From 0eb5af3f26a15a61571b4dbb765bb358fb7326c1 Mon Sep 17 00:00:00 2001
From: Dillyn Barber <dillyn@caveconsulting.com>
Date: Tue, 17 Jan 2023 09:44:40 -0600
Subject: [PATCH] Update cptbc-frontend.php

Fix stored XSS vulnerability in 1.12
---
 src/cptbc-frontend.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cptbc-frontend.php b/src/cptbc-frontend.php
index e05e841..0049a99 100644
--- a/src/cptbc-frontend.php
+++ b/src/cptbc-frontend.php
@@ -98,7 +98,7 @@ function cptbc_frontend($atts){
     if(count($images) > 0){
         ob_start();
         ?>
-        <div id="cptbc_<?php echo $id; ?>" class="carousel slide<?php if($atts['use_carousel_fade'] == '1'){ echo ' carousel-fade'; } ?>" <?php if($atts['use_javascript_animation'] == '0'){ echo ' data-ride="carousel"'; } ?> data-interval="<?php echo $atts['interval']; ?>">
+        <div id="cptbc_<?php echo $id; ?>" class="carousel slide<?php if($atts['use_carousel_fade'] == '1'){ echo ' carousel-fade'; } ?>" <?php if($atts['use_javascript_animation'] == '0'){ echo ' data-ride="carousel"'; } ?> data-interval="<?php echo htmlspecialchars($atts['interval']); ?>">
 
             <?php
             if( $atts['showindicators'] === 'true' ) {
@@ -234,7 +234,7 @@ function cptbc_frontend($atts){
         <script type="text/javascript">
             jQuery(document).ready(function() {
                 jQuery('#cptbc_<?php echo $id; ?>').carousel({
-                    interval: <?php echo $atts['interval']; ?>
+                    interval: <?php echo htmlspecialchars($atts['interval']); ?>
                 });
             });
         </script>