From b25cbf7cedd1c771b6a09f9fa527dbdc0bc80f45 Mon Sep 17 00:00:00 2001
From: Jeroen Schmit <jeroen@slimndap.com>
Date: Wed, 20 Nov 2024 12:23:47 +0100
Subject: [PATCH] Fixed Cross-Site Scripting Vulnerability CVE-2024-11371.

---
 functions/wpt_productions_list_table.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/functions/wpt_productions_list_table.php b/functions/wpt_productions_list_table.php
index 043fd86a..26d8cc21 100644
--- a/functions/wpt_productions_list_table.php
+++ b/functions/wpt_productions_list_table.php
@@ -318,6 +318,7 @@ function get_productions_args_from_dates_dropdown() {
 	 *
 	 * @since	0.15
 	 * @since	0.15.4	Removed the 'paged' query var when switching views.
+	 * @since	0.18.7	Fixed Cross-Site Scripting Vulnerability CVE-2024-11371.
 	 * @return	array	The views.
 	 */
 	function get_views() {
@@ -329,7 +330,7 @@ function get_views() {
 		$view_url = remove_query_arg( 'paged', $view_url );
 
 		ob_start();
-		?><a href="<?php echo $view_url;?>" <?php if ( empty( $_REQUEST['post_status'] ) ) { ?> class="current"<?php } ?>><?php _e( 'All' ); ?></a><?php
+		?><a href="<?php echo esc_url( $view_url );?>" <?php if ( empty( $_REQUEST['post_status'] ) ) { ?> class="current"<?php } ?>><?php _e( 'All' ); ?></a><?php
 	    $views['all'] = ob_get_clean();
 
 		$views_available = array(
@@ -345,7 +346,7 @@ function get_views() {
 				$view_url = remove_query_arg( 'paged', $view_url );
 
 				ob_start();
-				?><a href="<?php echo $view_url;?>" <?php if ( ! empty( $_REQUEST['post_status'] ) && $key == $_REQUEST['post_status'] ) { ?> class="current"<?php } ?>><?php	echo $val;
+				?><a href="<?php echo esc_url( $view_url );?>" <?php if ( ! empty( $_REQUEST['post_status'] ) && $key == $_REQUEST['post_status'] ) { ?> class="current"<?php } ?>><?php	echo $val;
 						?><span class="count"> (<?php echo $num_posts->{$key};?>)</span>
 				</a><?php
 			    $views[ $key ] = ob_get_clean();