← All changes | includes/core/shortcodes/class-wpfnl-shortcode-next-step-button.php +31 -3 3.12.13 → 3.13.4 View file →

		@@ -136,9 +136,9 @@
136	136	$align_style = !empty($this->attributes['align']) ? 'text-align: ' . esc_attr($this->attributes['align']) . ';' : '';
137	137
138	138	// Button Text with optional icon
139	139	$btn_text = isset($this->attributes['btn_text']) && $this->attributes['btn_text'] ? esc_html($this->attributes['btn_text']) : 'Get Now';
140		- $icon = isset($this->attributes['icon']) ? $this->attributes['icon'] : '';
	140	+ $icon = isset($this->attributes['icon']) ? wp_kses_post($this->attributes['icon']) : '';
141	141	$icon_position = isset($this->attributes['icon_position']) ? $this->attributes['icon_position'] : 'before';
142	142
143	143	$button_label = '';
144	144	if (!empty($icon) && $icon_position === 'before') {
		@@ -158,12 +158,12 @@
158	158	data-url="' . esc_url($this->attributes['data_url']) . '"
159	159	data-id="' . get_the_ID() . '"
160	160	data-products="' . esc_attr($products) . '"
161	161	id="' . esc_attr(!empty($this->attributes['custom_id']) ? $this->attributes['custom_id'] : 'wpfunnels_next_step_controller') . '"
162		- style="' . $style . '"
	162	+ style="' . esc_attr($style) . '"
163	163	class="' . esc_attr($this->attributes['class']) . ' next-step-button btn-default"
164	164	target="' . esc_attr($this->attributes['target']) . '"'
165		- . (!empty($this->attributes['custom_attrs']) ? ' ' . $this->attributes['custom_attrs'] : '') . '>';
	165	+ . $this->get_custom_attributes_html() . '>';
166	166
167	167	$html .= $button_label;
168	168
169	169	$html .= '</a></div><span class="wpfnl-alert" id="wpfnl-next-button-loader"></span>';
		@@ -172,6 +172,34 @@
172	172
173	173	return $html;
174	174	}
175	175	return false;
	176	+ }
	177	+
	178	+
	179	+ /**
	180	+ * Build the extra HTML attributes passed through `custom_attrs`.
	181	+ *
	182	+ * Shortcode attributes are author-supplied, so only `data-*` and `aria-*`
	183	+ * attributes (plus a few harmless ones) are kept and every value is escaped.
	184	+ * Event handlers such as `onclick` are dropped.
	185	+ *
	186	+ * @return string Leading-space separated attribute string, or an empty string.
	187	+ * @since 3.13.4
	188	+ */
	189	+ protected function get_custom_attributes_html() {
	190	+ if (empty($this->attributes['custom_attrs']) || !is_string($this->attributes['custom_attrs'])) {
	191	+ return '';
	192	+ }
	193	+
	194	+ $allowed = array('title', 'rel', 'role', 'tabindex');
	195	+ $html = '';
	196	+ foreach (wp_kses_hair($this->attributes['custom_attrs'], wp_allowed_protocols()) as $attr) {
	197	+ $name = strtolower($attr['name']);
	198	+ if (!in_array($name, $allowed, true) && !preg_match('/^(data|aria)-[a-z0-9_-]+$/', $name)) {
	199	+ continue;
	200	+ }
	201	+ $html .= ' ' . $name . '="' . esc_attr($attr['value']) . '"';
	202	+ }
	203	+ return $html;
176	204	}
177	205	}