Skip to content

Commit 287716b

Browse files
girishpanchal30girishpanchal30
committed
fix: escape field label and tooltip icon
1 parent 472eb95 commit 287716b

File tree

9 files changed

+40
-11
lines changed

9 files changed

+40
-11
lines changed

‎classes/plugin.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -977,7 +977,7 @@ public function show_tooltip( $description, $meta ) {
977977

978978
// Check if the tooltip is enabled.
979979
if ( isset( $meta['desc_tooltip'] ) && 'on' === $meta['desc_tooltip'] ) {
980-
$description = ( ! empty( $meta['description'] ) ) ? ' <span data-ppom-tooltip="ppom_tooltip" class="ppom-tooltip" title="' . esc_attr( $input_desc ) . '"><svg width="13px" height="13px" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="currentColor" d="M504 256c0 136.997-111.043 248-248 248S8 392.997 8 256C8 119.083 119.043 8 256 8s248 111.083 248 248zM262.655 90c-54.497 0-89.255 22.957-116.549 63.758-3.536 5.286-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></span>' : '';
980+
$description = ( ! empty( $meta['description'] ) ) ? ' <span data-ppom-tooltip="ppom_tooltip" class="ppom-tooltip" title="' . esc_attr( $input_desc ) . '"><span class="ppom-tooltip-icon"></span></span>' : '';
981981
}
982982
return $description;
983983
}

‎css/ppom-style.css

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,4 +594,22 @@ div.filelist .u_i_c_box {
594594
[data-remodal-id^="ppom_textbox_model_"] {
595595
max-width: 700px !important;
596596
min-height: 0 !important;
597+
}
598+
599+
span.ppom-tooltip .ppom-tooltip-icon {
600+
width: 13px;
601+
height: 13px;
602+
font-size: 11px;
603+
line-height: 13px;
604+
background-color: #000;
605+
border-radius: 100%;
606+
display: inline-block;
607+
text-align: center
608+
}
609+
span.ppom-tooltip .ppom-tooltip-icon::after {
610+
content: '?';
611+
font-size: 10px;
612+
color: #fff;
613+
line-height: 13px;
614+
font-weight: 700;
597615
}

‎inc/validation.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,17 @@ function ppom_esc_html( $content ) {
7272
$allowedposttags['a'] = $allowed_atts;
7373
$allowedposttags['b'] = $allowed_atts;
7474
$allowedposttags['i'] = $allowed_atts;
75+
$allowedposttags['svg'] = array(
76+
'width' => true,
77+
'height' => true,
78+
'role' => true,
79+
'xmlns' => true,
80+
'viewBox' => true,
81+
);
82+
$allowedposttags['path'] = array(
83+
'fill' => true,
84+
'd' => true,
85+
);
7586

7687
$allowed_tags = wp_kses_allowed_html( 'post' );
7788

‎templates/frontend/inputs/checkbox.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ function ( $v ) {
9595
// if discount price set
9696
if ( $has_discount ) {
9797
$price = $discount_price > 0 ? wc_format_sale_price( $option_price, $discount_price ) : wc_price( $option_price );
98-
$tooltip = $tooltip ? ' <span data-ppom-tooltip="ppom_tooltip" class="ppom-tooltip" title="' . esc_attr( $tooltip ) . '"><svg width="13px" height="13px" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="currentColor" d="M504 256c0 136.997-111.043 248-248 248S8 392.997 8 256C8 119.083 119.043 8 256 8s248 111.083 248 248zM262.655 90c-54.497 0-89.255 22.957-116.549 63.758-3.536 5.286-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></span>' : '';
98+
$tooltip = $tooltip ? ' <span data-ppom-tooltip="ppom_tooltip" class="ppom-tooltip" title="' . esc_attr( $tooltip ) . '"><span class="ppom-tooltip-icon"></span></span>' : '';
9999
$the_label = $value['raw'] . $tooltip;
100100
$option_label = '<span class="ppom-cb-label">' . $the_label . '</span><span class="ppom-cb-price">' . $price . '</span>';
101101
}

‎templates/frontend/inputs/cropper.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ class="<?php echo esc_attr( $fm->field_inner_wrapper_classes() ); ?>">
4141
<!-- if title of field exist -->
4242
<?php if ( $field_label ) : ?>
4343
<label class="<?php echo esc_attr( $fm->label_classes() ); ?>"
44-
for="<?php echo esc_attr( $fm->data_name() ); ?>"><?php echo esc_html( $field_label ); ?></label>
44+
for="<?php echo esc_attr( $fm->data_name() ); ?>"><?php echo wp_kses( $field_label, array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></label>
4545
<?php endif ?>
4646

4747

‎templates/frontend/inputs/divider.php

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@
103103
if ( $divider_styles == 'style1' ) {
104104
if ( $fm->field_label() ) {
105105
?>
106-
<h2 class="ppom-divider-with-txt ppom-divider-line ppom-divider-line-clr ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
106+
<h2 class="ppom-divider-with-txt ppom-divider-line ppom-divider-line-clr ppom-divider-txt"><?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></h2>
107107
<?php } else { ?>
108108
<hr class="ppom-divider-<?php echo esc_attr( $style1_border ); ?>">
109109
<?php
@@ -113,27 +113,27 @@
113113

114114
<!--Style 2-->
115115
<?php if ( $divider_styles == 'style2' ) { ?>
116-
<h2 class="ppom-divider-with-txt ppom-divider-gradient ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
116+
<h2 class="ppom-divider-with-txt ppom-divider-gradient ppom-divider-txt"><?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></h2>
117117
<?php } ?>
118118

119119
<!--Style 3-->
120120
<?php if ( $divider_styles == 'style3' ) { ?>
121-
<h2 class="ppom-divider-with-txt ppom-divider-donotcross ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
121+
<h2 class="ppom-divider-with-txt ppom-divider-donotcross ppom-divider-txt"><?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></h2>
122122
<?php } ?>
123123

124124
<!--Style 4-->
125125
<?php if ( $divider_styles == 'style4' ) { ?>
126126
<div class="ppom-divider-easy-shadow">
127127
<span></span>
128-
<span class="ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></span>
128+
<span class="ppom-divider-txt"><?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></span>
129129
<span></span>
130130
</div>
131131
<?php } ?>
132132

133133
<!--Style 5-->
134134
<?php if ( $divider_styles == 'style5' ) { ?>
135135

136-
<h1 class="ppom-divider-fancy-heading ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h1>
136+
<h1 class="ppom-divider-fancy-heading ppom-divider-txt"><?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?></h1>
137137
<div class="ppom-divider-fancy-line">
138138
<span></span>
139139
</div>

‎templates/frontend/inputs/file.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class="<?php echo esc_attr( $fm->field_inner_wrapper_classes() ); ?>">
3838
class="<?php echo esc_attr( $fm->label_classes() ); ?>"
3939
for="<?php echo esc_attr( $fm->data_name() ); ?>"
4040
>
41-
<?php echo esc_html( $field_label ); ?>
41+
<?php echo wp_kses( $field_label, array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?>
4242
</label>
4343
<?php endif ?>
4444

‎templates/frontend/inputs/quantities.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
class="<?php echo esc_attr( $fm->label_classes() ); ?>"
5252
for="<?php echo esc_attr( $fm->data_name() ); ?>"
5353
>
54-
<?php echo esc_html( $fm->field_label() ); ?>
54+
<?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?>
5555
</label>
5656
<?php endif ?>
5757

‎templates/frontend/inputs/text.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
class="<?php echo esc_attr( $fm->label_classes() ); ?>"
5555
for="<?php echo esc_attr( $fm->data_name() ); ?>"
5656
>
57-
<?php echo esc_html( $fm->field_label() ); ?>
57+
<?php echo wp_kses( $fm->field_label(), array( 'span' => array( 'class' => true, 'data-*' => true, 'title' => true ) ) ); ?>
5858
</label>
5959
<?php endif ?>
6060

0 commit comments

Comments
 (0)