← All changes | includes/forms/template.php +6 -5 4.16.7 → 4.17.0 View file →

		@@ -1199,8 +1199,9 @@
1199	1199
1200	1200	/**
1201	1201	* Outputs the default credit card address fields.
1202	1202	*
	1203	+ * @since 4.17.0 Escape prefilled billing address values before output.
1203	1204	* @since 3.1.0 Add the give_default_cc_address_fields_user_info filter
1204	1205	* @since 1.0
1205	1206	*
1206	1207	* @param int $form_id The form ID.
		@@ -1295,9 +1296,9 @@
1295	1296	name="card_address"
1296	1297	autocomplete="address-line1"
1297	1298	class="card-address give-input<?php echo( give_field_is_required( 'card_address', $form_id ) ? ' required' : '' ); ?>"
1298	1299	placeholder="<?php _e( 'Address line 1', 'give' ); ?>"
1299		- value="<?php echo isset( $give_user_info['card_address'] ) ? $give_user_info['card_address'] : ''; ?>"
	1300	+ value="<?php echo isset( $give_user_info['card_address'] ) ? esc_attr( $give_user_info['card_address'] ) : ''; ?>"
1300	1301	<?php echo( give_field_is_required( 'card_address', $form_id ) ? ' required aria-required="true" ' : '' ); ?>
1301	1302	/>
1302	1303	</p>
1303	1304
		@@ -1316,9 +1317,9 @@
1316	1317	name="card_address_2"
1317	1318	autocomplete="address-line2"
1318	1319	class="card-address-2 give-input<?php echo( give_field_is_required( 'card_address_2', $form_id ) ? ' required' : '' ); ?>"
1319	1320	placeholder="<?php _e( 'Address line 2', 'give' ); ?>"
1320		- value="<?php echo isset( $give_user_info['card_address_2'] ) ? $give_user_info['card_address_2'] : ''; ?>"
	1321	+ value="<?php echo isset( $give_user_info['card_address_2'] ) ? esc_attr( $give_user_info['card_address_2'] ) : ''; ?>"
1321	1322	<?php echo( give_field_is_required( 'card_address_2', $form_id ) ? ' required aria-required="true" ' : '' ); ?>
1322	1323	/>
1323	1324	</p>
1324	1325
		@@ -1336,9 +1337,9 @@
1336	1337	name="card_city"
1337	1338	autocomplete="address-level2"
1338	1339	class="card-city give-input<?php echo( give_field_is_required( 'card_city', $form_id ) ? ' required' : '' ); ?>"
1339	1340	placeholder="<?php _e( 'City', 'give' ); ?>"
1340		- value="<?php echo( isset( $give_user_info['card_city'] ) ? $give_user_info['card_city'] : '' ); ?>"
	1341	+ value="<?php echo( isset( $give_user_info['card_city'] ) ? esc_attr( $give_user_info['card_city'] ) : '' ); ?>"
1341	1342	<?php echo( give_field_is_required( 'card_city', $form_id ) && $city_required ? ' required aria-required="true" ' : '' ); ?>
1342	1343	/>
1343	1344	</p>
1344	1345
		@@ -1392,9 +1393,9 @@
1392	1393	?>
1393	1394	</select>
1394	1395	<?php else : ?>
1395	1396	<input type="text" size="6" name="card_state" id="card_state" class="card_state give-input"
1396		- placeholder="<?php echo $state_label; ?>" value="<?php echo $selected_state; ?>"
	1397	+ placeholder="<?php echo esc_attr( $state_label ); ?>" value="<?php echo esc_attr( $selected_state ); ?>"
1397	1398	<?php echo $validate_state ? ' required aria-required="true" ' : ''; ?>
1398	1399	/>
1399	1400	<?php endif; ?>
1400	1401	</p>
		@@ -1413,9 +1414,9 @@
1413	1414	name="card_zip"
1414	1415	autocomplete="postal-code"
1415	1416	class="card-zip give-input<?php echo( $postcode_required ? ' required' : '' ); ?>"
1416	1417	placeholder="<?php _e( 'Zip / Postal Code', 'give' ); ?>"
1417		- value="<?php echo isset( $give_user_info['card_zip'] ) ? $give_user_info['card_zip'] : ''; ?>"
	1418	+ value="<?php echo isset( $give_user_info['card_zip'] ) ? esc_attr( $give_user_info['card_zip'] ) : ''; ?>"
1418	1419	<?php echo( $postcode_required ? ' required aria-required="true" ' : '' ); ?>
1419	1420	/>
1420	1421	</p>
1421	1422	<?php