Skip to content

Commit 19458f6

Browse files
marcusquinnsuperdav42
marcusquinn
and
superdav42
authored
Fix WordPress.Security.EscapeOutput errors in payment and email templ… (#62)
* Fix WordPress.Security.EscapeOutput errors in payment and email templates --------- Co-authored-by: David Stone <david@nnucomputerwhiz.com>
1 parent 8e7fa84 commit 19458f6

File tree

7 files changed

+30
-30
lines changed

7 files changed

+30
-30
lines changed

‎views/dashboard-widgets/limits-and-quotas.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@
77
?>
88
<div class="wu-styling <?php echo esc_attr($className); ?>">
99

10-
<div class="<?php echo wu_env_picker('', 'wu-widget-inset'); ?>">
10+
<div class="<?php echo esc_attr(wu_env_picker('', 'wu-widget-inset')); ?>">
1111

1212
<!-- Title Element -->
13-
<div class="wu-p-4 wu-flex wu-items-center <?php echo wu_env_picker('', 'wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-b wu-border-gray-200'); ?>">
13+
<div class="wu-p-4 wu-flex wu-items-center <?php echo esc_attr(wu_env_picker('', 'wu-bg-gray-100 wu-border-solid wu-border-0 wu-border-b wu-border-gray-200')); ?>">
1414

1515
<?php if ($title) : ?>
1616

17-
<h3 class="wu-m-0 <?php echo wu_env_picker('', 'wu-widget-title'); ?>">
17+
<h3 class="wu-m-0 <?php echo esc_attr(wu_env_picker('', 'wu-widget-title')); ?>">
1818

1919
<?php echo esc_html($title); ?>
2020

@@ -25,7 +25,7 @@
2525
</div>
2626
<!-- Title Element - End -->
2727

28-
<ul class="wu-list-none wu-m-0 wu-p-4 wu-grid wu-gap-2 wu-row-gap-0 lg:wu-grid-cols-<?php echo esc_attr((int) $columns); ?> <?php echo wu_env_picker('', 'wu-p-4'); ?>">
28+
<ul class="wu-list-none wu-m-0 wu-p-4 wu-grid wu-gap-2 wu-row-gap-0 lg:wu-grid-cols-<?php echo esc_attr((int) $columns); ?> <?php echo esc_attr(wu_env_picker('', 'wu-p-4')); ?>">
2929

3030
<?php if ($post_type_limits->is_enabled()) : ?>
3131

@@ -66,7 +66,7 @@
6666

6767
<span class="wu-w-full wu-bg-gray-200 wu-rounded-full wu-h-1 wu-block wu-my-2">
6868

69-
<span class="<?php echo esc_attr(wu_get_random_color($index)); ?> wu-rounded-full wu-h-1 wu-block wu-my-1" style="width: <?php echo $width; ?>%;"></span>
69+
<span class="<?php echo esc_attr(wu_get_random_color($index)); ?> wu-rounded-full wu-h-1 wu-block wu-my-1" style="width: <?php echo esc_attr($width); ?>%;"></span>
7070

7171
</span>
7272

@@ -115,21 +115,21 @@
115115

116116
<?php esc_html_e('Unique Visits', 'wp-multisite-waas'); ?>
117117

118-
<?php echo wu_tooltip(sprintf(__('Next Reset: %s', 'wp-multisite-waas'), date_i18n(get_option('date_format', 'd/m/Y'), strtotime('last day of this month')))); ?>
118+
<?php echo wu_tooltip(sprintf(esc_html__('Next Reset: %s', 'wp-multisite-waas'), date_i18n(get_option('date_format', 'd/m/Y'), strtotime('last day of this month')))); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
119119

120120
</div>
121121

122122
<span class="wu-w-full wu-bg-gray-200 wu-rounded-full wu-h-1 wu-block wu-my-3">
123123

124-
<span class="wu-bg-orange-500 wu-rounded-full wu-h-1 wu-block wu-my-1" style="width: <?php echo $visits_width; ?>%;"></span>
124+
<span class="wu-bg-orange-500 wu-rounded-full wu-h-1 wu-block wu-my-1" style="width: <?php echo esc_attr($visits_width); ?>%;"></span>
125125

126126
</span>
127127

128128
<div class="wu-text-xs wu-text-gray-600 wu-align-middle">
129129

130130
<?php echo number_format($visits_count); ?>
131131
/
132-
<?php echo $visit_limitations->get_limit() == 0 ? __('Unlimited', 'wp-multisite-waas') : number_format((int) $visit_limitations->get_limit()); ?>
132+
<?php echo $visit_limitations->get_limit() == 0 ? esc_html__('Unlimited', 'wp-multisite-waas') : esc_html(number_format((int) $visit_limitations->get_limit())); ?>
133133

134134
</div>
135135

‎views/dynamic-styles/template-previewer.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,23 @@
66
*/
77
?>
88
body #switcher {
9-
background-color: #<?php echo $bg_color->getHex(); ?>;
10-
border-bottom: 5px solid <?php echo $bg_color->isDark() ? '#f9f9f9' : '#333'; ?>;
9+
background-color: #<?php echo esc_attr($bg_color->getHex()); ?>;
10+
border-bottom: 5px solid <?php echo esc_attr($bg_color->isDark() ? '#f9f9f9' : '#333'); ?>;
1111
}
1212

1313
#template_selector {
14-
color: <?php echo $bg_color->isDark() ? '#dfdfdf' : '#555'; ?>;
14+
color: <?php echo esc_attr($bg_color->isDark() ? '#dfdfdf' : '#555'); ?>;
1515
}
1616

1717
.responsive a {
18-
color: <?php echo $bg_color->isDark() ? '#fff' : '#444'; ?>
18+
color: <?php echo esc_attr($bg_color->isDark() ? '#fff' : '#444'); ?>
1919
}
2020

2121
.responsive a.active, .responsive a:hover {
22-
color: <?php echo $bg_color->isDark() ? '#fff' : '#444'; ?>
22+
color: <?php echo esc_attr($bg_color->isDark() ? '#fff' : '#444'); ?>
2323
}
2424

2525
.select-template a, .mobile-selector a {
26-
background-color: #<?php echo $button_bg_color->getHex(); ?>;
27-
color: <?php echo $button_bg_color->isDark() ? '#fff' : '#444'; ?>;
26+
background-color: #<?php echo esc_attr($button_bg_color->getHex()); ?>;
27+
color: <?php echo esc_attr($button_bg_color->isDark() ? '#fff' : '#444'); ?>;
2828
}

‎views/emails/admin/domain-created.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
?>
88
<p><?php esc_html_e('Hey there', 'wp-multisite-waas'); ?></p>
99

10-
<p><?php printf(__('A new domain, %2$s, was added to the site %3$s.', 'wp-multisite-waas'), '{{customer_name}}', '{{domain_domain}}', '{{site_title}}'); ?></p>
10+
<p><?php printf(esc_html__('A new domain, %2$s, was added to the site %3$s.', 'wp-multisite-waas'), '{{customer_name}}', '{{domain_domain}}', '{{site_title}}'); ?></p>
1111

1212
<h2><b><?php esc_html_e('Domain', 'wp-multisite-waas'); ?></b></h2>
1313

‎views/emails/admin/payment-received.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
?>
88
<p><?php esc_html_e('Hey there', 'wp-multisite-waas'); ?></p>
99

10-
<p><?php printf(__('We have great news! You received %1$s from %2$s (%3$s) for %4$s.', 'wp-multisite-waas'), '{{payment_total}}', '{{customer_name}}', '{{customer_user_email}}', '{{payment_product_names}}'); ?></p>
10+
<p><?php printf(esc_html__('We have great news! You received %1$s from %2$s (%3$s) for %4$s.', 'wp-multisite-waas'), '{{payment_total}}', '{{customer_name}}', '{{customer_user_email}}', '{{payment_product_names}}'); ?></p>
1111

1212
<p><a href="{{payment_invoice_url}}" style="text-decoration: none;" rel="nofollow"><?php esc_html_e('Download Invoice', 'wp-multisite-waas'); ?></a></p>
1313

‎views/events/widget-initiator.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515

1616
<?php if ($object->get_initiator() == 'manual') : ?>
1717

18-
<a href='<?php echo wu_network_admin_url('wp-ultimo-edit-customer', ['id' => $object->get_author_id()]); ?>' class='wu-table-card wu-text-gray-700 wu-p-2 wu-flex wu-flex-grow wu-rounded wu-items-center wu-border wu-border-solid wu-border-gray-300 wu-no-underline'>
18+
<a href='<?php echo esc_url(wu_network_admin_url('wp-ultimo-edit-customer', ['id' => $object->get_author_id()])); ?>' class='wu-table-card wu-text-gray-700 wu-p-2 wu-flex wu-flex-grow wu-rounded wu-items-center wu-border wu-border-solid wu-border-gray-300 wu-no-underline'>
1919

2020
<div class="wu-flex wu-relative wu-h-7 wu-w-7 wu-rounded-full wu-ring-2 wu-ring-white wu-bg-gray-300 wu-items-center wu-justify-center wu-mr-3">
2121

@@ -32,13 +32,13 @@
3232
]
3333
);
3434

35-
echo $avatar;
35+
echo $avatar; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
3636

3737
?>
3838

39-
<span role="tooltip" aria-label="<?php echo $object->get_initiator() . ' - ' . $object->get_severity_label(); ?>" class="wu-absolute wu-rounded-full wu--mb-2 wu--mr-2 wu-flex wu-items-center wu-justify-center wu-font-mono wu-bottom-0 wu-right-0 wu-font-bold wu-h-3 wu-w-3 wu-uppercase wu-text-2xs wu-p-1 wu-border-solid wu-border-2 wu-border-white <?php echo $object->get_severity_class(); ?>">
39+
<span role="tooltip" aria-label="<?php echo esc_attr($object->get_initiator().' - '.$object->get_severity_label()); ?>" class="wu-absolute wu-rounded-full wu--mb-2 wu--mr-2 wu-flex wu-items-center wu-justify-center wu-font-mono wu-bottom-0 wu-right-0 wu-font-bold wu-h-3 wu-w-3 wu-uppercase wu-text-2xs wu-p-1 wu-border-solid wu-border-2 wu-border-white <?php echo esc_attr($object->get_severity_class()); ?>">
4040

41-
<?php echo substr($object->get_severity_label(), 0, 1); ?>
41+
<?php echo esc_html(substr($object->get_severity_label(), 0, 1)); ?>
4242

4343
</span>
4444

@@ -62,9 +62,9 @@
6262

6363
<span class="dashicons-wu-tools wu-text-gray-700 wu-text-xl"></span>
6464

65-
<span role="tooltip" aria-label="<?php echo $object->get_initiator() . ' - ' . $object->get_severity_label(); ?>" class="wu-absolute wu-rounded-full wu--mb-2 wu--mr-2 wu-flex wu-items-center wu-justify-center wu-font-mono wu-bottom-0 wu-right-0 wu-font-bold wu-h-3 wu-w-3 wu-uppercase wu-text-2xs wu-p-1 wu-border-solid wu-border-2 wu-border-white <?php echo $object->get_severity_class(); ?>">
65+
<span role="tooltip" aria-label="<?php echo esc_attr($object->get_initiator().' - '.$object->get_severity_label()); ?>" class="wu-absolute wu-rounded-full wu--mb-2 wu--mr-2 wu-flex wu-items-center wu-justify-center wu-font-mono wu-bottom-0 wu-right-0 wu-font-bold wu-h-3 wu-w-3 wu-uppercase wu-text-2xs wu-p-1 wu-border-solid wu-border-2 wu-border-white <?php echo esc_attr($object->get_severity_class()); ?>">
6666

67-
<?php echo substr($object->get_severity_label(), 0, 1); ?>
67+
<?php echo esc_html(substr($object->get_severity_label(), 0, 1)); ?>
6868

6969
</span>
7070

@@ -98,11 +98,11 @@
9898

9999
switch ($type) {
100100
case 'membership':
101-
echo $base_list_table->column_membership($object);
101+
echo $base_list_table->column_membership($object); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
102102
break;
103103

104104
case 'payment':
105-
echo $base_list_table->column_payment($object);
105+
echo $base_list_table->column_payment($object); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
106106
break;
107107
}
108108

‎views/payments/line-item-actions.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747

4848
<span class="wu-ml-2 wu-text-gray-700">
4949

50-
<?php echo wu_format_currency($payment->get_refund_total(), $payment->get_currency()); ?>
50+
<?php echo esc_html(wu_format_currency($payment->get_refund_total(), $payment->get_currency())); ?>
5151

5252
</span>
5353

@@ -63,7 +63,7 @@
6363

6464
<span class="wu-ml-2">
6565

66-
<?php echo wu_format_currency($payment->get_total(), $payment->get_currency()); ?>
66+
<?php echo esc_html(wu_format_currency($payment->get_total(), $payment->get_currency())); ?>
6767

6868
</span>
6969

‎views/payments/tax-details.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@
1414

1515
<?php foreach ($tax_breakthrough as $tax_rate => $tax_total) : ?>
1616
<tr>
17-
<td><?php echo $tax_rate; ?>%</td>
18-
<td><?php echo wu_format_currency($tax_total); ?></td>
17+
<td><?php echo esc_html($tax_rate); ?>%</td>
18+
<td><?php echo esc_html(wu_format_currency($tax_total)); ?></td>
1919
</tr>
2020
<?php endforeach; ?>
2121

2222
<?php if ( ! empty($payment)) : ?>
2323
<tr>
2424
<td><span class="wu-font-bold wu-uppercase wu-text-xs wu-text-gray-700"><?php esc_html_e('Total', 'wp-multisite-waas'); ?></span></td>
25-
<td><?php echo wu_format_currency($payment->get_tax_total()); ?></td>
25+
<td><?php echo esc_html(wu_format_currency($payment->get_tax_total())); ?></td>
2626
</tr>
2727
<?php endif; ?>
2828

0 commit comments

Comments
 (0)