| @@ -533,19 +533,25 @@ | ||
| 533 | 533 | * @param array $data |
| 534 | 534 | * @param array $tag_args as ['type' => 'text/javascript', 'id' => ''] |
| 535 | 535 | * |
| 536 | 536 | * @return void |
| 537 | - * @version 1.0.1 | |
| 537 | + * @version 1.0.2 | |
| 538 | 538 | * @since 4.2.5.5 |
| 539 | 539 | */ |
| 540 | 540 | public static function print_inline_script_tag( string $name_variable_script, array $data, array $tag_args = [] ) { |
| 541 | - foreach ( $data as $key => $value ) { | |
| 541 | + /** | |
| 542 | + * Comment block code reason by security | |
| 543 | + * wp_json_encode() already produces a valid JavaScript string, | |
| 544 | + * and there is no reason to decode HTML entities inside data that will be re-inserted with insertAdjacentHTML | |
| 545 | + * @comment since 4.4.8 | |
| 546 | + */ | |
| 547 | + /*foreach ( $data as $key => $value ) { | |
| 542 | 548 | if ( ! is_scalar( $value ) ) { |
| 543 | 549 | continue; |
| 544 | 550 | } |
| 545 | 551 | |
| 546 | 552 | $data[ $key ] = html_entity_decode( (string) $value, ENT_QUOTES, 'UTF-8' ); |
| 547 | - } | |
| 553 | + }*/ | |
| 548 | 554 | |
| 549 | 555 | $data_json = wp_json_encode( $data ); |
| 550 | 556 | $script = ''; |
| 551 | 557 | if ( ! empty( $name_variable_script ) ) { |
