← All changes
|
app/Modules/Payments/Components/MultiPaymentComponent.php
+10
-6
6.2.12
→
6.2.15
View file →
| @@ -168,9 +168,9 @@ | ||
| 168 | 168 | ); |
| 169 | 169 | |
| 170 | 170 | $elMarkup = $input = "<input " . $this->buildAttributes($inputAttributes, $form) . ">"; |
| 171 | 171 | |
| 172 | - $elMarkup .= '<span class="ff_item_price_wrapper"><span class="ff_product_price_label">' . $priceLabel . '</span>'; | |
| 172 | + $elMarkup .= '<span class="ff_item_price_wrapper"><span class="ff_product_price_label">' . fluentform_sanitize_html($priceLabel) . '</span>'; | |
| 173 | 173 | $elMarkup .= ' <span class="ff_product_price">' . $money . '</span></span>'; |
| 174 | 174 | |
| 175 | 175 | $html = $this->buildElementMarkup($elMarkup, $data, $form); |
| 176 | 176 | |
| @@ -295,9 +295,10 @@ | ||
| 295 | 295 | 'selected' => $checked, |
| 296 | 296 | 'disabled' => ArrayHelper::get($option, 'disabled') ? 'disabled' : '', |
| 297 | 297 | 'data-quantity_remaining' => ArrayHelper::get($option, 'quantity_remaining', false) |
| 298 | 298 | ], $form); |
| 299 | - $elMarkup .= '<option ' . $optionAtts . '>' . $option['label'] . $quantityLabel.'</option>'; | |
| 299 | + $optionLabel = fluentform_sanitize_html($option['label'] . $quantityLabel); | |
| 300 | + $elMarkup .= '<option ' . $optionAtts . '>' . $optionLabel . '</option>'; | |
| 300 | 301 | continue; |
| 301 | 302 | } |
| 302 | 303 | |
| 303 | 304 | $displayType = isset($data['settings']['display_type']) ? ' ff-el-form-check-' . $data['settings']['display_type'] : ''; |
| @@ -325,21 +326,24 @@ | ||
| 325 | 326 | $data['attributes']['data-quantity_remaining'] = ArrayHelper::get($option, 'quantity_remaining', false); |
| 326 | 327 | |
| 327 | 328 | |
| 328 | 329 | $atts = $this->buildAttributes($data['attributes'], $form); |
| 329 | - $id = $this->getUniqueid(str_replace(['[', ']'], ['', ''], $data['attributes']['name'])); | |
| 330 | + $id = esc_attr($this->getUniqueid(str_replace(['[', ']'], ['', ''], $data['attributes']['name']))); | |
| 330 | 331 | |
| 331 | 332 | if ($hasImageOption && !empty($option['image'])) { |
| 332 | 333 | $parentClass .= ' ff-el-image-holder'; |
| 333 | 334 | } |
| 334 | 335 | |
| 335 | - $elMarkup .= "<div class='{$parentClass}'>"; | |
| 336 | + $elMarkup .= "<div class='" . esc_attr($parentClass) . "'>"; | |
| 336 | 337 | // Here we can push the visual items |
| 337 | 338 | if ($hasImageOption && !empty($option['image'])) { |
| 338 | - $elMarkup .= "<label style='background-image: url({$option['image']})' class='ff-el-image-input-src' for={$id}></label>"; | |
| 339 | + $imageStyle = 'background-image: url("' . esc_url($option['image']) . '")'; | |
| 340 | + $escapedImageStyle = htmlspecialchars($imageStyle, ENT_QUOTES, 'UTF-8', true); | |
| 341 | + $elMarkup .= "<label style='{$escapedImageStyle}' class='ff-el-image-input-src' for='{$id}'></label>"; | |
| 339 | 342 | } |
| 340 | 343 | |
| 341 | - $elMarkup .= "<label class='ff-el-form-check-label' for={$id}><input {$atts} id='{$id}'> <span class='ff_plan_title'>{$option['label']}{$quantityLabel}</span></label>"; | |
| 344 | + $safeLabel = fluentform_sanitize_html($option['label'] . $quantityLabel); | |
| 345 | + $elMarkup .= "<label class='ff-el-form-check-label' for='{$id}'><input {$atts} id='{$id}'> <span class='ff_plan_title'>{$safeLabel}</span></label>"; | |
| 342 | 346 | $elMarkup .= "</div>"; |
| 343 | 347 | } |
| 344 | 348 | |
| 345 | 349 | if ($type == 'select') { |