Merge pull request #34 from themesgrove/dev

Fix the Vulnerability and Security issues
themesgrove · Jun 24, 2024 · 2f1e1d8 · 2f1e1d8
2 parents 2da26ab + c833c1f
commit 2f1e1d8
Show file tree

Hide file tree

Showing 40 changed files with 491 additions and 537 deletions.
diff --git a/README.txt b/README.txt
@@ -5,7 +5,7 @@ Donate link: https://themesgrove.com/
 Tags: elementor, add-ons, elementor addons, elementor widgets, woocommerce, learndash, learnpress, widgets, woocommerce addons, learndash addons, sensei, sensei addons, countdown, timer, slider, team, testimonial, social-share, carousel, portfolio, pricing, widgetkit
 Requires at least: 5.0
 Tested up to: 6.5.2
-Stable tag: 2.5.0
+Stable tag: 2.5.1
 Requires PHP: 7.0
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html

diff --git a/admin/notices/admin-notices.php b/admin/notices/admin-notices.php
@@ -13,7 +13,8 @@ function wk_td_admin_ads()
     <img style="max-width:200px"
         src="<?php echo esc_attr(plugin_dir_url(__FILE__) . '../assets/images/thrivedesk-logo.png'); ?>">
     <p style="font-size:16px">
-        <?php esc_html_e('Your customers deserve better customer support and You deserve the peace of mind. <a href="https://www.thrivedesk.com/?ref=widgetkit"><strong>Try ThriveDesk</strong></a>', 'widgetkit'); ?>
+        <?php esc_html_e('Your customers deserve better customer support and You deserve the peace of mind.', 'widgetkit');?>
+		 <a href="<?php echo esc_url('https://www.thrivedesk.com');?>"><strong>Try ThriveDesk</strong></a>
     </p>
 </div>
 <?php

diff --git a/admin/notices/notice.php b/admin/notices/notice.php
@@ -7,4 +7,4 @@
 	Thank you!',
 
 );
-echo json_encode($notice);
+echo wp_json_encode($notice);
diff --git a/elements/advanced-tab/template/view.php b/elements/advanced-tab/template/view.php
@@ -69,7 +69,7 @@
                     } ?>
                 <?php elseif ('image' == $tab['tabs_content_type']) : ?>
                     <?php if (!empty($tab['tab_image'])) {?>
-                        <img src="<?php esc_url($tab['tab_image']['url']);?>" alt="">
+                        <img src="<?php echo esc_url($tab['tab_image']['url']);?>" alt="">
                         <?php
                     } ?>
                 <?php endif; ?>

diff --git a/elements/animation-text/template/view.php b/elements/animation-text/template/view.php
@@ -1,12 +1,6 @@
 <?php
-// Silence is golden.
-
     $settings = $this->get_settings();
-
-
 ?>
-
-
     <div class="animation-text">
         <div class="text-slide">
             <h2 class="cd-headline <?php if ($settings['choose_animation_text'] == 'rotate') {

diff --git a/elements/carousel/template/view.php b/elements/carousel/template/view.php
@@ -15,16 +15,16 @@
                     <figure class="project-wrap">
                         <div class="project-image" >
                             <?php if($project['project_thumb_image']):?>
-                                <a href="<?php echo esc_attr($project['project_demo_link']); ?>">
-                                    <img src="<?php echo esc_attr($project['project_thumb_image']['url']);?>" alt="<?php echo esc_attr($project['project_title']); ?>">  
+                                <a href="<?php echo esc_url($project['project_demo_link']); ?>">
+                                    <img src="<?php echo esc_url($project['project_thumb_image']['url']);?>" alt="<?php echo esc_attr($project['project_title']); ?>">  
                                 </a>
 
                             <?php endif; ?> 
                         </div>
                         <figcaption class="text-center">
                             <?php if ($project['project_title']): ?>
                                 <h5 class="title">
-                                    <a target="_blank" href="<?php echo esc_attr($project['project_demo_link']); ?>"><?php echo esc_html($project['project_title']); ?>
+                                    <a target="_blank" href="<?php echo esc_url($project['project_demo_link']); ?>"><?php echo esc_html($project['project_title']); ?>
                                     </a> 
                                 </h5>       
                             <?php endif ?>    

diff --git a/elements/content-carousel/template/view.php b/elements/content-carousel/template/view.php
diff --git a/elements/countdown/template/config.php b/elements/countdown/template/config.php
@@ -84,7 +84,7 @@ protected function register_controls() {
 		     	'picker_options'	=> [
 		     		'format' => 'Ym/d H:m:s'
 		     	],
-		     	'default' => date( "Y/m/d H:m:s", strtotime("+ 1 Day") ),
+		     	'default' => gmdate( "Y/m/d H:m:s", strtotime("+ 1 Day") ),
 				'description' => esc_html__( 'Date format is (yyyy/mm/dd). Time format is (hh:mm:ss). Example: 2020-01-01 09:30.', 'widgetkit-for-elementor' )
 		  	]
 		);

diff --git a/elements/gallery/template/view.php b/elements/gallery/template/view.php
@@ -58,12 +58,12 @@
 							<?php if ($galleries['content_position'] == 'overlay'): ?>
 
 					            <?php if ($gallery['gallery_thumb_image']['url']): ?>
-					            	<img src="<?php echo esc_attr($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
+					            	<img src="<?php echo esc_url($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
 					            <?php endif ;?>
 
 					            <div class="wk-padding-small wk-position-absolute wk-position-center wk-text-center wk-gallery-body">
 						               <?php if ($gallery['demo_link']['url']): ?>
-						           		<a href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
+						           		<a href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 						            		<h5 class="wk-text-medium wk-margin-small wk-card-title"> <?php echo esc_html($gallery['gallery_title']);?>
 						            		</h5>
 										</a>
@@ -80,7 +80,7 @@
 						            	<?php if ($galleries['lightcase_enable'] == 'yes' || $galleries['link_enable'] == 'yes'):?>
 							            	<div class="gallery-lightbox wk-text-center">
 							            		<?php if ($galleries['link_enable'] == 'yes'):?>
-									            	<a class="icon" href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
+									            	<a class="icon" href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 									            		<span class="fa fa-link"></span>
 									            	</a>
 								            	<?php endif; ?>
@@ -98,38 +98,38 @@
 									    <?php if ($gallery['gallery_thumb_image']['url']): ?>
 							            	<?php if ($gallery['demo_link']['url']): ?>
 								            	<a class="img-link" href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
-								            		<img src="<?php echo esc_attr($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
+								            		<img src="<?php echo esc_url($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
 								            	</a>
 							            	<?php else: ?>
-							            		<img class="img-link" src="<?php echo esc_attr($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
+							            		<img class="img-link" src="<?php echo esc_url($gallery['gallery_thumb_image']['url']);?>" alt="<?php echo esc_attr($gallery['gallery_title']);?>">
 							            	<?php endif;?>
 							            <?php endif ;?>
 
 						            	<?php if ($galleries['lightcase_enable'] == 'yes' || $galleries['link_enable'] == 'yes'):?>
 							            	<div class="gallery-lightbox wk-text-center wk-position-absolute wk-position-center">
 							            		<?php if ($galleries['link_enable'] == 'yes'): ?>
 							            			 <?php if ($galleries['button_text']): ?>
-										            	<a class="button-text" href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
+										            	<a class="button-text" href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 										            	 	<?php echo esc_html($galleries['button_text']); ?>
 										            	</a>
 										            <?php else: ?>
-										            	<a class="top-icon" href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
+										            	<a class="top-icon" href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 										            	<a class="top-icon" href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 										            	 	<span class="fa fa-link"></span>
 										            	</a>		
 										            <?php endif; ?>
 							            		<?php endif; ?>
 
 								            	<?php if ($galleries['lightcase_enable'] == 'yes'):?>
-													<a class="top-icon" href="<?php echo esc_attr($gallery['gallery_thumb_image']['url']);?>" <?php echo esc_attr($galleries['lightcase_enable']) == 'yes'? ' wk-lightbox="animation:' . esc_attr($light_case_animation) . '"' : '';?>><span class="fa fa-search"></span></a>
+													<a class="top-icon" href="<?php echo esc_url($gallery['gallery_thumb_image']['url']);?>" <?php echo esc_attr($galleries['lightcase_enable']) == 'yes'? ' wk-lightbox="animation:' . esc_attr($light_case_animation) . '"' : '';?>><span class="fa fa-search"></span></a>
 												<?php endif; ?>
 							            	</div>
 						            	<?php endif; ?>
 									</div>
 
 						            <div class="wk-padding-small wk-text-<?php echo esc_attr($galleries['caption_align']);?> wk-gallery-body">
 						               <?php if ($gallery['demo_link']['url']): ?>
-						           		<a href="<?php echo esc_attr($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
+						           		<a href="<?php echo esc_url($gallery['demo_link']['url']); ?>" <?php echo esc_attr($gallery['demo_link']['is_external']) ? 'target="_blank"' : 'nofollow="nofollow"'; ?>>
 						            		<h5 class="wk-text-medium wk-margin-small wk-card-title wk-margin-remove-top"> <?php echo esc_html($gallery['gallery_title']);?>
 						            		</h5>
 										</a>

diff --git a/elements/hover-image/template/view.php b/elements/hover-image/template/view.php
@@ -1,17 +1,15 @@
 <?php
     $settings = $this->get_settings();
 ?>
-
-
     <div class="tgx-hover-image">
         <figure class="<?php echo esc_attr($settings['hover_image_hover_animation']); ?>">
 
             <?php if ($settings['hover_image']):?>
 
                 <div class="hover-image">
                     <?php if ( $settings['select_link_to'] == 'url' ):?>
-                        <a target="<?php  echo esc_attr($settings['hover_image_link']['is_external']) ? '_blank' : '_self'?>" href="<?php echo esc_attr($settings['hover_image_link']['url']);?>">
-                            <img src="<?php echo esc_attr($settings['hover_image']['url']); ?>" alt="hover-image">
+                        <a target="<?php  echo esc_attr($settings['hover_image_link']['is_external']) ? '_blank' : '_self'?>" href="<?php echo esc_url($settings['hover_image_link']['url']);?>">
+                            <img src="<?php echo esc_url($settings['hover_image']['url']); ?>" alt="hover-image">
                             <?php if ($settings['hover_image_caption_title']):?>
 
                                 <figcaption class="image-caption">
@@ -27,8 +25,8 @@
                             <?php endif; ?>
                         </a>
                     <?php else: ?>
-                        <a href="<?php echo esc_attr($settings['hover_image']['url']); ?>" data-elementor-open-lightbox="<?php echo esc_attr($settings['hover_image_lightbox']);?>">
-                            <img src="<?php echo esc_attr($settings['hover_image']['url']); ?>" alt="hover-image">
+                        <a href="<?php echo esc_url($settings['hover_image']['url']); ?>" data-elementor-open-lightbox="<?php echo esc_attr($settings['hover_image_lightbox']);?>">
+                            <img src="<?php echo esc_url($settings['hover_image']['url']); ?>" alt="hover-image">
                             <?php if ($settings['hover_image_caption_title']):?>
 
                                 <figcaption class="image-caption">

diff --git a/elements/image-compare/template/view.php b/elements/image-compare/template/view.php
@@ -6,8 +6,8 @@
          <div class="row">
             <div id="image-compare-<?php echo esc_attr($id); ?>" class="image-compare-container">
 
-                <img src="<?php echo esc_attr($image_compare['before_image']['url']); ?>" alt="before">
-                <img src="<?php echo esc_attr($image_compare['after_image']['url']); ?>" alt="After">
+                <img src="<?php echo esc_url($image_compare['before_image']['url']); ?>" alt="before">
+                <img src="<?php echo esc_url($image_compare['after_image']['url']); ?>" alt="After">
             </div>
         </div>
     </div>

diff --git a/elements/image-feature/template/view.php b/elements/image-feature/template/view.php
@@ -1,13 +1,8 @@
 <?php
 // Silence is golden.
     use Elementor\Icons_Manager;
-
     $settings = $this->get_settings();
-
 ?>
-
-
-
     <div class="tgx-image-feature">               
         <!-- feature Start -->
         <div class="block drop-shadow ">
@@ -22,7 +17,7 @@
                             rel="nofollow" 
                         <?php endif; ?>
 
-                        href="<?php echo esc_attr($settings['feature_link']['url']);?>"> 
+                        href="<?php echo esc_url($settings['feature_link']['url']);?>"> 
                             <h4 class="feature-title"><?php echo esc_html($settings['feature_title']); ?></h4>
                         </a>
                     <?php else: ?>
@@ -36,7 +31,7 @@
 
                     <?php if ($settings['choose_media'] == 'image'): ?>
                         <?php if( $settings['feature_image']['url']):?>
-                            <img src="<?php echo esc_attr($settings['feature_image']['url']); ?>" alt="<?php the_title(); ?>"> 
+                            <img src="<?php echo esc_url($settings['feature_image']['url']); ?>" alt="<?php the_title(); ?>"> 
                         <?php endif; ?>
 
                     <?php else: ?>
@@ -56,7 +51,7 @@
                     <?php if ($settings['choose_media'] == 'image'): ?>
 
                         <?php if( $settings['feature_image']['url']):?>
-                            <img class= "tgx-media" src="<?php echo esc_attr($settings['feature_image']['url']); ?>" alt="<?php the_title(); ?>"> 
+                            <img class= "tgx-media" src="<?php echo esc_url($settings['feature_image']['url']); ?>" alt="<?php the_title(); ?>"> 
                         <?php endif; ?>
 
                     <?php else: ?>
@@ -82,7 +77,7 @@
                         <?php else: ?>
                             rel="nofollow" 
                         <?php endif; ?>
-                        href="<?php echo esc_attr($settings['feature_link']['url']);?>"> 
+                        href="<?php echo esc_url($settings['feature_link']['url']);?>"> 
                             <h4 class="feature-title"><?php echo esc_html($settings['feature_title']); ?></h4>
                         </a>
                     <?php else: ?>

diff --git a/elements/portfolio/template/view.php b/elements/portfolio/template/view.php
@@ -178,7 +178,7 @@
                                     <div class="portfolio-btn text-center">
                                         <?php if($portfolio['portfolio_full_image']):?>
                                             <a class="icon-search" 
-                                                href="<?php echo esc_html($portfolio['portfolio_full_image']['url']);?>">
+                                                href="<?php echo esc_url($portfolio['portfolio_full_image']['url']);?>">
                                                 <i class='fa fa-plus'></i>
                                             </a>
                                         <?php endif; ?>

diff --git a/elements/pricing-1/template/view.php b/elements/pricing-1/template/view.php
@@ -50,7 +50,7 @@
 
                 <?php if ($settings['discount_price_switcher'] == 'yes'): ?>
                     <?php if ($settings['discount_price'] && $settings['currency_position'] == 'before') : ?>
-                        <del><span class="tgx-price-table__discount-currency"><span><?php echo esc_attr($symbol); ?></span></span><span class="tgx-price-table__discount-part"><span><?php echo esc_attr($settings['discount_price']); ?></span></span></del>
+                        <del><span class="tgx-price-table__discount-currency"><span><?php echo esc_attr($symbol); ?></span></span><span class="tgx-price-table__discount-part"><span><?php echo esc_html($settings['discount_price']); ?></span></span></del>
                     <?php endif; ?>
 
                 <?php endif ;?>
@@ -61,21 +61,20 @@
                 <?php endif; ?>
 
                 <?php if ( ! empty( $settings['price'] ) ) : ?>
-                    <span class="tgx-price-table__integer-part"><span><?php echo esc_attr($settings['price']); ?></span></span>
+                    <span class="tgx-price-table__integer-part"><span><?php echo esc_html($settings['price']); ?></span></span>
                 <?php endif; ?>
 
                 <?php if ($settings['discount_price_switcher'] == 'yes'): ?>
                     <?php if ($settings['discount_price'] && $settings['currency_position'] == 'after') : ?>
-                        <del><span class="tgx-price-table__discount-currency"><span><?php echo esc_attr($symbol); ?></span></span><span class="tgx-price-table__discount-part"><span><?php echo esc_attr($settings['discount_price']); ?></span></span></del>
+                        <del><span class="tgx-price-table__discount-currency"><span><?php echo esc_attr($symbol); ?></span></span><span class="tgx-price-table__discount-part"><span><?php echo esc_html($settings['discount_price']); ?></span></span></del>
                     <?php endif; ?>
 
                 <?php endif ;?>
 
 
                 <?php if ( ! empty( $settings['period'] ) ) : ?>
-                    <span class="tgx-price-table__period"><span><?php echo esc_attr($settings['period']); ?></span></span>
+                    <span class="tgx-price-table__period"><span><?php echo esc_html($settings['period']); ?></span></span>
                 <?php endif; ?>
-
             </div>
 
             <?php if ( $settings['title_position'] == 'bottom' ) : ?>

diff --git a/elements/pricing-2/template/view.php b/elements/pricing-2/template/view.php
@@ -29,7 +29,7 @@
 
                       <?php if ( ! empty( $settings['pricing_2_icon_image']['url'] ) ) : ?>
                           <div class="tgx-single-image">
-                            <img src="<?php echo esc_attr($settings['pricing_2_icon_image']['url']); ?>" alt="<?php echo esc_attr($settings['pricing_2_pricing_title']); ?>" />
+                            <img src="<?php echo esc_url($settings['pricing_2_icon_image']['url']); ?>" alt="<?php echo esc_attr($settings['pricing_2_pricing_title']); ?>" />
                           </div><!-- .table-image -->
                       <?php endif; ?>
                 </div> <!-- .tx-table-heading -->
@@ -72,7 +72,7 @@
 
         <?php if ( ! empty( $settings['single_button_text'] ) ) : ?>
             <div class="tgx-single-footer"> 
-                <a class="tgx-single-btn" href="<?php echo esc_attr($settings['single_link']['url']); ?>">
+                <a class="tgx-single-btn" href="<?php echo esc_url($settings['single_link']['url']); ?>">
                     <?php echo esc_html($settings['single_button_text']); ?>
                 </a> 
             </div><!-- .tgx-single-footer -->