Use wp_unslash() when displaying search string on orders.

2013-11-18 16:32:47 +01:00 · 2013-11-18 16:32:47 +01:00 · 96fe4aae0b
parent faf64a4d96
commit 96fe4aae0b
1 changed files with 1 additions and 1 deletions
--- a/includes/admin/post-types/class-wc-admin-cpt-shop_order.php
+++ b/includes/admin/post-types/class-wc-admin-cpt-shop_order.php
@ -591,7 +591,7 @@ class WC_Admin_CPT_Shop_Order extends WC_Admin_CPT {
 	    if ( $typenow != 'shop_order' ) return $query;
 		if ( ! get_query_var( 'shop_order_search' ) ) return $query;

-		return $_GET['s'];
+		return wp_unslash( $_GET['s'] );
 	}

 	/**