deploy: 633aa01

mc_add_events_url.html

@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1334">line 1334</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1332">line 1332</a>
     </li></ul></dd>
 
 
@@ -304,7 +304,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1409">line 1409</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1407">line 1407</a>
     </li></ul></dd>
 
 

mc_adminbar_uri.html

@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1350">line 1350</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1348">line 1348</a>
     </li></ul></dd>
 
 

mc_convert_locations_select_to_autocomplete.html

@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1930">line 1930</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1928">line 1928</a>
     </li></ul></dd>
 
 

mc_custom_spam_status.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1639">line 1639</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1637">line 1637</a>
     </li></ul></dd>
 
 

mc_customize_email_headers.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1575">line 1575</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1573">line 1573</a>
     </li></ul></dd>
 
 

mc_disable_mobile_js.html

@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line718">line 718</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line717">line 717</a>
     </li></ul></dd>
 
 

mc_disable_spam_checking.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1628">line 1628</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1626">line 1626</a>
     </li></ul></dd>
 
 

mc_event_mail_bcc.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1555">line 1555</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1553">line 1553</a>
     </li></ul></dd>
 
 

mc_event_mail_body.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1597">line 1597</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1595">line 1595</a>
     </li></ul></dd>
 
 

mc_event_mail_from.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1543">line 1543</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1541">line 1541</a>
     </li></ul></dd>
 
 

mc_event_mail_subject.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1586">line 1586</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1584">line 1584</a>
     </li></ul></dd>
 
 

mc_event_mail_to.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1531">line 1531</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1529">line 1529</a>
     </li></ul></dd>
 
 

mc_get_current_url.html

@@ -134,7 +134,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line991">line 991</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line989">line 989</a>
     </li></ul></dd>
 
 

mc_registered_stylesheet.html

@@ -304,7 +304,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line871">line 871</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line870">line 870</a>
     </li></ul></dd>
 
 

mc_send_notification.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1516">line 1516</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line1514">line 1514</a>
     </li></ul></dd>
 
 

mc_setup_allowed_sites.html

@@ -157,7 +157,7 @@ <h5>Parameters:</h5>
 
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line2488">line 2488</a>
+        <a href="my-calendar-core.php.html">my-calendar-core.php</a>, <a href="my-calendar-core.php.html#line2486">line 2486</a>
     </li></ul></dd>
 
 

my-calendar-core.php.html

@@ -537,8 +537,7 @@
  */
 function mc_enqueue_calendar_print_styles() {
 	$css = mc_generate_css();
-	$css = wp_filter_nohtml_kses( $css );
-	echo '<style>' . $css . '</style>';
+	echo '<style>' . wp_filter_nohtml_kses( $css ) . '</style>';
 }
 add_action( 'mc_print_view_head', 'mc_enqueue_calendar_print_styles' );
 
@@ -728,7 +727,7 @@
 	if ( ! is_wp_error( $response ) || is_array( $response ) ) {
 		$data = $response['body'];
 		$bits = explode( '== Upgrade Notice ==', $data );
-		echo '</div><div id="mc-upgrade" class="notice inline notice-warning"><ul><li><strong style="color:#c22;">Upgrade Notes:</strong> ' . str_replace( '* ', '', nl2br( trim( $bits[1] ) ) ) . '</li></ul>';
+		echo '</div><div id="mc-upgrade" class="notice inline notice-warning"><ul><li><strong style="color:#c22;">Upgrade Notes:</strong> ' . esc_html( str_replace( '* ', '', nl2br( trim( $bits[1] ) ) ) ) . '</li></ul>';
 	}
 }
 
@@ -961,16 +960,15 @@
 	if ( '' !== $style_vars ) {
 		$style_vars = '.mc-main {' . $style_vars . $category_vars . '}';
 	}
-
-	$all_styles = "
+	?>
 <style>
-<!--
 /* Styles by My Calendar - Joseph C Dolson https://www.joedolson.com/ */
-$category_styles
-$style_vars
--->
-</style>";
-	echo $all_styles;
+	<?php
+	echo wp_filter_nohtml_kses( $category_styles );
+	echo wp_filter_nohtml_kses( $style_vars );
+	?>
+</style>
+	<?php
 }
 add_action( 'admin_head', 'mc_admin_head' );
 
@@ -2245,7 +2243,7 @@
 
 		?>
 		<form method="post" action="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-help' ) ); ?>">
-			<div><input type="hidden" name="_wpnonce" value="<?php echo wp_create_nonce( 'my-calendar-nonce' ); ?>" /></div>
+			<div><input type="hidden" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( 'my-calendar-nonce' ) ); ?>" /></div>
 			<div>
 			<code><?php echo esc_html( __( 'From:', 'my-calendar' ) . " \"$current_user->display_name\" <$current_user->user_email>" ); ?></code>
 			</p>
@@ -2609,7 +2607,7 @@
 		$upgrade = 'https://www.joedolson.com/awesome/my-calendar-pro/';
 		$dismiss = admin_url( 'admin.php?page=my-calendar-config&dismiss=promotion' );
 		// Translators: URL to upgrade.
-		echo "<div class='notice mc-promotion'><p><img src='" . plugins_url( 'images/awd-logo-disc.png', __FILE__ ) . "' alt='Joe Dolson Accessible Web Design' /><span>" . sprintf( __( 'I hope you\'ve enjoyed <strong>My Calendar</strong>! Take a look at <a href=\'%1$s\'>upgrading to My Calendar Pro</a> for advanced event management with WordPress! <a href=\'%2$s\' class="button-secondary">Dismiss</a>', 'my-calendar' ), $upgrade, $dismiss ) . '</span></p></div>';
+		echo "<div class='notice mc-promotion'><p><img src='" . esc_url( plugins_url( 'images/awd-logo-disc.png', __FILE__ ) ) . "' alt='Joe Dolson Accessible Web Design' /><span>" . wp_kses_post( sprintf( __( 'I hope you\'ve enjoyed <strong>My Calendar</strong>! Take a look at <a href=\'%1$s\'>upgrading to My Calendar Pro</a> for advanced event management with WordPress! <a href=\'%2$s\' class="button-secondary">Dismiss</a>', 'my-calendar' ), esc_url( $upgrade ), esc_url( $dismiss ) ) ) . '</span></p></div>';
 	}
 }
 add_action( 'admin_notices', 'mc_promotion_notice', 10 );

my-calendar-help.php.html

@@ -65,24 +65,24 @@
 				<ul class='list'>
 					<?php
 					if ( ! mc_get_uri( 'boolean' ) ) {
-						echo '<li>' . __( 'Add the My Calendar shortcode (<code>[my_calendar]</code>) to a page.', 'my-calendar' ) . '</li>';
-						echo '<li>' . __( 'Assign your Calendar Page Location at <code>My Calendar > Settings > General</code>', 'my-calendar' ) . '</li>';
+						echo '<li>' . wp_kses_post( __( 'Add the My Calendar shortcode (<code>[my_calendar]</code>) to a page.', 'my-calendar' ) ) . '</li>';
+						echo '<li>' . wp_kses_post( __( 'Assign your Calendar Page Location at <code>My Calendar > Settings > General</code>', 'my-calendar' ) ) . '</li>';
 					} else {
 						$permalink = mc_get_uri();
 						$edit_url  = get_edit_post_link( absint( mc_get_option( 'uri_id' ) ) );
 						// Translators: Calendar link, calendar edit link.
-						echo '<li>' . sprintf( __( '<a href="%1$s">View your calendar</a> or <a href="%2$s">Edit the calendar page</a>', 'my-calendar' ), esc_url( $permalink ), esc_url( $edit_url ) ) . '</li>';
+						echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">View your calendar</a> or <a href="%2$s">Edit the calendar page</a>', 'my-calendar' ), esc_url( $permalink ), esc_url( $edit_url ) ) ) . '</li>';
 					}
 					$add_categories = admin_url( 'admin.php?page=my-calendar-categories' );
 					$add_locations  = admin_url( 'admin.php?page=my-calendar-locations' );
 					$edit_events    = admin_url( 'admin.php?page=my-calendar-manage' );
 					$add_events     = admin_url( 'admin.php?page=my-calendar' );
 					// Translators: Add events link, manage events link.
-					echo '<li>' . sprintf( __( '<a href="%1$s">Add events</a> and <a href="%2$s">administer your events</a>.', 'my-calendar' ), esc_url( $add_events ), esc_url( $edit_events ) ) . '</li>';
+					echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">Add events</a> and <a href="%2$s">administer your events</a>.', 'my-calendar' ), esc_url( $add_events ), esc_url( $edit_events ) ) ) . '</li>';
 					// Translators: Add categories link, add locations link.
-					echo '<li>' . sprintf( __( '<a href="%1$s">Add categories</a> and <a href="%2$s">add locations</a>.', 'my-calendar' ), esc_url( $add_categories ), esc_url( $add_locations ) ) . '</li>';
+					echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">Add categories</a> and <a href="%2$s">add locations</a>.', 'my-calendar' ), esc_url( $add_categories ), esc_url( $add_locations ) ) ) . '</li>';
 					// Translators: Documentation URL.
-					echo '<li>' . sprintf( __( 'When you\'re ready, <a href="%s">read the documentation</a>.', 'my-calendar' ), 'https://docs.joedolson.com/my-calendar/' ) . '</li>';
+					echo '<li>' . wp_kses_post( sprintf( __( 'When you\'re ready, <a href="%s">read the documentation</a>.', 'my-calendar' ), 'https://docs.joedolson.com/my-calendar/' ) ) . '</li>';
 					?>
 				</ul>
 				<?php
@@ -103,31 +103,31 @@
 
 			<div class="inside">
 				<h3><?php esc_html_e( 'Custom Styles Locations', 'my-calendar' ); ?></h3>
-				<p><?php _e( 'My Calendar custom style files can be saved in any of these locations. CSS files in these locations will be selectable from the stylesheet selector.', 'my-calendar' ); ?></p>
+				<p><?php esc_html_e( 'My Calendar custom style files can be saved in any of these locations. CSS files in these locations will be selectable from the stylesheet selector.', 'my-calendar' ); ?></p>
 				<ul>
 					<?php
 					foreach ( mc_custom_dirs() as $dir ) {
-						echo "<li><code>$dir</code></li>";
+						echo '<li><code>' . esc_html( $dir ) . '</code></li>';
 					}
 					?>
 				</ul>
 				<p>
 					<?php
 					printf(
 						// translators: print CSS file name, mobile CSS file name, tablet CSS file name.
-						__( 'Custom print, mobile, and tablet stylesheet file names: %1$s, %2$s, and %3$s.', 'my-calendar' ),
+						esc_html__( 'Custom print, mobile, and tablet stylesheet file names: %1$s, %2$s, and %3$s.', 'my-calendar' ),
 						'<code>mc-print.css</code>',
 						'<code>mc-mobile.css</code>',
 						'<code>mc-tablet.css</code>'
 					)
 					?>
 				</p>
 				<h3><?php esc_html_e( 'Custom Template Locations', 'my-calendar' ); ?></h3>
-				<p><?php _e( 'Default My Calendar templates are found in <code>/wp-content/my-calendar/mc-templates/</code>. Copy those templates into a <code>/mc-templates/</code> directory in your theme to customize.', 'my-calendar' ); ?></p>
-				<p><?php _e( 'Legacy My Calendar templates can be loaded as text files (.txt) from any of the allowed style directory locations.', 'my-calendar' ); ?></p>
+				<p><?php echo wp_kses_post( __( 'Default My Calendar templates are found in <code>/wp-content/my-calendar/mc-templates/</code>. Copy those templates into a <code>/mc-templates/</code> directory in your theme to customize.', 'my-calendar' ) ); ?></p>
+				<p><?php esc_html_e( 'Legacy My Calendar templates can be loaded as text files (.txt) from any of the allowed style directory locations.', 'my-calendar' ); ?></p>
 				<h3><?php esc_html_e( 'Custom Icons Location', 'my-calendar' ); ?></h3>
 				<ul>
-					<li><code><?php echo str_replace( '/my-calendar', '', plugin_dir_path( __FILE__ ) ) . 'my-calendar-custom/icons/'; ?></code></li>
+					<li><code><?php echo esc_html( str_replace( '/my-calendar', '', plugin_dir_path( __FILE__ ) ) ) . 'my-calendar-custom/icons/'; ?></code></li>
 				</ul>
 			</div>
 		</div>
@@ -140,21 +140,21 @@
 			<div class="inside">
 				<h3><?php esc_html_e( 'Data Collection by My Calendar', 'my-calendar' ); ?></h3>
 				<p>
-					<?php _e( 'My Calendar collects no personally identifying data.', 'my-calendar' ); ?>
+					<?php esc_html_e( 'My Calendar collects no personally identifying data.', 'my-calendar' ); ?>
 				</p>
 				<p>
-					<?php _e( 'My Calendar Pro, when installed, collects submitter names and email addresses when a public user submits an event from any public event submission form.', 'my-calendar' ); ?>
+					<?php esc_html_e( 'My Calendar Pro, when installed, collects submitter names and email addresses when a public user submits an event from any public event submission form.', 'my-calendar' ); ?>
 				</p>
 				<h3><?php esc_html_e( 'Data Sharing by My Calendar', 'my-calendar' ); ?></h3>
 				<p>
-					<?php _e( 'The names and email addresses of people who author or host events are shared by My Calendar as part of the API output and iCal formatted event output. This data is sourced from user profiles, and will be destroyed or exported with that information.', 'my-calendar' ); ?>
+					<?php esc_html_e( 'The names and email addresses of people who author or host events are shared by My Calendar as part of the API output and iCal formatted event output. This data is sourced from user profiles, and will be destroyed or exported with that information.', 'my-calendar' ); ?>
 				</p>
 				<p>
-					<?php _e( 'Events submitted by public users from any public event submission form using My Calendar Pro include names and emails as part of the event data. This data is destroyed when the event is deleted.', 'my-calendar' ); ?>
+					<?php esc_html_e( 'Events submitted by public users from any public event submission form using My Calendar Pro include names and emails as part of the event data. This data is destroyed when the event is deleted.', 'my-calendar' ); ?>
 				</p>
 				<h3><?php esc_html_e( 'Data Removal in My Calendar', 'my-calendar' ); ?></h3>
 				<p>
-					<?php _e( 'My Calendar supports the data export and removal features in WordPress 4.9.6 and later. When a data removal is requested, all events authored using the requested email address will be deleted. All events with that user assigned only as the host will remain, but the host will be changed.', 'my-calendar' ); ?>
+					<?php esc_html_e( 'My Calendar supports the data export and removal features in WordPress 4.9.6 and later. When a data removal is requested, all events authored using the requested email address will be deleted. All events with that user assigned only as the host will remain, but the host will be changed.', 'my-calendar' ); ?>
 				</p>
 			</div>
 		</div>
@@ -178,15 +178,15 @@
 					<p>
 					<?php
 					// Translators: Donate URL, Purchase URL.
-					printf( __( 'Please, consider a <a href="%1$s">donation</a> or a <a href="%2$s">purchase</a> to support My Calendar!', 'my-calendar' ), 'https://www.joedolson.com/donate/', 'https://www.joedolson.com/my-calendar/pro/' );
+					echo wp_kses_post( sprintf( __( 'Please, consider a <a href="%1$s">donation</a> or a <a href="%2$s">purchase</a> to support My Calendar!', 'my-calendar' ), 'https://www.joedolson.com/donate/', 'https://www.joedolson.com/my-calendar/pro/' ) );
 					?>
 					</p>
 				</div>
 				<?php
 				if ( current_user_can( 'administrator' ) ) {
 					mc_get_support_form();
 				} else {
-					_e( 'My Calendar support requests can only be sent by administrators.', 'my-calendar' );
+					esc_html_e( 'My Calendar support requests can only be sent by administrators.', 'my-calendar' );
 				}
 				?>
 			</div>