From 4c13f19af691f6c10cef4fe6a9b7b88a6a85e6f1 Mon Sep 17 00:00:00 2001
From: Fabiano Alencar <fabianocarvalho15@gmail.com>
Date: Tue, 8 Jan 2019 15:02:05 -0200
Subject: [PATCH] added needed esc (attr and html); fix the image thumbnail url

---
 src/header.php                                     |  2 +-
 src/template-parts/headercollection.php            | 14 ++++++++------
 src/template-parts/list-post.php                   |  6 ++++--
 .../loop-tainacan-collection-grid.php              |  8 +++++---
 .../loop-tainacan-collection-table.php             |  8 +++++---
 src/template-parts/loop-tainacan-collection.php    |  6 ++++--
 6 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/src/header.php b/src/header.php
index d93c727..0e2d66a 100644
--- a/src/header.php
+++ b/src/header.php
@@ -17,7 +17,7 @@
 			<div class="btn-group ml-auto"> 
 					<form class="form-horizontal my-2 my-md-0 tainacan-search-form d-none d-md-block" [formGroup]="searchForm" role="form" (keyup.enter)="onSubmit()" action="<?php echo home_url( '/' ); ?>">
 						<div class="input-group">
-							<input type="text" name="s" placeholder="<?php _e( 'Search', 'tainacan-interface' ); ?>" class="form-control" formControlName="searchText" size="50">
+							<input type="text" name="s" placeholder="<?php esc_attr_e( 'Search', 'tainacan-interface' ); ?>" class="form-control" formControlName="searchText" size="50">
 							<span class="text-midnight-blue input-group-btn mdi mdi-magnify form-control-feedback"></span>
 						</div>
 					</form>
diff --git a/src/template-parts/headercollection.php b/src/template-parts/headercollection.php
index c8595e2..975ea39 100644
--- a/src/template-parts/headercollection.php
+++ b/src/template-parts/headercollection.php
@@ -8,14 +8,14 @@ $background_color = get_post_meta( tainacan_get_collection_id(), 'tainacan_theme
 $text_color = get_post_meta( tainacan_get_collection_id(), 'tainacan_theme_collection_color', true );
 if ( $background_color ) {
 	echo ".t-bg-collection {
-		background-color: $background_color !important;
+		background-color: " . esc_attr($background_color) . " !important;
 	}";
 	echo ".t-bg-collection h2, .t-bg-collection .t-collection--info-description-text {
-		color: $text_color !important;
+		color: " . esc_attr($text_color) . " !important;
 	}";
 
 	echo ".t-bg-collection a {
-		color: $text_color !important;
+		color: " . esc_attr($text_color) . " !important;
 		opacity: 0.6;
 	}";
 }
@@ -27,13 +27,15 @@ echo '</style>';
 	<div class="container-fluid px-0 t-bg-collection" style="<!-- z-index: 0; -->">
 		<div class="collection-header position-relative max-large" style="">
 			<?php do_action( 'tainacan-interface-collection-header' ); ?>
-			<?php if ( has_post_thumbnail( tainacan_get_collection_id() ) ) : ?>
-				<img src="<?php echo get_the_post_thumbnail_url( tainacan_get_collection_id() ); ?>" class="t-collection--info-img rounded-circle img-fluid border border-white position-absolute text-left">
+			<?php if ( has_post_thumbnail( tainacan_get_collection_id() ) ) : 
+				$thumbnail_id = get_post_thumbnail_id( $post->ID );
+				$alt = get_post_meta($thumbnail_id, '_wp_attachment_image_alt', true); ?>
+				<img src="<?php the_post_thumbnail_url(); ?>" class="t-collection--info-img rounded-circle img-fluid border border-white position-absolute text-left" alt="<?php echo esc_attr($alt); ?>">
 			<?php else : ?>
 				<div class="image-placeholder rounded-circle border border-white position-absolute">
 					<h4 class="text-center">
 					<?php
-						echo tainacan_get_initials( tainacan_get_the_collection_name() );
+						echo esc_html( tainacan_get_initials( tainacan_get_the_collection_name() ) );
 					?>
 					</h4>
 				</div>
diff --git a/src/template-parts/list-post.php b/src/template-parts/list-post.php
index e77229c..b623ea4 100644
--- a/src/template-parts/list-post.php
+++ b/src/template-parts/list-post.php
@@ -1,7 +1,9 @@
 <div class="row blog-post mb-3">
-	<?php if ( has_post_thumbnail() ) : ?>
+	<?php if ( has_post_thumbnail() ) : 
+			$thumbnail_id = get_post_thumbnail_id( $post->ID );
+			$alt = get_post_meta($thumbnail_id, '_wp_attachment_image_alt', true); ?>
 		<div class="col-xs-12 col-md-4 blog-thumbnail align-self-center text-center mb-4 mb-md-0">
-			<a href="<?php the_permalink(); ?>"><img src="<?php echo get_the_post_thumbnail_url( get_the_ID(),'tainacan-interface-list-post' ) ?>" class="img-fluid" alt=""></a>
+			<a href="<?php the_permalink(); ?>"><img src="<?php the_post_thumbnail_url( 'tainacan-interface-list-post' ) ?>" class="img-fluid" alt="<?php echo esc_attr($alt); ?>"></a>
 		</div>
 	<?php endif; ?>
 	<div class="col-xs-12 blog-content <?php if ( has_post_thumbnail() ) :?>col-md-8 blog-flex<?php else : ?>col-md-12<?php endif; ?> align-self-center">
diff --git a/src/template-parts/loop-tainacan-collection-grid.php b/src/template-parts/loop-tainacan-collection-grid.php
index cf18c46..1c4b81f 100644
--- a/src/template-parts/loop-tainacan-collection-grid.php
+++ b/src/template-parts/loop-tainacan-collection-grid.php
@@ -7,12 +7,14 @@
 						<p class="tainacan-list-collection--grid-title text-black text-left p-3 mb-0 text-truncate">
 							<?php the_title(); ?>           
 						</p>
-						<?php if ( has_post_thumbnail() ) : ?>
-							<img src="<?php echo get_the_post_thumbnail_url( get_the_ID(), 'tainacan-medium' ) ?>" class="img-fluid tainacan-list-collection--grid-img" alt="">  
+						<?php if ( has_post_thumbnail() ) : 
+							$thumbnail_id = get_post_thumbnail_id( $post->ID );
+							$alt = get_post_meta($thumbnail_id, '_wp_attachment_image_alt', true); ?>
+							<img src="<?php the_post_thumbnail_url( 'tainacan-medium' ) ?>" class="img-fluid tainacan-list-collection--grid-img" alt="<?php echo esc_attr($alt); ?>">  
 						<?php else : ?>
 							<div class="image-placeholder">
 								<h4 class="text-center">
-									<?php echo tainacan_get_initials( get_the_title() ); ?>
+									<?php echo esc_html( tainacan_get_initials( get_the_title() ) ); ?>
 								</h4>
 							</div>
 						<?php endif; ?>
diff --git a/src/template-parts/loop-tainacan-collection-table.php b/src/template-parts/loop-tainacan-collection-table.php
index 3918f64..9b86872 100644
--- a/src/template-parts/loop-tainacan-collection-table.php
+++ b/src/template-parts/loop-tainacan-collection-table.php
@@ -14,12 +14,14 @@
 				<?php while ( have_posts() ) : the_post(); ?>
 					<tr class="tainacan-list-collection" onclick="location.href='<?php the_permalink(); ?>'">
 						<td class="collection-miniature">
-							<?php if ( has_post_thumbnail() ) : ?>
-								<img src="<?php echo get_the_post_thumbnail_url( get_the_ID(), 'tainacan-small' ) ?>" class="img-fluid rounded-circle" alt="">
+							<?php if ( has_post_thumbnail() ) : 
+								$thumbnail_id = get_post_thumbnail_id( $post->ID );
+								$alt = get_post_meta($thumbnail_id, '_wp_attachment_image_alt', true); ?>
+								<img src="<?php the_post_thumbnail_url( 'tainacan-small' ) ?>" class="img-fluid rounded-circle" alt="<?php echo esc_attr($alt); ?>">
 							<?php else : ?>
 								<div class="image-placeholder">
 									<h4>
-									<?php echo tainacan_get_initials( get_the_title(), true ); ?>
+									<?php echo esc_html( tainacan_get_initials( get_the_title(), true ) ); ?>
 									</h4>
 								</div>
 							<?php endif; ?>
diff --git a/src/template-parts/loop-tainacan-collection.php b/src/template-parts/loop-tainacan-collection.php
index cc5bcc5..2ea96d1 100644
--- a/src/template-parts/loop-tainacan-collection.php
+++ b/src/template-parts/loop-tainacan-collection.php
@@ -6,8 +6,10 @@
 					<a class="tainacan-list-collection--card-link" href="<?php the_permalink(); ?>">
 						<h5 class="tainacan-list-collection--title text-black text-left p-3 mb-0 text-truncate"><?php the_title(); ?></h5>
 						<div class="media">
-							<?php if ( has_post_thumbnail() ) : ?>
-								<img src="<?php echo get_the_post_thumbnail_url( get_the_ID(), 'collection-list-card' ) ?>" class="tainacan-list-collection--card-img rounded-0 align-self-center mr-3" alt="">  
+							<?php if ( has_post_thumbnail() ) : 
+								$thumbnail_id = get_post_thumbnail_id( $post->ID );
+								$alt = get_post_meta($thumbnail_id, '_wp_attachment_image_alt', true); ?>
+								<img src="<?php the_post_thumbnail_url( 'collection-list-card' ) ?>" class="tainacan-list-collection--card-img rounded-0 align-self-center mr-3" alt="<?php echo esc_attr($alt); ?>">  
 							<?php else : ?>
 								<div class="image-placeholder">
 									<h4>