| @@ -383,10 +383,8 @@ | ||
| 383 | 383 | if ( $this->is_current_page( 'cartflows' ) ) { |
| 384 | 384 | include_once CARTFLOWS_ADMIN_CORE_DIR . 'views/settings-app.php'; |
| 385 | 385 | } elseif ( $this->is_current_page( 'cartflows', array( 'wcf-edit-flow' ) ) ) { |
| 386 | 386 | include_once CARTFLOWS_ADMIN_CORE_DIR . 'views/editor-app.php'; |
| 387 | - } elseif ( $this->is_current_page( 'cartflows', array( 'wcf-log' ) ) ) { | |
| 388 | - include_once CARTFLOWS_ADMIN_CORE_DIR . 'views/debugger.php'; | |
| 389 | 387 | } elseif ( $this->is_current_page( 'cartflows', array( 'wcf-license' ) ) && _is_cartflows_pro() ) { |
| 390 | 388 | do_action( 'cartflows_admin_log', 'wcf-license' ); |
| 391 | 389 | } else { |
| 392 | 390 | include_once CARTFLOWS_ADMIN_CORE_DIR . 'views/404-error.php'; |
| @@ -1213,10 +1211,19 @@ | ||
| 1213 | 1211 | |
| 1214 | 1212 | // Fetch the RSS feed from the URL. This saves us from the CORS issue. |
| 1215 | 1213 | $feed = wp_remote_retrieve_body( wp_safe_remote_get( 'https://cartflows.com/product/cartflows/feed/' ) ); // phpcs:ignore -- This is a valid use case cannot use VIP rules here. |
| 1216 | 1214 | |
| 1217 | - // Security: Set proper content type header and strip script tags to prevent XSS. | |
| 1218 | - echo $feed; // phpcs:ignore -- RSS feed content sanitized via wp_kses_post. | |
| 1215 | + /* | |
| 1216 | + * This is an RSS document, parsed as XML by the What's New client. It must not be | |
| 1217 | + * run through wp_kses_post() — that strips the feed's own elements and leaves the | |
| 1218 | + * client nothing to parse. Declaring the type is what stops a browser sniffing the | |
| 1219 | + * response as HTML; the body itself is fetched over HTTPS from our own domain and | |
| 1220 | + * this endpoint is behind a nonce and a capability check. | |
| 1221 | + */ | |
| 1222 | + header( 'Content-Type: application/rss+xml; charset=' . get_option( 'blog_charset' ) ); | |
| 1223 | + header( 'X-Content-Type-Options: nosniff' ); | |
| 1224 | + | |
| 1225 | + echo $feed; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS/XML body, see above. | |
| 1219 | 1226 | exit; |
| 1220 | 1227 | } |
| 1221 | 1228 | } |
| 1222 | 1229 | |
