| @@ -230,8 +230,32 @@ | ||
| 230 | 230 | public static function create_page( array $args, string $key_option ) { |
| 231 | 231 | $page_id = 0; |
| 232 | 232 | |
| 233 | 233 | try { |
| 234 | + /** | |
| 235 | + * Whitelist of allowed page option keys for security. | |
| 236 | + * Prevents arbitrary options from being set via the key_option parameter. | |
| 237 | + */ | |
| 238 | + $key_pages_allow = apply_filters( | |
| 239 | + 'learn-press/pages/create-allow', | |
| 240 | + array( | |
| 241 | + 'learn_press_checkout_page_id', | |
| 242 | + 'learn_press_profile_page_id', | |
| 243 | + 'learn_press_courses_page_id', | |
| 244 | + 'learn_press_instructors_page_id', | |
| 245 | + 'learn_press_single_instructor_page_id', | |
| 246 | + 'learn_press_become_a_teacher_page_id', | |
| 247 | + 'learn_press_term_conditions_page_id', | |
| 248 | + 'learn_press_exams_page_id', // Must update Addon Exam v4.0.0 | |
| 249 | + 'learn_press_collections_page_id', // Must update Addon Collections v4.0.5 | |
| 250 | + 'learn_press_packages_page_id', // Must update Addon UpSell v4.0.9 | |
| 251 | + ) | |
| 252 | + ); | |
| 253 | + | |
| 254 | + if ( ! in_array( $key_option, $key_pages_allow ) ) { | |
| 255 | + throw new Exception( __( 'Invalid key page', 'learnpress' ) ); | |
| 256 | + } | |
| 257 | + | |
| 234 | 258 | if ( ! isset( $args['post_title'] ) ) { |
| 235 | 259 | throw new Exception( __( 'Missing post title', 'learnpress' ) ); |
| 236 | 260 | } |
| 237 | 261 | |
| @@ -509,19 +533,25 @@ | ||
| 509 | 533 | * @param array $data |
| 510 | 534 | * @param array $tag_args as ['type' => 'text/javascript', 'id' => ''] |
| 511 | 535 | * |
| 512 | 536 | * @return void |
| 513 | - * @version 1.0.1 | |
| 537 | + * @version 1.0.2 | |
| 514 | 538 | * @since 4.2.5.5 |
| 515 | 539 | */ |
| 516 | 540 | public static function print_inline_script_tag( string $name_variable_script, array $data, array $tag_args = [] ) { |
| 517 | - foreach ( $data as $key => $value ) { | |
| 541 | + /** | |
| 542 | + * Comment block code reason by security | |
| 543 | + * wp_json_encode() already produces a valid JavaScript string, | |
| 544 | + * and there is no reason to decode HTML entities inside data that will be re-inserted with insertAdjacentHTML | |
| 545 | + * @comment since 4.4.8 | |
| 546 | + */ | |
| 547 | + /*foreach ( $data as $key => $value ) { | |
| 518 | 548 | if ( ! is_scalar( $value ) ) { |
| 519 | 549 | continue; |
| 520 | 550 | } |
| 521 | 551 | |
| 522 | 552 | $data[ $key ] = html_entity_decode( (string) $value, ENT_QUOTES, 'UTF-8' ); |
| 523 | - } | |
| 553 | + }*/ | |
| 524 | 554 | |
| 525 | 555 | $data_json = wp_json_encode( $data ); |
| 526 | 556 | $script = ''; |
| 527 | 557 | if ( ! empty( $name_variable_script ) ) { |
