diff --git a/phpcs.xml b/phpcs.xml
index ff901cc..b317a5b 100644
--- a/phpcs.xml
+++ b/phpcs.xml
@@ -6,8 +6,9 @@
- inc
statify-blacklist.php
+ inc
+ views
diff --git a/views/settings-page.php b/views/settings-page.php
index 2213995..e2a210b 100755
--- a/views/settings-page.php
+++ b/views/settings-page.php
@@ -19,7 +19,7 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
// Check user capabilities.
if ( ! current_user_can( 'manage_options' ) ) {
- die( __( 'Are you sure you want to do this?' ) );
+ die( esc_html__( 'Are you sure you want to do this?' ) );
}
if ( ! empty( $_POST['cleanUp'] ) ) {
@@ -27,24 +27,27 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
StatifyBlacklist_Admin::cleanup_database();
} else {
// Extract referer array.
- if ( empty( trim( $_POST['statifyblacklist']['referer']['blacklist'] ) ) ) {
+ $referer_str = sanitize_textarea_field( wp_unslash( $_POST['statifyblacklist']['referer']['blacklist'] ) );
+ if ( empty( trim( $referer_str ) ) ) {
$referer = array();
} else {
- $referer = explode( "\r\n", $_POST['statifyblacklist']['referer']['blacklist'] );
+ $referer = explode( "\r\n", $referer_str );
}
// Extract target array.
- if ( empty( trim( $_POST['statifyblacklist']['target']['blacklist'] ) ) ) {
+ $target_str = sanitize_textarea_field( wp_unslash( $_POST['statifyblacklist']['target']['blacklist'] ) );
+ if ( empty( trim( $target_str ) ) ) {
$target = array();
} else {
- $target = explode( "\r\n", str_replace( '\\\\', '\\', $_POST['statifyblacklist']['target']['blacklist'] ) );
+ $target = explode( "\r\n", str_replace( '\\\\', '\\', $target_str ) );
}
// Extract IP array.
- if ( empty( trim( $_POST['statifyblacklist']['ip']['blacklist'] ) ) ) {
+ $ip_str = sanitize_textarea_field( wp_unslash( $_POST['statifyblacklist']['ip']['blacklist'] ) );
+ if ( empty( trim( $ip_str ) ) ) {
$ip = array();
} else {
- $ip = explode( "\r\n", $_POST['statifyblacklist']['ip']['blacklist'] );
+ $ip = explode( "\r\n", $ip_str );
}
// Update options (data will be sanitized).
@@ -90,10 +93,17 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
}
} // End if().
} // End if().
+
+/*
+ * Disable some code style rules that are impractical for textarea content:
+ *
+ * phpcs:disable Squiz.PHP.EmbeddedPhp.ContentBeforeOpen
+ * phpcs:disable Squiz.PHP.EmbeddedPhp.ContentAfterEnd
+ */
?>
-
+
';
@@ -103,7 +113,7 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
if ( isset( $statifyblacklist_post_warning ) ) {
print '
' .
esc_html( $statifyblacklist_post_warning );
- print '
';
+ print '
';
esc_html_e( 'Settings have not been saved yet.', 'statify-blacklist' );
print '
';
}
@@ -120,26 +130,24 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
+ ()
+ ()
+
+ ()
@@ -182,26 +184,24 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
+ ()
+ ()
+
+
+ (
+
+ )
+
@@ -244,8 +244,8 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
@@ -279,14 +279,16 @@ if ( ! empty( $_POST['statifyblacklist'] ) ) {
-
-
-
-
-
-
+
+
+
+
+
+
+
+