WordPress.org
Get WordPress

Plugin Directory

Changeset 2859814


Ignore:
Timestamp:
02/03/2023 06:52:08 PM (3 years ago)
Author:
ujimoto
Message:

updates on sanitize

Location:
uji-countdown/trunk/classes
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • uji-countdown/trunk/classes/class-uji-countdown-admin.php

    r2850143 r2859814  
    229229
    230230            // ID
    231             $cur_id = ( $this->cform_is_edit() ) ? $_GET['edit'] : '';
     231            $cur_id = ( $this->cform_is_edit() ) ? ujic_clean( wp_unslash( $_GET['edit'] ) ) : '';
    232232
    233233            // Get vars
    … …  
    235235
    236236            // Curent style
    237             $cur_style = ( $this->cform_is_edit() ) ? $vars['ujic_style'] : ( ( isset( $_GET['style'] ) && ! empty( $_GET['style'] ) ) ? $_GET['style'] : 'classic' );
     237            $cur_style = ( $this->cform_is_edit() ) ? $vars['ujic_style'] : ( ( isset( $_GET['style'] ) && ! empty( $_GET['style'] ) ) ? ujic_clean( wp_unslash( $_GET['style'] ) ) : 'classic' );
    238238
    239239            // Build Forms
    … …  
    824824    private function cform_delete() {
    825825        if ( isset( $_GET['del'] ) && ( ! empty( $_GET['del'] ) && is_numeric( $_GET['del'] ) ) ) {
    826                 $this->del_ujic_db( trim( $_GET['del'] ) );
     826                $this->del_ujic_db( trim( ujic_clean( wp_unslash($_GET['del'] ) ) ) );
    827827                $this->ujic_message( __( 'Your countdown style was deleted', 'ujicountdown' ) );
    828828        }

  • uji-countdown/trunk/classes/class-uji-countdown-front.php

    r2850143 r2859814  
    103103     */
    104104    public function ujic_shortcode( $atts, $content = null ) {
    105                          _fl('!!!!!!!!!');
    106                         _fl($atts);
    107105        extract(
    108106            shortcode_atts(
    … …  
    273271                       
    274272            $htmlCode     = strip_shortcodes( '<div class="ujic-hold' . esc_attr( $hclass ) . '"> <div id = "uji-wrapper" class = "ujicf"> <div class="ujicf ujiCountdown' . esc_attr( $classh ) . '" id="' . esc_attr( $ujic_id ) . '">' . wp_kses_post( $extStyle )  . '</div>' . wp_kses_post( $formHtmlCode ) . '</div></div>' . $content );
    275                 return $htmlCode;
     273                       
     274            return $htmlCode;
    276275        }
    277276    }

  • uji-countdown/trunk/classes/class-uji-countdown.php

    r2850143 r2859814  
    363363    public function del_ujic_db( $id ) {
    364364        global $wpdb;
    365         $wpdb->query( $wpdb->prepare( "DELETE FROM " . self::ujic_tab_name() . " WHERE id = '%d'" ), $id );
     365       
     366        if ( is_numeric( $id ) ) {
     367                $wpdb->query( $wpdb->prepare( "DELETE FROM " . self::ujic_tab_name() . " WHERE id = '%d'" ), $id );
     368        }
    366369    }
    367370
Note: See TracChangeset for help on using the changeset viewer.