FileXXXXXXXXXXX

dvadf

File manager - Edit - /home/centroca/public_html/wp/wp-content/plugins/nextgen-gallery/templates/AttachToPost/display_settings_form.php

Back
<form rel="<?php echo esc_attr( $display_type_name ); ?>" class="<?php echo esc_attr( $css_class ); ?>" method='POST' action='<?php echo esc_url( isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '' ); // esc_url + sanitize_text_field: REQUEST_URI is attacker-controllable; esc_url blocks javascript:/data: schemes and sanitize_text_field strips control chars before reflection. ?>' data-defaults="<?php print esc_attr( wp_json_encode( $defaults ) ); ?>"> <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Content is generated by internal form renderer echo $settings; ?> </form>

dvadf

dvadf