Skip to content

Commit 3ee7d28

Browse files
circuscodecircuscode
committed
Escaping Echo
1 parent d6d979b commit 3ee7d28

File tree

5 files changed

+55
-34
lines changed

5 files changed

+55
-34
lines changed

‎tootpress_developer.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ function tootpress_clearing_load() {
171171

172172
function tootpress_tools_dev_close() {
173173

174-
echo '<p>&nbsp;<br/><a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-dev-menu">Back to TootPress Tools</a></p>';
174+
echo '<p>&nbsp;<br/><a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-dev-menu">Back to TootPress Tools</a></p>';
175175

176176
}
177177

@@ -224,12 +224,12 @@ function tootpress_options_dev_content() {
224224

225225
function tootpress_options_dev_display_latest_toot()
226226
{
227-
echo '<input class="regular-text" type="text" name="tootpress_latest_toot" id="tootpress_latest_toot" value="'. get_option('tootpress_latest_toot') .'"/>';
227+
echo '<input class="regular-text" type="text" name="tootpress_latest_toot" id="tootpress_latest_toot" value="' . esc_attr(get_option('tootpress_latest_toot')) .'"/>';
228228
}
229229

230230
function tootpress_options_dev_display_oldest_toot()
231231
{
232-
echo '<input class="regular-text" type="text" name="tootpress_oldest_toot" id="tootpress_oldest_toot" value="'. get_option('tootpress_oldest_toot') .'"/>';
232+
echo '<input class="regular-text" type="text" name="tootpress_oldest_toot" id="tootpress_oldest_toot" value="'. esc_attr(get_option('tootpress_oldest_toot')) .'"/>';
233233
}
234234

235235
/**

‎tootpress_healthy.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -160,37 +160,37 @@ function tootpress_healthy_check() {
160160

161161
// Amount of previous API Requests
162162
$amount_of_api_requests=tootpress_get_amount_of_api_requests();
163-
$output.='Amount of Requests to Mastodon API: '.$amount_of_api_requests;
163+
$output.='Amount of Requests to Mastodon API: '.esc_html($amount_of_api_requests);
164164
$output.='<br/>';
165165

166166
// Amount of Toots in Database
167167
$amount_of_toots=tootpress_get_amount_of_toots();
168-
$output.='Amount of Toots in Database: '.$amount_of_toots;
168+
$output.='Amount of Toots in Database: '.esc_html($amount_of_toots);
169169
$output.='<br/>';
170170

171171
// Amount of Media in Database
172172
$amount_of_media=tootpress_get_amount_of_media();
173-
$output.='Amount of Media in Database: '.$amount_of_media;
173+
$output.='Amount of Media in Database: '.esc_html($amount_of_media);
174174
$output.='<br/>';
175175

176176
// Latest Toot
177177
$latest_toot=tootpress_get_latest_toot();
178-
if($latest_toot){$output.='Latest Toot: '.$latest_toot.'<br/>';}
178+
if($latest_toot){$output.='Latest Toot: '.esc_html($latest_toot).'<br/>';}
179179

180180
// Oldest Toot
181181
$oldest_toot=tootpress_get_oldest_toot();
182-
if($oldest_toot){$output.='Oldest Toot: '.$oldest_toot.'<br/>';};
182+
if($oldest_toot){$output.='Oldest Toot: '.esc_html($oldest_toot).'<br/>';};
183183

184184
// Last Insert
185185
$last_insert=get_option('tootpress_last_insert');
186-
if($last_insert){$output.='Last Insert: '.$last_insert.'<br/>';}
186+
if($last_insert){$output.='Last Insert: '.esc_html($last_insert).'<br/>';}
187187

188188
// PHP Max Execution Time
189189
$this_environment_php_execution_time=ini_get('max_execution_time');
190190
if($this_environment_php_execution_time==0) {
191191
$output.='Max PHP script execution time: not limited';
192192
} else {
193-
$output.='Max PHP script execution time: '.$this_environment_php_execution_time.' Seconds';
193+
$output.='Max PHP script execution time: '.esc_html($this_environment_php_execution_time).' Seconds';
194194
}
195195

196196
$output.='</p>';

‎tootpress_options.php‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,46 +54,46 @@ function tootpress_options_content() {
5454

5555
function tootpress_options_display_mastodon_instance()
5656
{
57-
echo '<input class="regular-text" type="text" name="tootpress_mastodon_instance" id="tootpress_mastodon_instance" value="'. get_option('tootpress_mastodon_instance') .'"/>';
57+
echo '<input class="regular-text" type="text" name="tootpress_mastodon_instance" id="tootpress_mastodon_instance" value="'. esc_attr(get_option('tootpress_mastodon_instance')) .'"/>';
5858
}
5959

6060
function tootpress_options_display_mastodon_oauth_access_token()
6161
{
62-
echo '<input class="regular-text" type="text" name="tootpress_mastodon_oauth_access_token" id="tootpress_mastodon_oauth_access_token" value="'. get_option('tootpress_mastodon_oauth_access_token') .'"/>';
62+
echo '<input class="regular-text" type="text" name="tootpress_mastodon_oauth_access_token" id="tootpress_mastodon_oauth_access_token" value="'. esc_attr(get_option('tootpress_mastodon_oauth_access_token')) .'"/>';
6363
}
6464

6565
function tootpress_options_display_mastodon_account_id()
6666
{
67-
echo '<input type="text" name="tootpress_mastodon_account_id" id="tootpress_mastodon_account_id" value="'. get_option('tootpress_mastodon_account_id') .'"/>';
67+
echo '<input type="text" name="tootpress_mastodon_account_id" id="tootpress_mastodon_account_id" value="'. esc_attr(get_option('tootpress_mastodon_account_id')) .'"/>';
6868
}
6969

7070
function tootpress_options_display_page_id()
7171
{
72-
echo '<input type="text" name="tootpress_page_id" id="tootpress_page_id" value="'. get_option('tootpress_page_id') .'"/>';
72+
echo '<input type="text" name="tootpress_page_id" id="tootpress_page_id" value="'. esc_attr(get_option('tootpress_page_id')) .'"/>';
7373
}
7474

7575
function tootpress_options_display_amount_toots_page()
7676
{
77-
echo '<input type="text" name="tootpress_amount_toots_page" id="tootpress_amount_toots_page" value="'. get_option('tootpress_amount_toots_page') .'"/>';
77+
echo '<input type="text" name="tootpress_amount_toots_page" id="tootpress_amount_toots_page" value="'. esc_attr(get_option('tootpress_amount_toots_page')) .'"/>';
7878
}
7979

8080
function tootpress_options_display_cron_period()
8181
{
82-
echo '<input type="text" name="tootpress_cron_period" id="tootpress_cron_period" value="'. tootpress_get_custom_cron_period_in_minutes() .'"/>';
82+
echo '<input type="text" name="tootpress_cron_period" id="tootpress_cron_period" value="'. esc_attr(tootpress_get_custom_cron_period_in_minutes()) .'"/>';
8383
}
8484

8585
function tootpress_options_display_navigation()
8686
{
87-
echo '<input type="radio" id="tootpress_navigation_standard" name="tootpress_navigation" value="standard" ' . checked('standard', get_option('tootpress_navigation'), false) . '/>';
88-
echo '<label for="tootpress_navigation_standard">Standard</label>';
87+
echo '<input type="radio" id="tootpress_navigation_standard" name="tootpress_navigation" value="standard" ' . checked('standard', esc_attr(get_option('tootpress_navigation')), false) . '/>';
88+
'<label for="tootpress_navigation_standard">Standard</label>';
8989
echo '<br/>&nbsp;<br/>';
90-
echo '<input type="radio" id="tootpress_navigation_numbers" name="tootpress_navigation" value="numbers" ' . checked('numbers', get_option('tootpress_navigation'), false) . '/>';
90+
echo '<input type="radio" id="tootpress_navigation_numbers" name="tootpress_navigation" value="numbers" ' . checked('numbers', esc_attr(get_option('tootpress_navigation')), false) . '/>';
9191
echo '<label for="tootpress_navigation_numbers">Numbers</label>';
9292
}
9393

9494
function tootpress_options_display_css()
9595
{
96-
echo '<input type="checkbox" name="tootpress_css" value="1" ' . checked(1, tootpress_get_css_option(), false) . '/>';
96+
echo '<input type="checkbox" name="tootpress_css" value="1" ' . checked(1, esc_attr(tootpress_get_css_option()), false) . '/>';
9797
}
9898

9999
/**

‎tootpress_plugin.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,4 +61,25 @@ function tootpress_flag( $classes ) {
6161
}
6262
add_filter( 'body_class', 'tootpress_flag' );
6363

64+
/**
65+
* Returns allowed HTML tags
66+
*
67+
* Used for escaping echos
68+
*
69+
* @since 0.2
70+
*
71+
* @return array Allowed HTML Tags
72+
*/
73+
74+
function tootpress_escaping_allowed_html() {
75+
return array(
76+
'p' => array(),
77+
'br' => array(),
78+
'strong' => array(),
79+
'span' => array(
80+
'class' => array(),
81+
),
82+
);
83+
}
84+
6485
?>

‎tootpress_tools.php‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ function tootpress_tools() {
154154
<label for="copy-toots">Mastodon API Request</label>
155155
</th>
156156
<td>
157-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&copytoots=true">Run</a>
157+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&copytoots=true">Run</a>
158158
</td>
159159
160160
<!-- Steady Fetch -->
@@ -163,7 +163,7 @@ function tootpress_tools() {
163163
<label for="cron-newtoots">Steady Fetch</label>
164164
</th>
165165
<td>
166-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&cronnewtoots=true">'.$button_newtoots_label.'</a>
166+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&cronnewtoots=true">'.esc_html($button_newtoots_label).'</a>
167167
</td>
168168
169169
<!-- Complete Archiv -->
@@ -172,7 +172,7 @@ function tootpress_tools() {
172172
<label for="cron-alltoots">Complete Timeline</label>
173173
</th>
174174
<td>
175-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&cronalltoots=true">'.$button_alltoots_label.'</a>
175+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&cronalltoots=true">'.esc_html($button_alltoots_label).'</a>
176176
</td>
177177
178178
<!-- Receive ID -->
@@ -181,7 +181,7 @@ function tootpress_tools() {
181181
<label for="retrieve-id">Account ID</label>
182182
</th>
183183
<td>
184-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&retrieveid=true">Retrieve</a>
184+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&retrieveid=true">Retrieve</a>
185185
</td>
186186
187187
<!-- Plugin Healthy Check -->
@@ -190,7 +190,7 @@ function tootpress_tools() {
190190
<label for="plugin-healthy-check">Healthy Check</label>
191191
</th>
192192
<td>
193-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&healthy=true">Show Results</a>
193+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&healthy=true">Show Results</a>
194194
</td>
195195
196196
<!-- Factory Settings -->
@@ -199,7 +199,7 @@ function tootpress_tools() {
199199
<label for="factory-settings">Factory Settings</label>
200200
</th>
201201
<td>
202-
<a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu&factorysettings=true">Reset</a>
202+
<a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu&factorysettings=true">Reset</a>
203203
</td>
204204
205205
</table>';
@@ -214,7 +214,7 @@ function tootpress_tools() {
214214

215215
function tootpress_tools_close() {
216216

217-
echo '<p>&nbsp;<br/><a class="button" href="'.admin_url().'tools.php?page=tootpress-tools-menu">Back to TootPress Tools</a></p>';
217+
echo '<p>&nbsp;<br/><a class="button" href="'.esc_url(admin_url()).'tools.php?page=tootpress-tools-menu">Back to TootPress Tools</a></p>';
218218

219219
}
220220

@@ -246,7 +246,7 @@ function tootpress_copy_toots_load() {
246246
} else {
247247
// TootPress is not ready to run
248248
echo '<p>Request not possible.</p>';
249-
echo tootpress_error_message_required_api_options_missing();
249+
echo wp_kses( tootpress_error_message_required_api_options_missing(), tootpress_escaping_allowed_html() );
250250
}
251251

252252
tootpress_tools_close();
@@ -274,12 +274,12 @@ function tootpress_switch_cron_newtoots_load() {
274274
update_option('tootpress_cron_newtoots_status','1');
275275
$period=tootpress_get_custom_cron_period_in_minutes();
276276
echo '<p>Cron was activated.<br/>';
277-
echo 'Steady Fetch runs every '.$period.' Minutes.<br/>';
277+
echo 'Steady Fetch runs every '.esc_html($period).' Minutes.<br/>';
278278
echo 'New Toots will be added automatically.</p>';
279279
} else {
280280
// TootPress is not ready to run
281281
echo '<p>Steady Fetch could not be activated.</p>';
282-
echo tootpress_error_message_required_api_options_missing();
282+
echo wp_kses( tootpress_error_message_required_api_options_missing(), tootpress_escaping_allowed_html() );
283283
}
284284

285285
} else {
@@ -327,7 +327,7 @@ function tootpress_trigger_cron_alltoots_load() {
327327
} else {
328328
// TootPress is not ready to run
329329
echo '<p>Procedure could not be activated.</p>';
330-
echo tootpress_error_message_required_api_options_missing();
330+
echo wp_kses( tootpress_error_message_required_api_options_missing(), tootpress_escaping_allowed_html() );
331331
}
332332

333333
}
@@ -356,10 +356,10 @@ function tootpress_retrieve_mastodonid() {
356356
$mastodonid=$verifycrendentials['id'];
357357

358358
echo '<p>Your Mastodon Account ID is the following.</p>';
359-
echo '<p>'.$mastodonid.'</p>';
359+
echo '<p>'.esc_html($mastodonid).'</p>';
360360

361361
} else {
362-
echo tootpress_error_message_instance_andor_token_missing();
362+
echo wp_kses( tootpress_error_message_instance_andor_token_missing(), tootpress_escaping_allowed_html() );
363363
}
364364

365365
tootpress_tools_close();
@@ -377,7 +377,7 @@ function tootpress_healthy_check_load() {
377377
echo '<h1 class="tootpress_tools_headline">TootPress › Healthy Check</h1>';
378378
echo '<p class="tootpress_tools_description">Analysis<br/>&nbsp;</p>';
379379
$health_status=tootpress_healthy_check();
380-
echo $health_status;
380+
echo wp_kses( $health_status, tootpress_escaping_allowed_html() );
381381
tootpress_tools_close();
382382

383383
}

0 commit comments

Comments
 (0)