Merge pull request #336 from Ecwid/dev

PLUGINS-7030

Author: meteor-ec

includes/gutenberg/class-ecwid-gutenberg-block-store.php

@@ -166,9 +166,9 @@ public function render_callback( $params ) {
 
 				if ( ! $is_profile_default ) {
 					if ( @$attribute['type'] == 'boolean' ) {
-						$config_js[] = 'window.ec.storefront.' . $name . '=' . ( $value === true ? 'true' : 'false' ) . ';';
+						$config_js[] = 'window.ec.storefront.' . esc_js( $name ) . '=' . ( $value === true ? 'true' : 'false' ) . ';';
 					} else {
-						$config_js[] = 'window.ec.storefront.' . $name . "='" . $value . "';";
+						$config_js[] = 'window.ec.storefront.' . esc_js( $name ) . "='" . esc_js( $value ) . "';";
 					}
 					$store_page_data[ $name ] = $value;
 				}
@@ -179,7 +179,7 @@ public function render_callback( $params ) {
 		foreach ( array( 'foreground', 'background', 'link', 'price', 'button' ) as $kind ) {
 			$color = ( isset( $params[ 'chameleon_color_' . $kind ] ) ) ? $params[ 'chameleon_color_' . $kind ] : false;
 			if ( $color ) {
-				$colors[ 'color-' . $kind ] = $color;
+				$colors[ 'color-' . esc_js( $kind ) ] = esc_js( $color );
 			}
 		}
 

includes/integrations/class-ecwid-integration-gutenberg.php

@@ -287,9 +287,9 @@ public function render_callback( $params ) {
 
 			if ( @$attribute['is_storefront_api'] ) {
 				if ( @$attribute['type'] == 'boolean' ) {
-					$result .= 'window.ec.storefront.' . $name . '=' . ( $value ? 'true' : 'false' ) . ';' . PHP_EOL;
+					$result .= 'window.ec.storefront.' . esc_js( $name ) . '=' . ( $value ? 'true' : 'false' ) . ';' . PHP_EOL;
 				} else {
-					$result .= 'window.ec.storefront.' . $name . "='" . $value . "';" . PHP_EOL;
+					$result .= 'window.ec.storefront.' . esc_js( $name ) . "='" . esc_js( $value ) . "';" . PHP_EOL;
 				}
 				$store_page_data[ $name ] = $value;
 			}
@@ -299,7 +299,7 @@ public function render_callback( $params ) {
 		foreach ( array( 'foreground', 'background', 'link', 'price', 'button' ) as $kind ) {
 			$color = @$params[ 'chameleon_color_' . $kind ];
 			if ( $color ) {
-				$colors[ 'color-' . $kind ] = $color;
+				$colors[ 'color-' . esc_js( $kind ) ] = esc_js( $color );
 			}
 		}