Skip to content

Commit 4ecc8e7

Browse files
vytisbulkeviciusvytisbulkevicius
authored
Merge pull request #441 from Codeinwp/bugfix/pro/528
Fixed XSS vulnerability issue with tooltip text
2 parents f10bf17 + ab28b6f commit 4ecc8e7

File tree

6 files changed

+86
-9
lines changed

6 files changed

+86
-9
lines changed

‎classes/frontend-scripts.class.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,9 @@ public static function load_scripts_by_product_id( $product_id, $ppom_id = null,
444444
break;
445445
}
446446

447+
if ( ! empty( $fields_meta['description'] ) ) {
448+
$fields_meta['description'] = wp_strip_all_tags( html_entity_decode( $fields_meta['description'] ) );
449+
}
447450
$inputs_meta_updated[] = $fields_meta;
448451

449452
// Conditional fields

‎classes/input-meta.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ function field_label( $tooltip = true, $desc = true, $asterisk = true ) {
155155

156156
$asterisk_symbol = ( ! empty( $this->required() ) && $this->title() != '' ) ? '<span class="show_required"> *</span>' : '';
157157

158-
$show_desc = ( ! empty( $this->desc() ) ) ? '<span class="show_description ppom-input-desc">' . $this->desc() . '</span>' : '';
158+
$show_desc = ( ! empty( $this->desc() ) ) ? '<span class="show_description ppom-input-desc">' . wp_strip_all_tags( html_entity_decode( $this->desc() ) ) . '</span>' : '';
159159

160160
if ( $desc ) {
161161
$show_desc = apply_filters( 'ppom_field_description', $show_desc, self::$input_meta );

‎classes/plugin.class.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -974,9 +974,10 @@ function add_ppom_meta_panel() {
974974
public function show_tooltip( $description, $meta ) {
975975
$input_desc = ! empty( $meta['description'] ) ? $meta['description'] : '';
976976
$input_desc = apply_filters( 'ppom_description_content', stripslashes( $input_desc ), $meta );
977+
$input_desc = wp_strip_all_tags( html_entity_decode( $input_desc ) );
977978

978979
// Check if the tooltip is enabled.
979-
if ( isset( $meta['desc_tooltip'] ) && 'on' === $meta['desc_tooltip'] ) {
980+
if ( ! empty( $input_desc ) && isset( $meta['desc_tooltip'] ) && 'on' === $meta['desc_tooltip'] ) {
980981
$description = ( ! empty( $meta['description'] ) ) ? ' <span data-ppom-tooltip="ppom_tooltip" class="ppom-tooltip" title="' . esc_attr( $input_desc ) . '"><svg width="13px" height="13px" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="currentColor" d="M504 256c0 136.997-111.043 248-248 248S8 392.997 8 256C8 119.083 119.043 8 256 8s248 111.083 248 248zM262.655 90c-54.497 0-89.255 22.957-116.549 63.758-3.536 5.286-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></span>' : '';
981982
}
982983
return $description;

‎templates/frontend/inputs/divider.php

Lines changed: 60 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,18 @@
103103
if ( $divider_styles == 'style1' ) {
104104
if ( $fm->field_label() ) {
105105
?>
106-
<h2 class="ppom-divider-with-txt ppom-divider-line ppom-divider-line-clr ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
106+
<h2 class="ppom-divider-with-txt ppom-divider-line ppom-divider-line-clr ppom-divider-txt">
107+
<?php
108+
echo wp_kses(
109+
$fm->field_label(),
110+
array(
111+
'span' => array(
112+
'class' => true,
113+
),
114+
)
115+
);
116+
?>
117+
</h2>
107118
<?php } else { ?>
108119
<hr class="ppom-divider-<?php echo esc_attr( $style1_border ); ?>">
109120
<?php
@@ -113,27 +124,71 @@
113124

114125
<!--Style 2-->
115126
<?php if ( $divider_styles == 'style2' ) { ?>
116-
<h2 class="ppom-divider-with-txt ppom-divider-gradient ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
127+
<h2 class="ppom-divider-with-txt ppom-divider-gradient ppom-divider-txt">
128+
<?php
129+
echo wp_kses(
130+
$fm->field_label(),
131+
array(
132+
'span' => array(
133+
'class' => true,
134+
),
135+
)
136+
);
137+
?>
138+
</h2>
117139
<?php } ?>
118140

119141
<!--Style 3-->
120142
<?php if ( $divider_styles == 'style3' ) { ?>
121-
<h2 class="ppom-divider-with-txt ppom-divider-donotcross ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h2>
143+
<h2 class="ppom-divider-with-txt ppom-divider-donotcross ppom-divider-txt">
144+
<?php
145+
echo wp_kses(
146+
$fm->field_label(),
147+
array(
148+
'span' => array(
149+
'class' => true,
150+
),
151+
)
152+
);
153+
?>
154+
</h2>
122155
<?php } ?>
123156

124157
<!--Style 4-->
125158
<?php if ( $divider_styles == 'style4' ) { ?>
126159
<div class="ppom-divider-easy-shadow">
127160
<span></span>
128-
<span class="ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></span>
161+
<span class="ppom-divider-txt">
162+
<?php
163+
echo wp_kses(
164+
$fm->field_label(),
165+
array(
166+
'span' => array(
167+
'class' => true,
168+
),
169+
)
170+
);
171+
?>
172+
</span>
129173
<span></span>
130174
</div>
131175
<?php } ?>
132176

133177
<!--Style 5-->
134178
<?php if ( $divider_styles == 'style5' ) { ?>
135179

136-
<h1 class="ppom-divider-fancy-heading ppom-divider-txt"><?php echo esc_html( $fm->field_label() ); ?></h1>
180+
<h1 class="ppom-divider-fancy-heading ppom-divider-txt">
181+
<?php
182+
echo wp_kses(
183+
$fm->field_label(),
184+
array(
185+
'span' => array(
186+
'class' => true,
187+
),
188+
)
189+
);
190+
?>
191+
</h1>
137192
<div class="ppom-divider-fancy-line">
138193
<span></span>
139194
</div>

‎templates/frontend/inputs/quantities.php

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,16 @@
5151
class="<?php echo esc_attr( $fm->label_classes() ); ?>"
5252
for="<?php echo esc_attr( $fm->data_name() ); ?>"
5353
>
54-
<?php echo esc_html( $fm->field_label() ); ?>
54+
<?php
55+
echo wp_kses(
56+
$fm->field_label(),
57+
array(
58+
'span' => array(
59+
'class' => true,
60+
),
61+
)
62+
);
63+
?>
5564
</label>
5665
<?php endif ?>
5766

‎templates/frontend/inputs/text.php

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,16 @@
5454
class="<?php echo esc_attr( $fm->label_classes() ); ?>"
5555
for="<?php echo esc_attr( $fm->data_name() ); ?>"
5656
>
57-
<?php echo esc_html( $fm->field_label() ); ?>
57+
<?php
58+
echo wp_kses(
59+
$fm->field_label(),
60+
array(
61+
'span' => array(
62+
'class' => true,
63+
),
64+
)
65+
);
66+
?>
5867
</label>
5968
<?php endif ?>
6069

0 commit comments

Comments
 (0)