Skip to content

Commit 6499714

Browse files
Dan0szDan0sz
committed
Improved: some attributes weren't escaped.
1 parent 8a48a9f commit 6499714

1 file changed

Lines changed: 22 additions & 20 deletions

File tree

‎src/Admin/Settings/API.php‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -552,17 +552,19 @@ private function get_quick_actions() {
552552
public function render_toggle_group_field( array $group, $hide_header = false ) {
553553
ob_start();
554554
?>
555-
<div id="<?php echo $group['slug']; ?>_toggle" onclick="plausibleToggleSection('<?php echo $group['slug']; ?>')" class="flex items-center mt-4 space-x-3 hover:cursor-pointer">
555+
<div id="<?php echo esc_attr( $group['slug'] ); ?>_toggle" onclick="plausibleToggleSection('<?php echo esc_js( $group['slug'] ); ?>')"
556+
class="flex items-center mt-4 space-x-3 hover:cursor-pointer">
556557
<span class="dark:text-gray-100 text-lg">
557-
<?php echo $group['label']; ?>
558+
<?php echo esc_html( $group['label'] ); ?>
558559
</span>
559560
<!-- Chevron -->
560-
<svg xmlns="http://www.w3.org/2000/svg" id="<?php echo $group['slug']; ?>_chevron" class="h-6 w-6 ml-2 text-gray-400 dark:text-gray-500 transition-transform duration-250" fill="none"
561+
<svg xmlns="http://www.w3.org/2000/svg" id="<?php echo esc_attr( $group['slug'] ); ?>_chevron" class="h-6 w-6 ml-2 text-gray-400 dark:text-gray-500 transition-transform duration-250"
562+
fill="none"
561563
viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor">
562564
<path stroke-linecap="round" stroke-linejoin="round" d="m4.5 15.75 7.5-7.5 7.5 7.5"/>
563565
</svg>
564566
</div>
565-
<div class="hidden" id="<?php echo $group['slug']; ?>_content">
567+
<div class="hidden" id="<?php echo esc_attr( $group['slug'] ); ?>_content">
566568
<?php echo $this->render_group_field( $group, true ); ?>
567569
</div>
568570
<?php
@@ -584,7 +586,7 @@ public function render_group_field( array $group, $hide_header = false ) {
584586
<div class="bg-white dark:bg-gray-800<?php echo $hide_header ? '' : ' plausible-analytics-group py-6 px-4 space-y-6 sm:p-6'; ?>">
585587
<?php if ( ! $hide_header ) : ?>
586588
<header class="relative">
587-
<h3 class="text-lg mt-0 leading-6 font-medium text-gray-900 dark:text-gray-100" id="<?php echo $group['slug']; ?>"><?php echo $group['label']; ?></h3>
589+
<h3 class="text-lg mt-0 leading-6 font-medium text-gray-900 dark:text-gray-100" id="<?php echo esc_attr( $group['slug'] ); ?>"><?php echo esc_html( $group['label'] ); ?></h3>
588590
<div class="mt-1 text-sm leading-5 !text-gray-500 !dark:text-gray-200">
589591
<?php echo wp_kses_post( $group['desc'] ); ?>
590592
</div>
@@ -642,15 +644,15 @@ public function render_clonable_text_field( array $group ) {
642644
$values = $group['value'] ?: [ 0 => '' ];
643645
$slug = $group['slug'] ?? '';
644646
?>
645-
<div id="<?php echo $slug; ?>_content" class="plausible-analytics-section <?php echo $group['hidden'] ? 'hidden' : ''; ?> !mt-1 mx-14">
647+
<div id="<?php echo esc_attr( $slug ); ?>_content" class="plausible-analytics-section <?php echo $group['hidden'] ? 'hidden' : ''; ?> !mt-1 mx-14">
646648
<div class="flex justify-between items-center">
647649
<div class="text-sm leading-5 !text-gray-500 !dark:text-gray-200"><?php echo wp_kses( $group['description'], 'post' ); ?></div>
648650
</div>
649-
<ol id="<?php echo $slug; ?>_list" class="m-0 mt-4 list-none mb-6">
651+
<ol id="<?php echo esc_attr( $slug ); ?>_list" class="m-0 mt-4 list-none mb-6">
650652
<?php foreach ( $values as $key => $value ) : ?>
651-
<li class="<?php echo str_replace( '_', '-', $slug ); ?>-field flex justify-between items-end">
652-
<?php echo $this->render_text_field( [ 'value' => $value, 'slug' => "{$slug}[$key]", 'classes' => 'flex-1' ] ); ?>
653-
<a onclick="plausibleRemoveField('<?php echo "{$slug}[$key]"; ?>')" class="<?php echo $key === 0 ? 'hidden' :
653+
<li class="<?php echo esc_attr( str_replace( '_', '-', $slug ) ); ?>-field flex justify-between items-end">
654+
<?php echo $this->render_text_field( [ 'value' => $value, 'slug' => esc_attr( "{$slug}[$key]" ), 'classes' => 'flex-1' ] ); ?>
655+
<a onclick="plausibleRemoveField('<?php echo esc_js( "{$slug}[$key]" ); ?>')" class="<?php echo $key === 0 ? 'hidden' :
654656
''; ?> ml-2 cursor-pointer text-red-800 hover:text-red-500 dark:text-red-500 dark:hover:text-red-400">
655657
<svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 m-auto" viewBox="0 0 24 24" stroke="currentColor" aria-hidden="true" fill="none" stroke-width="1.5">
656658
<path stroke-linecap="round" stroke-linejoin="round"
@@ -661,7 +663,7 @@ public function render_clonable_text_field( array $group ) {
661663
<?php endforeach; ?>
662664
</ol>
663665
<?php echo $this->render_button_field( [ 'slug' => 'save-' . $slug, 'label' => __( 'Save', 'plausible-analytics' ) ] ); ?>
664-
<button type="button" onclick="plausibleAddField('<?php echo $slug; ?>')"
666+
<button type="button" onclick="plausibleAddField('<?php echo esc_js( $slug ); ?>')"
665667
class="border-0 cursor-pointer whitespace-nowrap truncate gap-x-2 font-semibold px-3.5 py-2.5 text-sm bg-transparent text-indigo-600 hover:text-indigo-700">
666668
<?php echo __( 'Add More', 'plausible-analytics' ); ?>
667669
</button>
@@ -684,18 +686,18 @@ public function render_text_field( array $field ) {
684686
$disabled = ! empty( $field['disabled'] ) ? 'disabled' : '';
685687
$classes = ! empty ( $field['classes'] ) ? $field['classes'] : '';
686688
?>
687-
<div class="mt-4 <?php echo $classes; ?>">
689+
<div class="mt-4 <?php echo esc_attr( $classes ); ?>">
688690
<?php if ( ! empty( $field['label'] ) ): ?>
689691
<label class="block text-sm font-medium leading-5 !text-gray-700 !dark:text-gray-300"
690-
for="<?php echo $field['slug']; ?>"><?php echo $field['label']; ?></label>
692+
for="<?php echo esc_attr( $field['slug'] ); ?>"><?php echo wp_kses_post( $field['label'] ); ?></label>
691693
<?php endif; ?>
692694
<div class="mt-1">
693695
<input
694696
class="block w-full !border-gray-300 !dark:border-gray-700 !rounded-md focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm dark:bg-gray-900 dark:text-gray-300 py-2 px-3"
695-
id="<?php echo $field['slug']; ?>" placeholder="<?php echo $placeholder; ?>" autocomplete="off"
697+
id="<?php echo esc_attr( $field['slug'] ); ?>" placeholder="<?php echo esc_attr( $placeholder ); ?>" autocomplete="off"
696698
type="text"
697-
name="<?php echo $field['slug']; ?>"
698-
value="<?php echo $value; ?>" <?php echo $disabled; ?> />
699+
name="<?php echo esc_attr( $field['slug'] ); ?>"
700+
value="<?php echo esc_attr( $value ); ?>" <?php echo $disabled ? 'disabled' : ''; ?> />
699701
</div>
700702
</div>
701703
<?php
@@ -724,7 +726,7 @@ class="plausible-analytics-button mt-4 border-0 hover:cursor-pointer inline-flex
724726
<path class="opacity-75" fill="currentColor"
725727
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
726728
</svg>
727-
<?php esc_attr_e( $field['label'], 'plausible-analytics' ); ?>
729+
<?php esc_html_e( $field['label'], 'plausible-analytics' ); ?>
728730
</button>
729731
<?php
730732
return ob_get_clean();
@@ -763,7 +765,7 @@ public function render_checkbox_field( array $field, $is_list = false ) {
763765
<span class="plausible-analytics-toggle <?php echo $checked ? 'translate-x-5' :
764766
'translate-x-0'; ?> inline-block h-5 w-5 rounded-full bg-white dark:bg-gray-800 shadow transform transition-translate ease-in-out duration-200"></span>
765767
</button>
766-
<span class="ml-2 dark:text-gray-100 text-lg"><?php echo $field['label']; ?></span>
768+
<span class="ml-2 dark:text-gray-100 text-lg"><?php echo esc_html( $field['label'] ); ?></span>
767769
<?php if ( isset( $field['docs'] ) ): ?>
768770
<a class="leading-none" href="<?php echo esc_url( $field['docs'] ); ?>" rel="noreferrer" target="_blank">
769771
<svg xmlns="http://www.w3.org/2000/svg" class="text-gray-400 w-6 h-6 leading-none" stroke="currentColor" aria-hidden="true" fill="none" viewBox="0 0 24 24" stroke-width="1.5">
@@ -802,7 +804,7 @@ public function render_textarea_field( array $field ) {
802804
class="block w-full max-w-xl border-gray-300 dark:border-gray-700 resize-none shadow-sm focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm rounded-md dark:bg-gray-900 dark:text-gray-300"
803805
rows="5" id="<?php echo esc_attr( $field['slug'] ); ?>"
804806
placeholder="<?php echo esc_attr( $placeholder ); ?>"
805-
name="<?php echo esc_attr( $field['slug'] ); ?>"><?php echo $value; ?></textarea>
807+
name="<?php echo esc_attr( $field['slug'] ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
806808
</div>
807809
</div>
808810
<?php
@@ -835,7 +837,7 @@ public function render_hook_field( array $field ) {
835837

836838
ob_start();
837839
?>
838-
<div id="plausible-analytics-hook-<?php echo $field['slug']; ?>"
840+
<div id="plausible-analytics-hook-<?php echo esc_attr( $field['slug'] ); ?>"
839841
class="plausible-analytics-hook <?php echo $persist_message; ?> transition-opacity transition-300">
840842
<div class="rounded-md p-4 mt-4 relative <?php echo esc_attr( $box_class ); ?> rounded-t-md rounded-b-none">
841843
<div class="flex">

0 commit comments

Comments
 (0)