peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: escape get_search_query() output to prevent XSS in search forms

Browse Source 
Wrapped get_search_query() with esc_attr() in 404.php, front-page.php,
and searchform.php. Without this, a crafted search query can inject
arbitrary HTML attributes into the search input value field.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-12 16:22:48 +07:00
parent 71ba09e18c
commit 4b04b22161
3 changed files with 148 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
404.php
View File

@@ -17,7 +17,7 @@ get_header();
<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>"> <form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
<label> <label>
<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span> <span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo get_search_query(); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" /> <input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo esc_attr( get_search_query() ); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
</label> </label>
</form> </form>

2
front-page.php
View File

@@ -28,7 +28,7 @@ get_header();
name="s" name="s"
class="ps-search-input" class="ps-search-input"
placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>" placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
value="<?php echo get_search_query(); ?>" value="<?php echo esc_attr( get_search_query() ); ?>"
> >
</form> </form>
<?php <?php

2
searchform.php
View File

@@ -15,7 +15,7 @@
name="s" name="s"
class="ps-search-input" class="ps-search-input"
placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>" placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
value="<?php echo get_search_query(); ?>" value="<?php echo esc_attr( get_search_query() ); ?>"
> >
<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;"> <button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg"> <svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">