← All changes | classes/class-evaluate-phpspreadsheet.php +3 -0 2.3 → 3.0 View file →

		@@ -110,8 +110,11 @@
110	110	$url = esc_url( $url );
111	111	$cell_content = "<a href=\"{$url}\">{$cell_content}</a>";
112	112	}
113	113	}
	114	+
	115	+ // Sanitize the output of the evaluated formula.
	116	+ $cell_content = wp_kses_post( $cell_content ); // Equals wp_filter_post_kses(), but without the unnecessary slashes handling.
114	117	} catch ( \TablePress\PhpOffice\PhpSpreadsheet\Calculation\Exception $exception ) {
115	118	$message = str_replace( 'Worksheet!', '', $exception->getMessage() );
116	119	$cell_content = "!ERROR! {$message}";
117	120	}