| @@ -20,9 +20,9 @@ | ||
| 20 | 20 | include $field_view_path; |
| 21 | 21 | } |
| 22 | 22 | else |
| 23 | 23 | { |
| 24 | - echo __('Missing VIEW file:', 'wpdirectorykit').' '.esc_html($field_type).'.php'; | |
| 24 | + echo esc_html__('Missing VIEW file:', 'wpdirectorykit').' '.esc_html($field_type).'.php'; | |
| 25 | 25 | } |
| 26 | 26 | } |
| 27 | 27 | } |
| 28 | 28 | |
| @@ -190,8 +190,9 @@ | ||
| 190 | 190 | |
| 191 | 191 | } |
| 192 | 192 | |
| 193 | 193 | if($print){ |
| 194 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText | |
| 194 | 195 | echo $output; |
| 195 | 196 | return FALSE; |
| 196 | 197 | } |
| 197 | 198 | |
| @@ -359,8 +360,9 @@ | ||
| 359 | 360 | } |
| 360 | 361 | } |
| 361 | 362 | |
| 362 | 363 | if($print){ |
| 364 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText | |
| 363 | 365 | echo $output; |
| 364 | 366 | return FALSE; |
| 365 | 367 | } |
| 366 | 368 | |
| @@ -1191,9 +1193,8 @@ | ||
| 1191 | 1193 | $lang_term_id = pll_current_language('term_id'); |
| 1192 | 1194 | |
| 1193 | 1195 | if(is_numeric($lang_term_id)) |
| 1194 | 1196 | { |
| 1195 | - //echo $lang_term_id.'<br />'; | |
| 1196 | 1197 | $WMVC->db->join($WMVC->db->prefix.'term_relationships ON '.$WMVC->db->prefix.'posts.ID = '.$WMVC->db->prefix.'term_relationships.object_id', NULL, NULL); |
| 1197 | 1198 | $WMVC->db->where("({$WMVC->db->prefix}term_relationships.term_taxonomy_id = $lang_term_id)"); |
| 1198 | 1199 | } |
| 1199 | 1200 | } |
| @@ -1630,9 +1631,9 @@ | ||
| 1630 | 1631 | $detect_date = strtotime($gen_search); |
| 1631 | 1632 | |
| 1632 | 1633 | if(wdk_payments_is_date($val) && $detect_date > 1000) |
| 1633 | 1634 | { |
| 1634 | - $gen_search = date('Y-m-d H:i:s', $detect_date); | |
| 1635 | + $gen_search = gmdate('Y-m-d H:i:s', $detect_date); | |
| 1635 | 1636 | $gen_q.=$col_name." > '".$gen_search."' AND "; |
| 1636 | 1637 | } |
| 1637 | 1638 | else |
| 1638 | 1639 | { |
| @@ -1670,9 +1671,9 @@ | ||
| 1670 | 1671 | // order |
| 1671 | 1672 | if(isset($_GET_clone['order_by'])) |
| 1672 | 1673 | { |
| 1673 | 1674 | $_GET_clone['order_by'] = str_replace('post_id', $WMVC->db->prefix.'wdk_messages.post_id', $_GET_clone['order_by']); |
| 1674 | - $WMVC->db->order_by(wdk_esc_sql(sanitize_text_field($_GET_clone['order_by']))); | |
| 1675 | + $WMVC->db->order_by(wdk_esc_sql(sanitize_text_field($_GET_clone['order_by']), true)); | |
| 1675 | 1676 | } |
| 1676 | 1677 | |
| 1677 | 1678 | } |
| 1678 | 1679 | } |
| @@ -1679,9 +1680,9 @@ | ||
| 1679 | 1680 | |
| 1680 | 1681 | function wdk_date() { |
| 1681 | 1682 | $date_format = get_option('date_format'); |
| 1682 | 1683 | $time_format = get_option('time_format'); |
| 1683 | - $date = date("{$date_format} {$time_format}", current_time('timestamp')); | |
| 1684 | + $date = gmdate("{$date_format} {$time_format}", current_time('timestamp')); | |
| 1684 | 1685 | return $date; |
| 1685 | 1686 | } |
| 1686 | 1687 | |
| 1687 | 1688 | if(!function_exists('wdk_placeholder_image_src')) { |
| @@ -1833,9 +1834,9 @@ | ||
| 1833 | 1834 | } |
| 1834 | 1835 | |
| 1835 | 1836 | ?> |
| 1836 | 1837 | <div class="wdk-col wdk-col-btns"> |
| 1837 | - <div class="wdk-field wdk-field-btn"> | |
| 1838 | + <div class="wdk-field wdk-field-btn"> | |
| 1838 | 1839 | <div class="wdk-field-group wdk-field-group-additional"> |
| 1839 | 1840 | <button id="wdk-search-additional" type="button" class="wdk-search-additional-btn"><?php echo esc_html($wdk_text_more_button); ?><i class="wdk-toggle-icon"></i></button> |
| 1840 | 1841 | <input type='checkbox' style="display: none !important" value='1' <?php if(isset($_GET['wdk_search_additional_opened']) && wmvc_xss_clean($_GET['wdk_search_additional_opened']) == 1):?> checked <?php endif;?> name='wdk_search_additional_opened' /> |
| 1841 | 1842 | </div> |
| @@ -1841,14 +1842,19 @@ | ||
| 1841 | 1842 | </div> |
| 1842 | 1843 | <div class="wdk-field-group wdk-field-group-reset"> |
| 1843 | 1844 | <button title="<?php echo esc_attr__('Reset','wpdirectorykit');?>" id="wdk-reset-primary" type="reset" class="wdk-search-start wdk-search-reset wdk-click-load-animation"><?php echo esc_html($wdk_text_reset_button);?></button> |
| 1844 | 1845 | </div> |
| 1846 | + <?php if (function_exists('fpai_register_settings')):?> | |
| 1847 | + <div class="wdk-field-group wdk-field-group-ai-search"> | |
| 1848 | + <button title="<?php echo esc_attr__('Ai Search','wpdirectorykit');?>" type="button" class="wdk-ai-search"><?php echo esc_html__('Ai Search','wpdirectorykit');?></button> | |
| 1849 | + </div> | |
| 1850 | + <?php endif;?> | |
| 1845 | 1851 | <div class="wdk-field-group wdk-field-group-search"> |
| 1846 | 1852 | <button title="<?php echo esc_attr__('Search','wpdirectorykit');?>" id="wdk-start-primary" type="submit" class="wdk-search-start wdk-click-load-animation"> <?php echo esc_html($wdk_text_search_button);?> <i class="fa fa-spinner fa-spin fa-ajax-indicator" style="display: none;"></i> </button> |
| 1847 | 1853 | |
| 1848 | 1854 | <?php if(function_exists('run_wdk_save_search') && get_option('wdk_save_search_show_on_searchform')):?> |
| 1849 | 1855 | <div class="section-widget-control right"> |
| 1850 | - <a class="wdk-c-btn wdk-c-edit wdk-save-search-button" href="#" data-url="<?php echo esc_url(admin_url('admin-ajax.php')); ?>" title="<?php echo esc_attr_e('Save Search', 'selio'); ?>" target="_blank"> | |
| 1856 | + <a class="wdk-c-btn wdk-c-edit wdk-save-search-button" href="#" data-url="<?php echo esc_url(admin_url('admin-ajax.php')); ?>" title="<?php echo esc_attr__('Save Search', 'wpdirectorykit'); ?>" target="_blank"> | |
| 1851 | 1857 | <i class="fas fa-save" aria-hidden="true"></i> |
| 1852 | 1858 | <i class="fa fa-spinner fa-spin fa-ajax-indicator"></i> |
| 1853 | 1859 | </a> |
| 1854 | 1860 | </div> |
| @@ -1853,8 +1859,9 @@ | ||
| 1853 | 1859 | </a> |
| 1854 | 1860 | </div> |
| 1855 | 1861 | <?php endif;?> |
| 1856 | 1862 | </div> |
| 1863 | + | |
| 1857 | 1864 | </div> |
| 1858 | 1865 | </div> |
| 1859 | 1866 | <div id='wdk-form-additional' class="wdk-col" style="<?php echo esc_attr($form_closed) ;?>"> |
| 1860 | 1867 | <div class="wdk-row"> |
| @@ -1897,9 +1904,9 @@ | ||
| 1897 | 1904 | |
| 1898 | 1905 | if(empty($selected)) |
| 1899 | 1906 | $selected=''; |
| 1900 | 1907 | |
| 1901 | - $form = '<input name="'.$name.'" value="'.$selected.'" class="wdk-hidden" type="text" id="wdktreeelem'.$counter.'" readonly/>'; | |
| 1908 | + $form = '<input name="'.esc_attr($name).'" value="'.esc_attr($selected).'" class="wdk-hidden" type="text" id="wdktreeelem'.esc_attr($counter).'" readonly/>'; | |
| 1902 | 1909 | |
| 1903 | 1910 | $skip_id = ''; |
| 1904 | 1911 | //load javascript library |
| 1905 | 1912 | if($counter==0) |
| @@ -1906,40 +1913,39 @@ | ||
| 1906 | 1913 | { |
| 1907 | 1914 | wp_enqueue_script('wdk-treefield'); |
| 1908 | 1915 | wp_enqueue_style('wdk-treefield'); |
| 1909 | 1916 | } |
| 1910 | - ?> | |
| 1911 | - <script> | |
| 1912 | - jQuery(document).ready(function($) { | |
| 1913 | - $('#wdktreeelem<?php echo esc_js($counter);?>:not(.init)').wdkTreefield({ | |
| 1914 | - ajax_url: '<?php echo admin_url('admin-ajax.php'); ?>', | |
| 1917 | + wp_add_inline_script( | |
| 1918 | + 'wdk-treefield', | |
| 1919 | + "jQuery(document).ready(function($) { | |
| 1920 | + $('#wdktreeelem" . esc_js($counter) . ":not(.init)').wdkTreefield({ | |
| 1921 | + ajax_url: '" . esc_js(admin_url('admin-ajax.php')) . "', | |
| 1915 | 1922 | ajax_param: { |
| 1916 | - "page": 'wdk_frontendajax', | |
| 1917 | - "function": 'treefieldid', | |
| 1918 | - "action": 'wdk_public_action', | |
| 1919 | - "wdk_secure": '<?php echo wp_create_nonce( 'wdk_secure_treefieldid' );?>', | |
| 1920 | - "table": '<?php echo esc_js($table); ?>', | |
| 1921 | - "filter_ids": '<?php echo esc_js($filter_ids); ?>', | |
| 1922 | - "start_id": '<?php if(!empty($filter_ids)) esc_js($selected); else echo ""; ?>', | |
| 1923 | - "empty_value": '<?php echo esc_js($empty_value); ?>', | |
| 1924 | - "user_check": '<?php echo esc_js($user_check); ?>', | |
| 1925 | - "sql_where": '<?php echo esc_js($sql_where); ?>', | |
| 1926 | - "hide_fields": '<?php echo esc_js($hide_fields); ?>' | |
| 1927 | - }, | |
| 1928 | - attribute_id: '<?php echo esc_js($attribute_id); ?>', | |
| 1929 | - language_id: '<?php echo esc_js($language_id); ?>', | |
| 1930 | - attribute_value: '<?php echo esc_js($column); ?>', | |
| 1931 | - skip_id: '<?php echo esc_js($skip_id); ?>', | |
| 1923 | + page: 'wdk_frontendajax', | |
| 1924 | + function: 'treefieldid', | |
| 1925 | + action: 'wdk_public_action', | |
| 1926 | + wdk_secure: '" . esc_js(wp_create_nonce('wdk_secure_treefieldid')) . "', | |
| 1927 | + table: '" . esc_js($table) . "', | |
| 1928 | + filter_ids: '" . esc_js($filter_ids) . "', | |
| 1929 | + start_id: '" . (!empty($filter_ids) ? esc_js($selected) : "") . "', | |
| 1930 | + empty_value: '" . esc_js($empty_value) . "', | |
| 1931 | + user_check: '" . esc_js($user_check) . "', | |
| 1932 | + sql_where: '" . esc_js($sql_where) . "', | |
| 1933 | + hide_fields: '" . esc_js($hide_fields) . "' | |
| 1934 | + }, | |
| 1935 | + attribute_id: '" . esc_js($attribute_id) . "', | |
| 1936 | + language_id: '" . esc_js($language_id) . "', | |
| 1937 | + attribute_value: '" . esc_js($column) . "', | |
| 1938 | + skip_id: '', | |
| 1932 | 1939 | empty_value: ' - ', |
| 1933 | - text_search: '<?php esc_html_e('Search term', 'wpdirectorykit');?>', | |
| 1934 | - text_no_results: '<?php esc_html_e('No results found', 'wpdirectorykit');?>', | |
| 1940 | + text_search: '" . esc_html__('Search term', 'wpdirectorykit') . "', | |
| 1941 | + text_no_results: '" . esc_html__('No results found', 'wpdirectorykit') . "', | |
| 1935 | 1942 | callback_selected: function(key) { |
| 1936 | - $('#wdktreeelem<?php echo esc_js($counter);?>').trigger("change"); | |
| 1943 | + $('#wdktreeelem" . esc_js($counter) . "').trigger('change'); | |
| 1937 | 1944 | } |
| 1938 | 1945 | }).addClass('init'); |
| 1939 | - }); | |
| 1940 | - </script> | |
| 1941 | - <?php | |
| 1946 | + });" | |
| 1947 | + ); | |
| 1942 | 1948 | $counter++; |
| 1943 | 1949 | return $form; |
| 1944 | 1950 | } |
| 1945 | 1951 | } |
| @@ -2007,9 +2013,9 @@ | ||
| 2007 | 2013 | if(empty($values)) { |
| 2008 | 2014 | $values = $empty_value; |
| 2009 | 2015 | } |
| 2010 | 2016 | |
| 2011 | - $form = '<input name="'.$name.'" value="'.esc_html($selected).'" data-placehoder="'.esc_html($values).'" class="wdk-hidden" type="text" id="wdktreeelem_checkbox'.$counter.'" readonly/>'; | |
| 2017 | + $form = '<input name="'.esc_attr($name).'" value="'.esc_html($selected).'" data-placehoder="'.esc_html($values).'" class="wdk-hidden" type="text" id="wdktreeelem_checkbox'.esc_attr($counter).'" readonly/>'; | |
| 2012 | 2018 | |
| 2013 | 2019 | $skip_id = ''; |
| 2014 | 2020 | //load javascript library |
| 2015 | 2021 | if($counter==0) |
| @@ -2020,14 +2026,14 @@ | ||
| 2020 | 2026 | ?> |
| 2021 | 2027 | <script> |
| 2022 | 2028 | jQuery(document).ready(function($) { |
| 2023 | 2029 | $('#wdktreeelem_checkbox<?php echo esc_js($counter);?>:not(.init)').wdkTreefieldCheckboxes({ |
| 2024 | - ajax_url: '<?php echo admin_url('admin-ajax.php'); ?>', | |
| 2030 | + ajax_url: '<?php echo esc_url(admin_url('admin-ajax.php')); ?>', | |
| 2025 | 2031 | ajax_param: { |
| 2026 | 2032 | "page": 'wdk_frontendajax', |
| 2027 | 2033 | "function": 'treefieldid_checkboxes', |
| 2028 | 2034 | "action": 'wdk_public_action', |
| 2029 | - "wdk_secure": '<?php echo wp_create_nonce( 'wdk_secure_treefieldid_checkboxes' );?>', | |
| 2035 | + "wdk_secure": '<?php echo esc_js(wp_create_nonce( 'wdk_secure_treefieldid_checkboxes' ));?>', | |
| 2030 | 2036 | "table": '<?php echo esc_js($table); ?>', |
| 2031 | 2037 | "filter_ids": '<?php echo esc_js($filter_ids); ?>', |
| 2032 | 2038 | "empty_value": '<?php echo esc_js($empty_value); ?>', |
| 2033 | 2039 | "user_check": '<?php echo esc_js($user_check); ?>', |
| @@ -2196,9 +2202,9 @@ | ||
| 2196 | 2202 | } |
| 2197 | 2203 | |
| 2198 | 2204 | /* check is date on strtotime */ |
| 2199 | 2205 | if((bool)strtotime($date)){ |
| 2200 | - return date($return_format, strtotime($date)); | |
| 2206 | + return gmdate($return_format, strtotime($date)); | |
| 2201 | 2207 | } |
| 2202 | 2208 | |
| 2203 | 2209 | return false; |
| 2204 | 2210 | } |
| @@ -2252,9 +2258,9 @@ | ||
| 2252 | 2258 | return false; |
| 2253 | 2259 | } |
| 2254 | 2260 | |
| 2255 | 2261 | // Try to get filename from URL or headers |
| 2256 | - $filename = basename(parse_url($url, PHP_URL_PATH)); | |
| 2262 | + $filename = basename(wp_parse_url($url, PHP_URL_PATH)); | |
| 2257 | 2263 | |
| 2258 | 2264 | // If filename empty (Google Drive case) |
| 2259 | 2265 | if (!$filename || strpos($filename, '.') === false) { |
| 2260 | 2266 | // Try content-disposition header |
| @@ -2338,9 +2344,9 @@ | ||
| 2338 | 2344 | $data = getimagesizefromstring($response['body']); |
| 2339 | 2345 | if(!$data) return false; |
| 2340 | 2346 | if(empty($data['mime'])) return false; |
| 2341 | 2347 | |
| 2342 | - $filename = time().rand(0000,9999).'.'.wdk_mime2ext($data['mime']); | |
| 2348 | + $filename = time().wp_rand(0000,9999).'.'.wdk_mime2ext($data['mime']); | |
| 2343 | 2349 | } |
| 2344 | 2350 | $upload = wp_upload_bits( $filename, null, $response['body'] ); |
| 2345 | 2351 | |
| 2346 | 2352 | if( !empty( $upload['error'] ) ) { |
| @@ -2704,19 +2710,19 @@ | ||
| 2704 | 2710 | <!-- Your add & remove file links --> |
| 2705 | 2711 | <p class="hide-if-no-js"> |
| 2706 | 2712 | <a class="upload-custom-img <?php if ( $you_have_file ) { echo 'hidden'; } ?>" |
| 2707 | 2713 | href="<?php echo esc_url($upload_link) ?>"> |
| 2708 | - <?php echo esc_html__('Select file','wmvc_win') ?> | |
| 2714 | + <?php echo esc_html__('Select file','wpdirectorykit') ?> | |
| 2709 | 2715 | </a> |
| 2710 | 2716 | <a class="delete-custom-img <?php if ( ! $you_have_file ) { echo 'hidden'; } ?>" |
| 2711 | 2717 | href="#"> |
| 2712 | - <?php echo esc_html__('Remove all files','wmvc_win') ?> | |
| 2718 | + <?php echo esc_html__('Remove all files','wpdirectorykit') ?> | |
| 2713 | 2719 | </a> |
| 2714 | 2720 | </p> |
| 2715 | 2721 | <?php //endif; ?> |
| 2716 | 2722 | |
| 2717 | 2723 | <!-- A hidden input to set and post the chosen file id --> |
| 2718 | - <input class="logo_file_id" type="hidden" id="<?php echo esc_html($field_name); ?>" name="<?php echo esc_html($field_name); ?>" value="<?php echo esc_html($file_id); ?>" /> | |
| 2724 | + <input class="logo_file_id" type="hidden" id="<?php echo esc_attr($field_name); ?>" name="<?php echo esc_attr($field_name); ?>" value="<?php echo esc_attr($file_id); ?>" /> | |
| 2719 | 2725 | </div> |
| 2720 | 2726 | |
| 2721 | 2727 | <?php |
| 2722 | 2728 | $custom_js =''; |
| @@ -2724,8 +2730,9 @@ | ||
| 2724 | 2730 | if( typeof jQuery.fn.wpMediaElementFile == 'function') |
| 2725 | 2731 | $('#".esc_js($field_name)."meta-box-id.postbox-upload').wpMediaElementFile(); |
| 2726 | 2732 | });"; |
| 2727 | 2733 | |
| 2734 | +// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText | |
| 2728 | 2735 | echo "<script>".$custom_js."</script>"; |
| 2729 | 2736 | |
| 2730 | 2737 | ?> |
| 2731 | 2738 | |
| @@ -2776,10 +2783,10 @@ | ||
| 2776 | 2783 | function wdk_upload_multi_files($field_name, $image_ids='', $texts = array()) |
| 2777 | 2784 | { |
| 2778 | 2785 | static $media_element_counter = 0; |
| 2779 | 2786 | |
| 2780 | - if(!isset($texts['file_select']))$texts['file_select'] = esc_html__('Select file','wmvc_win'); | |
| 2781 | - if(!isset($texts['file_remove']))$texts['file_remove'] = esc_html__('Remove all files','wmvc_win'); | |
| 2787 | + if(!isset($texts['file_select']))$texts['file_select'] = esc_html__('Select file','wpdirectorykit'); | |
| 2788 | + if(!isset($texts['file_remove']))$texts['file_remove'] = esc_html__('Remove all files','wpdirectorykit'); | |
| 2782 | 2789 | |
| 2783 | 2790 | $media_element_counter++; |
| 2784 | 2791 | |
| 2785 | 2792 | $img_field = $field_name.'_'.$media_element_counter; |
| @@ -2821,9 +2828,9 @@ | ||
| 2821 | 2828 | <!-- Your image container, which can be manipulated with js --> |
| 2822 | 2829 | <div class="custom-img-container winter_mvc-media"> |
| 2823 | 2830 | <?php if($you_have_img)foreach($your_img_src as $image_id => $img_src) : ?> |
| 2824 | 2831 | <div class="winter_mvc-media-card" data-media-id="<?php echo esc_attr($image_id);?>"> |
| 2825 | - <img src="<?php echo esc_html($img_src); ?>" style="object-fit: contain;" alt="<?php echo esc_attr__('thumb', 'wmvc_win');?>" style="max-width:100%;" class="thumbnail"/> | |
| 2832 | + <img src="<?php echo esc_attr($img_src); ?>" style="object-fit: contain;" alt="<?php echo esc_attr__('thumb', 'wpdirectorykit');?>" style="max-width:100%;" class="thumbnail"/> | |
| 2826 | 2833 | <a href="#" class="remove"></a> |
| 2827 | 2834 | </div> |
| 2828 | 2835 | <?php endforeach; ?> |
| 2829 | 2836 | </div> |
| @@ -2843,9 +2850,9 @@ | ||
| 2843 | 2850 | </p> |
| 2844 | 2851 | <?php //endif; ?> |
| 2845 | 2852 | |
| 2846 | 2853 | <!-- A hidden input to set and post the chosen image id --> |
| 2847 | - <input class="logo_image_id" type="hidden" id="<?php echo esc_html(esc_html($field_name)); ?>" name="<?php echo esc_html($field_name); ?>" value="<?php echo esc_html($image_ids); ?>" /> | |
| 2854 | + <input class="logo_image_id" type="hidden" id="<?php echo esc_attr(esc_html($field_name)); ?>" name="<?php echo esc_attr($field_name); ?>" value="<?php echo esc_attr($image_ids); ?>" /> | |
| 2848 | 2855 | </div> |
| 2849 | 2856 | <?php |
| 2850 | 2857 | $custom_js =''; |
| 2851 | 2858 | $custom_js .=" jQuery(function($) { |
| @@ -2885,8 +2892,9 @@ | ||
| 2885 | 2892 | }) |
| 2886 | 2893 | }); |
| 2887 | 2894 | "; |
| 2888 | 2895 | |
| 2896 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText | |
| 2889 | 2897 | echo "<script>".$custom_js."</script>"; |
| 2890 | 2898 | |
| 2891 | 2899 | ?> |
| 2892 | 2900 | |
| @@ -2982,9 +2990,16 @@ | ||
| 2982 | 2990 | if($wdk_recaptcha_site_key && $wdk_recaptcha_secret_key) |
| 2983 | 2991 | { |
| 2984 | 2992 | if($load_script && $counter===0) |
| 2985 | 2993 | { |
| 2986 | - echo "<script src='https://www.google.com/recaptcha/api.js?render=".esc_attr(trim($wdk_recaptcha_site_key))."'></script>"; | |
| 2994 | + wp_enqueue_script( | |
| 2995 | + 'google-recaptcha-v3', | |
| 2996 | + 'https://www.google.com/recaptcha/api.js?render=' . esc_attr(trim($wdk_recaptcha_site_key)), | |
| 2997 | + array(), | |
| 2998 | + null, | |
| 2999 | + true | |
| 3000 | + ); | |
| 3001 | + | |
| 2987 | 3002 | } |
| 2988 | 3003 | $counter++; |
| 2989 | 3004 | ?> |
| 2990 | 3005 | <input type="hidden" name="g-recaptcha-response" id="recaptcha_called_v3_count_<?php echo esc_html($counter);?>"> |
| @@ -3022,9 +3037,16 @@ | ||
| 3022 | 3037 | if(get_option('wdk_recaptcha_site_key') !== FALSE && get_option('wdk_recaptcha_secret_key') !== NULL) |
| 3023 | 3038 | { |
| 3024 | 3039 | if($load_script && $counter===0) |
| 3025 | 3040 | { |
| 3026 | - echo "<script src='https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit'></script>"; | |
| 3041 | + wp_enqueue_script( | |
| 3042 | + 'google-recaptcha-v2', | |
| 3043 | + 'https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit', | |
| 3044 | + array(), | |
| 3045 | + null, | |
| 3046 | + true | |
| 3047 | + ); | |
| 3048 | + | |
| 3027 | 3049 | } |
| 3028 | 3050 | $counter++; |
| 3029 | 3051 | |
| 3030 | 3052 | $compact_tag=''; |
| @@ -3036,15 +3058,15 @@ | ||
| 3036 | 3058 | } |
| 3037 | 3059 | |
| 3038 | 3060 | $recaptcha_array[$counter] = array('size'=>$size_tag); |
| 3039 | 3061 | |
| 3040 | - echo '<div id="recaptcha_called_'.$counter.'" class="g-recaptcha" style="'.$style.'" '.$compact_tag.' data-sitekey="'.esc_attr(get_option('wdk_recaptcha_site_key')).'"></div>'; | |
| 3062 | + echo '<div id="recaptcha_called_'.esc_attr($counter).'" class="g-recaptcha" style="'.esc_attr($style).'" '.esc_attr($compact_tag).' data-sitekey="'.esc_attr(get_option('wdk_recaptcha_site_key')).'"></div>'; | |
| 3041 | 3063 | ?> |
| 3042 | 3064 | |
| 3043 | 3065 | <script> |
| 3044 | 3066 | <?php if($counter===1)echo 'var ';?>CaptchaCallback = function(){ |
| 3045 | 3067 | <?php for($j=1;$j<=$counter;$j++): ?> |
| 3046 | - grecaptcha.render(document.getElementById('recaptcha_called_<?php echo $j;?>'), {'size' : '<?php echo esc_attr($recaptcha_array[$j]['size']); ?>', 'sitekey' : '<?php echo esc_attr(get_option('wdk_recaptcha_site_key')); ?>'}); | |
| 3068 | + grecaptcha.render(document.getElementById('recaptcha_called_<?php echo esc_attr($j);?>'), {'size' : '<?php echo esc_attr($recaptcha_array[$j]['size']); ?>', 'sitekey' : '<?php echo esc_attr(get_option('wdk_recaptcha_site_key')); ?>'}); | |
| 3047 | 3069 | <?php endfor; ?> |
| 3048 | 3070 | }; |
| 3049 | 3071 | </script> |
| 3050 | 3072 | |
| @@ -3267,9 +3289,9 @@ | ||
| 3267 | 3289 | |
| 3268 | 3290 | if(is_array($filter_ids)) $filter_ids = implode(',', $filter_ids); |
| 3269 | 3291 | |
| 3270 | 3292 | static $counter = 0; |
| 3271 | - $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.$name.'" data-table="'.$table.'" '.$attr.' data-placeholder="'.$empty_value.'" class="form-control select_ajax" id="wdk_select2_'.$counter.'" multiple="">'; | |
| 3293 | + $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.esc_attr($name).'" data-table="'.esc_attr($table).'" '.esc_attr($attr).' data-placeholder="'.esc_attr($empty_value).'" class="form-control select_ajax" id="wdk_select2_'.esc_attr($counter).'" multiple="">'; | |
| 3272 | 3294 | |
| 3273 | 3295 | |
| 3274 | 3296 | if(false) |
| 3275 | 3297 | if( $column_key == 'idcategory') { |
| @@ -3283,9 +3305,9 @@ | ||
| 3283 | 3305 | |
| 3284 | 3306 | $ids = array(); |
| 3285 | 3307 | foreach($selected as $selected_item) { |
| 3286 | 3308 | if(!empty($selected_item)) { |
| 3287 | - $ids [] = $selected_item; | |
| 3309 | + $ids [] = (int) $selected_item; | |
| 3288 | 3310 | } |
| 3289 | 3311 | } |
| 3290 | 3312 | |
| 3291 | 3313 | /* where in */ |
| @@ -3296,8 +3318,10 @@ | ||
| 3296 | 3318 | |
| 3297 | 3319 | $results = $WMVC->$table->get(); |
| 3298 | 3320 | foreach ($results as $item) { |
| 3299 | 3321 | if($item) |
| 3322 | + // Dynamic field values are registered in the translation catalog separately. | |
| 3323 | + // phpcs:ignore WordPress.WP.I18n.NonSingularStringLiteralText | |
| 3300 | 3324 | $form .= '<option selected="selected" value="'.esc_attr(wmvc_show_data($column_key, $item, false, TRUE, TRUE)).'">'.esc_html__(wmvc_show_data($column_print, $item, false, TRUE, TRUE),'wpdirectorykit').'</option>'; |
| 3301 | 3325 | } |
| 3302 | 3326 | } |
| 3303 | 3327 | } elseif(is_intval($selected)) { |
| @@ -3302,8 +3326,10 @@ | ||
| 3302 | 3326 | } |
| 3303 | 3327 | } elseif(is_intval($selected)) { |
| 3304 | 3328 | $db_item = $WMVC->$table->get($selected, TRUE); |
| 3305 | 3329 | if($db_item) |
| 3330 | + // Dynamic field values are registered in the translation catalog separately. | |
| 3331 | + // phpcs:ignore WordPress.WP.I18n.NonSingularStringLiteralText | |
| 3306 | 3332 | $form .= '<option selected="selected" value="'.esc_attr(wmvc_show_data($column_key, $db_item, false, TRUE, TRUE)).'">'.esc_html__(wmvc_show_data($column_print, $db_item, false, TRUE, TRUE),'wpdirectorykit').'</option>'; |
| 3307 | 3333 | } |
| 3308 | 3334 | } else { |
| 3309 | 3335 | //$form .= '<option value="" selected="selected">'.esc_html__('Not selected', 'wpdirectorykit').'</option>'; |
| @@ -4353,11 +4379,11 @@ | ||
| 4353 | 4379 | $page_title, |
| 4354 | 4380 | $post_type |
| 4355 | 4381 | ); |
| 4356 | 4382 | } |
| 4357 | - | |
| 4358 | - $page = $wpdb->get_var( $sql ); | |
| 4359 | - | |
| 4383 | + $page = $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared | |
| 4384 | + | |
| 4385 | + | |
| 4360 | 4386 | if ( $page ) { |
| 4361 | 4387 | return get_post( $page, $output ); |
| 4362 | 4388 | } |
| 4363 | 4389 | |
| @@ -4421,9 +4447,9 @@ | ||
| 4421 | 4447 | $output .= '<tr>'; |
| 4422 | 4448 | foreach($var as $k => $v) { |
| 4423 | 4449 | if(count($columns) > 0 && !in_array($k, $columns))continue; |
| 4424 | 4450 | |
| 4425 | - $output .= '<td><strong>' . $k . '</strong></td>'; | |
| 4451 | + $output .= '<td><strong>' . esc_html($k) . '</strong></td>'; | |
| 4426 | 4452 | } |
| 4427 | 4453 | $output .= '</tr>'; |
| 4428 | 4454 | } |
| 4429 | 4455 | |
| @@ -4430,13 +4456,14 @@ | ||
| 4430 | 4456 | $output .= '<tr>'; |
| 4431 | 4457 | foreach($var as $k => $v) { |
| 4432 | 4458 | if(count($columns) > 0 && !in_array($k, $columns))continue; |
| 4433 | 4459 | |
| 4434 | - $output .= '<td>' . $v . '</td>'; | |
| 4460 | + $output .= '<td>' . esc_html($v) . '</td>'; | |
| 4435 | 4461 | } |
| 4436 | 4462 | $output .= '</tr>'; |
| 4437 | 4463 | } |
| 4438 | 4464 | $output .= '</table>'; |
| 4465 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.WP.I18n.NonSingularStringLiteralText | |
| 4439 | 4466 | echo $output; |
| 4440 | 4467 | } |
| 4441 | 4468 | } |
| 4442 | 4469 | |
| @@ -4442,9 +4469,9 @@ | ||
| 4442 | 4469 | |
| 4443 | 4470 | if ( ! function_exists('wdk_move_gps')) |
| 4444 | 4471 | { |
| 4445 | 4472 | function wdk_move_gps($value) { |
| 4446 | - return $value+0.001 * rand(1, 9); | |
| 4473 | + return $value+0.001 * wp_rand(1, 9); | |
| 4447 | 4474 | } |
| 4448 | 4475 | } |
| 4449 | 4476 | |
| 4450 | 4477 | if ( ! function_exists('wdk_get_near_location')) |
| @@ -4452,10 +4479,10 @@ | ||
| 4452 | 4479 | function wdk_get_near_location($latitude, $longitude, $radius = 10000) { |
| 4453 | 4480 | // Convert radius from meters to degrees |
| 4454 | 4481 | $radiusInDegrees = $radius / 111000; |
| 4455 | 4482 | |
| 4456 | - $u = mt_rand() / mt_getrandmax(); | |
| 4457 | - $v = mt_rand() / mt_getrandmax(); | |
| 4483 | + $u = wp_rand() / mt_getrandmax(); | |
| 4484 | + $v = wp_rand() / mt_getrandmax(); | |
| 4458 | 4485 | $w = $radiusInDegrees * sqrt($u); |
| 4459 | 4486 | $t = 2 * M_PI * $v; |
| 4460 | 4487 | $x = $w * cos($t); |
| 4461 | 4488 | $y = $w * sin($t); |
| @@ -4581,9 +4608,9 @@ | ||
| 4581 | 4608 | // For french |
| 4582 | 4609 | $str = str_replace(array('â','é','è','û','ê', 'à ','Â','ç','ï','î','ä','î'), |
| 4583 | 4610 | array('a','e','e','u','e', 'a','c','c','i','î','a','î'), $str); |
| 4584 | 4611 | |
| 4585 | - $str = strip_tags(strtolower($str)); | |
| 4612 | + $str = wp_strip_all_tags(strtolower($str)); | |
| 4586 | 4613 | |
| 4587 | 4614 | |
| 4588 | 4615 | foreach ($trans as $key => $val) |
| 4589 | 4616 | { |
| @@ -5043,9 +5070,9 @@ | ||
| 5043 | 5070 | { |
| 5044 | 5071 | $WMVC = &wdk_get_instance(); |
| 5045 | 5072 | |
| 5046 | 5073 | static $counter = 0; |
| 5047 | - $form = '<select data-ajax="'.admin_url('admin-ajax.php').'" name="'.$name.'" data-id="'.$filter_id.'" data-placeholder="'.$empty_value.'" class="form-control wdk_select2_field_suggestion" id="wdk_select2_field_'.$filter_id.'_'.$counter.'" multiple="">'; | |
| 5074 | + $form = '<select data-ajax="'.esc_url(admin_url('admin-ajax.php')).'" name="'.$name.'" data-id="'.$filter_id.'" data-placeholder="'.$empty_value.'" class="form-control wdk_select2_field_suggestion" id="wdk_select2_field_'.$filter_id.'_'.$counter.'" multiple="">'; | |
| 5048 | 5075 | if($selected) { |
| 5049 | 5076 | if(is_array($selected)) { |
| 5050 | 5077 | /* where in */ |
| 5051 | 5078 | foreach ($selected as $item) { |
| @@ -5084,10 +5111,10 @@ | ||
| 5084 | 5111 | */ |
| 5085 | 5112 | function wdk_next_month_payment_day($currentDate, $time = false, $wanted_day = NULL) { |
| 5086 | 5113 | $nextDate = null; |
| 5087 | 5114 | $timestamp = strtotime($currentDate); |
| 5088 | - $daysInNextMonth = date('t', strtotime('+1 month', strtotime(date('Y-m', $timestamp)))); | |
| 5089 | - $currentDay = (int)date('d', $timestamp); | |
| 5115 | + $daysInNextMonth = gmdate('t', strtotime('+1 month', strtotime(gmdate('Y-m', $timestamp)))); | |
| 5116 | + $currentDay = (int)gmdate('d', $timestamp); | |
| 5090 | 5117 | |
| 5091 | 5118 | $timeFormat = $time ? "H:i:s" : "00:00:00"; |
| 5092 | 5119 | |
| 5093 | 5120 | |
| @@ -5092,15 +5119,15 @@ | ||
| 5092 | 5119 | |
| 5093 | 5120 | |
| 5094 | 5121 | // Determine the wanted day |
| 5095 | 5122 | if ($wanted_day !== NULL) { |
| 5096 | - $wanted_day = (int)date('d', strtotime($wanted_day)); | |
| 5123 | + $wanted_day = (int)gmdate('d', strtotime($wanted_day)); | |
| 5097 | 5124 | } else { |
| 5098 | - $wanted_day = (int)date('d', $timestamp); | |
| 5125 | + $wanted_day = (int)gmdate('d', $timestamp); | |
| 5099 | 5126 | } |
| 5100 | 5127 | |
| 5101 | 5128 | $nextMonth = strtotime('first day of next month', $timestamp); |
| 5102 | - $daysInNextMonth = date('t', $nextMonth); | |
| 5129 | + $daysInNextMonth = gmdate('t', $nextMonth); | |
| 5103 | 5130 | |
| 5104 | 5131 | // Adjust for the wanted day |
| 5105 | 5132 | if ($wanted_day > $daysInNextMonth || |
| 5106 | 5133 | ( |
| @@ -5106,17 +5133,17 @@ | ||
| 5106 | 5133 | ( |
| 5107 | 5134 | get_option('wdk_membership_next_month_calculation_with_last_day') |
| 5108 | 5135 | |
| 5109 | 5136 | && ( |
| 5110 | - $currentDay >= 30 || $currentDay == date('t', $timestamp) | |
| 5137 | + $currentDay >= 30 || $currentDay == gmdate('t', $timestamp) | |
| 5111 | 5138 | ) |
| 5112 | 5139 | ) |
| 5113 | 5140 | ) { |
| 5114 | 5141 | // If the wanted day exceeds the max days of the next month, use the last day of the month |
| 5115 | - $nextDate = date("Y-m-{$daysInNextMonth} {$timeFormat}", $nextMonth); | |
| 5142 | + $nextDate = gmdate("Y-m-{$daysInNextMonth} {$timeFormat}", $nextMonth); | |
| 5116 | 5143 | } else { |
| 5117 | 5144 | // Otherwise, set the exact wanted day |
| 5118 | - $nextDate = date("Y-m-{$wanted_day} {$timeFormat}", $nextMonth); | |
| 5145 | + $nextDate = gmdate("Y-m-{$wanted_day} {$timeFormat}", $nextMonth); | |
| 5119 | 5146 | } |
| 5120 | 5147 | |
| 5121 | 5148 | return ($nextDate) ? $nextDate : false; |
| 5122 | 5149 | } |
| @@ -5133,19 +5160,19 @@ | ||
| 5133 | 5160 | |
| 5134 | 5161 | function wdk_next_year_payment_day($currentDate, $time = false) { |
| 5135 | 5162 | $nextDate = null; |
| 5136 | 5163 | $timestamp = strtotime($currentDate); |
| 5137 | - $nextYearTimestamp = strtotime('+1 year', strtotime(date('Y-m', $timestamp))); | |
| 5138 | - $daysInNextMonth = date('t', $nextYearTimestamp); | |
| 5139 | - $currentDay = date('j', $timestamp); | |
| 5164 | + $nextYearTimestamp = strtotime('+1 year', strtotime(gmdate('Y-m', $timestamp))); | |
| 5165 | + $daysInNextMonth = gmdate('t', $nextYearTimestamp); | |
| 5166 | + $currentDay = gmdate('j', $timestamp); | |
| 5140 | 5167 | $timeFormat = "00:00:00"; |
| 5141 | 5168 | if($time) { |
| 5142 | 5169 | $timeFormat = "H:i:s"; |
| 5143 | 5170 | } |
| 5144 | 5171 | if ($currentDay > $daysInNextMonth) { |
| 5145 | - $nextDate = date('Y-m-d '.$timeFormat, strtotime('last day of this month', $nextYearTimestamp)); | |
| 5172 | + $nextDate = gmdate('Y-m-d '.$timeFormat, strtotime('last day of this month', $nextYearTimestamp)); | |
| 5146 | 5173 | } else { |
| 5147 | - $nextDate = date('Y-m-d '.$timeFormat, strtotime('+1 year', $timestamp)); | |
| 5174 | + $nextDate = gmdate('Y-m-d '.$timeFormat, strtotime('+1 year', $timestamp)); | |
| 5148 | 5175 | } |
| 5149 | 5176 | |
| 5150 | 5177 | return ($nextDate) ? $nextDate : false; |
| 5151 | 5178 | } |
| @@ -5297,10 +5324,10 @@ | ||
| 5297 | 5324 | return apply_filters( 'wdk_render_elementor_template_output', $template_content, $layout_id, $post_data ); |
| 5298 | 5325 | } |
| 5299 | 5326 | |
| 5300 | 5327 | if(!function_exists('wdk_esc_sql')) { |
| 5301 | - function wdk_esc_sql ($value = '') { | |
| 5302 | - return esc_sql(trim(preg_replace([ | |
| 5328 | + function wdk_esc_sql($value = '', $strict = false) { | |
| 5329 | + $patterns = [ | |
| 5303 | 5330 | '/\bselect\b/i', |
| 5304 | 5331 | '/\binsert\b/i', |
| 5305 | 5332 | '/\bupdate\b/i', |
| 5306 | 5333 | '/\bdelete\b/i', |
| @@ -5314,14 +5341,55 @@ | ||
| 5314 | 5341 | '/\bbenchmark\s*\(/i', |
| 5315 | 5342 | '/--/', |
| 5316 | 5343 | '/#/i', |
| 5317 | 5344 | '/\/\*/', |
| 5318 | - | |
| 5345 | + | |
| 5319 | 5346 | // EXTRA BLOCK YOU REQUESTED |
| 5320 | 5347 | '/\\\\/', // remove backslash \ |
| 5321 | 5348 | '/\|/', // remove | |
| 5322 | 5349 | '/%/', // remove % |
| 5323 | - ], '', sanitize_text_field($value)))); | |
| 5350 | + ]; | |
| 5351 | + | |
| 5352 | + // If strict mode is enabled, block additional patterns | |
| 5353 | + if ($strict === true) { | |
| 5354 | + $strict_patterns = [ | |
| 5355 | + '/\bif\b\s*\(/i', | |
| 5356 | + '/\bord\b/i', | |
| 5357 | + '/\bsubstr\s*\(/i', | |
| 5358 | + '/\bschema\s*\(\)/i', | |
| 5359 | + '/@@version/i', | |
| 5360 | + ]; | |
| 5361 | + $patterns = array_merge($patterns, $strict_patterns); | |
| 5362 | + } | |
| 5363 | + | |
| 5364 | + return esc_sql(trim(preg_replace($patterns, '', sanitize_text_field($value)))); | |
| 5365 | + } | |
| 5366 | + } | |
| 5367 | + | |
| 5368 | + if(!function_exists('wdk_esc_sql_order_by')) { | |
| 5369 | + function wdk_esc_sql_order_by($value = '', array $allowed_fields = []) | |
| 5370 | + { | |
| 5371 | + if (empty($value) || empty($allowed_fields)) { | |
| 5372 | + return ''; | |
| 5373 | + } | |
| 5374 | + $result = []; | |
| 5375 | + foreach (explode(',', $value) as $part) { | |
| 5376 | + $part = trim(sanitize_text_field($part)); | |
| 5377 | + | |
| 5378 | + $direction = 'ASC'; | |
| 5379 | + if (preg_match('/\s+(ASC|DESC)$/i', $part, $match)) { | |
| 5380 | + $direction = strtoupper($match[1]); | |
| 5381 | + $part = trim(substr($part, 0, -strlen($match[0]))); | |
| 5382 | + } | |
| 5383 | + | |
| 5384 | + $part = sanitize_key($part); | |
| 5385 | + | |
| 5386 | + if (in_array($part, $allowed_fields, true)) { | |
| 5387 | + $result[] = $part . ' ' . $direction; | |
| 5388 | + } | |
| 5389 | + } | |
| 5390 | + | |
| 5391 | + return implode(', ', $result); | |
| 5324 | 5392 | } |
| 5325 | 5393 | } |
| 5326 | 5394 | |
| 5327 | 5395 | if(!function_exists('wdk_listing_seo_title')) { |
