Changeset 3097597

Timestamp:

06/04/2024 07:48:43 PM ( 3 weeks ago)

Author:

WebFactory

Message:

Escaped some HTML.

Location:

wp-reset/trunk

Files:

• libs/dumper.php (modified) ( 5 diffs )
• readme.txt (modified) ( 2 diffs )
• wp-reset-licensing.php (modified) ( 3 diffs )
• wp-reset.php (modified) ( 30 diffs )

wp-reset/trunk/libs/dumper.php

@@ -two hundred and seventy-six +two hundred and seventy-six @@
              $error_text = file_get_contents($error_file);
              unlink($error_file);
-             throw new WPR_Shuttle_Exception('Couldn\'t export database: ' . $error_text );
+             throw new WPR_Shuttle_Exception('Couldn\'t export database: ' . esc_html($error_text) );
          }
 
@@ -three hundred and ninety-eight +three hundred and ninety-eight @@
          $this->connection = @mysql_connect($this->host, $this->username, $this->password);
          if (!$this->connection) {
-             throw new WPR_Shuttle_Exception("Couldn't connect to the database: " . mysql_error( ));
+             throw new WPR_Shuttle_Exception("Couldn't connect to the database: " . esc_html(mysql_error() ));
          }
 
          $select_db_res = mysql_select_db($this->name, $this->connection);
          if (!$select_db_res) {
-             throw new WPR_Shuttle_Exception("Couldn't select database: " . mysql_error($this->connection ));
+             throw new WPR_Shuttle_Exception("Couldn't select database: " . esc_html(mysql_error($this->connection) ));
          }
 
@@ -four hundred and fifteen +four hundred and fifteen @@
          $res = mysql_query($q);
          if (!$res) {
-             throw new WPR_Shuttle_Exception("SQL error: " . mysql_error($this->connection ));
+             throw new WPR_Shuttle_Exception("SQL error: " . esc_html(mysql_error($this->connection) ));
          }
          return $res;
@@ -four hundred and sixty-one +four hundred and sixty-one @@
 
          if ($this->connection->connect_error) {
-             throw new WPR_Shuttle_Exception("Couldn't connect to the database: " . $this->connection->connect_error );
+             throw new WPR_Shuttle_Exception("Couldn't connect to the database: " . esc_html($this->connection->connect_error) );
          }
 
@@ -four hundred and seventy-four +four hundred and seventy-four @@
 
          if (!$res) {
-             throw new WPR_Shuttle_Exception("SQL error: " . $this->connection->error );
+             throw new WPR_Shuttle_Exception("SQL error: " . esc_html($this->connection->error) );
          }
 

wp-reset/trunk/readme.txt

@@ -five +five @@
  Requires PHP: 5.2
  Tested up to: 6.5
- Stable tag: 2.0 two
+ Stable tag: 2.0 three
  License: GPLv2 or later
  License URI:  http://www.gnu.org/licenses/gpl-2.0.html
@@ -one hundred and nineteen +one hundred and nineteen @@
 
  == Changelog ==
+
+ = v2.03 =
+ * 2024/06/04
+ * Adjusted HTML escaping on translatable strings
+ * Fixed some unescaped HTML output
 
  = v2.02 =

wp-reset/trunk/wp-reset-licensing.php

@@ -three hundred and eighty-seven +three hundred and eighty-seven @@
        check_ajax_referer('wf_licensing_' . $this->prefix);
       
-       if (false === current_user_can(' administrator ')) {
+       if (false === current_user_can(' manage_options ')) {
          wp_die('Sorry,  you have to be an admin to run this action.');
        }
@@ -four hundred and sixteen +four hundred and sixteen @@
        check_ajax_referer('wf_licensing_' . $this->prefix);
 
-       if (false === current_user_can(' administrator ')) {
+       if (false === current_user_can(' manage_options ')) {
          wp_die('Sorry,  you have to be an admin to run this action.');
        }
@@ -four hundred and thirty-one +four hundred and thirty-one @@
        check_ajax_referer('wf_licensing_' . $this->prefix);
 
-       if (false === current_user_can(' administrator ')) {
+       if (false === current_user_can(' manage_options ')) {
          wp_die('Sorry,  you have to be an admin to run this action.');
        }

wp-reset/trunk/wp-reset.php

@@ -four +four @@
    Plugin URI:  https://wpreset.com/
    Description: Reset the entire site or just selected parts while reserving the option to undo by using snapshots.
-   Version: 2.0 two
+   Version: 2.0 three
    Requires at least: 4.0
    Requires PHP: 5.2
@@ -two hundred and fifty-eight +two hundred and fifty-eight @@
      check_ajax_referer('wp-reset_dismiss_notice');
 
-     if (!current_user_can(' administrator ')) {
+     if (!current_user_can(' manage_options ')) {
        wp_send_json_error(__('You are not allowed to run this action.', 'wp-reset'));
      }
@@ -three hundred and fifty-two +three hundred and fifty-two @@
      } // foreach
 
-     if (!empty($pointers) && !$ this->is_plugin_page() && current_user_can(' administrator ')) {
+     if (!empty($pointers) && !$ this->is_plugin_page() && current_user_can(' manage_options ')) {
        $pointers['_nonce_dismiss_pointer'] = wp_create_nonce('wp-reset_dismiss_notice');
 
@@ -eight hundred and fifty-five +eight hundred and fifty-five @@
      check_ajax_referer('wp-reset_run_tool');
 
-     if (!current_user_can(' administrator ')) {
+     if (!current_user_can(' manage_options ')) {
        wp_send_json_error(__('You are not allowed to run this action.', 'wp-reset'));
      }
@@ -one thousand and thirty-one +one thousand and thirty-one @@
 
      // only admins can reset;  double-check
-     if (!$this->is_cli_running() && ! current_user_can(' administrator ')) {
+     if (!$this->is_cli_running() && ! current_user_can(' manage_options ')) {
        return false;
      }
@@ -one thousand one hundred and thirty-five +one thousand one hundred and thirty-five @@
    {
      // only admins can perform actions
-     if (!current_user_can(' administrator ')) {
+     if (!current_user_can(' manage_options ')) {
        return;
      }
@@ -one thousand two hundred and seventy-six +one thousand two hundred and seventy-six @@
      global $current_user;
 
-     echo '<div style="padding: 15px;  display: inline-block; font-size: 14px; " id="message" class="updated"><p style="font-size: 14px; ">' . sprintf(__('<b>Site has been successfully reset to default settings.</b><br>User "%s" was restored with the password unchanged. Open <a href="%s">WP Reset</a> to do another reset.', 'wp-reset'), esc_html($current_user->user_login), esc_url(admin_url('tools.php? page=wp-reset'))) . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<div style="padding: 15px;  display: inline-block; font-size: 14px; " id="message" class="updated"><p style="font-size: 14px; ">' . sprintf(__('<b>Site has been successfully reset to default settings.</b><br>User "%s" was restored with the password unchanged. Open <a href="%s">WP Reset</a> to do another reset.', 'wp-reset'), esc_html($current_user->user_login), esc_url(admin_url('tools.php? page=wp-reset'))) . '</p>') ;
 
      if (false == $this->get_dismissed_notices('rate')) {
@@ -one thousand four hundred and ten +one thousand four hundred and ten @@
    {
      // double check for admin privileges
-     if (!current_user_can(' administrator ')) {
-       wp_die( __('Sorry,  you are not allowed to access this page.', 'wp-reset'));
+     if (!current_user_can(' manage_options ')) {
+       wp_die( esc_html __('Sorry,  you are not allowed to access this page.', 'wp-reset'));
      }
 
@@ -one thousand four hundred and nineteen +one thousand four hundred and nineteen @@
      echo '<header>';
      echo '<div class="wpr-container">';
-     echo '<img id="logo-icon" src="' . esc_url($this->plugin_url) . 'img/wp-reset-logo.png" title="' . __('WP Reset', 'wp-reset') . ' " alt="' . __('WP Reset', 'wp-reset') . ' ">';
+     echo '<img id="logo-icon" src="' . esc_url($this->plugin_url) . 'img/wp-reset-logo.png" title="' . esc_html__('WP Reset', 'wp-reset') . ' " alt="' .  esc_html __('WP Reset', 'wp-reset') . ' ">';
      echo '</div>';
      echo '</header>';
@@ -one thousand five hundred and forty +one thousand five hundred and forty @@
      if (false === $notice_shown && is_multisite()) {
        echo '<div class="card notice-wrapper notice-error">';
-       echo '<h2>' . __('WP Reset is not compatible with multisite!', 'wp-reset') . '</ h2>';
-       echo '<p>' . __('Please be careful when using WP Reset with multisite enabled.  It\'s not recommended to reset the main site. Sub-sites should be OK. We\'re working on making it fully compatible with WP-MU. <b>Till then please be careful.</b> Thank you for understanding.', 'wp-reset') . '</p>' ;
+       echo '<h2>' . esc_html __('WP Reset is not compatible with multisite!', 'wp-reset') . '</ h2>';
+       WP_Reset_Utility::wp_kses_wf('<p>' . __ ('Please be careful when using WP Reset with multisite enabled. It\'s not recommended to reset the main site. Sub-sites should be OK. We\'re working on making it fully compatible with WP-MU. <b>Till then please be careful.</b> Thank you for understanding.', 'wp-reset') . '</ p>') ;
        echo '</div>';
        $notice_shown = true;
@@ -one thousand five hundred and fifty-two +one thousand five hundred and fifty-two @@
      ) {
        echo '<div class="card notice-wrapper notice-info">';
-       echo '<h2>' . __('Please help us spread the word &amp;  keep the plugin up-to-date', 'wp-reset') . '</h2>';
-       echo '<p>' . __('If you use &amp;  enjoy WP Reset, <b>please rate it on WordPress.org</b>. It only takes a second and helps us keep the plugin maintained. Thank you!', 'wp-reset') . '</p>' ;
-       echo '<p><a class="button-primary button" title="' . __('Rate WP Reset', 'wp-reset') . ' " target="_blank" href=" https://wordpress.org/support/plugin/wp-reset/reviews/#new -post">' . __('Rate the plugin ★★★★★', 'wp-reset') . '</a>  <a href="#" class="wpr-dismiss-notice dismiss-notice-rate" data-notice="rate">' . __('I\'ve already rated it', 'wp-reset') . '</ a></p>';
+       echo '<h2>' . esc_html __('Please help us spread the word &amp;  keep the plugin up-to-date', 'wp-reset') . '</h2>';
+       WP_Reset_Utility::wp_kses_wf('<p>' . __ ('If you use &amp;  enjoy WP Reset, <b>please rate it on WordPress.org</b>. It only takes a second and helps us keep the plugin maintained. Thank you!', 'wp-reset') . '</p>') ;
+       echo '<p><a class="button-primary button" title="' . esc_html__('Rate WP Reset', 'wp-reset') . ' " target="_blank" href=" https://wordpress.org/support/plugin/wp-reset/reviews/#new -post">' . esc_html__('Rate the plugin ★★★★★', 'wp-reset') . '</a>  <a href="#" class="wpr-dismiss-notice dismiss-notice-rate" data-notice="rate">' . esc_html __('I\'ve already rated it', 'wp-reset') . '</ a></p>';
        echo '</div>';
        $notice_shown = true;
@@ -one thousand six hundred and forty-two +one thousand six hundred and forty-two @@
      echo '</table>';
 
-     echo '<p><b>' . __('What happens when I run any Reset tool?', 'wp-reset') . '</ b></p>';
+     echo '<p><b>' . esc_html __('What happens when I run any Reset tool?', 'wp-reset') . '</ b></p>';
      echo '<ul class="plain-list">';
-     echo '<li>' . __('remember, always <b>make a backup first</b> or use <a href="#" class="change-tab" data-tab="2">snapshots</a>', 'wp-reset') . '</li>' ;
-     echo '<li>' . __('you will have to confirm the action one more time', 'wp-reset') . '</ li>';
-     echo '<li>' . __('see the table above to find out what exactly will be reset or deleted', 'wp-reset') . '</ li>';
-     echo '<li>' . __('site title,  WordPress URL, site URL, site language, search engine visibility and current user will always be restored', 'wp-reset') . '</li>';
-     echo '<li>' . __('you will be logged out,  automatically logged back in and taken to the admin dashboard', 'wp-reset') . '</li>';
-     echo '<li>' . __('WP Reset plugin will be reactivated if that option is chosen', 'wp-reset') . '</ li>';
+     WP_Reset_Utility::wp_kses_wf('<li>' . __ ('remember, always <b>make a backup first</b> or use <a href="#" class="change-tab" data-tab="2">snapshots</a>', 'wp-reset') . '</li>') ;
+     echo '<li>' . esc_html __('you will have to confirm the action one more time', 'wp-reset') . '</ li>';
+     echo '<li>' . esc_html __('see the table above to find out what exactly will be reset or deleted', 'wp-reset') . '</ li>';
+     echo '<li>' . esc_html __('site title,  WordPress URL, site URL, site language, search engine visibility and current user will always be restored', 'wp-reset') . '</li>';
+     echo '<li>' . esc_html __('you will be logged out,  automatically logged back in and taken to the admin dashboard', 'wp-reset') . '</li>';
+     echo '<li>' . esc_html __('WP Reset plugin will be reactivated if that option is chosen', 'wp-reset') . '</ li>';
      echo '</ul>';
 
-     echo '<p><b>' . __('WP-CLI Support', 'wp-reset') . '</ b><br>';
-     echo '' .  sprintf( __('All tools available via GUI are available in WP-CLI as well. To get the list of commands run %s. Instead of the active user,  the first user with admin privileges found in the database will be restored. ', 'wp-reset'), '<code>wp help reset</code>');
-     echo sprintf( __('All actions have to be confirmed. If you want to skip confirmation use the standard %s option. Please be careful and backup first.', 'wp-reset'), '<code>--yes</code>') . '</ p>';
+     echo '<p><b>' . esc_html __('WP-CLI Support', 'wp-reset') . '</ b><br>';
+     echo '' .  sprintf( esc_html __('All tools available via GUI are available in WP-CLI as well. To get the list of commands run %s. Instead of the active user,  the first user with admin privileges found in the database will be restored. ', 'wp-reset'), '<code>wp help reset</code>');
+     echo sprintf( esc_html __('All actions have to be confirmed. If you want to skip confirmation use the standard %s option. Please be careful and backup first.', 'wp-reset'), '<code>--yes</code>') . '</ p>';
 
      echo '</div></div>'; //  card description
@@ -one thousand six hundred and seventy-three +one thousand six hundred and seventy-three @@
      WP_Reset_Utility::wp_kses_wf($this->get_tool_icons(false, true));
 
-     echo '<p><br><label for="reset-options-reactivate-theme"><input type="checkbox" id="reset-options-reactivate-theme" value="1"> ' . __('Reactivate current theme', 'wp-reset') . ' - ' .  esc_html($theme_name) . '</ label></p>';
+     echo '<p><br><label for="reset-options-reactivate-theme"><input type="checkbox" id="reset-options-reactivate-theme" value="1"> ' . esc_html __('Reactivate current theme', 'wp-reset') . ' - ' .  esc_html($theme_name) . '</ label></p>';
      echo '<p><label for="reset-options-reactivate-plugins"><input type="checkbox" id="reset-options-reactivate-plugins" value="1"> Reactivate ' .  esc_attr(sizeof($active_plugins)) . '  currently active plugin' . (sizeof($active_plugins) !=  1 ? ' s' : '') . ' (WP Reset will reactivate by default)</label></p>';
 
@@ -one thousand six hundred and eighty-three +one thousand six hundred and eighty-three @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Site Reset', 'wp-reset'), 'tool-site-reset', array('collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p><label for="reactivate-theme"><input name="wpr-post-reset[reactivate_theme]" type="checkbox" id="reactivate-theme" value="1"> ' . __('Reactivate current theme', 'wp-reset') . ' - ' .  esc_html($theme->get('Name')) . '</ label></p>';
-     echo '<p><label for="reactivate-wpreset"><input name="wpr-post-reset[reactivate_wpreset]" type="checkbox" id="reactivate-wpreset" value="1" checked> ' . __('Reactivate WP Reset plugin', 'wp-reset') . '</ label></p>';
-
-     echo '<p><label for="reactivate-plugins"><input name="wpr-post-reset[reactivate_plugins]" type="checkbox" id="reactivate-plugins" value="1"> ' . __('Reactivate all currently active plugins', 'wp-reset') . '</ label></p>';
-     echo '<p>' . __('Type <b>reset</b> in the confirmation field to confirm the reset and then click the "Reset WordPress" button.< br>Always <a href="#" class="create-new-snapshot" data-description="Before resetting the site">create a snapshot</a> before resetting if you want to be able to undo.', 'wp-reset') . '</p>' ;
+     echo '<p><label for="reactivate-theme"><input name="wpr-post-reset[reactivate_theme]" type="checkbox" id="reactivate-theme" value="1"> ' . esc_html __('Reactivate current theme', 'wp-reset') . ' - ' .  esc_html($theme->get('Name')) . '</ label></p>';
+     echo '<p><label for="reactivate-wpreset"><input name="wpr-post-reset[reactivate_wpreset]" type="checkbox" id="reactivate-wpreset" value="1" checked> ' . esc_html __('Reactivate WP Reset plugin', 'wp-reset') . '</ label></p>';
+
+     echo '<p><label for="reactivate-plugins"><input name="wpr-post-reset[reactivate_plugins]" type="checkbox" id="reactivate-plugins" value="1"> ' . esc_html __('Reactivate all currently active plugins', 'wp-reset') . '</ label></p>';
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('Type <b>reset</b> in the confirmation field to confirm the reset and then click the "Reset WordPress" button.<br>Always <a href="#" class="create-new-snapshot" data-description="Before resetting the site">create a snapshot</a> before resetting if you want to be able to undo.', 'wp-reset') . '</ p>') ;
 
      wp_nonce_field('wp-reset');
      echo '<p class="mb0"><input id="wp_reset_confirm" type="text" name="wp_reset_confirm" placeholder="' . esc_attr(sprintf(__('Type in: %s', 'wp-reset'), '"reset"')) . '" value="" autocomplete="off"> &nbsp;';
-     echo '<a id="wp_reset_submit" class="button button-delete">' . __('Reset Site', 'wp-reset') . '</ a>';
+     echo '<a id="wp_reset_submit" class="button button-delete">' . esc_html __('Reset Site', 'wp-reset') . '</ a>';
      WP_Reset_Utility::wp_kses_wf($this->get_snapshot_button('reset-wordpress', 'Before resetting the site'));
      echo '</p>';
@@ -one thousand seven hundred and eight +one thousand seven hundred and eight @@
        echo '<p class="mb0 wpmu-error">This tool is <b>not compatible</b> with WP multisite (WPMU).  Using it would delete files shared by multiple sites in the WP network.</p>';
      } else {
-       echo '<p><br><label for="nuclear-reset-reactivate-wpreset"><input type="checkbox" id="nuclear-reset-reactivate-wpreset" value="1" checked> ' . __('Reactivate WP Reset plugin', 'wp-reset') . '</ label></p>';
-
-       echo '<p>' . __('Type <b>reset</b> in the confirmation field to confirm the reset and then click the "Reset WordPress &amp; Delete All Custom Files &amp; Data" button. < b>There is NO UNDO.', 'wp-reset') . '</b></p>' ;
-
-       echo '<p class="mb0"><input id="nuclear_reset_confirm" type="text" placeholder="' . esc_ attr __('Type in "reset"', 'wp-reset') . ' " value="" autocomplete="off"> &nbsp;';
-       echo '<a class="button button-delete button-pro-feature" href="#">' . __('Reset WordPress &amp; Delete All Custom Files &amp; Data', 'wp-reset') . ' - <span data-feature="tool-nuclear-reset" class="pro-feature"><span class="pro">PRO</span> tool</span></a></p>';
+       echo '<p><br><label for="nuclear-reset-reactivate-wpreset"><input type="checkbox" id="nuclear-reset-reactivate-wpreset" value="1" checked> ' . esc_html __('Reactivate WP Reset plugin', 'wp-reset') . '</ label></p>';
+
+       WP_Reset_Utility::wp_kses_wf('<p>' . __ ('Type <b>reset</b> in the confirmation field to confirm the reset and then click the "Reset WordPress &amp; Delete All Custom Files &amp; Data" button. < b>There is NO UNDO.', 'wp-reset') . '</b></p>') ;
+
+       echo '<p class="mb0"><input id="nuclear_reset_confirm" type="text" placeholder="' . esc_ html __('Type in "reset"', 'wp-reset') . ' " value="" autocomplete="off"> &nbsp;';
+       echo '<a class="button button-delete button-pro-feature" href="#">' . esc_html __('Reset WordPress &amp; Delete All Custom Files &amp; Data', 'wp-reset') . ' - <span data-feature="tool-nuclear-reset" class="pro-feature"><span class="pro">PRO</span> tool</span></a></p>';
      }
      echo '</div>';
@@ -one thousand seven hundred and eighty-two +one thousand seven hundred and eighty-two @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Reset Theme Options', 'wp-reset'), 'tool-reset-theme-options', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('All options (mods) for all themes will be reset;  not just for the active theme. The tool works only for themes that use the <a href=" https://codex.wordpress.org/Theme_Modification_API " target="_blank">WordPress theme modification API</a>. If options are saved in some other, custom way they won\'t be reset.<br> Always <a href="#" class="create-new-snapshot" data-description="Before resetting theme options">create a snapshot</a> before using this tool if you want to be able to undo its actions.', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('All options (mods) for all themes will be reset;  not just for the active theme. The tool works only for themes that use the <a href=" https://codex.wordpress.org/Theme_Modification_API " target="_blank">WordPress theme modification API</a>. If options are saved in some other, custom way they won\'t be reset.<br> Always <a href="#" class="create-new-snapshot" data-description="Before resetting theme options">create a snapshot</a> before using this tool if you want to be able to undo its actions.', 'wp-reset') . '</p>') ;
      WP_Reset_Utility::wp_kses_wf($this->get_tool_icons(false, true));
      echo '<p class="mb0"><a data-confirm-title="Are you sure you want to reset all theme options?" data-btn-confirm="Reset theme options" data-text-wait="Resetting theme options. Please wait." data-text-confirm="All options (mods) for all themes will be reset. Always ' . esc_attr('<a data-description="Before resetting theme options" href=" #" class="create-new-snapshot">create a snapshot</a> if you want to be able to undo') . '." data-text-done="Options for %n themes have been reset." data-text-done-singular="Options for one theme have been reset." class="button button-delete" href="#" id="reset-theme-options">Reset theme options</a>';
@@ -one thousand eight hundred and seventy-six +one thousand eight hundred and seventy-six @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Delete Themes', 'wp-reset'), 'tool-delete-themes', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('All themes will be deleted.  Including the currently active theme - ' . esc_html($theme->get('Name')) . '.< br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('All themes will be deleted. Including the currently active theme - ' . esc_html($theme->get('Name')) . '.< br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</p>') ;
      WP_Reset_Utility::wp_kses_wf($this->get_tool_icons(true, true));
      echo '<p class="mb0"><a data-confirm-title="Are you sure you want to delete all themes?" data-btn-confirm="Delete all themes" data-text-wait="Deleting all themes. Please wait." data-text-confirm="All themes will be deleted. There is NO UNDO. WP Reset does not make any file backups." data-text-done="%n themes have been deleted."  data-text-done-singular="One theme has been deleted." class="button button-delete" href="#" id="delete-themes">Delete all themes</a></p>';
@@ -one thousand eight hundred and eighty-five +one thousand eight hundred and eighty-five @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Delete Plugins', 'wp-reset'), 'tool-delete-plugins', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('All plugins will be deleted except for WP Reset which will remain active.< br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('All plugins will be deleted except for WP Reset which will remain active.<br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</ p>') ;
      WP_Reset_Utility::wp_kses_wf($this->get_tool_icons(true, true));
      echo '<p class="mb0"><a data-confirm-title="Are you sure you want to delete all plugins?" data-btn-confirm="Delete plugins" data-text-wait="Deleting plugins. Please wait." data-text-confirm="All plugins except WP Reset will be deleted. There is NO UNDO. WP Reset does not make any file backups." data-text-done="%n plugins have been deleted."  data-text-done-singular="One plugin has been deleted." class="button button-delete" href="#" id="delete-plugins">Delete plugins</a></p>';
@@ -one thousand nine hundred and twelve +one thousand nine hundred and twelve @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Clean uploads Folder', 'wp-reset'), 'tool-delete-uploads', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('All files in <code>' .  esc_html($upload_dir['basedir']) . '</ code> folder will be deleted. Including folders and subfolders, and files in subfolders. Files associated with <a href="' .  esc_url(admin_url('upload.php')) . ' ">media</a> entries will be deleted too.<br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('All files in <code>' . esc_html($upload_dir['basedir']) . '</ code> folder will be deleted. Including folders and subfolders, and files in subfolders. Files associated with <a href="' .  esc_url(admin_url('upload.php')) . ' ">media</a> entries will be deleted too.<br><b>There is NO UNDO. WP Reset does not make any file backups.</b>', 'wp-reset') . '</p>') ;
      WP_Reset_Utility::wp_kses_wf($this->get_tool_icons(true, false));
      if (false != $upload_dir['error']) {
@@ -one thousand nine hundred and forty +one thousand nine hundred and forty @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Empty or Delete Custom Tables', 'wp-reset'), 'tool-empty-delete-custom-tables', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('This action affects only custom tables with <code>' .  esc_html($wpdb->prefix) . '</ code> prefix. Core WP tables and other tables in the database that do not have that prefix will not be deleted/emptied. Deleting (dropping) tables completely removes them from the database.  Emptying (truncating) removes all content from them, but keeps the structure intact.<br>Always <a href="#" class="create-new-snapshot" data-description="Before deleting custom tables">create a snapshot</a> before using this tool if you want to be able to undo its actions.</p>', 'wp-reset' );
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('This action affects only custom tables with <code>' . esc_html($wpdb->prefix) . '</ code> prefix. Core WP tables and other tables in the database that do not have that prefix will not be deleted/emptied. Deleting (dropping) tables completely removes them from the database.  Emptying (truncating) removes all content from them, but keeps the structure intact.<br>Always <a href="#" class="create-new-snapshot" data-description="Before deleting custom tables">create a snapshot</a> before using this tool if you want to be able to undo its actions.</p>', 'wp-reset') );
      if ($custom_tables) {
-       echo '<p>' . __('The following ' .  esc_html(sizeof($custom_tables)) . '  custom tables are affected by this tool: ', 'wp-reset' );
+         WP_Reset_Utility::wp_kses_wf('<p>' . __('The following ' . sizeof($custom_tables) . '  custom tables are affected by this tool: ', 'wp-reset') );
        foreach ($custom_tables as $tbl) {
          echo '<code>' .  esc_html($tbl['name']) . '</ code>';
@@ -one thousand nine hundred and fifty-two +one thousand nine hundred and fifty-two @@
        $custom_tables_btns = '';
      } else {
-       echo '<p>' . __('There are no custom tables. There\'s nothing for this tool to empty or delete.', 'wp-reset') . '</ p>';
+       echo '<p>' . esc_html __('There are no custom tables. There\'s nothing for this tool to empty or delete.', 'wp-reset') . '</ p>';
        $custom_tables_btns = ' disabled';
      }
@@ -one thousand nine hundred and ninety-seven +one thousand nine hundred and ninety-seven @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Delete .htaccess File', 'wp-reset'), 'tool-delete-htaccess', array('iot_button' => true, 'collapse_button' => true)));
      echo '<div class="card-body">';
-     echo '<p>' . __('This action deletes the .htaccess file located in <code>' .  esc_html($this->get_htaccess_path()) . '</ code><br><b>There is NO UNDO. WP Reset does not make any file backups.</b></p>', 'wp-reset' );
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('This action deletes the .htaccess file located in <code>' . esc_html($this->get_htaccess_path()) . '</ code><br><b>There is NO UNDO. WP Reset does not make any file backups.</b></p>', 'wp-reset') );
 
      echo '<p>If you need to edit .htaccess, install our free <a href="' .  esc_url(admin_url('plugin-install.php?tab=plugin-information&plugin=wp-htaccess-editor&TB_iframe=true&width=600&height=550')) . '" class="thickbox open-plugin-details-modal">WP Htaccess Editor</a> plugin.  It automatically creates backups when you edit .htaccess as well as checks for syntax errors. To create the default .htaccess file open <a href="' .  esc_url(admin_url('options-permalink.php')) . ' ">Settings - Permalinks</a> and re-save settings. WordPress will recreate the file.</p>';
@@ -two thousand and eighteen +two thousand and eighteen @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header('What are Plugin & Theme Collections?', 'collections-info', array('collapse_button' => false)));
      echo '<div class="card-body">';
-     echo '<p>' . __('Have a set of plugins (and themes) that you install and activate after every reset?  Or on every fresh WordPress installation? Well, no more clicking install &amp; active for ten minutes! Build the collection once and install it with one click as many times as needed.</p><p>WP Reset stores collections in the cloud so they\'re accessible on every site you build. You can use free plugins and themes from the official repo,   and PRO ones by uploading a ZIP file. We\'ll safely store your license keys too, so you have everything in one place.', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('Have a set of plugins (and themes) that you install and activate after every reset?  Or on every fresh WordPress installation? Well, no more clicking install &amp; active for ten minutes! Build the collection once and install it with one click as many times as needed.</p><p>WP Reset stores collections in the cloud so they\'re accessible on every site you build. You can use free plugins and themes from the official repo,   and PRO ones by uploading a ZIP file. We\'ll safely store your license keys too, so you have everything in one place.', 'wp-reset') . '</p>') ;
      echo '<p><a class="button button-secondary button-pro-feature" href="#">Add a new collection - <span data-feature="collections" class="pro-feature"><span class="pro">PRO</span> feature</span></a> &nbsp; < a class="button button-secondary button-pro-feature" href="#">Reload my saved collections from the cloud - <span data-feature="collections" class="pro-feature"><span class="pro">PRO</span> feature</span></a></p>';
      echo '</div>';
@@ -two thousand and seventy-four +two thousand and seventy-four @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Documentation', 'wp-reset'), 'support-documentation', array('collapse_button' => false)));
      echo '<div class="card-body">';
-     echo '<p class="mb0">' . __('All tools and features are explained in detail in <a href="' . esc_url($this->generate_web_link('support-tab', '/documentation/')) . ' " target="_blank">the documentation</a>. We did our best to describe how things work on both the code level and an "average user" level.', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p class="mb0">' . __ ('All tools and features are explained in detail in <a href="' . esc_url($this->generate_web_link('support-tab', '/documentation/')) . '" target="_blank">the documentation</a>.  We did our best to describe how things work on both the code level and an "average user" level.', 'wp-reset') . '</p>') ;
      echo '</div>';
      echo '</div>'; //  documentation
@@ -two thousand and ninety-eight +two thousand and ninety-eight @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Public Support Forum', 'wp-reset'), 'support-forum', array('collapse_button' => false)));
      echo '<div class="card-body">';
-     echo '<p>' . __('We are very active on the <a href=" https://wordpress.org/support/plugin/wp-reset " target="_blank">official WP Reset support forum</a>. If you found a bug,  have a feature idea or just want to say hi - please drop by. We love to hear back from our users.', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p>' . __ ('We are very active on the <a href=" https://wordpress.org/support/plugin/wp-reset " target="_blank">official WP Reset support forum</a>. If you found a bug,  have a feature idea or just want to say hi - please drop by. We love to hear back from our users.', 'wp-reset') . '</p>') ;
      echo '</div>';
      echo '</div>'; //  forum
@@ -two thousand one hundred and twelve +two thousand one hundred and twelve @@
      WP_Reset_Utility::wp_kses_wf($this->get_card_header(__('Care to Help Out?', 'wp-reset'), 'support-help-out', array('collapse_button' => false)));
      echo '<div class="card-body">';
-     echo '<p class="mb0">' . __('No need for donations :) If you can give us a <a href=" https://wordpress.org/support/plugin/wp-reset/reviews/#new -post" target="_blank">five star rating</a> you\'ll help out more than you can imagine. A public mention <a href=" https://twitter.com/webfactoryltd " target="_blank">@webfactoryltd</a> also does wonders. Thank you!', 'wp-reset') . '</p>' ;
+     WP_Reset_Utility::wp_kses_wf('<p class="mb0">' . __ ('No need for donations :) If you can give us a <a href=" https://wordpress.org/support/plugin/wp-reset/reviews/#new -post" target="_blank">five star rating</a> you\'ll help out more than you can imagine. A public mention <a href=" https://twitter.com/webfactoryltd " target="_blank">@webfactoryltd</a> also does wonders. Thank you!', 'wp-reset') . '</p>') ;
      echo '</div>';
      echo '</div>'; //  help out
@@ -two thousand three hundred and ten +two thousand three hundred and ten @@
      echo '<div class="card" id="card-snapshots">';
      echo '<h4>';
-     echo __('Snapshots', 'wp-reset');
-     echo '<div class="card-header-right"><a class="toggle-card tooltip" href="#" title="' . __('Collapse / expand box', 'wp-reset') . ' "><span class="dashicons dashicons-arrow-up-alt2"></span></a></div>';
+     echo esc_html __('Snapshots', 'wp-reset');
+     echo '<div class="card-header-right"><a class="toggle-card tooltip" href="#" title="' . esc_html __('Collapse / expand box', 'wp-reset') . ' "><span class="dashicons dashicons-arrow-up-alt2"></span></a></div>';
      echo '</h4>';
      echo '<div class="card-body">';
@@ -three thousand and thirteen +three thousand and thirteen @@
      check_ajax_referer('install_wpfssl');
 
-     if (false === current_user_can(' administrator ')) {
+     if (false === current_user_can(' manage_options ')) {
        wp_die('Sorry,  you have to be an admin to run this action.');
      }
@@ -three thousand and thirty-five +three thousand and thirty-five @@
 
      echo '<div style="margin: 20px; color:#444;">';
-     echo 'If things are not done in a minute <a target="_parent" href="' . admin_url('plugin-install.php? s=force%20ssl%20webfactory&tab=search&type=term' ) .' ">install the plugin manually via Plugins page</a><br><br>';
+     echo 'If things are not done in a minute <a target="_parent" href="' . esc_url(admin_url('plugin-install.php? s=force%20ssl%20webfactory&tab=search&type=term') ) .' ">install the plugin manually via Plugins page</a><br><br>';
      echo 'Starting ...< br><br>';
 
@@ -three thousand and sixty-two +three thousand and sixty-two @@
        }
      } else {
-       echo 'Could not install WP Force SSL.  You\'ll have to <a target="_parent" href="' . admin_url('plugin-install.php? s=force%20ssl%20webfactory&tab=search&type=term' ) .' ">download and install manually</a>.';
+       echo 'Could not install WP Force SSL.  You\'ll have to <a target="_parent" href="' . esc_url(admin_url('plugin-install.php? s=force%20ssl%20webfactory&tab=search&type=term') ) .' ">download and install manually</a>.';
      }