Fix login shortcode attributes sanitization (#155)

.changeset/khaki-lies-enjoy.md

@@ -0,0 +1,5 @@
+---
+"wptelegram-login": patch
+---
+
+Fixed login shortcode attributes sanitization

plugins/wptelegram-login/src/shared/partials/login-view.php

@@ -42,8 +42,16 @@
 
 	$atts .= ' data-error-message="' . $error_message . '" onerror="(function(script){if(script.dataset.errorMessage){var doc=document,div=doc.createElement(\'div\'),span=doc.createElement(\'span\');span.appendChild(doc.createTextNode(script.dataset.errorMessage));div.setAttribute(\'class\', \'error-message\');div.appendChild(span);Object.assign(div.style,{overflow:\'scroll\',border:\'1px solid rgb(221, 221, 221)\',textAlign:\'center\',display:\'inline-block\',padding:\'5px\'});script.parentElement.appendChild(div);}})(this)"';
 }
-// phpcs:ignore WordPress.WP.EnqueuedResources
-$html = '<script async src="https://telegram.org/js/telegram-widget.js?6" data-telegram-login="' . $login_options['bot_username'] . '" data-size="' . $login_options['button_style'] . '" data-auth-url="' . $login_options['callback_url'] . '" data-request-access="write" ' . $atts . '></script>';
+
+$html = sprintf(
+	// phpcs:ignore WordPress.WP.EnqueuedResources
+	'<script async src="https://telegram.org/js/telegram-widget.js?%1$s" data-telegram-login="%2$s" data-size="%3$s" data-auth-url="%4$s" data-request-access="write" %5$s></script>',
+	esc_attr( WPTG_Login()->version() ),
+	esc_attr( $login_options['bot_username'] ),
+	esc_attr( ( $login_options['button_style'] ) ),
+	esc_url( $login_options['callback_url'] ),
+	$atts
+);
 ?>
 <div class="wptelegram-login-output-wrap container">
 	<?php echo $html; // phpcs:ignore WordPress.Security.EscapeOutput ?>