Fixed Cross-Site Scripting Vulnerability CVE-2024-11371.

slimndap · Nov 20, 2024 · b25cbf7 · b25cbf7
1 parent 8ec728b
commit b25cbf7
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/functions/wpt_productions_list_table.php b/functions/wpt_productions_list_table.php
@@ -318,6 +318,7 @@ function get_productions_args_from_dates_dropdown() {
 	 *
 	 * @since	0.15
 	 * @since	0.15.4	Removed the 'paged' query var when switching views.
+	 * @since	0.18.7	Fixed Cross-Site Scripting Vulnerability CVE-2024-11371.
 	 * @return	array	The views.
 	 */
 	function get_views() {
@@ -329,7 +330,7 @@ function get_views() {
 		$view_url = remove_query_arg( 'paged', $view_url );
 
 		ob_start();
-		?><a href="<?php echo $view_url;?>" <?php if ( empty( $_REQUEST['post_status'] ) ) { ?> class="current"<?php } ?>><?php _e( 'All' ); ?></a><?php
+		?><a href="<?php echo esc_url( $view_url );?>" <?php if ( empty( $_REQUEST['post_status'] ) ) { ?> class="current"<?php } ?>><?php _e( 'All' ); ?></a><?php
 	    $views['all'] = ob_get_clean();
 
 		$views_available = array(
@@ -345,7 +346,7 @@ function get_views() {
 				$view_url = remove_query_arg( 'paged', $view_url );
 
 				ob_start();
-				?><a href="<?php echo $view_url;?>" <?php if ( ! empty( $_REQUEST['post_status'] ) && $key == $_REQUEST['post_status'] ) { ?> class="current"<?php } ?>><?php	echo $val;
+				?><a href="<?php echo esc_url( $view_url );?>" <?php if ( ! empty( $_REQUEST['post_status'] ) && $key == $_REQUEST['post_status'] ) { ?> class="current"<?php } ?>><?php	echo $val;
 						?><span class="count"> (<?php echo $num_posts->{$key};?>)</span>
 				</a><?php
 			    $views[ $key ] = ob_get_clean();