Use strip_tags() for message in prompt_for_confirm() (#991)

This commit is contained in:
Roman Kelesidis 2023-10-26 15:13:17 +07:00 committed by GitHub
commit f4b2676f66
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -142,7 +142,7 @@ class Ajax
* @param int $error_code * @param int $error_code
* @throws Exception * @throws Exception
*/ */
public function ajax_die(string $error_msg, int $error_code = E_AJAX_GENERAL_ERROR) public function ajax_die(string $error_msg, int $error_code = E_AJAX_GENERAL_ERROR): void
{ {
$this->response['error_code'] = $error_code; $this->response['error_code'] = $error_code;
$this->response['error_msg'] = strip_tags($error_msg); $this->response['error_msg'] = strip_tags($error_msg);
@ -244,14 +244,14 @@ class Ajax
* @param string $confirm_msg * @param string $confirm_msg
* @throws Exception * @throws Exception
*/ */
public function prompt_for_confirm(string $confirm_msg) public function prompt_for_confirm(string $confirm_msg): void
{ {
if (empty($confirm_msg)) { if (empty($confirm_msg)) {
$this->ajax_die('false'); $this->ajax_die('false');
} }
$this->response['prompt_confirm'] = 1; $this->response['prompt_confirm'] = 1;
$this->response['confirm_msg'] = $confirm_msg; $this->response['confirm_msg'] = strip_tags($confirm_msg);
$this->send(); $this->send();
} }