Skip to content

Commit 94548d2

Browse files
sheabungesheabunge
committed
Ensure that output is always escaped late, not early
1 parent c640a25 commit 94548d2

File tree

4 files changed

+49
-40
lines changed

4 files changed

+49
-40
lines changed

‎php/admin-menus/class-edit-menu.php‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -341,14 +341,13 @@ private function save_posted_snippet() {
341341
function render_description_editor( Code_Snippet $snippet ) {
342342
$settings = code_snippets_get_settings();
343343
$settings = $settings['description_editor'];
344-
$heading = __( 'Description', 'code-snippets' );
345344

346345
/* Hack to remove space between heading and editor tabs */
347-
if ( ! $settings['media_buttons'] && 'false' !== get_user_option( 'rich_editing' ) ) {
348-
$heading = "<div>$heading</div>";
349-
}
346+
$inline_heading = ! $settings['media_buttons'] && 'false' !== get_user_option( 'rich_editing' );
350347

351-
echo '<h2><label for="snippet_description">', $heading, '</label></h2>';
348+
echo '<h2><label for="snippet_description">', $inline_heading ? '<div>' : '';
349+
esc_html_e( 'Description', 'code-snippets' );
350+
echo $inline_heading ? '</div>' : '', '</label></h2>';
352351

353352
remove_editor_styles(); // stop custom theme styling interfering with the editor
354353

‎php/settings/render-fields.php‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,23 @@ function code_snippets_checkbox_field( $atts ) {
1818
$saved_value = code_snippets_get_setting( $atts['section'], $atts['id'] );
1919
$input_name = sprintf( 'code_snippets_settings[%s][%s]', $atts['section'], $atts['id'] );
2020

21-
$output = sprintf(
21+
if ( ! empty( $atts['label'] ) ) {
22+
printf( '<label for="%s">', esc_attr( $input_name ) );
23+
}
24+
25+
printf(
2226
'<input type="checkbox" name="%s"%s>',
2327
esc_attr( $input_name ),
2428
checked( $saved_value, true, false )
2529
);
2630

27-
// Output the checkbox field, optionally with label
28-
if ( isset( $atts['label'] ) ) {
29-
printf( '<label for="%s">%s %s</label>', esc_attr( $input_name ), $output, $atts['label'] );
30-
} else {
31-
echo $output;
31+
if ( ! empty( $atts['label'] ) ) {
32+
echo esc_html( $atts['label'] ), '</label>';
3233
}
3334

3435
// Add field description if it is set
3536
if ( ! empty( $atts['desc'] ) ) {
36-
echo '<p class="description">' . $atts['desc'] . '</p>';
37+
echo '<p class="description">' . esc_html( $atts['desc'] ) . '</p>';
3738
}
3839
}
3940

@@ -64,11 +65,11 @@ function code_snippets_number_field( $atts ) {
6465
echo '>';
6566

6667
if ( ! empty( $atts['label'] ) ) {
67-
echo ' ' . $atts['label'];
68+
echo ' ' . esc_html( $atts['label'] );
6869
}
6970

7071
// Add field description if it is set
7172
if ( ! empty( $atts['desc'] ) ) {
72-
echo '<p class="description">' . $atts['desc'] . '</p>';
73+
echo '<p class="description">' . esc_html( $atts['desc'] ) . '</p>';
7374
}
7475
}

‎php/settings/settings-fields.php‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,7 @@ function code_snippets_get_settings_fields() {
7676
'complete_uninstall' => array(
7777
'name' => __( 'Complete Uninstall', 'code-snippets' ),
7878
'type' => 'checkbox',
79-
'label' => sprintf(
80-
/* translators: %s: URL for Plugins admin menu */
81-
__( 'When the plugin is deleted from the <a href="%s">Plugins</a> menu, also delete all snippets and plugin settings.', 'code-snippets' ),
82-
self_admin_url( 'plugins.php' )
83-
),
79+
'label' => __( 'When the plugin is deleted from the Plugins menu, also delete all snippets and plugin settings.', 'code-snippets' ),
8480
'default' => false,
8581
),
8682
);

‎php/views/edit.php‎

Lines changed: 34 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@
6464

6565
?></h1>
6666

67-
<form method="post" id="snippet-form" action="" style="margin-top: 10px;" class="<?php echo implode( ' ', $classes ); ?>">
67+
<form method="post" id="snippet-form" action="" style="margin-top: 10px;"
68+
class="<?php echo implode( ' ', $classes ); ?>">
6869
<?php
6970
/* Output the hidden fields */
7071

@@ -80,7 +81,9 @@
8081
<div id="titlediv">
8182
<div id="titlewrap">
8283
<label for="title" style="display: none;"><?php _e( 'Name', 'code-snippets' ); ?></label>
83-
<input id="title" type="text" autocomplete="off" name="snippet_name" value="<?php echo esc_attr( $snippet->name ); ?>" placeholder="<?php _e( 'Enter title here', 'code-snippets' ); ?>">
84+
<input id="title" type="text" autocomplete="off" name="snippet_name"
85+
value="<?php echo esc_attr( $snippet->name ); ?>"
86+
placeholder="<?php _e( 'Enter title here', 'code-snippets' ); ?>">
8487
</div>
8588
</div>
8689

@@ -91,7 +94,8 @@
9194
<h2><label for="snippet_code"><?php _e( 'Code', 'code-snippets' ); ?></label></h2>
9295

9396
<div class="snippet-editor">
94-
<textarea id="snippet_code" name="snippet_code" rows="200" spellcheck="false" style="font-family: monospace; width: 100%;"><?php
97+
<textarea id="snippet_code" name="snippet_code" rows="200" spellcheck="false"
98+
style="font-family: monospace; width: 100%;"><?php
9599
echo esc_textarea( $snippet->code );
96100
?></textarea>
97101

@@ -104,15 +108,15 @@
104108
<?php
105109

106110
$keys = array(
107-
'Cmd' => esc_html_x( 'Cmd', 'keyboard key', 'code-snippets' ),
108-
'Ctrl' => esc_html_x( 'Ctrl', 'keyboard key', 'code-snippets' ),
109-
'Shift' => esc_html_x( 'Shift', 'keyboard key', 'code-snippets' ),
110-
'Option' => esc_html_x( 'Option', 'keyboard key', 'code-snippets' ),
111-
'Alt' => esc_html_x( 'Alt', 'keyboard key', 'code-snippets' ),
112-
'F' => esc_html_x( 'F', 'keyboard key', 'code-snippets' ),
113-
'G' => esc_html_x( 'G', 'keyboard key', 'code-snippets' ),
114-
'R' => esc_html_x( 'R', 'keyboard key', 'code-snippets' ),
115-
'S' => esc_html_x( 'S', 'keyboard key', 'code-snippets' ),
111+
'Cmd' => _x( 'Cmd', 'keyboard key', 'code-snippets' ),
112+
'Ctrl' => _x( 'Ctrl', 'keyboard key', 'code-snippets' ),
113+
'Shift' => _x( 'Shift', 'keyboard key', 'code-snippets' ),
114+
'Option' => _x( 'Option', 'keyboard key', 'code-snippets' ),
115+
'Alt' => _x( 'Alt', 'keyboard key', 'code-snippets' ),
116+
'F' => _x( 'F', 'keyboard key', 'code-snippets' ),
117+
'G' => _x( 'G', 'keyboard key', 'code-snippets' ),
118+
'R' => _x( 'R', 'keyboard key', 'code-snippets' ),
119+
'S' => _x( 'S', 'keyboard key', 'code-snippets' ),
116120
);
117121

118122
?>
@@ -122,45 +126,54 @@
122126
<tr>
123127
<td><?php esc_html_e( 'Save changes', 'code-snippets' ); ?></td>
124128
<td>
125-
<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php
126-
echo $keys['Cmd']; ?></kbd>&hyphen;<kbd><?php echo $keys['S']; ?></kbd>
129+
<kbd class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd class="mac-key"><?php
130+
echo esc_html( $keys['Cmd'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['S'] ); ?></kbd>
127131
</td>
128132
</tr>
129133
<tr>
130134
<td><?php esc_html_e( 'Begin searching', 'code-snippets' ); ?></td>
131135
<td>
132-
<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php
133-
echo $keys['Cmd']; ?></kbd>&hyphen;<kbd><?php echo $keys['F']; ?></kbd>
136+
<kbd class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd class="mac-key"><?php
137+
echo esc_html( $keys['Cmd'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['F'] ); ?></kbd>
134138
</td>
135139
</tr>
136140
<tr>
137141
<td><?php esc_html_e( 'Find next', 'code-snippets' ); ?></td>
138142
<td>
139-
<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php echo $keys['Cmd']; ?></kbd>&hyphen;<kbd><?php echo $keys['G']; ?></kbd>
143+
<kbd class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd
144+
class="mac-key"><?php echo esc_html( $keys['Cmd'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['G'] ); ?></kbd>
140145
</td>
141146
</tr>
142147
<tr>
143148
<td><?php esc_html_e( 'Find previous', 'code-snippets' ); ?></td>
144149
<td>
145-
<kbd><?php echo $keys['Shift']; ?></kbd>-<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php echo $keys['Cmd']; ?></kbd>&hyphen;<kbd><?php echo $keys['G']; ?></kbd>
150+
<kbd><?php echo esc_html( $keys['Shift'] ); ?></kbd>-<kbd
151+
class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd
152+
class="mac-key"><?php echo esc_html( $keys['Cmd'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['G'] ); ?></kbd>
146153
</td>
147154
</tr>
148155
<tr>
149156
<td><?php esc_html_e( 'Replace', 'code-snippets' ); ?></td>
150157
<td>
151-
<kbd><?php echo $keys['Shift']; ?></kbd>&hyphen;<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php echo $keys['Cmd']; ?></kbd>&hyphen;<kbd><?php echo $keys['F']; ?></kbd>
158+
<kbd><?php echo esc_html( $keys['Shift'] ); ?></kbd>&hyphen;<kbd
159+
class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd
160+
class="mac-key"><?php echo esc_html( $keys['Cmd'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['F'] ); ?></kbd>
152161
</td>
153162
</tr>
154163
<tr>
155164
<td><?php esc_html_e( 'Replace all', 'code-snippets' ); ?></td>
156165
<td>
157-
<kbd><?php echo $keys['Shift']; ?></kbd>&hyphen;<kbd class="pc-key"><?php echo $keys['Ctrl']; ?></kbd><kbd class="mac-key"><?php echo $keys['Cmd']; ?></kbd><span class="mac-key">&hyphen;</span><kbd class="mac-key"><?php echo $keys['Option']; ?></kbd>&hyphen;<kbd><?php echo $keys['R']; ?></kbd>
166+
<kbd><?php echo esc_html( $keys['Shift'] ); ?></kbd>&hyphen;<kbd
167+
class="pc-key"><?php echo esc_html( $keys['Ctrl'] ); ?></kbd><kbd
168+
class="mac-key"><?php echo esc_html( $keys['Cmd'] ); ?></kbd><span
169+
class="mac-key">&hyphen;</span><kbd
170+
class="mac-key"><?php echo esc_html( $keys['Option'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['R'] ); ?></kbd>
158171
</td>
159172
</tr>
160173
<tr>
161174
<td><?php esc_html_e( 'Persistent search', 'code-snippets' ); ?></td>
162175
<td>
163-
<kbd><?php echo $keys['Alt']; ?></kbd>&hyphen;<kbd><?php echo $keys['F']; ?></kbd>
176+
<kbd><?php echo esc_html( $keys['Alt'] ); ?></kbd>&hyphen;<kbd><?php echo esc_html( $keys['F'] ); ?></kbd>
164177
</td>
165178
</tr>
166179
</table>

0 commit comments

Comments
 (0)