From d899aa04a4a9c63cf6299b57ecd2ecce212aae7a Mon Sep 17 00:00:00 2001 From: Matt Harvey Date: Tue, 24 Mar 2015 12:39:11 -0700 Subject: [PATCH 1/5] Add escaping to the components that were missing it. --- admin/class-aesop-core-admin.php | 12 +++------ .../includes/components/component-gallery.php | 12 ++++----- admin/includes/components/component-map.php | 26 +++++++++---------- public/includes/components/component-cbox.php | 8 +++--- .../components/component-character.php | 2 +- .../components/component-collections.php | 10 +++---- .../includes/components/component-gallery.php | 24 ++++++++--------- .../includes/components/component-heading.php | 4 +-- .../includes/components/component-image.php | 6 ++--- public/includes/components/component-map.php | 16 ++++++------ .../components/component-parallax.php | 2 +- .../includes/components/component-quote.php | 2 +- .../includes/components/component-video.php | 4 +-- 13 files changed, 62 insertions(+), 66 deletions(-) diff --git a/admin/class-aesop-core-admin.php b/admin/class-aesop-core-admin.php index aa64a1af..b85233ff 100755 --- a/admin/class-aesop-core-admin.php +++ b/admin/class-aesop-core-admin.php @@ -148,7 +148,7 @@ public function generator_button() { $button = apply_filters( 'aesop_generator_button', $getbutton ); - echo $button; + echo esc_html( $button ); } @@ -193,13 +193,9 @@ public function generator_popup() {
- + +
'; - echo $out; + echo esc_html( $out ); } } @@ -456,7 +456,7 @@ public function upgrade_click_handle() { var data = { action: 'upgrade_galleries', - security: '' + security: }; jQuery.post(ajaxurl, data, function(response) { diff --git a/admin/includes/components/component-map.php b/admin/includes/components/component-map.php index 28ed764f..ae41e170 100644 --- a/admin/includes/components/component-map.php +++ b/admin/includes/components/component-map.php @@ -140,13 +140,13 @@ public function render_map_box( $post ) { echo '
'; $ase_map_locations = get_post_meta( $post->ID, 'ase_map_component_locations' ); - $ase_map_start_point = get_post_meta( $post->ID, 'ase_map_component_start_point', true ); - $get_map_zoom = get_post_meta( $post->ID, 'ase_map_component_zoom', true ); + $ase_map_start_point = get_post_meta( $post->ID, 'ase_map_component_start_point', true ); + $get_map_zoom = get_post_meta( $post->ID, 'ase_map_component_zoom', true ); - $ase_map_start_point = empty ( $ase_map_start_point ) ? array( 29.76, -95.38 ) : array( $ase_map_start_point['lat'], $ase_map_start_point['lng'] ); - $ase_map_zoom = empty ( $get_map_zoom ) ? 12 : $get_map_zoom; + $ase_map_start_point = empty ( $ase_map_start_point ) ? array( 29.76, -95.38 ) : array( $ase_map_start_point['lat'], $ase_map_start_point['lng'] ); + $ase_map_zoom = empty ( $get_map_zoom ) ? 12 : $get_map_zoom; - $ase_map_start_point = json_encode( $ase_map_start_point ); + $ase_map_start_point = json_encode( $ase_map_start_point ); $ase_map_locations = json_encode( $ase_map_locations ); $tiles = aesop_map_tile_provider( $post->ID ); @@ -157,7 +157,7 @@ public function render_map_box( $post ) { jQuery(document).ready(function(){ - var start_point = ; + var start_point = ; var start_zoom = ; var map = L.map('aesop-map',{ @@ -175,12 +175,12 @@ public function render_map_box( $post ) { setMapCenter(lat,lng); }); - L.tileLayer('', { + L.tileLayer('', { maxZoom: 20 }).addTo(map); - var ase_map_locations = + var ase_map_locations = ase_map_locations.forEach(function(location) { @@ -411,7 +411,7 @@ public function upgrade_map_notice() { $out .= '

'; - echo $out; + echo esc_html( $out ); } } @@ -490,7 +490,7 @@ public function upgrade_marker_meta() { $old_start_point = get_post_meta( $id, 'aesop_map_start', true ); if ( ! empty ( $old_start_point ) ) { - echo $old_start_point; + echo esc_html( $old_start_point ); $old_start_point = explode( ',', $old_start_point ); if ( count( $old_start_point ) == 2 ) { $translated = array(); @@ -534,7 +534,7 @@ public function upgrade_click_handle() { var data = { action: 'upgrade_marker_meta', - security: '' + security: }; jQuery.post(ajaxurl, data, function(response) { @@ -566,7 +566,7 @@ public function upgrade_mapboxid_notice() { $out .= '

'; - echo $out; + echo esc_html( $out ); } } @@ -593,7 +593,7 @@ public function upgrade_mapbox_click_handle() { var data = { action: 'upgrade_mapbox', - security: '' + security: }; $.post(ajaxurl, data, function(response) { diff --git a/public/includes/components/component-cbox.php b/public/includes/components/component-cbox.php index 43a6fd56..97b6ee19 100644 --- a/public/includes/components/component-cbox.php +++ b/public/includes/components/component-cbox.php @@ -82,7 +82,7 @@ function aesop_content_shortcode( $atts, $content = null ) { do_action( 'aesop_cbox_before' ); // action ?> -
class="aesop-component aesop-content-component " style="" > +
class="aesop-component aesop-content-component " style="" > @@ -120,17 +120,17 @@ function scrollParallax(){ echo do_action( 'aesop_cbox_inside_top' ); // action ?> -
> +
> -
+
-
> +
> diff --git a/public/includes/components/component-character.php b/public/includes/components/component-character.php index 67021175..2d143972 100644 --- a/public/includes/components/component-character.php +++ b/public/includes/components/component-character.php @@ -47,7 +47,7 @@ function aesop_character_shortcode( $atts, $content = null ) {
-
> +
> diff --git a/public/includes/components/component-collections.php b/public/includes/components/component-collections.php index 73fe912c..885d6b31 100644 --- a/public/includes/components/component-collections.php +++ b/public/includes/components/component-collections.php @@ -44,7 +44,7 @@ function aesop_collection_shortcode( $atts ) {

-
+
+ ?>
-

name;?>

-
category_description;?>
+

name ); ?>

+
category_description ); ?>
 @@ -121,7 +121,7 @@ function aesop_collection_shortcode( $atts ) {

Written by

-
+
diff --git a/public/includes/components/component-gallery.php b/public/includes/components/component-gallery.php index e9a70180..d3dad7d6 100644 --- a/public/includes/components/component-gallery.php +++ b/public/includes/components/component-gallery.php @@ -182,10 +182,10 @@ public function aesop_grid_gallery( $gallery_id, $image_ids, $width ) { foreach ( $image_ids as $image_id ): - $getimage = wp_get_attachment_image( $image_id, 'aesop-grid-image', false, array( 'class' => 'aesop-grid-image' ) ); - $getimagesrc = wp_get_attachment_image_src( $image_id, 'full' ); - $img_title = get_post( $image_id )->post_title; - $caption = get_post( $image_id )->post_excerpt; + $getimage = wp_get_attachment_image( $image_id, 'aesop-grid-image', false, array( 'class' => 'aesop-grid-image' ) ); + $getimagesrc = wp_get_attachment_image_src( $image_id, 'full' ); + $img_title = get_post( $image_id )->post_title; + $caption = get_post( $image_id )->post_excerpt; ?> @@ -194,7 +194,7 @@ public function aesop_grid_gallery( $gallery_id, $image_ids, $width ) { - + @@ -242,7 +242,7 @@ public function aesop_stacked_gallery( $image_ids, $unique ) { $caption = get_post( $image_id )->post_excerpt; ?> -
+
@@ -269,18 +269,18 @@ public function aesop_sequence_gallery( $image_ids ) { foreach ( $image_ids as $image_id ): $img = wp_get_attachment_image_src( $image_id, $size, false, '' ); - $alt = get_post_meta( $image_id, '_wp_attachment_image_alt', true ); - $caption = get_post( $image_id )->post_excerpt; + $alt = get_post_meta( $image_id, '_wp_attachment_image_alt', true ); + $caption = get_post( $image_id )->post_excerpt; - $lazy = class_exists( 'AesopLazyLoader' ) && ! is_user_logged_in() ? sprintf( 'src="%s" data-src="%s" class="aesop-sequence-img aesop-lazy-img"', $lazy_holder, esc_url( $img[0] ) ) : sprintf( 'src="%s" class="aesop-sequence-img" ', esc_url( $img[0] ) ); + $lazy = class_exists( 'AesopLazyLoader' ) && ! is_user_logged_in() ? sprintf( 'src="%s" data-src="%s" class="aesop-sequence-img aesop-lazy-img"', $lazy_holder, esc_url( $img[0] ) ) : sprintf( 'src="%s" class="aesop-sequence-img" ', esc_url( $img[0] ) ); ?>
- alt=""> + alt=""> -
+
@@ -358,7 +358,7 @@ public function aesop_photoset_gallery( $gallery_id, $image_ids, $width ) { $lb_link = $lightbox ? sprintf( 'data-highres="%s"', esc_url( $full[0] ) ) : null; - ?> data-caption="" title="" alt=""> data-caption="" title="" alt=""> -
class="aesop-article-chapter-wrap default-cover aesop-component " > +
class="aesop-article-chapter-wrap default-cover aesop-component " > -
> +
>

diff --git a/public/includes/components/component-image.php b/public/includes/components/component-image.php index 1da6983f..5859754c 100644 --- a/public/includes/components/component-image.php +++ b/public/includes/components/component-image.php @@ -58,14 +58,14 @@ function aesop_image_shortcode( $atts ) { if ( 'on' == $atts['lightbox'] ) { ?> - +

- alt=""> + alt=""> - alt=""> + alt=""> -
class="aesop-component aesop-map-component " > +
class="aesop-component aesop-map-component " > , - center: [] + center: [] }); - L.tileLayer('', { + L.tileLayer('', { maxZoom: 20 }).addTo(map); @@ -150,19 +150,19 @@ public function aesop_map_loader() { foreach ( $markers as $marker ): $lat = $marker['lat']; - $long = $marker['lng']; - $text = $marker['title'] ? $marker['title'] : null; + $long = $marker['lng']; + $text = $marker['title'] ? $marker['title'] : null; - $loc = sprintf( '%s,%s', esc_attr( $lat ), esc_attr( $long ) ); + $loc = sprintf( '%s,%s', esc_attr( $lat ), esc_attr( $long ) ); // if market content is set run a popup if ( $text ) { ?> - L.marker([]).addTo(map).bindPopup('').openPopup(); + L.marker([]).addTo(map).bindPopup('').openPopup(); - L.marker([]).addTo(map); + L.marker([]).addTo(map); " href=""> - <?php echo esc_attr( $auto_alt );?> + <?php echo esc_attr( $auto_alt );?>
diff --git a/public/includes/components/component-quote.php b/public/includes/components/component-quote.php index 75eeacd3..c67ad208 100644 --- a/public/includes/components/component-quote.php +++ b/public/includes/components/component-quote.php @@ -82,7 +82,7 @@ function aesop_quote_shortcode( $atts ) { do_action( 'aesop_quote_before' ); // action ?> -
class="aesop-component aesop-quote-component " > +
class="aesop-component aesop-quote-component " > diff --git a/public/includes/components/component-video.php b/public/includes/components/component-video.php index d69efb99..742a96d1 100644 --- a/public/includes/components/component-video.php +++ b/public/includes/components/component-video.php @@ -86,7 +86,7 @@ function aesop_video_shortcode( $atts ) { -
> +
>
-
From 8cfe1ed433ee5d8d2f07cbf290593629ccce40ff Mon Sep 17 00:00:00 2001 From: Matt Harvey Date: Tue, 24 Mar 2015 12:42:52 -0700 Subject: [PATCH 2/5] Stop double encoding the map variables. --- admin/includes/components/component-map.php | 3 --- 1 file changed, 3 deletions(-) diff --git a/admin/includes/components/component-map.php b/admin/includes/components/component-map.php index ae41e170..8260a2a5 100644 --- a/admin/includes/components/component-map.php +++ b/admin/includes/components/component-map.php @@ -146,9 +146,6 @@ public function render_map_box( $post ) { $ase_map_start_point = empty ( $ase_map_start_point ) ? array( 29.76, -95.38 ) : array( $ase_map_start_point['lat'], $ase_map_start_point['lng'] ); $ase_map_zoom = empty ( $get_map_zoom ) ? 12 : $get_map_zoom; - $ase_map_start_point = json_encode( $ase_map_start_point ); - $ase_map_locations = json_encode( $ase_map_locations ); - $tiles = aesop_map_tile_provider( $post->ID ); ?> From 1491a5e91d2f5cfb22a9ad4f12d5fce7dafdf93e Mon Sep 17 00:00:00 2001 From: Matt Harvey Date: Fri, 3 Apr 2015 10:24:17 -0700 Subject: [PATCH 3/5] Do not escape HTML output that is already escaped. --- admin/class-aesop-core-admin.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin/class-aesop-core-admin.php b/admin/class-aesop-core-admin.php index b85233ff..568f05b3 100755 --- a/admin/class-aesop-core-admin.php +++ b/admin/class-aesop-core-admin.php @@ -148,7 +148,7 @@ public function generator_button() { $button = apply_filters( 'aesop_generator_button', $getbutton ); - echo esc_html( $button ); + echo wp_kses( $button ); } From f82939d111e285ca98217588c40ed7b4b52408be Mon Sep 17 00:00:00 2001 From: Matt Harvey Date: Fri, 3 Apr 2015 14:36:22 -0700 Subject: [PATCH 4/5] Stop escaping output that is already escaped/has HTML/JS. --- admin/class-aesop-core-admin.php | 2 +- admin/includes/components/component-gallery.php | 2 +- admin/includes/components/component-map.php | 4 ++-- public/includes/components/component-cbox.php | 4 ++-- public/includes/components/component-character.php | 2 +- public/includes/components/component-gallery.php | 2 +- public/includes/components/component-image.php | 6 +++--- public/includes/components/component-quote.php | 2 +- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/admin/class-aesop-core-admin.php b/admin/class-aesop-core-admin.php index 568f05b3..94ef009f 100755 --- a/admin/class-aesop-core-admin.php +++ b/admin/class-aesop-core-admin.php @@ -148,7 +148,7 @@ public function generator_button() { $button = apply_filters( 'aesop_generator_button', $getbutton ); - echo wp_kses( $button ); + echo ( $button ); } diff --git a/admin/includes/components/component-gallery.php b/admin/includes/components/component-gallery.php index abe3121e..a1d01cca 100644 --- a/admin/includes/components/component-gallery.php +++ b/admin/includes/components/component-gallery.php @@ -394,7 +394,7 @@ public function upgrade_galleries_notice() { $out .= '

'; - echo esc_html( $out ); + echo $out; } } diff --git a/admin/includes/components/component-map.php b/admin/includes/components/component-map.php index 8260a2a5..13f561dd 100644 --- a/admin/includes/components/component-map.php +++ b/admin/includes/components/component-map.php @@ -408,7 +408,7 @@ public function upgrade_map_notice() { $out .= '

'; - echo esc_html( $out ); + echo wp_kses( $out ); } } @@ -563,7 +563,7 @@ public function upgrade_mapboxid_notice() { $out .= '

'; - echo esc_html( $out ); + echo wp_kses( $out ); } } diff --git a/public/includes/components/component-cbox.php b/public/includes/components/component-cbox.php index 97b6ee19..aa76ada3 100644 --- a/public/includes/components/component-cbox.php +++ b/public/includes/components/component-cbox.php @@ -120,7 +120,7 @@ function scrollParallax(){ echo do_action( 'aesop_cbox_inside_top' ); // action ?> -
> +
> -
> +
> diff --git a/public/includes/components/component-character.php b/public/includes/components/component-character.php index 2d143972..eb82e26f 100644 --- a/public/includes/components/component-character.php +++ b/public/includes/components/component-character.php @@ -47,7 +47,7 @@ function aesop_character_shortcode( $atts, $content = null ) {
-
> +
> diff --git a/public/includes/components/component-gallery.php b/public/includes/components/component-gallery.php index d3dad7d6..6eec933c 100644 --- a/public/includes/components/component-gallery.php +++ b/public/includes/components/component-gallery.php @@ -194,7 +194,7 @@ public function aesop_grid_gallery( $gallery_id, $image_ids, $width ) { - + diff --git a/public/includes/components/component-image.php b/public/includes/components/component-image.php index 5859754c..60067de5 100644 --- a/public/includes/components/component-image.php +++ b/public/includes/components/component-image.php @@ -51,7 +51,7 @@ function aesop_image_shortcode( $atts ) {
-
> +
> " title="">

- alt=""> + alt=""> - alt=""> + alt=""> -
class="aesop-component aesop-quote-component " > +
class="aesop-component aesop-quote-component " > From 456932d9b6083275ad98ea0f180532b91e49704c Mon Sep 17 00:00:00 2001 From: Matt Harvey Date: Tue, 7 Apr 2015 10:11:25 -0700 Subject: [PATCH 5/5] Remove errant ()s --- admin/class-aesop-core-admin.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin/class-aesop-core-admin.php b/admin/class-aesop-core-admin.php index 94ef009f..b44eb3d0 100755 --- a/admin/class-aesop-core-admin.php +++ b/admin/class-aesop-core-admin.php @@ -148,7 +148,7 @@ public function generator_button() { $button = apply_filters( 'aesop_generator_button', $getbutton ); - echo ( $button ); + echo $button; }