diff --git a/mc_add_events_url.html b/mc_add_events_url.html index 2e1a837b..5906cbaa 100644 --- a/mc_add_events_url.html +++ b/mc_add_events_url.html @@ -134,7 +134,7 @@
Parameters:
Source:
@@ -304,7 +304,7 @@
Parameters:
Source:
diff --git a/mc_adminbar_uri.html b/mc_adminbar_uri.html index 2b12ad01..8390e455 100644 --- a/mc_adminbar_uri.html +++ b/mc_adminbar_uri.html @@ -134,7 +134,7 @@
Parameters:
Source:
diff --git a/mc_convert_locations_select_to_autocomplete.html b/mc_convert_locations_select_to_autocomplete.html index 0ebbcd48..d6b1cadf 100644 --- a/mc_convert_locations_select_to_autocomplete.html +++ b/mc_convert_locations_select_to_autocomplete.html @@ -134,7 +134,7 @@
Parameters:
Source:
diff --git a/mc_custom_spam_status.html b/mc_custom_spam_status.html index 3555c9c8..1d2b0143 100644 --- a/mc_custom_spam_status.html +++ b/mc_custom_spam_status.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_customize_email_headers.html b/mc_customize_email_headers.html index 646da5b6..49b23476 100644 --- a/mc_customize_email_headers.html +++ b/mc_customize_email_headers.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_disable_mobile_js.html b/mc_disable_mobile_js.html index d7af988d..65a34a3f 100644 --- a/mc_disable_mobile_js.html +++ b/mc_disable_mobile_js.html @@ -134,7 +134,7 @@
Parameters:
Source:
diff --git a/mc_disable_spam_checking.html b/mc_disable_spam_checking.html index 29d6b815..ab5b92c2 100644 --- a/mc_disable_spam_checking.html +++ b/mc_disable_spam_checking.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_event_mail_bcc.html b/mc_event_mail_bcc.html index 44e54251..c2e4b0db 100644 --- a/mc_event_mail_bcc.html +++ b/mc_event_mail_bcc.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_event_mail_body.html b/mc_event_mail_body.html index 43986212..b93c546d 100644 --- a/mc_event_mail_body.html +++ b/mc_event_mail_body.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_event_mail_from.html b/mc_event_mail_from.html index de047765..235bc0e8 100644 --- a/mc_event_mail_from.html +++ b/mc_event_mail_from.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_event_mail_subject.html b/mc_event_mail_subject.html index c6f5c829..0bac2cd6 100644 --- a/mc_event_mail_subject.html +++ b/mc_event_mail_subject.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_event_mail_to.html b/mc_event_mail_to.html index 27103362..febb1193 100644 --- a/mc_event_mail_to.html +++ b/mc_event_mail_to.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_get_current_url.html b/mc_get_current_url.html index 22057d99..6ec0dfe4 100644 --- a/mc_get_current_url.html +++ b/mc_get_current_url.html @@ -134,7 +134,7 @@
Parameters:
Source:
diff --git a/mc_registered_stylesheet.html b/mc_registered_stylesheet.html index 9cd171f5..d838d7e2 100644 --- a/mc_registered_stylesheet.html +++ b/mc_registered_stylesheet.html @@ -304,7 +304,7 @@
Parameters:
Source:
diff --git a/mc_send_notification.html b/mc_send_notification.html index 1499fe1a..ff0a6148 100644 --- a/mc_send_notification.html +++ b/mc_send_notification.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/mc_setup_allowed_sites.html b/mc_setup_allowed_sites.html index d879eeed..92b2f1c5 100644 --- a/mc_setup_allowed_sites.html +++ b/mc_setup_allowed_sites.html @@ -157,7 +157,7 @@
Parameters:
Source:
diff --git a/my-calendar-core.php.html b/my-calendar-core.php.html index 09e3f10b..fb479ad7 100644 --- a/my-calendar-core.php.html +++ b/my-calendar-core.php.html @@ -537,8 +537,7 @@ */ function mc_enqueue_calendar_print_styles() { $css = mc_generate_css(); - $css = wp_filter_nohtml_kses( $css ); - echo '<style>' . $css . '</style>'; + echo '<style>' . wp_filter_nohtml_kses( $css ) . '</style>'; } add_action( 'mc_print_view_head', 'mc_enqueue_calendar_print_styles' ); @@ -728,7 +727,7 @@ if ( ! is_wp_error( $response ) || is_array( $response ) ) { $data = $response['body']; $bits = explode( '== Upgrade Notice ==', $data ); - echo '</div><div id="mc-upgrade" class="notice inline notice-warning"><ul><li><strong style="color:#c22;">Upgrade Notes:</strong> ' . str_replace( '* ', '', nl2br( trim( $bits[1] ) ) ) . '</li></ul>'; + echo '</div><div id="mc-upgrade" class="notice inline notice-warning"><ul><li><strong style="color:#c22;">Upgrade Notes:</strong> ' . esc_html( str_replace( '* ', '', nl2br( trim( $bits[1] ) ) ) ) . '</li></ul>'; } } @@ -961,16 +960,15 @@ if ( '' !== $style_vars ) { $style_vars = '.mc-main {' . $style_vars . $category_vars . '}'; } - - $all_styles = " + ?> <style> -<!-- /* Styles by My Calendar - Joseph C Dolson https://www.joedolson.com/ */ -$category_styles -$style_vars ---> -</style>"; - echo $all_styles; + <?php + echo wp_filter_nohtml_kses( $category_styles ); + echo wp_filter_nohtml_kses( $style_vars ); + ?> +</style> + <?php } add_action( 'admin_head', 'mc_admin_head' ); @@ -2245,7 +2243,7 @@ ?> <form method="post" action="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-help' ) ); ?>"> - <div><input type="hidden" name="_wpnonce" value="<?php echo wp_create_nonce( 'my-calendar-nonce' ); ?>" /></div> + <div><input type="hidden" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( 'my-calendar-nonce' ) ); ?>" /></div> <div> <code><?php echo esc_html( __( 'From:', 'my-calendar' ) . " \"$current_user->display_name\" &lt;$current_user->user_email&gt;" ); ?></code> </p> @@ -2609,7 +2607,7 @@ $upgrade = 'https://www.joedolson.com/awesome/my-calendar-pro/'; $dismiss = admin_url( 'admin.php?page=my-calendar-config&dismiss=promotion' ); // Translators: URL to upgrade. - echo "<div class='notice mc-promotion'><p><img src='" . plugins_url( 'images/awd-logo-disc.png', __FILE__ ) . "' alt='Joe Dolson Accessible Web Design' /><span>" . sprintf( __( 'I hope you\'ve enjoyed <strong>My Calendar</strong>! Take a look at <a href=\'%1$s\'>upgrading to My Calendar Pro</a> for advanced event management with WordPress! <a href=\'%2$s\' class="button-secondary">Dismiss</a>', 'my-calendar' ), $upgrade, $dismiss ) . '</span></p></div>'; + echo "<div class='notice mc-promotion'><p><img src='" . esc_url( plugins_url( 'images/awd-logo-disc.png', __FILE__ ) ) . "' alt='Joe Dolson Accessible Web Design' /><span>" . wp_kses_post( sprintf( __( 'I hope you\'ve enjoyed <strong>My Calendar</strong>! Take a look at <a href=\'%1$s\'>upgrading to My Calendar Pro</a> for advanced event management with WordPress! <a href=\'%2$s\' class="button-secondary">Dismiss</a>', 'my-calendar' ), esc_url( $upgrade ), esc_url( $dismiss ) ) ) . '</span></p></div>'; } } add_action( 'admin_notices', 'mc_promotion_notice', 10 ); diff --git a/my-calendar-help.php.html b/my-calendar-help.php.html index 7c1309b2..b273d053 100644 --- a/my-calendar-help.php.html +++ b/my-calendar-help.php.html @@ -65,24 +65,24 @@ <ul class='list'> <?php if ( ! mc_get_uri( 'boolean' ) ) { - echo '<li>' . __( 'Add the My Calendar shortcode (<code>[my_calendar]</code>) to a page.', 'my-calendar' ) . '</li>'; - echo '<li>' . __( 'Assign your Calendar Page Location at <code>My Calendar > Settings > General</code>', 'my-calendar' ) . '</li>'; + echo '<li>' . wp_kses_post( __( 'Add the My Calendar shortcode (<code>[my_calendar]</code>) to a page.', 'my-calendar' ) ) . '</li>'; + echo '<li>' . wp_kses_post( __( 'Assign your Calendar Page Location at <code>My Calendar > Settings > General</code>', 'my-calendar' ) ) . '</li>'; } else { $permalink = mc_get_uri(); $edit_url = get_edit_post_link( absint( mc_get_option( 'uri_id' ) ) ); // Translators: Calendar link, calendar edit link. - echo '<li>' . sprintf( __( '<a href="%1$s">View your calendar</a> or <a href="%2$s">Edit the calendar page</a>', 'my-calendar' ), esc_url( $permalink ), esc_url( $edit_url ) ) . '</li>'; + echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">View your calendar</a> or <a href="%2$s">Edit the calendar page</a>', 'my-calendar' ), esc_url( $permalink ), esc_url( $edit_url ) ) ) . '</li>'; } $add_categories = admin_url( 'admin.php?page=my-calendar-categories' ); $add_locations = admin_url( 'admin.php?page=my-calendar-locations' ); $edit_events = admin_url( 'admin.php?page=my-calendar-manage' ); $add_events = admin_url( 'admin.php?page=my-calendar' ); // Translators: Add events link, manage events link. - echo '<li>' . sprintf( __( '<a href="%1$s">Add events</a> and <a href="%2$s">administer your events</a>.', 'my-calendar' ), esc_url( $add_events ), esc_url( $edit_events ) ) . '</li>'; + echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">Add events</a> and <a href="%2$s">administer your events</a>.', 'my-calendar' ), esc_url( $add_events ), esc_url( $edit_events ) ) ) . '</li>'; // Translators: Add categories link, add locations link. - echo '<li>' . sprintf( __( '<a href="%1$s">Add categories</a> and <a href="%2$s">add locations</a>.', 'my-calendar' ), esc_url( $add_categories ), esc_url( $add_locations ) ) . '</li>'; + echo '<li>' . wp_kses_post( sprintf( __( '<a href="%1$s">Add categories</a> and <a href="%2$s">add locations</a>.', 'my-calendar' ), esc_url( $add_categories ), esc_url( $add_locations ) ) ) . '</li>'; // Translators: Documentation URL. - echo '<li>' . sprintf( __( 'When you\'re ready, <a href="%s">read the documentation</a>.', 'my-calendar' ), 'https://docs.joedolson.com/my-calendar/' ) . '</li>'; + echo '<li>' . wp_kses_post( sprintf( __( 'When you\'re ready, <a href="%s">read the documentation</a>.', 'my-calendar' ), 'https://docs.joedolson.com/my-calendar/' ) ) . '</li>'; ?> </ul> <?php @@ -103,11 +103,11 @@ <div class="inside"> <h3><?php esc_html_e( 'Custom Styles Locations', 'my-calendar' ); ?></h3> - <p><?php _e( 'My Calendar custom style files can be saved in any of these locations. CSS files in these locations will be selectable from the stylesheet selector.', 'my-calendar' ); ?></p> + <p><?php esc_html_e( 'My Calendar custom style files can be saved in any of these locations. CSS files in these locations will be selectable from the stylesheet selector.', 'my-calendar' ); ?></p> <ul> <?php foreach ( mc_custom_dirs() as $dir ) { - echo "<li><code>$dir</code></li>"; + echo '<li><code>' . esc_html( $dir ) . '</code></li>'; } ?> </ul> @@ -115,7 +115,7 @@ <?php printf( // translators: print CSS file name, mobile CSS file name, tablet CSS file name. - __( 'Custom print, mobile, and tablet stylesheet file names: %1$s, %2$s, and %3$s.', 'my-calendar' ), + esc_html__( 'Custom print, mobile, and tablet stylesheet file names: %1$s, %2$s, and %3$s.', 'my-calendar' ), '<code>mc-print.css</code>', '<code>mc-mobile.css</code>', '<code>mc-tablet.css</code>' @@ -123,11 +123,11 @@ ?> </p> <h3><?php esc_html_e( 'Custom Template Locations', 'my-calendar' ); ?></h3> - <p><?php _e( 'Default My Calendar templates are found in <code>/wp-content/my-calendar/mc-templates/</code>. Copy those templates into a <code>/mc-templates/</code> directory in your theme to customize.', 'my-calendar' ); ?></p> - <p><?php _e( 'Legacy My Calendar templates can be loaded as text files (.txt) from any of the allowed style directory locations.', 'my-calendar' ); ?></p> + <p><?php echo wp_kses_post( __( 'Default My Calendar templates are found in <code>/wp-content/my-calendar/mc-templates/</code>. Copy those templates into a <code>/mc-templates/</code> directory in your theme to customize.', 'my-calendar' ) ); ?></p> + <p><?php esc_html_e( 'Legacy My Calendar templates can be loaded as text files (.txt) from any of the allowed style directory locations.', 'my-calendar' ); ?></p> <h3><?php esc_html_e( 'Custom Icons Location', 'my-calendar' ); ?></h3> <ul> - <li><code><?php echo str_replace( '/my-calendar', '', plugin_dir_path( __FILE__ ) ) . 'my-calendar-custom/icons/'; ?></code></li> + <li><code><?php echo esc_html( str_replace( '/my-calendar', '', plugin_dir_path( __FILE__ ) ) ) . 'my-calendar-custom/icons/'; ?></code></li> </ul> </div> </div> @@ -140,21 +140,21 @@ <div class="inside"> <h3><?php esc_html_e( 'Data Collection by My Calendar', 'my-calendar' ); ?></h3> <p> - <?php _e( 'My Calendar collects no personally identifying data.', 'my-calendar' ); ?> + <?php esc_html_e( 'My Calendar collects no personally identifying data.', 'my-calendar' ); ?> </p> <p> - <?php _e( 'My Calendar Pro, when installed, collects submitter names and email addresses when a public user submits an event from any public event submission form.', 'my-calendar' ); ?> + <?php esc_html_e( 'My Calendar Pro, when installed, collects submitter names and email addresses when a public user submits an event from any public event submission form.', 'my-calendar' ); ?> </p> <h3><?php esc_html_e( 'Data Sharing by My Calendar', 'my-calendar' ); ?></h3> <p> - <?php _e( 'The names and email addresses of people who author or host events are shared by My Calendar as part of the API output and iCal formatted event output. This data is sourced from user profiles, and will be destroyed or exported with that information.', 'my-calendar' ); ?> + <?php esc_html_e( 'The names and email addresses of people who author or host events are shared by My Calendar as part of the API output and iCal formatted event output. This data is sourced from user profiles, and will be destroyed or exported with that information.', 'my-calendar' ); ?> </p> <p> - <?php _e( 'Events submitted by public users from any public event submission form using My Calendar Pro include names and emails as part of the event data. This data is destroyed when the event is deleted.', 'my-calendar' ); ?> + <?php esc_html_e( 'Events submitted by public users from any public event submission form using My Calendar Pro include names and emails as part of the event data. This data is destroyed when the event is deleted.', 'my-calendar' ); ?> </p> <h3><?php esc_html_e( 'Data Removal in My Calendar', 'my-calendar' ); ?></h3> <p> - <?php _e( 'My Calendar supports the data export and removal features in WordPress 4.9.6 and later. When a data removal is requested, all events authored using the requested email address will be deleted. All events with that user assigned only as the host will remain, but the host will be changed.', 'my-calendar' ); ?> + <?php esc_html_e( 'My Calendar supports the data export and removal features in WordPress 4.9.6 and later. When a data removal is requested, all events authored using the requested email address will be deleted. All events with that user assigned only as the host will remain, but the host will be changed.', 'my-calendar' ); ?> </p> </div> </div> @@ -178,7 +178,7 @@ <p> <?php // Translators: Donate URL, Purchase URL. - printf( __( 'Please, consider a <a href="%1$s">donation</a> or a <a href="%2$s">purchase</a> to support My Calendar!', 'my-calendar' ), 'https://www.joedolson.com/donate/', 'https://www.joedolson.com/my-calendar/pro/' ); + echo wp_kses_post( sprintf( __( 'Please, consider a <a href="%1$s">donation</a> or a <a href="%2$s">purchase</a> to support My Calendar!', 'my-calendar' ), 'https://www.joedolson.com/donate/', 'https://www.joedolson.com/my-calendar/pro/' ) ); ?> </p> </div> @@ -186,7 +186,7 @@ if ( current_user_can( 'administrator' ) ) { mc_get_support_form(); } else { - _e( 'My Calendar support requests can only be sent by administrators.', 'my-calendar' ); + esc_html_e( 'My Calendar support requests can only be sent by administrators.', 'my-calendar' ); } ?> </div> diff --git a/my-calendar-install.php.html b/my-calendar-install.php.html index f5f5492b..71148f72 100644 --- a/my-calendar-install.php.html +++ b/my-calendar-install.php.html @@ -540,27 +540,25 @@ * See whether there are importable calendars present. */ function mc_check_imports() { - $output = ''; if ( 'true' !== get_option( 'ko_calendar_imported' ) ) { if ( function_exists( 'check_calendar' ) ) { - $output .= " + ?> <div id='message' class='updated'> - <p>" . __( 'My Calendar has identified that you have the Calendar plugin by Kieran O\'Shea installed. You can import those events and categories into the My Calendar database. Would you like to import these events?', 'my-calendar' ) . '</p> - <form method="post" action="' . admin_url( 'admin.php?page=my-calendar-config' ) . '"> + <p><?php esc_html_e( 'My Calendar has identified that you have the Calendar plugin by Kieran O\'Shea installed. You can import those events and categories into the My Calendar database. Would you like to import these events?', 'my-calendar' ); ?></p> + <form method="post" action="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-config' ); ?>"> <div> - <input type="hidden" name="_wpnonce" value="' . wp_create_nonce( 'my-calendar-nonce' ) . '" /> + <input type="hidden" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( 'my-calendar-nonce' ); ?>" /> </div> <div> <input type="hidden" name="import" value="true"/> - <input type="submit" value="' . __( 'Import from Calendar', 'my-calendar' ) . '" name="import-calendar" class="button-primary"/> + <input type="submit" value="<?php esc_attr_e( 'Import from Calendar', 'my-calendar' ); ?>" name="import-calendar" class="button-primary"/> </div> </form> - <p>' . __( 'Although it is possible that this import could fail to import your events correctly, it should not have any impact on your existing Calendar database.', 'my-calendar' ) . '</p> - </div>'; + <p><?php esc_html_e( 'Although it is possible that this import could fail to import your events correctly, it should not have any impact on your existing Calendar database.', 'my-calendar' ); ?></p> + </div> + <?php } } - - echo $output; } /** diff --git a/my-calendar-locations.php.html b/my-calendar-locations.php.html index 10a0d97f..6ec4e5cf 100644 --- a/my-calendar-locations.php.html +++ b/my-calendar-locations.php.html @@ -496,7 +496,7 @@ } } elseif ( isset( $_GET['location_id'] ) && 'delete' === $_GET['mode'] ) { $loc = absint( $_GET['location_id'] ); - echo mc_delete_location( $loc ); + echo wp_kses_post( mc_delete_location( $loc ) ); } elseif ( isset( $_GET['mode'] ) && isset( $_GET['location_id'] ) && 'edit' === $_GET['mode'] && ! isset( $post['mode'] ) ) { $cur_loc = (int) $_GET['location_id']; mc_show_location_form( 'edit', $cur_loc ); @@ -598,7 +598,7 @@ } else { ?> <h1 class="wp-heading-inline"><?php esc_html_e( 'Edit Location', 'my-calendar' ); ?></h1> - <a href="<?php echo admin_url( 'admin.php?page=my-calendar-locations' ); ?>" class="page-title-action"><?php esc_html_e( 'Add New', 'my-calendar' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-locations' ) ); ?>" class="page-title-action"><?php esc_html_e( 'Add New', 'my-calendar' ); ?></a> <hr class="wp-header-end"> <?php } @@ -647,7 +647,7 @@ <li><input type="submit" name="save" class="button-primary" value="<?php echo esc_attr( ( 'edit' === $view ) ? __( 'Save Changes', 'my-calendar' ) : __( 'Add Location', 'my-calendar' ) ); ?> "/></li> </ul> </div> - <div><input type="hidden" name="_wpnonce" value="<?php echo wp_create_nonce( 'my-calendar-nonce' ); ?>"/></div> + <div><input type="hidden" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( 'my-calendar-nonce' ) ); ?>"/></div> <?php if ( 'add' === $view ) { ?> @@ -660,11 +660,11 @@ ?> <div> <input type="hidden" name="mode" value="edit"/> - <input type="hidden" name="location_id" value="<?php echo $cur_loc->location_id; ?>"/> + <input type="hidden" name="location_id" value="<?php echo esc_attr( $cur_loc->location_id ); ?>"/> </div> <?php } - echo mc_locations_fields( $has_data, $cur_loc, 'location' ); + echo wp_kses( mc_locations_fields( $has_data, $cur_loc, 'location' ), mc_kses_elements() ); ?> <div class="mc-controls footer"> <ul> @@ -693,7 +693,7 @@ if ( 'edit' === $view ) { ?> <p> - <a href="<?php echo admin_url( 'admin.php?page=my-calendar-locations' ); ?>"><?php esc_html_e( 'Add a New Location', 'my-calendar' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-locations' ) ); ?>"><?php esc_html_e( 'Add a New Location', 'my-calendar' ); ?></a> </p> <?php } diff --git a/my-calendar-settings.php.html b/my-calendar-settings.php.html index f5f62040..42bfbd32 100644 --- a/my-calendar-settings.php.html +++ b/my-calendar-settings.php.html @@ -2111,7 +2111,7 @@ if ( ! wp_verify_nonce( $nonce, 'my-calendar-nonce' ) ) { wp_die( 'Invalid nonce' ); } - $locations = isset( $_POST['mc_location_controls'] ) ? map_deep( $_POST['mc_location_controls'], 'sanitize_textarea_field' ) : array(); + $locations = isset( $_POST['mc_location_controls'] ) ? map_deep( wp_unslash( $_POST['mc_location_controls'] ), 'sanitize_textarea_field' ) : array(); $mc_location_controls = array(); foreach ( $locations as $key => $value ) { $mc_location_controls[ $key ] = mc_csv_to_array( $value[0] ); @@ -2126,7 +2126,6 @@ */ function mc_location_controls() { if ( current_user_can( 'mc_edit_settings' ) ) { - $response = mc_update_location_controls(); $location_fields = array( 'event_label' => __( 'Name of Location', 'my-calendar' ), 'event_city' => __( 'City', 'my-calendar' ), @@ -2136,7 +2135,7 @@ 'event_country' => __( 'Country', 'my-calendar' ), ); $mc_location_controls = mc_get_option( 'location_controls' ); - + mc_update_location_controls(); ?> <p><?php echo wp_kses_post( __( 'Save custom values to change location text fields into dropdowns. One field per line. Format: <code>saved_value,Displayed Value</code>', 'my-calendar' ) ); ?></p> <form method="post" action="<?php echo esc_url( admin_url( 'admin.php?page=my-calendar-config#my-calendar-input' ) ); ?>">