From ff8bdd4d59010a874aa350f86e3b5fd871b708fb Mon Sep 17 00:00:00 2001 From: xecdev Date: Thu, 20 Feb 2025 22:05:23 +0430 Subject: [PATCH] Sanitize session data in public output to prevent XSS vulnerabilities --- includes/class-paybutton-public.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/class-paybutton-public.php b/includes/class-paybutton-public.php index b5f1ffe..ac244f3 100644 --- a/includes/class-paybutton-public.php +++ b/includes/class-paybutton-public.php @@ -96,7 +96,7 @@ public function enqueue_public_assets() { 'ajaxUrl' => admin_url( 'admin-ajax.php' ), 'nonce' => wp_create_nonce( 'paybutton_paywall_nonce' ), 'isUserLoggedIn' => ! empty( $_SESSION['cashtab_ecash_address'] ) ? 1 : 0, - 'userAddress' => ! empty( $_SESSION['cashtab_ecash_address'] ) ? $_SESSION['cashtab_ecash_address'] : '', + 'userAddress' => ! empty( $_SESSION['cashtab_ecash_address'] ) ? sanitize_text_field( $_SESSION['cashtab_ecash_address'] ) : '', 'defaultAddress' => get_option( 'paybutton_paywall_ecash_address', '' ), //Localize the Unlocked Content Indicator variable 'scrollToUnlocked' => get_option( 'paybutton_scroll_to_unlocked', '1' ), @@ -235,7 +235,7 @@ private function post_is_unlocked( $post_id ) { return true; } if ( ! empty( $_SESSION['cashtab_ecash_address'] ) ) { - $address = $_SESSION['cashtab_ecash_address']; + $address = sanitize_text_field( $_SESSION['cashtab_ecash_address'] ); if ( $this->is_unlocked_in_db( $address, $post_id ) ) { return true; }