From a004ff7ebf52cf31946f4f65276904215e95ca4a Mon Sep 17 00:00:00 2001
From: Brian Miyaji <brian@themeboy.com>
Date: Sat, 6 Nov 2021 11:30:53 +0900
Subject: [PATCH] Escape config links in admin

---
 includes/admin/views/html-admin-config.php | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/includes/admin/views/html-admin-config.php b/includes/admin/views/html-admin-config.php
index 0f5fb3c8..7aceadcc 100644
--- a/includes/admin/views/html-admin-config.php
+++ b/includes/admin/views/html-admin-config.php
@@ -113,10 +113,10 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
 							<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
 								<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
 									<td class="radio"><input type="radio" class="sp-primary-result-option" id="sportspress_primary_result_<?php echo $row->post_name; ?>" name="sportspress_primary_result" value="<?php echo $row->post_name; ?>" <?php checked( $selection, $row->post_name ); ?>></td>
-									<td class="row-title"><label for="sportspress_primary_result_<?php echo $row->post_name; ?>"><?php echo $row->post_title; ?></label></td>
+									<td class="row-title"><label for="sportspress_primary_result_<?php echo $row->post_name; ?>"><?php echo esc_html( $row->post_title ); ?></label></td>
 									<td><code><?php echo $row->post_name; ?>for</code>, <code><?php echo $row->post_name; ?>against</code></td>
-									<td><?php echo sp_get_post_equation( $row->ID ); ?></td>
-									<td><?php echo sp_get_post_precision( $row->ID ); ?></td>
+									<td><?php echo esc_html( sp_get_post_equation( $row->ID ) ); ?></td>
+									<td><?php echo esc_html( sp_get_post_precision( $row->ID ) ); ?></td>
 									<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
 									<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
 								</tr>
@@ -274,9 +274,9 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
 						<?php if ( $data ): $i = 0; foreach ( $data as $row ): ?>
 							<tr<?php if ( $i % 2 == 0 ) echo ' class="alternate"'; ?>>
 								<td class="row-title"><?php echo $row->post_title; ?></td>
-								<td><?php echo sp_get_post_equation( $row->ID ); ?></td>
-								<td><?php echo sp_get_post_precision( $row->ID ); ?></td>
-								<td><?php echo sp_get_post_order( $row->ID ); ?></td>
+								<td><?php echo esc_html( sp_get_post_equation( $row->ID ) ); ?></td>
+								<td><?php echo esc_html( sp_get_post_precision( $row->ID ) ); ?></td>
+								<td><?php echo esc_html( sp_get_post_order( $row->ID ) ); ?></td>
 								<td><p class="description"><?php echo $row->post_excerpt; ?></p></td>
 								<td class="edit"><a class="button" href="<?php echo get_edit_post_link( $row->ID ); ?>"><?php _e( 'Edit', 'sportspress' ); ?></s></td>
 							</tr>
@@ -402,9 +402,9 @@ $columns = get_option( 'sportspress_player_columns', 'auto' );
 										echo apply_filters( 'sportspress_performance_icon', $icon, $row->ID );
 										?>
 								</td>
-								<td><?php echo sp_get_post_equation( $row->ID ); ?></td>
-								<td><?php echo sp_get_post_precision( $row->ID ); ?></td>
-								<td><?php echo sp_get_post_section( $row->ID ); ?></td>
+								<td><?php echo esc_html( sp_get_post_equation( $row->ID ) ); ?></td>
+								<td><?php echo esc_html( sp_get_post_precision( $row->ID ) ); ?></td>
+								<td><?php echo esc_html( sp_get_post_section( $row->ID ) ); ?></td>
 								<?php if ( 'auto' === $columns ) { ?>
 									<td>
 										<?php if ( $visible ) { ?><i class="dashicons dashicons-yes"></i><?php } else { ?>&nbsp;<?php } ?>