stklcode/wp-liveticker
1
0
Fork 0
Code Issues Releases 7 Activity

fix: escape ticker ID in shortcode output (#28)

Browse Source 
Ticker ID is user input and may contain literally anything. While this
is properly escaped in the internal query, we should also escape it in
the generated HTML output.
This commit is contained in:
Stefan Kalscheuer 2025-02-04 17:58:19 +01:00
parent a0573a326c
commit 313159c74a
Signed by: stefan
GPG Key ID: 3887EC2A53B55430
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
includes/class-scliveticker.php
View File

@ -232,7 +232,7 @@ class SCLiveticker {
$output = '<div class="wp-block-scliveticker-ticker';
if ( 1 === self::$options['enable_ajax'] ) {
$output .= ' sclt-ajax" '
. 'data-sclt-ticker="' . $ticker . '" '
. 'data-sclt-ticker="' . esc_attr( $ticker ) . '" '
. 'data-sclt-limit="' . $limit . '" '
. 'data-sclt-last="' . $last;
}
@ -242,9 +242,9 @@ class SCLiveticker {
if ( $show_feed ) {
$feed_link = get_post_type_archive_feed_link( 'scliveticker_tick' ) . '';
if ( false === strpos( $feed_link, '&' ) ) {
$feed_link .= '?scliveticker_ticker=' . $ticker;
$feed_link .= '?scliveticker_ticker=' . rawurlencode( $ticker );
} else {
$feed_link .= '&scliveticker_ticker=' . $ticker;
$feed_link .= '&scliveticker_ticker=' . rawurlencode( $ticker );
}
$output .= '<a href="' . esc_attr( $feed_link ) . '">Feed</a>';
}