Skip to content
Snippets Groups Projects
Commit d6c43c76 authored by Marcin Kolanko's avatar Marcin Kolanko
Browse files

Merge branch 'feature/add-escaping-to-templates' into 'master' 

Feature/add escaping to templates

See merge request !20
parents d9d44554 c8e27303
No related branches found
No related tags found
1 merge request!20Feature/add escaping to templates
Pipeline #6285 passed with warnings
Stage: prepare-vendor
Stage: prepare-node
Stage: tools
Stage: tests
Stage: deploy
Stage: post-deploy
Show whitespace changes
Inline Side-by-side
templates/paragraph.php
+ 6
− 3
View file @ d6c43c76
...@@ -4,12 +4,15 @@ ...@@ -4,12 +4,15 @@
* @var string $name_prefix * @var string $name_prefix
* @var string $value * @var string $value
*/ */
?>
<?php if ( $field->has_description() ): ?> if ( $field->has_description() ) : ?>
<tr> <tr>
<td style="padding-left:0;" colspan="2"> <td style="padding-left:0;" colspan="2">
<p <?php if ( $field->has_classes() ): ?>class="<?php echo $field->get_classes(); ?>"<?php endif; ?>><?php echo wp_kses_post( $field->get_description() ); ?></p> <p
<?php
if ( $field->has_classes() ) :
?>
class="<?php echo \esc_attr( $field->get_classes() ); ?>"<?php endif; ?>><?php echo wp_kses_post( $field->get_description() ); ?></p>
</td> </td>
</tr> </tr>
<?php endif; ?> <?php endif; ?>
templates/product-select.php
+ 10
− 7
View file @ d6c43c76
<?php <?php
/** /**
* @var \WPDesk\Forms\Field $field * @var \WPDesk\Forms\Field $field
* @var string $name_prefix * @var string $name_prefix
* @var string[] $value * @var string[] $value
*/ */
?> ?>
<select class="wc-product-search" multiple="multiple" style="width: 50%;" <select class="wc-product-search" multiple="multiple" style="width: 50%;"
id="<?php echo esc_attr( $field->get_id() ); ?>" id="<?php echo \esc_attr( $field->get_id() ); ?>"
name="<?php echo esc_attr( $name_prefix ); ?>[<?php echo esc_attr( $field->get_name() ); ?>][]" name="<?php echo \esc_attr( $name_prefix ); ?>[<?php echo \esc_attr( $field->get_name() ); ?>][]"
data-placeholder="<?php esc_attr_e( 'Search for a product&hellip;', 'woocommerce' ); ?>" data-placeholder="<?php \esc_attr_e( 'Search for a product&hellip;', 'wp-forms' ); ?>"
data-action="woocommerce_json_search_products_and_variations"> data-action="woocommerce_json_search_products_and_variations">
<?php <?php
foreach ( (array) $value as $product_id ) { foreach ( (array) $value as $product_id ) {
$product = wc_get_product( $product_id ); $product = wc_get_product( $product_id );
if ( is_object( $product ) ) { if ( is_object( $product ) ) {
echo '<option value="' . esc_attr( $product_id ) . '"' . selected( true, true, echo '<option value="' . \esc_attr( $product_id ) . '"' . selected(
false ) . '>' . wp_kses_post( $product->get_formatted_name() ) . '</option>'; true,
true,
false
) . '>' . wp_kses_post( $product->get_formatted_name() ) . '</option>';
} }
} }
?> ?>
......
templates/select.php
+ 37
− 14
View file @ d6c43c76
...@@ -4,26 +4,49 @@ ...@@ -4,26 +4,49 @@
* @var string $name_prefix * @var string $name_prefix
* @var mixed $value * @var mixed $value
*/ */
?> ?>
<select <select
id="<?php echo esc_attr( $field->get_id() ); ?>" id="<?php echo \esc_attr( $field->get_id() ); ?>"
<?php if ($field->has_classes()): ?>class="<?php echo esc_attr( $field->get_classes() ); ?>"<?php endif; ?> <?php
name="<?php echo esc_attr( $name_prefix ); ?>[<?php echo esc_attr( $field->get_name() ); ?>]<?php echo $field->is_multiple()? '[]' : ''; ?>" if ( $field->has_classes() ) :
?>
class="<?php echo \esc_attr( $field->get_classes() ); ?>"<?php endif; ?>
name="<?php echo \esc_attr( $name_prefix ); ?>[<?php echo \esc_attr( $field->get_name() ); ?>]<?php echo \esc_attr( $field->is_multiple() ) ? '[]' : ''; ?>"
<?php foreach ( $field->get_attributes() as $key => $attr_val ) : ?> <?php foreach ( $field->get_attributes() as $key => $attr_val ) : ?>
<?php echo esc_attr($key); ?>="<?php echo esc_attr($attr_val); ?>" <?php echo \esc_attr( $key ); ?>="<?php echo \esc_attr( $attr_val ); ?>"
<?php endforeach; ?> <?php endforeach; ?>
<?php if ($field->is_required()): ?>required="required"<?php endif; ?> <?php
<?php if ($field->is_disabled()): ?>disabled="disabled"<?php endif; ?> if ( $field->is_required() ) :
<?php if ($field->is_readonly()): ?>readonly="readonly"<?php endif; ?> ?>
<?php if ($field->is_multiple()): ?>multiple="multiple"<?php endif; ?> required="required"<?php endif; ?>
<?php
if ( $field->is_disabled() ) :
?>
disabled="disabled"<?php endif; ?>
<?php
if ( $field->is_readonly() ) :
?>
readonly="readonly"<?php endif; ?>
<?php
if ( $field->is_multiple() ) :
?>
multiple="multiple"<?php endif; ?>
> >
<?php if ( $field->has_placeholder() ): ?><option value=""><?php echo esc_html( $field->get_placeholder() ); ?></option><?php endif; ?> <?php
if ( $field->has_placeholder() ) :
?>
<option value=""><?php echo \esc_html( $field->get_placeholder() ); ?></option><?php endif; ?>
<?php foreach ( $field->get_possible_values() as $possible_value => $label ) : ?> <?php foreach ( $field->get_possible_values() as $possible_value => $label ) : ?>
<option <option
<?php if ( $possible_value === $value || (is_array($value) && in_array($possible_value, $value)) || (is_numeric($possible_value) && is_numeric($value) && (int) $possible_value === (int) $value )): ?>selected="selected"<?php endif; ?> <?php
value="<?php echo esc_attr( $possible_value ); ?>" if ( $possible_value === $value || ( is_array( $value ) && in_array( $possible_value, $value, true ) ) || ( is_numeric( $possible_value ) && is_numeric( $value ) && (int) $possible_value === (int) $value ) ) :
><?php echo esc_html( $label ); ?></option> ?>
selected="selected"<?php endif; ?>
value="<?php echo \esc_attr( $possible_value ); ?>"
><?php echo \esc_html( $label ); ?></option>
<?php endforeach; ?> <?php endforeach; ?>
</select> </select>
templates/textarea.php
+ 31
− 12
View file @ d6c43c76
...@@ -4,20 +4,39 @@ ...@@ -4,20 +4,39 @@
* @var string $name_prefix * @var string $name_prefix
* @var string $value * @var string $value
*/ */
?> ?>
<textarea <textarea
id="<?php echo esc_attr( $field->get_id() ); ?>" id="<?php echo \esc_attr( $field->get_id() ); ?>"
<?php if ( $field->has_classes() ): ?>class="<?php echo esc_attr( $field->get_classes() ); ?>"<?php endif; ?> <?php
name="<?php echo esc_attr( $name_prefix ); ?>[<?php echo esc_attr( $field->get_name() ); ?>]" if ( $field->has_classes() ) :
?>
class="<?php echo \esc_attr( $field->get_classes() ); ?>"<?php endif; ?>
name="<?php echo \esc_attr( $name_prefix ); ?>[<?php echo \esc_attr( $field->get_name() ); ?>]"
<?php foreach ( $field->get_attributes() as $key => $attr_val ) : ?> <?php foreach ( $field->get_attributes() as $key => $attr_val ) : ?>
<?php echo esc_attr( $key ); ?>="<?php echo esc_attr( $attr_val ); ?>" <?php echo \esc_attr( $key ); ?>="<?php echo \esc_attr( $attr_val ); ?>"
<?php endforeach; ?> <?php endforeach; ?>
<?php if ( $field->is_required() ): ?>required="required"<?php endif; ?> <?php
<?php if ( $field->is_disabled() ): ?>disabled="disabled"<?php endif; ?> if ( $field->is_required() ) :
<?php if ( $field->is_readonly() ): ?>readonly="readonly"<?php endif; ?> ?>
<?php if ( $field->is_multiple() ): ?>multiple="multiple"<?php endif; ?> required="required"<?php endif; ?>
<?php
if ( $field->is_disabled() ) :
?>
disabled="disabled"<?php endif; ?>
<?php
if ( $field->is_readonly() ) :
?>
readonly="readonly"<?php endif; ?>
<?php
if ( $field->is_multiple() ) :
?>
multiple="multiple"<?php endif; ?>
<?php if ( $field->has_placeholder() ): ?>placeholder="<?php echo esc_html( $field->get_placeholder() ); ?>"<?php endif; ?> <?php
><?php echo esc_html( $value ); ?></textarea> if ( $field->has_placeholder() ) :
?>
placeholder="<?php echo \esc_html( $field->get_placeholder() ); ?>"<?php endif; ?>
><?php echo \esc_html( $value ); ?></textarea>
templates/wyswig.php
+ 9
− 8
View file @ d6c43c76
...@@ -4,23 +4,24 @@ ...@@ -4,23 +4,24 @@
* @var string $name_prefix * @var string $name_prefix
* @var string $value * @var string $value
*/ */
?>
<?php wp_print_styles( 'media-views' ); ?> wp_print_styles( 'media-views' ); ?>
<script> <script>
window.SM_EditorInitialized = true; window.SM_EditorInitialized = true;
</script> </script>
<?php <?php
$id = uniqid( 'wyswig_' ); $editor_id = uniqid( 'wyswig_' );
$editor_settings = array( $editor_settings = [
'textarea_name' => esc_attr( $name_prefix ) . '[' . esc_attr( $field->get_name() ) . ']' 'textarea_name' => \esc_attr( $name_prefix ) . '[' . \esc_attr( $field->get_name() ) . ']',
); ];
wp_editor( wp_kses_post( $value ), $id, $editor_settings ); wp_editor( wp_kses_post( $value ), $editor_id, $editor_settings );
?> ?>
<script type="text/javascript"> <script type="text/javascript">
(function () { (function () {
ShopMagic.wyswig.init('<?php echo $id; ?>'); ShopMagic.wyswig.init('<?php echo \esc_attr( $editor_id ); ?>');
}()); }());
</script> </script>
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment