Skip to content

Commit fa0bc10

Browse files
author
Daniel Neto
committed
fix: Update plugin parameter handling to ensure proper JSON encoding in confirmButton.php
https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768#event-599634
1 parent ece96cd commit fa0bc10

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@
113113
"value": $('#value<?php echo @$_GET['plans_id']; ?>').val(),
114114
"description": $('#description<?php echo @$_GET['plans_id']; ?>').val(),
115115
"plans_id": "<?php echo @$_GET['plans_id']; ?>",
116-
"plugin": "<?php echo @$_REQUEST['plugin']; ?>",
116+
"plugin": <?php echo json_encode((string)($_REQUEST['plugin'] ?? '')); ?>,
117117
"user": "<?php echo User::getUserName() ?>",
118118
"pass": "<?php echo User::getUserPass(); ?>",
119119
"singlePayment": 1

0 commit comments

Comments
 (0)