deploy: 3bed33f

joedolson · Jan 6, 2025 · 44a327c · 44a327c
1 parent d2a4cf0
commit 44a327c
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 3 deletions.
diff --git a/mc_after_settings.html b/mc_after_settings.html
@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line2060">line 2060</a>
+        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line2065">line 2065</a>
     </li></ul></dd>
 
 

diff --git a/mc_save_settings.html b/mc_save_settings.html
@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line643">line 643</a>
+        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line648">line 648</a>
     </li></ul></dd>
 
 

diff --git a/mc_settings_section_links.html b/mc_settings_section_links.html
@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line691">line 691</a>
+        <a href="my-calendar-settings.php.html">my-calendar-settings.php</a>, <a href="my-calendar-settings.php.html#line696">line 696</a>
     </li></ul></dd>
 
 

diff --git a/my-calendar-settings.php.html b/my-calendar-settings.php.html
@@ -463,7 +463,12 @@
 	// This is the &lt;title> element, and should not contain HTML.
 	$options['event_title_template'] = $post['mc_event_title_template'];
 	foreach ( $post as $key => $value ) {
+		$nonce = $_REQUEST['_wpnonce'];
+		if ( ! wp_verify_nonce( $nonce, 'my-calendar-nonce' ) ) {
+			wp_die( 'My Calendar: Security check failed' );
+		}
 		// If POST is set, change the sanitizing for settings in this group.
+		// The POST array was sanitized before being sent, but that sanitizing strips HTML.
 		$post[ $key ] = isset( $_POST[ $key ] ) ? wp_kses_post( wp_unslash( $_POST[ $key ] ) ) : $value;
 	}
 	$options['heading_text']        = isset( $_POST['mc_heading_text'] ) ? wp_kses_post( wp_unslash( $_POST['mc_heading_text'] ) ) : $post['mc_heading_text'];