CVE-2014-125035: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in Jobs-Plugin. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier of the patch is b8a56718b1d42834c6ec51d9c489c5dc20471d7b. It is recommended to apply a patch to fix this issue. The identifier VDB-217189 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-02T16:15Z
Repository: https://github.com/mrbobbybryant/Jobs-Plugin
Language: PHP
Files changed: hrm-jobs.php, jobs-cpt.php, jobs-fields.php, js/reorder.js, render-admin.php
Commit date: 2014-12-01 08:25:49 -0700
Commit message: Whitespace/code cleanup

* add limits and no_count_rows to optimize queries
* add some missing output escaping
* change some spaces to tabs, some remain
* add coding standards spacing to JS as well
* cast post id as (int) to avoid XSS vector

Diff: diff --git a/hrm-jobs.php b/hrm-jobs.php
index e8f13d7..ad761b2 100644
--- a/hrm-jobs.php
+++ b/hrm-jobs.php
@@ -28,11 +28,11 @@ if ( is_object($screen) && 'job' == $screen->post_type ) {
 
 	wp_enqueue_script( 'jquery-ui-sortable' );
 	wp_enqueue_script( 'reorder-js', plugins_url( '/js/reorder.js', __FILE__), array('jquery'), '', true );
 	wp_enqueue_script( 'jquery-ui-datepicker' );
   	wp_enqueue_script( 'field-date-js', plugins_url('js/Field_Date.js', __FILE__), array('jquery-core', 'jquery-ui-core', 'jquery-ui-datepicker'), '', true );
-	wp_enqueue_style('jquery-style', 'http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.2/themes/smoothness/jquery-ui.css');
+	wp_enqueue_style( 'jquery-style', 'http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.2/themes/smoothness/jquery-ui.css' );
   }
 }
 add_action( 'admin_enqueue_scripts', 'hrm_jobs_enqueue_scripts' );
 
 /**
@@ -44,17 +44,17 @@ require_once 'render-admin.php';
 
 /**
  * Create Sorting Admin Page
  */
 function hrm_jobs_add_menu_page() {
-	add_submenu_page( 
-		'edit.php?post_type=job', 
-		'Reorder Jobs', 
-		'Reorder Jobs', 
-		'edit_pages', 
-		'reorder_jobs', 
-		'hrm_jobs_render_admin' 
+	add_submenu_page(
+		'edit.php?post_type=job',
+		'Reorder Jobs',
+		'Reorder Jobs',
+		'edit_pages',
+		'reorder_jobs',
+		'hrm_jobs_render_admin'
 	);
 }
 
 /**
  * Create Jobs Shortcode
@@ -62,39 +62,41 @@ function hrm_jobs_add_menu_page() {
 
 function hrm_jobs_list_shortcode ( $atts, $content = null ) {
 	$args = array(
 		'post_type' => 'job',
 		'orderby' => 'menu_order',
-		'order' => 'ASC'
+		'order' => 'ASC',
+		'post_per_page' => 100, /* add a reasonable max # rows */
+		'no_found_rows' => true, /* don't generate a count as part of query */
 	);
 
 	$jobs = new WP_Query( $args );
 	?>
-		
+
 	<?php   if ( $jobs->have_posts() ) : ?>
-	    	
+
 			<table id="job-list">
 				<tr>
 					<th>Job Title</th>
 					<th>Location</th>
 					<th></th>
 				</tr>
 				<?php while ( $jobs->have_posts() ) : $jobs->the_post(); ?>
-					
+
 					<?php $jobUrl = get_permalink(); ?>
 
 				<tr>
 					<td id="<?php the_id(); ?>"><?php the_title(); ?></td>
 					<td><?php the_terms( $post->ID, 'location') ?></td>
-					<td><a href="<?php echo esc_url($jobUrl) ?>">Learn More</a></td>
+					<td><a href="<?php echo esc_url( $jobUrl ) ?>">Learn More</a></td>
 				</tr>
-					
+
 				<?php endwhile; ?>
-	    	</table>
+			</table>
 
 			<?php else: ?>
-			<p><?php _e('You have no Jobs to display.', 'hrm_jobs'); ?></p>
+			<p><?php _e( 'You have no Jobs to display.', 'hrm_jobs' ); ?></p>
 			<?php endif; ?>
 		</div>
 
 	<?php
 
diff --git a/jobs-cpt.php b/jobs-cpt.php
index 365e8d7..1a06ad5 100644
--- a/jobs-cpt.php
+++ b/jobs-cpt.php
@@ -1,8 +1,8 @@
 <?php
 function hrm_jobs_posttype() {
-    
+
     $labels = array(
         'name'               => 'Jobs',
         'singular_name'      => 'Job',
         'menu_name'          => 'Jobs',
         'name_admin_bar'     => 'Jobs',
@@ -15,11 +15,11 @@ function hrm_jobs_posttype() {
         'search_items'       => 'Search Jobs',
         'parent_item_colon'  => 'Parent Jobs:',
         'not_found'          => 'No jobs found.',
         'not_found_in_trash' => 'No jobs found in Trash.',
     );
-    
+
     $args = array(
         'labels'             => $labels,
         'public'             => true,
         'publicly_queryable' => true,
         'show_ui'            => true,
@@ -43,11 +43,11 @@ function hrm_jobs_my_rewrite_flush() {
     flush_rewrite_rules();
 }
 register_activation_hook( __FILE__, 'hrm_jobs_my_rewrite_flush' );
 
 function hrm_location_tax() {
-    
+
     $labels = array(
             'name'                       => _x( 'Locations', 'taxonomy general name' ),
             'singular_name'              => _x( 'Location', 'taxonomy singular name' ),
             'search_items'               => __( 'Search Locations' ),
             'popular_items'              => __( 'Popular Locations' ),
diff --git a/jobs-fields.php b/jobs-fields.php
index 426fe0d..684f872 100644
--- a/jobs-fields.php
+++ b/jobs-fields.php
@@ -1,16 +1,16 @@
-<?php 
+<?php
 
 /**
  * Adds a meta box to the post editing screen
  */
 function hrm_custom_meta() {
-    add_meta_box( 
-      'hrm_meta', 
-      __( 'Job Listing', 'hrm-jobs' ), 
-      'hrm_meta_callback', 
-      'job' 
+    add_meta_box(
+      'hrm_meta',
+      __( 'Job Listing', 'hrm-jobs' ),
+      'hrm_meta_callback',
+      'job'
     );
 }
 add_action( 'add_meta_boxes', 'hrm_custom_meta' );
 
 /**
@@ -23,28 +23,28 @@ function hrm_meta_callback( $post ) {
     <div>
       <div class="meta-row">
           <div class="meta-th">
             <label for="job-id" class="hrm-row-title"><?php _e( 'Job ID', 'hrm-textdomain' )?></label>
           </div>
-          <div class="meta-td">  
-            <input type="text" name="job-id" id="job-id" value="<?php if ( isset ( $hrm_stored_meta['job-id'] ) ) echo $hrm_stored_meta['job-id'][0]; ?>" />
+          <div class="meta-td">
+            <input type="text" name="job-id" id="job-id" value="<?php if ( isset ( $hrm_stored_meta['job-id'] ) ) echo esc_attr( $hrm_stored_meta['job-id'][0] ); ?>" />
           </div>
       </div>
       <div class="meta-row">
           <div class="meta-th">
             <label for="date_listed" class="wpdt-row-title"><?php _e( 'Date Listed', 'hrm-textdomain' )?></label>
           </div>
           <div class="meta-td">
-            <input type="text" size="10" class="wpdt-row-content datepicker" name="date_listed" id="date_listed" value="<?php if ( isset ( $hrm_stored_meta['date_listed'] ) ) echo $hrm_stored_meta['date_listed'][0]; ?>" />
+            <input type="text" size="10" class="wpdt-row-content datepicker" name="date_listed" id="date_listed" value="<?php if ( isset ( $hrm_stored_meta['date_listed'] ) ) echo esc_attr( $hrm_stored_meta['date_listed'][0] ); ?>" />
           </div>
       </div>
       <div class="meta-row">
           <div class="meta-th">
             <label for="application_deadline" class="wpdt-row-title"><?php _e( 'Application Deadline', 'hrm-textdomain' )?></label>
           </div>
           <div class="meta-td">
-            <input type="text" size="10" class="wpdt-row-content datepicker" name="application_deadline" id="application_deadline" value="<?php if ( isset ( $hrm_stored_meta['application_deadline'] ) ) echo $hrm_stored_meta['application_deadline'][0]; ?>" />
+            <input type="text" size="10" class="wpdt-row-content datepicker" name="application_deadline" id="application_deadline" value="<?php if ( isset ( $hrm_stored_meta['application_deadline'] ) ) echo esc_attr( $hrm_stored_meta['application_deadline'][0] ); ?>" />
           </div>
       </div>
       <div class="meta-row">
           <div class="meta-th">
             <span>Principle Duties</span>
@@ -52,11 +52,11 @@ function hrm_meta_callback( $post ) {
           <div  class="meta-editor">
             <?php
 
               $content = get_post_meta( $post->ID, 'principle_duties', true );
               $editor_id = 'principle_duties';
-              $settings = array( 
+              $settings = array(
                 'textarea_rows' => 5,
               );
 
               wp_editor( $content, $editor_id, $settings );
 
@@ -66,19 +66,19 @@ function hrm_meta_callback( $post ) {
       <div class="meta-row">
         <div class="meta-th">
           <label for="minimum-requirements" class="wpdt-row-title"><?php _e( 'Minimum Requirements', 'hrm-textdomain' )?></label>
         </div>
         <div class="meta-td">
-          <textarea name="minimum-requirements" class ="hrm-textarea" id="minimum-requirements"><?php if ( isset ( $hrm_stored_meta['minimum-requirements'] ) ) echo $hrm_stored_meta['minimum-requirements'][0]; ?></textarea>
+          <textarea name="minimum-requirements" class ="hrm-textarea" id="minimum-requirements"><?php if ( isset ( $hrm_stored_meta['minimum-requirements'] ) ) echo esc_attr( $hrm_stored_meta['minimum-requirements'][0] ); ?></textarea>
         </div>
       </div>
       <div class="meta-row">
         <div class="meta-th">
           <label for="preferred-requirements" class="wpdt-row-title"><?php _e( 'Preferred Requirements', 'hrm-textdomain' )?></label>
         </div>
         <div class="meta-td">
-          <textarea name="preferred-requirements" class ="hrm-textarea" id="preferred-requirements"><?php if ( isset ( $hrm_stored_meta['preferred-requirements'] ) ) echo $hrm_stored_meta['preferred-requirements'][0]; ?></textarea>
+          <textarea name="preferred-requirements" class ="hrm-textarea" id="preferred-requirements"><?php if ( isset ( $hrm_stored_meta['preferred-requirements'] ) ) echo esc_attr( $hrm_stored_meta['preferred-requirements'][0] ); ?></textarea>
         </div>
       </div>
       <div class="meta-row">
         <div class="meta-th">
           <label for="relocation-assistance" class="prfx-row-title"><?php _e( 'Relocation Assistance', 'hrm-textdomain' )?></label>
@@ -97,21 +97,21 @@ function hrm_meta_callback( $post ) {
 
 /**
  * Saves the custom meta input
  */
 function hrm_meta_save( $post_id ) {
- 
+
     // Checks save status
     $is_autosave = wp_is_post_autosave( $post_id );
     $is_revision = wp_is_post_revision( $post_id );
     $is_valid_nonce = ( isset( $_POST[ 'hrm_nonce' ] ) && wp_verify_nonce( $_POST[ 'hrm_nonce' ], basename( __FILE__ ) ) ) ? 'true' : 'false';
- 
+
     // Exits script depending on save status
     if ( $is_autosave || $is_revision || !$is_valid_nonce ) {
         return;
     }
- 
+
     // Checks for input and sanitizes/saves if needed
     if( isset( $_POST[ 'job-id' ] ) ) {
         update_post_meta( $post_id, 'job-id', sanitize_text_field( $_POST[ 'job-id' ] ) );
     }
 
@@ -120,11 +120,11 @@ function hrm_meta_save( $post_id ) {
     }
 
     if( isset( $_POST[ 'minimum-requirements' ] ) ) {
         update_post_meta( $post_id, 'minimum-requirements', sanitize_text_field( $_POST[ 'minimum-requirements' ] ) );
     }
-    
+
     if( isset( $_POST[ 'date_listed' ] ) ) {
         update_post_meta( $post_id, 'date_listed', sanitize_text_field( $_POST[ 'date_listed' ] ) );
     }
 
     if( isset( $_POST[ 'application_deadline' ] ) ) {
@@ -143,17 +143,17 @@ add_action( 'save_post', 'hrm_meta_save' );
 
 /**
  * Change Placeholder text in Default title field.
  */
 function change_default_title( $title ){
- 
+
     $screen = get_current_screen();
- 
+
     if ( 'job' == $screen->post_type ){
         $title = "Enter Job Title Here";
     }
- 
+
     return $title;
 }
- 
+
 add_filter( 'enter_title_here', 'change_default_title' );
 
diff --git a/js/reorder.js b/js/reorder.js
index b66e42e..d3ae51e 100644
--- a/js/reorder.js
+++ b/js/reorder.js
@@ -1,33 +1,33 @@
 jQuery(document).ready(function($) {
-	$('div#jobs-admin-sort').each(function() {
+	$( 'div#jobs-admin-sort' ).each(function() {
 
-		var sortList = $('ul#custom-type-list');
+		var sortList = $( 'ul#custom-type-list' );
 
 		sortList.sortable({
 			update: function(event, ui) {
-				$('#loading-animation').show(); // Show the animate loading gif while waiting
+				$( '#loading-animation' ).show(); // Show the animate loading gif while waiting
 
 				opts = {
 					url: ajaxurl, // ajaxurl is defined by WordPress and points to /wp-admin/admin-ajax.php
 					type: 'POST',
 					async: true,
 					cache: false,
 					dataType: 'json',
 					data:{
 						action: 'save_sort', // Tell WordPress how to handle this ajax request
-						order: sortList.sortable('toArray').toString() // Passes ID's of list items in	1,3,2 format
+						order: sortList.sortable( 'toArray' ).toString() // Passes ID's of list items in	1,3,2 format
 					},
 					success: function(response) {
-						$('div#message').remove();
-						$('#loading-animation').hide(); // Hide the loading animation
-						$('div#jobs-admin-sort h2:first').after('<div id="message" class="updated below-h2"><p>Jobs sort order has been saved</p></div>');
+						$( 'div#message' ).remove();
+						$( '#loading-animation' ).hide(); // Hide the loading animation
+						$( 'div#jobs-admin-sort h2:first' ).after( '<div id="message" class="updated below-h2"><p>Jobs sort order has been saved</p></div>' );
 						return;
 					},
 					error: function(xhr,textStatus,e) {
-						$('#loading-animation').hide(); // Hide the loading animation
-						$('div#jobs-admin-sort h2:first').after('<div id="message" class="error below-h2"><p>There was an error saving the sort order. Please try again later.</p></div>');
+						$( '#loading-animation' ).hide(); // Hide the loading animation
+						$( 'div#jobs-admin-sort h2:first' ).after( '<div id="message" class="error below-h2"><p>There was an error saving the sort order. Please try again later.</p></div>' );
 						return;
 					}
 				};
 				$.ajax(opts);
 			}
diff --git a/render-admin.php b/render-admin.php
index 1dd10a4..2abe74b 100644
--- a/render-admin.php
+++ b/render-admin.php
@@ -2,42 +2,48 @@
 
 function hrm_jobs_render_admin() {
 	$args = array(
 		'post_type' => 'job',
 		'orderby' => 'menu_order',
-		'order' => 'ASC'
+		'order' => 'ASC',
+		'post_per_page' => 100, /* add a reasonable max # rows */
+		'no_found_rows' => true, /* don't generate a count as part of query */
+
 	);
 
 	$jobs = new WP_Query( $args );
 	?>
 		<div id="jobs-admin-sort" class="wrap">
 		<div id="icon-job-admin" class="icon32"><br /></div>
-		<h2><?php _e('Sort Job Positions', 'hrm_jobs'); ?> <img src=" <?php echo admin_url(); ?>/images/loading.gif" id="loading-animation" /></h2>
+		<h2><?php _e('Sort Job Positions', 'hrm_jobs'); ?> <img src="<?php echo esc_url( admin_url() . '/images/loading.gif' ); ?>" id="loading-animation" /></h2>
 			<?php if ( $jobs->have_posts() ) : ?>
-	    	<p><?php _e('<strong>Note:</strong> this only affects the Jobs listed using the shortcode functions', 'hrm_jobs'); ?></p>
+			<p><?php _e('<strong>Note:</strong> this only affects the Jobs listed using the shortcode functions', 'hrm_jobs'); ?></p>
 			<ul id="custom-type-list">
 				<?php while ( $jobs->have_posts() ) : $jobs->the_post(); ?>
 					<li id="<?php the_id(); ?>"><?php the_title(); ?></li>
 				<?php endwhile; ?>
-	    	</ul>
+			</ul>
 			<?php else: ?>
-			<p><?php _e('You have no Jobs to sort.', 'hrm_jobs'); ?></p>
+			<p><?php _e( 'You have no Jobs to sort.', 'hrm_jobs' ); ?></p>
 			<?php endif; ?>
 		</div>
 
 	<?php
 }
 
 add_action( 'admin_menu', 'hrm_jobs_add_menu_page');
 
 function hrm_jobs_save_order() {
 
+	//@todo add a nonce here to verify user intent
+	//@todo add a capability check to ensure use caps
+
 	global $wpdb; // WordPress database class
 		$order = explode(',', $_POST['order']);
 		$counter = 0;
 		foreach ($order as $item_id) {
-			$wpdb->update($wpdb->posts, array( 'menu_order' => $counter ), array( 'ID' => $item_id) );
+			$wpdb->update( $wpdb->posts, array( 'menu_order' => $counter ), array( 'ID' => (int) $item_id) );
 			$counter++;
 		}
 		die(1);
 
 }

Vulnerable code: 	wp_enqueue_style('jquery-style', 'http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.2/themes/smoothness/jquery-ui.css');
	add_submenu_page( 
		'edit.php?post_type=job', 
		'Reorder Jobs', 
		'Reorder Jobs', 
		'edit_pages', 
		'reorder_jobs', 
		'hrm_jobs_render_admin' 
		'order' => 'ASC'
		
	    	
					
					<td><a href="<?php echo esc_url($jobUrl) ?>">Learn More</a></td>
					
	    	</table>
			<p><?php _e('You have no Jobs to display.', 'hrm_jobs'); ?></p>
    
    
    
<?php 
    add_meta_box( 
      'hrm_meta', 
      __( 'Job Listing', 'hrm-jobs' ), 
      'hrm_meta_callback', 
      'job' 
          <div class="meta-td">  
            <input type="text" name="job-id" id="job-id" value="<?php if ( isset ( $hrm_stored_meta['job-id'] ) ) echo $hrm_stored_meta['job-id'][0]; ?>" />
            <input type="text" size="10" class="wpdt-row-content datepicker" name="date_listed" id="date_listed" value="<?php if ( isset ( $hrm_stored_meta['date_listed'] ) ) echo $hrm_stored_meta['date_listed'][0]; ?>" />
            <input type="text" size="10" class="wpdt-row-content datepicker" name="application_deadline" id="application_deadline" value="<?php if ( isset ( $hrm_stored_meta['application_deadline'] ) ) echo $hrm_stored_meta['application_deadline'][0]; ?>" />
              $settings = array( 
          <textarea name="minimum-requirements" class ="hrm-textarea" id="minimum-requirements"><?php if ( isset ( $hrm_stored_meta['minimum-requirements'] ) ) echo $hrm_stored_meta['minimum-requirements'][0]; ?></textarea>
          <textarea name="preferred-requirements" class ="hrm-textarea" id="preferred-requirements"><?php if ( isset ( $hrm_stored_meta['preferred-requirements'] ) ) echo $hrm_stored_meta['preferred-requirements'][0]; ?></textarea>
 
 
 
    
 
 
 
 
	$('div#jobs-admin-sort').each(function() {
		var sortList = $('ul#custom-type-list');
				$('#loading-animation').show(); // Show the animate loading gif while waiting
						order: sortList.sortable('toArray').toString() // Passes ID's of list items in	1,3,2 format
						$('div#message').remove();
						$('#loading-animation').hide(); // Hide the loading animation
						$('div#jobs-admin-sort h2:first').after('<div id="message" class="updated below-h2"><p>Jobs sort order has been saved</p></div>');
						$('#loading-animation').hide(); // Hide the loading animation
						$('div#jobs-admin-sort h2:first').after('<div id="message" class="error below-h2"><p>There was an error saving the sort order. Please try again later.</p></div>');
		'order' => 'ASC'
		<h2><?php _e('Sort Job Positions', 'hrm_jobs'); ?> <img src=" <?php echo admin_url(); ?>/images/loading.gif" id="loading-animation" /></h2>
	    	<p><?php _e('<strong>Note:</strong> this only affects the Jobs listed using the shortcode functions', 'hrm_jobs'); ?></p>
	    	</ul>
			<p><?php _e('You have no Jobs to sort.', 'hrm_jobs'); ?></p>
			$wpdb->update($wpdb->posts, array( 'menu_order' => $counter ), array( 'ID' => $item_id) );
Fixed code: 	wp_enqueue_style( 'jquery-style', 'http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.2/themes/smoothness/jquery-ui.css' );
	add_submenu_page(
		'edit.php?post_type=job',
		'Reorder Jobs',
		'Reorder Jobs',
		'edit_pages',
		'reorder_jobs',
		'hrm_jobs_render_admin'
		'order' => 'ASC',
		'post_per_page' => 100, /* add a reasonable max # rows */
		'no_found_rows' => true, /* don't generate a count as part of query */



					<td><a href="<?php echo esc_url( $jobUrl ) ?>">Learn More</a></td>

			</table>
			<p><?php _e( 'You have no Jobs to display.', 'hrm_jobs' ); ?></p>



<?php
    add_meta_box(
      'hrm_meta',
      __( 'Job Listing', 'hrm-jobs' ),
      'hrm_meta_callback',
      'job'
          <div class="meta-td">
            <input type="text" name="job-id" id="job-id" value="<?php if ( isset ( $hrm_stored_meta['job-id'] ) ) echo esc_attr( $hrm_stored_meta['job-id'][0] ); ?>" />
            <input type="text" size="10" class="wpdt-row-content datepicker" name="date_listed" id="date_listed" value="<?php if ( isset ( $hrm_stored_meta['date_listed'] ) ) echo esc_attr( $hrm_stored_meta['date_listed'][0] ); ?>" />
            <input type="text" size="10" class="wpdt-row-content datepicker" name="application_deadline" id="application_deadline" value="<?php if ( isset ( $hrm_stored_meta['application_deadline'] ) ) echo esc_attr( $hrm_stored_meta['application_deadline'][0] ); ?>" />
              $settings = array(
          <textarea name="minimum-requirements" class ="hrm-textarea" id="minimum-requirements"><?php if ( isset ( $hrm_stored_meta['minimum-requirements'] ) ) echo esc_attr( $hrm_stored_meta['minimum-requirements'][0] ); ?></textarea>
          <textarea name="preferred-requirements" class ="hrm-textarea" id="preferred-requirements"><?php if ( isset ( $hrm_stored_meta['preferred-requirements'] ) ) echo esc_attr( $hrm_stored_meta['preferred-requirements'][0] ); ?></textarea>








	$( 'div#jobs-admin-sort' ).each(function() {
		var sortList = $( 'ul#custom-type-list' );
				$( '#loading-animation' ).show(); // Show the animate loading gif while waiting
						order: sortList.sortable( 'toArray' ).toString() // Passes ID's of list items in	1,3,2 format
						$( 'div#message' ).remove();
						$( '#loading-animation' ).hide(); // Hide the loading animation
						$( 'div#jobs-admin-sort h2:first' ).after( '<div id="message" class="updated below-h2"><p>Jobs sort order has been saved</p></div>' );
						$( '#loading-animation' ).hide(); // Hide the loading animation
						$( 'div#jobs-admin-sort h2:first' ).after( '<div id="message" class="error below-h2"><p>There was an error saving the sort order. Please try again later.</p></div>' );
		'order' => 'ASC',
		'post_per_page' => 100, /* add a reasonable max # rows */
		'no_found_rows' => true, /* don't generate a count as part of query */

		<h2><?php _e('Sort Job Positions', 'hrm_jobs'); ?> <img src="<?php echo esc_url( admin_url() . '/images/loading.gif' ); ?>" id="loading-animation" /></h2>
			<p><?php _e('<strong>Note:</strong> this only affects the Jobs listed using the shortcode functions', 'hrm_jobs'); ?></p>
			</ul>
			<p><?php _e( 'You have no Jobs to sort.', 'hrm_jobs' ); ?></p>
	//@todo add a nonce here to verify user intent
	//@todo add a capability check to ensure use caps

			$wpdb->update( $wpdb->posts, array( 'menu_order' => $counter ), array( 'ID' => (int) $item_id) );