| @@ -6,9 +6,9 @@ | ||
| 6 | 6 | * |
| 7 | 7 | * @author David Bisset |
| 8 | 8 | * @package Charitable/Templates/Shortcodes |
| 9 | 9 | * @since 1.8.2 |
| 10 | - * @version 1.8.8.6 | |
| 10 | + * @version 1.8.13 | |
| 11 | 11 | */ |
| 12 | 12 | |
| 13 | 13 | // Exit if accessed directly. |
| 14 | 14 | if ( ! defined( 'ABSPATH' ) ) { |
| @@ -14,22 +14,30 @@ | ||
| 14 | 14 | if ( ! defined( 'ABSPATH' ) ) { |
| 15 | 15 | exit; |
| 16 | 16 | } |
| 17 | 17 | |
| 18 | -$charitable_target_for_link = $view_args['new_tab'] ? ' target="_blank"' : ''; | |
| 19 | -$charitable_target_for_button = $view_args['new_tab'] ? ' onclick="window.open(\'' . esc_url( $view_args['url'] ) . '\')" ' : ' onclick="location.href=\'' . esc_url( $view_args['url'] ) . '\'" '; | |
| 18 | +/* | |
| 19 | + * The destination URL is carried in a data attribute and read back by the click | |
| 20 | + * handler rather than being interpolated into the inline JavaScript. | |
| 21 | + * | |
| 22 | + * esc_url() is a URL escaper, not a JavaScript string escaper. It encodes a literal | |
| 23 | + * apostrophe as `'` and leaves named entities such as `'` intact -- correct | |
| 24 | + * inside href="", but both are decoded back into a real apostrophe by the HTML parser | |
| 25 | + * when it reads an attribute value, which would close a single-quoted JS string and | |
| 26 | + * let the remainder of the URL run as script. Keeping the handler free of any | |
| 27 | + * user-controlled data removes that context altogether. | |
| 28 | + */ | |
| 29 | +$charitable_button_onclick = $view_args['new_tab'] | |
| 30 | + ? "window.open(this.getAttribute('data-charitable-url'));" | |
| 31 | + : "location.href=this.getAttribute('data-charitable-url');"; | |
| 20 | 32 | |
| 21 | 33 | // if the type is a button, use a button element, otherwise use a link. |
| 22 | 34 | if ( 'link' === $view_args['type'] ) : |
| 23 | - | |
| 24 | - // filter esc_attr but prevent quotes from being encoded. | |
| 25 | - $charitable_target_for_link = str_replace( '"', '"', esc_attr( $charitable_target_for_link ) ); | |
| 26 | - $charitable_target_for_button = str_replace( '"', '"', esc_attr( $charitable_target_for_button ) ); | |
| 27 | 35 | ?> |
| 28 | 36 | |
| 29 | - <a <?php echo $charitable_target_for_link; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?> href="<?php echo esc_url( $view_args['url'] ); ?>" class="<?php echo esc_attr( $view_args['css'] ); ?>"><?php echo esc_html( $view_args['label'] ); ?></a> | |
| 37 | + <a<?php echo $view_args['new_tab'] ? ' target="_blank"' : ''; ?> href="<?php echo esc_url( $view_args['url'] ); ?>" class="<?php echo esc_attr( $view_args['css'] ); ?>"><?php echo esc_html( $view_args['label'] ); ?></a> | |
| 30 | 38 | |
| 31 | 39 | <?php else : ?> |
| 32 | 40 | |
| 33 | - <input <?php echo $charitable_target_for_button; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?> id="charitable-donate-button-<?php echo intval( $view_args['campaign'] ); ?>" class="<?php echo esc_attr( $view_args['css'] ); ?>" type="button" value="<?php echo esc_html( $view_args['label'] ); ?>" /> | |
| 41 | + <input onclick="<?php echo esc_attr( $charitable_button_onclick ); ?>" data-charitable-url="<?php echo esc_url( $view_args['url'] ); ?>" id="charitable-donate-button-<?php echo intval( $view_args['campaign'] ); ?>" class="<?php echo esc_attr( $view_args['css'] ); ?>" type="button" value="<?php echo esc_attr( $view_args['label'] ); ?>" /> | |
| 34 | 42 | |
| 35 | 43 | <?php endif; ?> |
