Event Calendar WD – Responsive Event Calendar plugin - Version 1.1.22

Version Description

  • Fixed: XSS vulnerabilities
  • Changed: Capability required to edit themes
Download this release

Release Info

Developer webdorado
Plugin Icon 128x128 Event Calendar WD – Responsive Event Calendar plugin
Version 1.1.22
Comparing to
See all releases

Code changes from version 1.1.21 to 1.1.22

Files changed (15) hide show
  1. changelog.txt +4 -0
  2. ecwd.php +2 -2
  3. includes/ecwd_class-rest-api.php +1 -1
  4. js/admin/admin.js +17 -1
  5. readme.txt +5 -1
  6. views/admin/ecwd-calendar-meta.php +1 -1
  7. views/admin/ecwd-event-calendars-meta.php +1 -1
  8. views/admin/ecwd-event-meta.php +6 -6
  9. views/admin/ecwd-event-organizers-meta.php +1 -1
  10. views/admin/ecwd-event-venues-meta.php +10 -10
  11. views/admin/ecwd-organizer-meta.php +2 -2
  12. views/admin/ecwd-venue-meta.php +8 -8
  13. views/ecwd-event-content.php +2 -2
  14. views/ecwd-event-popup.php +2 -2
  15. views/ecwd-organizer-content.php +1 -1
changelog.txt CHANGED
@@ -1,3 +1,7 @@
 
 
 
 
1
  = 1.1.21 =
2
  * Fixed: PHP 5.4 error and minor style issues
3
 
1
+ = 1.1.22 =
2
+ * Fixed: XSS vulnerabilities
3
+ * Changed: Capability required to edit themes
4
+
5
  = 1.1.21 =
6
  * Fixed: PHP 5.4 error and minor style issues
7
 
ecwd.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: Event Calendar WD
4
  * Plugin URI: https://web-dorado.com/products/wordpress-event-calendar-wd.html
5
  * Description: Event Calendar WD is an easy event management and planning tool with advanced features.
6
- * Version: 1.1.21
7
  * Author: WebDorado
8
  * Author URI: https://web-dorado.com/wordpress-plugins-bundle.html
9
  * Text Domain: event-calendar-wd
@@ -25,7 +25,7 @@ if (!defined('ECWD_URL')) {
25
  }
26
 
27
  if (!defined('ECWD_VERSION')) {
28
- define('ECWD_VERSION', "1.1.21");
29
  }
30
 
31
  if (!defined('ECWD_PLUGIN_MAIN_FILE')) {
3
  * Plugin Name: Event Calendar WD
4
  * Plugin URI: https://web-dorado.com/products/wordpress-event-calendar-wd.html
5
  * Description: Event Calendar WD is an easy event management and planning tool with advanced features.
6
+ * Version: 1.1.22
7
  * Author: WebDorado
8
  * Author URI: https://web-dorado.com/wordpress-plugins-bundle.html
9
  * Text Domain: event-calendar-wd
25
  }
26
 
27
  if (!defined('ECWD_VERSION')) {
28
+ define('ECWD_VERSION', "1.1.22");
29
  }
30
 
31
  if (!defined('ECWD_PLUGIN_MAIN_FILE')) {
includes/ecwd_class-rest-api.php CHANGED
@@ -196,7 +196,7 @@ class EcwdRestApi
196
  foreach ($events as $event){
197
  $event_data = array(
198
  'id' => $event->id,
199
- 'title' => $event->title,
200
  'from' => $event->get_start_date(),
201
  'end' => $event->get_end_date(),
202
  );
196
  foreach ($events as $event){
197
  $event_data = array(
198
  'id' => $event->id,
199
+ 'title' => esc_html($event->title),
200
  'from' => $event->get_start_date(),
201
  'end' => $event->get_end_date(),
202
  );
js/admin/admin.js CHANGED
@@ -1310,7 +1310,7 @@ $('body').on('click','.ecwd_add_events',function (e) {
1310
  ecwd_event_data.push({
1311
  event_id:event_id,
1312
  });
1313
- var ecwd_added_event = '<span class="ecwd-calendar-event"> <span>'+event_title+'</span>\n' +
1314
  ' <input type="hidden" name="ecwd-calendar-event-id[]" value="'+event_id+'">\n' +
1315
  ' <span class="ecwd-calendar-event-edit"><a href="post.php?post=21&amp;action=edit" target="_blank">e</a></span>\n' +
1316
  ' <span class="ecwd-calendar-event-delete">x</span>\n' +
@@ -1494,3 +1494,19 @@ function ecwd_ajax_delete_events(data) {
1494
  }
1495
 
1496
  }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1310
  ecwd_event_data.push({
1311
  event_id:event_id,
1312
  });
1313
+ var ecwd_added_event = '<span class="ecwd-calendar-event"> <span>'+ECWDescapeHtml(event_title)+'</span>\n' +
1314
  ' <input type="hidden" name="ecwd-calendar-event-id[]" value="'+event_id+'">\n' +
1315
  ' <span class="ecwd-calendar-event-edit"><a href="post.php?post=21&amp;action=edit" target="_blank">e</a></span>\n' +
1316
  ' <span class="ecwd-calendar-event-delete">x</span>\n' +
1494
  }
1495
 
1496
  }
1497
+
1498
+ function ECWDescapeHtml(str) {
1499
+ return str.replace(/[&<>"'\/]/g, function (s) {
1500
+ var entityMap = {
1501
+ "&": "&amp;",
1502
+ "<": "&lt;",
1503
+ ">": "&gt;",
1504
+ '"': '&quot;',
1505
+ "'": '&#39;',
1506
+ "/": '&#x2F;'
1507
+ };
1508
+
1509
+ return entityMap[s];
1510
+ });
1511
+ }
1512
+
readme.txt CHANGED
@@ -4,7 +4,7 @@ Tags: calendar, date, event, event calendar, events, events calendar, meeting, o
4
  Requires at least: 3.9
5
  Tested up to: 4.9
6
  Requires PHP: 5.2
7
- Stable tag: 1.1.21
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -347,6 +347,10 @@ Event Calendar WD plugin optionally embeds Google Maps on front end to display e
347
 
348
  == Changelog ==
349
 
 
 
 
 
350
  = 1.1.21 =
351
  * Fixed: PHP 5.4 error and minor style issues
352
 
4
  Requires at least: 3.9
5
  Tested up to: 4.9
6
  Requires PHP: 5.2
7
+ Stable tag: 1.1.22
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
347
 
348
  == Changelog ==
349
 
350
+ = 1.1.22 =
351
+ * Fixed: XSS vulnerabilities
352
+ * Changed: Capability required to edit themes
353
+
354
  = 1.1.21 =
355
  * Fixed: PHP 5.4 error and minor style issues
356
 
views/admin/ecwd-calendar-meta.php CHANGED
@@ -63,7 +63,7 @@ $ecwd_calendar_default_theme_color = (isset($ecwd_calendar_theme) && $ecwd_calen
63
  <div data-new_event_url="<?php echo get_admin_url() ?>post-new.php?post_type=ecwd_event&cal_id=<?php echo $post_id; ?>" class="ecwd-events">
64
  <?php if ($events) { ?>
65
  <?php foreach ($events as $event) { ?>
66
- <span class="ecwd-calendar-event"> <span><?php echo $event->post_title; ?></span>
67
  <input type="hidden" name="ecwd-calendar-event-id[]" value="<?php echo $event->ID; ?>"/>
68
  <span class="ecwd-calendar-event-edit"><a href="post.php?post=<?php echo $event->ID; ?>&action=edit" target="_blank">e</a></span>
69
  <span class="ecwd-calendar-event-delete">x</span>
63
  <div data-new_event_url="<?php echo get_admin_url() ?>post-new.php?post_type=ecwd_event&cal_id=<?php echo $post_id; ?>" class="ecwd-events">
64
  <?php if ($events) { ?>
65
  <?php foreach ($events as $event) { ?>
66
+ <span class="ecwd-calendar-event"> <span><?php echo esc_html($event->post_title); ?></span>
67
  <input type="hidden" name="ecwd-calendar-event-id[]" value="<?php echo $event->ID; ?>"/>
68
  <span class="ecwd-calendar-event-edit"><a href="post.php?post=<?php echo $event->ID; ?>&action=edit" target="_blank">e</a></span>
69
  <span class="ecwd-calendar-event-delete">x</span>
views/admin/ecwd-event-calendars-meta.php CHANGED
@@ -50,7 +50,7 @@ if ($pagenow == "post-new.php" && empty($event_calendars)) {
50
  <label for = "ecwd_event_calendar_<?php echo $calendar_post->ID; ?>" id = "ecwd_event_calendar_label_<?php echo $calendar_post->ID ?>">
51
  <input type = "checkbox" name = "ecwd_event_calendars[]" id = "ecwd_event_calendar_<?php echo $calendar_post->ID; ?>" value = "<?php echo $calendar_post->ID; ?>" <?php if(in_array($calendar_post->ID, $event_calendars)){echo 'checked="checked"';}
52
  ?> />
53
- <?php echo $calendar_post->post_title; ?>
54
  </label>
55
  </p>
56
 
50
  <label for = "ecwd_event_calendar_<?php echo $calendar_post->ID; ?>" id = "ecwd_event_calendar_label_<?php echo $calendar_post->ID ?>">
51
  <input type = "checkbox" name = "ecwd_event_calendars[]" id = "ecwd_event_calendar_<?php echo $calendar_post->ID; ?>" value = "<?php echo $calendar_post->ID; ?>" <?php if(in_array($calendar_post->ID, $event_calendars)){echo 'checked="checked"';}
52
  ?> />
53
+ <?php echo esc_html($calendar_post->post_title); ?>
54
  </label>
55
  </p>
56
 
views/admin/ecwd-event-meta.php CHANGED
@@ -24,14 +24,14 @@ if($single_event->get_is_default_dates() === false){
24
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_from"
25
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_from"
26
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date"
27
- value="<?php echo $start_date; ?>" autocomplete="off"/>
28
  <!-- <p class="description">
29
  </p>-->
30
  <?php _e('To', 'event-calendar-wd'); ?>
31
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_to"
32
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_to"
33
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date"
34
- value="<?php echo $end_date; ?>" autocomplete="off"/>
35
  <!-- <div id="-->
36
  <?php //echo ECWD_PLUGIN_PREFIX; ?><!--_event_pickup_date" class="button" value="">Days</div>-->
37
  <!-- <div id="-->
@@ -126,7 +126,7 @@ if($single_event->get_is_default_dates() === false){
126
  <div id="ecwd_daily" class="hidden">
127
  <label class="repeat_format"><?php _e('Repeat every', 'event-calendar-wd'); ?></label>
128
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how"
129
- value="<?php echo $single_event->repeat['ecwd_event_repeat_how']; ?>"/>
130
 
131
  <span id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how_label_daily"
132
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how_label hidden">
@@ -390,7 +390,7 @@ if($single_event->get_is_default_dates() === false){
390
  <label class="repeat_format"><?php _e('Repeat until', 'event-calendar-wd'); ?></label>
391
  <input id='<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_until_input' type="text"
392
  name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_repeat_until"
393
- value="<?php echo $single_event->repeat['ecwd_event_repeat_repeat_until']; ?>" autocomplete="off"/>
394
  </div>
395
  </p>
396
  </div>
@@ -419,7 +419,7 @@ if($single_event->get_is_default_dates() === false){
419
  <tr>
420
  <th scope="row"><?php _e('Event URL', 'event-calendar-wd'); ?></th>
421
  <td>
422
- <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_url" value="<?php echo $single_event->event_url; ?>"
423
  size="70">
424
 
425
  <p class="description">
@@ -431,7 +431,7 @@ if($single_event->get_is_default_dates() === false){
431
  <th scope="row"><?php _e('Event Video URL', 'event-calendar-wd'); ?></th>
432
  <td>
433
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_video"
434
- value="<?php echo $single_event->video_url; ?>" size="70">
435
 
436
  <p class="description">
437
  <?php _e('Provide Youtube or Vimeo URL of the video to accompany the event.', 'event-calendar-wd'); ?>
24
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_from"
25
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_from"
26
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date"
27
+ value="<?php echo esc_attr($start_date); ?>" autocomplete="off"/>
28
  <!-- <p class="description">
29
  </p>-->
30
  <?php _e('To', 'event-calendar-wd'); ?>
31
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_to"
32
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date_to"
33
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_date"
34
+ value="<?php echo esc_attr($end_date); ?>" autocomplete="off"/>
35
  <!-- <div id="-->
36
  <?php //echo ECWD_PLUGIN_PREFIX; ?><!--_event_pickup_date" class="button" value="">Days</div>-->
37
  <!-- <div id="-->
126
  <div id="ecwd_daily" class="hidden">
127
  <label class="repeat_format"><?php _e('Repeat every', 'event-calendar-wd'); ?></label>
128
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how"
129
+ value="<?php echo esc_attr($single_event->repeat['ecwd_event_repeat_how']); ?>"/>
130
 
131
  <span id="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how_label_daily"
132
  class="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_how_label hidden">
390
  <label class="repeat_format"><?php _e('Repeat until', 'event-calendar-wd'); ?></label>
391
  <input id='<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_until_input' type="text"
392
  name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_repeat_repeat_until"
393
+ value="<?php echo esc_attr($single_event->repeat['ecwd_event_repeat_repeat_until']); ?>" autocomplete="off"/>
394
  </div>
395
  </p>
396
  </div>
419
  <tr>
420
  <th scope="row"><?php _e('Event URL', 'event-calendar-wd'); ?></th>
421
  <td>
422
+ <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_url" value="<?php echo esc_attr($single_event->event_url); ?>"
423
  size="70">
424
 
425
  <p class="description">
431
  <th scope="row"><?php _e('Event Video URL', 'event-calendar-wd'); ?></th>
432
  <td>
433
  <input type="text" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_event_video"
434
+ value="<?php echo esc_attr($single_event->video_url); ?>" size="70">
435
 
436
  <p class="description">
437
  <?php _e('Provide Youtube or Vimeo URL of the video to accompany the event.', 'event-calendar-wd'); ?>
views/admin/ecwd-event-organizers-meta.php CHANGED
@@ -82,7 +82,7 @@ if (!$event_organizers || $event_organizers == '' || !is_array($event_organizers
82
  echo 'checked="checked"';
83
  }
84
  ?> />
85
- <?php echo $organizer_post->post_title; ?>
86
  </label>
87
  </p>
88
 
82
  echo 'checked="checked"';
83
  }
84
  ?> />
85
+ <?php echo esc_html($organizer_post->post_title); ?>
86
  </label>
87
  </p>
88
 
views/admin/ecwd-event-venues-meta.php CHANGED
@@ -44,7 +44,7 @@ if (!empty($venues)) {
44
  foreach ($venues as $venue) {
45
  $venues_meta_data[$venue->ID] = array();
46
 
47
- $venues_meta_data[$venue->ID]['post_title'] = $venue->post_title;
48
 
49
  foreach ($venue_meta_keys as $venue_meta_key) {
50
  $venues_meta_data[$venue->ID][$venue_meta_key] = get_post_meta($venue->ID, $venue_meta_key, true);
@@ -82,7 +82,7 @@ $map_table_class = "ecwd_event_venue_map_content";
82
  if (!empty($venues)) { ?>
83
  <?php foreach ($venues as $venue) { ?>
84
  <option value="<?php echo $venue->ID; ?>" <?php echo selected($venue->ID, $ecwd_event_venue); ?>>
85
- <?php echo $venue->post_title; ?>
86
  </option>
87
  <?php
88
  } ?>
@@ -98,19 +98,19 @@ $map_table_class = "ecwd_event_venue_map_content";
98
  <tr class="ecwd_venue_info_field">
99
  <th><?php _e('Address:', 'event-calendar-wd'); ?></th>
100
  <td class="ecwd_venue_address_info">
101
- <?php echo (isset($selected_venue_metadata['ecwd_venue_location'])) ? $selected_venue_metadata['ecwd_venue_location'] : ""; ?>
102
  </td>
103
  </tr>
104
  <tr class="ecwd_venue_info_field">
105
  <th><?php _e('Phone:', 'event-calendar-wd'); ?></th>
106
  <td class="ecwd_venue_phone_info">
107
- <?php echo (isset($selected_venue_metadata['ecwd_venue_meta_phone'])) ? $selected_venue_metadata['ecwd_venue_meta_phone'] : ""; ?>
108
  </td>
109
  </tr>
110
  <tr class="ecwd_venue_info_field">
111
  <th><?php _e('Website:', 'event-calendar-wd'); ?></th>
112
  <td class="ecwd_venue_website_info">
113
- <?php echo (isset($selected_venue_metadata['ecwd_venue_meta_website'])) ? $selected_venue_metadata['ecwd_venue_meta_website'] : ""; ?>
114
  </td>
115
  </tr>
116
  </tbody>
@@ -225,12 +225,12 @@ $map_table_class = "ecwd_event_venue_map_content";
225
  ?>
226
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
227
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
228
- value="<?php echo $ecwd_lat_long; ?>"/>
229
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker"
230
- id="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker" value="<?php echo $ecwd_marker; ?>"/>
231
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
232
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
233
- value="<?php echo $ecwd_map_zoom; ?>"/>
234
  <div id="map-canvas" style="width: 100%; height: 300px; min-height: 300px;"></div>
235
  <?php
236
  $latitude = $longitude = '';
@@ -249,10 +249,10 @@ $map_table_class = "ecwd_event_venue_map_content";
249
  ?>
250
  <div class="<?php echo $lat_long_container_class; ?>">
251
  <label style="width:85px;display:inline-block;" for="ecwd_latitude">Latitude:</label>
252
- <input type="text" id="ecwd_latitude" value="<?php echo $latitude; ?>"/>
253
  <br/>
254
  <label style="width:85px;display:inline-block;" for="ecwd_longitude">Longitude:</label>
255
- <input type="text" id="ecwd_longitude" value="<?php echo $longitude; ?>"/>
256
  </div>
257
  </div>
258
  </div>
44
  foreach ($venues as $venue) {
45
  $venues_meta_data[$venue->ID] = array();
46
 
47
+ $venues_meta_data[$venue->ID]['post_title'] = esc_html($venue->post_title);
48
 
49
  foreach ($venue_meta_keys as $venue_meta_key) {
50
  $venues_meta_data[$venue->ID][$venue_meta_key] = get_post_meta($venue->ID, $venue_meta_key, true);
82
  if (!empty($venues)) { ?>
83
  <?php foreach ($venues as $venue) { ?>
84
  <option value="<?php echo $venue->ID; ?>" <?php echo selected($venue->ID, $ecwd_event_venue); ?>>
85
+ <?php echo esc_html($venue->post_title); ?>
86
  </option>
87
  <?php
88
  } ?>
98
  <tr class="ecwd_venue_info_field">
99
  <th><?php _e('Address:', 'event-calendar-wd'); ?></th>
100
  <td class="ecwd_venue_address_info">
101
+ <?php echo (isset($selected_venue_metadata['ecwd_venue_location'])) ? esc_html($selected_venue_metadata['ecwd_venue_location']) : ""; ?>
102
  </td>
103
  </tr>
104
  <tr class="ecwd_venue_info_field">
105
  <th><?php _e('Phone:', 'event-calendar-wd'); ?></th>
106
  <td class="ecwd_venue_phone_info">
107
+ <?php echo (isset($selected_venue_metadata['ecwd_venue_meta_phone'])) ? esc_html($selected_venue_metadata['ecwd_venue_meta_phone']) : ""; ?>
108
  </td>
109
  </tr>
110
  <tr class="ecwd_venue_info_field">
111
  <th><?php _e('Website:', 'event-calendar-wd'); ?></th>
112
  <td class="ecwd_venue_website_info">
113
+ <?php echo (isset($selected_venue_metadata['ecwd_venue_meta_website'])) ? esc_html($selected_venue_metadata['ecwd_venue_meta_website']) : ""; ?>
114
  </td>
115
  </tr>
116
  </tbody>
225
  ?>
226
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
227
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
228
+ value="<?php echo esc_attr($ecwd_lat_long); ?>"/>
229
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker"
230
+ id="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker" value="<?php echo esc_attr($ecwd_marker); ?>"/>
231
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
232
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
233
+ value="<?php echo esc_attr($ecwd_map_zoom); ?>"/>
234
  <div id="map-canvas" style="width: 100%; height: 300px; min-height: 300px;"></div>
235
  <?php
236
  $latitude = $longitude = '';
249
  ?>
250
  <div class="<?php echo $lat_long_container_class; ?>">
251
  <label style="width:85px;display:inline-block;" for="ecwd_latitude">Latitude:</label>
252
+ <input type="text" id="ecwd_latitude" value="<?php echo esc_attr($latitude); ?>"/>
253
  <br/>
254
  <label style="width:85px;display:inline-block;" for="ecwd_longitude">Longitude:</label>
255
+ <input type="text" id="ecwd_longitude" value="<?php echo esc_attr($longitude); ?>"/>
256
  </div>
257
  </div>
258
  </div>
views/admin/ecwd-organizer-meta.php CHANGED
@@ -21,14 +21,14 @@ $ecwd_organizer_meta_website = get_post_meta($post->ID, 'ecwd_organizer_meta_web
21
  <div class="ecwd-meta-field">
22
  <label for="ecwd_organizer_meta_phone"><?php _e('Phone','event-calendar-wd')?>:</label>
23
  <input type="text" name="ecwd_organizer_meta_phone" id="ecwd_organizer_meta_phone"
24
- value="<?php echo $ecwd_organizer_meta_phone; ?>"/>
25
  </div>
26
  <!-- end ecwd_event_location -->
27
  <!-- start ecwd_venue_meta_phone -->
28
  <div class="ecwd-meta-field">
29
  <label for="ecwd_organizer_meta_website"><?php _e('Website','event-calendar-wd')?>:</label>
30
  <input type="text" name="ecwd_organizer_meta_website"
31
- id="ecwd_organizer_meta_website" value="<?php echo $ecwd_organizer_meta_website; ?>"/>
32
  </div>
33
  </div>
34
  </td>
21
  <div class="ecwd-meta-field">
22
  <label for="ecwd_organizer_meta_phone"><?php _e('Phone','event-calendar-wd')?>:</label>
23
  <input type="text" name="ecwd_organizer_meta_phone" id="ecwd_organizer_meta_phone"
24
+ value="<?php echo esc_attr($ecwd_organizer_meta_phone); ?>"/>
25
  </div>
26
  <!-- end ecwd_event_location -->
27
  <!-- start ecwd_venue_meta_phone -->
28
  <div class="ecwd-meta-field">
29
  <label for="ecwd_organizer_meta_website"><?php _e('Website','event-calendar-wd')?>:</label>
30
  <input type="text" name="ecwd_organizer_meta_website"
31
+ id="ecwd_organizer_meta_website" value="<?php echo esc_attr($ecwd_organizer_meta_website); ?>"/>
32
  </div>
33
  </div>
34
  </td>
views/admin/ecwd-venue-meta.php CHANGED
@@ -31,21 +31,21 @@ if (!$ecwd_map_zoom) {
31
  <div class="ecwd-meta-field">
32
  <label for="ecwd_event_location"><?php _e('Address','event-calendar-wd')?>:</label>
33
  <input type="text" name="ecwd_venue_location" id="ecwd_event_location"
34
- value="<?php echo $ecwd_venue_location; ?>" size="70"/>
35
  </div>
36
  <!-- end ecwd_event_location -->
37
  <!-- start ecwd_venue_meta_phone -->
38
  <div class="ecwd-meta-field">
39
  <label for="ecwd_venue_meta_phone"><?php _e('Phone','event-calendar-wd')?>:</label>
40
  <input type="text" name="ecwd_venue_meta_phone"
41
- id="ecwd_venue_meta_phone" value="<?php echo $ecwd_venue_meta_phone; ?>"/>
42
  </div>
43
  <!-- end ecwd_venue_meta_phone -->
44
  <!-- start ecwd_venue_meta_website -->
45
  <div class="ecwd-meta-field">
46
  <label for="ecwd_venue_meta_website"><?php _e('Website','event-calendar-wd')?>:</label>
47
  <input type="text" name="ecwd_venue_meta_website"
48
- id="ecwd_venue_meta_website" value="<?php echo $ecwd_venue_meta_website; ?>"/>
49
  </div>
50
  <!-- end ecwd_venue_meta_website -->
51
  <div class="ecwd-meta-field">
@@ -76,12 +76,12 @@ if (!$ecwd_map_zoom) {
76
  } ?>
77
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_venue_lat_long"
78
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
79
- value="<?php echo $ecwd_venue_lat_long; ?>"/>
80
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker"
81
- id="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker" value="<?php echo $ecwd_marker; ?>"/>
82
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
83
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
84
- value="<?php echo $ecwd_map_zoom; ?>"/>
85
 
86
  <div id="map-canvas" style="width: 100%; height: 300px; min-height: 300px;">
87
 
@@ -97,10 +97,10 @@ if (!$ecwd_map_zoom) {
97
  }
98
  ?>
99
  <label style="width:85px" for="<?php echo ECWD_PLUGIN_PREFIX; ?>_latitude">Latitude:</label>
100
- <input type="text" id="<?php echo ECWD_PLUGIN_PREFIX; ?>_latitude" value="<?php echo $latitude; ?>"/>
101
  <br/>
102
  <label style="width:85px" for="<?php echo ECWD_PLUGIN_PREFIX; ?>_longitude">Longitude:</label>
103
- <input type="text" id="<?php echo ECWD_PLUGIN_PREFIX; ?>_longitude" value="<?php echo $longitude; ?>"/>
104
  </div>
105
  </div>
106
  <p class="<?php echo $description_class; ?>">
31
  <div class="ecwd-meta-field">
32
  <label for="ecwd_event_location"><?php _e('Address','event-calendar-wd')?>:</label>
33
  <input type="text" name="ecwd_venue_location" id="ecwd_event_location"
34
+ value="<?php echo esc_attr($ecwd_venue_location); ?>" size="70"/>
35
  </div>
36
  <!-- end ecwd_event_location -->
37
  <!-- start ecwd_venue_meta_phone -->
38
  <div class="ecwd-meta-field">
39
  <label for="ecwd_venue_meta_phone"><?php _e('Phone','event-calendar-wd')?>:</label>
40
  <input type="text" name="ecwd_venue_meta_phone"
41
+ id="ecwd_venue_meta_phone" value="<?php echo esc_attr($ecwd_venue_meta_phone); ?>"/>
42
  </div>
43
  <!-- end ecwd_venue_meta_phone -->
44
  <!-- start ecwd_venue_meta_website -->
45
  <div class="ecwd-meta-field">
46
  <label for="ecwd_venue_meta_website"><?php _e('Website','event-calendar-wd')?>:</label>
47
  <input type="text" name="ecwd_venue_meta_website"
48
+ id="ecwd_venue_meta_website" value="<?php echo esc_attr($ecwd_venue_meta_website); ?>"/>
49
  </div>
50
  <!-- end ecwd_venue_meta_website -->
51
  <div class="ecwd-meta-field">
76
  } ?>
77
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_venue_lat_long"
78
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_lat_long"
79
+ value="<?php echo esc_attr($ecwd_venue_lat_long); ?>"/>
80
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker"
81
+ id="<?php echo ECWD_PLUGIN_PREFIX; ?>_marker" value="<?php echo esc_attr($ecwd_marker); ?>"/>
82
  <input type="hidden" name="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
83
  id="<?php echo ECWD_PLUGIN_PREFIX; ?>_map_zoom"
84
+ value="<?php echo esc_attr($ecwd_map_zoom); ?>"/>
85
 
86
  <div id="map-canvas" style="width: 100%; height: 300px; min-height: 300px;">
87
 
97
  }
98
  ?>
99
  <label style="width:85px" for="<?php echo ECWD_PLUGIN_PREFIX; ?>_latitude">Latitude:</label>
100
+ <input type="text" id="<?php echo ECWD_PLUGIN_PREFIX; ?>_latitude" value="<?php echo esc_attr($latitude); ?>"/>
101
  <br/>
102
  <label style="width:85px" for="<?php echo ECWD_PLUGIN_PREFIX; ?>_longitude">Longitude:</label>
103
+ <input type="text" id="<?php echo ECWD_PLUGIN_PREFIX; ?>_longitude" value="<?php echo esc_attr($longitude); ?>"/>
104
  </div>
105
  </div>
106
  <p class="<?php echo $description_class; ?>">
views/ecwd-event-content.php CHANGED
@@ -238,8 +238,8 @@ if (!empty($calendars_id)) {
238
  if (!empty($organizer_website)) { ?>
239
  <div class="ecwd_organizer_website">
240
  <span><?php _e('Website', 'event-calendar-wd'); ?>:</span>
241
- <a href="<?php echo $organizer_website; ?>">
242
- <?php echo $organizer_website; ?>
243
  </a>
244
  </div>
245
  <?php }
238
  if (!empty($organizer_website)) { ?>
239
  <div class="ecwd_organizer_website">
240
  <span><?php _e('Website', 'event-calendar-wd'); ?>:</span>
241
+ <a href="<?php echo esc_url($organizer_website); ?>">
242
+ <?php echo esc_html($organizer_website); ?>
243
  </a>
244
  </div>
245
  <?php }
views/ecwd-event-popup.php CHANGED
@@ -229,8 +229,8 @@ $event_categories = wp_get_post_terms($post->ID, 'ecwd_event_category', $args);
229
  if (!empty($organizer_website)) { ?>
230
  <div class="ecwd_organizer_website">
231
  <span><?php _e('Website', 'event-calendar-wd'); ?>:</span>
232
- <a href="<?php echo $organizer_website; ?>">
233
- <?php echo $organizer_website; ?>
234
  </a>
235
  </div>
236
  <?php }
229
  if (!empty($organizer_website)) { ?>
230
  <div class="ecwd_organizer_website">
231
  <span><?php _e('Website', 'event-calendar-wd'); ?>:</span>
232
+ <a href="<?php echo esc_url($organizer_website); ?>">
233
+ <?php echo esc_html($organizer_website); ?>
234
  </a>
235
  </div>
236
  <?php }
views/ecwd-organizer-content.php CHANGED
@@ -108,7 +108,7 @@ if (!empty($organizer_website)) {
108
  }
109
 
110
  if (!empty($organizer_website_html)) {
111
- echo sprintf($organizer_website_html, "ecwd_organizer_website", $organizer_website, $organizer_website);
112
  }
113
 
114
  echo '<div class="ecwd_organizer_description">' . wpautop($post->post_content) . '</div>';
108
  }
109
 
110
  if (!empty($organizer_website_html)) {
111
+ echo sprintf($organizer_website_html, "ecwd_organizer_website", esc_url($organizer_website), $organizer_website);
112
  }
113
 
114
  echo '<div class="ecwd_organizer_description">' . wpautop($post->post_content) . '</div>';