| @@ -17,16 +17,20 @@ | ||
| 17 | 17 | ); |
| 18 | 18 | } |
| 19 | 19 | |
| 20 | 20 | public function render_image() { |
| 21 | - $url = urldecode( $_GET['fl_asst_image_proxy'] ); | |
| 22 | - $url = str_replace( '?url=', '', $url ); | |
| 21 | + if ( ! isset( $_GET['fl_asst_image_proxy'] ) && ! isset( $_GET['url'] ) ) { | |
| 22 | + return; | |
| 23 | + } | |
| 23 | 24 | |
| 25 | + $url = esc_url_raw( $_GET['url'] ); | |
| 26 | + $url = urldecode( $url ); | |
| 27 | + | |
| 24 | 28 | if ( 0 !== strpos( $url, 'http' ) ) { |
| 25 | 29 | return; |
| 26 | 30 | } |
| 27 | 31 | |
| 28 | - $response = wp_remote_get( $url ); | |
| 32 | + $response = wp_safe_remote_get( $url ); | |
| 29 | 33 | |
| 30 | 34 | if ( is_wp_error( $response ) ) { |
| 31 | 35 | return; |
| 32 | 36 | } |