From 5fed60196e2d52d1880469f283a750b0d3ac6386 Mon Sep 17 00:00:00 2001 From: Thomas W Date: Wed, 23 Nov 2016 10:49:27 +0100 Subject: [PATCH] improved escaping and sanitizing of widget settings and slider options --- functions.php | 127 +++++++++--------- inc/slider.php | 32 ++--- inc/theme-info.php | 14 +- inc/widgets/widget-magazine-posts-boxed.php | 2 +- inc/widgets/widget-magazine-posts-columns.php | 8 +- inc/widgets/widget-magazine-posts-grid.php | 4 +- readme.txt | 3 + style.css | 2 +- 8 files changed, 98 insertions(+), 94 deletions(-) diff --git a/functions.php b/functions.php index a2ec5fc..bbba151 100644 --- a/functions.php +++ b/functions.php @@ -14,71 +14,70 @@ if ( ! function_exists( 'tortuga_setup' ) ) : -/** - * Sets up theme defaults and registers support for various WordPress features. - * - * Note that this function is hooked into the after_setup_theme hook, which - * runs before the init hook. The init hook is too late for some features, such - * as indicating support for post thumbnails. - */ -function tortuga_setup() { - - // Make theme available for translation. Translations can be filed in the /languages/ directory. - load_theme_textdomain( 'tortuga', get_template_directory() . '/languages' ); - - // Add default posts and comments RSS feed links to head. - add_theme_support( 'automatic-feed-links' ); - - // Let WordPress manage the document title. - add_theme_support( 'title-tag' ); - - // Enable support for Post Thumbnails on posts and pages. - add_theme_support( 'post-thumbnails' ); - - // Set detfault Post Thumbnail size. - set_post_thumbnail_size( 900, 400, true ); - - // Register Navigation Menu. - register_nav_menu( 'primary', esc_html__( 'Main Navigation', 'tortuga' ) ); + /** + * Sets up theme defaults and registers support for various WordPress features. + * + * Note that this function is hooked into the after_setup_theme hook, which + * runs before the init hook. The init hook is too late for some features, such + * as indicating support for post thumbnails. + */ + function tortuga_setup() { + + // Make theme available for translation. Translations can be filed in the /languages/ directory. + load_theme_textdomain( 'tortuga', get_template_directory() . '/languages' ); + + // Add default posts and comments RSS feed links to head. + add_theme_support( 'automatic-feed-links' ); + + // Let WordPress manage the document title. + add_theme_support( 'title-tag' ); + + // Enable support for Post Thumbnails on posts and pages. + add_theme_support( 'post-thumbnails' ); + + // Set detfault Post Thumbnail size. + set_post_thumbnail_size( 900, 400, true ); + + // Register Navigation Menu. + register_nav_menu( 'primary', esc_html__( 'Main Navigation', 'tortuga' ) ); + + // Switch default core markup for search form, comment form, and comments to output valid HTML5. + add_theme_support( 'html5', array( + 'comment-form', + 'comment-list', + 'gallery', + 'caption', + ) ); + + // Set up the WordPress core custom background feature. + add_theme_support( 'custom-background', apply_filters( 'tortuga_custom_background_args', array( 'default-color' => 'dddddd' ) ) ); + + // Set up the WordPress core custom logo feature. + add_theme_support( 'custom-logo', apply_filters( 'tortuga_custom_logo_args', array( + 'height' => 50, + 'width' => 250, + 'flex-height' => true, + 'flex-width' => true, + ) ) ); + + // Set up the WordPress core custom header feature. + add_theme_support( 'custom-header', apply_filters( 'tortuga_custom_header_args', array( + 'header-text' => false, + 'width' => 1920, + 'height' => 480, + 'flex-height' => true, + ) ) ); + + // Add Theme Support for wooCommerce. + add_theme_support( 'woocommerce' ); + + // Add extra theme styling to the visual editor. + add_editor_style( array( 'css/editor-style.css', tortuga_google_fonts_url() ) ); + + // Add Theme Support for Selective Refresh in Customizer. + add_theme_support( 'customize-selective-refresh-widgets' ); - // Switch default core markup for search form, comment form, and comments to output valid HTML5. - add_theme_support( 'html5', array( - 'search-form', - 'comment-form', - 'comment-list', - 'gallery', - 'caption', - ) ); - - // Set up the WordPress core custom background feature. - add_theme_support( 'custom-background', apply_filters( 'tortuga_custom_background_args', array( 'default-color' => 'dddddd' ) ) ); - - // Set up the WordPress core custom logo feature. - add_theme_support( 'custom-logo', apply_filters( 'tortuga_custom_logo_args', array( - 'height' => 50, - 'width' => 250, - 'flex-height' => true, - 'flex-width' => true, - ) ) ); - - // Set up the WordPress core custom header feature. - add_theme_support( 'custom-header', apply_filters( 'tortuga_custom_header_args', array( - 'header-text' => false, - 'width' => 1920, - 'height' => 480, - 'flex-height' => true, - ) ) ); - - // Add Theme Support for wooCommerce. - add_theme_support( 'woocommerce' ); - - // Add extra theme styling to the visual editor. - add_editor_style( array( 'css/editor-style.css', tortuga_google_fonts_url() ) ); - - // Add Theme Support for Selective Refresh in Customizer. - add_theme_support( 'customize-selective-refresh-widgets' ); - -} + } endif; add_action( 'after_setup_theme', 'tortuga_setup' ); diff --git a/inc/slider.php b/inc/slider.php index 6de9bec..f1a8015 100644 --- a/inc/slider.php +++ b/inc/slider.php @@ -21,14 +21,14 @@ function tortuga_slider_scripts() { // Register and enqueue FlexSlider JS and CSS if necessary. if ( true === $theme_options['slider_blog'] or true === $theme_options['slider_magazine'] or is_page_template( 'template-slider.php' ) ) : - // FlexSlider CSS. - wp_enqueue_style( 'tortuga-flexslider', get_template_directory_uri() . '/css/flexslider.css' ); - // FlexSlider JS. - wp_enqueue_script( 'flexslider', get_template_directory_uri() .'/js/jquery.flexslider-min.js', array( 'jquery' ), '2.6.0' ); + wp_enqueue_script( 'jquery-flexslider', get_template_directory_uri() . '/js/jquery.flexslider-min.js', array( 'jquery' ), '2.6.0' ); // Register and enqueue slider setup. - wp_enqueue_script( 'tortuga-post-slider', get_template_directory_uri() .'/js/slider.js', array( 'flexslider' ) ); + wp_enqueue_script( 'tortuga-slider', get_template_directory_uri() . '/js/slider.js', array( 'jquery-flexslider' ) ); + + // Register and enqueue slider CSS. + wp_enqueue_style( 'tortuga-slider', get_template_directory_uri() . '/css/flexslider.css' ); endif; @@ -48,17 +48,17 @@ function tortuga_slider_excerpt_length( $length ) { if ( ! function_exists( 'tortuga_slider_meta' ) ) : -/** - * Displays the date and author on slider posts - */ -function tortuga_slider_meta() { + /** + * Displays the date and author on slider posts + */ + function tortuga_slider_meta() { - $postmeta = tortuga_meta_date(); - $postmeta .= tortuga_meta_author(); + $postmeta = tortuga_meta_date(); + $postmeta .= tortuga_meta_author(); - echo '
' . $postmeta . '
'; + echo '
' . $postmeta . '
'; -} + } endif; @@ -76,13 +76,13 @@ function tortuga_slider_options() { $params = array(); // Set slider animation. - $params['animation'] = $theme_options['slider_animation']; + $params['animation'] = ( 'fade' === $theme_options['slider_animation'] ) ? 'fade' : 'slide'; // Set slider speed. - $params['speed'] = $theme_options['slider_speed']; + $params['speed'] = absint( $theme_options['slider_speed'] ); // Passing parameters to Flexslider. - wp_localize_script( 'tortuga-post-slider', 'tortuga_slider_params', $params ); + wp_localize_script( 'tortuga-slider', 'tortuga_slider_params', $params ); } add_action( 'wp_enqueue_scripts', 'tortuga_slider_options' ); diff --git a/inc/theme-info.php b/inc/theme-info.php index 89ee521..c75d997 100644 --- a/inc/theme-info.php +++ b/inc/theme-info.php @@ -80,7 +80,7 @@ function tortuga_theme_info_page() { get( 'Name' ) ); ?>

- +

@@ -146,10 +146,12 @@ function tortuga_theme_info_page() {
-

get( 'Name' ), - 'ThemeZee', - '' . esc_html__( 'rate it', 'tortuga' ) . ''); ?> +

+ get( 'Name' ), + 'ThemeZee', + '' . esc_html__( 'rate it', 'tortuga' ) . '' + ); ?>

@@ -172,7 +174,7 @@ function tortuga_theme_info_page_css( $hook ) { } // Embed theme info css style. - wp_enqueue_style( 'tortuga-theme-info-css', get_template_directory_uri() .'/css/theme-info.css' ); + wp_enqueue_style( 'tortuga-theme-info-css', get_template_directory_uri() . '/css/theme-info.css' ); } add_action( 'admin_enqueue_scripts', 'tortuga_theme_info_page_css' ); diff --git a/inc/widgets/widget-magazine-posts-boxed.php b/inc/widgets/widget-magazine-posts-boxed.php index 8ac0a95..e7bd84e 100644 --- a/inc/widgets/widget-magazine-posts-boxed.php +++ b/inc/widgets/widget-magazine-posts-boxed.php @@ -433,7 +433,7 @@ function form( $instance ) { ?>

diff --git a/inc/widgets/widget-magazine-posts-columns.php b/inc/widgets/widget-magazine-posts-columns.php index bafbfb7..35a2cb4 100644 --- a/inc/widgets/widget-magazine-posts-columns.php +++ b/inc/widgets/widget-magazine-posts-columns.php @@ -304,7 +304,7 @@ function category_title( $args, $settings, $category_id, $category_title ) { // Display Widget Title with link to category archive. echo '
'; - echo '

'. $widget_title . '

'; + echo '

' . $widget_title . '

'; echo '
'; else : @@ -357,7 +357,7 @@ function form( $instance ) {

@@ -378,7 +378,7 @@ function form( $instance ) {

@@ -399,7 +399,7 @@ function form( $instance ) {

diff --git a/inc/widgets/widget-magazine-posts-grid.php b/inc/widgets/widget-magazine-posts-grid.php index 43e9798..247f237 100644 --- a/inc/widgets/widget-magazine-posts-grid.php +++ b/inc/widgets/widget-magazine-posts-grid.php @@ -411,7 +411,7 @@ function form( $instance ) {

@@ -440,7 +440,7 @@ function form( $instance ) {

diff --git a/readme.txt b/readme.txt index 870a39c..e842a4a 100644 --- a/readme.txt +++ b/readme.txt @@ -26,6 +26,9 @@ For more information about Tortuga please go to https://themezee.com/themes/tort == Changelog == += 1.1.4 = +* improved escaping and sanitizing of widget settings and slider options + = 1.1.3 = * fixed mobile menus on RTL language sites * moved Theme Links to Theme Options panel dropdown diff --git a/style.css b/style.css index 6ab3e33..386bb63 100644 --- a/style.css +++ b/style.css @@ -4,7 +4,7 @@ Theme URI: https://themezee.com/themes/tortuga/ Author: ThemeZee Author URI: https://themezee.com Description: Tortuga is a highly flexible and adventurous WordPress theme for your pirate magazine or any news related website. It supports three different post layouts, two sidebar schemes and a Magazine Homepage template based on widgets. Other highlights of Tortuga are the beautiful post slider and header widgets area. Arrr! -Version: 1.1.3 +Version: 1.1.4 License: GNU General Public License v2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Text Domain: tortuga