Value not escaped

  • Resolved Andy McCoy

    (@andymax)


    7 years, 11 months ago

    Hi,

    The value in this input-box is not escaped:

    <input type=”hidden” class=”current_product_name” value=””>

    Great plugin!

    Best/
    Andy

Viewing 3 replies - 1 through 3 (of 3 total)

  • Hi Andy,

    Can you please help me by pointing the exact issue that you are facing here? Be rest assured we will address that quickly.

    Thanks,

    Team Dualcube

    Thread Starter Andy McCoy

    (@andymax)

    Hi,

    It’s html encoding of the producttitle that is missing. If the producttitle contains double quotes it will give really starnge results.

    I found the it here:

    ..\classes\class-woo-product-stock-alert-frontend.php:

    Line 147: <input type="hidden" class="current_product_name" value="'.$product->post->post_title.'" />

    Line 155: <input type="hidden" class="current_product_name" value="'.$product->post->post_title.'" />

    It hould probably be something like this to solve the problem:

    Line 147: <input type="hidden" class="current_product_name" value="'.htmlentities($product->post->post_title).'" />

    Line 155: <input type="hidden" class="current_product_name" value="'.htmlentities($product->post->post_title).'" />

    Best/
    Andy

    • This reply was modified 7 years, 11 months ago by Andy McCoy.

    Hi Andy,

    That was really helpful and we will keep this small points in mind while moving ahead for the next update.

    Once again, thanks a lot for your valuable input.

    Regards,
    Team Dualcube

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Value not escaped’ is closed to new replies.

Tags