WordPress.org
Get WordPress

Plugin Directory

Changeset 3186303


Ignore:
Timestamp:
11/12/2024 08:21:07 AM (15 months ago)
Author:
razorpay
Message:

Update: 2.4.7

Location:
razorpay-payment-button/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • razorpay-payment-button/trunk/includes/rzp-payment-buttons.php

    r2735435 r3186303  
    8989        //All Buttons
    9090        $class = ($current === 'all' ? ' class="current"' :'');
    91         $all_url = remove_query_arg('status');
     91        $all_url = esc_url(remove_query_arg('status'));
    9292        $views['all'] = "<a href='{$all_url }' {$class} >All</a>";
    9393
    9494        //Recovered link
    95         $foo_url = add_query_arg('status','active');
     95        $foo_url = esc_url(add_query_arg('status','active'));
    9696        $class = ($current === 'active' ? ' class="current"' :'');
    9797        $views['status'] = "<a href='{$foo_url}' {$class} >Enabled</a>";
    9898
    9999        //Abandon
    100         $bar_url = add_query_arg('status','inactive');
     100        $bar_url = esc_url(add_query_arg('status','inactive'));
    101101        $class = ($current === 'inactive' ? ' class="current"' :'');
    102102        $views['disabled'] = "<a href='{$bar_url}' {$class} >Disabled</a>";

  • razorpay-payment-button/trunk/includes/rzp-subscription-buttons.php

    r2735435 r3186303  
    8989        //All Buttons
    9090        $class = ($current === 'all' ? ' class="current"' :'');
    91         $all_url = remove_query_arg('status');
     91        $all_url = esc_url(remove_query_arg('status'));
    9292        $views['all'] = "<a href='{$all_url }' {$class} >All</a>";
    9393
    9494        //Recovered link
    95         $foo_url = add_query_arg('status','active');
     95        $foo_url = esc_url(add_query_arg('status','active'));
    9696        $class = ($current === 'active' ? ' class="current"' :'');
    9797        $views['status'] = "<a href='{$foo_url}' {$class} >Enabled</a>";
    9898
    9999        //Abandon
    100         $bar_url = add_query_arg('status','inactive');
     100        $bar_url = esc_url(add_query_arg('status','inactive'));
    101101        $class = ($current === 'inactive' ? ' class="current"' :'');
    102102        $views['disabled'] = "<a href='{$bar_url}' {$class} >Disabled</a>";

  • razorpay-payment-button/trunk/razorpay-payment-buttons.php

    r3148679 r3186303  
    55 * Plugin URI:  https://github.com/razorpay/payment-button-wordpress-plugin
    66 * Description: Add a Razorpay Payment Button (Donate Now, Buy Now, Support Now and more)  to your website and start accepting payments via Credit/Debit cards, Netbanking, UPI, Wallets, Pay later etc. instantly.
    7  * Version:     2.4.6
     7 * Version:     2.4.7
    88 * Author:      Razorpay
    99 * Author URI:  https://razorpay.com

  • razorpay-payment-button/trunk/readme.txt

    r3148679 r3186303  
    33Tags: Payment gateway, Donate button, UPI/credit/debit card, Payment plugin, India, e-commerce, education.
    44Tested up to: 6.6
    5 Stable tag: 2.4.6
     5Stable tag: 2.4.7
    66License: GPLv2 or later
    77License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    9999== Changelog ==
    100100
     101= 2.4.7 =
     102* Added security enhancements
     103
    101104= 2.4.6 =
    102105* Fixed naming conflict in razorpay section

  • razorpay-payment-button/trunk/templates/razorpay-button-view-templates.php

    r2744133 r3186303  
    2727            wp_die("This page consist some request parameters to view response");
    2828        }
    29         $pagenum = $_REQUEST['paged'];
    30         $type = $_REQUEST['type'];
     29        $pagenum = sanitize_text_field($_REQUEST['paged']); // nosemgrep
     30        $type = sanitize_text_field($_REQUEST['type']); // nosemgrep
    3131        if($type === 'payment')
    3232        {
    … …  
    4747                    <span class="dashicons rzp-dashicons dashicons-arrow-left-alt"></span> Button List
    4848                </a>
    49                 <span class="dashicons rzp-dashicons dashicons-arrow-right-alt2"></span>'.$button_detail['title'].'
     49                <span class="dashicons rzp-dashicons dashicons-arrow-right-alt2"></span>' . esc_html($button_detail['title']) . '
    5050            </div>
    5151            <div class="container rzp-container">
    5252                <div class="row panel-heading">
    53                     <div class="text">'.$button_detail['title'].'</div>
     53                    <div class="text">' . esc_html($button_detail['title']) . '</div>
    5454                </div>
    5555                <div class="row panel-body">
    … …  
    5757                        <div class="row">
    5858                            <div class="col-sm-4 panel-label">Button ID</div>
    59                             <div class="col-sm-8 panel-value">'.$button_detail["id"].'</div>
     59                            <div class="col-sm-8 panel-value">' . esc_html($button_detail["id"]) . '</div>
    6060                        </div>
    6161                        <div class="row">
    6262                            <div class="col-sm-4 panel-label">Button Status</div>
    6363                            <div class="col-sm-8 panel-value">
    64                                 <span class="status-label">'.$button_detail['status'].'</span>
    65                                 <button onclick="'.$show.'" class="status-button">'.$button_detail['btn_pointer_status'].'</button>
     64                                <span class="status-label">' . esc_html($button_detail['status']) . '</span>
     65                                <button onclick="'.$show.'" class="status-button">' . esc_html($button_detail['btn_pointer_status']) . '</button>
    6666                            </div>
    6767                        </div>
    6868                        <div class="row">
    6969                            <div class="col-sm-4 panel-label">Total Quantity Sold</div>
    70                             <div class="col-sm-8 panel-value">'.$button_detail['total_item_sold'].'</div>
     70                            <div class="col-sm-8 panel-value">' . htmlentities($button_detail['total_item_sold']) . '</div>
    7171                        </div>';
    7272                        if($type === 'payment')
    … …  
    7474                            echo '<div class="row">
    7575                                    <div class="col-sm-4 panel-label">Total revenue</div>
    76                                     <div class="col-sm-8 panel-value"><span class="rzp-currency">₹ </span>' . $button_detail['total_revenue'] . '</div>
     76                                    <div class="col-sm-8 panel-value"><span class="rzp-currency">₹ </span>' . esc_html($button_detail['total_revenue']) . '</div>
    7777                                </div>';
    7878                        }
    7979                        echo '<div class="row">
    8080                            <div class="col-sm-4 panel-label">Created on</div>
    81                             <div class="col-sm-8 panel-value">'.$button_detail['created_at'].'</div>
     81                            <div class="col-sm-8 panel-value">' . esc_html($button_detail['created_at']) . '</div>
    8282                        </div>
    8383                    </div>';
    … …  
    9898    <div class="container">
    9999        <div class="modal-header">
    100             <h3 class="modal-title">'.$button_detail["modal_title_content"].'</h3>
     100            <h3 class="modal-title">' . esc_html($button_detail["modal_title_content"]) . '</h3>
    101101        </div> 
    102102        <div class="modal-body">
    103103            <div class="text-semi-muted">
    104                 <p>'.$button_detail["modal_body_content"].'</p>
     104                <p>' . esc_html($button_detail["modal_body_content"]) . '</p>
    105105            </div>
    106106            <div class="Modal__actions">
    107107                <button type="button" onclick="'.$hide.'" class="btn btn-default">No, don`t!</button>
    108                 <button type="submit" onclick="'.$hide.'" name="btn_action" value="'.$button_detail['btn_pointer_status'].'" class="btn btn-primary">Yes, '.$button_detail['btn_pointer_status'].'</button>
     108                <button type="submit" onclick="'.$hide.'" name="btn_action" value="' . esc_html($button_detail['btn_pointer_status']) . '" class="btn btn-primary">Yes, ' . esc_html($button_detail['btn_pointer_status']) . '</button>
    109109                <input type="hidden" name="type" value="'.$type.'">
    110                 <input type="hidden" name="btn_id" value="'.$button_detail['id'].'">
     110                <input type="hidden" name="btn_id" value="' . esc_html($button_detail['id']) . '">
    111111                <input type="hidden" name="paged" value="'.$pagenum.'">
    112112                <input type="hidden" name="action" value="rzp_btn_action">
    … …  
    203203            $html_content_item = $html_content_item.$content;
    204204        }
    205        
     205
    206206        return array(
    207207            'id' => $button_detail['id'],
Note: See TracChangeset for help on using the changeset viewer.