WordPress.org
Get WordPress

Plugin Directory

Changeset 2502182


Ignore:
Timestamp:
03/24/2021 01:41:58 AM (5 years ago)
Author:
brettshumaker
Message:

ADDED: Use the filter sslp_staff_member_bio_kses_allowed_html to change which HTML tags are allowed in the Staff Member bio field - it currently defaults to the post context. Learn more.
FIXED: Added some data sanitization and escaping
FIXED: Removed extra spacing on default values
CLEANED UP: Removed some old debugging code

Location:
simple-staff-list/trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • simple-staff-list/trunk/README.txt

    r2094774 r2502182  
    33Tags: staff list, staff directory, employee list, staff, employee, employees
    44Requires at least: 3.0
    5 Tested up to: 5.2.1
    6 Stable tag: 2.2.0
     5Tested up to: 5.7
     6Stable tag: 2.2.1
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4646
    4747== Changelog ==
     48
     49= 2.2.1 =
     50* ADDED: Use the filter `sslp_staff_member_bio_kses_allowed_html` to change which HTML tags are allowed in the Staff Member bio field - it currently defaults to the `post` context. [Learn more](https://developer.wordpress.org/reference/functions/wp_kses/).
     51* FIXED: Added some data sanitization and escaping
     52* FIXED: Removed extra spacing on default values
     53* CLEANED UP: Removed some old debugging code
    4854
    4955= 2.2.0 =

  • simple-staff-list/trunk/admin/class-simple-staff-list-admin.php

    r2094774 r2502182  
    475475        switch ( $column ) {
    476476            case 'id':
    477                 echo $post->ID;
     477                echo esc_html( $post->ID );
    478478                break;
    479479            case 'photo':
    … …  
    518518            $post->ID,
    519519            '_staff_member_bio',
    520             isset( $_POST['_staff_member_bio'] ) ? $_POST['_staff_member_bio'] : ''
     520            isset( $_POST['_staff_member_bio'] ) ? wp_kses( $_POST['_staff_member_bio'], apply_filters( 'sslp_staff_member_bio_kses_allowed_html', 'post' ) ) : ''
    521521        );
    522522        update_post_meta(
    523523            $post->ID,
    524524            '_staff_member_title',
    525             isset( $_POST['_staff_member_title'] ) ? $_POST['_staff_member_title'] : ''
     525            isset( $_POST['_staff_member_title'] ) ? sanitize_text_field( $_POST['_staff_member_title'] ) : ''
    526526        );
    527527        update_post_meta(
    528528            $post->ID,
    529529            '_staff_member_email',
    530             isset( $_POST['_staff_member_email'] ) ? $_POST['_staff_member_email'] : ''
     530            isset( $_POST['_staff_member_email'] ) ? sanitize_email( $_POST['_staff_member_email'] ) : ''
    531531        );
    532532        update_post_meta(
    533533            $post->ID,
    534534            '_staff_member_phone',
    535             isset( $_POST['_staff_member_phone'] ) ? $_POST['_staff_member_phone'] : ''
     535            isset( $_POST['_staff_member_phone'] ) ? sanitize_text_field( $_POST['_staff_member_phone'] ) : ''
    536536        );
    537537        update_post_meta(
    538538            $post->ID,
    539539            '_staff_member_fb',
    540             isset( $_POST['_staff_member_fb'] ) ? $_POST['_staff_member_fb'] : ''
     540            isset( $_POST['_staff_member_fb'] ) ? sanitize_text_field( $_POST['_staff_member_fb'] ) : ''
    541541        );
    542542        update_post_meta(
    543543            $post->ID,
    544544            '_staff_member_tw',
    545             isset( $_POST['_staff_member_tw'] ) ? $_POST['_staff_member_tw'] : ''
     545            isset( $_POST['_staff_member_tw'] ) ? sanitize_text_field( $_POST['_staff_member_tw'] ) : ''
    546546        );
    547547
    … …  
    592592        }
    593593
    594         $post_type = $_POST['postType'];
    595594        $order     = $_POST['order'];
    596595

  • simple-staff-list/trunk/includes/class-simple-staff-list-activator.php

    r1816099 r2502182  
    3232     */
    3333    public static function activate( $is_forced = false ) {
    34         $default_template = '
    35         [staff_loop]
    36             <img class="staff-member-photo" src="[staff-photo-url]" alt="[staff-name] : [staff-position]">
    37             <div class="staff-member-info-wrap">
    38                 [staff-name-formatted]
    39                 [staff-position-formatted]
    40                 [staff-bio-formatted]
    41                 [staff-email-link]
    42             </div>
    43         [/staff_loop]';
     34        $default_template = "[staff_loop]\n    <img class=\"staff-member-photo\" src=\"[staff-photo-url]\" alt=\"[staff-name] : [staff-position]\">\n    <div class=\"staff-member-info-wrap\">\n        [staff-name-formatted]\n        [staff-position-formatted]\n        [staff-bio-formatted]\n        [staff-email-link]\n    </div>\n[/staff_loop]";
    4435
    45         $default_css = '
    46             /*  div wrapped around entire staff list  */
    47             div.staff-member-listing {
    48             }
    49             /*  div wrapped around each staff member  */
    50             div.staff-member {
    51                 padding-bottom: 2em;
    52                 border-bottom: thin dotted #aaa;
    53             }
    54             /*  "Even" staff member  */
    55             div.staff-member.even {
    56             }
    57             /*  "Odd" staff member  */
    58             div.staff-member.odd {
    59                 margin-top: 2em;
    60             }
    61             /*  Last staff member  */
    62             div.staff-member.last {
    63                 padding-bottom: 0;
    64                 border: none;
    65             }
    66             /*  Wrap around staff info  */
    67             .staff-member-info-wrap {
    68                 float: left;
    69                 width: 70%;
    70                 margin-left: 3%;
    71             }
    72             /*  [staff-bio-formatted]  */
    73             div.staff-member-bio {
    74             }
    75             /*  p tags within [staff-bio-formatted]  */
    76             div.staff-member-bio p {
    77             }
    78             /*  [staff-photo]  */
    79             img.staff-member-photo {
    80                 float: left;
    81             }
    82             /*  [staff-email-link]  */
    83             .staff-member-email {
    84             }
    85             /*  [staff-name-formatted]  */
    86             div.staff-member-listing h3.staff-member-name {
    87                 margin: 0;
    88             }
    89             /*  [staff-position-formatted]  */
    90             div.staff-member-listing h4.staff-member-position {
    91                 margin: 0;
    92                 font-style: italic;
    93             }
    94             /* Clearfix for div.staff-member */
    95             div.staff-member:after {
    96                 content: "";
    97                 display: block;
    98                 clear: both;
    99             }
    100             /* Clearfix for <= IE7 */
    101             * html div.staff-member { height: 1%; }
    102             div.staff-member { display: block; }
    103         ';
     36        $default_css = "/*  div wrapped around entire staff list  */\n    div.staff-member-listing {\n}\n/*  div wrapped around each staff member  */\ndiv.staff-member {\n    padding-bottom: 2em;\n    border-bottom: thin dotted #aaa;\n}\n/*  Even staff member  */\ndiv.staff-member.even {\n}\n/*  Odd staff member  */\ndiv.staff-member.odd {\n    margin-top: 2em;\n}\n/*  Last staff member  */\ndiv.staff-member.last {\n    padding-bottom: 0;\n    border: none;\n}\n/*  Wrap around staff info  */\n.staff-member-info-wrap {\n    float: left;\n    width: 70%;\n    margin-left: 3%;\n}\n/*  [staff-bio-formatted]  */\ndiv.staff-member-bio {\n}\n/*  p tags within [staff-bio-formatted]  */\ndiv.staff-member-bio p {\n}\n/*  [staff-photo]  */\nimg.staff-member-photo {\n    float: left;\n}\n/*  [staff-email-link]  */\n.staff-member-email {\n}\n/*  [staff-name-formatted]  */\ndiv.staff-member-listing h3.staff-member-name {\n    margin: 0;\n}\n/*  [staff-position-formatted]  */\ndiv.staff-member-listing h4.staff-member-position {\n    margin: 0;\n    font-style: italic;\n}\n/* Clearfix for div.staff-member */\ndiv.staff-member:after {\n    content: \"\";\n    display: block;\n    clear: both;\n}\n/* Clearfix for <= IE7 */\n* html div.staff-member { height: 1%; }\ndiv.staff-member { display: block; }\n";
    10437
    10538        $default_tags       = array(

  • simple-staff-list/trunk/includes/class-simple-staff-list.php

    r2094774 r2502182  
    6969
    7070        $this->plugin_name = 'simple-staff-list';
    71         $this->version     = '2.2.0';
     71        $this->version     = '2.2.1';
    7272
    7373        $this->load_dependencies();

  • simple-staff-list/trunk/includes/sslp-core-functions.php

    r1895344 r2502182  
    3434    $template = apply_filters( 'sslp_get_template_part', $template, $slug );
    3535
    36     //wp_die( $template );
    37 
    3836    if ( $template ) {
    3937        load_template( $template, false );

  • simple-staff-list/trunk/public/partials/simple-staff-list-shortcode-display.php

    r2094774 r2502182  
    9292    // Prepare to output styles if not using external style sheet.
    9393    if ( 'no' === $use_external_css ) {
    94         $style_output = '<style>' . $custom_css . '</style>';
     94        $style_output = '<style>' . esc_html( $custom_css ) . '</style>';
    9595    } else {
    9696        $style_output = ''; }
    … …  
    121121            $custom          = get_post_custom();
    122122            $name            = get_the_title();
    123             $name_formatted  = '<h3 class="staff-member-name">' . $name . '</h3>';
     123            $name_formatted  = '<h3 class="staff-member-name">' . esc_html( $name ) . '</h3>';
    124124            $name_slug       = basename( get_permalink() );
    125125            $title           = isset( $custom['_staff_member_title'][0] ) ? $custom['_staff_member_title'][0] : '';
    126             $title_formatted = '' !== $title ? '<h4 class="staff-member-position">' . $title . '</h4>' : '';
     126            $title_formatted = '' !== $title ? '<h4 class="staff-member-position">' . esc_html( $title ) . '</h4>' : '';
    127127            $email           = isset( $custom['_staff_member_email'][0] ) ? $custom['_staff_member_email'][0] : '';
    128128            $phone           = isset( $custom['_staff_member_phone'][0] ) ? $custom['_staff_member_phone'][0] : '';
    … …  
    130130            $fb_url          = isset( $custom['_staff_member_fb'][0] ) ? $custom['_staff_member_fb'][0] : '';
    131131            $tw_url          = isset( $custom['_staff_member_tw'][0] ) ? 'http://www.twitter.com/' . $custom['_staff_member_tw'][0] : '';
    132             $email_mailto    = '' !== $email ? '<a class="staff-member-email" href="mailto:' . antispambot( $email ) . '" title="Email ' . $name . '">' . antispambot( $email ) . '</a>' : '';
     132            $email_mailto    = '' !== $email ? '<a class="staff-member-email" href="mailto:' . esc_attr( antispambot( $email ) ) . '" title="Email ' . esc_attr( $name ) . '">' . esc_html( antispambot( $email ) ) . '</a>' : '';
    133133            $email_nolink    = '' !== $email ? antispambot( $email ) : '';
    134134
    … …  
    141141
    142142                $photo_url = $src;
    143                 $photo     = '<img class="staff-member-photo" src="' . $photo_url . '" alt = "' . $title . '">';
     143                $photo     = '<img class="staff-member-photo" src="' . esc_url( $photo_url ) . '" alt = "' . esc_attr( $title ) . '">';
    144144
    145145            } else {
    … …  
    152152            if ( function_exists( 'wpautop' ) ) {
    153153
    154                 $bio_format = '' !== $bio ? '<div class="staff-member-bio">' . wpautop( $bio ) . '</div>' : '';
     154                $bio_format = '' !== $bio ? '<div class="staff-member-bio">' . wp_kses( wpautop( $bio ), apply_filters( 'sslp_staff_member_bio_kses_allowed_html', 'post' ) ) . '</div>' : '';
    155155
    156156            } else {
    157157
    158                 $bio_format = $bio;
     158                $bio_format = wp_kses( $bio, apply_filters( 'sslp_staff_member_bio_kses_allowed_html', 'post' ) );
    159159
    160160            }
    161161
    162162            $accepted_single_tags  = $default_tags;
    163             $replace_single_values = apply_filters( 'sslp_replace_single_values_filter', array( $name, $name_slug, $photo_url, $title, $email_nolink, $phone, $bio, $fb_url, $tw_url ), $post->ID );
     163            $replace_single_values = apply_filters( 'sslp_replace_single_values_filter', array( esc_html( $name ), esc_attr( $name_slug ), esc_url( $photo_url ), esc_html( $title ), esc_html( $email_nolink ), esc_html( $phone ), wp_kses( $bio, apply_filters( 'sslp_staff_member_bio_kses_allowed_html', 'post' ) ), esc_html( $fb_url ), esc_url( $tw_url ) ), $post->ID );
    164164
    165165            $accepted_formatted_tags  = $default_formatted_tags;

  • simple-staff-list/trunk/public/templates/single-staff-member/staff-bio.php

    r1895343 r2502182  
    1414$bio = get_post_meta( $post->ID, '_staff_member_bio', true );
    1515
    16 echo wpautop( $bio );
     16echo wp_kses( wpautop( $bio ), apply_filters( 'sslp_staff_member_bio_kses_allowed_html', 'post' ) );

  • simple-staff-list/trunk/public/templates/single-staff-member/staff-facebook.php

    r1895343 r2502182  
    2525    }
    2626
    27     echo '<span class="facebook"><a class="staff-member-facebook" href="' . esc_attr( $facebook ) . '" title="Find ' . esc_attr( get_the_title() ) . ' on Facebook">' . $icon . '</a></span>';
     27    echo '<span class="facebook"><a class="staff-member-facebook" href="' . esc_url( $facebook ) . '" title="Find ' . esc_attr( get_the_title() ) . ' on Facebook">' . $icon . '</a></span>';
    2828
    2929}

  • simple-staff-list/trunk/public/templates/single-staff-member/staff-image.php

    r1895343 r2502182  
    1919$src       = $image_obj[0];
    2020?>
    21 <img class="staff-member-photo" src="<?php echo esc_attr( $src ); ?>" alt = "<?php echo esc_attr( get_the_title() ); ?>">
     21<img class="staff-member-photo" src="<?php echo esc_url( $src ); ?>" alt = "<?php echo esc_attr( get_the_title() ); ?>">

  • simple-staff-list/trunk/simple-staff-list.php

    r2094774 r2502182  
    1616 * Plugin URI:        https://wordpress.org/plugins/simple-staff-list/
    1717 * Description:       A simple plugin to build and display a staff listing for your website.
    18  * Version:           2.2.0
     18 * Version:           2.2.1
    1919 * Author:            Brett Shumaker
    2020 * Author URI:        http://www.brettshumaker.com
Note: See TracChangeset for help on using the changeset viewer.