Skip to content

Commit b430b9d

Browse files
pavelthqpavelthq
committed
VC-2957 apply fixes for resources/views
1 parent f43ab85 commit b430b9d

27 files changed

+236
-181
lines changed

‎visualcomposer/Helpers/Globals.php

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?php
2+
3+
namespace VisualComposer\Helpers;
4+
5+
if (!defined('ABSPATH')) {
6+
header('Status: 403 Forbidden');
7+
header('HTTP/1.1 403 Forbidden');
8+
exit;
9+
}
10+
11+
use VisualComposer\Framework\Illuminate\Support\Helper;
12+
use function VisualComposer\Framework\esc_html;
13+
14+
class Output implements Helper
15+
{
16+
public function printNotEscaped($content)
17+
{
18+
echo esc_html($content);
19+
}
20+
21+
public function printEscaped($content)
22+
{
23+
echo \esc_html($content);
24+
}
25+
}

‎visualcomposer/resources/views/editor/frontend/fe-update-wrapper.php

+12-10
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,19 @@
1212
}
1313
require_once ABSPATH . 'wp-admin/includes/admin.php';
1414

15+
$globalsHelper = vchelper('Globals');
16+
$outputHelper = vchelper('Output');
1517
// @codingStandardsIgnoreStart
1618
global $title, $hook_suffix, $current_screen, $wp_locale, $pagenow, $wp_version,
1719
$update_title, $total_update_count, $parent_file, $typenow, $wp_meta_boxes;
1820

1921
$hookSuffix = $hook_suffix;
20-
$wp_meta_boxes = [];
22+
$globalsHelper->set('wp_meta_boxes', []);
2123
if (empty($current_screen)) {
2224
set_current_screen();
2325
}
2426
// @codingStandardsIgnoreEnd
25-
$typenow = get_post_type();
27+
$globalsHelper->set('typenow', get_post_type());
2628
/**
2729
* @var $editableLink - link to editable content
2830
*/
@@ -31,10 +33,10 @@
3133
wp_enqueue_media();
3234
?>
3335
<!DOCTYPE html>
34-
<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
36+
<html xmlns="https://w3.org/1999/xhtml" <?php language_attributes(); ?>>
3537
<head>
36-
<link rel="profile" href="http://gmpg.org/xfn/11" />
37-
<meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
38+
<link rel="profile" href="https://gmpg.org/xfn/11" />
39+
<meta http-equiv="Content-Type" content="<?php echo esc_attr(get_bloginfo('html_type', 'display')); ?>; charset=<?php echo esc_attr(get_bloginfo('charset', 'display')); ?>" />
3840
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, maximum-scale=1, user-scalable=0" />
3941
<title>Visual Composer: Update</title>
4042
<link rel="stylesheet"
@@ -57,8 +59,8 @@
5759
if (is_array($variables)) {
5860
foreach ($variables as $variable) {
5961
if (is_array($variable) && isset($variable['key'], $variable['value'])) {
60-
$type = isset($variable['type']) ? $variable['type'] : 'variable';
61-
evcview('partials/variableTypes/' . $type, $variable);
62+
$variableType = isset($variable['type']) ? $variable['type'] : 'variable';
63+
evcview('partials/variableTypes/' . $variableType, $variable);
6264
}
6365
}
6466
unset($variable);
@@ -72,10 +74,10 @@
7274
?>
7375
</head>
7476
<body class="vcv-wb-editor vcv-is-disabled-outline">
75-
<script src="<?php echo get_site_url(null, 'index.php?vcv-script=vendor'); ?>"></script>
77+
<script src="<?php echo esc_url(get_site_url(null, 'index.php?vcv-script=vendor')); ?>"></script>
7678

7779
<div class="vcv-settings" data-section="vcv-update">
78-
<?php echo $content; ?>
80+
<?php $outputHelper->printNotEscaped($content); ?>
7981
</div>
8082
<?php
8183
vcevent('vcv:frontend:postUpdate:render:footer', ['sourceId' => $sourceId]);
@@ -88,7 +90,7 @@
8890
if (is_array($extraOutput)) {
8991
foreach ($extraOutput as $output) {
9092
// @codingStandardsIgnoreLine
91-
echo $output;
93+
$outputHelper->printNotEscaped($output);
9294
}
9395
unset($output);
9496
}

‎visualcomposer/resources/views/editor/frontend/frontend.php

+11-13
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,14 @@
66
exit;
77
}
88
require_once ABSPATH . 'wp-admin/includes/admin.php';
9-
9+
$globalsHelper = vchelper('Globals');
10+
$outputHelper = vchelper('Output');
1011
// @codingStandardsIgnoreStart
1112
global $title, $hook_suffix, $current_screen, $wp_locale, $pagenow, $wp_version,
1213
$update_title, $total_update_count, $parent_file, $typenow, $wp_meta_boxes;
1314

1415
$hookSuffix = $hook_suffix;
15-
$wp_meta_boxes = [];
16+
$globalsHelper->set('wp_meta_boxes', []);
1617
if (empty($current_screen)) {
1718
set_current_screen();
1819
}
@@ -21,7 +22,7 @@
2122
$current_screen->id = $sourceId;
2223
}
2324
// @codingStandardsIgnoreEnd
24-
$typenow = get_post_type();
25+
$globalsHelper->set('typenow', get_post_type());
2526
/**
2627
* @var $editableLink - link to editable content
2728
*/
@@ -35,7 +36,7 @@
3536
<link rel="profile" href="http://gmpg.org/xfn/11" />
3637
<meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
3738
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, maximum-scale=1, user-scalable=0" />
38-
<title><?php echo sprintf(__('Visual Composer: %s', 'visualcomposer'), get_the_title()); ?></title>
39+
<title><?php echo sprintf(__('Visual Composer: %s', 'visualcomposer'), esc_html(get_the_title())); ?></title>
3940
<link rel="stylesheet"
4041
href="//fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic&subset=latin,greek,greek-ext,cyrillic-ext,latin-ext,cyrillic">
4142
<?php
@@ -50,16 +51,16 @@
5051
if (is_array($extraOutput)) {
5152
foreach ($extraOutput as $output) {
5253
// @codingStandardsIgnoreLine
53-
echo $output;
54+
vcv_print_html($output);
5455
}
5556
unset($output);
5657
}
5758
$variables = vcfilter('vcv:editor:variables', [], ['sourceId' => $sourceId]);
5859
if (is_array($variables)) {
5960
foreach ($variables as $variable) {
6061
if (is_array($variable) && isset($variable['key'], $variable['value'])) {
61-
$type = isset($variable['type']) ? $variable['type'] : 'variable';
62-
evcview('partials/variableTypes/' . $type, $variable);
62+
$variableType = isset($variable['type']) ? $variable['type'] : 'variable';
63+
evcview('partials/variableTypes/' . $variableType, $variable);
6364
}
6465
}
6566
unset($variable);
@@ -71,8 +72,7 @@
7172
$extraOutput = vcfilter('vcv:frontend:body:extraOutput', [], ['sourceId' => $sourceId]);
7273
if (is_array($extraOutput)) {
7374
foreach ($extraOutput as $output) {
74-
// @codingStandardsIgnoreLine
75-
echo $output;
75+
$outputHelper->printNotEscaped($output);
7676
}
7777
unset($output);
7878
}
@@ -90,8 +90,7 @@
9090
</div>
9191
<iframe class="vcv-layout-iframe"
9292
src="<?php
93-
// @codingStandardsIgnoreLine
94-
echo $editableLink;
93+
echo esc_url($editableLink);
9594
?>" id="vcv-editor-iframe"
9695
frameborder="0" scrolling="auto"></iframe>
9796
</div>
@@ -129,8 +128,7 @@
129128
$extraOutput = vcfilter('vcv:frontend:footer:extraOutput', [], ['sourceId' => $sourceId]);
130129
if (is_array($extraOutput)) {
131130
foreach ($extraOutput as $output) {
132-
// @codingStandardsIgnoreLine
133-
echo $output;
131+
$outputHelper->printNotEscaped($output);
134132
}
135133
unset($output);
136134
}

‎visualcomposer/resources/views/editor/templates/blank-template.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
div.vcv-editor-theme-hf .vcv-layouts-html > * > [data-vce-full-width="true"]:not([data-vce-stretch-content="true"]) > [data-vce-element-content="true"],
3535
div.vcv-header > * > [data-vce-full-width="true"]:not([data-vce-stretch-content="true"]) > [data-vce-element-content="true"],
3636
div.vcv-footer > * > [data-vce-full-width="true"]:not([data-vce-stretch-content="true"]) > [data-vce-element-content="true"] {
37-
max-width: <?php echo $customLayoutWidth . 'px' ?> !important;
37+
max-width: <?php echo esc_attr($customLayoutWidth) . 'px' ?> !important;
3838
}
3939
}
4040
</style>

‎visualcomposer/resources/views/hub/elementsBundle.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<script id="vcv-hub-element-<?php echo esc_attr($key); ?>" src="<?php
1414
// @codingStandardsIgnoreLine
1515
$version = vcvenv('VCV_DEBUG') ? esc_attr($time) : esc_attr($optionsHelper->get('hubAction:element/' . $key, VCV_VERSION));
16-
echo set_url_scheme($element['bundlePath']) . '?v=' . $version; ?>"></script>
16+
echo esc_url(set_url_scheme($element['bundlePath']) . '?v=' . $version); ?>"></script>
1717
<?php
1818
endif;
1919
endforeach;

‎visualcomposer/resources/views/license/pages/license.php

+25-16
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,27 @@
1515
['vcv-action' => 'license:deactivate:adminNonce', 'vcv-nonce' => $nonceHelper->admin()]
1616
);
1717

18-
$activateHubUrl = esc_url(admin_url('admin.php?page=vcv-activate-license&vcv-ref=license-vcdashboard'));
19-
$upgradeLicenseUrl = esc_url(vcvenv('VCV_HUB_LICENSES_URL'));
18+
$activateHubUrl = admin_url('admin.php?page=vcv-activate-license&vcv-ref=license-vcdashboard');
19+
$upgradeLicenseUrl = vcvenv('VCV_HUB_LICENSES_URL');
2020

2121
$expirationDate = vchelper('License')->getExpirationDate();
2222
if (!vchelper('License')->isPremiumActivated()) {
2323
echo sprintf(
2424
'<div class="vcv-description vcv-description--no-flex"><p class="description">%s</p>',
25-
__(
25+
esc_html__(
2626
'It seems you haven’t activated your Premium license to access elements, templates, and addons in the Visual Composer Hub.',
2727
'visualcomposer'
2828
)
2929
);
3030
echo sprintf(
3131
'<a href="%s" class="button vcv-license-btn-activate-hub">%s</a>',
32-
$activateHubUrl,
33-
__('Activate Premium', 'visualcomposer')
32+
esc_url($activateHubUrl),
33+
esc_html__('Activate Premium', 'visualcomposer')
3434
);
3535
echo sprintf(
3636
'<a href="%s" class="button vcv-license-btn-activate-hub vcv-license-btn-go-premium" target="_blank" rel="noopener noreferrer">%s</a>',
3737
esc_url(vchelper('Utm')->get('vcdashboard-license-go-premium')),
38-
__('Go Premium', 'visualcomposer')
38+
esc_html__('Go Premium', 'visualcomposer')
3939
);
4040
echo '</div>';
4141

@@ -69,7 +69,7 @@
6969
<tbody>
7070
<tr>
7171
<td><?php echo esc_html__('License key', 'visualcomposer') ?>:</td>
72-
<td><?php echo vchelper('License')->getHiddenKey(); ?> <a href="<?php
72+
<td><?php echo esc_html(vchelper('License')->getHiddenKey()); ?> <a href="<?php
7373
echo esc_url(
7474
$deactivateUrl
7575
); ?>" class="vcv-license-btn-deactivate"><?php
@@ -81,22 +81,31 @@
8181
</tr>
8282
<tr>
8383
<td><?php echo esc_html__('License type', 'visualcomposer') ?>:</td>
84-
<td><?php $type = vchelper('License')->getType();
85-
echo ucfirst($type);
86-
echo $type === 'free' ? (' - <a href="' . esc_url($upgradeLicenseUrl)
87-
. '" class="vcv-license-btn-upgrade">' . esc_html__(
84+
<td><?php
85+
$licenseType = vchelper('License')->getType();
86+
echo esc_html(ucfirst($licenseType));
87+
if ($licenseType === 'free') {
88+
echo sprintf(
89+
' - <a href="%s" class="vcv-license-btn-upgrade">%s</a>',
90+
esc_url($upgradeLicenseUrl),
91+
esc_html__(
8892
'Upgrade',
8993
'visualcomposer'
90-
) . '</a>') : ''; ?></td>
94+
)
95+
);
96+
}
97+
?></td>
9198
</tr>
9299
<?php if (!empty($expirationDate)) : ?>
93100
<tr>
94101
<td><?php echo esc_html__('License expiration date', 'visualcomposer') ?>:</td>
95102
<td><?php
96-
echo $expirationDate !== 'lifetime' ? gmdate(
97-
get_option('date_format') . ' ' . get_option('time_format'),
98-
$expirationDate
99-
) : 'lifetime'; ?></td>
103+
echo esc_html(
104+
$expirationDate !== 'lifetime' ? gmdate(
105+
get_option('date_format') . ' ' . get_option('time_format'),
106+
$expirationDate
107+
) : 'lifetime'
108+
); ?></td>
100109
</tr>
101110
<?php endif; ?>
102111
</tbody>

‎visualcomposer/resources/views/partials/script.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
}
88
/** @var string $value */
99
/** @var string $key */
10+
$outputHelper = vchelper('Output');
1011
?>
1112
<script id="vcv-<?php echo esc_attr(vchelper('Str')->slugify($key)); ?>">
1213
<?php
13-
// @codingStandardsIgnoreLine
14-
echo $value;
14+
$outputHelper->printNotEscaped($value);
1515
?>
1616
</script>

‎visualcomposer/resources/views/partials/style.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
}
88
/** @var string $value */
99
/** @var string $key */
10+
$outputHelper = vchelper('Output');
1011
?>
1112
<style id="vcv-style-<?php echo esc_attr(vchelper('Str')->slugify($key)); ?>">
1213
<?php
13-
// @codingStandardsIgnoreLine
14-
echo $value;
14+
$outputHelper->printNotEscaped($value);
1515
?>
1616
</style>

‎visualcomposer/resources/views/partials/teaser.php

+5-5
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,19 @@
1313
<div class="vcv-premium-teaser-inner">
1414
<div class="vcv-premium-teaser-image"></div>
1515
<header class="vcv-premium-teaser-header">
16-
<h2 class="vcv-premium-teaser-heading"><?php echo $page['premiumTitle']; ?></h2>
16+
<h2 class="vcv-premium-teaser-heading"><?php echo esc_html($page['premiumTitle']); ?></h2>
1717
</header>
1818
<div class="vcv-premium-teaser-content">
19-
<p class="vcv-premium-teaser-text"><?php echo $page['premiumDescription']; ?></p>
19+
<p class="vcv-premium-teaser-text"><?php echo esc_html($page['premiumDescription']); ?></p>
2020
</div>
2121
<div class="vcv-download-addon-button-container">
2222
<?php if (vchelper('License')->isPremiumActivated()) : ?>
23-
<a class="vcv-premium-teaser-btn vcv-premium-teaser-download-addon-btn" data-vcv-action="download" data-vcv-action-bundle="<?php echo $page['premiumActionBundle']; ?>"><?php esc_html_e('Download Addon', 'visualcomposer'); ?></a>
23+
<a class="vcv-premium-teaser-btn vcv-premium-teaser-download-addon-btn" data-vcv-action="download" data-vcv-action-bundle="<?php echo esc_attr($page['premiumActionBundle']); ?>"><?php esc_html_e('Download Addon', 'visualcomposer'); ?></a>
2424
<?php else : ?>
25-
<a class="vcv-premium-teaser-btn" href="<?php echo $page['premiumUrl']; ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('Go Premium', 'visualcomposer'); ?></a>
25+
<a class="vcv-premium-teaser-btn" href="<?php echo esc_url($page['premiumUrl']); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('Go Premium', 'visualcomposer'); ?></a>
2626
<p class="vcv-premium-teaser-text">
2727
<?php if (!empty($page['activationUrl'])) : ?>
28-
<?php esc_html_e('Already have a Premium license?', 'visualcomposer'); ?> <a href="<?php echo $page['activationUrl']; ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('Activate here', 'visualcomposer'); ?></a>
28+
<?php esc_html_e('Already have a Premium license?', 'visualcomposer'); ?> <a href="<?php echo esc_url($page['activationUrl']); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('Activate here', 'visualcomposer'); ?></a>
2929
<?php endif; ?>
3030
</p>
3131
<?php endif; ?>

‎visualcomposer/resources/views/settings/fields/css-editor/css-editor.php

+6-2
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,13 @@
77
}
88

99
/** @var array $globalSetting */
10+
$outputHelper = vchelper('Output');
1011
?>
1112

1213
<div class="vcv-ui-form-editor-container">
13-
<textarea id="vcv-<?php echo $globalSetting['slug']; ?>" class="vcv-css-code-editor" name="vcv-<?php echo $globalSetting['slug']; ?>"><?php echo (isset($globalSetting['value'])) ? $globalSetting['value'] : ''; ?></textarea>
14-
<textarea id="vcv-<?php echo $globalSetting['slug']; ?>-compiled" style="display:none;" name="vcv-<?php echo $globalSetting['slug']; ?>-compiled">not-changed</textarea>
14+
<textarea id="vcv-<?php echo esc_attr($globalSetting['slug']); ?>" class="vcv-css-code-editor" name="vcv-<?php echo esc_attr($globalSetting['slug']); ?>"><?php $outputHelper->printNotEscaped(
15+
isset($globalSetting['value']) ? $globalSetting['value'] : ''
16+
);
17+
?></textarea>
18+
<textarea id="vcv-<?php echo esc_attr($globalSetting['slug']); ?>-compiled" style="display:none;" name="vcv-<?php echo esc_attr($globalSetting['slug']); ?>-compiled">not-changed</textarea>
1519
</div>

‎visualcomposer/resources/views/settings/fields/customtoggle.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
<label class="vcv-ui-form-switch">
1919
<input type="checkbox" value="<?php echo esc_attr($value); ?>" name="<?php echo esc_attr($name); ?>" <?php echo $isEnabled ? 'checked="checked"' : ''; ?> />
2020
<span class="vcv-ui-form-switch-indicator"></span>
21-
<span class="vcv-ui-form-switch-label" data-vc-switch-on="<?php echo $onTitle; ?>"></span>
22-
<span class="vcv-ui-form-switch-label" data-vc-switch-off="<?php echo $offTitle; ?>"></span>
21+
<span class="vcv-ui-form-switch-label" data-vc-switch-on="<?php echo esc_attr($onTitle); ?>"></span>
22+
<span class="vcv-ui-form-switch-label" data-vc-switch-off="<?php echo esc_attr($offTitle); ?>"></span>
2323
</label>
2424
<span><?php echo isset($title) ? esc_html($title) : ''; ?></span>
2525
</div>

‎visualcomposer/resources/views/settings/fields/dropdown.php

+11-7
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,28 @@
1212
/** @var string $class */
1313
/** @var string $emptyTitle */
1414
/** @var string $dataTitle */
15+
$outputHelper = vchelper('Output');
1516
?>
1617

17-
<div class="vcv-ui-form-group<?php echo isset($description) ? ' vcv-ui-form-switch-container-has-description' : ''; ?>" <?php echo isset($dataTitle) ? 'data-title="' . $dataTitle . '"' : ''; ?>>
18-
<?php $createUrlAttribute = isset($createUrl) ? 'data-create-url="' . $createUrl . '"' : ''; ?>
19-
<select class="vcv-ui-form-dropdown<?php echo isset($class) ? ' ' . $class : ''; ?>" <?php echo $createUrlAttribute ?> id="<?php echo $name; ?>" name="<?php echo $name; ?>">
18+
<div class="vcv-ui-form-group<?php echo isset($description) ? ' vcv-ui-form-switch-container-has-description' : ''; ?>" <?php
19+
echo isset($dataTitle) ? 'data-title="' . esc_attr($dataTitle) . '"' : ''; ?>>
20+
<?php $createUrlAttribute = isset($createUrl) ? 'data-create-url="' . esc_url($createUrl) . '"' : ''; ?>
21+
<select class="vcv-ui-form-dropdown<?php echo isset($class) ? ' ' . esc_attr($class) : ''; ?>" <?php $outputHelper->printNotEscaped($createUrlAttribute); ?> id="<?php echo esc_attr(
22+
$name
23+
); ?>" name="<?php echo esc_attr($name); ?>">
2024
<?php if (isset($emptyTitle)) : ?>
21-
<option value=""><?php echo $emptyTitle; ?></option>
25+
<option value=""><?php echo esc_html($emptyTitle); ?></option>
2226
<?php endif; ?>
2327
<?php if (!empty($enabledOptions)) : ?>
2428
<?php foreach ($enabledOptions as $option) : ?>
2529
<?php $selected = ($option['id'] === $value) ? 'selected' : ''; ?>
26-
<?php $url = isset($option['url']) ? 'data-url="' . $option['url'] . '"' : ''; ?>
27-
<option value="<?php echo $option['id']; ?>" <?php echo $url ?> <?php echo $selected; ?>><?php echo $option['title']; ?></option>
30+
<?php $url = isset($option['url']) ? 'data-url="' . esc_url($option['url']) . '"' : ''; ?>
31+
<option value="<?php echo esc_attr($option['id']); ?>" <?php $outputHelper->printNotEscaped($url) ?> <?php $outputHelper->printNotEscaped($selected); ?>><?php echo esc_html($option['title']); ?></option>
2832
<?php endforeach; ?>
2933
<?php endif; ?>
3034
</select>
3135

3236
<?php if (isset($description)) { ?>
33-
<p class="description"><?php echo $description; ?></p>
37+
<p class="description"><?php esc_html($description); ?></p>
3438
<?php } ?>
3539
</div>

0 commit comments

Comments
 (0)