From 5e15051ec56cd40db6b5b2b29e77617f7fe2405f Mon Sep 17 00:00:00 2001
From: leodudedev <pinori@gmail.com>
Date: Tue, 1 Nov 2022 22:28:21 +0100
Subject: [PATCH] escaping var and replace domain

---
 admin/class-simple-limited-access-admin.php |  2 +-
 admin/partials/config-basic.php             | 22 ++++++++++-----------
 public/partials/form.php                    | 19 +++++++++++-------
 3 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/admin/class-simple-limited-access-admin.php b/admin/class-simple-limited-access-admin.php
index 718654c..e02bae0 100644
--- a/admin/class-simple-limited-access-admin.php
+++ b/admin/class-simple-limited-access-admin.php
@@ -131,7 +131,7 @@ private function hook_admin_menu()
         function () {
 ?>
         <div style="padding: 20px;">
-          <h1><?php echo __('Simple Limited Access settings', 'simple_limited_access'); ?></h1>
+          <h1><?php echo __('Simple Limited Access settings', 'simple-limited-access'); ?></h1>
           <?php
           require(WP_PLUGIN_DIR . '/' . dirname(plugin_basename(__FILE__)) . '/partials/config-basic.php');
           ?>
diff --git a/admin/partials/config-basic.php b/admin/partials/config-basic.php
index 7d0d956..c246695 100644
--- a/admin/partials/config-basic.php
+++ b/admin/partials/config-basic.php
@@ -84,7 +84,7 @@
 <form action="" method="post">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Login page background', 'simple_limited_access'); ?><br>
+      <?php echo __('Login page background', 'simple-limited-access'); ?><br>
       es. <strong>#ff00ff</strong>
     </p>
     <div style="display: flex">
@@ -95,14 +95,14 @@
   <hr style="margin: 20px 0;">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Info text on the login page', 'simple_limited_access'); ?>
+      <?php echo __('Info text on the login page', 'simple-limited-access'); ?>
     </p>
     <textarea rows="3" class="large-text code" name="sla_text" id="sla_text"><?php echo esc_html($text); ?></textarea>
   </div>
   <hr style="margin: 20px 0;">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Enable on page', 'simple_limited_access'); ?>
+      <?php echo __('Enable on page', 'simple-limited-access'); ?>
     </p>
     <?php
     $page_val = '';
@@ -127,7 +127,7 @@
   <hr style="margin: 20px 0;">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Enable on post_type', 'simple_limited_access'); ?>
+      <?php echo __('Enable on post_type', 'simple-limited-access'); ?>
     </p>
     <?php
     $post_type_val = '';
@@ -137,7 +137,7 @@
       }
     }
     ?>
-    <select class="sla-select2" name="sla_post_type[]" multiple="multiple" style="width: 100%" data-initval="<?php echo $post_type_val; ?>">
+    <select class="sla-select2" name="sla_post_type[]" multiple="multiple" style="width: 100%" data-initval="<?php echo esc_html($post_type_val); ?>">
       <?php
       foreach (get_post_types(array('public' => true)) as $key => $value) {
         if ($key !== 'attachment') {
@@ -150,22 +150,22 @@
   <hr style="margin: 20px 0;">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Insert new line in the textarea to add a user', 'simple_limited_access'); ?>.<br>
-      <?php echo __('Username and password must be separated by colons', 'simple_limited_access'); ?><br>es. <strong>username:123456</strong>
+      <?php echo __('Insert new line in the textarea to add a user', 'simple-limited-access'); ?>.<br>
+      <?php echo __('Username and password must be separated by colons', 'simple-limited-access'); ?><br>es. <strong>username:123456</strong>
     </p>
     <textarea rows="10" class="large-text code" name="sla_usrlist"><?php echo esc_html($userlist); ?></textarea>
   </div>
   <hr style="margin: 20px 0;">
   <div>
     <p style="margin: 0 0 5px 0">
-      <?php echo __('Cookie timeout in hours', 'simple_limited_access'); ?><br>
-      <?php echo __('Default value 2 hours', 'simple_limited_access'); ?>
+      <?php echo __('Cookie timeout in hours', 'simple-limited-access'); ?><br>
+      <?php echo __('Default value 2 hours', 'simple-limited-access'); ?>
     </p>
     <input type="number" name="sla_cookie_timeout" value="<?php echo esc_html($time); ?>">
   </div>
   <hr style="margin: 20px 0;">
   <div>
-    <input type="submit" class="button button-primary" value="<?php echo __('Save settings', 'simple_limited_access'); ?>">
+    <input type="submit" class="button button-primary" value="<?php echo __('Save settings', 'simple-limited-access'); ?>">
   </div>
 </form>
 <?php
@@ -175,7 +175,7 @@
 ?>
   <hr style="margin: 50px 0 20px 0;">
   <div>
-    <h2 style="margin: 0 0 5px 0"><?php echo __('Log accesses', 'simple_limited_access'); ?></h2>
+    <h2 style="margin: 0 0 5px 0"><?php echo __('Log accesses', 'simple-limited-access'); ?></h2>
     <textarea rows="10" class="large-text code" name="sla_log" style="font-size: 12px"><?php echo esc_html($log); ?></textarea>
   </div>
 <?php
diff --git a/public/partials/form.php b/public/partials/form.php
index 7e1c868..4083a28 100644
--- a/public/partials/form.php
+++ b/public/partials/form.php
@@ -5,17 +5,22 @@
   <meta charset="utf-8">
   <meta http-equiv="x-ua-compatible" content="ie=edge">
   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-  <title><?php echo get_bloginfo(); ?></title>
+  <title><?php echo esc_html(get_bloginfo()); ?></title>
   <meta name='robots' content='noindex, nofollow' />
   <?php
   wp_head();
+
+  $bg_login = 'darkseagreen';
+  if (get_option('simple_limited_access_bg')) {
+    $bg_login = get_option('simple_limited_access_bg');
+  }
   ?>
   <style>
     body {
       font-family: Arial, Helvetica, sans-serif;
       font-size: 16px;
       color: white;
-      background-color: <?php echo get_option('simple_limited_access_bg') ? get_option('simple_limited_access_bg') : 'darkseagreen' ?>;
+      background-color: <?php echo esc_html($bg_login); ?>;
       padding: 0;
       margin: 0;
     }
@@ -111,26 +116,26 @@
     <div>
       <?php
       if (get_option('simple_limited_access_text')) {
-        echo '<div class="sla-infotext">' . stripslashes(get_option('simple_limited_access_text')) . '</div>';
+        echo '<div class="sla-infotext">' . wp_kses_post(get_option('simple_limited_access_text')) . '</div>';
       }
       ?>
       <div class="sla-tgt-form">
         <form action="<?php get_permalink(); ?>" method="post">
           <input type="hidden" name="sla_token" id="sla_token">
           <label for="sla_usr">
-            <span><?php echo __('Username', 'simple_limited_access'); ?></span>
+            <span><?php echo __('Username', 'simple-limited-access'); ?></span>
             <input type="text" name="sla_user" id="sla_user">
           </label>
           <label for="sla_pwd">
-            <span><?php echo __('Password', 'simple_limited_access'); ?></span>
+            <span><?php echo __('Password', 'simple-limited-access'); ?></span>
             <input type="password" name="sla_pwd" id="sla_pwd">
           </label>
-          <input type="submit" id="sla_submit" value="<?php echo __('Send', 'simple_limited_access'); ?>">
+          <input type="submit" id="sla_submit" value="<?php echo __('Send', 'simple-limited-access'); ?>">
           <?php
           if (isset($renderFormError)) {
             if ($renderFormError) {
           ?>
-              <p class="sla-tgt-form-error"><?php echo __('Wrong username or password', 'simple_limited_access'); ?></p>
+              <p class="sla-tgt-form-error"><?php echo __('Wrong username or password', 'simple-limited-access'); ?></p>
           <?php
             }
           }