| @@ -380,12 +380,18 @@ | ||
| 380 | 380 | // badge text |
| 381 | 381 | if ( empty( $badge ) && empty($args['icon_class']) ) { |
| 382 | 382 | $badge = isset($field->site_title) ? $field->site_title : ''; |
| 383 | 383 | } |
| 384 | - if( !empty( $badge ) && $badge = str_replace("%%input%%", $match_value,$badge) ){ | |
| 384 | + // Decode entities in the admin-authored template text now, before any | |
| 385 | + // untrusted user values are substituted in below. Decoding after | |
| 386 | + // substitution would undo the escaping applied to those values. | |
| 387 | + if ( ! empty( $badge ) ) { | |
| 388 | + $badge = wp_specialchars_decode( $badge, ENT_QUOTES ); | |
| 389 | + } | |
| 390 | + if( !empty( $badge ) && $badge = str_replace("%%input%%", esc_html( (string) $match_value ), $badge) ){ | |
| 385 | 391 | // will be replace in condition check |
| 386 | 392 | } |
| 387 | - if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", uwp_build_profile_tab_url($user_id),$badge) ){ | |
| 393 | + if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", esc_url( uwp_build_profile_tab_url($user_id) ),$badge) ){ | |
| 388 | 394 | // will be replace in condition check |
| 389 | 395 | } |
| 390 | 396 | |
| 391 | 397 | // link url, replace vars |
| @@ -428,9 +434,9 @@ | ||
| 428 | 434 | if ( ! empty( $args['new_window'] ) ) { |
| 429 | 435 | $new_window = ' target="_blank" '; |
| 430 | 436 | } |
| 431 | 437 | |
| 432 | - $badge = ! empty( $badge ) ? __( wp_specialchars_decode( $badge, ENT_QUOTES ), 'userswp' ) : ''; | |
| 438 | + $badge = ! empty( $badge ) ? __( $badge, 'userswp' ) : ''; | |
| 433 | 439 | |
| 434 | 440 | // phone & email link |
| 435 | 441 | if ( ! empty( $field ) && ! empty( $field->field_type ) && ! empty( $args['link'] ) && strpos( $args['link'], 'http' ) !== 0 ) { |
| 436 | 442 | if ( $field->field_type == 'phone' ) { |
| @@ -595,8 +601,11 @@ | ||
| 595 | 601 | if(isset($user_data)){ |
| 596 | 602 | foreach($user_data as $key => $val) { |
| 597 | 603 | if ( ! in_array( $key, $excluded_fields ) ) { |
| 598 | 604 | $val = apply_filters( 'uwp_replace_variables_' . $key, $val, $text ); |
| 605 | + if ( is_scalar( $val ) ) { | |
| 606 | + $val = esc_html( (string) $val ); | |
| 607 | + } | |
| 599 | 608 | $text = str_replace( '%%' . $key . '%%', $val, $text ); |
| 600 | 609 | } |
| 601 | 610 | } |
| 602 | 611 | } |
