fix: escape get_search_query() output to prevent XSS in search forms
Wrapped get_search_query() with esc_attr() in 404.php, front-page.php, and searchform.php. Without this, a crafted search query can inject arbitrary HTML attributes into the search input value field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
72
404.php
72
404.php
@@ -1,36 +1,36 @@
|
|||||||
<?php
|
<?php
|
||||||
/**
|
/**
|
||||||
* The 404 template
|
* The 404 template
|
||||||
*
|
*
|
||||||
* @package peptide-starter
|
* @package peptide-starter
|
||||||
*/
|
*/
|
||||||
|
|
||||||
get_header();
|
get_header();
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<main id="main" class="site-main">
|
<main id="main" class="site-main">
|
||||||
<div class="ps-container">
|
<div class="ps-container">
|
||||||
<div class="error-404 not-found">
|
<div class="error-404 not-found">
|
||||||
<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
|
<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
|
||||||
<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
|
<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
|
||||||
|
|
||||||
<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||||
<label>
|
<label>
|
||||||
<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
|
<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
|
||||||
<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo get_search_query(); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
|
<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo esc_attr( get_search_query() ); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
|
||||||
</label>
|
</label>
|
||||||
</form>
|
</form>
|
||||||
|
|
||||||
<div class="ps-404-cta-group">
|
<div class="ps-404-cta-group">
|
||||||
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
|
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||||
<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
|
<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
|
||||||
</a>
|
</a>
|
||||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
|
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||||
</a>
|
</a>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</main>
|
</main>
|
||||||
|
|
||||||
<?php get_footer(); ?>
|
<?php get_footer(); ?>
|
||||||
|
|||||||
170
front-page.php
170
front-page.php
@@ -1,85 +1,85 @@
|
|||||||
<?php
|
<?php
|
||||||
/**
|
/**
|
||||||
* The front page template
|
* The front page template
|
||||||
*
|
*
|
||||||
* @package peptide-starter
|
* @package peptide-starter
|
||||||
*/
|
*/
|
||||||
|
|
||||||
get_header();
|
get_header();
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<main id="main" class="site-main">
|
<main id="main" class="site-main">
|
||||||
<!-- Hero Section -->
|
<!-- Hero Section -->
|
||||||
<section class="hero-section">
|
<section class="hero-section">
|
||||||
<div class="hero-content">
|
<div class="hero-content">
|
||||||
<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
|
<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
|
||||||
<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
|
<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
|
||||||
|
|
||||||
<!-- Hero Search (Peptide Search AI) -->
|
<!-- Hero Search (Peptide Search AI) -->
|
||||||
<div class="hero-search">
|
<div class="hero-search">
|
||||||
<?php
|
<?php
|
||||||
if ( shortcode_exists( 'peptide_search' ) ) {
|
if ( shortcode_exists( 'peptide_search' ) ) {
|
||||||
echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
|
echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
|
||||||
} else {
|
} else {
|
||||||
?>
|
?>
|
||||||
<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||||
<input
|
<input
|
||||||
type="search"
|
type="search"
|
||||||
name="s"
|
name="s"
|
||||||
class="ps-search-input"
|
class="ps-search-input"
|
||||||
placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
|
placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
|
||||||
value="<?php echo get_search_query(); ?>"
|
value="<?php echo esc_attr( get_search_query() ); ?>"
|
||||||
>
|
>
|
||||||
</form>
|
</form>
|
||||||
<?php
|
<?php
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<!-- Hero CTAs -->
|
<!-- Hero CTAs -->
|
||||||
<div class="hero-ctas">
|
<div class="hero-ctas">
|
||||||
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
|
<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
|
||||||
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
|
||||||
</a>
|
</a>
|
||||||
<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
|
<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
|
||||||
<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
|
<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
|
||||||
</a>
|
</a>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<!-- PRAutoBlogger Posts Widget -->
|
<!-- PRAutoBlogger Posts Widget -->
|
||||||
<?php
|
<?php
|
||||||
if ( shortcode_exists( 'prautoblogger_posts' ) ) {
|
if ( shortcode_exists( 'prautoblogger_posts' ) ) {
|
||||||
echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
|
echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<!-- News Feed Section -->
|
<!-- News Feed Section -->
|
||||||
<?php
|
<?php
|
||||||
// Display the Peptide News plugin shortcode if available
|
// Display the Peptide News plugin shortcode if available
|
||||||
if ( shortcode_exists( 'peptide_news' ) ) {
|
if ( shortcode_exists( 'peptide_news' ) ) {
|
||||||
?>
|
?>
|
||||||
<section class="news-feed-section">
|
<section class="news-feed-section">
|
||||||
<div class="ps-container">
|
<div class="ps-container">
|
||||||
<div class="news-feed-header">
|
<div class="news-feed-header">
|
||||||
<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
|
<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
|
||||||
<p class="news-feed-description">
|
<p class="news-feed-description">
|
||||||
<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
|
<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
|
||||||
</p>
|
</p>
|
||||||
</div>
|
</div>
|
||||||
<?php echo do_shortcode( '[peptide_news]' ); ?>
|
<?php echo do_shortcode( '[peptide_news]' ); ?>
|
||||||
</div>
|
</div>
|
||||||
</section>
|
</section>
|
||||||
<?php
|
<?php
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<?php
|
<?php
|
||||||
// Note: The front page layout is handled entirely by this template.
|
// Note: The front page layout is handled entirely by this template.
|
||||||
// Old page content (e.g. from Elementor) is intentionally NOT rendered here
|
// Old page content (e.g. from Elementor) is intentionally NOT rendered here
|
||||||
// to avoid duplicate hero sections and empty space.
|
// to avoid duplicate hero sections and empty space.
|
||||||
?>
|
?>
|
||||||
</main>
|
</main>
|
||||||
|
|
||||||
<?php get_footer(); ?>
|
<?php get_footer(); ?>
|
||||||
|
|||||||
@@ -1,27 +1,27 @@
|
|||||||
<?php
|
<?php
|
||||||
/**
|
/**
|
||||||
* The search form template
|
* The search form template
|
||||||
*
|
*
|
||||||
* @package peptide-starter
|
* @package peptide-starter
|
||||||
*/
|
*/
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
|
||||||
<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
|
<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
|
||||||
<div style="position: relative;">
|
<div style="position: relative;">
|
||||||
<input
|
<input
|
||||||
type="search"
|
type="search"
|
||||||
id="search"
|
id="search"
|
||||||
name="s"
|
name="s"
|
||||||
class="ps-search-input"
|
class="ps-search-input"
|
||||||
placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
|
placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
|
||||||
value="<?php echo get_search_query(); ?>"
|
value="<?php echo esc_attr( get_search_query() ); ?>"
|
||||||
>
|
>
|
||||||
<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
|
<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
|
||||||
<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
|
<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
|
||||||
<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||||
<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||||
</svg>
|
</svg>
|
||||||
</button>
|
</button>
|
||||||
</div>
|
</div>
|
||||||
</form>
|
</form>
|
||||||
|
|||||||
Reference in New Issue
Block a user