Skip to content

Commit f1d9485

Browse files
KingYesKingYes
authored
Tweak: Add output escaping, fixed: #194 (#208)
1 parent 55041c0 commit f1d9485

File tree

7 files changed

+39
-33
lines changed

7 files changed

+39
-33
lines changed

‎includes/admin-functions.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ function hello_elementor_fail_load_admin_notice() {
133133
} );</script>
134134
<div class="notice updated is-dismissible hello-elementor-notice hello-elementor-install-elementor">
135135
<div class="hello-elementor-notice-aside">
136-
<img src="<?php echo esc_url( get_template_directory_uri() ) . '/assets/images/elementor-notice-icon.svg'; ?>" alt="<?php _e( 'Get Elementor', 'hello-elementor' ); ?>" />
136+
<img src="<?php echo esc_url( get_template_directory_uri() ) . '/assets/images/elementor-notice-icon.svg'; ?>" alt="<?php esc_attr_e( 'Get Elementor', 'hello-elementor' ); ?>" />
137137
</div>
138138
<div class="hello-elementor-notice-inner">
139139
<div class="hello-elementor-notice-content">

‎includes/customizer/elementor-upsell.php

+2-8
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,10 @@ public function render_content() {
2323
$this->print_customizer_upsell();
2424

2525
if ( isset( $this->description ) ) {
26-
echo '<span class="description customize-control-description">' . $this->description . '</span>';
26+
echo '<span class="description customize-control-description">' . wp_kses_post( $this->description ) . '</span>';
2727
}
2828
}
2929

30-
/**
31-
* Customizer deeplinks HTML
32-
*
33-
* @return string HTML to use in the customizer panel
34-
*/
35-
3630
private function print_customizer_upsell() {
3731
if ( ! function_exists( 'get_plugins' ) ) {
3832
require_once ABSPATH . 'wp-admin/includes/plugin.php';
@@ -94,7 +88,7 @@ private function print_customizer_upsell() {
9488
);
9589
}
9690

97-
echo $customizer_content;
91+
echo wp_kses_post( $customizer_content );
9892
}
9993

10094
private function get_customizer_upsell_html( $title, $text, $url, $button_text, $image ) {

‎phpcs.xml

-3
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,11 @@
2727
<exclude name="WordPress.Arrays.MultipleStatementAlignment" />
2828
<exclude name="WordPress.CSRF.NonceVerification.NoNonceVerification" />
2929
<exclude name="WordPress.Files.FileName.InvalidClassFileName" />
30-
<exclude name="WordPress.Security.EscapeOutput.OutputNotEscaped"/>
31-
<exclude name="WordPress.Security.EscapeOutput.UnsafePrintingFunction" />
3230
<exclude name="WordPress.Security.NonceVerification.NoNonceVerification"/>
3331
<exclude name="WordPress.Security.NonceVerification.Missing"/>
3432
<exclude name="WordPress.WP.I18n.MissingTranslatorsComment" />
3533
<exclude name="WordPress.WP.I18n.NonSingularStringLiteralSingle" />
3634
<exclude name="WordPress.WP.I18n.NonSingularStringLiteralPlural" />
37-
<exclude name="WordPress.XSS.EscapeOutput.OutputNotEscaped" />
3835
<exclude name="WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet" />
3936
<exclude name="PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket" />
4037
<exclude name="PEAR.Functions.FunctionCallSignature.MultipleArguments" />

‎template-parts/dynamic-footer.php

+12-9
Original file line numberDiff line numberDiff line change
@@ -19,39 +19,42 @@
1919
'echo' => false,
2020
] );
2121
?>
22-
<footer id="site-footer" class="site-footer dynamic-footer <?php echo $footer_class; ?>" role="contentinfo">
22+
<footer id="site-footer" class="site-footer dynamic-footer <?php echo esc_attr( $footer_class ); ?>" role="contentinfo">
2323
<div class="footer-inner">
24-
<div class="site-branding show-<?php echo hello_elementor_get_setting( 'hello_footer_logo_type' ); ?>">
24+
<div class="site-branding show-<?php echo esc_attr( hello_elementor_get_setting( 'hello_footer_logo_type' ) ); ?>">
2525
<?php if ( has_custom_logo() && ( 'title' !== hello_elementor_get_setting( 'hello_footer_logo_type' ) || $is_editor ) ) : ?>
26-
<div class="site-logo <?php echo hello_show_or_hide( 'hello_footer_logo_display' ); ?>">
26+
<div class="site-logo <?php echo esc_attr( hello_show_or_hide( 'hello_footer_logo_display' ) ); ?>">
2727
<?php the_custom_logo(); ?>
2828
</div>
2929
<?php endif;
3030

3131
if ( $site_name && ( 'logo' !== hello_elementor_get_setting( 'hello_footer_logo_type' ) ) || $is_editor ) : ?>
32-
<h4 class="site-title <?php echo hello_show_or_hide( 'hello_footer_logo_display' ); ?>">
32+
<h4 class="site-title <?php echo esc_attr( hello_show_or_hide( 'hello_footer_logo_display' ) ); ?>">
3333
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" title="<?php esc_attr_e( 'Home', 'hello-elementor' ); ?>" rel="home">
3434
<?php echo esc_html( $site_name ); ?>
3535
</a>
3636
</h4>
3737
<?php endif;
3838

3939
if ( $tagline || $is_editor ) : ?>
40-
<p class="site-description <?php echo hello_show_or_hide( 'hello_footer_tagline_display' ); ?>">
40+
<p class="site-description <?php echo esc_attr( hello_show_or_hide( 'hello_footer_tagline_display' ) ); ?>">
4141
<?php echo esc_html( $tagline ); ?>
4242
</p>
4343
<?php endif; ?>
4444
</div>
4545

4646
<?php if ( $footer_nav_menu ) : ?>
47-
<nav class="site-navigation <?php echo hello_show_or_hide( 'hello_footer_menu_display' ); ?>" role="navigation">
48-
<?php echo $footer_nav_menu; ?>
47+
<nav class="site-navigation <?php echo esc_attr( hello_show_or_hide( 'hello_footer_menu_display' ) ); ?>" role="navigation">
48+
<?php
49+
// PHPCS - escaped by WordPress with "wp_nav_menu"
50+
echo $footer_nav_menu; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
51+
?>
4952
</nav>
5053
<?php endif; ?>
5154

5255
<?php if ( '' !== hello_elementor_get_setting( 'hello_footer_copyright_text' ) || $is_editor ) : ?>
53-
<div class="copyright <?php echo hello_show_or_hide( 'hello_footer_copyright_display' ); ?>">
54-
<p><?php echo hello_elementor_get_setting( 'hello_footer_copyright_text' ); ?></p>
56+
<div class="copyright <?php echo esc_attr( hello_show_or_hide( 'hello_footer_copyright_display' ) ); ?>">
57+
<p><?php echo wp_kses_post( hello_elementor_get_setting( 'hello_footer_copyright_text' ) ); ?></p>
5558
</div>
5659
<?php endif; ?>
5760
</div>

‎template-parts/dynamic-header.php

+15-9
Original file line numberDiff line numberDiff line change
@@ -24,40 +24,46 @@
2424
?>
2525
<header id="site-header" class="site-header dynamic-header <?php echo esc_attr( hello_get_header_layout_class() ); ?>" role="banner">
2626
<div class="header-inner">
27-
<div class="site-branding show-<?php echo hello_elementor_get_setting( 'hello_header_logo_type' ); ?>">
27+
<div class="site-branding show-<?php echo esc_attr( hello_elementor_get_setting( 'hello_header_logo_type' ) ); ?>">
2828
<?php if ( has_custom_logo() && ( 'title' !== hello_elementor_get_setting( 'hello_header_logo_type' ) || $is_editor ) ) : ?>
29-
<div class="site-logo <?php echo hello_show_or_hide( 'hello_header_logo_display' ); ?>">
29+
<div class="site-logo <?php echo esc_attr( hello_show_or_hide( 'hello_header_logo_display' ) ); ?>">
3030
<?php the_custom_logo(); ?>
3131
</div>
3232
<?php endif;
3333

3434
if ( $site_name && ( 'logo' !== hello_elementor_get_setting( 'hello_header_logo_type' ) || $is_editor ) ) : ?>
35-
<h1 class="site-title <?php echo hello_show_or_hide( 'hello_header_logo_display' ); ?>">
35+
<h1 class="site-title <?php echo esc_attr( hello_show_or_hide( 'hello_header_logo_display' ) ); ?>">
3636
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" title="<?php esc_attr_e( 'Home', 'hello-elementor' ); ?>" rel="home">
3737
<?php echo esc_html( $site_name ); ?>
3838
</a>
3939
</h1>
4040
<?php endif;
4141

4242
if ( $tagline && ( hello_elementor_get_setting( 'hello_header_tagline_display' ) || $is_editor ) ) : ?>
43-
<p class="site-description <?php echo hello_show_or_hide( 'hello_header_tagline_display' ); ?> ">
43+
<p class="site-description <?php echo esc_attr( hello_show_or_hide( 'hello_header_tagline_display' ) ); ?>">
4444
<?php echo esc_html( $tagline ); ?>
4545
</p>
4646
<?php endif; ?>
4747
</div>
4848

4949
<?php if ( $header_nav_menu ) : ?>
50-
<nav class="site-navigation <?php echo hello_show_or_hide( 'hello_header_menu_display' ); ?>" role="navigation">
51-
<?php echo $header_nav_menu; ?>
50+
<nav class="site-navigation <?php echo esc_attr( hello_show_or_hide( 'hello_header_menu_display' ) ); ?>" role="navigation">
51+
<?php
52+
// PHPCS - escaped by WordPress with "wp_nav_menu"
53+
echo $header_nav_menu; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
54+
?>
5255
</nav>
53-
<div class="site-navigation-toggle-holder <?php echo hello_show_or_hide( 'hello_header_menu_display' ); ?>">
56+
<div class="site-navigation-toggle-holder <?php echo esc_attr( hello_show_or_hide( 'hello_header_menu_display' ) ); ?>">
5457
<div class="site-navigation-toggle">
5558
<i class="eicon-menu-bar"></i>
5659
<span class="elementor-screen-only">Menu</span>
5760
</div>
5861
</div>
59-
<nav class="site-navigation-dropdown <?php echo hello_show_or_hide( 'hello_header_menu_display' ); ?>" role="navigation">
60-
<?php echo $header_nav_menu; ?>
62+
<nav class="site-navigation-dropdown <?php echo esc_attr( hello_show_or_hide( 'hello_header_menu_display' ) ); ?>" role="navigation">
63+
<?php
64+
// PHPCS - escaped by WordPress with "wp_nav_menu"
65+
echo $header_nav_menu; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
66+
?>
6167
</nav>
6268
<?php endif; ?>
6369
</div>

‎template-parts/footer.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@
1818
<footer id="site-footer" class="site-footer" role="contentinfo">
1919
<?php if ( $footer_nav_menu ) : ?>
2020
<nav class="site-navigation" role="navigation">
21-
<?php echo $footer_nav_menu; ?>
21+
<?php
22+
// PHPCS - escaped by WordPress with "wp_nav_menu"
23+
echo $footer_nav_menu; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
24+
?>
2225
</nav>
2326
<?php endif; ?>
2427
</footer>

‎template-parts/header.php

+5-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
] );
1818
?>
1919
<a class="skip-link screen-reader-text" href="#content">
20-
<?php _e( 'Skip to content', 'hello-elementor' ); ?></a>
20+
<?php esc_html_e( 'Skip to content', 'hello-elementor' ); ?></a>
2121

2222
<header id="site-header" class="site-header" role="banner">
2323

@@ -44,7 +44,10 @@
4444

4545
<?php if ( $header_nav_menu ) : ?>
4646
<nav class="site-navigation" role="navigation">
47-
<?php echo $header_nav_menu; ?>
47+
<?php
48+
// PHPCS - escaped by WordPress with "wp_nav_menu"
49+
echo $header_nav_menu; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
50+
?>
4851
</nav>
4952
<?php endif; ?>
5053
</header>

0 commit comments

Comments
 (0)