'+f(_.i18n_bulk_add_amount)+''+f(_.i18n_bulk_add_unit)+''+f(_.i18n_bulk_add_name)+"
");for(var o=0;o'+f(_.i18n_bulk_add_amount)+''+f(_.i18n_bulk_add_unit)+''+f(_.i18n_bulk_add_name)+"
");for(var o=0;o- ",e.data.errors.forEach(function(e){o+="
- "+e+" "}),o+="
"+(e.data.message||cooked_migration_js_vars.i18n_import_failed)+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),r.removeClass("cooked-active"),a.removeClass("cooked-active"))},"json").fail(function(){s.html(""+cooked_migration_js_vars.i18n_failed_process_csv+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),r.removeClass("cooked-active"),a.removeClass("cooked-active")})):(s.html(""+(e.data.message||cooked_migration_js_vars.i18n_file_upload_failed)+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),r.removeClass("cooked-active"),a.removeClass("cooked-active"))},error:function(){s.html(""+cooked_migration_js_vars.i18n_failed_upload_csv+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),r.removeClass("cooked-active"),a.removeClass("cooked-active")}})):s.html(""+cooked_migration_js_vars.i18n_csv_invalid_file+"
").show():s.html(""+cooked_migration_js_vars.i18n_csv_no_file+"
").show()})})})(jQuery);{function cookedDecimalAdjust(e,o,i){return void 0===i||0==+i?Math[e](o):(i=+i,null===(o=+o)||isNaN(o)||"number"!=typeof i||i%1!=0?NaN:o<0?-cookedDecimalAdjust(e,-o,i):(o=o.toString().split("e"),+((o=(o=Math[e](+(o[0]+"e"+(o[1]?+o[1]-i:-i)))).toString().split("e"))[0]+"e"+(o[1]?+o[1]+i:i))))}}Math.round10||(Math.round10=function(e,o){return cookedDecimalAdjust("round",e,o)});var cooked_recipe_migrate_counter=0,progressIterations=0;function cooked_migrate_recipes(e,r){var a,d,c,o,n=0;0- ",o.data.errors.forEach(function(o){e+="
- "+o+" "}),e+="
"+(o.data.message||cooked_migration_js_vars.i18n_import_failed)+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),s.removeClass("cooked-active"),a.removeClass("cooked-active"))},"json").fail(function(){r.html(""+cooked_migration_js_vars.i18n_failed_process_csv+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),s.removeClass("cooked-active"),a.removeClass("cooked-active")})):(r.html(""+(o.data.message||cooked_migration_js_vars.i18n_file_upload_failed)+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),s.removeClass("cooked-active"),a.removeClass("cooked-active"))},error:function(){r.html(""+cooked_migration_js_vars.i18n_failed_upload_csv+"
").show(),i.removeClass("disabled").attr("disabled",!1),t.attr("disabled",!1),s.removeClass("cooked-active"),a.removeClass("cooked-active")}})):r.html(""+cooked_migration_js_vars.i18n_csv_invalid_file+"
").show():r.html(""+cooked_migration_js_vars.i18n_csv_no_file+"
").show()})})})(jQuery);{function cookedDecimalAdjust(o,e,i){return void 0===i||0==+i?Math[o](e):(i=+i,null===(e=+e)||isNaN(e)||"number"!=typeof i||i%1!=0?NaN:e<0?-cookedDecimalAdjust(o,-e,i):(e=e.toString().split("e"),+((e=(e=Math[o](+(e[0]+"e"+(e[1]?+e[1]-i:-i)))).toString().split("e"))[0]+"e"+(e[1]?+e[1]+i:i))))}}Math.round10||(Math.round10=function(o,e){return cookedDecimalAdjust("round",o,e)});var cooked_recipe_migrate_counter=0,progressIterations=0;function cooked_migrate_recipes(o,s){var a,c,n,e,d=0;0' . __('Ingredients','cooked') . '
[cooked-ingredients checkboxes=false]' . __('Directions','cooked') . '
[cooked-directions numbers=false]' ); - $seo_content = do_shortcode( $seo_content ); + $seo_content = apply_filters( 'cooked_seo_recipe_content', '[cooked-excerpt]' . __( 'Ingredients', 'cooked' ) . '
[cooked-ingredients checkboxes=false]' . __( 'Directions', 'cooked' ) . '
[cooked-directions numbers=false]' ); + $seo_content = do_shortcode( $seo_content ); - wp_update_post([ - 'ID' => $rid, - 'post_excerpt' => $recipe_excerpt, - 'post_content' => $seo_content - ]); - - } - } - - if ( !empty( $leftover_recipe_ids ) ) { - echo wp_json_encode( $leftover_recipe_ids ); - wp_die(); + wp_update_post( [ + 'ID' => $rid, + 'post_excerpt' => $recipe_excerpt, + 'post_content' => $seo_content, + ] ); } - } - set_transient( 'cooked_classic_recipes', 'complete', 60 * 60 * 24 * 7 ); - echo 'false'; - wp_die(); - + if ( ! empty( $leftover_recipe_ids ) ) { + echo wp_json_encode( $leftover_recipe_ids ); + wp_die(); + } } + set_transient( 'cooked_classic_recipes', 'complete', 60 * 60 * 24 * 7 ); + echo 'false'; wp_die(); } public function import_recipes() { - if (!current_user_can('edit_cooked_recipes')) { - wp_die(); - } + self::require_settings_ajax( 'cooked_import_recipes' ); require_once COOKED_DIR . 'includes/class.cooked-delicious-recipes.php'; require_once COOKED_DIR . 'includes/class.cooked-recipe-maker.php'; $bulk_amount = 10; + $recipe_ids = self::recipe_ids_from_json( isset( $_POST['recipe_ids'] ) ? wp_unslash( $_POST['recipe_ids'] ) : '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- JSON decoded then absint in recipe_ids_from_json. + $import_type = isset( $_POST['import_type'] ) ? sanitize_key( wp_unslash( $_POST['import_type'] ) ) : ''; + $import_type = self::sanitize_import_type( $import_type ); - if ( isset($_POST['recipe_ids']) ) { - // Sanitize Recipe IDs - $recipe_ids = json_decode( $_POST['recipe_ids'], true ); - - if ( is_array( $recipe_ids ) && !empty( $recipe_ids ) ) { - $_recipe_ids = []; - foreach ( $recipe_ids as $_rid ) { - $safe_id = intval( $_rid ); - if ( $safe_id ) { - $_recipe_ids[] = $_rid; - } - } - $recipe_ids = $_recipe_ids; - } else { - return false; - } - - $leftover_recipe_ids = array_slice( $recipe_ids, $bulk_amount ); - $recipe_ids = array_slice( $recipe_ids, 0, $bulk_amount ); + if ( empty( $recipe_ids ) || ! $import_type ) { + wp_die(); + } - $import_type = $_POST['import_type']; + $expected_type = $import_type === 'delicious_recipes' ? 'recipe' : 'wprm_recipe'; + $leftover_recipe_ids = array_slice( $recipe_ids, $bulk_amount ); + $recipe_ids = array_slice( $recipe_ids, 0, $bulk_amount ); - if ( !empty($recipe_ids) ) { - foreach ( $recipe_ids as $rid ) { - if ($import_type === 'delicious_recipes') { - Cooked_Delicious_Recipes::import_recipe( $rid ); - } elseif ($import_type === 'wp_recipe_maker') { - Cooked_Recipe_Maker_Recipes::import_recipe( $rid ); - } + if ( ! empty( $recipe_ids ) ) { + foreach ( $recipe_ids as $rid ) { + if ( ! self::user_can_edit_post_of_type( $rid, $expected_type ) ) { + continue; } - if ( !empty( $leftover_recipe_ids ) ) { - echo wp_json_encode( $leftover_recipe_ids ); - wp_die(); - } else { - if ($import_type === 'delicious_recipes') { - update_option( 'cooked_delicious_recipes_imported', true ); - } elseif ($import_type === 'wp_recipe_maker') { - update_option( 'cooked_wp_recipe_maker_imported', true ); - } + if ( $import_type === 'delicious_recipes' ) { + Cooked_Delicious_Recipes::import_recipe( $rid ); + } elseif ( $import_type === 'wp_recipe_maker' ) { + Cooked_Recipe_Maker_Recipes::import_recipe( $rid ); } } - echo 'false'; - wp_die(); + if ( ! empty( $leftover_recipe_ids ) ) { + echo wp_json_encode( $leftover_recipe_ids ); + wp_die(); + } + + if ( $import_type === 'delicious_recipes' ) { + update_option( 'cooked_delicious_recipes_imported', true ); + } elseif ( $import_type === 'wp_recipe_maker' ) { + update_option( 'cooked_wp_recipe_maker_imported', true ); + } } + echo 'false'; wp_die(); } public function get_recipe_ids() { - if (!wp_verify_nonce($_POST['nonce'], 'cooked_save_default_bulk') || !current_user_can('edit_cooked_default_template')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_save_default_bulk' ) || ! current_user_can( 'edit_cooked_default_template' ) ) { wp_die(); } @@ -290,7 +293,8 @@ public function get_recipe_ids() { } public function get_recipe_count() { - if (!wp_verify_nonce($_POST['nonce'], 'cooked_save_default_bulk') || !current_user_can('edit_cooked_default_template')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_save_default_bulk' ) || ! current_user_can( 'edit_cooked_default_template' ) ) { wp_die(); } @@ -308,16 +312,17 @@ public function get_recipe_count() { public function save_default_bulk() { $per_page = 20; - if (!wp_verify_nonce($_POST['nonce'], 'cooked_save_default_bulk') || !current_user_can('edit_cooked_default_template')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_save_default_bulk' ) || ! current_user_can( 'edit_cooked_default_template' ) ) { wp_die(); } - if (!isset($_POST['default_content'])) { + if ( ! isset( $_POST['default_content'] ) ) { wp_send_json_error( [ 'message' => __( 'No default content provided.', 'cooked' ) ] ); } - $page = isset($_POST['page']) ? absint($_POST['page']) : 0; - $content = wp_kses_post($_POST['default_content']); + $page = isset( $_POST['page'] ) ? absint( wp_unslash( $_POST['page'] ) ) : 0; + $content = wp_kses_post( wp_unslash( $_POST['default_content'] ) ); $args = [ 'post_type' => 'cp_recipe', @@ -354,15 +359,16 @@ public function save_default_bulk() { public function save_default() { global $_cooked_settings; - if (!wp_verify_nonce($_POST['nonce'], 'cooked_save_default') || !current_user_can('edit_cooked_default_template')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_save_default' ) || ! current_user_can( 'edit_cooked_default_template' ) ) { wp_die(); } - if (isset($_POST['default_content'])) { - $_cooked_settings['default_content'] = wp_kses_post( $_POST['default_content'] ); + if ( isset( $_POST['default_content'] ) ) { + $_cooked_settings['default_content'] = wp_kses_post( wp_unslash( $_POST['default_content'] ) ); update_option('cooked_settings', $_cooked_settings); } else { - echo __( 'No default content provided.', 'cooked' ); + echo esc_html__( 'No default content provided.', 'cooked' ); } wp_die(); @@ -390,16 +396,23 @@ public function load_default() { * Handle CSV file upload */ public function upload_csv() { - if (!current_user_can('edit_cooked_recipes')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_admin_import' ) || ! current_user_can( 'edit_cooked_settings' ) ) { wp_send_json_error(['message' => __('You do not have permission to import recipes.', 'cooked')]); } - if (!isset($_FILES['csv_file']) || $_FILES['csv_file']['error'] !== UPLOAD_ERR_OK) { + if ( ! isset( $_FILES['csv_file'] ) || ! isset( $_FILES['csv_file']['error'] ) || UPLOAD_ERR_OK !== (int) $_FILES['csv_file']['error'] ) { wp_send_json_error(['message' => __('File upload failed.', 'cooked')]); } + $csv_name = isset( $_FILES['csv_file']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['csv_file']['name'] ) ) : ''; + if ( ! $csv_name ) { + wp_send_json_error(['message' => __('File upload failed.', 'cooked')]); + } + $_FILES['csv_file']['name'] = $csv_name; + // Validate file type - $file_type = wp_check_filetype($_FILES['csv_file']['name']); + $file_type = wp_check_filetype( $csv_name ); if ($file_type['ext'] !== 'csv') { wp_send_json_error(['message' => __('Invalid file type. Please upload a CSV file.', 'cooked')]); } @@ -426,11 +439,12 @@ public function upload_csv() { * Process CSV file and import recipes */ public function process_csv() { - if (!current_user_can('edit_cooked_recipes')) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_admin_import' ) || ! current_user_can( 'edit_cooked_settings' ) ) { wp_send_json_error(['message' => __('You do not have permission to import recipes.', 'cooked')]); } - $transient_key = isset($_POST['transient_key']) ? sanitize_text_field($_POST['transient_key']) : ''; + $transient_key = isset( $_POST['transient_key'] ) ? sanitize_text_field( wp_unslash( $_POST['transient_key'] ) ) : ''; $file_path = get_transient($transient_key); if (!$file_path || !file_exists($file_path)) { @@ -443,13 +457,14 @@ public function process_csv() { // Clean up if (file_exists($file_path)) { - @unlink($file_path); + wp_delete_file($file_path); } delete_transient($transient_key); if ($results['success'] > 0) { wp_send_json_success([ 'message' => sprintf( + /* translators: %d: number of recipes imported */ __('Successfully imported %d recipe(s).', 'cooked'), $results['success'] ), @@ -466,11 +481,12 @@ public function process_csv() { } public function parse_bulk_ingredients() { - if ( ! check_ajax_referer( 'cooked_bulk_add', 'nonce', false ) ) { + $nonce = isset( $_POST['nonce'] ) ? wp_unslash( $_POST['nonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verify nonce after unslash; do not sanitize_text_field a nonce. + if ( ! wp_verify_nonce( $nonce, 'cooked_bulk_add' ) ) { wp_send_json_error( [ 'message' => __( 'Security check failed.', 'cooked' ) ] ); } - $lines = isset( $_POST['lines'] ) ? (array) $_POST['lines'] : []; + $lines = isset( $_POST['lines'] ) ? wp_unslash( (array) $_POST['lines'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Each line is sanitize_text_field'd below. if ( empty( $lines ) ) { wp_send_json_error( [ 'message' => __( 'No ingredients provided.', 'cooked' ) ] ); @@ -505,7 +521,6 @@ public function parse_bulk_ingredients() { // Do not use Cooked_Functions::sanitize_text_field() here — it runs htmlentities() and turns // Unicode like en dash or ½ into – / ½, which breaks parsing and leaks into output. $line = is_string( $line ) ? $line : ''; - $line = wp_unslash( $line ); $line = html_entity_decode( $line, ENT_QUOTES | ENT_HTML5, 'UTF-8' ); $line = trim( sanitize_text_field( $line ) ); diff --git a/includes/class.cooked-allergens.php b/includes/class.cooked-allergens.php index e02cc01..f59bc44 100644 --- a/includes/class.cooked-allergens.php +++ b/includes/class.cooked-allergens.php @@ -271,7 +271,7 @@ public static function render_from_recipe( $recipe ) { } $recipe_settings = Cooked_Recipes::get_settings( $recipe['id'] ); - echo self::render( $recipe_settings ); + echo wp_kses_post( self::render( $recipe_settings ) ); } /** @@ -361,8 +361,8 @@ public static function cooked_info_allergens( $recipe_settings ) { } echo ''; - echo '' . __( 'Allergens', 'cooked' ) . ''; - echo $html; + echo '' . esc_html__( 'Allergens', 'cooked' ) . ''; + echo wp_kses_post( $html ); echo ''; } diff --git a/includes/class.cooked-csv-import.php b/includes/class.cooked-csv-import.php index 31adb38..ee3c25d 100644 --- a/includes/class.cooked-csv-import.php +++ b/includes/class.cooked-csv-import.php @@ -46,7 +46,7 @@ public static function import_from_file( $file_path ) { /** * Open and parse CSV file */ - $handle = fopen( $file_path, 'r' ); + $handle = fopen( $file_path, 'r' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- CSV row streaming. if ( false === $handle ) { $results['errors'][] = __( 'Could not open CSV file.', 'cooked' ); return $results; @@ -58,7 +58,7 @@ public static function import_from_file( $file_path ) { $headers = fgetcsv( $handle ); if ( false === $headers || empty( $headers ) ) { $results['errors'][] = __( 'CSV file is empty or invalid.', 'cooked' ); - fclose( $handle ); + fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- CSV row streaming. return $results; } @@ -73,7 +73,7 @@ public static function import_from_file( $file_path ) { */ if ( ! in_array( 'title', $headers ) ) { $results['errors'][] = __( 'CSV file must contain a "title" column.', 'cooked' ); - fclose( $handle ); + fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- CSV row streaming. return $results; } @@ -120,6 +120,7 @@ public static function import_from_file( $file_path ) { } } catch ( Exception $e ) { $error_msg = $e->getMessage(); + /* translators: 1: CSV row number, 2: error message */ $results['errors'][] = sprintf( __( 'Row %1$d: %2$s', 'cooked' ), $row_number, $error_msg ); if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) { @@ -131,7 +132,7 @@ public static function import_from_file( $file_path ) { } } - fclose( $handle ); + fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- CSV row streaming. return $results; } diff --git a/includes/class.cooked-enqueues.php b/includes/class.cooked-enqueues.php index 8cb4671..2f9d67e 100644 --- a/includes/class.cooked-enqueues.php +++ b/includes/class.cooked-enqueues.php @@ -62,22 +62,23 @@ public function enqueues($hook) { wp_enqueue_style('cooked-icons', COOKED_URL . 'assets/css/icons' . $min . '.css', [], COOKED_VERSION); wp_enqueue_style('cooked-styling', COOKED_URL . 'assets/css/style' . $min . '.css', [], COOKED_VERSION ); wp_register_style('cooked-fotorama', COOKED_URL . 'assets/css/fotorama/fotorama.min.css', [], '4.6.4'); - wp_register_script('cooked-fotorama', COOKED_URL . 'assets/js/fotorama/fotorama' . $min . '.js', ['jquery'], '4.6.4'); - wp_register_script('cooked-timer', COOKED_URL . 'assets/js/timer/jquery.simple.timer' . $min . '.js', ['jquery'], '0.0.5'); - wp_register_script('cooked-nosleep', COOKED_URL . 'assets/js/nosleep/NoSleep' . $min . '.js', [], '0.12.0'); + wp_register_script('cooked-fotorama', COOKED_URL . 'assets/js/fotorama/fotorama' . $min . '.js', ['jquery'], '4.6.4', true); + wp_register_script('cooked-timer', COOKED_URL . 'assets/js/timer/jquery.simple.timer' . $min . '.js', ['jquery'], '0.0.5', true); + wp_register_script('cooked-nosleep', COOKED_URL . 'assets/js/nosleep/NoSleep' . $min . '.js', [], '0.12.0', true); // Compatibility with the Bridge Theme. if (!defined('QODE_ROOT')) { - wp_register_script('cooked-appear', COOKED_URL . 'assets/js/appear/jquery.appear' . $min . '.js', ['jquery'], '0.3.6'); + wp_register_script('cooked-appear', COOKED_URL . 'assets/js/appear/jquery.appear' . $min . '.js', ['jquery'], '0.3.6', true); } wp_enqueue_script('wp-sanitize'); - wp_register_script('cooked-functions', COOKED_URL . 'assets/js/cooked-functions' . $min . '.js', ['jquery', 'wp-sanitize'], COOKED_VERSION); + wp_register_script('cooked-functions', COOKED_URL . 'assets/js/cooked-functions' . $min . '.js', ['jquery', 'wp-sanitize'], COOKED_VERSION, true); wp_localize_script('cooked-functions', 'cooked_functions_i18n_js_vars', $cooked_i18n_js_vars); wp_add_inline_script( 'cooked-functions', 'const cooked_functions_js_vars = ' . json_encode( $cooked_js_vars ) . ';', 'before' ); } public function css_colors() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only print view flag. if (!isset($_GET['print'])) { $file = COOKED_DIR . 'assets/css/colors.php'; $css = self::get_dynamic_css($file); @@ -86,6 +87,7 @@ public function css_colors() { } public function css_responsive() { + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only print view flag. if (!isset($_GET['print'])) { $file = COOKED_DIR . 'assets/css/responsive.php'; $css = self::get_dynamic_css($file); diff --git a/includes/class.cooked-functions.php b/includes/class.cooked-functions.php index 5b61300..c4ae09e 100644 --- a/includes/class.cooked-functions.php +++ b/includes/class.cooked-functions.php @@ -124,17 +124,17 @@ public static function print_options() { echo '';
- echo '';
- echo '
';
}
diff --git a/includes/class.cooked-import.php b/includes/class.cooked-import.php
index 11d1cd8..33e64b7 100644
--- a/includes/class.cooked-import.php
+++ b/includes/class.cooked-import.php
@@ -25,8 +25,12 @@ public function __construct() {
}
public static function init() {
- register_setting( 'cooked_import_group', 'cooked_import' );
- register_setting( 'cooked_import_group', 'cooked_import_saved' );
+ register_setting( 'cooked_import_group', 'cooked_import', ['sanitize_callback' => [__CLASS__, 'sanitize_saved_flag']] );
+ register_setting( 'cooked_import_group', 'cooked_import_saved', ['sanitize_callback' => [__CLASS__, 'sanitize_saved_flag']] );
+ }
+
+ public static function sanitize_saved_flag( $value ) {
+ return rest_sanitize_boolean( $value );
}
public static function tabs_fields() {
@@ -203,35 +207,35 @@ public static function field_import_button( $name, $field_options, $color, $fiel
if ($total > 0) {
echo '' . __( 'Print Options:','cooked') . '
'; - - echo ' '; - echo ' '; - echo ' '; - echo ' '; - echo ' '; - echo ' '; - echo ' '; - echo ' '; + echo ''; + echo '' . esc_html__( 'Print Options:','cooked') . '
'; + + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; echo ''; - echo ''; + echo ''; echo '
'; echo ''; echo '0 / ' . esc_html( $total ) . ''; echo '
'; - echo 'Import Complete! You can now ' . __( 'reload', 'cooked' ) . ' the import screen.
'; + echo 'Import Complete! You can now ' . esc_html__( 'reload', 'cooked' ) . ' the import screen.
'; } } public static function field_message( $name, $field_options, $color, $field ) { - echo '' . $field['message'] . '
'; + echo '' . wp_kses_post( $field['message'] ) . '
'; } public static function field_csv_upload( $name, $field_options, $color, $field ) { - echo '' . __( 'Download sample CSV files:', 'cooked' ) . ' '; - echo '' . __( 'Small (1 recipe)', 'cooked' ) . ', '; - echo '' . __( 'Medium (3 recipes)', 'cooked' ) . ', '; - echo '' . __( 'Large (10 recipes)', 'cooked' ) . '
'; + echo '' . esc_html__( 'Download sample CSV files:', 'cooked' ) . ' '; + echo '' . esc_html__( 'Small (1 recipe)', 'cooked' ) . ', '; + echo '' . esc_html__( 'Medium (3 recipes)', 'cooked' ) . ', '; + echo '' . esc_html__( 'Large (10 recipes)', 'cooked' ) . '
'; echo ''; } diff --git a/includes/class.cooked-measurements.php b/includes/class.cooked-measurements.php index ce70d19..06ea0ed 100644 --- a/includes/class.cooked-measurements.php +++ b/includes/class.cooked-measurements.php @@ -211,6 +211,10 @@ public static function nutrition_facts() { // Use the "cooked_nutrition_facts" filter to add your own nutrition facts. // Reference: https://www.fda.gov/food/nutrition-facts-label/daily-value-nutrition-and-supplement-facts-labels + $unit_g = __( 'g', 'cooked' ); + $unit_mg = __( 'mg', 'cooked' ); + $unit_mcg = __( 'mcg', 'cooked' ); + $nutrition_facts = apply_filters('cooked_nutrition_facts', [ 'top' => [ 'servings' => [ @@ -234,67 +238,67 @@ public static function nutrition_facts() { 'fat' => [ 'name' => __('Total Fat', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, 'pdv' => apply_filters('cooked_pdv_fat', 78), 'subs' => [ 'sat_fat' => [ 'name' => __('Saturated Fat', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, 'pdv' => apply_filters('cooked_pdv_satfat', 20) ], 'trans_fat' => [ 'name' => __('Trans Fat', 'cooked'), 'nutrition_info_name' => __('Trans Fat', 'cooked'), 'type' => 'number', - 'measurement' => 'g' + 'measurement' => $unit_g ], 'monounsaturated_fat' => [ 'name' => __('Monounsaturated Fat', 'cooked'), 'type' => 'number', - 'measurement' => 'g' + 'measurement' => $unit_g ], 'polyunsaturated_fat' => [ 'name' => __('Polyunsaturated Fat', 'cooked'), 'type' => 'number', - 'measurement' => 'g' + 'measurement' => $unit_g ] ] ], 'cholesterol' => [ 'name' => __('Cholesterol', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_cholesterol', 300) ], 'sodium' => [ 'name' => __('Sodium', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_sodium', 2300) ], 'carbs' => [ 'name' => (isset($_cooked_settings['carb_format']) && $_cooked_settings['carb_format'] == 'total' ? __('Total Carbohydrate', 'cooked') : __('Net Carbohydrate', 'cooked')), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, 'pdv' => apply_filters('cooked_pdv_carbs', 275), 'subs' => [ 'fiber' => [ 'name' => __('Dietary Fiber', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, 'pdv' => apply_filters('cooked_pdv_fiber', 28) ], 'sugars' => [ 'name' => __('Total Sugars', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, //'pdv' => apply_filters('cooked_pdv_sugars', 28) ], 'added_sugars' => [ 'name' => __('Added Sugars', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, 'pdv' => apply_filters('cooked_pdv_added_sugars', 50) ] ] @@ -302,7 +306,7 @@ public static function nutrition_facts() { 'protein' => [ 'name' => __('Protein', 'cooked'), 'type' => 'number', - 'measurement' => 'g', + 'measurement' => $unit_g, //'pdv' => apply_filters('cooked_pdv_protein', 50) ] ], @@ -311,165 +315,162 @@ public static function nutrition_facts() { 'vitamin_a' => [ 'name' => __('Vitamin A', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_vitamin_a', 900) ], 'vitamin_c' => [ 'name' => __('Vitamin C', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_vitamin_c', 90) ], 'calcium' => [ 'name' => __('Calcium', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_calcium', 1300) ], 'iron' => [ 'name' => __('Iron', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_iron', 18) ], 'potassium' => [ 'name' => __('Potassium', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_potassium', 4700) ], 'vitamin_d' => [ 'name' => __('Vitamin D', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_vitamin_d', 20) ], 'vitamin_e' => [ 'name' => __('Vitamin E', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_vitamin_e', 15) ], 'vitamin_k' => [ 'name' => __('Vitamin K', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_vitamin_k', 120) ], 'thiamin' => [ 'name' => __('Thiamin', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_thiamin', 1.2) ], 'riboflavin' => [ 'name' => __('Riboflavin', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_riboflavin', 1.3) ], 'niacin' => [ 'name' => __('Niacin', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_niacin', 16) ], 'vitamin_b6' => [ 'name' => __('Vitamin B6', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_vitamin_b6', 1.7) ], 'folate' => [ 'name' => __('Folate', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_folate', 400) ], 'vitamin_b12' => [ 'name' => __('Vitamin B12', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_vitamin_b12', 2.4) ], 'biotin' => [ 'name' => __('Biotin', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_biotin', 30) ], 'pantothenic_acid' => [ 'name' => __('Pantothenic Acid', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_pantothenic_acid', 5) ], 'phosphorus' => [ 'name' => __('Phosphorus', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_phosphorus', 1250) ], 'iodine' => [ 'name' => __('Iodine', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_iodine', 150) ], 'magnesium' => [ 'name' => __('Magnesium', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_magnesium', 420) ], 'zinc' => [ 'name' => __('Zinc', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_zinc', 11) ], 'selenium' => [ 'name' => __('Selenium', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_selenium', 55) ], 'copper' => [ 'name' => __('Copper', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_copper', 0.9) ], 'manganese' => [ 'name' => __('Manganese', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_manganese', 2.3) ], 'chromium' => [ 'name' => __('Chromium', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_chromium', 35) ], 'molybdenum' => [ 'name' => __('Molybdenum', 'cooked'), 'type' => 'number', - 'measurement' => 'mcg', + 'measurement' => $unit_mcg, 'pdv' => apply_filters('cooked_pdv_molybdenum', 45) ], 'chloride' => [ 'name' => __('Chloride', 'cooked'), 'type' => 'number', - 'measurement' => 'mg', + 'measurement' => $unit_mg, 'pdv' => apply_filters('cooked_pdv_chloride', 2300) ] ] ]); - // Ensures "mcg" is in the translation catalog (g and mg are cataloged via get()). - __( 'mcg', 'cooked' ); - return $nutrition_facts; } @@ -718,7 +719,7 @@ public static function time_format( $minutes, $format = 'default' ) { return 'PT0H'.intval( $minutes ).'M'; else: /* translators: singular and plural number of minutes (shorthand) */ - echo self::singular_plural( sprintf( __( '%d min','cooked' ), number_format_i18n($minutes) ), sprintf( __( '%d mins','cooked' ), number_format_i18n($minutes) ), $minutes ); + echo esc_html( self::singular_plural( sprintf( esc_html__( '%d min','cooked' ), number_format_i18n($minutes) ), sprintf( esc_html__( '%d mins','cooked' ), number_format_i18n($minutes) ), $minutes ) ); endif; elseif ( $minutes < 1440 ): $hours = floor( $minutes / 60 ); @@ -727,9 +728,9 @@ public static function time_format( $minutes, $format = 'default' ) { return 'PT'.intval( $hours ).'H'.( $minutes_left ? intval( $minutes_left ) : 0 ).'M'; else: /* translators: singular and plural number of hours (shorthand) */ - echo self::singular_plural( sprintf( __( '%d hr','cooked' ), number_format_i18n($hours) ), sprintf( __( '%d hrs','cooked' ), number_format_i18n($hours) ), $hours ); + echo esc_html( self::singular_plural( sprintf( esc_html__( '%d hr','cooked' ), number_format_i18n($hours) ), sprintf( esc_html__( '%d hrs','cooked' ), number_format_i18n($hours) ), $hours ) ); /* translators: singular and plural number of minutes (shorthand) */ - echo ( $minutes_left ? ' ' . self::singular_plural( sprintf( __( '%d min','cooked' ), number_format_i18n($minutes_left) ), sprintf( __( '%d mins','cooked' ), number_format_i18n($minutes_left) ), $minutes_left ) : '' ); + echo ( $minutes_left ? ' ' . esc_html( self::singular_plural( sprintf( esc_html__( '%d min','cooked' ), number_format_i18n($minutes_left) ), sprintf( esc_html__( '%d mins','cooked' ), number_format_i18n($minutes_left) ), $minutes_left ) ) : '' ); endif; else: $days = floor( $minutes / 24 / 60 ); @@ -743,11 +744,11 @@ public static function time_format( $minutes, $format = 'default' ) { return 'P'.intval( $days ).'DT'.( $hours_left ? intval( $hours_left ) : 0 ).'H'.( $minutes_left ? intval( $minutes_left ) : 0 ).'M'; else: /* translators: singular and plural number of days */ - echo self::singular_plural( sprintf( __( '%d day','cooked' ), number_format_i18n($days) ), sprintf( __( '%d days','cooked' ), number_format_i18n($days) ), $days ); + echo esc_html( self::singular_plural( sprintf( esc_html__( '%d day','cooked' ), number_format_i18n($days) ), sprintf( esc_html__( '%d days','cooked' ), number_format_i18n($days) ), $days ) ); /* translators: singular and plural number of hours (shorthand) */ - echo ( $hours_left ? ' ' . self::singular_plural( sprintf( __( '%d hr','cooked' ), number_format_i18n($hours_left) ), sprintf( __( '%d hrs','cooked' ), number_format_i18n($hours_left) ), $hours_left ) : '' ); + echo ( $hours_left ? ' ' . esc_html( self::singular_plural( sprintf( esc_html__( '%d hr','cooked' ), number_format_i18n($hours_left) ), sprintf( esc_html__( '%d hrs','cooked' ), number_format_i18n($hours_left) ), $hours_left ) ) : '' ); /* translators: singular and plural number of minutes (shorthand) */ - echo ( $minutes_left ? ' ' . self::singular_plural( sprintf( __( '%d min','cooked' ), number_format_i18n($minutes_left) ), sprintf( __( '%d mins','cooked' ), number_format_i18n($minutes_left) ), $minutes_left ) : '' ); + echo ( $minutes_left ? ' ' . esc_html( self::singular_plural( sprintf( esc_html__( '%d min','cooked' ), number_format_i18n($minutes_left) ), sprintf( esc_html__( '%d mins','cooked' ), number_format_i18n($minutes_left) ), $minutes_left ) ) : '' ); endif; endif; diff --git a/includes/class.cooked-migration.php b/includes/class.cooked-migration.php index 3b49039..502de4d 100644 --- a/includes/class.cooked-migration.php +++ b/includes/class.cooked-migration.php @@ -87,8 +87,8 @@ public static function old_recipes_message() { if ($total > 0) { $class = 'notice notice-error'; /* translators: for displaying singular or plural versions depending on the number of recipes. */ - $message = sprintf( esc_html( _n( 'There is %1$s recipe that is from an older version of Cooked. Please %2$s to migrate this recipe.', 'There are %1$s recipes that are from an older version of Cooked. Please %2$s to migrate these recipes.', $total, 'cooked' ) ), '' . number_format( $total ) . '', '' . __( 'click here', 'cooked' ) . '' ); - printf('%2$s
%2$s
%2$s
%2$s
%s
' . esc_html( $shortcode ) . ''
+ )
)
);
}
@@ -255,19 +268,19 @@ public static function bulk_add_modal() {
×
-
+
@@ -285,8 +298,8 @@ function cooked_recipe_shortcodes_content() {
- - + +
-
-
+
+
@@ -307,14 +320,14 @@ function cooked_recipe_shortcodes_content() {
@@ -324,14 +337,14 @@ function cooked_recipe_shortcodes_content() {
@@ -341,14 +354,14 @@ function cooked_recipe_shortcodes_content() {
@@ -358,17 +371,17 @@ function cooked_recipe_shortcodes_content() {
"style"
- +"width"
- +"hide_excerpt"
- +"hide_author"
- +"hide_image"
- +"hide_title"
- +
-
-
+
@@ -504,8 +517,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- id ()
- width ()
- style ()
- hide_image ()
- hide_title ()
- hide_excerpt ()
- hide_author ()
+ id ()
+ width ()
+ style ()
+ hide_image ()
+ hide_title ()
+ hide_excerpt ()
+ hide_author ()
+
[cooked-recipe-card id="" width="300px" style="modern"]
-
+
-
-
+
+
@@ -519,7 +532,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
' . __( 'Default Recipe Template','cooked') . '' . __( 'Choose from the options below to use this layout as the default for new recipes or for all recipes.', 'cooked') . '0 / 0' ); ?>" class="button cooked-layout-save-default">
+' . esc_html__( 'Default Recipe Template','cooked') . '' . esc_html__( 'Choose from the options below to use this layout as the default for new recipes or for all recipes.', 'cooked') . '0 / 0' ); ?>" class="button cooked-layout-save-default">
@@ -537,7 +550,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
@@ -560,8 +573,8 @@ function cooked_render_recipe_fields( $post_id ) {
-
@@ -571,7 +584,7 @@ function cooked_render_recipe_fields( $post_id ) {
- +
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
@@ -852,11 +865,11 @@ function cooked_render_recipe_fields( $post_id ) {
+
-
-
-
+
+
+
@@ -663,7 +676,7 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -696,11 +709,11 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
@@ -672,7 +685,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
@@ -685,7 +698,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
-
+
-
+
@@ -791,10 +804,10 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -822,7 +835,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
@@ -831,7 +844,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
@@ -844,7 +857,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
-
+
-
+
-
+
@@ -936,11 +949,11 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
-
+
@@ -975,34 +988,34 @@ function cooked_render_recipe_fields( $post_id ) {
1
@@ -1015,10 +1028,10 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1027,7 +1040,7 @@ function cooked_render_recipe_fields( $post_id ) {
true,
'media_buttons' => false,
'wpautop' => false,
'editor_height' => 250,
- 'textarea_name' => '_recipe_settings[directions][' . $random_key . '][content]',
+ 'textarea_name' => '_recipe_settings[directions][' . esc_attr( $random_key ) . '][content]',
'quicktags' => true
]);
?>
-
+
-
+
@@ -1047,11 +1060,11 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
-
+
@@ -1082,7 +1095,7 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1215,7 +1228,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
-
+
@@ -1120,7 +1133,7 @@ function cooked_render_recipe_fields( $post_id ) {
-
+
- +
- $nf ): @@ -1148,14 +1161,14 @@ function cooked_render_recipe_fields( $post_id ) { endforeach; ?> -
- +
- $nf ): echo '
- ';
- echo '' . esc_html($nf['name']) . ' ___' . ( isset($nf['measurement']) ? '' . esc_html__( $nf['measurement'], 'cooked' ) . '' : '' );
+ echo '' . esc_html($nf['name']) . ' ___' . ( isset($nf['measurement']) ? '' . esc_html( $nf['measurement'] ) . '' : '' );
echo ( isset( $nf['pdv'] ) ? '0%' : '' );
if ( isset($nf['subs']) ):
@@ -1163,16 +1176,16 @@ function cooked_render_recipe_fields( $post_id ) {
echo '
- ';
if ($sub_slug === 'trans_fat'):
echo '
- '; - echo $sub_nf['nutrition_info_name'] . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ); + echo wp_kses_post( $sub_nf['nutrition_info_name'] ) . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ); echo ' '; elseif ($sub_slug === 'added_sugars'): echo '
- '; - echo __('Includes', 'cooked') . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ) . ' ' . esc_html($sub_nf['name']); + echo esc_html__('Includes', 'cooked') . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ) . ' ' . esc_html($sub_nf['name']); echo ( isset( $sub_nf['pdv'] ) ? '0%' : '' ); echo '
- '; - echo $sub_nf['name'] . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ); + echo esc_html( $sub_nf['name'] ) . ' ___' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ); echo ( isset( $sub_nf['pdv'] ) ? '0%' : '' ); echo ' '; endif; @@ -1189,7 +1202,7 @@ function cooked_render_recipe_fields( $post_id ) { $nf ): echo '
- '; - echo $nf['name'] . ' ___' . ( isset($nf['measurement']) ? '' . esc_html__( $nf['measurement'], 'cooked' ) . '' : '' ); + echo esc_html( $nf['name'] ) . ' ___' . ( isset($nf['measurement']) ? '' . esc_html( $nf['measurement'] ) . '' : '' ); echo ( isset( $nf['pdv'] ) ? '0%' : '' ); echo ' '; endforeach; ?> @@ -1199,14 +1212,14 @@ function cooked_render_recipe_fields( $post_id ) {
*
+*
-
-
-
+
@@ -1282,8 +1295,8 @@ function cooked_render_recipe_fields( $post_id ) {
-
-
+
+
@@ -1292,9 +1305,9 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1302,8 +1315,8 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1313,7 +1326,7 @@ function cooked_render_recipe_fields( $post_id ) {
- +
- + echo sprintf( esc_html__( '"%1$s" and "%2$s"','cooked' ), 'left','right' ); ?> +
-
+
__('Difficulty', 'cooked'), 'servings' => __('Servings Switcher', 'cooked'), 'taxonomies' => __('Category', 'cooked'), - 'print' => __('Print Mode', 'cooked'), + 'print' => esc_html__('Print Mode', 'cooked'), 'fullscreen' => __('Full-Screen Mode', 'cooked') ]); @@ -1344,14 +1357,14 @@ function cooked_render_recipe_fields( $post_id ) {
-
-
+
+
@@ -1359,10 +1372,10 @@ function cooked_render_recipe_fields( $post_id ) {
"checkboxes"
- +
-
@@ -1375,14 +1388,14 @@ function cooked_render_recipe_fields( $post_id ) {
+
- true ()
- false ()
+ true ()
+ false ()
-
-
+
+
@@ -1390,10 +1403,10 @@ function cooked_render_recipe_fields( $post_id ) {
"numbers"
- +
-
@@ -1406,8 +1419,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- true ()
- false ()
+ true ()
+ false ()
-
-
+
+
@@ -1415,9 +1428,9 @@ function cooked_render_recipe_fields( $post_id ) {
-
@@ -1430,8 +1443,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- +
-
-
+
+
@@ -1439,9 +1452,9 @@ function cooked_render_recipe_fields( $post_id ) {
-
@@ -1456,8 +1469,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- +
-
-
+
+
@@ -1465,14 +1478,14 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1482,14 +1495,14 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1499,27 +1512,27 @@ function cooked_render_recipe_fields( $post_id ) {
"width"
- +"ratio"
- +"nav"
- +"allowfullscreen"
- +
-
@@ -1535,8 +1548,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
width
ratio
nav
allowfullscreen
-
-
+
+
@@ -1544,9 +1557,9 @@ function cooked_render_recipe_fields( $post_id ) {
-
@@ -1559,14 +1572,14 @@ function cooked_render_recipe_fields( $post_id ) {
+
- +
-
-
+
+
@@ -1574,10 +1587,10 @@ function cooked_render_recipe_fields( $post_id ) {
"show_header"
- +
-
@@ -1590,8 +1603,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- true ()
- false ()
+ true ()
+ false ()
-
-
+
+
@@ -1619,12 +1632,12 @@ function cooked_render_recipe_fields( $post_id ) {
' />
@@ -1600,16 +1613,16 @@ function cooked_render_recipe_fields( $post_id ) {
- +
"desc"
- +
-
@@ -1637,19 +1650,19 @@ function cooked_render_recipe_fields( $post_id ) {
+
- seconds ()
- minutes ()
- hours ()
- desc ()
+ seconds ()
+ minutes ()
+ hours ()
+ desc ()
-
-
+
+
-
+
-
@@ -1662,8 +1675,8 @@ function cooked_render_recipe_fields( $post_id ) {
+
- +
-
-
+
+
@@ -1671,14 +1684,14 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1688,14 +1701,14 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1705,14 +1718,14 @@ function cooked_render_recipe_fields( $post_id ) {
@@ -1722,38 +1735,38 @@ function cooked_render_recipe_fields( $post_id ) {
-
"id"
- +"title"
- +"limit"
- +"columns"
- +"hide_image"
- +"hide_excerpt"
- +"hide_author"
- +"match_*"
- +- +
+
-
+
- id ()
- title ()
- limit ()
- columns ()
- hide_image ()
- hide_excerpt ()
- hide_author ()
- match_* ()
+ id ()
+ title ()
+ limit ()
+ columns ()
+ hide_image ()
+ hide_excerpt ()
+ hide_author ()
+ match_* ()
+
[cooked-related-recipes limit="4" columns="2" title="Related Recipes"]
';
- echo has_post_thumbnail($rid) && !$hide_image ? '' : '';
+ echo has_post_thumbnail($rid) && !$hide_image ? '' : '';
echo '
';
@@ -295,7 +297,7 @@ public static function recipe_list( $orderby = 'date', $show = 5, $recipes = fal
echo '';
endif;
@@ -329,7 +331,7 @@ public static function card( $rid, $width = false, $hide_image = false, $hide_ti
do_action( 'cooked_recipe_grid_before_image', $recipe );
- echo has_post_thumbnail($rid) && !$hide_image ? '' : '';
+ echo has_post_thumbnail($rid) && !$hide_image ? '' : '';
//do_action( 'cooked_recipe_grid_after_image', $recipe );
@@ -349,7 +351,7 @@ public static function card( $rid, $width = false, $hide_image = false, $hide_ti
echo '';
endif;
@@ -373,6 +375,7 @@ public static function card( $rid, $width = false, $hide_image = false, $hide_ti
}
public function print_recipe_template() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only print view flag.
if ( is_singular('cp_recipe') && isset($_GET['print']) ):
load_template( COOKED_DIR . 'templates/front/recipe-print.php', false);
exit;
@@ -437,7 +440,8 @@ public function filter_recipes_by_taxonomy() {
foreach ( $taxonomies as $taxonomy ):
if ( is_array($cooked_taxonomies_shown) && !in_array( $taxonomy, $cooked_taxonomies_shown ) || !is_array($cooked_taxonomies_shown) ):
$cooked_taxonomies_shown[] = $taxonomy;
- $selected = isset($_GET[$taxonomy]) ? sanitize_title($_GET[$taxonomy]) : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only admin taxonomy filter.
+ $selected = isset( $_GET[ $taxonomy ] ) ? absint( wp_unslash( $_GET[ $taxonomy ] ) ) : '';
$info_taxonomy = get_taxonomy($taxonomy);
$taxonomy_label = $info_taxonomy->label;
@@ -918,7 +922,6 @@ public static function gallery_types() {
endforeach;
- wp_reset_query();
wp_reset_postdata();
return $gallery_types;
@@ -927,6 +930,7 @@ public static function gallery_types() {
public static function measurement_system_switcher() {
global $_cooked_settings, $post;
$switcher_enabled = ( isset( $_cooked_settings['advanced'] ) && in_array( 'enable_measurement_switcher', $_cooked_settings['advanced'] ) ? true : false );
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only print view flag.
$printing = ( is_singular('cp_recipe') && isset($_GET['print']) );
if ( !$printing && $switcher_enabled ):
@@ -938,13 +942,13 @@ public static function measurement_system_switcher() {
];
$current_label = isset( $labels[ $current ] ) ? $labels[ $current ] : $labels[''];
echo '';
- echo '' . __( 'Units', 'cooked' ) . '';
+ echo '' . esc_html__( 'Units', 'cooked' ) . '';
echo '' . esc_html( $current_label ) . '';
- echo '';
+ echo '';
echo '';
echo '';
endif;
@@ -953,6 +957,7 @@ public static function measurement_system_switcher() {
public static function serving_size_switcher( $servings ) {
global $_cooked_settings, $post;
$switcher_disabled = ( isset( $_cooked_settings['advanced'] ) && in_array( 'disable_servings_switcher', $_cooked_settings['advanced'] ) ? true : false );
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only print view flag.
$printing = ( is_singular('cp_recipe') && isset($_GET['print']) );
if ( !$printing && !$switcher_disabled ):
@@ -993,22 +998,22 @@ public static function serving_size_switcher( $servings ) {
endif;
echo '';
- echo '' . __('Yields','cooked') . '';
+ echo '' . esc_html__('Yields','cooked') . '';
if ( !$printing && !$switcher_disabled ):
/* translators: singular and plural "serving" sizes */
$servings_string = sprintf( esc_html( _n( '%s Serving', '%s Servings', $servings, 'cooked' ) ), $servings );
- echo '' . $servings_string . '';
- echo '';
+ echo '' . esc_html( $servings_string ) . '';
+ echo '';
echo '';
else:
/* translators: singular and plural "serving" sizes */
- echo '' . sprintf( esc_html( _n( '%s Serving', '%s Servings', $servings, 'cooked' ) ), $servings ) . '';
+ echo '' . esc_html( sprintf( _n( '%s Serving', '%s Servings', $servings, 'cooked' ), $servings ) ) . '';
endif;
echo '';
@@ -1035,7 +1040,7 @@ public static function single_ingredient( $ing, $checkboxes = true, $plain_text
? ($ing['section_heading_element'] === 'div' ? $default_element : $ing['section_heading_element'])
: $default_element;
- echo '<' . $element . ' class="cooked-single-ingredient cooked-heading">' . esc_html($ing['section_heading_name']) . '';
+ echo '<' . tag_escape( $element ) . ' class="cooked-single-ingredient cooked-heading">' . esc_html($ing['section_heading_name']) . '';
}
} elseif ( isset($ing['name']) && $ing['name'] ) {
@@ -1154,7 +1159,7 @@ public static function single_ingredient( $ing, $checkboxes = true, $plain_text
if ( $sub_name ) {
echo '';
- echo ' ' . __('or', 'cooked') . ' ';
+ echo ' ' . esc_html__('or', 'cooked') . ' ';
echo ( $sub_amount ? '' . wp_kses_post($sub_amount) . ' ' . wp_kses_post( $sub_measurement ) . ' ' : '' );
echo '' . wp_kses_post( $sub_name ) . '';
echo '';
@@ -1164,7 +1169,7 @@ public static function single_ingredient( $ing, $checkboxes = true, $plain_text
}
$ing_html = ob_get_clean();
- echo apply_filters( 'cooked_single_ingredient_html', $ing_html, $ing, $checkboxes, $plain_text );
+ echo wp_kses_post( apply_filters( 'cooked_single_ingredient_html', $ing_html, $ing, $checkboxes, $plain_text ) );
}
public static function single_direction($dir, $number = false, $plain_text = false, $step = false, $atts = false) {
@@ -1183,7 +1188,7 @@ public static function single_direction($dir, $number = false, $plain_text = fal
? ($dir['section_heading_element'] === 'div' ? $default_element : $dir['section_heading_element'])
: $default_element;
- echo '<' . $element . ' class="cooked-single-direction cooked-heading">' . esc_html($dir['section_heading_name']) . '';
+ echo '<' . tag_escape( $element ) . ' class="cooked-single-direction cooked-heading">' . esc_html($dir['section_heading_name']) . '';
}
} elseif ( !empty($dir['content']) || !empty($dir['image']) || !empty($dir['video']) ) {
@@ -1201,9 +1206,9 @@ public static function single_direction($dir, $number = false, $plain_text = fal
/* translators: singular and plural "steps" */
$step_string = sprintf( __( 'Step %d', 'cooked' ), $step );
- echo '
';
+ echo '
';
echo $number ? '' . esc_html($number) . '' : '';
- echo '
';
}
}
@@ -1259,7 +1264,7 @@ public static function recipe_search_box( $options = false ) {
echo '' . do_shortcode($content) . ($image ? wpautop($image) : '') . ($video ? '' : '') . '
';
+ echo '' . do_shortcode($content) . ($image ? wp_kses_post( wpautop($image) ) : '') . ($video ? '' : '') . '
';
echo '';
echo '';
- echo '' . ( isset($active_taxonomy) ? esc_html( $active_taxonomy ) : __('Browse','cooked') ) . '';
+ echo '' . ( isset($active_taxonomy) ? esc_html( $active_taxonomy ) : esc_html__('Browse','cooked') ) . '';
echo '';
endif;
@@ -1280,15 +1285,15 @@ public static function recipe_search_box( $options = false ) {
$terms_array = Cooked_Settings::terms_array( 'cp_recipe_category', false, __('No categories','cooked'), true, true, false );
if ( !empty($terms_array) ):
echo '';
- echo '' . __('Categories','cooked') . '';
+ echo '' . esc_html__('Categories','cooked') . '';
echo '';
- echo '' . $nf['name'] . ' ' . esc_html( $nutrition_facts[$slug] ) . '' . ( isset($nf['measurement']) ? '' . esc_html__( $nf['measurement'], 'cooked' ) . '' : '' );
- echo ( isset( $nf['pdv'] ) && $nutrition_facts[$slug] ? '' . ceil( ( esc_html( $nutrition_facts[$slug] ) / $nf['pdv'] ) * 100 ) . '%' : '' );
+ echo '' . esc_html( $nf['name'] ) . ' ' . esc_html( $nutrition_facts[$slug] ) . '' . ( isset($nf['measurement']) ? '' . esc_html( $nf['measurement'] ) . '' : '' );
+ echo ( isset( $nf['pdv'] ) && $nutrition_facts[$slug] ? '' . esc_html( ceil( ( $nutrition_facts[$slug] / $nf['pdv'] ) * 100 ) ) . '%' : '' );
if ( isset($nf['subs']) ):
foreach( $nf['subs'] as $sub_slug => $sub_nf ):
@@ -1026,17 +1030,17 @@ public function cooked_nutrition_shortcode($atts, $content = null) {
echo ' ';
- echo '' . esc_html($nf['name']) . ' ' . esc_html( $nutrition_facts[$slug] ) . '' . ( isset($nf['measurement']) ? '' . esc_html__( $nf['measurement'], 'cooked' ) . '' : '' );
- echo ( isset( $nf['pdv'] ) ? '' . ceil( ( esc_html( $nutrition_facts[$slug] ) / $nf['pdv'] ) * 100 ) . '%' : '' );
+ echo '' . esc_html($nf['name']) . ' ' . esc_html( $nutrition_facts[$slug] ) . '' . ( isset($nf['measurement']) ? '' . esc_html( $nf['measurement'] ) . '' : '' );
+ echo ( isset( $nf['pdv'] ) ? '' . esc_html( ceil( ( $nutrition_facts[$slug] / $nf['pdv'] ) * 100 ) ) . '%' : '' );
echo ' ';
endif;
endforeach;
@@ -1088,7 +1092,7 @@ public function cooked_nutrition_shortcode($atts, $content = null) {
echo '
'; echo '
';
- echo ( $view_all_recipes_url ? '' . __( 'All Categories','cooked' ) . '' : '' );
+ echo ( $view_all_recipes_url ? '' . esc_html__( 'All Categories','cooked' ) . '' : '' );
foreach ( $terms_array as $key => $val ):
if ( $key ):
$term = get_term( $key );
$term_link = ( !empty($term) ? get_term_link( $term ) : false );
$term_name = apply_filters( 'cooked_term_name', $term->name, $term->ID, $term->taxonomy );
- echo ( $term_link ? ( isset($active_taxonomy) && $active_taxonomy == $val ? ' ' : '' ) . '' . esc_html($term_name) . '' . ( isset($active_taxonomy) && $active_taxonomy == $val ? '' : '' ) : '' );
+ echo ( $term_link ? ( isset($active_taxonomy) && $active_taxonomy == $val ? ' ' : '' ) . '' . wp_kses_post($term_name) . '' . ( isset($active_taxonomy) && $active_taxonomy == $val ? '' : '' ) : '' );
$total_taxonomies++;
$sub_terms_array = Cooked_Settings::terms_array( 'cp_recipe_category', false, false, true, false, $key );
if ( !empty($sub_terms_array) ):
@@ -1297,7 +1302,7 @@ public static function recipe_search_box( $options = false ) {
$sub_term = get_term( $sub_key );
$sub_term_link = ( !empty($sub_term) ? get_term_link( $sub_term ) : false );
$sub_term_name = apply_filters( 'cooked_term_name', $sub_term->name, $sub_term->ID, $sub_term->taxonomy );
- echo ( $sub_term_link ? '' . ( isset($active_taxonomy) && $active_taxonomy == $sub_val ? ' ' : '' ) . '' . esc_html($sub_term_name) . '' . ( isset($active_taxonomy) && $active_taxonomy == $sub_val ? '' : '' ) . '' : '' );
+ echo ( $sub_term_link ? '' . ( isset($active_taxonomy) && $active_taxonomy == $sub_val ? ' ' : '' ) . '' . wp_kses_post($sub_term_name) . '' . ( isset($active_taxonomy) && $active_taxonomy == $sub_val ? '' : '' ) . '' : '' );
$total_taxonomies++;
endif;
endforeach;
@@ -1351,11 +1356,11 @@ public static function recipe_search_box( $options = false ) {
echo '', esc_attr( $class ), $message );
+ printf( '', esc_attr( $class ), wp_kses_post( $message ) );
}
}
@@ -232,7 +244,7 @@ public static function prefix_dark_mode_css( $selectors ) {
}
if ( '' === $scope ) {
- return $selectors;
+ return wp_kses( $selectors, [] );
}
$parts = array_map( 'trim', explode( ',', $selectors ) );
@@ -243,15 +255,15 @@ function ( $part ) use ( $scope ) {
$parts
);
- return implode( ', ', $parts );
+ return wp_kses( implode( ', ', $parts ), [] );
}
public static function tabs_fields() {
$pages_array = self::pages_array( __('Choose a page...','cooked'), __('No pages','cooked') );
$categories_array = self::terms_array( 'cp_recipe_category', __('No default', 'cooked'), __('No categories', 'cooked') );
$recipes_per_page_array = self::per_page_array();
- $recipe_archive_slug = sanitize_title_with_dashes( __( 'Recipe Archive', 'cooked' ) );
- $recipe_archive_url = home_url( '/' . $recipe_archive_slug . '/' );
+ $recipe_archive_slug = sanitize_title_with_dashes( __( 'Recipe Archive', 'cooked' ) );
+ $recipe_archive_url = home_url( '/' . $recipe_archive_slug . '/' );
// Dynamically load roles.
$role_options = [];
@@ -284,7 +296,7 @@ public static function tabs_fields() {
'recipes_per_page' => [
'title' => __('Recipes Per Page', 'cooked'),
/* translators: a description on how to choose the default number of recipes per page. */
- 'desc' => sprintf(__('Choose the default (set via the %s panel) or choose a different number here.', 'cooked'), '' . __('Settings > Reading', 'cooked') . ''),
+ 'desc' => sprintf(__('Choose the default (set via the %s panel) or choose a different number here.', 'cooked'), '' . __('Settings > Reading', 'cooked') . ''),
'type' => 'select',
'default' => 9,
'options' => $recipes_per_page_array
@@ -335,7 +347,7 @@ public static function tabs_fields() {
],
'print_view_display_options' => [
'title' => __('Print View', 'cooked'),
- 'desc' => __('When enabled, the website logo will appear at the top of the recipe print screen.', 'cooked'),
+ 'desc' => esc_html__('When enabled, the website logo will appear at the top of the recipe print screen.', 'cooked'),
'type' => 'checkboxes',
'default' => [],
'options' => apply_filters(
@@ -672,8 +684,8 @@ public static function field_radio( $field_name, $options ) {
$combined_extras = $is_disabled . $conditional_value;
- if ( $conditional_requirement ): echo ''; endif;
- echo ''; endif;
+ echo '
'; if ( $conditional_requirement ): echo ' '; endif;
@@ -693,7 +705,7 @@ public static function field_select( $field_name, $options, $color = false, $fie
}
echo '
';
@@ -1017,8 +1021,8 @@ public function cooked_nutrition_shortcode($atts, $content = null) {
if ( isset( $nutrition_facts[$slug] ) && $nutrition_facts[$slug] || isset( $nutrition_facts[$slug] ) && $nutrition_facts[$slug] === '0' ):
echo '';
- echo !$options['hide_browse'] && $taxonomy_search_fields ? $taxonomy_search_fields : '';
+ echo !$options['hide_browse'] && $taxonomy_search_fields ? wp_kses_post( $taxonomy_search_fields ) : '';
- echo '';
+ echo '';
- echo '';
+ echo '';
echo '
';
diff --git a/includes/class.cooked-seo.php b/includes/class.cooked-seo.php
index 5c8d4f3..613048e 100644
--- a/includes/class.cooked-seo.php
+++ b/includes/class.cooked-seo.php
@@ -80,6 +80,7 @@ public static function schema_values( $recipe = false ) {
$directions[] = [
'@type' => 'HowToStep',
+ /* translators: %d: step number */
'name' => sprintf(__('Step %d', 'cooked'), $number),
'text' => $direction_cleaned,
'url' => get_permalink($rpost) . '#cooked-single-direction-step-' . $number,
@@ -107,14 +108,14 @@ public static function schema_values( $recipe = false ) {
$unsaturatedFatAmount = (isset($recipe['nutrition']['monounsaturated_fat']) && $recipe['nutrition']['monounsaturated_fat'] ? $recipe['nutrition']['monounsaturated_fat'] : 0) + (isset($recipe['nutrition']['polyunsaturated_fat']) && $recipe['nutrition']['polyunsaturated_fat'] ? $recipe['nutrition']['polyunsaturated_fat'] : 0);
if ($unsaturatedFatAmount):
- $unsaturatedFatContent = $unsaturatedFatAmount . ' ' . __( $_nutrition_facts['main']['fat']['subs']['monounsaturated_fat']['measurement'], 'cooked' );
+ $unsaturatedFatContent = $unsaturatedFatAmount . ' ' . $_nutrition_facts['main']['fat']['subs']['monounsaturated_fat']['measurement'];
else:
$unsaturatedFatContent = '';
endif;
$description = '';
if (!empty($recipe['seo_description'])):
- $description = wp_strip_all_tags( preg_replace("~(?:\[/?)[^/\]]+/?\]~s", '', $recipe['seo_description']) ); ;
+ $description = wp_strip_all_tags( preg_replace("~(?:\[/?)[^/\]]+/?\]~s", '', wp_specialchars_decode( $recipe['seo_description'], ENT_QUOTES ) ) );
elseif (!empty($recipe['excerpt'])):
$description = wp_strip_all_tags( preg_replace("~(?:\[/?)[^/\]]+/?\]~s", '', $recipe['excerpt']) );
elseif (!empty($recipe['title'])):
@@ -147,16 +148,16 @@ public static function schema_values( $recipe = false ) {
'nutrition' => [
'@type' => 'NutritionInformation',
'calories' => (isset($recipe['nutrition']['calories']) && $recipe['nutrition']['calories'] ? $recipe['nutrition']['calories'] . ' ' . strtolower($_nutrition_facts['mid']['calories']['name']) : 0),
- 'carbohydrateContent' => (isset($recipe['nutrition']['carbs']) && $recipe['nutrition']['carbs'] ? $recipe['nutrition']['carbs'] . ' ' . __( $_nutrition_facts['main']['carbs']['measurement'], 'cooked' ) : ''),
- 'cholesterolContent' => (isset($recipe['nutrition']['cholesterol']) && $recipe['nutrition']['cholesterol'] ? $recipe['nutrition']['cholesterol'] . ' ' . __( $_nutrition_facts['main']['cholesterol']['measurement'], 'cooked' ) : ''),
- 'fatContent' => (isset($recipe['nutrition']['fat']) && $recipe['nutrition']['fat'] ? $recipe['nutrition']['fat'] . ' ' . __( $_nutrition_facts['main']['fat']['measurement'], 'cooked' ) : ''),
- 'fiberContent' => (isset($recipe['nutrition']['fiber']) && $recipe['nutrition']['fiber'] ? $recipe['nutrition']['fiber'] . ' ' . __( $_nutrition_facts['main']['carbs']['subs']['fiber']['measurement'], 'cooked' ) : ''),
- 'proteinContent' => (isset($recipe['nutrition']['protein']) && $recipe['nutrition']['protein'] ? $recipe['nutrition']['protein'] . ' ' . __( $_nutrition_facts['main']['protein']['measurement'], 'cooked' ) : ''),
- 'saturatedFatContent' => (isset($recipe['nutrition']['sat_fat']) && $recipe['nutrition']['sat_fat'] ? $recipe['nutrition']['sat_fat'] . ' ' . __( $_nutrition_facts['main']['fat']['subs']['sat_fat']['measurement'], 'cooked' ) : ''),
+ 'carbohydrateContent' => (isset($recipe['nutrition']['carbs']) && $recipe['nutrition']['carbs'] ? $recipe['nutrition']['carbs'] . ' ' . $_nutrition_facts['main']['carbs']['measurement'] : ''),
+ 'cholesterolContent' => (isset($recipe['nutrition']['cholesterol']) && $recipe['nutrition']['cholesterol'] ? $recipe['nutrition']['cholesterol'] . ' ' . $_nutrition_facts['main']['cholesterol']['measurement'] : ''),
+ 'fatContent' => (isset($recipe['nutrition']['fat']) && $recipe['nutrition']['fat'] ? $recipe['nutrition']['fat'] . ' ' . $_nutrition_facts['main']['fat']['measurement'] : ''),
+ 'fiberContent' => (isset($recipe['nutrition']['fiber']) && $recipe['nutrition']['fiber'] ? $recipe['nutrition']['fiber'] . ' ' . $_nutrition_facts['main']['carbs']['subs']['fiber']['measurement'] : ''),
+ 'proteinContent' => (isset($recipe['nutrition']['protein']) && $recipe['nutrition']['protein'] ? $recipe['nutrition']['protein'] . ' ' . $_nutrition_facts['main']['protein']['measurement'] : ''),
+ 'saturatedFatContent' => (isset($recipe['nutrition']['sat_fat']) && $recipe['nutrition']['sat_fat'] ? $recipe['nutrition']['sat_fat'] . ' ' . $_nutrition_facts['main']['fat']['subs']['sat_fat']['measurement'] : ''),
'servingSize' => (isset($recipe['nutrition']['serving_size']) && $recipe['nutrition']['serving_size'] ? $recipe['nutrition']['serving_size'] . ' ' . strtolower($_nutrition_facts['top']['servings']['name']) : ''),
- 'sodiumContent' => (isset($recipe['nutrition']['sodium']) && $recipe['nutrition']['sodium'] ? $recipe['nutrition']['sodium'] . ' ' . __( $_nutrition_facts['main']['sodium']['measurement'], 'cooked' ) : ''),
- 'sugarContent' => (isset($recipe['nutrition']['sugars']) && $recipe['nutrition']['sugars'] ? $recipe['nutrition']['sugars'] . ' ' . __( $_nutrition_facts['main']['carbs']['subs']['sugars']['measurement'], 'cooked' ) : ''),
- 'transFatContent' => (isset($recipe['nutrition']['trans_fat']) && $recipe['nutrition']['trans_fat'] ? $recipe['nutrition']['trans_fat'] . ' ' . __( $_nutrition_facts['main']['fat']['subs']['trans_fat']['measurement'], 'cooked' ) : ''),
+ 'sodiumContent' => (isset($recipe['nutrition']['sodium']) && $recipe['nutrition']['sodium'] ? $recipe['nutrition']['sodium'] . ' ' . $_nutrition_facts['main']['sodium']['measurement'] : ''),
+ 'sugarContent' => (isset($recipe['nutrition']['sugars']) && $recipe['nutrition']['sugars'] ? $recipe['nutrition']['sugars'] . ' ' . $_nutrition_facts['main']['carbs']['subs']['sugars']['measurement'] : ''),
+ 'transFatContent' => (isset($recipe['nutrition']['trans_fat']) && $recipe['nutrition']['trans_fat'] ? $recipe['nutrition']['trans_fat'] . ' ' . $_nutrition_facts['main']['fat']['subs']['trans_fat']['measurement'] : ''),
'unsaturatedFatContent' => $unsaturatedFatContent,
],
'recipeInstructions' => $directions,
diff --git a/includes/class.cooked-settings.php b/includes/class.cooked-settings.php
index 9d1250d..f6294b4 100644
--- a/includes/class.cooked-settings.php
+++ b/includes/class.cooked-settings.php
@@ -56,7 +56,11 @@ public static function init() {
$list_id_counter = 0;
$_cooked_settings = Cooked_Settings::get();
register_setting( 'cooked_settings_group', 'cooked_settings', ['sanitize_callback' => [__CLASS__, 'sanitize_settings']] );
- register_setting( 'cooked_settings_group', 'cooked_settings_saved' );
+ register_setting( 'cooked_settings_group', 'cooked_settings_saved', ['sanitize_callback' => [__CLASS__, 'sanitize_saved_flag']] );
+ }
+
+ public static function sanitize_saved_flag( $value ) {
+ return rest_sanitize_boolean( $value );
}
// Add this new method to handle settings sanitization.
@@ -103,7 +107,12 @@ public static function sanitize_settings($settings) {
}
function cooked_settings_saved_admin_notice() {
- if (isset($_GET['settings-updated']) && $_GET['settings-updated'] && isset($_GET['page']) && $_GET['page'] === 'cooked_settings') {
+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- Display-only Settings API query vars.
+ $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
+ $settings_updated = isset( $_GET['settings-updated'] ) ? rest_sanitize_boolean( wp_unslash( $_GET['settings-updated'] ) ) : false;
+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+ if ( $settings_updated && $page === 'cooked_settings' ) {
add_settings_error(
'cooked_settings_group',
'cooked_settings_updated',
@@ -115,7 +124,9 @@ function cooked_settings_saved_admin_notice() {
function browse_page_missing_notice() {
// Only show on admin pages, not on the Cooked settings page itself
- if ( isset($_GET['page']) && $_GET['page'] === 'cooked_settings' ) {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only admin page query var.
+ $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
+ if ( $page === 'cooked_settings' ) {
return;
}
@@ -127,10 +138,11 @@ function browse_page_missing_notice() {
$class = 'notice notice-warning is-dismissible';
$message = sprintf(
'' . __( 'Cooked Plugin Setup', 'cooked' ) . ' ' .
+ /* translators: %s: Browse/Search Recipes Page link */
__( 'To display your recipes properly, please set up your %s.', 'cooked' ),
- '' . __( 'Browse/Search Recipes Page', 'cooked' ) . ''
+ '' . __( 'Browse/Search Recipes Page', 'cooked' ) . ''
);
- printf( '%2$s
%2$s
'; if ( $conditional_requirement ): echo '
';
- echo ' ';
- echo '';
+ echo '';
echo ' ';
echo '0 / ' . esc_html( $total ) . '';
echo ' Migration Complete! You can now ' . __( 'reload', 'cooked' ) . ' the settings screen. Migration Complete! You can now ' . esc_html__( 'reload', 'cooked' ) . ' the settings screen. ';
- echo '' . $browse_page_url . '/' . esc_html( $end_of_url ) . '/';
+ echo '' . esc_url( $browse_page_url ) . '/' . esc_html( $end_of_url ) . '/';
echo ' ' . esc_html( isset($nutrition_facts[$slug]) ? $nutrition_facts[$slug] : '' ) . ' ' . $servings_change . ' ' . esc_html(strtolower($nf['name'])) . ' ' . esc_html( $servings_change ) . ' ' . esc_html(strtolower($nf['name'])) . '';
echo '';
- echo '';
+ echo '';
if ( $has_image ) {
echo wp_get_attachment_image( $attachment_id, 'thumbnail', false, [
@@ -865,11 +877,11 @@ public static function field_checkboxes($field_name, $options, $color = false, $
if ($is_disabled) {
echo '';
- echo '';
else:
- echo '' . __('Notes', 'cooked') . '' : '';
+ $show_header = $show_header ? '' . esc_html__( 'Notes', 'cooked' ) . '' : '';
echo '';
- echo $show_header;
+ echo wp_kses_post( $show_header );
echo do_shortcode($notes);
echo '';
}
@@ -975,7 +979,7 @@ public function cooked_nutrition_shortcode($atts, $content = null) {
echo '
- ';
if ($sub_slug === 'trans_fat'):
echo '
- '; - echo $sub_nf['nutrition_info_name'] . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ); + echo wp_kses_post( $sub_nf['nutrition_info_name'] ) . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ); echo ' '; elseif ($sub_slug === 'added_sugars'): echo '
- '; - echo __('Includes', 'cooked') . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ) . ' ' . esc_html($sub_nf['name']); - echo ( isset( $sub_nf['pdv'] ) ? '' . ceil( ( esc_html( $nutrition_facts[$sub_slug] ) / $sub_nf['pdv'] ) * 100 ) . '%' : '' ); + echo esc_html__('Includes', 'cooked') . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ) . ' ' . esc_html($sub_nf['name']); + echo ( isset( $sub_nf['pdv'] ) ? '' . esc_html( ceil( ( $nutrition_facts[$sub_slug] / $sub_nf['pdv'] ) * 100 ) ) . '%' : '' ); echo '
- '; - echo esc_html( $sub_nf['name'] ) . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html__( $sub_nf['measurement'], 'cooked' ) . '' : '' ); - echo ( isset( $sub_nf['pdv'] ) && $nutrition_facts[$sub_slug] ? '' . ceil( ( esc_html( $nutrition_facts[$sub_slug] ) / $sub_nf['pdv'] ) * 100 ) . '%' : '' ); + echo esc_html( $sub_nf['name'] ) . ' ' . esc_html( $nutrition_facts[$sub_slug] ) . '' . ( isset($sub_nf['measurement']) ? '' . esc_html( $sub_nf['measurement'] ) . '' : '' ); + echo ( isset( $sub_nf['pdv'] ) && $nutrition_facts[$sub_slug] ? '' . esc_html( ceil( ( $nutrition_facts[$sub_slug] / $sub_nf['pdv'] ) * 100 ) ) . '%' : '' ); echo ' '; endif; echo '
'; echo '
- ';
- echo '
- ' . __('Amount per serving','cooked') . ' '; + echo '
- ' . esc_html__('Amount per serving','cooked') . ' '; if ( isset($mid_facts_content) && $mid_facts_content ): echo '
- ' . __('% Daily Value *','cooked'). ' '; + echo '
- ' . esc_html__('% Daily Value *','cooked'). ' '; echo '
';
- echo '
' . __('Nutrition Facts', 'cooked') . '
';
+ echo '' . esc_html__('Nutrition Facts', 'cooked') . '
';
echo wp_kses_post( $nutrition_facts_content );
if ( isset($main_facts_content) && $main_facts_content || isset($bottom_facts_content) && $bottom_facts_content ):
echo '';
- echo '* ' . __('The % Daily Value (DV) tells you how much a nutrient in a serving of food contributes to a daily diet. 2,000 calories a day is used for general nutrition advice.','cooked') . '
'; + echo '* ' . esc_html__('The % Daily Value (DV) tells you how much a nutrient in a serving of food contributes to a daily diet. 2,000 calories a day is used for general nutrition advice.','cooked') . '
'; endif; // Add the Edamam attribution "Powered by Edamam" if the Edamam API is enabled. @@ -1193,8 +1197,10 @@ public function cooked_related_recipes_shortcode($atts, $content = null) { // Check if it's a different post type $post_check = get_post($recipe_id); if ($post_check && $post_check->post_type !== 'cp_recipe') { + /* translators: %d: post ID */ $error_msg .= ' ' . sprintf(__('The specified ID (%d) is not a recipe.', 'cooked'), $recipe_id); } elseif (!$post_check) { + /* translators: %d: post ID */ $error_msg .= ' ' . sprintf(__('No post found with ID %d.', 'cooked'), $recipe_id); } return ''; @@ -1247,7 +1253,7 @@ public function cooked_related_recipes_shortcode($atts, $content = null) { foreach ($recipe_ids as $rid) { echo '';
- echo Cooked_Recipes::card($rid, false, $hide_image, false, $hide_excerpt, $hide_author);
+ echo wp_kses_post( Cooked_Recipes::card($rid, false, $hide_image, false, $hide_excerpt, $hide_author) );
echo '
';
}
diff --git a/includes/class.cooked-updates.php b/includes/class.cooked-updates.php
index 5bd9ae4..6dcad4c 100644
--- a/includes/class.cooked-updates.php
+++ b/includes/class.cooked-updates.php
@@ -45,12 +45,20 @@ class Cooked_Updates {
*/
private static $cooked_settings_saved;
+ /**
+ * Whether rewrite rules were already flushed this request.
+ *
+ * @var bool
+ */
+ private static $rewrite_rules_flushed = false;
+
/**
* Initialize the updates system
*/
public function __construct() {
// Add action to check version and update settings at the end of page load.
add_action( 'shutdown', [__CLASS__, 'init'] );
+ add_action( 'init', [ __CLASS__, 'maybe_heal_rewrite_rules' ], 99 );
}
/**
@@ -78,6 +86,8 @@ public static function init() {
if ( self::needs_update() ) {
self::run_updates();
}
+
+ self::maybe_flush_queued_rewrite_rules();
}
/**
@@ -108,14 +118,18 @@ private static function run_updates() {
// Run version-specific updates
self::run_version_updates();
+ self::update_rewrite_rules();
+
// Update both version numbers.
update_option( 'cooked_settings_version', self::$current_version );
if ( defined('COOKED_PRO_VERSION') ) {
update_option( 'cooked_pro_settings_version', self::$current_pro_version );
}
- // Log the update
- error_log( sprintf( 'Cooked: Updated from version %s to %s', $old_version, self::$current_version ) );
+ if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+ error_log( sprintf( 'Cooked: Updated from version %s to %s', $old_version, self::$current_version ) );
+ }
}
/**
@@ -131,7 +145,10 @@ private static function run_version_updates() {
try {
call_user_func( [__CLASS__, $method] );
} catch ( Exception $e ) {
- error_log( sprintf( 'Cooked: Error running update method %s: %s', $method, $e->getMessage() ) );
+ if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+ error_log( sprintf( 'Cooked: Error running update method %s: %s', $method, $e->getMessage() ) );
+ }
}
}
}
@@ -204,9 +221,11 @@ public static function run_tool( $tool_name ) {
}
}
if ( ! isset( $allowed[ $tool_name ] ) ) {
+ /* translators: %s: site health tool name */
return new \WP_Error( 'cooked_tool_invalid', sprintf( __( 'Unknown tool: %s.', 'cooked' ), $tool_name ) );
}
if ( ! method_exists( __CLASS__, $tool_name ) ) {
+ /* translators: %s: PHP method name */
return new \WP_Error( 'cooked_tool_missing', sprintf( __( 'Tool method %s does not exist.', 'cooked' ), $tool_name ) );
}
@@ -327,7 +346,8 @@ private static function fix_recipe_line_endings() {
}
// Log the update if any recipes were modified
- if ( $updated_count > 0 ) {
+ if ( $updated_count > 0 && defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
error_log( sprintf( 'Cooked: Fixed line endings in %d recipes for WordPress exporter/importer compatibility.', $updated_count ) );
}
}
@@ -345,7 +365,10 @@ private static function purge_legacy_related_recipes_cache() {
delete_option( 'cooked_related_version' );
delete_option( 'cooked_related_calculation_last' );
- error_log( 'Cooked: Purged legacy related-recipes cache and options.' );
+ if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+ error_log( 'Cooked: Purged legacy related-recipes cache and options.' );
+ }
}
/**
@@ -378,19 +401,146 @@ private static function remove_recipes_from_cooked_user_meta() {
$updated_count++;
}
- if ( $updated_count > 0 ) {
+ if ( $updated_count > 0 && defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
error_log( sprintf( 'Cooked: Removed legacy recipes key from %d user(s) cooked_user_meta.', $updated_count ) );
}
}
+ /**
+ * Soft-flush rewrite rules when any rule registered this request is missing
+ * from the stored rewrite_rules option.
+ *
+ * @since 1.16.0
+ * @return void
+ */
+ public static function maybe_heal_rewrite_rules() {
+ if ( self::registered_rewrite_rules_missing() ) {
+ self::update_rewrite_rules();
+ }
+ }
+
+ /**
+ * Queue a one-shot rewrite flush when registered rewrite rules are missing
+ * from the stored rewrite_rules option.
+ *
+ * @since 1.16.0
+ * @return void
+ */
+ public static function maybe_queue_rewrite_flush() {
+ if ( self::registered_rewrite_rules_missing() ) {
+ update_option( 'cooked_flush_rewrite_rules', '1' );
+ }
+ }
+
+ /**
+ * Whether the stored rewrite_rules option is missing any rewrite rule
+ * registered this request via add_rewrite_rule().
+ *
+ * @since 1.16.0
+ * @return bool
+ */
+ public static function registered_rewrite_rules_missing() {
+ if ( function_exists( 'wp_installing' ) && wp_installing() ) {
+ return false;
+ }
+
+ if ( ! get_option( 'permalink_structure' ) ) {
+ return false;
+ }
+
+ $registered = self::registered_extra_rewrite_rules();
+ if ( empty( $registered ) ) {
+ return false;
+ }
+
+ $stored = get_option( 'rewrite_rules' );
+ if ( ! is_array( $stored ) || empty( $stored ) ) {
+ return true;
+ }
+
+ foreach ( $registered as $regex => $query ) {
+ if ( array_key_exists( $regex, $stored ) ) {
+ continue;
+ }
+
+ if ( is_string( $query ) && in_array( $query, $stored, true ) ) {
+ continue;
+ }
+
+ return true;
+ }
+
+ return false;
+ }
+
+ /**
+ * Rewrite rules added this request with add_rewrite_rule().
+ *
+ * @since 1.16.0
+ * @return array
+ */
+ private static function registered_extra_rewrite_rules() {
+ global $wp_rewrite;
+
+ if ( ! is_object( $wp_rewrite ) ) {
+ return [];
+ }
+
+ $rules = [];
+
+ if ( ! empty( $wp_rewrite->extra_rules_top ) && is_array( $wp_rewrite->extra_rules_top ) ) {
+ $rules = $wp_rewrite->extra_rules_top;
+ }
+
+ if ( ! empty( $wp_rewrite->extra_rules ) && is_array( $wp_rewrite->extra_rules ) ) {
+ $rules = array_merge( $rules, $wp_rewrite->extra_rules );
+ }
+
+ return $rules;
+ }
+
+ /**
+ * Soft-flush rewrite rules when a previous request queued it.
+ *
+ * @since 1.16.0
+ * @return void
+ */
+ public static function maybe_flush_queued_rewrite_rules() {
+ if ( ! get_option( 'cooked_flush_rewrite_rules' ) ) {
+ return;
+ }
+
+ self::update_rewrite_rules();
+ delete_option( 'cooked_flush_rewrite_rules' );
+ }
+
+ /**
+ * Reset per-request flush state. Used by tests.
+ *
+ * @since 1.16.0
+ * @return void
+ */
+ public static function reset_rewrite_flush_state() {
+ self::$rewrite_rules_flushed = false;
+ }
+
/**
* Update rewrite rules if needed
*
* @since 1.11.2
*/
private static function update_rewrite_rules() {
- flush_rewrite_rules();
- error_log( 'Cooked: Flushed rewrite rules due to version update.' );
+ if ( self::$rewrite_rules_flushed ) {
+ return;
+ }
+
+ flush_rewrite_rules( false );
+ self::$rewrite_rules_flushed = true;
+ if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+ error_log( 'Cooked: Flushed rewrite rules due to version update.' );
+ }
}
}
diff --git a/includes/class.cooked-widgets.php b/includes/class.cooked-widgets.php
index d4896f3..9d6c8b2 100644
--- a/includes/class.cooked-widgets.php
+++ b/includes/class.cooked-widgets.php
@@ -37,7 +37,7 @@ public function register_widgets() {
public static function recipe_finder( $field_id = '', $field_name = '', $included = '' ) {
$button_title = ( ! empty( $included ) ? __( 'Edit Recipe(s)...', 'cooked' ) : __( 'Choose recipe(s)...', 'cooked' ) );
echo '';
- echo '