fix_domain_and_links.ag

inc/spbc-settings.php

@@ -1,5 +1,6 @@
 <?php
 
+use CleantalkSP\Common\TextPlateStatic;
 use CleantalkSP\Security\LoginCollectingProtector;
 use CleantalkSP\SpbctWP\AdjustToEnvironmentModule\AdjustToEnvironmentSettings;
 use CleantalkSP\SpbctWP\API;
@@ -2098,23 +2099,27 @@ function spbc_field_security_logs__prepare_data(&$table)
                     $event .= $is_add_time ? $time : '';
                     break;
                 case 'editing_post_id':
+                    $post_id_prepared = esc_html(get_the_title($parse_action['post_id']));
+                    $post_action_prepared = !empty($parse_action['page_action']) && is_string($parse_action['page_action'])
+                        ? esc_html($parse_action['page_action'])
+                        : '';
                     $event =  sprintf(
                         __('Editing post %s', 'security-malware-firewall'),
-                        '"' . get_the_title($parse_action['post_id']) . '"' . $parse_action['page_action']
+                        '"' . $post_id_prepared . '"' . $post_action_prepared
                     );
                     $event .= $is_add_time ? $time : '';
                     break;
                 case 'activate_plugin':
                     $event = sprintf(
                         __('Activate plugin %s', 'security-malware-firewall'),
-                        '"' . $parse_action['plugin_name'] . '"'
+                        '"' . esc_html($parse_action['plugin_name']) . '"'
                     );
                     $event .= $is_add_time ? $time : '';
                     break;
                 case 'deact_plugin':
                     $event = sprintf(
                         __('Deactivate plugin %s', 'security-malware-firewall'),
-                        '"' . $parse_action['plugin_name'] . '"'
+                        '"' . esc_html($parse_action['plugin_name']) . '"'
                     );
                     $event .= $is_add_time ? $time : '';
                     break;
@@ -2744,12 +2749,20 @@ function spbc_field_scanner__prepare_data__domains(&$table)
     if ($table->items_count) {
         $num = $table->sql['offset'] + 1;
         foreach ($table->rows as $row) {
+            $_text = "<a href={{href}} target='_blank'>{{href_text}}</a>";
+            $domain = TextPlateStatic::render(
+                $_text,
+                [
+                    'href' => esc_url($row->domain),
+                    'href_text' => esc_html($row->domain),
+                ]
+            );
             $table->items[] = array(
                 'num'         => $num++,
-                'uid'         => $row->domain,
-                'domain'      => "<a href='{$row->domain}' target='_blank'>{$row->domain}</a>",
+                'uid'         => esc_html($row->domain),
+                'domain'      => $domain,
                 'spam_active' => isset($row->spam_active) ? ($row->spam_active ? 'Yes' : 'No') : 'Unknown',
-                'page_url'    => $row->page_url,
+                'page_url'    => esc_url($row->page_url),
                 'link_count'  => htmlspecialchars($row->link_count),
                 'actions'     => $row->actions,
             );
@@ -2761,10 +2774,25 @@ function spbc_field_scanner__prepare_data__links(&$table)
 {
     if ($table->items_count) {
         foreach ($table->rows as $row) {
+            $_text = "<a href={{href}} target='_blank'>{{href_text}}</a>";
+            $link = TextPlateStatic::render(
+                $_text,
+                [
+                    'href' => esc_url($row->link),
+                    'href_text' => esc_html($row->link),
+                ]
+            );
+            $page_url = TextPlateStatic::render(
+                $_text,
+                [
+                    'href' => esc_url($row->page_url),
+                    'href_text' => esc_html($row->page_url),
+                ]
+            );
             $table->items[] = array(
                 'link_id'     => $row->link_id,
-                'link'        => "<a href='{$row->link}' target='_blank'>{$row->link}</a>",
-                'page_url'    => "<a href='{$row->page_url}' target='_blank'>{$row->page_url}</a>",
+                'link'        => $link,
+                'page_url'    => $page_url,
                 'link_text'   => htmlspecialchars($row->link_text),
             );
         }

lib/CleantalkSP/Common/TextPlateStatic.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace CleantalkSP\Common;
+
+class TextPlateStatic
+{
+    use TextPlate;
+
+    /**
+     * @param string $_text
+     * @param array $_plate
+     * @param bool $trim
+     * @return string
+     */
+    public static function render(string $_text, array $_plate, bool $trim = true): string
+    {
+        return static::textPlateRender($_text, $_plate, $trim);
+    }
+}