← All changes | includes/bricks-builder-widgets/property-deposit.php +6 -4 2.2.3 → 2.4.0 View file →

		@@ -71,12 +71,14 @@
71	71
72	72	// Add 'class' attribute to element root tag
73	73	$this->set_attribute( '_root', 'class', $root_classes );
74	74
	75	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Bricks serializes registered attributes through its documented render_attributes() API.
75	76	echo "<div {$this->render_attributes( '_root' )}>";
76	77
77	78	if ( isset( $this->settings['icon'] ) )
78	79	{
	80	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Bricks Element::render_icon() returns the icon-control HTML fragment, including i/svg markup; Bricks sanitizes uploaded SVGs at its documented upload boundary.
79	81	echo self::render_icon( $this->settings['icon'] );
80	82	echo ' ';
81	83	}
82	84
		@@ -81,17 +83,17 @@
81	83	}
82	84
83	85	if ( isset($this->settings['before']) && !empty($this->settings['before']) )
84	86	{
85		- echo $this->settings['before'] . ' ';
	87	+ echo wp_kses_post( $this->settings['before'] ) . ' ';
86	88	}
87	89
88		- echo $property->get_formatted_deposit();
	90	+ echo esc_html( $property->get_formatted_deposit() );
89	91
90	92	if ( isset($this->settings['after']) && !empty($this->settings['after']) )
91	93	{
92		- echo ' ' . $this->settings['after'];
	94	+ echo ' ' . wp_kses_post( $this->settings['after'] );
93	95	}
94	96
95	97	echo '</div>';
96	98	}
97		-}
	99	+}