From 70eadf8ac07f167e3b0aa8f431e5675fa0778205 Mon Sep 17 00:00:00 2001
From: Savvas Hadjigeorgiou <savvasha@hotmail.com>
Date: Fri, 5 Nov 2021 13:20:56 +0200
Subject: [PATCH] Escape output vars on Admin Dashboard

---
 includes/admin/class-sp-admin-dashboard.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/admin/class-sp-admin-dashboard.php b/includes/admin/class-sp-admin-dashboard.php
index 2c871439..cd7b2eaa 100644
--- a/includes/admin/class-sp-admin-dashboard.php
+++ b/includes/admin/class-sp-admin-dashboard.php
@@ -79,7 +79,7 @@ class SP_Admin_Dashboard {
               <li class="countdown" data-countdown="<?php echo str_replace( '-', '/', get_gmt_from_date( $next_event->post_date ) ); ?>">
                   <a href="<?php echo get_edit_post_link( $next_event->ID ); ?>">
                       <?php printf( __( '<strong>%s</strong> until next event', 'sportspress' ), $interval->days . ' ' . __( 'days', 'sportspress' ) . ' ' . sprintf( '%02s:%02s:%02s', $interval->h, $interval->i, $interval->s ) ); ?>
-                      (<?php echo $next_event->post_title; ?>)
+                      (<?php echo esc_attr( $next_event->post_title ); ?>)
                   </a>
               </li>
           <?php endif; ?>
@@ -113,7 +113,7 @@ class SP_Admin_Dashboard {
       <div class="rss-widget">
         <ul>
           <?php foreach ($rss_items as $item) { ?>
-          <li><a class="rsswidget" href="<?php echo $item->get_permalink(); ?>" target="_blank"><?php echo $item->get_title(); ?></a> <span class="rss-date"><?php echo $item->get_date('j F Y'); ?></span></li>
+          <li><a class="rsswidget" href="<?php echo esc_url( $item->get_permalink() ); ?>" target="_blank"><?php echo esc_attr( $item->get_title() ); ?></a> <span class="rss-date"><?php echo esc_attr( $item->get_date('j F Y') ); ?></span></li>
           <?php } ?>
         </ul>
       </div>