| @@ -64,12 +64,12 @@ | ||
| 64 | 64 | ) { |
| 65 | 65 | $file = $file['id']; |
| 66 | 66 | } |
| 67 | 67 | $file_url = isset( $file['url'] ) ? $file['url'] : wp_get_attachment_url( $file ); |
| 68 | - $updated = str_replace( '%file_url%', $file_url, $preview ); | |
| 68 | + $updated = str_replace( '%file_url%', esc_attr( $file_url ), $preview ); | |
| 69 | 69 | $updated = str_replace( |
| 70 | 70 | '%file_name%', |
| 71 | - $this->get_name_from_file( $file['url'] ), | |
| 71 | + esc_attr( $this->get_name_from_file( $file['url'] ) ), | |
| 72 | 72 | $updated |
| 73 | 73 | ); |
| 74 | 74 | |
| 75 | 75 | // preset field |
| @@ -78,9 +78,9 @@ | ||
| 78 | 78 | $image_ext = array( 'jpg', 'jpeg', 'jpe', 'gif', 'png', 'svg', 'webp', 'avif' ); |
| 79 | 79 | $img_ext_preg = '!\.(' . join( '|', $image_ext ) . ')$!i'; |
| 80 | 80 | |
| 81 | 81 | if ( preg_match( $img_ext_preg, $file['url'] ) ) { |
| 82 | - $replace = sprintf( '<img src="%s" alt="" width="100px" height="100px">', $file['url'] ); | |
| 82 | + $replace = sprintf( '<img src="%s" alt="" width="100px" height="100px">', esc_url( $file['url'] ) ); | |
| 83 | 83 | |
| 84 | 84 | $updated = str_replace( '<!-- preview -->', $replace, $updated ); |
| 85 | 85 | } |
| 86 | 86 | |
