| @@ -228,9 +228,9 @@ | ||
| 228 | 228 | if ($fullMessageHover !== $notif['message']) { |
| 229 | 229 | echo ' data-acym-full="'.esc_attr($fullMessageHover).'"'; |
| 230 | 230 | } |
| 231 | 231 | echo '>'; |
| 232 | - echo $notif['message']; | |
| 232 | + echo wp_kses($notif['message'], SecurityHelper::ALLOWED_HTML_NOTIFICATION); | |
| 233 | 233 | echo '<div class="cell acym__header__notification__one__date">'.esc_html(acym_date($notif['date'])).'</div></div>'; |
| 234 | 234 | echo '<i class="cell small-1 acym__header__notification__one__delete acymicon-close" data-id="'.esc_attr($key).'"></i>'; |
| 235 | 235 | echo '</div>'; |
| 236 | 236 | } |
| @@ -249,9 +249,19 @@ | ||
| 249 | 249 | $notifications = []; |
| 250 | 250 | } |
| 251 | 251 | |
| 252 | 252 | $notif->message = str_replace('<br />', "\r\n", $notif->message); |
| 253 | - $notif->message = acym_stripTags($notif->message, '<a>'); | |
| 253 | + $notif->message = wp_kses( | |
| 254 | + $notif->message, | |
| 255 | + [ | |
| 256 | + 'a' => [ | |
| 257 | + 'href' => true, | |
| 258 | + 'class' => true, | |
| 259 | + 'id' => true, | |
| 260 | + 'target' => true, | |
| 261 | + ], | |
| 262 | + ] | |
| 263 | + ); | |
| 254 | 264 | |
| 255 | 265 | // Prevent duplicated notifications |
| 256 | 266 | foreach ($notifications as $key => $oneNotif) { |
| 257 | 267 | if ($oneNotif['message'] === $notif->message && $oneNotif['level'] === $notif->level) unset($notifications[$key]); |
