stklcode/wp-liveticker
1
0
Fork 0
Code Issues Releases 7 Activity

fix: escape ticker ID in shortcode output (#28)
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse Source 
Ticker ID is user input and may contain literally anything. While this
is properly escaped in the internal query, we should also escape it in
the generated HTML output.
This commit is contained in:
Stefan Kalscheuer 2025-02-04 17:58:19 +01:00
parent 4635a47ca9
commit fceea65dfb
Signed by: stefan
GPG Key ID: 3887EC2A53B55430
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
includes/class-scliveticker.php
View File

@ -232,7 +232,7 @@ class SCLiveticker {
$output = '<div class="wp-block-scliveticker-ticker';
if ( 1 === self::$options['enable_ajax'] ) {
$output .= ' sclt-ajax" '
. 'data-sclt-ticker="' . $ticker . '" '
. 'data-sclt-ticker="' . esc_attr( $ticker ) . '" '
. 'data-sclt-limit="' . $limit . '" '
. 'data-sclt-last="' . $last;
}
@ -242,9 +242,9 @@ class SCLiveticker {
if ( $show_feed ) {
$feed_link = get_post_type_archive_feed_link( 'scliveticker_tick' ) . '';
if ( false === strpos( $feed_link, '&' ) ) {
$feed_link .= '?scliveticker_ticker=' . $ticker;
$feed_link .= '?scliveticker_ticker=' . rawurlencode( $ticker );
} else {
$feed_link .= '&scliveticker_ticker=' . $ticker;
$feed_link .= '&scliveticker_ticker=' . rawurlencode( $ticker );
}
$output .= '<a href="' . esc_attr( $feed_link ) . '">Feed</a>';
}