<p>$_GET['tab'] is not escaped.</p><p>File: esplanade\includes\theme-options.php</p><pre class=""><code class="language-php" data-lang="php" style="font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 16px; border-radius: 3px;"><span class="k" style="color: rgb(0, 102, 153);">function</span> <span class="nf" style="color: rgb(204, 0, 255);">esplanade_theme_page</span><span class="p">()</span> <span class="p">{</span>
<span class="nx">add_theme_page</span><span class="p">(</span> <span class="nx">__</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'Esplanade Theme Options'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade'</span> <span class="p">),</span> <span class="nx">__</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'Theme Options'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade'</span> <span class="p">),</span> <span class="s1" style="color: rgb(204, 51, 0);">'edit_theme_options'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade_options'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade_admin_options_page'</span> <span class="p">);</span>
<span class="p">}</span>
<span class="nx">add_action</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'admin_menu'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade_theme_page'</span> <span class="p">);</span>
<span class="k" style="color: rgb(0, 102, 153);">function</span> <span class="nf" style="color: rgb(204, 0, 255);">esplanade_admin_options_page</span><span class="p">()</span> <span class="p">{</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> <div class="wrap"></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">esplanade_admin_options_page_tabs</span><span class="p">();</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="k" style="color: rgb(0, 102, 153);">if</span> <span class="p">(</span> <span class="nb" style="color: rgb(51, 102, 102);">isset</span><span class="p">(</span> <span class="nv" style="color: rgb(0, 51, 51);">$_GET</span><span class="p">[</span><span class="s1" style="color: rgb(204, 51, 0);">'settings-updated'</span><span class="p">]</span> <span class="p">)</span> <span class="p">)</span> <span class="o" style="color: rgb(85, 85, 85);">:</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> <div class='updated'><p></span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">_e</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'Theme settings updated successfully.'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade'</span> <span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span><span class="x"></p></div></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="k" style="color: rgb(0, 102, 153);">endif</span><span class="p">;</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> <form action="options.php" method="post"></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">settings_fields</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade_theme_options'</span> <span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">do_settings_sections</span><span class="p">(</span><span class="s1" style="color: rgb(204, 51, 0);">'esplanade_options'</span><span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> <p>&nbsp;</p></span>
<span class="x"> </span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nv" style="color: rgb(0, 51, 51);">$tab</span> <span class="o" style="color: rgb(85, 85, 85);">=</span> <span class="p">(</span> <span class="nb" style="color: rgb(51, 102, 102);">isset</span><span class="p">(</span> <span class="nv" style="color: rgb(0, 51, 51);">$_GET</span><span class="p">[</span><span class="s1" style="color: rgb(204, 51, 0);">'tab'</span><span class="p">]</span> <span class="p">)</span> <span class="o" style="color: rgb(85, 85, 85);">?</span> <span class="nv" style="color: rgb(0, 51, 51);">$_GET</span><span class="p">[</span><span class="s1" style="color: rgb(204, 51, 0);">'tab'</span><span class="p">]</span> <span class="o" style="color: rgb(85, 85, 85);">:</span> <span class="s1" style="color: rgb(204, 51, 0);">'general'</span> <span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span>
<span class="x"> <input name="esplanade_theme_options[submit-</span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="k" style="color: rgb(0, 102, 153);">echo</span> <span class="nv" style="color: rgb(0, 51, 51);">$tab</span><span class="p">;</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span><span class="x">]" type="submit" class="button-primary" value="</span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">_e</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'Save Settings'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade'</span> <span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span><span class="x">" /></span>
<span class="x"> <input name="esplanade_theme_options[reset-</span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="k" style="color: rgb(0, 102, 153);">echo</span> <span class="nv" style="color: rgb(0, 51, 51);">$tab</span><span class="p">;</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span><span class="x">]" type="submit" class="button-secondary" value="</span><span class="cp" style="color: rgb(0, 153, 153);"><?php</span> <span class="nx">_e</span><span class="p">(</span> <span class="s1" style="color: rgb(204, 51, 0);">'Reset Defaults'</span><span class="p">,</span> <span class="s1" style="color: rgb(204, 51, 0);">'esplanade'</span> <span class="p">);</span> <span class="cp" style="color: rgb(0, 153, 153);">?></span><span class="x">" /></span>
<span class="x"> <script> </span>
<span class="x"> jQuery(document).ready(function($) { </span>
<span class="x"> $('.wp-color-picker').wpColorPicker(); </span>
<span class="x"> }); </span>
<span class="x"> </script></span>
<span class="x"> </form></span>
<span class="x"> </div></span>
<span class="cp" style="color: rgb(0, 153, 153);"><?php</span>
<span class="p">}</span></code></pre>
京公网安备 11010502034610号
暂无评论