Merge pull request #1721 from Automattic/release/1.32.3

Release 1.32.3

assets/js/admin.js

@@ -1,11 +1,21 @@
 jQuery(document).ready(function($) {
 	// Tooltips
-	$( '.tips, .help_tip' ).tipTip({
-		'attribute' : 'data-tip',
-		'fadeIn' : 50,
-		'fadeOut' : 50,
-		'delay' : 200
-	});
+	$( '.tips, .help_tip' ).each( function() {
+		var $self = $(this);
+		var tipText = $self.attr( 'data-tip' );
+
+		if ( tipText ) {
+			$(this).tipTip( {
+				'content': '',
+				'fadeIn': 50,
+				'fadeOut': 50,
+				'delay': 200,
+				'enter': function () {
+					$(tiptip_content).text( tipText );
+				}
+			} );
+		}
+	} );
 
 	// Author
 	$( 'p.form-field-author' ).on( 'click', 'a.change-author', function() {
@@ -42,8 +52,11 @@ jQuery(document).ready(function($) {
 			searching: function() {
 				return job_manager_admin_params.user_selection_strings.searching;
 			},
-			escapeMarkup: function( m ) {
-				return m;
+			templateResult: function (result) {
+				return result.text;
+			},
+			templateSelection: function (selection) {
+				return selection.text;
 			},
 			width: '100%',
 			ajax: {

changelog.txt

@@ -1,3 +1,7 @@
+= 1.32.3 =
+* Fix: Escape tooltip text in WordPress admin. (Props hd7exploit)
+* Fix: Escape user display names on author selector while editing job listings. (Props hd7exploit)
+
 = 1.32.2 =
 * Fix: Issue saving job types for job listings in WordPress admin after WordPress 5.1 update.
 * Fix: Add nonce checks on edit/submit forms for logged in users. Will require updates to `templates/job-preview.php` if overridden in theme. (Props to foobar7)

includes/admin/class-wp-job-manager-writepanels.php

@@ -517,8 +517,8 @@ public static function input_author( $key, $field ) {
 				if ( $posted_by ) {
 					$user_string = sprintf(
 						// translators: Used in user select. %1$s is the user's display name; #%2$s is the user ID; %3$s is the user email.
-						esc_html__( '%1$s (#%2$s – %3$s)', 'wp-job-manager' ),
-						$posted_by->display_name,
+						esc_html__( '%1$s (#%2$s – %3$s)', 'wp-job-manager' ),
+						htmlentities( $posted_by->display_name ),
 						absint( $posted_by->ID ),
 						$posted_by->user_email
 					);

includes/class-wp-job-manager-ajax.php

@@ -401,8 +401,8 @@ public static function ajax_search_users() {
 		foreach ( $users as $user ) {
 			$found_users[ $user->ID ] = sprintf(
 				// translators: Used in user select. %1$s is the user's display name; #%2$s is the user ID; %3$s is the user email.
-				esc_html__( '%1$s (#%2$s – %3$s)', 'wp-job-manager' ),
-				$user->display_name,
+				esc_html__( '%1$s (#%2$s – %3$s)', 'wp-job-manager' ),
+				htmlentities( $user->display_name ),
 				absint( $user->ID ),
 				$user->user_email
 			);

languages/wp-job-manager.pot

@@ -2,9 +2,9 @@
 # This file is distributed under the GPL2+.
 msgid ""
 msgstr ""
-"Project-Id-Version: WP Job Manager 1.32.2\n"
+"Project-Id-Version: WP Job Manager 1.32.3\n"
 "Report-Msgid-Bugs-To: https://github.com/Automattic/WP-Job-Manager/issues\n"
-"POT-Creation-Date: 2019-02-25 14:23:26+00:00\n"
+"POT-Creation-Date: 2019-04-23 17:25:49+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=utf-8\n"
 "Content-Transfer-Encoding: 8bit\n"

package.json

@@ -1,7 +1,7 @@
 {
   "name": "wp-job-manager",
   "title": "WP Job Manager",
-  "version": "1.32.2",
+  "version": "1.32.3",
   "homepage": "http://wordpress.org/plugins/wp-job-manager/",
   "license": "GPL-2.0+",
   "repository": "automattic/wp-job-manager",

readme.md

@@ -3,7 +3,7 @@
 **Tags:** job manager, job listing, job board, job management, job lists, job list, job, jobs, company, hiring, employment, employer, employees, candidate, freelance, internship, job listings, positions, board, application, hiring, listing, manager, recruiting, recruitment, talent  
 **Requires at least:** 4.7.0  
 **Tested up to:** 5.1  
-**Stable tag:** 1.32.2  
+**Stable tag:** 1.32.3  
 **License:** GPLv3  
 **License URI:** http://www.gnu.org/licenses/gpl-3.0.html  
 
@@ -152,6 +152,10 @@ It then creates a database based on the parameters passed to it.
 
 ## Changelog ##
 
+### 1.32.3 ###
+* Fix: Escape tooltips in WordPress admin. (Props hd7exploit)
+* Fix: Escape user display names on author selector while editing job listings.
+
 ### 1.32.2 ###
 * Fix: Issue saving job types for job listings in WordPress admin after WordPress 5.1 update.
 * Fix: Add nonce checks on edit/submit forms for logged in users. Will require updates to `templates/job-preview.php` if overridden in theme. (Props to foobar7)

readme.txt

@@ -3,7 +3,7 @@ Contributors: mikejolley, automattic, adamkheckler, alexsanford1, annezazu, cena
 Tags: job manager, job listing, job board, job management, job lists, job list, job, jobs, company, hiring, employment, employer, employees, candidate, freelance, internship, job listings, positions, board, application, hiring, listing, manager, recruiting, recruitment, talent
 Requires at least: 4.7.0
 Tested up to: 5.1
-Stable tag: 1.32.2
+Stable tag: 1.32.3
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -152,6 +152,10 @@ It then creates a database based on the parameters passed to it.
 
 == Changelog ==
 
+= 1.32.3 =
+* Fix: Escape tooltip text in WordPress admin. (Props hd7exploit)
+* Fix: Escape user display names on author selector while editing job listings. (Props hd7exploit)
+
 = 1.32.2 =
 * Fix: Issue saving job types for job listings in WordPress admin after WordPress 5.1 update.
 * Fix: Add nonce checks on edit/submit forms for logged in users. Will require updates to `templates/job-preview.php` if overridden in theme. (Props to foobar7)

wp-job-manager.php

@@ -3,7 +3,7 @@
  * Plugin Name: WP Job Manager
  * Plugin URI: https://wpjobmanager.com/
  * Description: Manage job listings from the WordPress admin panel, and allow users to post jobs directly to your site.
- * Version: 1.32.2
+ * Version: 1.32.3
  * Author: Automattic
  * Author URI: https://wpjobmanager.com/
  * Requires at least: 4.7.0
@@ -63,7 +63,7 @@ public static function instance() {
 	 */
 	public function __construct() {
 		// Define constants.
-		define( 'JOB_MANAGER_VERSION', '1.32.2' );
+		define( 'JOB_MANAGER_VERSION', '1.32.3' );
 		define( 'JOB_MANAGER_MINIMUM_WP_VERSION', '4.7.0' );
 		define( 'JOB_MANAGER_PLUGIN_DIR', untrailingslashit( plugin_dir_path( __FILE__ ) ) );
 		define( 'JOB_MANAGER_PLUGIN_URL', untrailingslashit( plugins_url( basename( plugin_dir_path( __FILE__ ) ), basename( __FILE__ ) ) ) );