Fix: Logs: Correctly escape search and form action

Author: n7studios

_modules/dashboard/views/import-export.php

@@ -32,7 +32,7 @@
     		</a>
 		</h2>
 
-		<form name="post" method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>" id="<?php echo $this->plugin->name; ?>" enctype="multipart/form-data">
+		<form name="post" method="post" action="<?php echo esc_attr( $_SERVER['REQUEST_URI'] ); ?>" id="<?php echo $this->plugin->name; ?>" enctype="multipart/form-data">
 			<div id="poststuff">
 		    	<div id="post-body" class="metabox-holder columns-1">
 		    		<!-- Content -->

readme.txt

@@ -137,6 +137,9 @@ To auto post to Instagram and/or Pinterest, [Upgrade to WordPress to Buffer Pro]
 
 == Changelog ==
 
+= 3.7.5 (2021-09-17) =
+* Fix: Logs: Correctly escape search and form action
+
 = 3.7.4 (2021-09-16) =
 * Fix: PHP Deprecated notices in PHP 8
 

vendor/views/log.php

@@ -11,12 +11,12 @@
     // Search Subtitle
     if ( isset( $_REQUEST['s'] ) && ! empty( $_REQUEST['s'] ) ) {
         ?>
-        <span class="subtitle left"><?php _e( 'Search results for', 'page-generator-pro' ); ?> &#8220;<?php echo urldecode( $_REQUEST['s'] ); ?>&#8221;</span>
+        <span class="subtitle left"><?php _e( 'Search results for', 'page-generator-pro' ); ?> &#8220;<?php echo esc_html( urldecode( $_REQUEST['s'] ) ); ?>&#8221;</span>
         <?php
     }
     ?>
 
-    <form action="admin.php?page=<?php echo sanitize_text_field( $_REQUEST['page'] ); ?>" method="post" id="posts-filter">
+    <form action="admin.php?page=<?php echo esc_attr( $_REQUEST['page'] ); ?>" method="post" id="posts-filter">
         <?php   
         // Output Search Box
         $table->search_box( __( 'Search' ), 'wp-to-social-log' );

vendor/views/settings.php

@@ -90,7 +90,7 @@
 	    <div id="poststuff">
 	    	<div id="post-body" class="metabox-holder columns-2">
 	    		<!-- Content -->
-	    		<form name="post" method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>" id="<?php echo $this->base->plugin->name; ?>" class="wp-to-social-pro">	
+	    		<form name="post" method="post" action="<?php echo esc_attr( $_SERVER['REQUEST_URI'] ); ?>" id="<?php echo $this->base->plugin->name; ?>" class="wp-to-social-pro">	
 		    		<div id="post-body-content">
 			            <div id="normal-sortables" class="meta-box-sortables ui-sortable publishing-defaults">  
 			            	<?php

wp-to-buffer.php

@@ -2,7 +2,7 @@
 /**
 * Plugin Name: WP to Buffer
 * Plugin URI: http://www.wpzinc.com/plugins/wp-to-buffer-pro
-* Version: 3.7.4
+* Version: 3.7.5
 * Author: WP Zinc
 * Author URI: http://www.wpzinc.com
 * Description: Send WordPress Pages, Posts or Custom Post Types to your Buffer (buffer.com) account for scheduled publishing to social networks.
@@ -74,8 +74,8 @@ public function __construct() {
 
         $this->plugin->settingsName     = 'wp-to-buffer-pro'; // Settings key - used in both Free + Pro, and for oAuth
         $this->plugin->account          = 'Buffer';
-        $this->plugin->version          = '3.7.4';
-        $this->plugin->buildDate        = '2021-09-16 18:00:00';
+        $this->plugin->version          = '3.7.5';
+        $this->plugin->buildDate        = '2021-09-17 18:00:00';
         $this->plugin->requires         = '5.0';
         $this->plugin->tested           = '5.8.1';
         $this->plugin->folder           = plugin_dir_path( __FILE__ );