Skip to content

Sanitize event time and error messages to prevent XSS #2661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtashjianjr-godaddy merged 1 commit into from
Mar 3, 2026
+17 −17
Merged

Sanitize event time and error messages to prevent XSS #2661

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions src/blocks/events/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,8 +99,8 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

$event_time_string = sprintf(
'<span class="wp-block-coblocks-events__time">%1$s - %2$s</span>',
gmdate( 'g:ia', $start_date_string ),
gmdate( 'g:ia', $end_date_string )
esc_html( gmdate( 'g:ia', $start_date_string ) ),
esc_html( gmdate( 'g:ia', $end_date_string ) )
);

$events_layout .= coblocks_render_single_day_event_item(
Expand All @@ -117,8 +117,8 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

$event_time_string = sprintf(
'<span class="wp-block-coblocks-events__time">%1$s - %2$s</span>',
gmdate( 'g:ia', $start_date_string ),
gmdate( 'g:ia', $end_date_string )
esc_html( gmdate( 'g:ia', $start_date_string ) ),
esc_html( gmdate( 'g:ia', $end_date_string ) )
);

$events_layout .= coblocks_render_multi_day_event_item(
Expand All @@ -136,8 +136,8 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

$event_time_string = sprintf(
'<span data-start-time=%1$s data-end-time=%2$s class="wp-block-coblocks-events__time wp-block-coblocks-events__time-formatted"></span>',
gmdate( 'c', $start_date_string ),
gmdate( 'c', $end_date_string )
esc_html( gmdate( 'c', $start_date_string ) ),
esc_html( gmdate( 'c', $end_date_string ) )
);

$events_layout .= coblocks_render_single_day_event_item(
Expand All @@ -154,8 +154,8 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

$event_time_string = sprintf(
'<span data-start-time=%1$s data-end-time=%2$s class="wp-block-coblocks-events__time wp-block-coblocks-events__time-formatted"></span>',
gmdate( 'c', $start_date_string ),
gmdate( 'c', $end_date_string )
esc_html( gmdate( 'c', $start_date_string ) ),
esc_html( gmdate( 'c', $end_date_string ) )
);

$events_layout .= coblocks_render_multi_day_event_item(
Expand Down Expand Up @@ -188,8 +188,8 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

$events_layout .= '</div>';

$events_layout .= sprintf( '<button class="wp-coblocks-events-nav-button__prev" id="wp-coblocks-event-swiper-prev" style="visibility: hidden" aria-label="%s"/>', __( 'Previous post', 'coblocks' ) );
$events_layout .= sprintf( '<button class="wp-coblocks-events-nav-button__next" id="wp-coblocks-event-swiper-next" style="visibility: hidden" aria-label="%s"/>', __( 'Next post', 'coblocks' ) );
$events_layout .= sprintf( '<button class="wp-coblocks-events-nav-button__prev" id="wp-coblocks-event-swiper-prev" style="visibility: hidden" aria-label="%s"/>', esc_attr__( 'Previous post', 'coblocks' ) );
$events_layout .= sprintf( '<button class="wp-coblocks-events-nav-button__next" id="wp-coblocks-event-swiper-next" style="visibility: hidden" aria-label="%s"/>', esc_attr__( 'Next post', 'coblocks' ) );

$events_layout .= '</div>';

Expand All @@ -199,7 +199,7 @@ function coblocks_render_coblocks_events_block( $attributes, $content ) {

} catch ( \Exception $e ) {

return '<div class="components-placeholder"><div class="notice notice-error">' . __( 'An error has occurred, check for calendar privileges to make sure it is public or try again later.', 'coblocks' ) . '</div></div>';
return '<div class="components-placeholder"><div class="notice notice-error">' . esc_html__( 'An error has occurred, check for calendar privileges to make sure it is public or try again later.', 'coblocks' ) . '</div></div>';

}
}
Expand Down Expand Up @@ -234,18 +234,18 @@ function coblocks_render_event_item(
<span class="wp-block-coblocks-events__year">%3$s</span>
</div>
</div>',
$date_range,
$month,
$year
esc_html( $date_range ),
esc_html( $month ),
esc_html( $year ),
);

$event_layout .= sprintf(
'<div class="wp-block-coblocks-events__content">
<span class="wp-block-coblocks-events__title">%1$s</span>
<span class="wp-block-coblocks-events__description">%2$s</span>
</div>',
$title,
$description
esc_html( $title ),
esc_html( $description )
);

$event_layout .= sprintf(
Expand All @@ -254,7 +254,7 @@ function coblocks_render_event_item(
<span class="wp-block-coblocks-events__location">%2$s</span>
</div>',
$time_string,
$location
esc_html( $location )
);

return $event_layout;
Expand Down
Loading