Skip to content

Commit a3fb375

Browse files
Zodiac1978Zodiac1978
committed
Add proper escaping
1 parent 9c05b4d commit a3fb375

1 file changed

Lines changed: 18 additions & 18 deletions

File tree

‎rt-plugin-report.php‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -449,21 +449,21 @@ private function render_table_row( $report ) {
449449
if ( isset( $report['repo_error_code'] ) && $report['repo_error_code'] === 'plugins_api_failed' ) {
450450
// Plugin is not available in the wp.org repo.
451451
if ( isset( $report['exists_in_svn'] ) && $report['exists_in_svn'] === true ) {
452-
$html .= '<td class="' . self::CSS_CLASS_HIGH . '">' . __( 'wordpress.org, plugin closed', 'plugin-report' ) . '</td>';
452+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_HIGH ) . '">' . esc_html__( 'wordpress.org, plugin closed', 'plugin-report' ) . '</td>';
453453
} else {
454-
$html .= '<td class="' . self::CSS_CLASS_HIGH . '">' . __( 'wordpress.org, plugin not found', 'plugin-report' ) . '</td>';
454+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_HIGH ) . '">' . esc_html__( 'wordpress.org, plugin not found', 'plugin-report' ) . '</td>';
455455
}
456456
} else {
457457
// Plugin is available on wp.org.
458-
$html .= '<td class="' . self::CSS_CLASS_LOW . '">wordpress.org</td>';
458+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_LOW ) . '">wordpress.org</td>';
459459
}
460460
} else {
461461
if ( $parsed_repo_url && isset( $parsed_repo_url['host'] ) ) {
462462
// Update URI is a valid URL, display the host.
463-
$html .= '<td class="' . self::CSS_CLASS_MED . '">' . esc_html( $repo_host ) . '</td>';
463+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_MED ) . '">' . esc_html( $repo_host ) . '</td>';
464464
} else {
465465
// Some other value (like 'false'), so assume updates are disabled.
466-
$html .= '<td class="' . self::CSS_CLASS_MED . '">' . __( 'Updates disabled', 'plugin-report' ) . '</td>';
466+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_MED ) . '">' . esc_html__( 'Updates disabled', 'plugin-report' ) . '</td>';
467467
}
468468
}
469469
} elseif ( version_compare( $wp_version, '5.8', '<' ) ) {
@@ -479,23 +479,23 @@ private function render_table_row( $report ) {
479479
$activation_status = $this->get_multisite_activation( $report['file_path'] );
480480
if ( true === $activation_status['network'] ) {
481481
$css_class = self::CSS_CLASS_LOW;
482-
$html .= '<td class="' . $css_class . '">' . __( 'Network activated', 'plugin-report' ) . '</td>';
482+
$html .= '<td class="' . esc_attr( $css_class ) . '">' . esc_html__( 'Network activated', 'plugin-report' ) . '</td>';
483483
} else {
484484
$css_class = ( $activation_status['active'] > 0 ) ? self::CSS_CLASS_LOW : self::CSS_CLASS_HIGH;
485-
$html .= '<td class="' . $css_class . '">' . $activation_status['active'] . '/' . $activation_status['sites'] . '</td>';
485+
$html .= '<td class="' . esc_attr( $css_class ) . '">' . absint( $activation_status['active'] ) . '/' . absint( $activation_status['sites'] ) . '</td>';
486486
}
487487
} else {
488488
if ( isset( $report['file_path'] ) ) {
489489
$active = is_plugin_active( $report['file_path'] ) ? __( 'Yes', 'plugin-report' ) : __( 'No', 'plugin-report' );
490490
$css_class = is_plugin_active( $report['file_path'] ) ? self::CSS_CLASS_LOW : self::CSS_CLASS_HIGH;
491491
}
492-
$html .= '<td class="' . $css_class . '">' . $active . '</td>';
492+
$html .= '<td class="' . esc_attr( $css_class ) . '">' . esc_html( $active ) . '</td>';
493493
}
494494

495495
// Installed / available version.
496496
if ( isset( $report['repo_info'] ) ) {
497497
$css_class = $this->get_version_risk_classname( $report['local_info']['Version'], $report['repo_info']->version );
498-
$html .= '<td class="' . $css_class . '">';
498+
$html .= '<td class="' . esc_attr( $css_class ) . '">';
499499
$html .= esc_html( $report['local_info']['Version'] );
500500
if ( $report['local_info']['Version'] !== $report['repo_info']->version ) {
501501
// Any platform upgrades needed?
@@ -523,12 +523,12 @@ private function render_table_row( $report ) {
523523

524524
// Auto-update.
525525
if ( version_compare( $wp_version, '5.5', '<' ) ) {
526-
$html .= '<td>' . __( 'Requires WordPress 5.5 or higher', 'plugin-report' ) . '</td>';
526+
$html .= '<td>' . esc_html__( 'Requires WordPress 5.5 or higher', 'plugin-report' ) . '</td>';
527527
} else {
528528
if ( isset( $report['auto-update'] ) && $report['auto-update'] ) {
529-
$html .= '<td class="' . self::CSS_CLASS_LOW . '">' . __( 'Enabled', 'plugin-report' ) . '</td>';
529+
$html .= '<td class="' . esc_attr( self::CSS_CLASS_LOW ) . '">' . esc_html__( 'Enabled', 'plugin-report' ) . '</td>';
530530
} else {
531-
$html .= '<td>' . __( 'Not enabled', 'plugin-report' ) . '</td>';
531+
$html .= '<td>' . esc_html__( 'Not enabled', 'plugin-report' ) . '</td>';
532532
}
533533
}
534534

@@ -537,24 +537,24 @@ private function render_table_row( $report ) {
537537
$time_update = new DateTime( $report['repo_info']->last_updated );
538538
$time_diff = human_time_diff( $time_update->getTimestamp(), current_time( 'timestamp' ) );
539539
$css_class = $this->get_timediff_risk_classname( current_time( 'timestamp' ) - $time_update->getTimestamp() );
540-
$html .= '<td class="' . $css_class . '" data-sort="' . esc_attr( (string) $time_update->getTimestamp() ) . '">' . esc_html( $time_diff ) . '</td>';
540+
$html .= '<td class="' . esc_attr( $css_class ) . '" data-sort="' . esc_attr( (string) $time_update->getTimestamp() ) . '">' . esc_html( $time_diff ) . '</td>';
541541
} else {
542542
$html .= $this->render_error_cell();
543543
}
544544

545545
// Tested up to.
546546
if ( isset( $report['repo_info'] ) && isset( $report['repo_info']->tested ) && ! empty( $report['repo_info']->tested ) ) {
547547
$css_class = $this->get_version_risk_classname( $report['repo_info']->tested, $wp_latest, true );
548-
$html .= '<td class="' . $css_class . '">' . esc_html( $report['repo_info']->tested ) . '</td>';
548+
$html .= '<td class="' . esc_attr( $css_class ) . '">' . esc_html( $report['repo_info']->tested ) . '</td>';
549549
} else {
550550
$html .= $this->render_error_cell();
551551
}
552552

553553
// Overall user rating.
554554
if ( isset( $report['repo_info'] ) && isset( $report['repo_info']->num_ratings ) && isset( $report['repo_info']->rating ) ) {
555555
$css_class = ( intval( $report['repo_info']->num_ratings ) > 0 ) ? $this->get_percentage_risk_classname( intval( $report['repo_info']->rating ) ) : '';
556-
$value_text = ( ( intval( $report['repo_info']->num_ratings ) > 0 ) ? esc_html( $report['repo_info']->rating ) . '%' : esc_html__( 'No data available', 'plugin-report' ) );
557-
$html .= '<td class="' . $css_class . '">' . $value_text . '</td>';
556+
$value_text = ( ( intval( $report['repo_info']->num_ratings ) > 0 ) ? intval( $report['repo_info']->rating ) . '%' : esc_html__( 'No data available', 'plugin-report' ) );
557+
$html .= '<td class="' . esc_attr( $css_class ) . '">' . esc_html( $value_text ) . '</td>';
558558
} else {
559559
$html .= $this->render_error_cell();
560560
}
@@ -572,7 +572,7 @@ private function render_table_row( $report ) {
572572
* @param string $message Message to be shown.
573573
*/
574574
private function render_error_row( $message ) {
575-
return '<tr class="pluginreport-row-error"><td colspan="' . self::COLS_PER_ROW . '">' . $message . '</td></tr>';
575+
return '<tr class="pluginreport-row-error"><td colspan="' . (int) self::COLS_PER_ROW . '">' . esc_html( $message ) . '</td></tr>';
576576
}
577577

578578

@@ -585,7 +585,7 @@ private function render_error_cell( $message = null ) {
585585
if ( ! $message ) {
586586
$message = esc_html__( 'No data available', 'plugin-report' );
587587
}
588-
return '<td class="pluginreport-cell-error" data-sort="0">' . $message . '</td>';
588+
return '<td class="pluginreport-cell-error" data-sort="0">' . esc_html( $message ) . '</td>';
589589
}
590590

591591

0 commit comments

Comments
 (0)