kate522/wordpress-theme-aksrt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(vip): preserve safe HTML in VIP copy

Browse Source 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kate522andClaude Opus 5 committed 2026-10-19 12:52:23 +08:00
1 parent 7a0445fc4a
commit 573040381d
15 files changed
+155 -118
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

inc/helpers/user-center-renderers/sidebar-vip.php
+4 -4
View File
@@ -29,7 +29,7 @@ if ($status === '') {
}
if ($vip_level > 0) {
$title = (string) ($vip_levels[$vip_level]['name'] ?? ('VIP' . $vip_level));
$title = (string) ($vip_levels[$vip_level]['name_html'] ?? $vip_levels[$vip_level]['name'] ?? ('VIP' . $vip_level));
if ($expires <= 0 && ($vip_state['source'] ?? 'none') !== 'order') {
$status = __('永久会员', 'aksrt');
} else {
@@ -41,7 +41,7 @@ if ($vip_level > 0) {
);
}
} elseif ($expired_level > 0) {
$title = (string) ($vip_levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$title = (string) ($vip_levels[$expired_level]['name_html'] ?? $vip_levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$status = __('已过期', 'aksrt');
}
@@ -55,8 +55,8 @@ $sidebar_arrow = aksrt_icon_markup('zibsvg-right', 'uc-sidebar-vip__arrow');
<a class="uc-sidebar-vip" href="<?php echo esc_url($vip_url); ?>" data-tab="vip">
<span class="uc-sidebar-vip__icon"><?php echo $sidebar_icon; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></span>
<span class="uc-sidebar-vip__content">
<strong><?php echo esc_html($title); ?></strong>
<small><?php echo esc_html($status); ?></small>
<strong><?php echo wp_kses_post($title); ?></strong>
<small><?php echo wp_kses_post($status); ?></small>
</span>
<?php echo $sidebar_arrow; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
</a>
inc/helpers/user-center-renderers/vip-tab.php
+14 -14
View File
@@ -46,7 +46,7 @@ $btn_type = 'pay';
if ($level > 0) {
$vip_level_number = $level;
$vip_level_name = (string) ($levels[$level]['name'] ?? ('VIP' . $level));
$vip_level_name = (string) ($levels[$level]['name_html'] ?? $levels[$level]['name'] ?? ('VIP' . $level));
$level_desc = (string) ($levels[$level]['desc'] ?? '');
$vip_description = $level_desc !== '' ? $level_desc : __('尊享专属特权', 'aksrt');
@@ -63,7 +63,7 @@ if ($level > 0) {
$vip_state_label = __('生效中', 'aksrt');
$vip_expiry_text = sprintf(__('到期时间：%s', 'aksrt'), wp_date('Y年m月d日', $expires));
if ($base_level > 0 && $base_level < $level) {
$base_name = (string) ($levels[$base_level]['name'] ?? ('VIP' . $base_level));
$base_name = wp_strip_all_tags((string) ($levels[$base_level]['name'] ?? ('VIP' . $base_level)));
$base_expiry_text = $base_expires > 0
? wp_date('Y年m月d日', $base_expires)
: __('永久', 'aksrt');
@@ -75,7 +75,7 @@ if ($level > 0) {
$vip_state = 'expired';
$vip_state_label = __('已过期', 'aksrt');
$vip_level_number = $expired_level;
$vip_level_name = (string) ($levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$vip_level_name = (string) ($levels[$expired_level]['name_html'] ?? $levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$expired_desc = (string) ($levels[$expired_level]['desc'] ?? '');
$vip_description = $expired_desc !== ''
? $expired_desc
@@ -97,9 +97,9 @@ $status_html = '<div class="uc-vip-status" role="status">'
. '<div class="uc-vip-status__main uc-vip-status__main--level-' . (int) $vip_level_number . '">'
// 未开通（level 0）不输出图标位：名称前不放通用证书图标。
. ($vip_level_number > 0 ? '<span class="uc-vip-status__icon" aria-hidden="true">' . $status_icon . '</span>' : '')
. '<span class="uc-vip-status__level">' . esc_html($vip_level_name) . '</span>'
. '<span class="uc-vip-status__level">' . wp_kses_post($vip_level_name) . '</span>'
. '</div>'
. '<div class="uc-vip-status__desc">' . esc_html($vip_description) . '</div>'
. '<div class="uc-vip-status__desc">' . wp_kses_post($vip_description) . '</div>'
. ($vip_expiry_text !== '' ? '<div class="uc-vip-status__expiry"><i class="fa fas fa-clock" aria-hidden="true"></i><span>' . esc_html($vip_expiry_text) . '</span></div>' : '')
. '</div>';
@@ -109,14 +109,14 @@ foreach ([1, 2] as $lv) {
if (empty($levels[$lv]['enabled'])) {
continue;
}
$lv_name = (string) ($levels[$lv]['name'] ?? ('VIP' . $lv));
$lv_name = (string) ($levels[$lv]['name_html'] ?? $levels[$lv]['name'] ?? ('VIP' . $lv));
$lv_desc = (string) ($levels[$lv]['desc'] ?? '');
// Preserve admin equity HTML as-is (sanitize/wrap only; never re-split into items).
$equity_raw = (string) ($levels[$lv]['equity'] ?? '');
$equity = function_exists('aksrt_format_vip_equity_html')
? aksrt_format_vip_equity_html($equity_raw)
: '';
$cta = sprintf(__('开通%s', 'aksrt'), $lv_name);
$cta = __('开通', 'aksrt') . wp_kses_post($lv_name);
$vip_attr = $lv;
// 参考主题 zibpay_get_vip_card：续费/升级档位卡展示各自的一句话简介。
$card_action = 'pay';
@@ -128,10 +128,10 @@ foreach ([1, 2] as $lv) {
if (str_starts_with($btn_type, 'renew_')) {
$renew_lv = (int) substr($btn_type, 6);
if ($lv === $renew_lv) {
$cta = sprintf(__('续费%s', 'aksrt'), $lv_name);
$cta = __('续费', 'aksrt') . wp_kses_post($lv_name);
$card_action = 'renew';
} elseif ($lv > $renew_lv) {
$cta = sprintf(__('升级%s', 'aksrt'), $lv_name);
$cta = __('升级', 'aksrt') . wp_kses_post($lv_name);
$card_action = 'upgrade';
} else {
continue;
@@ -140,13 +140,13 @@ foreach ([1, 2] as $lv) {
if ($lv <= $level) {
continue;
}
$cta = sprintf(__('升级%s', 'aksrt'), $lv_name);
$cta = __('升级', 'aksrt') . wp_kses_post($lv_name);
$card_action = 'upgrade';
$vip_attr = 2;
} elseif ($level > 0 && $lv < $level) {
continue;
} elseif ($level > 0 && $lv === $level) {
$cta = sprintf(__('续费%s', 'aksrt'), $lv_name);
$cta = __('续费', 'aksrt') . wp_kses_post($lv_name);
$card_action = 'renew';
}
if ($card_action === 'renew' && $renew_desc !== '') {
@@ -158,14 +158,14 @@ foreach ([1, 2] as $lv) {
$cards .= '<div class="aksrt-panel text-center pay-vip-info flex1 level-' . $lv . ' uc-vip-level-card">';
$cards .= '<div class="relative uc-vip-level-card__inner">';
$cards .= '<div class="v-iconbox mb10">';
$cards .= '<div class="v-name font-bold"><span class="v-icon">' . $lv_icon . '</span>' . esc_html($lv_name) . '</div>';
$cards .= '<div class="v-name font-bold"><span class="v-icon">' . $lv_icon . '</span>' . wp_kses_post($lv_name) . '</div>';
if ($card_desc !== '') {
$cards .= '<div class="v-desc em09 muted-2-color">' . esc_html($card_desc) . '</div>';
$cards .= '<div class="v-desc em09 muted-2-color">' . wp_kses_post($card_desc) . '</div>';
}
$cards .= '</div>';
$cards .= $equity;
$cards .= '<a class="padding-lg but jb-vip' . $lv . ' radius pay-vip uc-vip-cta" href="javascript:;" vip-level="' . (int) $vip_attr . '">'
. '<span>' . esc_html($cta) . '</span>'
. '<span>' . $cta . '</span>'
. ' <i class="fa fas fa-chevron-circle-right" aria-hidden="true"></i></a>';
$cards .= '</div></div>';
}