Skip to content
This repository was archived by the owner on Jan 13, 2022. It is now read-only.

Commit 0daae30

Browse files
niallkennedyniallkennedy
committed
escape values at the time they are output to pass WordPress.com scripts
1 parent 6dacdee commit 0daae30

File tree

3 files changed

+21
-22
lines changed

3 files changed

+21
-22
lines changed

‎admin/settings-debug.php

+19-20
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ public static function app_section() {
198198
return;
199199

200200
echo '<section id="debug-app">';
201-
echo '<header><h3><a href="' . self::get_app_edit_base_uri( $facebook_loader->credentials['app_id'] ) . '" target="_blank">' . esc_html( sprintf( __( 'App %s', 'facebook' ), $facebook_loader->credentials['app_id'] ) ) . '</a></h3></header>';
201+
echo '<header><h3><a href="' . esc_url( self::get_app_edit_base_uri( $facebook_loader->credentials['app_id'] ), array('http', 'https') ) . '" target="_blank">' . esc_html( sprintf( __( 'App %s', 'facebook' ), $facebook_loader->credentials['app_id'] ) ) . '</a></h3></header>';
202202

203203
self::app_editors( $facebook_loader->credentials['app_id'] );
204204
self::app_details( $facebook_loader->credentials['app_id'] );
@@ -284,12 +284,12 @@ public static function app_editors( $app_id ) {
284284
if ( $wordpress_users_display_count === 1 ) {
285285
$ask_string = $wordpress_users_display[0];
286286
} else if ( $wordpress_users_display_count === 2 ) {
287-
$ask_string = $wordpress_users_display[0] . ' ' . _x( 'or', 'bridge between two options: this or that or these', 'facebook' ) . ' ' . $wordpress_users_display[1];
287+
$ask_string = $wordpress_users_display[0] . ' ' . esc_html( _x( 'or', 'bridge between two options: this or that or these', 'facebook' ) ) . ' ' . $wordpress_users_display[1];
288288
} else {
289-
$ask_string = ', ' . _x( 'or', 'bridge between two options: this or that or these', 'facebook' ) . ' ' . array_pop( $wordpress_users_display );
289+
$ask_string = ', ' . esc_html( _x( 'or', 'bridge between two options: this or that or these', 'facebook' ) ) . ' ' . array_pop( $wordpress_users_display );
290290
$ask_string = implode( ', ', $wordpress_users_display ) . $ask_string;
291291
}
292-
echo '<p>' . sprintf( __( '%s can change these application settings on Facebook.', 'facebook' ), $ask_string ) . '</p>';
292+
echo '<p>' . sprintf( esc_html( __( '%s can change these application settings on Facebook.', 'facebook' ) ), $ask_string ) . '</p>';
293293
}
294294

295295
/**
@@ -315,14 +315,16 @@ public static function app_details( $app_id ) {
315315

316316
// link to the relevant Facebook app editor screen
317317
$app_edit_base_uri = self::get_app_edit_base_uri( $app_id );
318+
$app_details_uri = $app_edit_base_uri . 'appdetails/';
319+
$app_summary_uri = $app_edit_base_uri . 'summary/';
318320

319321
echo '<table id="facebook-app-login-fields">';
320322
echo '<caption>' . esc_html( __( 'Facebook Login', 'facebook' ) ) . '</caption>';
321323
echo '<thead><tr><th>' . esc_html( _x( 'Setting', 'Table column header. The Facebook application setting.', 'facebook' ) ) . '</th><th>' . esc_html( _x( 'Value', 'Facebook application setting retrieved from Facebook servers.', 'facebook' ) ) . '</th></tr></thead>';
322324
echo '<tbody>';
323325

324326
// app name
325-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/#name" target="_blank">' . esc_html( __( 'App name', 'facebook' ) ) . '</a></th><td';
327+
echo '<tr><th><a href="' . esc_url( $app_details_uri . '#name', array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'App name', 'facebook' ) ) . '</a></th><td';
326328
if ( isset( $app_details['name'] ) && $app_details['name'] ) {
327329
echo '>"' . esc_html( $app_details['name'] ) . '"';
328330
} else {
@@ -338,7 +340,7 @@ public static function app_details( $app_id ) {
338340
echo '</td></tr>';
339341

340342
// app domains able to act on behalf of the application
341-
echo '<tr><th><a href="' . $app_edit_base_uri . 'summary/" target="_blank">' . esc_html( __( 'App Domains', 'facebook' ) ) . '</a></th><td';
343+
echo '<tr><th><a href="' . esc_url( $app_summary_uri, array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'App Domains', 'facebook' ) ) . '</a></th><td';
342344
if ( isset( $app_details['app_domains'] ) && ! empty( $app_details['app_domains'] ) ) {
343345
echo '><ul>';
344346
foreach( $app_details['app_domains'] as $app_domain ) {
@@ -352,18 +354,17 @@ public static function app_details( $app_id ) {
352354
echo '</td></tr>';
353355

354356
// Website with Facebook Login
355-
echo '<tr><th><a href="' . $app_edit_base_uri . 'summary/#site_url_input" target="_blank">' . esc_html( __( 'Website', 'facebook' ) ) . '</a></th><td';
357+
echo '<tr><th><a href="' . esc_url( $app_summary_uri .'#site_url_input', array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'Website', 'facebook' ) ) . '</a></th><td';
356358
if ( isset( $app_details['website_url'] ) && $app_details['website_url'] ) {
357-
$app_details['website_url'] = esc_url( $app_details['website_url'], array( 'http', 'https' ) );
358-
echo '><a href="' . $app_details['website_url'] . '" target="_blank">' . $app_details['website_url'] . '</a>';
359+
echo '><a href="' . esc_url( $app_details['website_url'], array( 'http', 'https' ) ) . '" target="_blank">' . esc_html( $app_details['website_url'] ) . '</a>';
359360
} else {
360361
echo ' class="error-message">';
361362
echo esc_html( sprintf( __( 'Not set. Consider using: %s', 'facebook' ), home_url( '/' ) ) );
362363
}
363364
echo '</td></tr>';
364365

365366
// One-line description
366-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/" target="_blank">' . esc_html( __( 'One-line description', 'facebook' ) ) . '</a></th><td';
367+
echo '<tr><th><a href="' . esc_url( $app_details_uri, array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'One-line description', 'facebook' ) ) . '</a></th><td';
367368
if ( isset( $app_details['auth_dialog_headline'] ) && $app_details['auth_dialog_headline'] ) {
368369
echo '>"' . esc_html( $app_details['auth_dialog_headline'] ) . '"';
369370
} else {
@@ -379,36 +380,35 @@ public static function app_details( $app_id ) {
379380
echo '</td></tr>';
380381

381382
// publish permissions explanation
382-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/" target="_blank">' . esc_html( _x( 'Publish permissions explanation', 'Explain the reason for requesting publish permissions from a Facebook user', 'facebook' ) ) . '</a></th><td';
383+
echo '<tr><th><a href="' . esc_url( $app_details_uri, array('http', 'https') ) . '" target="_blank">' . esc_html( _x( 'Publish permissions explanation', 'Explain the reason for requesting publish permissions from a Facebook user', 'facebook' ) ) . '</a></th><td';
383384
if ( isset( $app_details['auth_dialog_perms_explanation'] ) && $app_details['auth_dialog_perms_explanation'] )
384385
echo '>"' . esc_html( $app_details['auth_dialog_perms_explanation'] ) . '"';
385386
else
386387
echo ' class="error-message">' . esc_html( sprintf( __( 'Not set. Consider using: %s', 'facebook' ), '"' . __( 'Publish new posts to your Facebook Timeline or Page.', 'facebook' ) . '"' ) );
387388
echo '</td></tr>';
388389

389390
// Privacy Policy
390-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/#privacy_url" target="_blank">' . esc_html( __( 'Privacy Policy', 'facebook' ) ) . '</a></th><td';
391+
echo '<tr><th><a href="' . esc_url( $app_details_uri . '#privacy_url', array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'Privacy Policy', 'facebook' ) ) . '</a></th><td';
391392
if ( isset( $app_details['privacy_policy_url'] ) && $app_details['privacy_policy_url'] ) {
392-
$app_details['privacy_policy_url'] = esc_url( $app_details['privacy_policy_url'], array( 'http', 'https' ) );
393-
echo '><a href="' . $app_details['privacy_policy_url'] . '" target="_blank">' . $app_details['privacy_policy_url'] . '</a>';
393+
echo '><a href="' . esc_url( $app_details['privacy_policy_url'], array( 'http', 'https' ) ) . '" target="_blank">' . esc_html( $app_details['privacy_policy_url'] ) . '</a>';
394394
} else {
395395
echo ' class="error-message">' . esc_html( __( 'Not set.', 'facebook' ) ) . ' ' . esc_html( _x( 'Create a new page?', 'Create a new WordPress page', 'facebook' ) );
396396
}
397397
echo '</td></tr>';
398398

399399
// Terms of Service
400-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/#tos_url" target="_blank">' . esc_html( __( 'Terms of Service', 'facebook' ) ) . '</a></th><td';
400+
echo '<tr><th><a href="' . esc_url( $app_details_uri . '#tos_url', array('http', 'https') ) . '" target="_blank">' . esc_html( __( 'Terms of Service', 'facebook' ) ) . '</a></th><td';
401401
if ( isset( $app_details['terms_of_service_url'] ) && $app_details['terms_of_service_url'] ) {
402402
$app_details['terms_of_service_url'] = esc_url( $app_details['terms_of_service_url'], array( 'http', 'https' ) );
403-
echo '><a href="' . $app_details['terms_of_service_url'] . '" target="_blank">' . $app_details['terms_of_service_url'] . '</a>';
403+
echo '><a href="' . esc_url( $app_details['terms_of_service_url'], array( 'http', 'https' ) ) . '" target="_blank">' . esc_html( $app_details['terms_of_service_url'] ) . '</a>';
404404
} else {
405405
echo ' class="error-message">';
406406
echo esc_html( __( 'Not set.', 'facebook' ) ) . ' ' . esc_html( _x( 'Create a new page?', 'Create a new WordPress page', 'facebook' ) );
407407
}
408408
echo '</td></tr>';
409409

410410
// Logo
411-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/" target="_blank">' . esc_html( _x( 'Logo', 'Facebook application logo', 'facebook' ) ) . '</a></th><td';
411+
echo '<tr><th><a href="' . esc_url( $app_details_uri, array('http', 'https') ) . '" target="_blank">' . esc_html( _x( 'Logo', 'Facebook application logo', 'facebook' ) ) . '</a></th><td';
412412
if ( isset( $app_details['logo_url'] ) && $app_details['logo_url'] ) {
413413
echo '><img alt="' . esc_attr( __( 'Facebook application logo', 'facebook' ) ) . '" src="' . esc_url( $app_details['logo_url'], array( 'http', 'https' ) ) . '" />';
414414
} else {
@@ -417,7 +417,7 @@ public static function app_details( $app_id ) {
417417
echo '</td></tr>';
418418

419419
// Icon
420-
echo '<tr><th><a href="' . $app_edit_base_uri . 'appdetails/" target="_blank">' . esc_html( _x( 'Icon', 'Facebook application icon', 'facebook' ) ) . '</a></th><td';
420+
echo '<tr><th><a href="' . esc_url( $app_details_uri, array('http', 'https') ) . '" target="_blank">' . esc_html( _x( 'Icon', 'Facebook application icon', 'facebook' ) ) . '</a></th><td';
421421
if ( isset( $app_details['icon_url'] ) && $app_details['icon_url'] ) {
422422
echo '><img alt="' . esc_attr( __( 'Facebook application icon', 'facebook' ) ) . '" src="' . esc_url( $app_details['icon_url'], array( 'http', 'https' ) ) . '" />';
423423
} else {
@@ -550,8 +550,7 @@ public static function post_to_page_section() {
550550
$page_link = $post_to_page['link'];
551551
else
552552
$page_link = 'https://www.facebook.com/' . $post_to_page['id'];
553-
$page_link = esc_url( $page_link, array( 'http', 'https' ) );
554-
echo '<p>' . sprintf( esc_html( _x( 'Publishing to %s.', 'publishing to a page name on Facebook.com', 'facebook' ) ), '<a href="' . $page_link . '">' . esc_html( $post_to_page['name'] ) . '</a>' );
553+
echo '<p>' . sprintf( esc_html( _x( 'Publishing to %s.', 'publishing to a page name on Facebook.com', 'facebook' ) ), '<a href="' . esc_url( $page_link, array( 'http', 'https' ) ) . '">' . esc_html( $post_to_page['name'] ) . '</a>' );
555554
unset( $page_link );
556555
if ( isset( $post_to_page['set_by_user'] ) ) {
557556
if ( get_current_user_id() == $post_to_page['set_by_user'] ) {

‎admin/settings-social-plugin.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public static function color_scheme_choices( $name, $existing_value = 'light' )
131131
// provides a hint of final display. May change but possibly helpful in making a decision
132132
if ( isset( self::$color_scheme_styles[$color_scheme] ) )
133133
$checkboxes .= ' style="padding:0.5em;' . self::$color_scheme_styles[$color_scheme] . '"';
134-
$checkboxes .= '><input type="radio" name="' . $name . '" value="' . $color_scheme . '"' . checked( $existing_value, $color_scheme, false ) . ' />';
134+
$checkboxes .= '><input type="radio" name="' . $name . '" value="' . esc_attr( $color_scheme ) . '"' . checked( $existing_value, $color_scheme, false ) . ' />';
135135
$checkboxes .= ' ' . esc_html( __( $color_scheme, 'facebook' ) ) . '</label> ';
136136
}
137137
return rtrim( $checkboxes );

‎open-graph-protocol.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ public static function meta_elements( $property, $content ) {
103103
self::meta_elements( $property . ':' . $structured_property, $content_value );
104104
}
105105
} else {
106-
echo '<meta property="' . $property . '" content="' . esc_attr( $content ) . '"';
106+
echo '<meta property="' . esc_attr( $property ) . '" content="' . esc_attr( $content ) . '"';
107107

108108
// do not use trailing slash if HTML5
109109
// http://wiki.whatwg.org/wiki/FAQ#Should_I_close_empty_elements_with_.2F.3E_or_.3E.3F

0 commit comments

Comments
 (0)