>'; | |
| 50 | 50 | $output .= '</fieldset>'; |
| 51 | 51 | |
| 52 | 52 | } |
| 53 | 53 | |
| 54 | 54 | return $output; |
| 55 | + | |
| 56 | +} | |
| 57 | + | |
| 58 | +function usp_allowed_post_tags() { | |
| 59 | + | |
| 60 | + global $allowedposttags; | |
| 61 | + | |
| 62 | + $allowed_atts = array( | |
| 63 | + | |
| 64 | + 'align' => array(), | |
| 65 | + 'class' => array(), | |
| 66 | + 'type' => array(), | |
| 67 | + 'id' => array(), | |
| 68 | + 'dir' => array(), | |
| 69 | + 'lang' => array(), | |
| 70 | + 'style' => array(), | |
| 71 | + 'xml:lang' => array(), | |
| 72 | + 'src' => array(), | |
| 73 | + 'alt' => array(), | |
| 74 | + 'href' => array(), | |
| 75 | + 'rel' => array(), | |
| 76 | + 'rev' => array(), | |
| 77 | + 'target' => array(), | |
| 78 | + 'novalidate' => array(), | |
| 79 | + 'type' => array(), | |
| 80 | + 'value' => array(), | |
| 81 | + 'name' => array(), | |
| 82 | + 'tabindex' => array(), | |
| 83 | + 'action' => array(), | |
| 84 | + 'method' => array(), | |
| 85 | + 'for' => array(), | |
| 86 | + 'width' => array(), | |
| 87 | + 'height' => array(), | |
| 88 | + 'data' => array(), | |
| 89 | + 'title' => array() | |
| 90 | + | |
| 91 | + ); | |
| 92 | + | |
| 93 | + $allowedposttags['form'] = $allowed_atts; | |
| 94 | + $allowedposttags['label'] = $allowed_atts; | |
| 95 | + $allowedposttags['input'] = $allowed_atts; | |
| 96 | + $allowedposttags['textarea'] = $allowed_atts; | |
| 97 | + $allowedposttags['style'] = $allowed_atts; | |
| 98 | + $allowedposttags['strong'] = $allowed_atts; | |
| 99 | + $allowedposttags['small'] = $allowed_atts; | |
| 100 | + $allowedposttags['table'] = $allowed_atts; | |
| 101 | + $allowedposttags['span'] = $allowed_atts; | |
| 102 | + $allowedposttags['abbr'] = $allowed_atts; | |
| 103 | + $allowedposttags['code'] = $allowed_atts; | |
| 104 | + $allowedposttags['pre'] = $allowed_atts; | |
| 105 | + $allowedposttags['div'] = $allowed_atts; | |
| 106 | + $allowedposttags['img'] = $allowed_atts; | |
| 107 | + $allowedposttags['h1'] = $allowed_atts; | |
| 108 | + $allowedposttags['h2'] = $allowed_atts; | |
| 109 | + $allowedposttags['h3'] = $allowed_atts; | |
| 110 | + $allowedposttags['h4'] = $allowed_atts; | |
| 111 | + $allowedposttags['h5'] = $allowed_atts; | |
| 112 | + $allowedposttags['h6'] = $allowed_atts; | |
| 113 | + $allowedposttags['ol'] = $allowed_atts; | |
| 114 | + $allowedposttags['ul'] = $allowed_atts; | |
| 115 | + $allowedposttags['li'] = $allowed_atts; | |
| 116 | + $allowedposttags['em'] = $allowed_atts; | |
| 117 | + $allowedposttags['hr'] = $allowed_atts; | |
| 118 | + $allowedposttags['br'] = $allowed_atts; | |
| 119 | + $allowedposttags['tr'] = $allowed_atts; | |
| 120 | + $allowedposttags['td'] = $allowed_atts; | |
| 121 | + $allowedposttags['p'] = $allowed_atts; | |
| 122 | + $allowedposttags['a'] = $allowed_atts; | |
| 123 | + $allowedposttags['b'] = $allowed_atts; | |
| 124 | + $allowedposttags['i'] = $allowed_atts; | |
| 125 | + | |
| 126 | + return apply_filters('usp_allowed_post_tags', $allowedposttags); | |
| 55 | 127 | |
| 56 | 128 | } |
| 57 | 129 | |
| 58 | 130 | function usp_get_form_vars() { |
