From 55d52ace676f0724e68b09a656fb3d526ea65ca7 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 15:48:16 -0700
Subject: [PATCH 01/11] Escape translation output in
 html-accommodation-booking-data.php

---
 .../admin/views/html-accommodation-booking-data.php  | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/includes/admin/views/html-accommodation-booking-data.php b/includes/admin/views/html-accommodation-booking-data.php
index a99bb25c..a7c89239 100644
--- a/includes/admin/views/html-accommodation-booking-data.php
+++ b/includes/admin/views/html-accommodation-booking-data.php
@@ -62,15 +62,15 @@
 		$cancel_limit_unit = get_post_meta( $post_id, '_wc_booking_cancel_limit_unit', true );
 	?>
 	<p class="form-field accommodation-booking-cancel-limit">
-		<label for="_wc_accommodation_booking_cancel_limit"><?php _e( 'Cancellation up till', 'woocommerce-accommodation-bookings' ); ?></label>
+		<label for="_wc_accommodation_booking_cancel_limit"><?php esc_html_e( 'Cancellation up till', 'woocommerce-accommodation-bookings' ); ?></label>
 		<input type="number" name="_wc_accommodation_booking_cancel_limit" id="_wc_accommodation_booking_cancel_limit" value="<?php echo esc_attr( $cancel_limit ); ?>" step="1" min="1" style="margin-right: 7px; width: 4em;">
 		<select name="_wc_accommodation_booking_cancel_limit_unit" id="_wc_accommodation_booking_cancel_limit_unit" class="short" style="width: auto; margin-right: 7px;">
-			<option value="month" <?php selected( $cancel_limit_unit, 'month' ); ?>><?php _e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-			<option value="day" <?php selected( $cancel_limit_unit, 'day' ); ?>><?php _e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-			<option value="hour" <?php selected( $cancel_limit_unit, 'hour' ); ?>><?php _e( 'Hour(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-			<option value="minute" <?php selected( $cancel_limit_unit, 'minute' ); ?>><?php _e( 'Minute(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+			<option value="month" <?php selected( $cancel_limit_unit, 'month' ); ?>><?php esc_html_e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+			<option value="day" <?php selected( $cancel_limit_unit, 'day' ); ?>><?php esc_html_e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+			<option value="hour" <?php selected( $cancel_limit_unit, 'hour' ); ?>><?php esc_html_e( 'Hour(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+			<option value="minute" <?php selected( $cancel_limit_unit, 'minute' ); ?>><?php esc_html_e( 'Minute(s)', 'woocommerce-accommodation-bookings' ); ?></option>
 		</select>
-		<span class="description"><?php _e( 'before check-in.', 'woocommerce-accommodation-bookings' ); ?></span>
+		<span class="description"><?php esc_html_e( 'before check-in.', 'woocommerce-accommodation-bookings' ); ?></span>
 	</p>
 
 	<script type="text/javascript">

From 7ba8f940e9deee42dedbb56024bb3e4418044a93 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 16:06:42 -0700
Subject: [PATCH 02/11] Escape translation output in
 html-accommodation-booking-availability.php

---
 ...tml-accommodation-booking-availability.php | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/includes/admin/views/html-accommodation-booking-availability.php b/includes/admin/views/html-accommodation-booking-availability.php
index f81f9030..85ef82da 100644
--- a/includes/admin/views/html-accommodation-booking-availability.php
+++ b/includes/admin/views/html-accommodation-booking-availability.php
@@ -9,13 +9,13 @@
 			$min_date_unit = get_post_meta( $post_id, '_wc_booking_min_date_unit', true );
 		?>
 		<p class="form-field">
-			<label for="_wc_accommodation_booking_min_date"><?php _e( 'Bookings can be made starting', 'woocommerce-accommodation-bookings' ); ?></label>
+			<label for="_wc_accommodation_booking_min_date"><?php esc_html_e( 'Bookings can be made starting', 'woocommerce-accommodation-bookings' ); ?></label>
 			<input type="number" name="_wc_accommodation_booking_min_date" id="_wc_accommodation_booking_min_date" value="<?php echo esc_attr( $min_date ); ?>" step="1" min="0" style="margin-right: 7px; width: 4em;">
 			<select name="_wc_accommodation_booking_min_date_unit" id="_wc_accommodation_booking_min_date_unit" class="short" style="margin-right: 7px;">
-				<option value="month" <?php selected( $min_date_unit, 'month' ); ?>><?php _e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="week" <?php selected( $min_date_unit, 'week' ); ?>><?php _e( 'Week(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="day" <?php selected( $min_date_unit, 'day' ); ?>><?php _e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-			</select> <?php _e( 'into the future', 'woocommerce-accommodation-bookings' ); ?>
+				<option value="month" <?php selected( $min_date_unit, 'month' ); ?>><?php esc_html_e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="week" <?php selected( $min_date_unit, 'week' ); ?>><?php esc_html_e( 'Week(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="day" <?php selected( $min_date_unit, 'day' ); ?>><?php esc_html_e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+			</select> <?php esc_html_e( 'into the future', 'woocommerce-accommodation-bookings' ); ?>
 		</p>
 		<?php
 			$max_date = get_post_meta( $post_id, '_wc_booking_max_date', true );
@@ -26,13 +26,13 @@
 			$max_date_unit = get_post_meta( $post_id, '_wc_booking_max_date_unit', true );
 		?>
 		<p class="form-field">
-			<label for="_wc_accommodation_booking_max_date"><?php _e( 'Bookings can only be made', 'woocommerce-accommodation-bookings' ); ?></label>
+			<label for="_wc_accommodation_booking_max_date"><?php esc_html_e( 'Bookings can only be made', 'woocommerce-accommodation-bookings' ); ?></label>
 			<input type="number" name="_wc_accommodation_booking_max_date" id="_wc_accommodation_booking_max_date" value="<?php echo esc_attr( $max_date ); ?>" step="1" min="1" style="margin-right: 7px; width: 4em;">
 			<select name="_wc_accommodation_booking_max_date_unit" id="_wc_accommodation_booking_max_date_unit" class="short" style="margin-right: 7px;">
-				<option value="month" <?php selected( $max_date_unit, 'month' ); ?>><?php _e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="week" <?php selected( $max_date_unit, 'week' ); ?>><?php _e( 'Week(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="day" <?php selected( $max_date_unit, 'day' ); ?>><?php _e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
-				</select> <?php _e( 'into the future', 'woocommerce-accommodation-bookings' ); ?>
+				<option value="month" <?php selected( $max_date_unit, 'month' ); ?>><?php esc_html_e( 'Month(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="week" <?php selected( $max_date_unit, 'week' ); ?>><?php esc_html_e( 'Week(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="day" <?php selected( $max_date_unit, 'day' ); ?>><?php esc_html_e( 'Day(s)', 'woocommerce-accommodation-bookings' ); ?></option>
+				</select> <?php esc_html_e( 'into the future', 'woocommerce-accommodation-bookings' ); ?>
 		</p>
 
 		<?php
@@ -69,11 +69,11 @@
 						__( 'Saturday', 'woocommerce-bookings' ),
 						);
 
-					for ( $i=0;  $i < 7;  $i++) { 
+					for ( $i=0;  $i < 7;  $i++) {
 						?>
 							<td>
-								<label class="checkbox" for="_wc_accommodation_booking_restricted_days[<?php echo $i; ?>]" style="width: auto;"><?php echo $weekdays[ $i ]; ?>&nbsp;</label>
-								<input type="checkbox" class="checkbox" name="_wc_accommodation_booking_restricted_days[<?php echo $i; ?>]" id="_wc_accommodation_booking_restricted_days[<?php echo $i; ?>]" value="<?php echo $i; ?>" <?php checked( $restricted_days[ $i ], $i ); ?>>
+								<label class="checkbox" for="_wc_accommodation_booking_restricted_days[<?php echo esc_attr( $i ); ?>]" style="width: auto;"><?php echo esc_html( $weekdays[ $i ] ); ?>&nbsp;</label>
+								<input type="checkbox" class="checkbox" name="_wc_accommodation_booking_restricted_days[<?php echo esc_attr( $i ); ?>]" id="_wc_accommodation_booking_restricted_days[<?php echo esc_attr( $i ); ?>]" value="<?php echo esc_attr( $i ); ?>" <?php checked( $restricted_days[ $i ], $i ); ?>>
 							</td>
 						<?php
 					}
@@ -128,4 +128,4 @@
 		</div>
 	</div>
 
-</div>
\ No newline at end of file
+</div>

From 589c7c56ee6285f8be2a6a5489cec496f327d11b Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 16:06:59 -0700
Subject: [PATCH 03/11] Escape translation output in
 html-accommodation-booking-availability-fields.php

---
 ...tml-accommodation-booking-availability-fields.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/includes/admin/views/html-accommodation-booking-availability-fields.php b/includes/admin/views/html-accommodation-booking-availability-fields.php
index a656f24b..9f7a3d4b 100644
--- a/includes/admin/views/html-accommodation-booking-availability-fields.php
+++ b/includes/admin/views/html-accommodation-booking-availability-fields.php
@@ -43,10 +43,10 @@
 	<td>
 		<div class="select wc_booking_availability_type">
 			<select name="wc_accommodation_booking_availability_type[]">
-				<option value="custom" <?php selected( $availability['type'], 'custom' ); ?>><?php _e( 'Custom date range', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="months" <?php selected( $availability['type'], 'months' ); ?>><?php _e( 'Range of months', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="weeks" <?php selected( $availability['type'], 'weeks' ); ?>><?php _e( 'Range of weeks', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="days" <?php selected( $availability['type'], 'days' ); ?>><?php _e( 'Range of days', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="custom" <?php selected( $availability['type'], 'custom' ); ?>><?php esc_html_e( 'Custom date range', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="months" <?php selected( $availability['type'], 'months' ); ?>><?php esc_html_e( 'Range of months', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="weeks" <?php selected( $availability['type'], 'weeks' ); ?>><?php esc_html_e( 'Range of weeks', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="days" <?php selected( $availability['type'], 'days' ); ?>><?php esc_html_e( 'Range of days', 'woocommerce-accommodation-bookings' ); ?></option>
 			</select>
 		</div>
 	</td>
@@ -105,8 +105,8 @@
 	<td>
 		<div class="select">
 			<select name="wc_accommodation_booking_availability_bookable[]">
-				<option value="no" <?php selected( isset( $availability['bookable'] ) && $availability['bookable'] == 'no', true ) ?>><?php _e( 'No', 'woocommerce-accommodation-bookings' ) ;?></option>
-				<option value="yes" <?php selected( isset( $availability['bookable'] ) && $availability['bookable'] == 'yes', true ) ?>><?php _e( 'Yes', 'woocommerce-accommodation-bookings' ) ;?></option>
+				<option value="no" <?php selected( isset( $availability['bookable'] ) && $availability['bookable'] == 'no', true ) ?>><?php esc_html_e( 'No', 'woocommerce-accommodation-bookings' ) ;?></option>
+				<option value="yes" <?php selected( isset( $availability['bookable'] ) && $availability['bookable'] == 'yes', true ) ?>><?php esc_html_e( 'Yes', 'woocommerce-accommodation-bookings' ) ;?></option>
 			</select>
 		</div>
 	</td>

From a8b2048b0514a3b53bb99f93c7463828b5f1feeb Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 16:12:10 -0700
Subject: [PATCH 04/11] Escape outputs in
 html-accommodation-booking-rates-fields.php

---
 .../html-accommodation-booking-rates-fields.php    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/includes/admin/views/html-accommodation-booking-rates-fields.php b/includes/admin/views/html-accommodation-booking-rates-fields.php
index 8391fddd..31a7f095 100644
--- a/includes/admin/views/html-accommodation-booking-rates-fields.php
+++ b/includes/admin/views/html-accommodation-booking-rates-fields.php
@@ -40,10 +40,10 @@
 	<td>
 		<div class="select wc_booking_availability_type">
 			<select name="wc_accommodation_booking_pricing_type[]">
-				<option value="custom" <?php selected( $rate['type'], 'custom' ); ?>><?php _e( 'Range of certain nights', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="months" <?php selected( $rate['type'], 'months' ); ?>><?php _e( 'Range of months', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="weeks" <?php selected( $rate['type'], 'weeks' ); ?>><?php _e( 'Range of weeks', 'woocommerce-accommodation-bookings' ); ?></option>
-				<option value="days" <?php selected( $rate['type'], 'days' ); ?>><?php _e( 'Range of nights during the week', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="custom" <?php selected( $rate['type'], 'custom' ); ?>><?php esc_html_e( 'Range of certain nights', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="months" <?php selected( $rate['type'], 'months' ); ?>><?php esc_html_e( 'Range of months', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="weeks" <?php selected( $rate['type'], 'weeks' ); ?>><?php esc_html_e( 'Range of weeks', 'woocommerce-accommodation-bookings' ); ?></option>
+				<option value="days" <?php selected( $rate['type'], 'days' ); ?>><?php esc_html_e( 'Range of nights during the week', 'woocommerce-accommodation-bookings' ); ?></option>
 			</select>
 		</div>
 	</td>
@@ -107,14 +107,14 @@
 		<input type="number" step="0.01" name="wc_accommodation_booking_pricing_block_cost[]" value="<?php
 		// Handle legacy
 		if ( ! empty( $rate['override_block'] ) ) {
-			echo $rate['override_block'];
+			echo esc_attr( $rate['override_block'] );
 		} else if ( ! empty( $rate['modifier'] ) && isset( $rate['cost'] ) ) {
 			$base_cost = abs( floatval( get_post_meta( $post_id, '_wc_booking_base_cost', true ) ) );
 
 			if ( 'plus' == $rate['modifier'] ) {
-				echo $base_cost + $rate['cost'];
+				echo esc_attr( $base_cost + $rate['cost'] );
 			} else {
-				echo $base_cost - $rate['cost'];
+				echo esc_attr( $base_cost - $rate['cost'] );
 			}
 		}
 		?>" placeholder="0" />

From 88d1cd4d7621c5350c1b34012c9120cefffe2ee2 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 16:13:20 -0700
Subject: [PATCH 05/11] Escape translation outputs in
 html-accommodation-booking-tabs.php

---
 includes/admin/views/html-accommodation-booking-tabs.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/admin/views/html-accommodation-booking-tabs.php b/includes/admin/views/html-accommodation-booking-tabs.php
index 7696594a..d829f3d3 100644
--- a/includes/admin/views/html-accommodation-booking-tabs.php
+++ b/includes/admin/views/html-accommodation-booking-tabs.php
@@ -1,2 +1,2 @@
-<li class="accommodation_bookings_tab accommodation_bookings_availability_tab bookings_availability_tab advanced_options show_if_accommodation-booking"><a href="#accommodation_bookings_availability"><span><?php _e( 'Availability', 'woocommerce-accommodation-bookings' ); ?></span></a></li>
-<li class="accommodation_bookings_tab accommodation_bookings_pricing_tab  bookings_pricing_tab advanced_options show_if_accommodation-booking"><a href="#accommodation_bookings_rates"><span><?php _e( 'Rates', 'woocommerce-accommodation-bookings' ); ?></span></a></li>
+<li class="accommodation_bookings_tab accommodation_bookings_availability_tab bookings_availability_tab advanced_options show_if_accommodation-booking"><a href="#accommodation_bookings_availability"><span><?php esc_html_e( 'Availability', 'woocommerce-accommodation-bookings' ); ?></span></a></li>
+<li class="accommodation_bookings_tab accommodation_bookings_pricing_tab  bookings_pricing_tab advanced_options show_if_accommodation-booking"><a href="#accommodation_bookings_rates"><span><?php esc_html_e( 'Rates', 'woocommerce-accommodation-bookings' ); ?></span></a></li>

From 9cfadbe44f71add5d73e11bdbd3b80195af56ea6 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 17:16:58 -0700
Subject: [PATCH 06/11] Sanitize inputs in
 class-wc-accommodation-booking-admin-panels.php

---
 ...-wc-accommodation-booking-admin-panels.php | 28 ++++++++-----------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-panels.php b/includes/admin/class-wc-accommodation-booking-admin-panels.php
index a1eaa6d1..e723df62 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-panels.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-panels.php
@@ -153,7 +153,7 @@ public function save_product_data( $post_id ) {
 		);
 
 		foreach ( $meta_to_save as $meta_key => $sanitize ) {
-			$value = ! empty( $_POST[ $meta_key ] ) ? $_POST[ $meta_key ] : '';
+			$value = filter_input( INPUT_POST, $meta_key );
 			switch ( $sanitize ) {
 				case 'int' :
 					$value = $value ? absint( $value ) : '';
@@ -243,11 +243,11 @@ public function save_product_data( $post_id ) {
 				$wpdb->update(
 					"{$wpdb->prefix}wc_booking_relationships",
 					array(
-						'sort_order'  => $resource_menu_order[ $i ]
+						'sort_order'  => absint( $resource_menu_order[ $i ] ),
 					),
 					array(
 						'product_id'  => $post_id,
-						'resource_id' => $resource_id
+						'resource_id' => $resource_id,
 					)
 				);
 
@@ -262,7 +262,7 @@ public function save_product_data( $post_id ) {
 			update_post_meta( $post_id, '_resource_base_costs', $resource_base_costs );
 			update_post_meta( $post_id, '_resource_block_costs', $resource_block_costs );
 		}
-		
+
 		// Rates
 		$pricing = array();
 		$original_base_cost = abs( (float) get_post_meta( $post_id, '_wc_booking_base_cost', true ) );
@@ -294,9 +294,10 @@ public function save_product_data( $post_id ) {
 				break;
 			}
 		}
-		
+
 		// Person Types
 		if ( isset( $_POST['person_id'] ) && isset( $_POST['_wc_booking_has_persons'] ) ) {
+			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
 			$person_ids         = $_POST['person_id'];
 			$person_menu_order  = $_POST['person_menu_order'];
 			$person_name        = $_POST['person_name'];
@@ -305,6 +306,7 @@ public function save_product_data( $post_id ) {
 			$person_description = $_POST['person_description'];
 			$person_min         = $_POST['person_min'];
 			$person_max         = $_POST['person_max'];
+			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 
 			$max_loop = max( array_keys( $_POST['person_id'] ) );
 
@@ -319,21 +321,13 @@ public function save_product_data( $post_id ) {
 					$person_name[ $i ] = sprintf( __( 'Person Type #%d', 'woocommerce-bookings' ), ( $i + 1 ) );
 				}
 
-				$wpdb->update(
-					$wpdb->posts,
+				wp_update_post(
 					array(
+						'ID'           => $person_id,
 						'post_title'   => stripslashes( $person_name[ $i ] ),
 						'post_excerpt' => stripslashes( $person_description[ $i ] ),
-						'menu_order'   => $person_menu_order[ $i ] ),
-					array(
-						'ID' => $person_id
-					),
-					array(
-						'%s',
-						'%s',
-						'%d'
-					),
-					array( '%d' )
+						'menu_order'   => $person_menu_order[ $i ],
+					)
 				);
 
 				update_post_meta( $person_id, 'cost', wc_clean( $person_cost[ $i ] ) );

From 56ddb7feb364a5dcd346557a7e70e252674feb52 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 17:43:01 -0700
Subject: [PATCH 07/11] Extra escaping in
 class-wc-accommodation-booking-admin-product-settings.php

---
 .../class-wc-accommodation-booking-admin-product-settings.php   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-product-settings.php b/includes/admin/class-wc-accommodation-booking-admin-product-settings.php
index 63a74d86..4fbc4af9 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-product-settings.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-product-settings.php
@@ -218,7 +218,7 @@ public function generate_accommodation_time_html( $key, $value ) {
 			<th scope="row" class="titledesc">
 				<label for="<?php echo esc_attr( $field_key ); ?>"><?php echo esc_html( $value['title'] ); ?></label>
 			</th>
-			<td class="forminp forminp-<?php echo sanitize_title( $value['type'] ) ?>">
+			<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ) ?>">
 				<input
 					name="<?php echo esc_attr( $field_key ); ?>"
 					id="<?php echo esc_attr( $field_key ); ?>"

From ec89bfb3f30fbb6f588504b12623550c722fb1b2 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 17 Apr 2023 17:46:55 -0700
Subject: [PATCH 08/11] phpcs rule management in
 class-wc-accommodation-booking-admin-panels.php

---
 .../admin/class-wc-accommodation-booking-admin-panels.php     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-panels.php b/includes/admin/class-wc-accommodation-booking-admin-panels.php
index e723df62..f2bb5101 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-panels.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-panels.php
@@ -225,11 +225,13 @@ public function save_product_data( $post_id ) {
 
 		// Resources
 		if ( isset( $_POST['resource_id'] ) && isset( $_POST['_wc_booking_has_resources'] ) ) {
+			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
 			$resource_ids         = $_POST['resource_id'];
 			$resource_menu_order  = $_POST['resource_menu_order'];
 			$resource_base_cost   = $_POST['resource_cost'];
 			$resource_block_cost  = $_POST['resource_block_cost'];
 			$max_loop             = max( array_keys( $_POST['resource_id'] ) );
+			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 			$resource_base_costs  = array();
 			$resource_block_costs = array();
 
@@ -306,9 +308,9 @@ public function save_product_data( $post_id ) {
 			$person_description = $_POST['person_description'];
 			$person_min         = $_POST['person_min'];
 			$person_max         = $_POST['person_max'];
-			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 
 			$max_loop = max( array_keys( $_POST['person_id'] ) );
+			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 
 			for ( $i = 0; $i <= $max_loop; $i ++ ) {
 				if ( ! isset( $person_ids[ $i ] ) ) {

From 3cdc19e5def2f67182e662a7a85c5dd408cfc79d Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Tue, 18 Apr 2023 17:01:59 -0700
Subject: [PATCH 09/11] Filter inputs instead of ignoring linting rules

---
 ...-wc-accommodation-booking-admin-panels.php | 94 +++++++++++++++----
 1 file changed, 75 insertions(+), 19 deletions(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-panels.php b/includes/admin/class-wc-accommodation-booking-admin-panels.php
index f2bb5101..d8bd0c34 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-panels.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-panels.php
@@ -225,13 +225,34 @@ public function save_product_data( $post_id ) {
 
 		// Resources
 		if ( isset( $_POST['resource_id'] ) && isset( $_POST['_wc_booking_has_resources'] ) ) {
-			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
-			$resource_ids         = $_POST['resource_id'];
-			$resource_menu_order  = $_POST['resource_menu_order'];
-			$resource_base_cost   = $_POST['resource_cost'];
-			$resource_block_cost  = $_POST['resource_block_cost'];
-			$max_loop             = max( array_keys( $_POST['resource_id'] ) );
-			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+			$resource_data = filter_input_array(
+				INPUT_POST,
+				array(
+					'resource_id'         => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'resource_menu_order' => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'resource_cost'       => array(
+						'filter' => FILTER_VALIDATE_FLOAT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'resource_block_cost' => array(
+						'filter' => FILTER_VALIDATE_FLOAT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+				)
+			);
+			$resource_ids        = $resource_data['resource_id'];
+			$resource_menu_order = $resource_data['resource_menu_order'];
+			$resource_base_cost  = $resource_data['resource_cost'];
+			$resource_block_cost = $resource_data['resource_block_cost'];
+
+			$max_loop = max( array_keys( $resource_ids ) );
+
 			$resource_base_costs  = array();
 			$resource_block_costs = array();
 
@@ -299,18 +320,53 @@ public function save_product_data( $post_id ) {
 
 		// Person Types
 		if ( isset( $_POST['person_id'] ) && isset( $_POST['_wc_booking_has_persons'] ) ) {
-			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
-			$person_ids         = $_POST['person_id'];
-			$person_menu_order  = $_POST['person_menu_order'];
-			$person_name        = $_POST['person_name'];
-			$person_cost        = $_POST['person_cost'];
-			$person_block_cost  = $_POST['person_block_cost'];
-			$person_description = $_POST['person_description'];
-			$person_min         = $_POST['person_min'];
-			$person_max         = $_POST['person_max'];
-
-			$max_loop = max( array_keys( $_POST['person_id'] ) );
-			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+			$person_data = filter_input_array(
+				INPUT_POST,
+				array(
+					'person_id'          => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_menu_order'  => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_name'        => array(
+						'filter' => FILTER_DEFAULT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_cost'        => array(
+						'filter' => FILTER_VALIDATE_FLOAT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_block_cost'  => array(
+						'filter' => FILTER_VALIDATE_FLOAT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_description' => array(
+						'filter' => FILTER_DEFAULT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_min'         => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+					'person_max'         => array(
+						'filter' => FILTER_VALIDATE_INT,
+						'flags'  => FILTER_REQUIRE_ARRAY,
+					),
+				)
+			);
+			$person_ids         = $person_data['person_id'];
+			$person_menu_order  = $person_data['person_menu_order'];
+			$person_name        = $person_data['person_name'];
+			$person_cost        = $person_data['person_cost'];
+			$person_block_cost  = $person_data['person_block_cost'];
+			$person_description = $person_data['person_description'];
+			$person_min         = $person_data['person_min'];
+			$person_max         = $person_data['person_max'];
+
+			$max_loop = max( array_keys( $person_ids ) );
 
 			for ( $i = 0; $i <= $max_loop; $i ++ ) {
 				if ( ! isset( $person_ids[ $i ] ) ) {

From 2adb6af3624735410662903238285c4c05623296 Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Mon, 1 May 2023 12:54:45 -0700
Subject: [PATCH 10/11] Change method of retrieving post inputs in
 WC_Accommodation_Booking_Admin_Panels

---
 .../admin/class-wc-accommodation-booking-admin-panels.php     | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-panels.php b/includes/admin/class-wc-accommodation-booking-admin-panels.php
index d8bd0c34..44e59e71 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-panels.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-panels.php
@@ -153,7 +153,7 @@ public function save_product_data( $post_id ) {
 		);
 
 		foreach ( $meta_to_save as $meta_key => $sanitize ) {
-			$value = filter_input( INPUT_POST, $meta_key );
+			$value = sanitize_text_field( $_POST[ $meta_key ] ?? '' );
 			switch ( $sanitize ) {
 				case 'int' :
 					$value = $value ? absint( $value ) : '';
@@ -173,8 +173,6 @@ public function save_product_data( $post_id ) {
 						$value = 1;
 					}
 					break;
-				default :
-					$value = sanitize_text_field( $value );
 			}
 
 			$meta_key = str_replace( '_wc_accommodation_booking_', '_wc_booking_', $meta_key );

From 6fa8897b942b6d444d8619f949b59a113a5d27ef Mon Sep 17 00:00:00 2001
From: Corey McKrill <916023+coreymckrill@users.noreply.github.com>
Date: Tue, 2 May 2023 09:50:40 -0700
Subject: [PATCH 11/11] Update
 includes/admin/class-wc-accommodation-booking-admin-panels.php

Co-authored-by: Vedanshu Jain <vedanshu.jain.2012@gmail.com>
---
 includes/admin/class-wc-accommodation-booking-admin-panels.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/admin/class-wc-accommodation-booking-admin-panels.php b/includes/admin/class-wc-accommodation-booking-admin-panels.php
index 44e59e71..32f9f365 100644
--- a/includes/admin/class-wc-accommodation-booking-admin-panels.php
+++ b/includes/admin/class-wc-accommodation-booking-admin-panels.php
@@ -153,7 +153,7 @@ public function save_product_data( $post_id ) {
 		);
 
 		foreach ( $meta_to_save as $meta_key => $sanitize ) {
-			$value = sanitize_text_field( $_POST[ $meta_key ] ?? '' );
+			$value = sanitize_text_field( wp_unslash( $_POST[ $meta_key ] ?? '' ) );
 			switch ( $sanitize ) {
 				case 'int' :
 					$value = $value ? absint( $value ) : '';