escape template name, id and image

8ivek · Aug 19, 2021 · 1fa48d6 · 1fa48d6
1 parent 5abcd45
commit 1fa48d6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/admin/partials/yapt-admin-add-page.php b/admin/partials/yapt-admin-add-page.php
@@ -74,8 +74,8 @@
                             ?>
                             <div class="yapt_template_item">
                                 <label>
-                                    <input type="radio" name="template_id" value="<?php echo $template['id'] ?>" checked="checked"/>
-                                    <img src="<?php echo YAPT_PLUGIN_URL . 'templates/' . $template['template_name'] . '/' . $template['image']; ?>"/>
+                                    <input type="radio" name="template_id" value="<?php echo esc_html($template['id']); ?>" checked="checked"/>
+                                    <img src="<?php echo YAPT_PLUGIN_URL . 'templates/' . esc_html($template['template_name']) . '/' . esc_html($template['image']); ?>"/>
                                 </label>
                             </div>
                             <?php

diff --git a/admin/partials/yapt-admin-edit.php b/admin/partials/yapt-admin-edit.php
@@ -77,13 +77,13 @@
                             ?>
                             <div class="yapt_template_item">
                                 <label>
-                                    <input type="radio" name="template_id" value="<?php echo $template['id'] ?>" <?php
+                                    <input type="radio" name="template_id" value="<?php echo esc_html($template['id']); ?>" <?php
                                     if ($template['id'] === $this->price_table->item['template_id']) {
                                         echo "checked='checked'";
                                     }
                                     ?> />
                                     <img
-                                            src="<?php echo YAPT_PLUGIN_URL . 'templates/' . $template['template_name'] . '/' . $template['image']; ?>"/>
+                                            src="<?php echo YAPT_PLUGIN_URL . 'templates/' . esc_html($template['template_name']) . '/' . esc_html($template['image']); ?>"/>
                                 </label>
                             </div>
                             <?php