Use consistent strategy for sanitizing the payment gateway title.
Elsewhere, in relation to payment gateway titles, we use the HtmlSanitizer utility to remove dangerous HTML but allow a safe subset. We should also apply that here, for consistency.
This commit is contained in:
parent
30ea6cfc71
commit
17c4952e72
|
@ -15,6 +15,8 @@
|
|||
* @version 4.6.0
|
||||
*/
|
||||
|
||||
use Automattic\WooCommerce\Internal\Utilities\HtmlSanitizer;
|
||||
|
||||
defined( 'ABSPATH' ) || exit;
|
||||
|
||||
$order = wc_get_order( $order_id ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
|
||||
|
@ -83,7 +85,7 @@ if ( $show_downloads ) {
|
|||
?>
|
||||
<tr>
|
||||
<th scope="row"><?php echo esc_html( $total['label'] ); ?></th>
|
||||
<td><?php echo ( 'payment_method' === $key ) ? esc_html( $total['value'] ) : wp_kses_post( $total['value'] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></td>
|
||||
<td><?php echo ( 'payment_method' === $key ) ? wc_get_container()->get( HtmlSanitizer::class )->sanitize( $total['value'] ) : wp_kses_post( $total['value'] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></td>
|
||||
</tr>
|
||||
<?php
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue