From 9bdca7944f9e6c0fbdbf189302632e90b83dfa85 Mon Sep 17 00:00:00 2001
From: Robin Cornett <hello@robincornett.com>
Date: Thu, 7 May 2015 20:36:35 -0400
Subject: [PATCH] escape more things #WWGJD

---
 includes/class-displayfeaturedimagegenesis-admin.php   | 10 ++++++++--
 includes/class-displayfeaturedimagegenesis-output.php  |  2 +-
 includes/class-displayfeaturedimagegenesis-rss.php     |  2 +-
 .../class-displayfeaturedimagegenesis-settings.php     |  2 +-
 .../class-displayfeaturedimagegenesis-taxonomies.php   |  4 ++--
 includes/helper-functions.php                          |  5 +++--
 6 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/includes/class-displayfeaturedimagegenesis-admin.php b/includes/class-displayfeaturedimagegenesis-admin.php
index 8e70353..4d0d925 100644
--- a/includes/class-displayfeaturedimagegenesis-admin.php
+++ b/includes/class-displayfeaturedimagegenesis-admin.php
@@ -113,7 +113,10 @@ class Display_Featured_Image_Genesis_Admin {
 			$id
 		);
 
-		echo '<img src="' . esc_url( $preview[0] ) . '" alt="' . esc_attr( $alt ) . '" />';
+		printf( '<img src="%1$s" alt="%2$s" />',
+			esc_url( $preview[0] ),
+			esc_attr( $alt )
+		);
 
 	}
 
@@ -141,7 +144,10 @@ class Display_Featured_Image_Genesis_Admin {
 			wp_get_attachment_image_src( $id, 'thumbnail' ),
 			$id
 		);
-		echo '<img src="' . esc_url( $preview[0] ) . '" alt="' . esc_attr( the_title_attribute( 'echo=0' ) ) . '" />';
+		printf( '<img src="%1$s" alt="%2$s" />',
+			esc_url( $preview[0] ),
+			esc_attr( the_title_attribute( 'echo=0' ) )
+		);
 
 	}
 
diff --git a/includes/class-displayfeaturedimagegenesis-output.php b/includes/class-displayfeaturedimagegenesis-output.php
index c265e5a..da752f3 100644
--- a/includes/class-displayfeaturedimagegenesis-output.php
+++ b/includes/class-displayfeaturedimagegenesis-output.php
@@ -250,7 +250,7 @@ class Display_Featured_Image_Genesis_Output {
 			esc_attr( $item->title )
 		);
 
-		echo apply_filters( 'display_featured_image_genesis_large_image_output', $image );
+		echo apply_filters( 'display_featured_image_genesis_large_image_output', wp_kses_post( $image ) );
 	}
 
 	/**
diff --git a/includes/class-displayfeaturedimagegenesis-rss.php b/includes/class-displayfeaturedimagegenesis-rss.php
index 205b84f..dcd4cc0 100644
--- a/includes/class-displayfeaturedimagegenesis-rss.php
+++ b/includes/class-displayfeaturedimagegenesis-rss.php
@@ -100,7 +100,7 @@ class Display_Featured_Image_Genesis_RSS {
 
 		// whew. build the image!
 		$image   = get_the_post_thumbnail( get_the_ID(), $size, array( 'align' => $align, 'style' => $style, 'class' => $class ) );
-		$image   = apply_filters( 'display_featured_image_genesis_modify_rss_image', $image );
+		$image   = apply_filters( 'display_featured_image_genesis_modify_rss_image', wp_kses_post( $image ) );
 
 		return $image . $content;
 
diff --git a/includes/class-displayfeaturedimagegenesis-settings.php b/includes/class-displayfeaturedimagegenesis-settings.php
index dbad8b2..999728c 100644
--- a/includes/class-displayfeaturedimagegenesis-settings.php
+++ b/includes/class-displayfeaturedimagegenesis-settings.php
@@ -232,7 +232,7 @@ class Display_Featured_Image_Genesis_Settings {
 			}
 			$preview = wp_get_attachment_image_src( absint( $id ), 'medium' );
 			echo '<div id="upload_logo_preview">';
-			echo '<img src="' . esc_url( $preview[0] ) . '" />';
+			printf( '<img src="%s" />', esc_url( $preview[0] ) );
 			echo '</div>';
 		}
 		echo '<input type="hidden" class="upload_image_id" id="displayfeaturedimagegenesis[default]" name="displayfeaturedimagegenesis[default]" value="' . absint( $id ) . '" />';
diff --git a/includes/class-displayfeaturedimagegenesis-taxonomies.php b/includes/class-displayfeaturedimagegenesis-taxonomies.php
index bf31753..4e3f248 100644
--- a/includes/class-displayfeaturedimagegenesis-taxonomies.php
+++ b/includes/class-displayfeaturedimagegenesis-taxonomies.php
@@ -26,7 +26,7 @@ class Display_Featured_Image_Genesis_Taxonomies {
 				__( 'Delete Image', 'display-featured-image-genesis' )
 			);
 			echo '<p class="description">';
-			printf( __( 'Set Featured Image for new term.','display-featured-image-genesis' ) );
+			printf( __( 'Set Featured Image for new term.', 'display-featured-image-genesis' ) );
 			echo '</p>';
 		echo '</div>';
 
@@ -59,7 +59,7 @@ class Display_Featured_Image_Genesis_Taxonomies {
 					}
 					$preview = wp_get_attachment_image_src( absint( $id ), 'medium' );
 					echo '<div id="upload_logo_preview">';
-					echo '<img src="' . esc_url( $preview[0] ) . '" width="300" />';
+					printf( '<img src="%s" width="300" />', esc_url( $preview[0] ) );
 					echo '</div>';
 				}
 				echo '<input type="hidden" class="upload_image_id" id="term_image_id" name="displayfeaturedimagegenesis[term_image]" value="' . absint( $id ) . '" />';
diff --git a/includes/helper-functions.php b/includes/helper-functions.php
index 8cdf599..b953a7e 100644
--- a/includes/helper-functions.php
+++ b/includes/helper-functions.php
@@ -16,10 +16,11 @@
  * @since  2.1.0
  */
 function display_featured_image_genesis_get_term_image_id() {
+
+	$image_id   = '';
 	$taxonomies = get_taxonomies();
 	$args       = array( 'orderby' => 'count', 'order' => 'DESC' );
 	$terms      = wp_get_object_terms( get_the_ID(), $taxonomies, $args );
-	$image_id   = '';
 
 	foreach ( $terms as $term ) {
 		$t_id      = $term->term_id;
@@ -192,7 +193,7 @@ function display_featured_image_genesis_add_archive_thumbnails() {
 	$permalink = get_permalink();
 	printf( '<a href="%1$s" aria-hidden="true">%2$s</a>',
 		esc_url( $permalink ),
-		$image
+		wp_kses_post( $image )
 	);
 
 }