@@ -91,6 +91,7 @@ class SettingsApi {
91
91
* @param string $slug Slug for the settings page.
92
92
* @param int|null $position Menu position for the settings page.
93
93
* @param bool $top_level If it's a top level menu.
94
+ * @param string $icon_url URL to use for an icon.
94
95
*/
95
96
public function __construct ( $ page_title , $ menu_title , $ capability , $ slug , $ position = null , $ top_level = false , $ icon_url = '' ) {
96
97
@@ -251,8 +252,8 @@ public function admin_init() {
251
252
$ section ['desc ' ] = '<div class="inside"> ' . $ section ['desc ' ] . '</div> ' ;
252
253
253
254
// Create the callback for description.
254
- $ callback = function () use ( $ section ) {
255
- echo str_replace ( '" ' , '\" ' , $ section ['desc ' ] );
255
+ $ callback = function () use ( $ section ) {
256
+ echo wp_kses_post ( str_replace ( '" ' , '\" ' , $ section ['desc ' ] ) );
256
257
};
257
258
258
259
} elseif ( isset ( $ section ['callback ' ] ) ) {
@@ -349,7 +350,7 @@ public function admin_init() {
349
350
* @param array $args = [)
350
351
*/
351
352
352
- // @param string $id
353
+ // @param string $id
353
354
$ field_id = $ section . '[ ' . $ field ['id ' ] . '] ' ;
354
355
355
356
add_settings_field (
@@ -374,7 +375,6 @@ public function admin_init() {
374
375
*/
375
376
register_setting ( $ section ['id ' ], $ section ['id ' ], [ $ this , 'sanitize_fields ' ] );
376
377
} // foreach ended.
377
-
378
378
} // admin_init() ended.
379
379
380
380
/**
@@ -462,7 +462,7 @@ public function callback_title( $args ) {
462
462
463
463
$ html = '' ;
464
464
465
- echo $ html ;
465
+ echo wp_kses_post ( $ html ) ;
466
466
}
467
467
468
468
/**
@@ -479,7 +479,7 @@ public function callback_text( $args ) {
479
479
$ html = sprintf ( '<input type="%1$s" class="%2$s-text" id="%3$s[%4$s]" name="%3$s[%4$s]" value="%5$s"placeholder="%6$s"/> ' , $ type , $ size , $ args ['section ' ], $ args ['id ' ], $ value , $ args ['placeholder ' ] );
480
480
$ html .= $ this ->get_field_description ( $ args );
481
481
482
- echo $ html ;
482
+ echo wp_kses_post ( $ html ) ;
483
483
}
484
484
485
485
/**
@@ -525,7 +525,7 @@ public function callback_checkbox( $args ) {
525
525
$ html .= sprintf ( '%1$s</label> ' , $ args ['desc ' ] );
526
526
$ html .= '</fieldset> ' ;
527
527
528
- echo $ html ;
528
+ echo wp_kses_post ( $ html ) ;
529
529
}
530
530
531
531
/**
@@ -543,15 +543,15 @@ public function callback_multicheck( $args ) {
543
543
$ label = is_array ( $ item ) ? $ item ['label ' ] : $ item ;
544
544
$ checked = isset ( $ value [ $ key ] ) ? $ value [ $ key ] : '0 ' ;
545
545
546
- $ html .= sprintf ( '<label for=" ' . $ this ->slug . '-%1$s[%2$s][%3$s]"> ' , $ args ['section ' ], $ args ['id ' ], $ key );
547
- $ html .= sprintf ( '<input type="checkbox" class="checkbox" id=" ' . $ this ->slug . '-%1$s[%2$s][%3$s]" name="%1$s[%2$s][%3$s]" value="%3$s" %4$s /> ' , $ args ['section ' ], $ args ['id ' ], $ key , checked ( $ checked , $ key , false ) );
548
- $ html .= sprintf ( '%1$s</label><br> ' , $ label );
549
- $ html .= $ this ->get_field_description ( $ item );
546
+ $ html .= sprintf ( '<label for=" ' . $ this ->slug . '-%1$s[%2$s][%3$s]"> ' , $ args ['section ' ], $ args ['id ' ], $ key );
547
+ $ html .= sprintf ( '<input type="checkbox" class="checkbox" id=" ' . $ this ->slug . '-%1$s[%2$s][%3$s]" name="%1$s[%2$s][%3$s]" value="%3$s" %4$s /> ' , $ args ['section ' ], $ args ['id ' ], $ key , checked ( $ checked , $ key , false ) );
548
+ $ html .= sprintf ( '%1$s</label><br> ' , $ label );
549
+ $ html .= $ this ->get_field_description ( $ item );
550
550
}
551
551
$ html .= $ this ->get_field_description ( $ args );
552
552
$ html .= '</fieldset> ' ;
553
553
554
- echo $ html ;
554
+ echo wp_kses_post ( $ html ) ;
555
555
}
556
556
557
557
/**
@@ -572,7 +572,7 @@ public function callback_radio( $args ) {
572
572
$ html .= $ this ->get_field_description ( $ args );
573
573
$ html .= '</fieldset> ' ;
574
574
575
- echo $ html ;
575
+ echo wp_kses_post ( $ html ) ;
576
576
}
577
577
578
578
/**
@@ -592,7 +592,7 @@ public function callback_select( $args ) {
592
592
$ html .= sprintf ( '</select> ' );
593
593
$ html .= $ this ->get_field_description ( $ args );
594
594
595
- echo $ html ;
595
+ echo wp_kses_post ( $ html ) ;
596
596
}
597
597
598
598
/**
@@ -608,7 +608,7 @@ public function callback_textarea( $args ) {
608
608
$ html = sprintf ( '<textarea rows="5" cols="55" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]">%4$s</textarea> ' , $ size , $ args ['section ' ], $ args ['id ' ], $ value );
609
609
$ html .= $ this ->get_field_description ( $ args );
610
610
611
- echo $ html ;
611
+ echo wp_kses_post ( $ html ) ;
612
612
}
613
613
614
614
/**
@@ -619,7 +619,7 @@ public function callback_textarea( $args ) {
619
619
* @return void
620
620
*/
621
621
public function callback_html ( $ args ) {
622
- echo $ this ->get_field_description ( $ args );
622
+ echo wp_kses_post ( $ this ->get_field_description ( $ args ) );
623
623
}
624
624
625
625
/**
@@ -647,7 +647,7 @@ public function callback_wysiwyg( $args ) {
647
647
648
648
echo '</div> ' ;
649
649
650
- echo $ this ->get_field_description ( $ args );
650
+ echo wp_kses_post ( $ this ->get_field_description ( $ args ) );
651
651
}
652
652
653
653
/**
@@ -668,7 +668,7 @@ public function callback_file( $args ) {
668
668
$ html .= '<input type="button" class="button eighteen73-browse" value=" ' . $ label . '" /> ' ;
669
669
$ html .= $ this ->get_field_description ( $ args );
670
670
671
- echo $ html ;
671
+ echo wp_kses_post ( $ html ) ;
672
672
}
673
673
674
674
/**
@@ -690,7 +690,7 @@ public function callback_image( $args ) {
690
690
$ html .= $ this ->get_field_description ( $ args );
691
691
$ html .= '<p class="eighteen73-image-preview"><img src=""/></p> ' ;
692
692
693
- echo $ html ;
693
+ echo wp_kses_post ( $ html ) ;
694
694
}
695
695
696
696
/**
@@ -706,7 +706,7 @@ public function callback_password( $args ) {
706
706
$ html = sprintf ( '<input type="password" class="%1$s-text" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s"/> ' , $ size , $ args ['section ' ], $ args ['id ' ], $ value );
707
707
$ html .= $ this ->get_field_description ( $ args );
708
708
709
- echo $ html ;
709
+ echo wp_kses_post ( $ html ) ;
710
710
}
711
711
712
712
/**
@@ -722,7 +722,7 @@ public function callback_color( $args ) {
722
722
$ html = sprintf ( '<input type="text" class="%1$s-text color-picker" id="%2$s[%3$s]" name="%2$s[%3$s]" value="%4$s" data-default-color="%5$s" placeholder="%6$s" /> ' , $ size , $ args ['section ' ], $ args ['id ' ], $ value , $ args ['std ' ], $ args ['placeholder ' ] );
723
723
$ html .= $ this ->get_field_description ( $ args );
724
724
725
- echo $ html ;
725
+ echo wp_kses_post ( $ html ) ;
726
726
}
727
727
728
728
/**
@@ -735,26 +735,26 @@ public function callback_separator( $args ) {
735
735
736
736
$ html = '' ;
737
737
$ html .= '<div class="eighteen73-settings-separator"></div> ' ;
738
- echo $ html ;
738
+ echo wp_kses_post ( $ html ) ;
739
739
}
740
740
741
741
/**
742
742
* Get the value of a settings field
743
743
*
744
- * @param string $option settings field name.
745
- * @param string $section the section name this field belongs to.
746
- * @param string $default default text if it's not found.
744
+ * @param string $option settings field name.
745
+ * @param string $section the section name this field belongs to.
746
+ * @param string $fallback default text if it's not found.
747
747
* @return string
748
748
*/
749
- public function get_option ( $ option , $ section , $ default = '' ) {
749
+ public function get_option ( $ option , $ section , $ fallback = '' ) {
750
750
751
751
$ options = get_option ( $ section );
752
752
753
753
if ( isset ( $ options [ $ option ] ) ) {
754
754
return $ options [ $ option ];
755
755
}
756
756
757
- return $ default ;
757
+ return $ fallback ;
758
758
}
759
759
760
760
/**
@@ -786,11 +786,11 @@ public function admin_menu() {
786
786
/**
787
787
* Sets a submenu.
788
788
*
789
- * @param string $page_title
790
- * @param string $menu_title
791
- * @param string $menu_slug
792
- * @param array $callback
793
- * @param int|null $position
789
+ * @param string $page_title Page title for the submenu page.
790
+ * @param string $menu_title Menu title for the submenu page.
791
+ * @param string $menu_slug Slug for the settings page.
792
+ * @param array $callback The callback for the submenu.
793
+ * @param int|null $position Menu position for the submenu page.
794
794
*/
795
795
public function set_submenu ( $ page_title , $ menu_title , $ menu_slug , $ callback , $ position = null ) {
796
796
if ( empty ( $ page_title ) || empty ( $ menu_title ) || empty ( $ menu_slug ) || empty ( $ callback ) || ! is_array ( $ callback ) ) {
@@ -838,7 +838,7 @@ public function admin_submenus() {
838
838
*/
839
839
public function plugin_page () {
840
840
echo '<div class="wrap"> ' ;
841
- echo '<h1> ' . $ this ->page_title . '</h1> ' ;
841
+ echo '<h1> ' . esc_html ( $ this ->page_title ) . '</h1> ' ;
842
842
$ this ->show_navigation ();
843
843
$ this ->show_forms ();
844
844
echo '</div> ' ;
@@ -860,7 +860,7 @@ public function show_navigation() {
860
860
861
861
$ html .= '</h2> ' ;
862
862
863
- echo $ html ;
863
+ echo wp_kses_post ( $ html ) ;
864
864
}
865
865
866
866
/**
0 commit comments