Changeset 2736803

Timestamp:

06/03/2022 07:28:31 AM (4 years ago)

Author:

codup

Message:

#Codup WooCommerce Gift Product Update

Location:

woo-product-as-gift/trunk

Files:

• class/class-wc-gift-settings.php (modified) (1 diff)
• partials/gifts-settings.php (modified) (1 diff)
• partials/wrapping.php (modified) (2 diffs)

woo-product-as-gift/trunk/class/class-wc-gift-settings.php

@@ -66 +66 @@
                 delete_option("wcgw-gift-detail");
             }
-            $wcgw_wrapping_style = (isset($_POST["wcgw-wrapping-style"])) ? wp_unslash($_POST["wcgw-wrapping-style"]) : false;
-            $first_set = (isset($_POST["wcgw-wrapping-style"]["name"][0])) ? wp_unslash($_POST["wcgw-wrapping-style"]["name"][0]) : false;
+            $wcgw_wrapping_style = (isset($_POST["wcgw-wrapping-style"])) ? filter_var_array(wp_unslash($_POST["wcgw-wrapping-style"])) : false;
+            $first_set = (isset($_POST["wcgw-wrapping-style"]["name"][0])) ? wp_kses_post(wp_unslash($_POST["wcgw-wrapping-style"]["name"][0])) : false;
+
             if ( !empty($first_set) ) {
                 $this->save_styles($wcgw_wrapping_style);

woo-product-as-gift/trunk/partials/gifts-settings.php

@@ -6 +6 @@
     if ( filter_input(INPUT_GET, 'page') == "wc-gift-settings" ) {
         if ( filter_input(INPUT_GET, 'tab') ) {
-            $active_tab = $_GET['tab'];
+            $active_tab = wp_kses_post($_GET['tab']);
         }
     }

woo-product-as-gift/trunk/partials/wrapping.php

@@ -58 +58 @@
                                         ?>
                                         <div>
-                                            <input name="wcgw-wrapping-style[image][]" data-image='<?php echo esc_attr($no_image); ?>' value="<?php echo $style["image"]; ?>" type="hidden" />
+                                            <input name="wcgw-wrapping-style[image][]" data-image='<?php echo esc_attr($no_image); ?>' value="<?php esc_attr($style["image"]); ?>" type="hidden" />
                                             <button type="button" class="upload_image_button button">Upload</button>
                                         </div>
@@ -70 +70 @@
                                 }
                                 ?>
-                                <p class="dashicons <?php echo $class; ?>"></p>
+                                <p class="dashicons <?php esc_attr($class); ?>"></p>
                             </div>
                             <?php