| @@ -222,8 +222,9 @@ | ||
| 222 | 222 | |
| 223 | 223 | /** |
| 224 | 224 | * Add checkout button |
| 225 | 225 | * |
| 226 | + * @since 4.16.3 Escaped the checkout button label in the Sequoia template. | |
| 226 | 227 | * @since 2.7.0 |
| 227 | 228 | */ |
| 228 | 229 | public function getCheckoutButton() |
| 229 | 230 | { |
| @@ -236,9 +237,9 @@ | ||
| 236 | 237 | '<div class="give-submit-button-wrap give-clearfix"> |
| 237 | 238 | <input type="submit" class="give-submit give-btn" id="give-purchase-button" name="give-purchase" value="%1$s" data-before-validation-label="Donate Now"> |
| 238 | 239 | <span class="give-loading-animation"></span> |
| 239 | 240 | </div>', |
| 240 | - $label | |
| 241 | + esc_attr($label) | |
| 241 | 242 | ); |
| 242 | 243 | } |
| 243 | 244 | |
| 244 | 245 | /** |
| @@ -243,8 +244,9 @@ | ||
| 243 | 244 | |
| 244 | 245 | /** |
| 245 | 246 | * Add wrapper and introduction text to payment information section |
| 246 | 247 | * |
| 248 | + * @since 4.16.4 Escaped the headline output. | |
| 247 | 249 | * @since 2.7.0 |
| 248 | 250 | * |
| 249 | 251 | * @param int $formId |
| 250 | 252 | */ |
| @@ -260,9 +262,9 @@ | ||
| 260 | 262 | ); |
| 261 | 263 | |
| 262 | 264 | printf( |
| 263 | 265 | '<div class="give-section payment"><div class="heading">%1$s</div><div class="subheading">%2$s</div>', |
| 264 | - $headline, | |
| 266 | + esc_html($headline), | |
| 265 | 267 | $description |
| 266 | 268 | ); |
| 267 | 269 | } |
| 268 | 270 | |
| @@ -278,8 +280,9 @@ | ||
| 278 | 280 | |
| 279 | 281 | /** |
| 280 | 282 | * Start choose amount section |
| 281 | 283 | * |
| 284 | + * @since 4.16.4 Escaped the donate button label output. | |
| 282 | 285 | * @since 2.7.0 |
| 283 | 286 | */ |
| 284 | 287 | public function getStartWrapperHTMLForAmountSection() |
| 285 | 288 | { |
| @@ -296,9 +299,9 @@ | ||
| 296 | 299 | ); |
| 297 | 300 | $arrow = is_rtl() ? 'left' : 'right'; |
| 298 | 301 | printf( |
| 299 | 302 | '<button class="give-btn advance-btn">%1$s<i class="fas fa-chevron-%2$s"></i></button></div>', |
| 300 | - $label, | |
| 303 | + esc_html($label), | |
| 301 | 304 | $arrow |
| 302 | 305 | ); |
| 303 | 306 | |
| 304 | 307 | if ( ! empty($content)) { |
| @@ -313,8 +316,9 @@ | ||
| 313 | 316 | |
| 314 | 317 | /** |
| 315 | 318 | * Close choose amount section |
| 316 | 319 | * |
| 320 | + * @since 4.16.4 Escaped the continue button label output. | |
| 317 | 321 | * @since 2.7.0 |
| 318 | 322 | */ |
| 319 | 323 | public function getCloseWrapperHTMLForAmountSection() |
| 320 | 324 | { |
| @@ -325,9 +329,9 @@ | ||
| 325 | 329 | $arrow = is_rtl() ? 'left' : 'right'; |
| 326 | 330 | |
| 327 | 331 | printf( |
| 328 | 332 | '<button class="give-btn advance-btn">%1$s<i class="fas fa-chevron-%2$s"></i></button></div>', |
| 329 | - $label, | |
| 333 | + esc_html($label), | |
| 330 | 334 | $arrow |
| 331 | 335 | ); |
| 332 | 336 | } |
| 333 | 337 | |
