Changeset 3178811

Timestamp:

10/30/2024 12:34:52 PM (17 months ago)

Author:

webangon

Message:

Security fix

Location:

the-pack-addon/trunk/includes

Files:

• helper-functions.php (modified) (1 diff)
• widgets/element/accordion/view.php (modified) (1 diff)
• widgets/woocommerce/woo-title-description/view.php (modified) (1 diff)

the-pack-addon/trunk/includes/helper-functions.php

@@ -13 +13 @@
 function tp_only_alpha_num($string){
     if (!preg_match("/[^[:alnum:]_\/-]/",$string)) {
+        return $string;
+    }
+}
+
+function tp_allow_html_tag($string){
+    $allowed = ['h1','h2','h3','h4','h5','h6','p','span'];
+    if (in_array($string, $allowed)){
         return $string;
     }

the-pack-addon/trunk/includes/widgets/element/accordion/view.php

@@ -38 +38 @@
 </ul>
 </div>
+

the-pack-addon/trunk/includes/widgets/woocommerce/woo-title-description/view.php

@@ -15 +15 @@
       break;
 }
-$tag = tp_only_alpha_num($settings['tag']); 
+$tag = tp_allow_html_tag($settings['tag']); 
 echo sprintf( "<%s class='product_title_desc'>%s</%s>", $tag, esc_attr($type), $tag  );
-?>
+?>