Escape html entities before passing to WP/photoswipe

woocommerce · Feb 20, 2019 · ffa230d · ffa230d
1 parent 1caeb43
commit ffa230d
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/includes/wc-template-functions.php b/includes/wc-template-functions.php
@@ -1433,13 +1433,13 @@ function wc_get_gallery_image_html( $attachment_id, $main_image = false ) {
 		apply_filters(
 			'woocommerce_gallery_image_html_attachment_image_params',
 			array(
-				'title'                   => get_post_field( 'post_title', $attachment_id ),
-				'data-caption'            => get_post_field( 'post_excerpt', $attachment_id ),
-				'data-src'                => $full_src[0],
-				'data-large_image'        => $full_src[0],
-				'data-large_image_width'  => $full_src[1],
-				'data-large_image_height' => $full_src[2],
-				'class'                   => $main_image ? 'wp-post-image' : '',
+				'title'                   => _wp_specialchars( get_post_field( 'post_title', $attachment_id ), ENT_QUOTES, 'UTF-8', true ),
+				'data-caption'            => _wp_specialchars( get_post_field( 'post_excerpt', $attachment_id ), ENT_QUOTES, 'UTF-8', true ),
+				'data-src'                => esc_url( $full_src[0] ),
+				'data-large_image'        => esc_url( $full_src[0] ),
+				'data-large_image_width'  => esc_attr( $full_src[1] ),
+				'data-large_image_height' => esc_attr( $full_src[2] ),
+				'class'                   => esc_attr( $main_image ? 'wp-post-image' : '' ),
 			),
 			$attachment_id,
 			$image_size,