← All changes | includes/forms/template.php +12 -7 4.16.1 → 4.17.0 View file →

		@@ -1199,8 +1199,9 @@
1199	1199
1200	1200	/**
1201	1201	* Outputs the default credit card address fields.
1202	1202	*
	1203	+ * @since 4.17.0 Escape prefilled billing address values before output.
1203	1204	* @since 3.1.0 Add the give_default_cc_address_fields_user_info filter
1204	1205	* @since 1.0
1205	1206	*
1206	1207	* @param int $form_id The form ID.
		@@ -1295,9 +1296,9 @@
1295	1296	name="card_address"
1296	1297	autocomplete="address-line1"
1297	1298	class="card-address give-input<?php echo( give_field_is_required( 'card_address', $form_id ) ? ' required' : '' ); ?>"
1298	1299	placeholder="<?php _e( 'Address line 1', 'give' ); ?>"
1299		- value="<?php echo isset( $give_user_info['card_address'] ) ? $give_user_info['card_address'] : ''; ?>"
	1300	+ value="<?php echo isset( $give_user_info['card_address'] ) ? esc_attr( $give_user_info['card_address'] ) : ''; ?>"
1300	1301	<?php echo( give_field_is_required( 'card_address', $form_id ) ? ' required aria-required="true" ' : '' ); ?>
1301	1302	/>
1302	1303	</p>
1303	1304
		@@ -1316,9 +1317,9 @@
1316	1317	name="card_address_2"
1317	1318	autocomplete="address-line2"
1318	1319	class="card-address-2 give-input<?php echo( give_field_is_required( 'card_address_2', $form_id ) ? ' required' : '' ); ?>"
1319	1320	placeholder="<?php _e( 'Address line 2', 'give' ); ?>"
1320		- value="<?php echo isset( $give_user_info['card_address_2'] ) ? $give_user_info['card_address_2'] : ''; ?>"
	1321	+ value="<?php echo isset( $give_user_info['card_address_2'] ) ? esc_attr( $give_user_info['card_address_2'] ) : ''; ?>"
1321	1322	<?php echo( give_field_is_required( 'card_address_2', $form_id ) ? ' required aria-required="true" ' : '' ); ?>
1322	1323	/>
1323	1324	</p>
1324	1325
		@@ -1336,9 +1337,9 @@
1336	1337	name="card_city"
1337	1338	autocomplete="address-level2"
1338	1339	class="card-city give-input<?php echo( give_field_is_required( 'card_city', $form_id ) ? ' required' : '' ); ?>"
1339	1340	placeholder="<?php _e( 'City', 'give' ); ?>"
1340		- value="<?php echo( isset( $give_user_info['card_city'] ) ? $give_user_info['card_city'] : '' ); ?>"
	1341	+ value="<?php echo( isset( $give_user_info['card_city'] ) ? esc_attr( $give_user_info['card_city'] ) : '' ); ?>"
1341	1342	<?php echo( give_field_is_required( 'card_city', $form_id ) && $city_required ? ' required aria-required="true" ' : '' ); ?>
1342	1343	/>
1343	1344	</p>
1344	1345
		@@ -1392,9 +1393,9 @@
1392	1393	?>
1393	1394	</select>
1394	1395	<?php else : ?>
1395	1396	<input type="text" size="6" name="card_state" id="card_state" class="card_state give-input"
1396		- placeholder="<?php echo $state_label; ?>" value="<?php echo $selected_state; ?>"
	1397	+ placeholder="<?php echo esc_attr( $state_label ); ?>" value="<?php echo esc_attr( $selected_state ); ?>"
1397	1398	<?php echo $validate_state ? ' required aria-required="true" ' : ''; ?>
1398	1399	/>
1399	1400	<?php endif; ?>
1400	1401	</p>
		@@ -1413,9 +1414,9 @@
1413	1414	name="card_zip"
1414	1415	autocomplete="postal-code"
1415	1416	class="card-zip give-input<?php echo( $postcode_required ? ' required' : '' ); ?>"
1416	1417	placeholder="<?php _e( 'Zip / Postal Code', 'give' ); ?>"
1417		- value="<?php echo isset( $give_user_info['card_zip'] ) ? $give_user_info['card_zip'] : ''; ?>"
	1418	+ value="<?php echo isset( $give_user_info['card_zip'] ) ? esc_attr( $give_user_info['card_zip'] ) : ''; ?>"
1418	1419	<?php echo( $postcode_required ? ' required aria-required="true" ' : '' ); ?>
1419	1420	/>
1420	1421	</p>
1421	1422	<?php
		@@ -1676,8 +1677,10 @@
1676	1677	<a href="<?php echo wp_lostpassword_url(); ?>" target="_blank"><?php _e( 'Reset Password', 'give' ); ?></a>
1677	1678	</span>
1678	1679	</div>
1679	1680	</div>
	1681	+ <input type="hidden" name="give_login_nonce"
	1682	+ value="<?php echo wp_create_nonce( 'give-login-nonce' ); ?>"/>
1680	1683	<?php
1681	1684	/**
1682	1685	* Fires while rendering checkout login form, after the fields.
1683	1686	*
		@@ -2020,13 +2023,15 @@
2020	2023
2021	2024	/**
2022	2025	* Give Donation form submit button.
2023	2026	*
	2027	+ * @since 4.16.2 Escape submit button label in form markup.
	2028	+ * @since 1.8.8
	2029	+ *
2024	2030	* @param int $form_id The form ID.
2025	2031	* @param array $args
2026	2032	*
2027	2033	* @return string
2028		- * @since 1.8.8
2029	2034	*/
2030	2035	function give_get_donation_form_submit_button( $form_id, $args = [] ) {
2031	2036
2032	2037	$display_label_field = give_get_meta( $form_id, '_give_checkout_label', true );
		@@ -2035,9 +2040,9 @@
2035	2040	ob_start();
2036	2041	?>
2037	2042	<div class="give-submit-button-wrap give-clearfix">
2038	2043	<input type="submit" class="give-submit give-btn" id="give-purchase-button" name="give-purchase"
2039		- value="<?php echo $display_label; ?>" data-before-validation-label="<?php echo $display_label; ?>"/>
	2044	+ value="<?php echo esc_attr( $display_label ); ?>" data-before-validation-label="<?php echo esc_attr( $display_label ); ?>"/>
2040	2045	<span class="give-loading-animation"></span>
2041	2046	</div>
2042	2047	<?php
2043	2048	return apply_filters( 'give_donation_form_submit_button', ob_get_clean(), $form_id, $args );