← All changes | app/Services/FormBuilder/Components/SelectCountry.php +5 -3 6.2.10 → trunk View file →

		@@ -31,9 +31,9 @@
31	31	$data = apply_filters('fluentform/rendering_field_data_' . $elementName, $data, $form);
32	32
33	33	$data = $this->loadCountries($data);
34	34	$defaultValues = (array) $this->extractValueFromAttributes($data);
35		- $data['attributes']['class'] = trim('ff-el-form-control ' . $data['attributes']['class']);
	35	+ $data['attributes']['class'] = trim('ff-el-form-control ' . ArrayHelper::get($data, 'attributes.class', ''));
36	36	$data['attributes']['id'] = $this->makeElementId($data, $form);
37	37	$isSearchable = ArrayHelper::get($data, 'settings.enable_select_2');
38	38	if ('yes' == $isSearchable) {
39	39	wp_enqueue_script('choices');
		@@ -60,11 +60,13 @@
60	60	$selectCountries = ArrayHelper::get($data, 'settings.country_list.priority_based', []);
61	61	$priorityCountries = $this->getSelectedCountries($selectCountries);
62	62	$primaryListLabel = ArrayHelper::get($data, 'settings.primary_label');
63	63	$otherListLabel = ArrayHelper::get($data, 'settings.other_label');
64		- $elMarkup .= '<optgroup label="' . wp_strip_all_tags($primaryListLabel) . '">';
	64	+ // SECURITY (FINDING-12): esc_attr (not just strip_all_tags, which leaves quotes) the
	65	+ // optgroup labels before interpolating them into the double-quoted label attribute.
	66	+ $elMarkup .= '<optgroup label="' . esc_attr($primaryListLabel) . '">';
65	67	$elMarkup .= $this->buildOptions($priorityCountries, $defaultValues);
66		- $elMarkup .= '</optgroup><optgroup label="' . wp_strip_all_tags($otherListLabel) . '">';
	68	+ $elMarkup .= '</optgroup><optgroup label="' . esc_attr($otherListLabel) . '">';
67	69	$elMarkup .= $this->buildOptions($data['options'], $defaultValues);
68	70	$elMarkup .= '</optgroup>';
69	71	} else {
70	72	$elMarkup .= $this->buildOptions($data['options'], $defaultValues);