Skip to content

Commit 64fcc7d

Browse files
refactor: WordPress.Security.EscapeOutput.OutputNotEscaped, WordPress.Security.EscapeOutput.ExceptionNotEscaped escaping (#2270)
* refactor: page view scripts load from template * refactor: escaping tooltip text * refactor: escaping dokan withdraw method title * refactor: escaping installed error message * style: ignore scaping wc_esc_json function * refactor: escaping note and ship info * refactor: heading control description * style: ignore escaping the svg label image from radio image control * refactor: shop order custom columns data * refactor: escaping some text * style: ignore escaping for back trace message * refactor: escaping some variables * style: ignore escaping for back trace message * reactor: escaping some variables and some are ignored * style: ignore escaping for some variables * style: ignore escaping some variables * update: add phpcs rule for exception output * style: ignore escaping for dynamic content * style: ignore escaping for dynamic content * update: php method doc * update: php method doc * style: ignore escaping for dynamic content * update: php method doc * style: ignore escaping for dynamic content * style: ignore escaping for dynamic content * refactor: escpaing php variables * refactor: escaping some variables * refactor: escaping variables * refactor: title text * refactor: ecaping some text * refactor: escaping localize text * refactor: ecaping some text * refactor: dynamic time format data * update: phpcs rule set for capabilities * update: phpcs config * update: phpcs rule as per woocommerce * refactor: phpcs issues * added: Available roles in the phpcs for PHPCS check * refactor: fix wp data sanitization errors for SetupWizard.php * refactor: fix wp data sanitization errors for SetupWizardNoWC.php * refactor: fix wp data sanitization errors for SetupWizard.php * added: rules for custom sanitizing functions * refactor: html markup escaping * fix: template load issue for Page view * refactor: docblock for return type `dokan_get_product_types` * Update includes/Ajax.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update templates/settings/store-form.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * refactor: WordPress coding standards and security issues * refactor: WordPress coding standards and security issues * refactor: WordPress coding standards and security issues skip for non required code * update: enqueue script instead of template `templates/page-views.php` * update: using escaping `wp_kses_post($this->description);` instead of `wp_kses( $this->description, wp_kses_allowed_html( 'user_description' ) );` * delete: old tempalte for `page-views.php` --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent 7778a06 commit 64fcc7d

33 files changed

+307
-228
lines changed

assets/js/page-views.js

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* ATTENTION: The "eval" devtool has been used (maybe by default in mode: "development").
3+
* This devtool is neither made for production nor for readable output files.
4+
* It uses "eval()" calls to create a separate source file in the browser devtools.
5+
* If you are trying to read the output file, select a different devtool (https://webpack.js.org/configuration/devtool/)
6+
* or disable the default devtool with "devtool: false".
7+
* If you are looking for production-ready output files, see mode: "production" (https://webpack.js.org/configuration/mode/).
8+
*/
9+
/******/ (() => { // webpackBootstrap
10+
/******/ var __webpack_modules__ = ({
11+
12+
/***/ "./assets/src/js/page-views.js":
13+
/*!*************************************!*\
14+
!*** ./assets/src/js/page-views.js ***!
15+
\*************************************/
16+
/***/ (() => {
17+
18+
eval("/* global dokanPageViewsParams */\n\njQuery(document).ready(function ($) {\n if (!localStorage) {\n return;\n }\n if (!window.dokanPageViewsParams) {\n return;\n }\n\n // Get today's date in the format of YYYY-MM-DD\n let newDate = new Date().toISOString().slice(0, 10);\n let dokanPageViewCount = JSON.parse(localStorage.getItem(\"dokan_pageview_count\"));\n\n // If there is no data in local storage or today's date is not same as the date in local storage.\n if (dokanPageViewCount === null || dokanPageViewCount.today && dokanPageViewCount.today !== newDate) {\n dokanPageViewCount = {\n \"today\": newDate,\n \"post_ids\": []\n };\n }\n\n // If the post id is not in the local storage, then send the ajax request.\n if (!dokanPageViewCount.post_ids.includes(window.dokanPageViewsParams.post_id)) {\n $.post(window.dokanPageViewsParams.ajax_url, {\n action: \"dokan_pageview\",\n _ajax_nonce: window.dokanPageViewsParams.nonce,\n post_id: window.dokanPageViewsParams.post_id\n });\n\n // Add the post id to the local storage.\n dokanPageViewCount.post_ids.push(window.dokanPageViewsParams.post_id);\n localStorage.setItem(\"dokan_pageview_count\", JSON.stringify(dokanPageViewCount));\n }\n});\n\n//# sourceURL=webpack://dokan/./assets/src/js/page-views.js?");
19+
20+
/***/ })
21+
22+
/******/ });
23+
/************************************************************************/
24+
/******/
25+
/******/ // startup
26+
/******/ // Load entry module and return exports
27+
/******/ // This entry module can't be inlined because the eval devtool is used.
28+
/******/ var __webpack_exports__ = {};
29+
/******/ __webpack_modules__["./assets/src/js/page-views.js"]();
30+
/******/
31+
/******/ })()
32+
;

assets/src/js/page-views.js

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/* global dokanPageViewsParams */
2+
3+
jQuery( document ).ready( function( $ ) {
4+
if( ! localStorage ) {
5+
return;
6+
}
7+
8+
if ( ! window.dokanPageViewsParams ) {
9+
return;
10+
}
11+
12+
// Get today's date in the format of YYYY-MM-DD
13+
let newDate = new Date().toISOString().slice(0, 10);
14+
let dokanPageViewCount = JSON.parse(localStorage.getItem("dokan_pageview_count"));
15+
16+
// If there is no data in local storage or today's date is not same as the date in local storage.
17+
if ( dokanPageViewCount === null || ( dokanPageViewCount.today && dokanPageViewCount.today !== newDate ) ) {
18+
dokanPageViewCount = { "today": newDate, "post_ids": [] };
19+
}
20+
21+
// If the post id is not in the local storage, then send the ajax request.
22+
if ( ! dokanPageViewCount.post_ids.includes( window.dokanPageViewsParams.post_id ) ) {
23+
$.post( window.dokanPageViewsParams.ajax_url, {
24+
action: "dokan_pageview",
25+
_ajax_nonce: window.dokanPageViewsParams.nonce,
26+
post_id: window.dokanPageViewsParams.post_id,
27+
} );
28+
29+
// Add the post id to the local storage.
30+
dokanPageViewCount.post_ids.push( window.dokanPageViewsParams.post_id );
31+
localStorage.setItem( "dokan_pageview_count", JSON.stringify( dokanPageViewCount ) );
32+
}
33+
} );

includes/Admin/Hooks.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ class="dokan_product_author_override"
9696
data-minimum_input_length="0"
9797
data-data='<?php echo wp_json_encode( $user ); ?>'
9898
>
99-
</select> <?php echo wc_help_tip( __( 'You can search vendors and assign them.', 'dokan-lite' ) ); ?>
99+
</select> <?php echo wp_kses( wc_help_tip( esc_html__( 'You can search vendors and assign them.', 'dokan-lite' ) ), wp_kses_allowed_html( 'user_description' ) ); ?>
100100
<?php
101101
}
102102

@@ -165,9 +165,9 @@ public function search_vendors() {
165165
*
166166
* @return void
167167
*/
168-
public function override_product_author_by_admin( $product_id, $post ) {
168+
public function override_product_author_by_admin( $product_id ) {
169169
$product = wc_get_product( $product_id );
170-
$posted_vendor_id = ! empty( $_POST['dokan_product_author_override'] ) ? intval( wp_unslash( $_POST['dokan_product_author_override'] ) ) : 0; // phpcs:ignore
170+
$posted_vendor_id = ! empty( $_POST['dokan_product_author_override'] ) ? (int) sanitize_key( wp_unslash( $_POST['dokan_product_author_override'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Missing
171171

172172
if ( ! $posted_vendor_id ) {
173173
return;

includes/Admin/SetupWizard.php

+8-2
Original file line numberDiff line numberDiff line change
@@ -515,7 +515,7 @@ public function dokan_setup_withdraw() {
515515
<div class="wc-wizard-service-description">
516516
<?php
517517
// translators: %s: withdraw method name
518-
printf( esc_html__( 'Enable %s for your vendor as a withdraw method', 'dokan-lite' ), dokan_withdraw_get_method_title( $key ) );
518+
printf( esc_html__( 'Enable %s for your vendor as a withdraw method', 'dokan-lite' ), esc_html( dokan_withdraw_get_method_title( $key ) ) );
519519
?>
520520
</div>
521521
<div class="dokan-wizard-service-enable">
@@ -732,9 +732,15 @@ public function dokan_setup_withdraw_save() {
732732

733733
$options = get_option( 'dokan_withdraw', [] );
734734
$options['withdraw_methods'] = ! empty( $_POST['withdraw_methods'] ) ? wc_clean( wp_unslash( $_POST['withdraw_methods'] ) ) : [];
735-
$options['withdraw_limit'] = ! empty( $_POST['withdraw_limit'] ) ? (float) wc_format_decimal( sanitize_text_field( wp_unslash( $_POST['withdraw_limit'] ) ) ) < 0 ? 0 : wc_format_decimal( sanitize_text_field( wp_unslash( $_POST['withdraw_limit'] ) ) ) : 0;
736735
$options['withdraw_order_status'] = ! empty( $_POST['withdraw_order_status'] ) ? wc_clean( wp_unslash( $_POST['withdraw_order_status'] ) ) : [];
737736

737+
if ( ! empty( $_POST['withdraw_limit'] ) ) {
738+
$input_limit = sanitize_text_field( wp_unslash( $_POST['withdraw_limit'] ) );
739+
$options['withdraw_limit'] = is_numeric( $input_limit ) && $input_limit >= 0 ? wc_format_decimal( $input_limit ) : 0;
740+
} else {
741+
$options['withdraw_limit'] = 0;
742+
}
743+
738744
/**
739745
* Filter dokan_withdraw options before saving in setup wizard
740746
*

includes/Admin/SetupWizardNoWC.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ public function install_woocommerce() {
129129
delete_transient( '_wc_activation_redirect' );
130130

131131
if ( is_wp_error( $installed ) ) {
132-
wp_die( $installed->get_error_message(), __( 'Error installing WooCommerce plugin', 'dokan-lite' ) );
132+
wp_die( esc_html( $installed->get_error_message() ), esc_html__( 'Error installing WooCommerce plugin', 'dokan-lite' ) );
133133
}
134134

135135
set_transient( 'dokan_setup_wizard_no_wc', true, 15 * MINUTE_IN_SECONDS );

includes/Ajax.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -265,8 +265,8 @@ public function grant_access_to_download() {
265265

266266
include dirname( __DIR__ ) . '/templates/orders/order-download-permission-html.php';
267267

268-
$loop ++;
269-
$file_count ++;
268+
++$loop;
269+
++$file_count;
270270
}
271271
}
272272
}
@@ -414,7 +414,7 @@ public function add_order_note() {
414414
echo 'customer-note';
415415
}
416416
echo '"><div class="note_content">';
417-
echo wpautop( wptexturize( $note ) ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
417+
echo wp_kses_post( wpautop( wptexturize( $note ) ) );
418418
echo '</div><p class="meta"><a href="#" class="delete_note">' . esc_html__( 'Delete note', 'dokan-lite' ) . '</a></p>';
419419
echo '</li>';
420420
}
@@ -484,7 +484,7 @@ public function add_shipping_tracking_info() {
484484
echo '<li rel="' . esc_attr( $comment_id ) . '" class="note ';
485485
echo 'customer-note';
486486
echo '"><div class="note_content">';
487-
echo wpautop( wptexturize( $ship_info ) ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
487+
echo wp_kses_post( wpautop( wptexturize( $ship_info ) ) );
488488
echo '</div><p class="meta"><a href="#" class="delete_note">' . esc_html__( 'Delete', 'dokan-lite' ) . '</a></p>';
489489
echo '</li>';
490490

@@ -692,6 +692,7 @@ public function dokan_json_search_products_tags() {
692692

693693
$drop_down_tags = apply_filters(
694694
'dokan_search_product_tags_for_vendor_products', [
695+
'taxonomy' => 'product_tag',
695696
'name__like' => $name,
696697
'hide_empty' => 0,
697698
'orderby' => 'name',
@@ -701,7 +702,7 @@ public function dokan_json_search_products_tags() {
701702
]
702703
);
703704

704-
$product_tags = get_terms( 'product_tag', $drop_down_tags );
705+
$product_tags = get_terms( $drop_down_tags );
705706

706707
if ( $product_tags ) {
707708
foreach ( $product_tags as $pro_term ) {

includes/Customizer/HeadingControl.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ protected function render_content() {
2828
<?php } ?>
2929

3030
<?php if ( ! empty( $this->description ) ) { ?>
31-
<span class="description customize-control-description"><?php echo $this->description; ?></span>
31+
<span class="description customize-control-description">
32+
<?php echo wp_kses_post( $this->description ); ?>
33+
</span>
3234
<?php } ?>
3335
<?php
3436
}

includes/Customizer/RadioImageControl.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ public function render_content() {
8080
<label for="<?php echo esc_attr( $this->id ) . esc_attr( $value ); ?>">
8181
<?php
8282
if ( isset( $label['svg'] ) ) {
83-
echo $label['svg'];
83+
echo $label['svg']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
8484
} else {
8585
?>
8686
<img src="<?php echo esc_html( $label['src'] ); ?>" alt="<?php echo esc_attr( $label['label'] ); ?>" title="<?php echo esc_attr( $label['label'] ); ?>">

includes/Order/Admin/Hooks.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ public function shop_order_custom_columns( $col, $post_id ) {
158158
}
159159

160160
if ( ! empty( $output ) ) {
161-
echo apply_filters( "dokan_manage_shop_order_custom_columns_{$col}", $output, $order );
161+
echo wp_kses_post( apply_filters( "dokan_manage_shop_order_custom_columns_{$col}", $output, $order ) );
162162
}
163163
}
164164

@@ -168,15 +168,15 @@ public function shop_order_custom_columns( $col, $post_id ) {
168168
* @since 3.8.0 Moved from includes/Admin/Hooks.php file
169169
* @since 3.8.0 Rewritten for HPOS
170170
*
171-
* @param string[] $classes An array of post class names.
172-
* @param string[] $class An array of additional class names added to the post.
171+
* @param string[] $classes An array of post class names.
172+
* @param string[] $css_class An array of additional class names added to the post.
173173
* @param int $post_id The post ID.
174174
*
175175
* @global WP_Post $post
176176
*
177177
* @return array
178178
*/
179-
public function admin_shop_order_row_classes( $classes, $class, $post_id ) {
179+
public function admin_shop_order_row_classes( $classes, $css_class, $post_id ) {
180180
if ( ! OrderUtil::is_order( $post_id ) ) {
181181
return $classes;
182182
}

includes/PageViews.php

+77-76
Original file line numberDiff line numberDiff line change
@@ -3,83 +3,84 @@
33
namespace WeDevs\Dokan;
44

55
/**
6-
* Pageviews - for counting product post views.
6+
* Page views - for counting product post views.
77
*/
88
class PageViews {
99

10-
private $meta_key = 'pageview';
11-
12-
public function __construct() {
13-
/* Registers the entry views extension scripts if we're on the correct page. */
14-
add_action( 'template_redirect', array( $this, 'load_views' ), 25 );
15-
16-
/* Add the entry views AJAX actions to the appropriate hooks. */
17-
add_action( 'wp_ajax_dokan_pageview', array( $this, 'update_ajax' ) );
18-
add_action( 'wp_ajax_nopriv_dokan_pageview', array( $this, 'update_ajax' ) );
19-
}
20-
21-
public function load_scripts() {
22-
$nonce = wp_create_nonce( 'dokan_pageview' );
23-
24-
echo '<script type="text/javascript">
25-
jQuery(document).ready( function($) {
26-
if(localStorage){
27-
let new_date = new Date().toISOString().slice(0, 10);
28-
let dokan_pageview_count = JSON.parse(localStorage.getItem("dokan_pageview_count"));
29-
let post_id = ' . get_the_ID() . ';
30-
31-
if ( dokan_pageview_count === null || ( dokan_pageview_count.today && dokan_pageview_count.today !== new_date ) ) {
32-
dokan_pageview_count = { "today": new_date, "post_ids": [] };
33-
}
34-
if ( ! dokan_pageview_count.post_ids.includes( post_id ) ) {
35-
var data = {
36-
action: "dokan_pageview",
37-
_ajax_nonce: "' . esc_html( $nonce ) . '",
38-
post_id: ' . get_the_ID() . ',
39-
}
40-
$.post( "' . esc_url( admin_url( 'admin-ajax.php' ) ) . '", data );
41-
dokan_pageview_count.post_ids.push( post_id );
42-
localStorage.setItem("dokan_pageview_count", JSON.stringify(dokan_pageview_count));
43-
}
44-
}
45-
} );
46-
</script>';
47-
}
48-
49-
public function load_views() {
50-
if ( is_singular( 'product' ) ) {
51-
global $post;
52-
53-
if ( $post->post_author !== dokan_get_current_user_id() ) {
54-
wp_enqueue_script( 'jquery' );
55-
add_action( 'wp_footer', array( $this, 'load_scripts' ) );
56-
}
57-
}
58-
}
59-
60-
public function update_view( $post_id = '' ) {
61-
if ( ! empty( $post_id ) ) {
62-
$old_views = get_post_meta( $post_id, $this->meta_key, true );
63-
$new_views = absint( $old_views ) + 1;
64-
65-
update_post_meta( $post_id, $this->meta_key, $new_views, $old_views );
66-
$seller_id = get_post_field( 'post_author', $post_id );
67-
Cache::delete( "pageview_{$seller_id}" );
68-
}
69-
}
70-
71-
public function update_ajax() {
72-
check_ajax_referer( 'dokan_pageview' );
73-
74-
if ( isset( $_POST['post_id'] ) ) {
75-
$post_id = absint( $_POST['post_id'] );
76-
}
77-
78-
if ( ! empty( $post_id ) ) {
79-
$this->update_view( $post_id );
80-
}
81-
82-
wp_die();
83-
}
84-
10+
private $meta_key = 'pageview';
11+
12+
public function __construct() {
13+
/* Registers the entry views extension scripts if we're on the correct page. */
14+
add_action( 'template_redirect', array( $this, 'load_views' ), 25 );
15+
16+
/* Add the entry views AJAX actions to the appropriate hooks. */
17+
add_action( 'wp_ajax_dokan_pageview', array( $this, 'update_ajax' ) );
18+
add_action( 'wp_ajax_nopriv_dokan_pageview', array( $this, 'update_ajax' ) );
19+
}
20+
21+
/**
22+
* Load the scripts
23+
*
24+
* @return void
25+
*/
26+
public function load_scripts() {
27+
wp_enqueue_script( 'dokan-page-views', DOKAN_PLUGIN_ASSEST . '/js/page-views.js', array( 'jquery' ), DOKAN_PLUGIN_VERSION, true );
28+
wp_localize_script(
29+
'dokan-page-views',
30+
'dokanPageViewsParams',
31+
array(
32+
'nonce' => wp_create_nonce( 'dokan_pageview' ),
33+
'post_id' => get_the_ID(),
34+
'ajax_url' => admin_url( 'admin-ajax.php' ),
35+
)
36+
);
37+
}
38+
39+
public function load_views() {
40+
if ( is_singular( 'product' ) ) {
41+
global $post;
42+
43+
if ( dokan_get_current_user_id() !== $post->post_author ) {
44+
wp_enqueue_script( 'jquery' );
45+
add_action( 'wp_footer', array( $this, 'load_scripts' ) );
46+
}
47+
}
48+
}
49+
50+
/**
51+
* Update the view count
52+
*
53+
* @param int $post_id The post ID
54+
*
55+
* @return void
56+
*/
57+
public function update_view( $post_id = '' ) {
58+
if ( ! empty( $post_id ) ) {
59+
$old_views = get_post_meta( $post_id, $this->meta_key, true );
60+
$new_views = absint( $old_views ) + 1;
61+
62+
update_post_meta( $post_id, $this->meta_key, $new_views, $old_views );
63+
$seller_id = get_post_field( 'post_author', $post_id );
64+
Cache::delete( "pageview_{$seller_id}" );
65+
}
66+
}
67+
68+
/**
69+
* Update the view count via AJAX
70+
*
71+
* @return void
72+
*/
73+
public function update_ajax() {
74+
check_ajax_referer( 'dokan_pageview' );
75+
76+
if ( isset( $_POST['post_id'] ) ) {
77+
$post_id = absint( $_POST['post_id'] );
78+
}
79+
80+
if ( ! empty( $post_id ) ) {
81+
$this->update_view( $post_id );
82+
}
83+
84+
wp_die();
85+
}
8586
}

0 commit comments

Comments
 (0)