PluginProbe
WP Directory Kit / 1.5.9
WP Directory Kit v1.5.9
1.5.9 1.5.7 1.5.6 1.5.5 1.5.4 1.5.3 trunk 1.1.0 1.1.6 1.1.8 1.2.3 1.2.4 1.2.5 1.2.6 1.2.7 1.2.8 1.2.9 1.3.0 1.3.1 1.3.2 1.3.3 1.3.4 1.3.5 1.3.6 1.3.8 All 37 releases
← All changes | application/helpers/Basic.php +212 -81 1.5.3 → 1.5.9 View file →
@@ -20,9 +20,9 @@
20 20 include $field_view_path;
21 21 }
22 22 else
23 23 {
24 - echo __('Missing VIEW file:', 'wpdirectorykit').' '.esc_html($field_type).'.php';
24 + echo esc_html__('Missing VIEW file:', 'wpdirectorykit').' '.esc_html($field_type).'.php';
25 25 }
26 26 }
27 27 }
28 28
@@ -190,8 +190,9 @@
190 190
191 191 }
192 192
193 193 if($print){
194 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText
194 195 echo $output;
195 196 return FALSE;
196 197 }
197 198
@@ -359,8 +360,9 @@
359 360 }
360 361 }
361 362
362 363 if($print){
364 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText
363 365 echo $output;
364 366 return FALSE;
365 367 }
366 368
@@ -702,8 +704,13 @@
702 704 /* location / categories */
703 705 if(!is_intval($smart_search)) {
704 706 $gen_q.="location_title LIKE '%$smart_search%' OR ";
705 707 $gen_q.="category_title LIKE '%$smart_search%' OR ";
708 +
709 +
710 + $gen_q.="`category_table`.`titles_for_search` LIKE '%$smart_search%' OR ";
711 + $gen_q.="`location_table`.`titles_for_search` LIKE '%$smart_search%' OR ";
712 +
706 713 }
707 714 /* get address and gps */
708 715 if(strlen($smart_search) > 5) {
709 716 $coordinates_center = wdk_get_gps($smart_search);
@@ -1186,9 +1193,8 @@
1186 1193 $lang_term_id = pll_current_language('term_id');
1187 1194
1188 1195 if(is_numeric($lang_term_id))
1189 1196 {
1190 - //echo $lang_term_id.'<br />';
1191 1197 $WMVC->db->join($WMVC->db->prefix.'term_relationships ON '.$WMVC->db->prefix.'posts.ID = '.$WMVC->db->prefix.'term_relationships.object_id', NULL, NULL);
1192 1198 $WMVC->db->where("({$WMVC->db->prefix}term_relationships.term_taxonomy_id = $lang_term_id)");
1193 1199 }
1194 1200 }
@@ -1625,9 +1631,9 @@
1625 1631 $detect_date = strtotime($gen_search);
1626 1632
1627 1633 if(wdk_payments_is_date($val) && $detect_date > 1000)
1628 1634 {
1629 - $gen_search = date('Y-m-d H:i:s', $detect_date);
1635 + $gen_search = gmdate('Y-m-d H:i:s', $detect_date);
1630 1636 $gen_q.=$col_name." > '".$gen_search."' AND ";
1631 1637 }
1632 1638 else
1633 1639 {
@@ -1665,9 +1671,9 @@
1665 1671 // order
1666 1672 if(isset($_GET_clone['order_by']))
1667 1673 {
1668 1674 $_GET_clone['order_by'] = str_replace('post_id', $WMVC->db->prefix.'wdk_messages.post_id', $_GET_clone['order_by']);
1669 - $WMVC->db->order_by(wdk_esc_sql(sanitize_text_field($_GET_clone['order_by'])));
1675 + $WMVC->db->order_by(wdk_esc_sql(sanitize_text_field($_GET_clone['order_by']), true));
1670 1676 }
1671 1677
1672 1678 }
1673 1679 }
@@ -1674,9 +1680,9 @@
1674 1680
1675 1681 function wdk_date() {
1676 1682 $date_format = get_option('date_format');
1677 1683 $time_format = get_option('time_format');
1678 - $date = date("{$date_format} {$time_format}", current_time('timestamp'));
1684 + $date = gmdate("{$date_format} {$time_format}", current_time('timestamp'));
1679 1685 return $date;
1680 1686 }
1681 1687
1682 1688 if(!function_exists('wdk_placeholder_image_src')) {
@@ -1828,9 +1834,9 @@
1828 1834 }
1829 1835
1830 1836 ?>
1831 1837 <div class="wdk-col wdk-col-btns">
1832 - <div class="wdk-field wdk-field-btn">
1838 + <div class="wdk-field wdk-field-btn">
1833 1839 <div class="wdk-field-group wdk-field-group-additional">
1834 1840 <button id="wdk-search-additional" type="button" class="wdk-search-additional-btn"><?php echo esc_html($wdk_text_more_button); ?><i class="wdk-toggle-icon"></i></button>
1835 1841 <input type='checkbox' style="display: none !important" value='1' <?php if(isset($_GET['wdk_search_additional_opened']) && wmvc_xss_clean($_GET['wdk_search_additional_opened']) == 1):?> checked <?php endif;?> name='wdk_search_additional_opened' />
1836 1842 </div>
@@ -1836,14 +1842,19 @@
1836 1842 </div>
1837 1843 <div class="wdk-field-group wdk-field-group-reset">
1838 1844 <button title="<?php echo esc_attr__('Reset','wpdirectorykit');?>" id="wdk-reset-primary" type="reset" class="wdk-search-start wdk-search-reset wdk-click-load-animation"><?php echo esc_html($wdk_text_reset_button);?></button>
1839 1845 </div>
1846 + <?php if (function_exists('fpai_register_settings')):?>
1847 + <div class="wdk-field-group wdk-field-group-ai-search">
1848 + <button title="<?php echo esc_attr__('Ai Search','wpdirectorykit');?>" type="button" class="wdk-ai-search"><?php echo esc_html__('Ai Search','wpdirectorykit');?></button>
1849 + </div>
1850 + <?php endif;?>
1840 1851 <div class="wdk-field-group wdk-field-group-search">
1841 1852 <button title="<?php echo esc_attr__('Search','wpdirectorykit');?>" id="wdk-start-primary" type="submit" class="wdk-search-start wdk-click-load-animation">&nbsp;&nbsp;<?php echo esc_html($wdk_text_search_button);?>&nbsp;<i class="fa fa-spinner fa-spin fa-ajax-indicator" style="display: none;"></i>&nbsp;</button>
1842 1853
1843 1854 <?php if(function_exists('run_wdk_save_search') && get_option('wdk_save_search_show_on_searchform')):?>
1844 1855 <div class="section-widget-control right">
1845 - <a class="wdk-c-btn wdk-c-edit wdk-save-search-button" href="#" data-url="<?php echo esc_url(admin_url('admin-ajax.php')); ?>" title="<?php echo esc_attr_e('Save Search', 'selio'); ?>" target="_blank">
1856 + <a class="wdk-c-btn wdk-c-edit wdk-save-search-button" href="#" data-url="<?php echo esc_url(admin_url('admin-ajax.php')); ?>" title="<?php echo esc_attr__('Save Search', 'wpdirectorykit'); ?>" target="_blank">
1846 1857 <i class="fas fa-save" aria-hidden="true"></i>
1847 1858 <i class="fa fa-spinner fa-spin fa-ajax-indicator"></i>
1848 1859 </a>
1849 1860 </div>
@@ -1848,8 +1859,9 @@
1848 1859 </a>
1849 1860 </div>
1850 1861 <?php endif;?>
1851 1862 </div>
1863 +
1852 1864 </div>
1853 1865 </div>
1854 1866 <div id='wdk-form-additional' class="wdk-col" style="<?php echo esc_attr($form_closed) ;?>">
1855 1867 <div class="wdk-row">
@@ -1892,9 +1904,9 @@
1892 1904
1893 1905 if(empty($selected))
1894 1906 $selected='';
1895 1907
1896 - $form = '<input name="'.$name.'" value="'.$selected.'" class="wdk-hidden" type="text" id="wdktreeelem'.$counter.'" readonly/>';
1908 + $form = '<input name="'.esc_attr($name).'" value="'.esc_attr($selected).'" class="wdk-hidden" type="text" id="wdktreeelem'.esc_attr($counter).'" readonly/>';
1897 1909
1898 1910 $skip_id = '';
1899 1911 //load javascript library
1900 1912 if($counter==0)
@@ -1901,40 +1913,39 @@
1901 1913 {
1902 1914 wp_enqueue_script('wdk-treefield');
1903 1915 wp_enqueue_style('wdk-treefield');
1904 1916 }
1905 - ?>
1906 - <script>
1907 - jQuery(document).ready(function($) {
1908 - $('#wdktreeelem<?php echo esc_js($counter);?>:not(.init)').wdkTreefield({
1909 - ajax_url: '<?php echo admin_url('admin-ajax.php'); ?>',
1917 + wp_add_inline_script(
1918 + 'wdk-treefield',
1919 + "jQuery(document).ready(function($) {
1920 + $('#wdktreeelem" . esc_js($counter) . ":not(.init)').wdkTreefield({
1921 + ajax_url: '" . esc_js(admin_url('admin-ajax.php')) . "',
1910 1922 ajax_param: {
1911 - "page": 'wdk_frontendajax',
1912 - "function": 'treefieldid',
1913 - "action": 'wdk_public_action',
1914 - "wdk_secure": '<?php echo wp_create_nonce( 'wdk_secure_treefieldid' );?>',
1915 - "table": '<?php echo esc_js($table); ?>',
1916 - "filter_ids": '<?php echo esc_js($filter_ids); ?>',
1917 - "start_id": '<?php if(!empty($filter_ids)) esc_js($selected); else echo ""; ?>',
1918 - "empty_value": '<?php echo esc_js($empty_value); ?>',
1919 - "user_check": '<?php echo esc_js($user_check); ?>',
1920 - "sql_where": '<?php echo esc_js($sql_where); ?>',
1921 - "hide_fields": '<?php echo esc_js($hide_fields); ?>'
1922 - },
1923 - attribute_id: '<?php echo esc_js($attribute_id); ?>',
1924 - language_id: '<?php echo esc_js($language_id); ?>',
1925 - attribute_value: '<?php echo esc_js($column); ?>',
1926 - skip_id: '<?php echo esc_js($skip_id); ?>',
1923 + page: 'wdk_frontendajax',
1924 + function: 'treefieldid',
1925 + action: 'wdk_public_action',
1926 + wdk_secure: '" . esc_js(wp_create_nonce('wdk_secure_treefieldid')) . "',
1927 + table: '" . esc_js($table) . "',
1928 + filter_ids: '" . esc_js($filter_ids) . "',
1929 + start_id: '" . (!empty($filter_ids) ? esc_js($selected) : "") . "',
1930 + empty_value: '" . esc_js($empty_value) . "',
1931 + user_check: '" . esc_js($user_check) . "',
1932 + sql_where: '" . esc_js($sql_where) . "',
1933 + hide_fields: '" . esc_js($hide_fields) . "'
1934 + },
1935 + attribute_id: '" . esc_js($attribute_id) . "',
1936 + language_id: '" . esc_js($language_id) . "',
1937 + attribute_value: '" . esc_js($column) . "',
1938 + skip_id: '',
1927 1939 empty_value: ' - ',
1928 - text_search: '<?php esc_html_e('Search term', 'wpdirectorykit');?>',
1929 - text_no_results: '<?php esc_html_e('No results found', 'wpdirectorykit');?>',
1940 + text_search: '" . esc_html__('Search term', 'wpdirectorykit') . "',
1941 + text_no_results: '" . esc_html__('No results found', 'wpdirectorykit') . "',
1930 1942 callback_selected: function(key) {
1931 - $('#wdktreeelem<?php echo esc_js($counter);?>').trigger("change");
1943 + $('#wdktreeelem" . esc_js($counter) . "').trigger('change');
1932 1944 }
1933 1945 }).addClass('init');
1934 - });
1935 - </script>
1936 - <?php
1946 + });"
1947 + );
1937 1948 $counter++;
1938 1949 return $form;
1939 1950 }
1940 1951 }
@@ -2002,9 +2013,9 @@
2002 2013 if(empty($values)) {
2003 2014 $values = $empty_value;
2004 2015 }
2005 2016
2006 - $form = '<input name="'.$name.'" value="'.esc_html($selected).'" data-placehoder="'.esc_html($values).'" class="wdk-hidden" type="text" id="wdktreeelem_checkbox'.$counter.'" readonly/>';
2017 + $form = '<input name="'.esc_attr($name).'" value="'.esc_html($selected).'" data-placehoder="'.esc_html($values).'" class="wdk-hidden" type="text" id="wdktreeelem_checkbox'.esc_attr($counter).'" readonly/>';
2007 2018
2008 2019 $skip_id = '';
2009 2020 //load javascript library
2010 2021 if($counter==0)
@@ -2015,14 +2026,14 @@
2015 2026 ?>
2016 2027 <script>
2017 2028 jQuery(document).ready(function($) {
2018 2029 $('#wdktreeelem_checkbox<?php echo esc_js($counter);?>:not(.init)').wdkTreefieldCheckboxes({
2019 - ajax_url: '<?php echo admin_url('admin-ajax.php'); ?>',
2030 + ajax_url: '<?php echo esc_url(admin_url('admin-ajax.php')); ?>',
2020 2031 ajax_param: {
2021 2032 "page": 'wdk_frontendajax',
2022 2033 "function": 'treefieldid_checkboxes',
2023 2034 "action": 'wdk_public_action',
2024 - "wdk_secure": '<?php echo wp_create_nonce( 'wdk_secure_treefieldid_checkboxes' );?>',
2035 + "wdk_secure": '<?php echo esc_js(wp_create_nonce( 'wdk_secure_treefieldid_checkboxes' ));?>',
2025 2036 "table": '<?php echo esc_js($table); ?>',
2026 2037 "filter_ids": '<?php echo esc_js($filter_ids); ?>',
2027 2038 "empty_value": '<?php echo esc_js($empty_value); ?>',
2028 2039 "user_check": '<?php echo esc_js($user_check); ?>',
@@ -2191,9 +2202,9 @@
2191 2202 }
2192 2203
2193 2204 /* check is date on strtotime */
2194 2205 if((bool)strtotime($date)){
2195 - return date($return_format, strtotime($date));
2206 + return gmdate($return_format, strtotime($date));
2196 2207 }
2197 2208
2198 2209 return false;
2199 2210 }
@@ -2247,9 +2258,9 @@
2247 2258 return false;
2248 2259 }
2249 2260
2250 2261 // Try to get filename from URL or headers
2251 - $filename = basename(parse_url($url, PHP_URL_PATH));
2262 + $filename = basename(wp_parse_url($url, PHP_URL_PATH));
2252 2263
2253 2264 // If filename empty (Google Drive case)
2254 2265 if (!$filename || strpos($filename, '.') === false) {
2255 2266 // Try content-disposition header
@@ -2333,9 +2344,9 @@
2333 2344 $data = getimagesizefromstring($response['body']);
2334 2345 if(!$data) return false;
2335 2346 if(empty($data['mime'])) return false;
2336 2347
2337 - $filename = time().rand(0000,9999).'.'.wdk_mime2ext($data['mime']);
2348 + $filename = time().wp_rand(0000,9999).'.'.wdk_mime2ext($data['mime']);
2338 2349 }
2339 2350 $upload = wp_upload_bits( $filename, null, $response['body'] );
2340 2351
2341 2352 if( !empty( $upload['error'] ) ) {
@@ -2699,19 +2710,19 @@
2699 2710 <!-- Your add & remove file links -->
2700 2711 <p class="hide-if-no-js">
2701 2712 <a class="upload-custom-img <?php if ( $you_have_file ) { echo 'hidden'; } ?>"
2702 2713 href="<?php echo esc_url($upload_link) ?>">
2703 - <?php echo esc_html__('Select file','wmvc_win') ?>
2714 + <?php echo esc_html__('Select file','wpdirectorykit') ?>
2704 2715 </a>
2705 2716 <a class="delete-custom-img <?php if ( ! $you_have_file ) { echo 'hidden'; } ?>"
2706 2717 href="#">
2707 - <?php echo esc_html__('Remove all files','wmvc_win') ?>
2718 + <?php echo esc_html__('Remove all files','wpdirectorykit') ?>
2708 2719 </a>
2709 2720 </p>
2710 2721 <?php //endif; ?>
2711 2722
2712 2723 <!-- A hidden input to set and post the chosen file id -->
2713 - <input class="logo_file_id" type="hidden" id="<?php echo esc_html($field_name); ?>" name="<?php echo esc_html($field_name); ?>" value="<?php echo esc_html($file_id); ?>" />
2724 + <input class="logo_file_id" type="hidden" id="<?php echo esc_attr($field_name); ?>" name="<?php echo esc_attr($field_name); ?>" value="<?php echo esc_attr($file_id); ?>" />
2714 2725 </div>
2715 2726
2716 2727 <?php
2717 2728 $custom_js ='';
@@ -2719,8 +2730,9 @@
2719 2730 if( typeof jQuery.fn.wpMediaElementFile == 'function')
2720 2731 $('#".esc_js($field_name)."meta-box-id.postbox-upload').wpMediaElementFile();
2721 2732 });";
2722 2733
2734 +// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText
2723 2735 echo "<script>".$custom_js."</script>";
2724 2736
2725 2737 ?>
2726 2738
@@ -2771,10 +2783,10 @@
2771 2783 function wdk_upload_multi_files($field_name, $image_ids='', $texts = array())
2772 2784 {
2773 2785 static $media_element_counter = 0;
2774 2786
2775 - if(!isset($texts['file_select']))$texts['file_select'] = esc_html__('Select file','wmvc_win');
2776 - if(!isset($texts['file_remove']))$texts['file_remove'] = esc_html__('Remove all files','wmvc_win');
2787 + if(!isset($texts['file_select']))$texts['file_select'] = esc_html__('Select file','wpdirectorykit');
2788 + if(!isset($texts['file_remove']))$texts['file_remove'] = esc_html__('Remove all files','wpdirectorykit');
2777 2789
2778 2790 $media_element_counter++;
2779 2791
2780 2792 $img_field = $field_name.'_'.$media_element_counter;
@@ -2816,9 +2828,9 @@
2816 2828 <!-- Your image container, which can be manipulated with js -->
2817 2829 <div class="custom-img-container winter_mvc-media">
2818 2830 <?php if($you_have_img)foreach($your_img_src as $image_id => $img_src) : ?>
2819 2831 <div class="winter_mvc-media-card" data-media-id="<?php echo esc_attr($image_id);?>">
2820 - <img src="<?php echo esc_html($img_src); ?>" style="object-fit: contain;" alt="<?php echo esc_attr__('thumb', 'wmvc_win');?>" style="max-width:100%;" class="thumbnail"/>
2832 + <img src="<?php echo esc_attr($img_src); ?>" style="object-fit: contain;" alt="<?php echo esc_attr__('thumb', 'wpdirectorykit');?>" style="max-width:100%;" class="thumbnail"/>
2821 2833 <a href="#" class="remove"></a>
2822 2834 </div>
2823 2835 <?php endforeach; ?>
2824 2836 </div>
@@ -2838,9 +2850,9 @@
2838 2850 </p>
2839 2851 <?php //endif; ?>
2840 2852
2841 2853 <!-- A hidden input to set and post the chosen image id -->
2842 - <input class="logo_image_id" type="hidden" id="<?php echo esc_html(esc_html($field_name)); ?>" name="<?php echo esc_html($field_name); ?>" value="<?php echo esc_html($image_ids); ?>" />
2854 + <input class="logo_image_id" type="hidden" id="<?php echo esc_attr(esc_html($field_name)); ?>" name="<?php echo esc_attr($field_name); ?>" value="<?php echo esc_attr($image_ids); ?>" />
2843 2855 </div>
2844 2856 <?php
2845 2857 $custom_js ='';
2846 2858 $custom_js .=" jQuery(function($) {
@@ -2880,8 +2892,9 @@
2880 2892 })
2881 2893 });
2882 2894 ";
2883 2895
2896 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText
2884 2897 echo "<script>".$custom_js."</script>";
2885 2898
2886 2899 ?>
2887 2900
@@ -2977,9 +2990,16 @@
2977 2990 if($wdk_recaptcha_site_key && $wdk_recaptcha_secret_key)
2978 2991 {
2979 2992 if($load_script && $counter===0)
2980 2993 {
2981 - echo "<script src='https://www.google.com/recaptcha/api.js?render=".esc_attr(trim($wdk_recaptcha_site_key))."'></script>";
2994 + wp_enqueue_script(
2995 + 'google-recaptcha-v3',
2996 + 'https://www.google.com/recaptcha/api.js?render=' . esc_attr(trim($wdk_recaptcha_site_key)),
2997 + array(),
2998 + null,
2999 + true
3000 + );
3001 +
2982 3002 }
2983 3003 $counter++;
2984 3004 ?>
2985 3005 <input type="hidden" name="g-recaptcha-response" id="recaptcha_called_v3_count_<?php echo esc_html($counter);?>">
@@ -3017,9 +3037,16 @@
3017 3037 if(get_option('wdk_recaptcha_site_key') !== FALSE && get_option('wdk_recaptcha_secret_key') !== NULL)
3018 3038 {
3019 3039 if($load_script && $counter===0)
3020 3040 {
3021 - echo "<script src='https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&amp;render=explicit'></script>";
3041 + wp_enqueue_script(
3042 + 'google-recaptcha-v2',
3043 + 'https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit',
3044 + array(),
3045 + null,
3046 + true
3047 + );
3048 +
3022 3049 }
3023 3050 $counter++;
3024 3051
3025 3052 $compact_tag='';
@@ -3031,15 +3058,15 @@
3031 3058 }
3032 3059
3033 3060 $recaptcha_array[$counter] = array('size'=>$size_tag);
3034 3061
3035 - echo '<div id="recaptcha_called_'.$counter.'" class="g-recaptcha" style="'.$style.'" '.$compact_tag.' data-sitekey="'.esc_attr(get_option('wdk_recaptcha_site_key')).'"></div>';
3062 + echo '<div id="recaptcha_called_'.esc_attr($counter).'" class="g-recaptcha" style="'.esc_attr($style).'" '.esc_attr($compact_tag).' data-sitekey="'.esc_attr(get_option('wdk_recaptcha_site_key')).'"></div>';
3036 3063 ?>
3037 3064
3038 3065 <script>
3039 3066 <?php if($counter===1)echo 'var ';?>CaptchaCallback = function(){
3040 3067 <?php for($j=1;$j<=$counter;$j++): ?>
3041 - grecaptcha.render(document.getElementById('recaptcha_called_<?php echo $j;?>'), {'size' : '<?php echo esc_attr($recaptcha_array[$j]['size']); ?>', 'sitekey' : '<?php echo esc_attr(get_option('wdk_recaptcha_site_key')); ?>'});
3068 + grecaptcha.render(document.getElementById('recaptcha_called_<?php echo esc_attr($j);?>'), {'size' : '<?php echo esc_attr($recaptcha_array[$j]['size']); ?>', 'sitekey' : '<?php echo esc_attr(get_option('wdk_recaptcha_site_key')); ?>'});
3042 3069 <?php endfor; ?>
3043 3070 };
3044 3071 </script>
3045 3072
@@ -3262,9 +3289,9 @@
3262 3289
3263 3290 if(is_array($filter_ids)) $filter_ids = implode(',', $filter_ids);
3264 3291
3265 3292 static $counter = 0;
3266 - $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.$name.'" data-table="'.$table.'" '.$attr.' data-placeholder="'.$empty_value.'" class="form-control select_ajax" id="wdk_select2_'.$counter.'" multiple="">';
3293 + $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.esc_attr($name).'" data-table="'.esc_attr($table).'" '.esc_attr($attr).' data-placeholder="'.esc_attr($empty_value).'" class="form-control select_ajax" id="wdk_select2_'.esc_attr($counter).'" multiple="">';
3267 3294
3268 3295
3269 3296 if(false)
3270 3297 if( $column_key == 'idcategory') {
@@ -3278,9 +3305,9 @@
3278 3305
3279 3306 $ids = array();
3280 3307 foreach($selected as $selected_item) {
3281 3308 if(!empty($selected_item)) {
3282 - $ids [] = $selected_item;
3309 + $ids [] = (int) $selected_item;
3283 3310 }
3284 3311 }
3285 3312
3286 3313 /* where in */
@@ -3291,8 +3318,10 @@
3291 3318
3292 3319 $results = $WMVC->$table->get();
3293 3320 foreach ($results as $item) {
3294 3321 if($item)
3322 + // Dynamic field values are registered in the translation catalog separately.
3323 + // phpcs:ignore WordPress.WP.I18n.NonSingularStringLiteralText
3295 3324 $form .= '<option selected="selected" value="'.esc_attr(wmvc_show_data($column_key, $item, false, TRUE, TRUE)).'">'.esc_html__(wmvc_show_data($column_print, $item, false, TRUE, TRUE),'wpdirectorykit').'</option>';
3296 3325 }
3297 3326 }
3298 3327 } elseif(is_intval($selected)) {
@@ -3297,8 +3326,10 @@
3297 3326 }
3298 3327 } elseif(is_intval($selected)) {
3299 3328 $db_item = $WMVC->$table->get($selected, TRUE);
3300 3329 if($db_item)
3330 + // Dynamic field values are registered in the translation catalog separately.
3331 + // phpcs:ignore WordPress.WP.I18n.NonSingularStringLiteralText
3301 3332 $form .= '<option selected="selected" value="'.esc_attr(wmvc_show_data($column_key, $db_item, false, TRUE, TRUE)).'">'.esc_html__(wmvc_show_data($column_print, $db_item, false, TRUE, TRUE),'wpdirectorykit').'</option>';
3302 3333 }
3303 3334 } else {
3304 3335 //$form .= '<option value="" selected="selected">'.esc_html__('Not selected', 'wpdirectorykit').'</option>';
@@ -4348,11 +4379,11 @@
4348 4379 $page_title,
4349 4380 $post_type
4350 4381 );
4351 4382 }
4352 -
4353 - $page = $wpdb->get_var( $sql );
4354 -
4383 + $page = $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
4384 +
4385 +
4355 4386 if ( $page ) {
4356 4387 return get_post( $page, $output );
4357 4388 }
4358 4389
@@ -4416,9 +4447,9 @@
4416 4447 $output .= '<tr>';
4417 4448 foreach($var as $k => $v) {
4418 4449 if(count($columns) > 0 && !in_array($k, $columns))continue;
4419 4450
4420 - $output .= '<td><strong>' . $k . '</strong></td>';
4451 + $output .= '<td><strong>' . esc_html($k) . '</strong></td>';
4421 4452 }
4422 4453 $output .= '</tr>';
4423 4454 }
4424 4455
@@ -4425,13 +4456,14 @@
4425 4456 $output .= '<tr>';
4426 4457 foreach($var as $k => $v) {
4427 4458 if(count($columns) > 0 && !in_array($k, $columns))continue;
4428 4459
4429 - $output .= '<td>' . $v . '</td>';
4460 + $output .= '<td>' . esc_html($v) . '</td>';
4430 4461 }
4431 4462 $output .= '</tr>';
4432 4463 }
4433 4464 $output .= '</table>';
4465 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText
4434 4466 echo $output;
4435 4467 }
4436 4468 }
4437 4469
@@ -4437,9 +4469,9 @@
4437 4469
4438 4470 if ( ! function_exists('wdk_move_gps'))
4439 4471 {
4440 4472 function wdk_move_gps($value) {
4441 - return $value+0.001 * rand(1, 9);
4473 + return $value+0.001 * wp_rand(1, 9);
4442 4474 }
4443 4475 }
4444 4476
4445 4477 if ( ! function_exists('wdk_get_near_location'))
@@ -4447,10 +4479,10 @@
4447 4479 function wdk_get_near_location($latitude, $longitude, $radius = 10000) {
4448 4480 // Convert radius from meters to degrees
4449 4481 $radiusInDegrees = $radius / 111000;
4450 4482
4451 - $u = mt_rand() / mt_getrandmax();
4452 - $v = mt_rand() / mt_getrandmax();
4483 + $u = wp_rand() / mt_getrandmax();
4484 + $v = wp_rand() / mt_getrandmax();
4453 4485 $w = $radiusInDegrees * sqrt($u);
4454 4486 $t = 2 * M_PI * $v;
4455 4487 $x = $w * cos($t);
4456 4488 $y = $w * sin($t);
@@ -4576,9 +4608,9 @@
4576 4608 // For french
4577 4609 $str = str_replace(array('â','é','è','û','ê', 'à','Â','ç','ï','î','ä','î'),
4578 4610 array('a','e','e','u','e', 'a','c','c','i','î','a','î'), $str);
4579 4611
4580 - $str = strip_tags(strtolower($str));
4612 + $str = wp_strip_all_tags(strtolower($str));
4581 4613
4582 4614
4583 4615 foreach ($trans as $key => $val)
4584 4616 {
@@ -5038,9 +5070,9 @@
5038 5070 {
5039 5071 $WMVC = &wdk_get_instance();
5040 5072
5041 5073 static $counter = 0;
5042 - $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.$name.'" data-id="'.$filter_id.'" data-placeholder="'.$empty_value.'" class="form-control wdk_select2_field_suggestion" id="wdk_select2_field_'.$filter_id.'_'.$counter.'" multiple="">';
5074 + $form = '<select data-ajax="'.esc_url(admin_url('admin-ajax.php')).'" name="'.$name.'" data-id="'.$filter_id.'" data-placeholder="'.$empty_value.'" class="form-control wdk_select2_field_suggestion" id="wdk_select2_field_'.$filter_id.'_'.$counter.'" multiple="">';
5043 5075 if($selected) {
5044 5076 if(is_array($selected)) {
5045 5077 /* where in */
5046 5078 foreach ($selected as $item) {
@@ -5079,10 +5111,10 @@
5079 5111 */
5080 5112 function wdk_next_month_payment_day($currentDate, $time = false, $wanted_day = NULL) {
5081 5113 $nextDate = null;
5082 5114 $timestamp = strtotime($currentDate);
5083 - $daysInNextMonth = date('t', strtotime('+1 month', strtotime(date('Y-m', $timestamp))));
5084 - $currentDay = (int)date('d', $timestamp);
5115 + $daysInNextMonth = gmdate('t', strtotime('+1 month', strtotime(gmdate('Y-m', $timestamp))));
5116 + $currentDay = (int)gmdate('d', $timestamp);
5085 5117
5086 5118 $timeFormat = $time ? "H:i:s" : "00:00:00";
5087 5119
5088 5120
@@ -5087,15 +5119,15 @@
5087 5119
5088 5120
5089 5121 // Determine the wanted day
5090 5122 if ($wanted_day !== NULL) {
5091 - $wanted_day = (int)date('d', strtotime($wanted_day));
5123 + $wanted_day = (int)gmdate('d', strtotime($wanted_day));
5092 5124 } else {
5093 - $wanted_day = (int)date('d', $timestamp);
5125 + $wanted_day = (int)gmdate('d', $timestamp);
5094 5126 }
5095 5127
5096 5128 $nextMonth = strtotime('first day of next month', $timestamp);
5097 - $daysInNextMonth = date('t', $nextMonth);
5129 + $daysInNextMonth = gmdate('t', $nextMonth);
5098 5130
5099 5131 // Adjust for the wanted day
5100 5132 if ($wanted_day > $daysInNextMonth ||
5101 5133 (
@@ -5101,17 +5133,17 @@
5101 5133 (
5102 5134 get_option('wdk_membership_next_month_calculation_with_last_day')
5103 5135
5104 5136 && (
5105 - $currentDay >= 30 || $currentDay == date('t', $timestamp)
5137 + $currentDay >= 30 || $currentDay == gmdate('t', $timestamp)
5106 5138 )
5107 5139 )
5108 5140 ) {
5109 5141 // If the wanted day exceeds the max days of the next month, use the last day of the month
5110 - $nextDate = date("Y-m-{$daysInNextMonth} {$timeFormat}", $nextMonth);
5142 + $nextDate = gmdate("Y-m-{$daysInNextMonth} {$timeFormat}", $nextMonth);
5111 5143 } else {
5112 5144 // Otherwise, set the exact wanted day
5113 - $nextDate = date("Y-m-{$wanted_day} {$timeFormat}", $nextMonth);
5145 + $nextDate = gmdate("Y-m-{$wanted_day} {$timeFormat}", $nextMonth);
5114 5146 }
5115 5147
5116 5148 return ($nextDate) ? $nextDate : false;
5117 5149 }
@@ -5128,19 +5160,19 @@
5128 5160
5129 5161 function wdk_next_year_payment_day($currentDate, $time = false) {
5130 5162 $nextDate = null;
5131 5163 $timestamp = strtotime($currentDate);
5132 - $nextYearTimestamp = strtotime('+1 year', strtotime(date('Y-m', $timestamp)));
5133 - $daysInNextMonth = date('t', $nextYearTimestamp);
5134 - $currentDay = date('j', $timestamp);
5164 + $nextYearTimestamp = strtotime('+1 year', strtotime(gmdate('Y-m', $timestamp)));
5165 + $daysInNextMonth = gmdate('t', $nextYearTimestamp);
5166 + $currentDay = gmdate('j', $timestamp);
5135 5167 $timeFormat = "00:00:00";
5136 5168 if($time) {
5137 5169 $timeFormat = "H:i:s";
5138 5170 }
5139 5171 if ($currentDay > $daysInNextMonth) {
5140 - $nextDate = date('Y-m-d '.$timeFormat, strtotime('last day of this month', $nextYearTimestamp));
5172 + $nextDate = gmdate('Y-m-d '.$timeFormat, strtotime('last day of this month', $nextYearTimestamp));
5141 5173 } else {
5142 - $nextDate = date('Y-m-d '.$timeFormat, strtotime('+1 year', $timestamp));
5174 + $nextDate = gmdate('Y-m-d '.$timeFormat, strtotime('+1 year', $timestamp));
5143 5175 }
5144 5176
5145 5177 return ($nextDate) ? $nextDate : false;
5146 5178 }
@@ -5292,10 +5324,10 @@
5292 5324 return apply_filters( 'wdk_render_elementor_template_output', $template_content, $layout_id, $post_data );
5293 5325 }
5294 5326
5295 5327 if(!function_exists('wdk_esc_sql')) {
5296 - function wdk_esc_sql ($value = '') {
5297 - return esc_sql(trim(preg_replace([
5328 + function wdk_esc_sql($value = '', $strict = false) {
5329 + $patterns = [
5298 5330 '/\bselect\b/i',
5299 5331 '/\binsert\b/i',
5300 5332 '/\bupdate\b/i',
5301 5333 '/\bdelete\b/i',
@@ -5309,13 +5341,112 @@
5309 5341 '/\bbenchmark\s*\(/i',
5310 5342 '/--/',
5311 5343 '/#/i',
5312 5344 '/\/\*/',
5313 -
5345 +
5314 5346 // EXTRA BLOCK YOU REQUESTED
5315 5347 '/\\\\/', // remove backslash \
5316 5348 '/\|/', // remove |
5317 5349 '/%/', // remove %
5318 - ], '', sanitize_text_field($value))));
5350 + ];
5351 +
5352 + // If strict mode is enabled, block additional patterns
5353 + if ($strict === true) {
5354 + $strict_patterns = [
5355 + '/\bif\b\s*\(/i',
5356 + '/\bord\b/i',
5357 + '/\bsubstr\s*\(/i',
5358 + '/\bschema\s*\(\)/i',
5359 + '/@@version/i',
5360 + ];
5361 + $patterns = array_merge($patterns, $strict_patterns);
5362 + }
5363 +
5364 + return esc_sql(trim(preg_replace($patterns, '', sanitize_text_field($value))));
5319 5365 }
5320 5366 }
5367 +
5368 + if(!function_exists('wdk_esc_sql_order_by')) {
5369 + function wdk_esc_sql_order_by($value = '', array $allowed_fields = [])
5370 + {
5371 + if (empty($value) || empty($allowed_fields)) {
5372 + return '';
5373 + }
5374 + $result = [];
5375 + foreach (explode(',', $value) as $part) {
5376 + $part = trim(sanitize_text_field($part));
5377 +
5378 + $direction = 'ASC';
5379 + if (preg_match('/\s+(ASC|DESC)$/i', $part, $match)) {
5380 + $direction = strtoupper($match[1]);
5381 + $part = trim(substr($part, 0, -strlen($match[0])));
5382 + }
5383 +
5384 + $part = sanitize_key($part);
5385 +
5386 + if (in_array($part, $allowed_fields, true)) {
5387 + $result[] = $part . ' ' . $direction;
5388 + }
5389 + }
5390 +
5391 + return implode(', ', $result);
5392 + }
5393 + }
5394 +
5395 + if(!function_exists('wdk_listing_seo_title')) {
5396 + function wdk_listing_seo_title () {
5397 + static $cached_seo_title = null;
5398 + if ($cached_seo_title !== null) {
5399 + return $cached_seo_title;
5400 + }
5401 +
5402 + $seo_title ='';
5403 + global $wp_query;
5404 + $wdk_listing_id = $wp_query->post->ID;
5405 + if(wdk_get_option('wdk_seo_listing_title')) {
5406 + global $Winter_MVC_WDK;
5407 + $Winter_MVC_WDK->model('field_m');
5408 + $Winter_MVC_WDK->load_helper('listing');
5409 +
5410 + $seo_template = wdk_get_option('wdk_seo_listing_title');
5411 +
5412 + $matches = [];
5413 + preg_match_all('/{(?:field_)?([^}]+)}/', $seo_template, $matches);
5414 + $fields_in_template = isset($matches[1]) ? $matches[1] : [];
5415 +
5416 + $fields_values = [];
5417 +
5418 + foreach ($fields_in_template as $field_id) {
5419 + $key_id = '{field_' . $field_id . '}';
5420 + if($field_id == 'category') {
5421 + $field_id = 'category_title';
5422 + }
5423 + if($field_id == 'location') {
5424 + $field_id = 'location_title';
5425 + }
5426 + // Try to get value for field_id for this listing
5427 + $fields_values[$key_id] = wdk_field_value($field_id, $wdk_listing_id);
5428 + }
5429 + // Replace the fields in template with real values
5430 + $seo_title = strtr($seo_template, $fields_values);
5431 + }
5432 +
5433 + $cached_seo_title = $seo_title;
5434 + return $seo_title;
5435 + }
5436 + }
5437 +
5438 +
5439 + if ( ! function_exists('wdk_filter_viber_phone'))
5440 + {
5441 + // Validation phone for viber
5442 + /**
5443 + * @param string $value phone in string
5444 + * @return strings +xxx
5445 + */
5446 + function wdk_filter_viber_phone($value = '') {
5447 + $value = str_replace(array(' ','-','(',')'),'',$value);
5448 + return (strpos($value, '+') !== 0) ? '+' . $value : $value;
5449 + }
5450 + }
5451 +
5321 5452 ?>