| @@ -1676,8 +1676,10 @@ | ||
| 1676 | 1676 | <a href="<?php echo wp_lostpassword_url(); ?>" target="_blank"><?php _e( 'Reset Password', 'give' ); ?></a> |
| 1677 | 1677 | </span> |
| 1678 | 1678 | </div> |
| 1679 | 1679 | </div> |
| 1680 | + <input type="hidden" name="give_login_nonce" | |
| 1681 | + value="<?php echo wp_create_nonce( 'give-login-nonce' ); ?>"/> | |
| 1680 | 1682 | <?php |
| 1681 | 1683 | /** |
| 1682 | 1684 | * Fires while rendering checkout login form, after the fields. |
| 1683 | 1685 | * |
| @@ -2020,13 +2022,15 @@ | ||
| 2020 | 2022 | |
| 2021 | 2023 | /** |
| 2022 | 2024 | * Give Donation form submit button. |
| 2023 | 2025 | * |
| 2026 | + * @since 4.16.2 Escape submit button label in form markup. | |
| 2027 | + * @since 1.8.8 | |
| 2028 | + * | |
| 2024 | 2029 | * @param int $form_id The form ID. |
| 2025 | 2030 | * @param array $args |
| 2026 | 2031 | * |
| 2027 | 2032 | * @return string |
| 2028 | - * @since 1.8.8 | |
| 2029 | 2033 | */ |
| 2030 | 2034 | function give_get_donation_form_submit_button( $form_id, $args = [] ) { |
| 2031 | 2035 | |
| 2032 | 2036 | $display_label_field = give_get_meta( $form_id, '_give_checkout_label', true ); |
| @@ -2035,9 +2039,9 @@ | ||
| 2035 | 2039 | ob_start(); |
| 2036 | 2040 | ?> |
| 2037 | 2041 | <div class="give-submit-button-wrap give-clearfix"> |
| 2038 | 2042 | <input type="submit" class="give-submit give-btn" id="give-purchase-button" name="give-purchase" |
| 2039 | - value="<?php echo $display_label; ?>" data-before-validation-label="<?php echo $display_label; ?>"/> | |
| 2043 | + value="<?php echo esc_attr( $display_label ); ?>" data-before-validation-label="<?php echo esc_attr( $display_label ); ?>"/> | |
| 2040 | 2044 | <span class="give-loading-animation"></span> |
| 2041 | 2045 | </div> |
| 2042 | 2046 | <?php |
| 2043 | 2047 | return apply_filters( 'give_donation_form_submit_button', ob_get_clean(), $form_id, $args ); |
