stklcode/wp-liveticker
1
0
Fork 0
Code Issues Releases 7 Activity

fix: escape ticker ID in shortcode output (#28)

Browse Source 
Ticker ID is user input and may contain literally anything. While this
is properly escaped in the internal query, we should also escape it in
the generated HTML output.
This commit is contained in:
Stefan Kalscheuer
2025-02-04 17:58:19 +01:00
parent a0573a326c
commit 313159c74a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
includes/class-scliveticker.php
View File

@ -232,7 +232,7 @@ class SCLiveticker {
$output = '<div class="wp-block-scliveticker-ticker';
if ( 1 === self::$options['enable_ajax'] ) {
$output .= ' sclt-ajax" '
. 'data-sclt-ticker="' . $ticker . '" '
. 'data-sclt-ticker="' . esc_attr( $ticker ) . '" '
. 'data-sclt-limit="' . $limit . '" '
. 'data-sclt-last="' . $last;
}
@ -242,9 +242,9 @@ class SCLiveticker {
if ( $show_feed ) {
$feed_link = get_post_type_archive_feed_link( 'scliveticker_tick' ) . '';
if ( false === strpos( $feed_link, '&' ) ) {
$feed_link .= '?scliveticker_ticker=' . $ticker;
$feed_link .= '?scliveticker_ticker=' . rawurlencode( $ticker );
} else {
$feed_link .= '&scliveticker_ticker=' . $ticker;
$feed_link .= '&scliveticker_ticker=' . rawurlencode( $ticker );
}
$output .= '<a href="' . esc_attr( $feed_link ) . '">Feed</a>';
}