Steve-Dee-Designs
/
woocommerce
mirror of https://github.com/woocommerce/woocommerce.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[3.2.3] XSS #1575

This commit is contained in:
Mike Jolley 2012-10-15 14:42:36 +01:00
parent 723c3144ec
commit 5d15f30cea
2 changed files with 96 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
admin/post-types/writepanels/writepanel-product_data.php
View File

@ -7,7 +7,7 @@
* @author WooThemes
* @category Admin
* @package WooCommerce/Admin/WritePanels
* @version 1.6.4
* @version 1.7.0
*/
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
@ -42,7 +42,7 @@ function woocommerce_product_data_box() {
$type_box = '<label for="product-type"><select id="product-type" name="product-type"><optgroup label="' . __( 'Product Type', 'woocommerce' ) . '">';
foreach ( $product_type_selector as $value => $label )
$type_box .= '<option value="' . $value . '" ' . selected( $product_type, $value, false ) .'>' . $label . '</option>';
$type_box .= '<option value="' . esc_attr( $value ) . '" ' . selected( $product_type, $value, false ) .'>' . esc_html( $label ) . '</option>';
$type_box .= '</optgroup></select></label>';
$product_type_options = apply_filters('product_type_options', array(
@ -62,7 +62,7 @@ function woocommerce_product_data_box() {
foreach ( $product_type_options as $key => $option ) {
$selected_value = get_post_meta( $post->ID, '_' . $key, true );
$type_box .= '<label for="' . $option['id'] . '" class="'. $option['wrapper_class'] . ' tips" data-tip="' . $option['description'] . '">'. $option['label'] . ': <input type="checkbox" name="' . $option['id'] . '" id="' . $option['id'] . '" ' . checked( $selected_value, 'yes', false ) .' /></label>';
$type_box .= '<label for="' . esc_attr( $option['id'] ) . '" class="'. esc_attr( $option['wrapper_class'] ) . ' tips" data-tip="' . esc_attr( $option['description'] ) . '">' . esc_html( $option['label'] ) . ': <input type="checkbox" name="' . esc_attr( $option['id'] ) . '" id="' . esc_attr( $option['id'] ) . '" ' . checked( $selected_value, 'yes', false ) .' /></label>';
}
?>
@ -94,11 +94,10 @@ function woocommerce_product_data_box() {
echo '<div class="options_group show_if_simple show_if_variable show_if_external">';
// SKU
if( get_option('woocommerce_enable_sku', true) !== 'no' ) :
if( get_option('woocommerce_enable_sku', true) !== 'no' )
woocommerce_wp_text_input( array( 'id' => '_sku', 'label' => '<abbr title="'. __('Stock Keeping Unit', 'woocommerce') .'">' . __('SKU', 'woocommerce') . '</abbr>', 'desc_tip' => 'true', 'description' => __('SKU refers to a Stock-keeping unit, a unique identifier for each distinct product and service that can be purchased.', 'woocommerce') ) );
else:
echo '<input type="hidden" name="_sku" value="'.get_post_meta($thepostid, '_sku', true).'" />';
endif;
else
echo '<input type="hidden" name="_sku" value="' . esc_attr( get_post_meta( $thepostid, '_sku', true ) ) . '" />';
do_action('woocommerce_product_options_sku');
@ -123,15 +122,13 @@ function woocommerce_product_data_box() {
woocommerce_wp_text_input( array( 'id' => '_sale_price', 'class' => 'wc_input_price short', 'label' => __('Sale Price', 'woocommerce') . ' ('.get_woocommerce_currency_symbol().')', 'description' => '<a href="#" class="sale_schedule">' . __('Schedule', 'woocommerce') . '</a>' ) );
// Special Price date range
$field = array( 'id' => '_sale_price_dates', 'label' => __('Sale Price Dates', 'woocommerce') );
$sale_price_dates_from = get_post_meta( $thepostid, '_sale_price_dates_from', true );
$sale_price_dates_to = get_post_meta( $thepostid, '_sale_price_dates_to', true );
$sale_price_dates_from = ( $date = get_post_meta( $thepostid, '_sale_price_dates_from', true ) ) ? date_i18n( 'Y-m-d', $date ) : '';
$sale_price_dates_to = ( $date = get_post_meta( $thepostid, '_sale_price_dates_to', true ) ) ? date_i18n( 'Y-m-d', $date ) : '';
echo ' <p class="form-field sale_price_dates_fields">
<label for="' . $field['id'] . '_from">' . $field['label'] . '</label>
<input type="text" class="short" name="' . $field['id'] . '_from" id="' . $field['id'] . '_from" value="' . ( $sale_price_dates_from ? date_i18n( 'Y-m-d', $sale_price_dates_from ) : '' ) . '" placeholder="' . _x('From&hellip;', 'placeholder', 'woocommerce') . '" maxlength="10" />
<input type="text" class="short" name="' . $field['id'] . '_to" id="' . $field['id'] . '_to" value="' . ( $sale_price_dates_to ? date_i18n( 'Y-m-d', $sale_price_dates_to ) : '' ) . '" placeholder="' . _x( 'To&hellip;', 'placeholder', 'woocommerce' ) . '" maxlength="10" />
<label for="_sale_price_dates_from">' . __( 'Sale Price Dates', 'woocommerce' ) . '</label>
<input type="text" class="short" name="_sale_price_dates_from" id="_sale_price_dates_from" value="' . $sale_price_dates_from . '" placeholder="' . _x( 'From&hellip;', 'placeholder', 'woocommerce' ) . '" maxlength="10" />
<input type="text" class="short" name="_sale_price_dates_to" id="_sale_price_dates_to" value="' . $sale_price_dates_to . '" placeholder="' . _x( 'To&hellip;', 'placeholder', 'woocommerce' ) . '" maxlength="10" />
<a href="#" class="cancel_sale_schedule">'. __( 'Cancel', 'woocommerce' ) .'</a>
</p>';
@ -143,11 +140,11 @@ function woocommerce_product_data_box() {
// File URL
$file_paths = get_post_meta( $post->ID, '_file_paths', true );
if ( is_array( $file_paths ) ) $file_paths = implode( "\n", $file_paths );
if ( is_array( $file_paths ) )
$file_paths = implode( "\n", $file_paths );
$field = array( 'id' => '_file_paths', 'label' => __('File paths (one per line)', 'woocommerce' ) );
echo '<p class="form-field"><label for="'.$field['id'].'">'.$field['label'].':</label>
<textarea style="float:left;height:5em;" id="'.$field['id'].'" class="short file_paths" cols="20" rows="3" placeholder="'.__('File paths/URLs, one per line', 'woocommerce').'" name="'.$field['id'].'" wrap="off">'.$file_paths.'</textarea>
echo '<p class="form-field"><label for="_file_paths">' . __('File paths (one per line)', 'woocommerce' ) . ':</label>
<textarea style="float:left;height:5em;" id="_file_paths" class="short file_paths" cols="20" rows="3" placeholder="' . __( 'File paths/URLs, one per line', 'woocommerce' ) . '" name="_file_paths" wrap="off">' . esc_textarea( $file_paths ) . '</textarea>
<input type="button" class="upload_file_button button" value="' . __( 'Upload a file', 'woocommerce' ) . '" />
</p>';
@ -162,11 +159,9 @@ function woocommerce_product_data_box() {
echo '</div>';
do_action( 'woocommerce_product_options_general_product_data' );
?>
</div>
<div id="tax_product_data" class="panel woocommerce_options_panel">
<?php
// Tax
@ -179,9 +174,9 @@ function woocommerce_product_data_box() {
$tax_classes = array_filter( array_map( 'trim', explode( "\n", get_option( 'woocommerce_tax_classes' ) ) ) );
$classes_options = array();
$classes_options[''] = __( 'Standard', 'woocommerce' );
if ($tax_classes) foreach ($tax_classes as $class) :
$classes_options[sanitize_title($class)] = $class;
endforeach;
if ( $tax_classes )
foreach ( $tax_classes as $class )
$classes_options[ sanitize_title( $class ) ] = esc_html( $class );
woocommerce_wp_select( array( 'id' => '_tax_class', 'label' => __( 'Tax Class', 'woocommerce' ), 'options' => $classes_options ) );
@ -246,7 +241,7 @@ function woocommerce_product_data_box() {
if( get_option('woocommerce_enable_weight', true) !== 'no' ) :
woocommerce_wp_text_input( array( 'id' => '_weight', 'label' => __('Weight', 'woocommerce') . ' ('.get_option('woocommerce_weight_unit').')', 'placeholder' => '0.00', 'description' => __('Weight in decimal form', 'woocommerce') ) );
else:
echo '<input type="hidden" name="_weight" value="'.get_post_meta($thepostid, '_weight', true).'" />';
echo '<input type="hidden" name="_weight" value="' . esc_attr( get_post_meta( $thepostid, '_weight', true ) ) . '" />';
endif;
// Size fields
@ -254,16 +249,16 @@ function woocommerce_product_data_box() {
?><p class="form-field dimensions_field">
<label for"product_length"><?php echo __( 'Dimensions', 'woocommerce' ) . ' (' . get_option( 'woocommerce_dimension_unit' ) . ')'; ?></label>
<span class="wrap">
<input id="product_length" placeholder="<?php _e('Length', 'woocommerce'); ?>" class="input-text" size="6" type="text" name="_length" value="<?php echo get_post_meta( $thepostid, '_length', true ); ?>" />
<input placeholder="<?php _e('Width', 'woocommerce'); ?>" class="input-text" size="6" type="text" name="_width" value="<?php echo get_post_meta( $thepostid, '_width', true ); ?>" />
<input placeholder="<?php _e('Height', 'woocommerce'); ?>" class="input-text last" size="6" type="text" name="_height" value="<?php echo get_post_meta( $thepostid, '_height', true ); ?>" />
<input id="product_length" placeholder="<?php _e( 'Length', 'woocommerce' ); ?>" class="input-text" size="6" type="text" name="_length" value="<?php echo esc_attr( get_post_meta( $thepostid, '_length', true ) ); ?>" />
<input placeholder="<?php _e( 'Width', 'woocommerce' ); ?>" class="input-text" size="6" type="text" name="_width" value="<?php echo esc_attr( get_post_meta( $thepostid, '_width', true ) ); ?>" />
<input placeholder="<?php _e( 'Height', 'woocommerce' ); ?>" class="input-text last" size="6" type="text" name="_height" value="<?php echo esc_attr( get_post_meta( $thepostid, '_height', true ) ); ?>" />
</span>
<span class="description"><?php _e( 'LxWxH in decimal form', 'woocommerce' ); ?></span>
</p><?php
else:
echo '<input type="hidden" name="_length" value="'.get_post_meta($thepostid, '_length', true).'" />';
echo '<input type="hidden" name="_width" value="'.get_post_meta($thepostid, '_width', true).'" />';
echo '<input type="hidden" name="_height" value="'.get_post_meta($thepostid, '_height', true).'" />';
echo '<input type="hidden" name="_length" value="' . esc_attr( get_post_meta( $thepostid, '_length', true ) ) . '" />';
echo '<input type="hidden" name="_width" value="' . esc_attr( get_post_meta( $thepostid, '_width', true ) ) . '" />';
echo '<input type="hidden" name="_height" value="' . esc_attr( get_post_meta( $thepostid, '_height', true ) ) . '" />';
endif;
do_action( 'woocommerce_product_options_dimensions' );

81
admin/post-types/writepanels/writepanels-init.php
View File

@ -7,7 +7,7 @@
* @author WooThemes
* @category Admin
* @package WooCommerce/Admin/WritePanels
* @version 1.6.4
* @version 1.7.0
*/
if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
@ -292,7 +292,7 @@ function woocommerce_meta_boxes_show_errors() {
echo '<div id="woocommerce_errors" class="error fade">';
foreach ( $woocommerce_errors as $error )
echo '<p>' . $error . '</p>';
echo '<p>' . esc_html( $error ) . '</p>';
echo '</div>';
// Clear
@ -314,20 +314,20 @@ add_action( 'admin_notices', 'woocommerce_meta_boxes_show_errors' );
function woocommerce_wp_text_input( $field ) {
global $thepostid, $post, $woocommerce;
if ( ! $thepostid ) $thepostid = $post->ID;
if ( ! isset( $field['placeholder'] ) ) $field['placeholder'] = '';
if ( ! isset( $field['class'] ) ) $field['class'] = 'short';
if ( ! isset( $field['value'] ) ) $field['value'] = get_post_meta( $thepostid, $field['id'], true );
if ( ! isset( $field['name'] ) ) $field['name'] = $field['id'];
$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
$field['placeholder'] = isset( $field['placeholder'] ) ? $field['placeholder'] : '';
$field['class'] = isset( $field['class'] ) ? $field['class'] : 'short';
$field['value'] = isset( $field['value'] ) ? $field['value'] : get_post_meta( $thepostid, $field['id'], true );
$field['name'] = isset( $field['name'] ) ? $field['name'] : $field['id'];
echo '<p class="form-field '.$field['id'].'_field"><label for="'.$field['id'].'">'.$field['label'].'</label><input type="text" class="'.$field['class'].'" name="'.$field['name'].'" id="'.$field['id'].'" value="'.esc_attr( $field['value'] ).'" placeholder="'.$field['placeholder'].'" /> ';
echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field"><label for="' . esc_attr( $field['id'] ) . '">' . esc_html( $field['label'] ) . '</label><input type="text" class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['name'] ) . '" id="' . esc_attr( $field['id'] ) . '" value="' . esc_attr( $field['value'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" /> ';
if ( isset( $field['description'] ) && $field['description'] ) {
if ( ! empty( $field['description'] ) ) {
if ( isset( $field['desc_tip'] ) ) {
echo '<img class="help_tip" data-tip="' . esc_attr( $field['description'] ) . '" src="' . $woocommerce->plugin_url() . '/assets/images/help.png" />';
} else {
echo '<span class="description">' . $field['description'] . '</span>';
echo '<span class="description">' . esc_html( $field['description'] ) . '</span>';
}
}
@ -344,9 +344,11 @@ function woocommerce_wp_text_input( $field ) {
*/
function woocommerce_wp_hidden_input( $field ) {
global $thepostid, $post;
if (!$thepostid) $thepostid = $post->ID;
if (!isset($field['value'])) $field['value'] = get_post_meta($thepostid, $field['id'], true);
echo '<input type="hidden" class="'.$field['class'].'" name="'.$field['id'].'" id="'.$field['id'].'" value="'.esc_attr( $field['value'] ).'" /> ';
$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
$field['value'] = isset( $field['value'] ) ? $field['value'] : get_post_meta( $thepostid, $field['id'], true );
echo '<input type="hidden" class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['id'] ) . '" id="' . esc_attr( $field['id'] ) . '" value="' . esc_attr( $field['value'] ) . '" /> ';
}
@ -360,19 +362,19 @@ function woocommerce_wp_hidden_input( $field ) {
function woocommerce_wp_textarea_input( $field ) {
global $thepostid, $post, $woocommerce;
if (!$thepostid) $thepostid = $post->ID;
if (!isset($field['placeholder'])) $field['placeholder'] = '';
if (!isset($field['class'])) $field['class'] = 'short';
if (!isset($field['value'])) $field['value'] = get_post_meta($thepostid, $field['id'], true);
$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
$field['placeholder'] = isset( $field['placeholder'] ) ? $field['placeholder'] : '';
$field['class'] = isset( $field['class'] ) ? $field['class'] : 'short';
$field['value'] = isset( $field['value'] ) ? $field['value'] : get_post_meta( $thepostid, $field['id'], true );
echo '<p class="form-field '.$field['id'].'_field"><label for="'.$field['id'].'">'.$field['label'].'</label><textarea class="'.$field['class'].'" name="'.$field['id'].'" id="'.$field['id'].'" placeholder="'.$field['placeholder'].'" rows="2" cols="20">'.esc_textarea( $field['value'] ).'</textarea> ';
echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field"><label for="' . esc_attr( $field['id'] ) . '">' . esc_html( $field['label'] ) . '</label><textarea class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['id'] ) . '" id="' . esc_attr( $field['id'] ) . '" placeholder="' . esc_attr( $field['placeholder'] ) . '" rows="2" cols="20">' . esc_textarea( $field['value'] ) . '</textarea> ';
if ( isset( $field['description'] ) && $field['description'] ) {
if ( ! empty( $field['description'] ) ) {
if ( isset( $field['desc_tip'] ) ) {
echo '<img class="help_tip" data-tip="' . esc_attr( $field['description'] ) . '" src="' . $woocommerce->plugin_url() . '/assets/images/help.png" />';
} else {
echo '<span class="description">' . $field['description'] . '</span>';
echo '<span class="description">' . esc_html( $field['description'] ) . '</span>';
}
}
@ -390,19 +392,15 @@ function woocommerce_wp_textarea_input( $field ) {
function woocommerce_wp_checkbox( $field ) {
global $thepostid, $post;
if (!$thepostid) $thepostid = $post->ID;
if (!isset($field['class'])) $field['class'] = 'checkbox';
if (!isset($field['wrapper_class'])) $field['wrapper_class'] = '';
if (!isset($field['value'])) $field['value'] = get_post_meta($thepostid, $field['id'], true);
if (!isset($field['cbvalue'])) $field['cbvalue'] = 'yes';
$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
$field['class'] = isset( $field['class'] ) ? $field['class'] : 'checkbox';
$field['wrapper_class'] = isset( $field['wrapper_class'] ) ? $field['wrapper_class'] : '';
$field['value'] = isset( $field['value'] ) ? $field['value'] : get_post_meta( $thepostid, $field['id'], true );
$field['cbvalue'] = isset( $field['cbvalue'] ) ? $field['cbvalue'] : 'yes';
echo '<p class="form-field '.$field['id'].'_field '.$field['wrapper_class'].'"><label for="'.$field['id'].'">'.$field['label'].'</label><input type="checkbox" class="'.$field['class'].'" name="'.$field['id'].'" id="'.$field['id'].'" value="' . $field['cbvalue'] . '" ';
echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field ' . esc_attr( $field['wrapper_class'] ) . '"><label for="' . esc_attr( $field['id'] ) . '">' . esc_html( $field['label'] ) . '</label><input type="checkbox" class="' . esc_attr( $field['class'] ) . '" name="' . esc_attr( $field['id'] ) . '" id="' . esc_attr( $field['id'] ) . '" value="' . esc_attr( $field['cbvalue'] ) . '" ' . checked( $field['value'], $field['cbvalue'], false ) . ' /> ';
checked($field['value'], $field['cbvalue']);
echo ' /> ';
if (isset($field['description']) && $field['description']) echo '<span class="description">' .$field['description'] . '</span>';
if ( ! empty( $field['description'] ) ) echo '<span class="description">' . esc_html( $field['description'] ) . '</span>';
echo '</p>';
}
@ -418,31 +416,28 @@ function woocommerce_wp_checkbox( $field ) {
function woocommerce_wp_select( $field ) {
global $thepostid, $post, $woocommerce;
if (!$thepostid) $thepostid = $post->ID;
if (!isset($field['class'])) $field['class'] = 'select short';
if (!isset($field['value'])) $field['value'] = get_post_meta($thepostid, $field['id'], true);
$thepostid = empty( $thepostid ) ? $post->ID : $thepostid;
$field['class'] = isset( $field['class'] ) ? $field['class'] : 'select short';
$field['value'] = isset( $field['value'] ) ? $field['value'] : get_post_meta( $thepostid, $field['id'], true );
echo '<p class="form-field '.$field['id'].'_field"><label for="'.$field['id'].'">'.$field['label'].'</label><select id="'.$field['id'].'" name="'.$field['id'].'" class="'.$field['class'].'">';
echo '<p class="form-field ' . esc_attr( $field['id'] ) . '_field"><label for="' . esc_attr( $field['id'] ) . '">' . esc_html( $field['label'] ) . '</label><select id="' . esc_attr( $field['id'] ) . '" name="' . esc_attr( $field['id'] ) . '" class="' . esc_attr( $field['class'] ) . '">';
foreach ($field['options'] as $key => $value) :
foreach ( $field['options'] as $key => $value ) {
echo '<option value="'.$key.'" ';
selected($field['value'], $key);
echo '>'.$value.'</option>';
echo '<option value="' . esc_attr( $key ) . '" ' . selected( esc_attr( $field['value'] ), esc_attr( $key ), false ) . '>' . esc_html( $value ) . '</option>';
endforeach;
}
echo '</select> ';
if ( isset( $field['description'] ) && $field['description'] ) {
if ( ! empty( $field['description'] ) ) {
if ( isset( $field['desc_tip'] ) ) {
echo '<img class="help_tip" data-tip="' . esc_attr( $field['description'] ) . '" src="' . $woocommerce->plugin_url() . '/assets/images/help.png" />';
} else {
echo '<span class="description">' . $field['description'] . '</span>';
echo '<span class="description">' . esc_html( $field['description'] ) . '</span>';
}
}
echo '</p>';
}