From 85e0a4549618340c45120f98e8817435848c8211 Mon Sep 17 00:00:00 2001 From: Marcin Kolanko <mr.marcin.kolanko@gmail.com> Date: Mon, 20 Sep 2021 10:59:08 +0200 Subject: [PATCH] fix: add missing escaping functions --- templates/header.php | 5 ++--- templates/input-image.php | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/templates/header.php b/templates/header.php index 48b0f11..db07896 100644 --- a/templates/header.php +++ b/templates/header.php @@ -5,9 +5,8 @@ * @var string $value */ -$header_size = $field->get_meta_value( 'header_size' ) ?: '2'; -$classes = $field->has_classes() ? 'class="' . $field->get_classes() . '"' : ''; - +$header_size = (int) $field->get_meta_value( 'header_size' ) ?: 2; +$classes = $field->has_classes() ? 'class="' . esc_attr( $field->get_classes() ) . '"' : ''; ?> <?php if ( $field->has_label() ): ?> diff --git a/templates/input-image.php b/templates/input-image.php index 18fba1b..34d1388 100644 --- a/templates/input-image.php +++ b/templates/input-image.php @@ -13,11 +13,11 @@ $media_container_id = 'media_' . sanitize_key( $field->get_id() ); id="<?php echo \esc_attr( $field->get_id() ); ?>"/> <div class="custom-img-container"> <?php if ( $value ) : ?> - <img src="<?php echo $value ?>" alt="" width="100"/> + <img src="<?php echo \esc_html( $value ) ?>" alt="" width="100"/> <?php endif; ?> </div> <p class="hide-if-no-js"> - <a class="upload-custom-img <?php if ( $value ): ?>hidden<?php endif ?>" href="<?php echo $value ?>"> + <a class="upload-custom-img <?php if ( $value ): ?>hidden<?php endif ?>" href="<?php echo \esc_html( $value ) ?>"> <?php _e( 'Set image', 'wp-forms' ) ?> </a> <a class="delete-custom-img <?php if ( ! $value ): ?>hidden<?php endif ?>" href="#"> @@ -28,7 +28,7 @@ $media_container_id = 'media_' . sanitize_key( $field->get_id() ); <script> jQuery( function ( $ ) { var frame, - metaBox = $( '#<?php echo $media_container_id; ?>' ), + metaBox = $( '#<?php echo esc_attr( $media_container_id ); ?>' ), addImgLink = metaBox.find( '.upload-custom-img' ), delImgLink = metaBox.find( '.delete-custom-img' ), imgContainer = metaBox.find( '.custom-img-container' ), -- GitLab