← All changes | app/Services/FormBuilder/Components/TabularGrid.php +2 -1 6.2.13 → trunk View file →

		@@ -67,9 +67,10 @@
67	67
68	68	// SECURITY (FINDING-12): esc_attr the row/column labels before interpolating them
69	69	// into the double-quoted aria-label; save-time sanitizers do not encode quotes.
70	70	$input = '<input aria-label="'. esc_attr($row['name']) .'-'. esc_attr($column['label']) . '" ' . $attributes . " {$isChecked} aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $attributes is escaped before being passed in.
71		- $elMarkup .= "<td data-label='" . fluentform_sanitize_html($column['label']) . "'>{$input}</td>";
	71	+ $responsiveLabel = esc_attr(wp_strip_all_tags($column['label']));
	72	+ $elMarkup .= "<td data-label='{$responsiveLabel}'>{$input}</td>";
72	73	}
73	74	$elMarkup .= '</tr>';
74	75	}
75	76