From 3e485f0a0304211d5147cc5a5751d0a052a1c3d5 Mon Sep 17 00:00:00 2001 From: savvasha Date: Sun, 26 Sep 2021 16:22:35 +0300 Subject: [PATCH] FIX: Minor security issue --- includes/admin/post-types/class-sp-admin-cpt-event.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/includes/admin/post-types/class-sp-admin-cpt-event.php b/includes/admin/post-types/class-sp-admin-cpt-event.php index a8cc4a4b..cf957d83 100644 --- a/includes/admin/post-types/class-sp-admin-cpt-event.php +++ b/includes/admin/post-types/class-sp-admin-cpt-event.php @@ -262,7 +262,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { if ( $typenow != 'sp_event' ) return; - $selected = isset( $_REQUEST['team'] ) ? $_REQUEST['team'] : null; + $selected = isset( $_REQUEST['team'] ) ? esc_attr( $_REQUEST['team'] ) : null; $args = array( 'post_type' => 'sp_team', 'name' => 'team', @@ -272,7 +272,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { ); wp_dropdown_pages( $args ); - $selected = isset( $_REQUEST['sp_league'] ) ? $_REQUEST['sp_league'] : null; + $selected = isset( $_REQUEST['sp_league'] ) ? esc_attr( $_REQUEST['sp_league'] ) : null; $args = array( 'show_option_all' => __( 'Show all leagues', 'sportspress' ), 'taxonomy' => 'sp_league', @@ -281,7 +281,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { ); sp_dropdown_taxonomies( $args ); - $selected = isset( $_REQUEST['sp_season'] ) ? $_REQUEST['sp_season'] : null; + $selected = isset( $_REQUEST['sp_season'] ) ? esc_attr( $_REQUEST['sp_season'] ) : null; $args = array( 'show_option_all' => __( 'Show all seasons', 'sportspress' ), 'taxonomy' => 'sp_season', @@ -290,7 +290,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT { ); sp_dropdown_taxonomies( $args ); - $selected = isset( $_REQUEST['match_day'] ) ? $_REQUEST['match_day'] : null; + $selected = isset( $_REQUEST['match_day'] ) ? esc_attr( $_REQUEST['match_day'] ) : null; echo ''; if ( current_user_can( 'edit_others_sp_events' ) )