| @@ -52,9 +52,11 @@ | ||
| 52 | 52 | add_filter('fluentform/response_render_' . $this->key, function ($response, $field, $form_id, $isHtml = false) { |
| 53 | 53 | if (!$isHtml) { |
| 54 | 54 | return $response; |
| 55 | 55 | } |
| 56 | - return ArrayHelper::get($field, 'raw.settings.subscription_options.' . $response . '.name', $response); | |
| 56 | + return fluentform_sanitize_html( | |
| 57 | + ArrayHelper::get($field, 'raw.settings.subscription_options.' . $response . '.name', $response) | |
| 58 | + ); | |
| 57 | 59 | }, 10, 4); |
| 58 | 60 | add_filter('fluentform/white_listed_fields', [$this, 'addWhiteListedFields'], 10, 2); |
| 59 | 61 | } |
| 60 | 62 | |
| @@ -340,9 +342,10 @@ | ||
| 340 | 342 | 'selected' => $isDefaultPlan |
| 341 | 343 | ]); |
| 342 | 344 | $optionAtts = $this->buildAttributes($optionAtts, $form); |
| 343 | 345 | |
| 344 | - $elMarkup .= '<option ' . $optionAtts . '>' . $pricingPlan['name'] . '</option>'; | |
| 346 | + $optionLabel = fluentform_sanitize_html($pricingPlan['name']); | |
| 347 | + $elMarkup .= '<option ' . $optionAtts . '>' . $optionLabel . '</option>'; | |
| 345 | 348 | } else { |
| 346 | 349 | $displayType = isset($data['settings']['display_type']) ? ' ff-el-form-check-' . $data['settings']['display_type'] : ''; |
| 347 | 350 | $parentClass = "ff-el-form-check{$displayType}"; |
| 348 | 351 | $atts = $data['attributes']; |
| @@ -360,21 +363,22 @@ | ||
| 360 | 363 | $atts['class'] .= ' ff_subscription_item ff_payment_item'; |
| 361 | 364 | $atts['value'] = $index; |
| 362 | 365 | $atts['data-group_id'] = $groupId; |
| 363 | 366 | |
| 364 | - $id = $this->getUniqueid(str_replace(['[', ']'], ['', ''], $atts['name'])); | |
| 367 | + $id = esc_attr($this->getUniqueid(str_replace(['[', ']'], ['', ''], $atts['name']))); | |
| 365 | 368 | $atts = $this->buildAttributes(array_merge($billingAttributes, $atts), $form); |
| 366 | 369 | |
| 367 | - $labelHtml = "<span class='ff_plan_name'>{$pricingPlan['name']}</span>"; | |
| 370 | + $safePlanName = fluentform_sanitize_html($pricingPlan['name']); | |
| 371 | + $labelHtml = "<span class='ff_plan_name'>{$safePlanName}</span>"; | |
| 368 | 372 | |
| 369 | 373 | if ($isSmartUi) { |
| 370 | 374 | $paymentSummary = $this->getPaymentSummaryText($pricingPlan, $form->id, $currency); |
| 371 | 375 | $summaryHtml = '<div class="ff_sub_desc">' . $paymentSummary . '</div>'; |
| 372 | - $labelHtml = "<span class='ff_plan_holder'><span class='ff_plan_title'>{$pricingPlan['name']}</span>" . $summaryHtml . "</span>"; | |
| 376 | + $labelHtml = "<span class='ff_plan_holder'><span class='ff_plan_title'>{$safePlanName}</span>" . $summaryHtml . '</span>'; | |
| 373 | 377 | } |
| 374 | 378 | |
| 375 | - $elMarkup .= "<div class='{$parentClass}'>"; | |
| 376 | - $elMarkup .= "<label class='ff-el-form-check-label' for={$id}><input {$atts} id='{$id}'>" . $labelHtml . "</label>"; | |
| 379 | + $elMarkup .= "<div class='" . esc_attr($parentClass) . "'>"; | |
| 380 | + $elMarkup .= "<label class='ff-el-form-check-label' for='{$id}'><input {$atts} id='{$id}'>" . $labelHtml . '</label>'; | |
| 377 | 381 | $elMarkup .= "</div>"; |
| 378 | 382 | } |
| 379 | 383 | |
| 380 | 384 | if ($isCustomAmount) { |
| @@ -465,8 +469,10 @@ | ||
| 465 | 469 | |
| 466 | 470 | private function makeCustomInputHtml($field, $plan, $parentInputType, $markup) |
| 467 | 471 | { |
| 468 | 472 | $htmlID = ArrayHelper::get($field, 'attributes.name') . '_custom_' . $plan['index']; |
| 473 | + $escapedHtmlID = esc_attr($htmlID); | |
| 474 | + $escapedPlanIndex = esc_attr($plan['index']); | |
| 469 | 475 | $isDefault = ArrayHelper::get($plan, 'is_default') === 'yes'; |
| 470 | 476 | |
| 471 | 477 | $customAmountInputAttributes = $this->buildAttributes([ |
| 472 | 478 | 'name' => $htmlID, |
| @@ -485,12 +491,13 @@ | ||
| 485 | 491 | ]); |
| 486 | 492 | |
| 487 | 493 | $class = $isDefault ? '' : 'hidden_field'; |
| 488 | 494 | $style = $parentInputType === 'hidden' ? '' : "style='margin-top: 5px'"; |
| 489 | - $markup .= "<div class='ff-custom-user-input-wrapper ff-custom-user-input-wrapper-{$plan['index']} {$class}' {$style}>"; | |
| 495 | + $markup .= "<div class='ff-custom-user-input-wrapper ff-custom-user-input-wrapper-{$escapedPlanIndex} {$class}' {$style}>"; | |
| 490 | 496 | |
| 491 | 497 | if ($parentInputType !== 'hidden') { |
| 492 | - $markup .= "<label class='ff-el-form-check-label' for='{$htmlID}'>" . ArrayHelper::get($plan, 'user_input_label') . '</label>'; | |
| 498 | + $customLabel = fluentform_sanitize_html(ArrayHelper::get($plan, 'user_input_label')); | |
| 499 | + $markup .= "<label class='ff-el-form-check-label' for='{$escapedHtmlID}'>{$customLabel}</label>"; | |
| 493 | 500 | } |
| 494 | 501 | |
| 495 | 502 | $markup .= "<input {$customAmountInputAttributes}>"; |
| 496 | 503 | $markup .= '</div>'; |
