#133 Fix eror from plugin checker

README.md

@@ -2,11 +2,11 @@
 
 Contributors: Takahashi_Fumiki, hametuha  
 Tags: facebook,twitter,google,account,oauth,community,social,sns  
-Tested up to: 6.2  
-Stable Tag: 5.0.0  
-Requires at least: 5.6  
+Tested up to: 6.6  
+Stable Tag: 5.2.0  
+Requires at least: 5.9  
 Requires PHP: 7.2  
-License: GPL 2.0 or later  
+License:  GPL2 or Later  
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
 Connect user accounts with significant web services like Facebook, Twitter, etc. Stand on the shoulders of giants!
@@ -96,4 +96,4 @@ Here is a list of change logs.
 
 ----
 
-Please refer [changelog.md](https://github.com/fumikito/Gianism/blob/master/changelog.md) for older change logs, 
+Please refer [changelog.md](https://github.com/fumikito/Gianism/blob/master/changelog.md) for older change logs, 

app/Gianism/Controller/Admin.php

@@ -109,7 +109,7 @@ public function invalid_option_notices() {
 			return;
 		}
 		array_unshift( $this->invalid_options, '<strong>[Gianism]</strong>' );
-		printf( '<div class="error"><p>%s</p></div>', implode( '<br />', $this->invalid_options ) );
+		printf( '<div class="error"><p>%s</p></div>', wp_kses_post( implode( '<br />', $this->invalid_options ) ) );
 	}
 
 	/**

app/Gianism/Pattern/AbstractNotice.php

@@ -140,8 +140,8 @@ public function invalid_option_notices() {
 		?>
 		<div class="error" style="position: relative;">
 			<p>
-			<button data-endpoint="<?php echo esc_url( $endpoint ); ?>" class="gianism-admin-notice notice-dismiss"></button>
-				<?php echo $this->message(); ?>
+				<button data-endpoint="<?php echo esc_url( $endpoint ); ?>" class="gianism-admin-notice notice-dismiss"></button>
+				<?php echo wp_kses_post( $this->message() ); ?>
 			</p>
 		</div>
 		<?php

app/Gianism/Plugins/Bot.php

@@ -408,7 +408,7 @@ public function custom_columns( $column_name, $post_id ) {
 			case 'end_date':
 				$limit = $this->cron_limit( $post_id );
 				if ( preg_match( '/[0-9]{4}-[0-9]{2}-[0-9]{2}/u', $limit ) ) {
-					echo mysql2date( $this->option->get( 'date_format' ), $limit . ' 00:00:00' );
+					echo esc_html( mysql2date( $this->option->get( 'date_format' ), $limit . ' 00:00:00' ) );
 				} else {
 					echo '---';
 				}

app/Gianism/Service/Facebook.php

@@ -302,7 +302,7 @@ protected function handle_default( $action ) {
 							$wpdb->users,
 							[
 								'display_name' => $user['name'],
-							//                              'user_url'     => $user['link'], // Deprecated because of REST API 3 udpdate: https://developers.facebook.com/blog/post/2018/05/01/enhanced-developer-app-review-and-graph-api-3.0-now-live/
+								// 'user_url'     => $user['link'], // Deprecated because of REST API 3 udpdate: https://developers.facebook.com/blog/post/2018/05/01/enhanced-developer-app-review-and-graph-api-3.0-now-live/
 							],
 							[
 								'ID' => $user_id,

app/Gianism/UI/Screen.php

@@ -115,7 +115,10 @@ protected function load_template( $name ) {
 		} else {
 			printf(
 				'<div class="gianism-load-error">%s</div>',
-				sprintf( $this->_( 'Template file <code>%s</code> is missing.' ), esc_html( $name ) )
+				wp_kses_post( sprintf(
+					__( 'Template file <code>%s</code> is missing.', 'wp-gianism' ),
+					esc_html( $name )
+				) )
 			);
 		}
 		/**

templates/advanced.php

@@ -84,7 +84,14 @@ function my_facebook_auth( $facebook, $args $token ) {
 ?>
 </pre>
 
-<p class="notice"><?php printf( $this->_( '<strong>Note:</strong> <code>$facebook</code> object is instance of Facebook class which is part of Facebook PHP SDK. To know what you can do with it, read the <a href="%s">documentation</a>.' ), 'https://developers.facebook.com/docs/reference/php/' ); ?></p>
+<p class="notice">
+	<?php
+	echo wp_kses_post( sprintf(
+		// translators: %s is URL.
+	__( '<strong>Note:</strong> <code>$facebook</code> object is instance of Facebook class which is part of Facebook PHP SDK. To know what you can do with it, read the <a href="%s">documentation</a>.', 'wp-gianism' ),
+	'https://developers.facebook.com/docs/reference/php/'
+	) ); ?>
+</p>
 
 
 <h3><?php $this->e( 'Make tweet with your account' ); ?></h3>

templates/setting.php

@@ -19,10 +19,10 @@
 				<p>
 					<?php if ( $this->option->user_can_register() ) : ?>
 						<i class="lsf lsf-check" style="color: green; font-size: 1.4em;"></i>
-						<strong><?php _e( 'User can register account.', 'wp-gianism' ); ?></strong>
+						<strong><?php esc_html_e( 'User can register account.', 'wp-gianism' ); ?></strong>
 					<?php else : ?>
 						<i class="lsf lsf-ban" style="color: lightgrey; font-size: 1.4em;"></i>
-						<strong><?php _e( 'User can\'t register account.', 'wp-gianism' ); ?></strong>
+						<strong><?php esc_html_e( 'User can\'t register account.', 'wp-gianism' ); ?></strong>
 					<?php endif; ?>
 				</p>
 				<p>
@@ -76,7 +76,7 @@
 			<td>
 				<select name="button_type" id="button_type">
 					<?php foreach ( $this->option->button_types() as $index => $value ) : ?>
-						<option value="<?php echo $index; ?>"<?php selected( $this->option->button_type, $index ); ?>>
+						<option value="<?php echo esc_attr( $index ); ?>"<?php selected( $this->option->button_type, $index ); ?>>
 							<?php echo esc_html( $value ); ?>
 						</option>
 					<?php endforeach; ?>

templates/setting/facebook.php

@@ -12,16 +12,18 @@
 			<?php $this->switch_button( 'fb_enabled', $this->option->is_enabled( 'facebook' ), 1 ); ?>
 			<p class="description">
 				<?php
-				printf(
-					$this->_( 'You have to create %1$s App <a target="_blank" href="%2$s">here</a> to get required infomation.' ),
+				echo wp_kses_post( sprintf(
+					// translators: %1$s is service name, %2$s is URL.
+					__( 'You have to create %1$s App <a target="_blank" href="%2$s">here</a> to get required infomation.', 'wp-gianism' ),
 					'Facebook',
 					'https://developers.facebook.com/apps'
-				);
-				printf(
-					$this->_( 'See detail at <a href="%1$s">%2$s</a>.' ),
-					$this->setting_url( 'setup' ),
-					$this->_( 'How to set up' )
-				);
+				) );
+				echo wp_kses_post( sprintf(
+					// translators: %1$s is URL, %2$s is label.
+					__( 'See detail at <a href="%1$s">%2$s</a>.', 'wp-gianism' ),
+					esc_url( $this->setting_url( 'setup' ) ),
+					esc_html__( 'How to set up', 'wp-gianism' )
+				) );
 				?>
 			</p>
 		</td>
@@ -86,12 +88,17 @@
 			<p class="description">
 				<?php
 				$this->new_from( '2.2' );
-				$this->e( 'If enabled, you can get Facebook API Token for this site.' );
+				esc_html_e( 'If enabled, you can get Facebook API Token for this site.', 'wp-gianism' );
 				?>
 			</p>
 			<?php if ( $instance->fb_use_api ) : ?>
 				<p class="notice">
-					<?php printf( $this->_( 'You must set up token on <a href="%s">Facebook API page</a>.' ), $this->setting_url( 'fb-api' ) ); ?>
+					<?php
+					echo wp_kses_post( sprintf(
+						__( 'You must set up token on <a href="%s">Facebook API page</a>.', 'wp-gianism' ),
+						$this->setting_url( 'fb-api' )
+					) );
+					?>
 				</p>
 			<?php endif; ?>
 		</td>