fix: escape get_search_query() output to prevent XSS in search forms
Wrapped get_search_query() with esc_attr() in 404.php, front-page.php, and searchform.php. Without this, a crafted search query can inject arbitrary HTML attributes into the search input value field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
72
404.php
72
404.php
@@ -1,36 +1,36 @@
|
||||
<?php
|
||||
/**
|
||||
* The 404 template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
get_header();
|
||||
?>
|
||||
|
||||
<main id="main" class="site-main">
|
||||
<div class="ps-container">
|
||||
<div class="error-404 not-found">
|
||||
<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
|
||||
<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
|
||||
|
||||
<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<label>
|
||||
<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
|
||||
<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo get_search_query(); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
|
||||
</label>
|
||||
</form>
|
||||
|
||||
<div class="ps-404-cta-group">
|
||||
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||
<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<?php get_footer(); ?>
|
||||
<?php
|
||||
/**
|
||||
* The 404 template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
get_header();
|
||||
?>
|
||||
|
||||
<main id="main" class="site-main">
|
||||
<div class="ps-container">
|
||||
<div class="error-404 not-found">
|
||||
<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
|
||||
<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
|
||||
|
||||
<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<label>
|
||||
<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
|
||||
<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo esc_attr( get_search_query() ); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
|
||||
</label>
|
||||
</form>
|
||||
|
||||
<div class="ps-404-cta-group">
|
||||
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||
<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<?php get_footer(); ?>
|
||||
|
||||
170
front-page.php
170
front-page.php
@@ -1,85 +1,85 @@
|
||||
<?php
|
||||
/**
|
||||
* The front page template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
get_header();
|
||||
?>
|
||||
|
||||
<main id="main" class="site-main">
|
||||
<!-- Hero Section -->
|
||||
<section class="hero-section">
|
||||
<div class="hero-content">
|
||||
<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
|
||||
<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
|
||||
|
||||
<!-- Hero Search (Peptide Search AI) -->
|
||||
<div class="hero-search">
|
||||
<?php
|
||||
if ( shortcode_exists( 'peptide_search' ) ) {
|
||||
echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
|
||||
} else {
|
||||
?>
|
||||
<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<input
|
||||
type="search"
|
||||
name="s"
|
||||
class="ps-search-input"
|
||||
placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
|
||||
value="<?php echo get_search_query(); ?>"
|
||||
>
|
||||
</form>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
</div>
|
||||
|
||||
<!-- Hero CTAs -->
|
||||
<div class="hero-ctas">
|
||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||
<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<!-- PRAutoBlogger Posts Widget -->
|
||||
<?php
|
||||
if ( shortcode_exists( 'prautoblogger_posts' ) ) {
|
||||
echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
|
||||
}
|
||||
?>
|
||||
|
||||
<!-- News Feed Section -->
|
||||
<?php
|
||||
// Display the Peptide News plugin shortcode if available
|
||||
if ( shortcode_exists( 'peptide_news' ) ) {
|
||||
?>
|
||||
<section class="news-feed-section">
|
||||
<div class="ps-container">
|
||||
<div class="news-feed-header">
|
||||
<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
|
||||
<p class="news-feed-description">
|
||||
<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
|
||||
</p>
|
||||
</div>
|
||||
<?php echo do_shortcode( '[peptide_news]' ); ?>
|
||||
</div>
|
||||
</section>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
|
||||
<?php
|
||||
// Note: The front page layout is handled entirely by this template.
|
||||
// Old page content (e.g. from Elementor) is intentionally NOT rendered here
|
||||
// to avoid duplicate hero sections and empty space.
|
||||
?>
|
||||
</main>
|
||||
|
||||
<?php get_footer(); ?>
|
||||
<?php
|
||||
/**
|
||||
* The front page template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
get_header();
|
||||
?>
|
||||
|
||||
<main id="main" class="site-main">
|
||||
<!-- Hero Section -->
|
||||
<section class="hero-section">
|
||||
<div class="hero-content">
|
||||
<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
|
||||
<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
|
||||
|
||||
<!-- Hero Search (Peptide Search AI) -->
|
||||
<div class="hero-search">
|
||||
<?php
|
||||
if ( shortcode_exists( 'peptide_search' ) ) {
|
||||
echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
|
||||
} else {
|
||||
?>
|
||||
<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<input
|
||||
type="search"
|
||||
name="s"
|
||||
class="ps-search-input"
|
||||
placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
|
||||
value="<?php echo esc_attr( get_search_query() ); ?>"
|
||||
>
|
||||
</form>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
</div>
|
||||
|
||||
<!-- Hero CTAs -->
|
||||
<div class="hero-ctas">
|
||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||
<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<!-- PRAutoBlogger Posts Widget -->
|
||||
<?php
|
||||
if ( shortcode_exists( 'prautoblogger_posts' ) ) {
|
||||
echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
|
||||
}
|
||||
?>
|
||||
|
||||
<!-- News Feed Section -->
|
||||
<?php
|
||||
// Display the Peptide News plugin shortcode if available
|
||||
if ( shortcode_exists( 'peptide_news' ) ) {
|
||||
?>
|
||||
<section class="news-feed-section">
|
||||
<div class="ps-container">
|
||||
<div class="news-feed-header">
|
||||
<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
|
||||
<p class="news-feed-description">
|
||||
<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
|
||||
</p>
|
||||
</div>
|
||||
<?php echo do_shortcode( '[peptide_news]' ); ?>
|
||||
</div>
|
||||
</section>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
|
||||
<?php
|
||||
// Note: The front page layout is handled entirely by this template.
|
||||
// Old page content (e.g. from Elementor) is intentionally NOT rendered here
|
||||
// to avoid duplicate hero sections and empty space.
|
||||
?>
|
||||
</main>
|
||||
|
||||
<?php get_footer(); ?>
|
||||
|
||||
@@ -1,27 +1,27 @@
|
||||
<?php
|
||||
/**
|
||||
* The search form template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
?>
|
||||
<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
|
||||
<div style="position: relative;">
|
||||
<input
|
||||
type="search"
|
||||
id="search"
|
||||
name="s"
|
||||
class="ps-search-input"
|
||||
placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
|
||||
value="<?php echo get_search_query(); ?>"
|
||||
>
|
||||
<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
|
||||
<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||
<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||
</svg>
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
<?php
|
||||
/**
|
||||
* The search form template
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
?>
|
||||
<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||
<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
|
||||
<div style="position: relative;">
|
||||
<input
|
||||
type="search"
|
||||
id="search"
|
||||
name="s"
|
||||
class="ps-search-input"
|
||||
placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
|
||||
value="<?php echo esc_attr( get_search_query() ); ?>"
|
||||
>
|
||||
<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
|
||||
<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||
<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||
</svg>
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
|
||||
Reference in New Issue
Block a user