From 669eedd4639c206ad65cbdd312b1628c412ba090 Mon Sep 17 00:00:00 2001
From: Irshad Ahmad <irshad@wpsocio.com>
Date: Mon, 5 Aug 2024 21:04:16 +0530
Subject: [PATCH] Fix login shortcode attributes sanitization (#155)

---
 .changeset/khaki-lies-enjoy.md                       |  5 +++++
 .../src/shared/partials/login-view.php               | 12 ++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/khaki-lies-enjoy.md

diff --git a/.changeset/khaki-lies-enjoy.md b/.changeset/khaki-lies-enjoy.md
new file mode 100644
index 00000000..3c191ad4
--- /dev/null
+++ b/.changeset/khaki-lies-enjoy.md
@@ -0,0 +1,5 @@
+---
+"wptelegram-login": patch
+---
+
+Fixed login shortcode attributes sanitization
diff --git a/plugins/wptelegram-login/src/shared/partials/login-view.php b/plugins/wptelegram-login/src/shared/partials/login-view.php
index 1bbf5503..686cf443 100644
--- a/plugins/wptelegram-login/src/shared/partials/login-view.php
+++ b/plugins/wptelegram-login/src/shared/partials/login-view.php
@@ -42,8 +42,16 @@
 
 	$atts .= ' data-error-message="' . $error_message . '" onerror="(function(script){if(script.dataset.errorMessage){var doc=document,div=doc.createElement(\'div\'),span=doc.createElement(\'span\');span.appendChild(doc.createTextNode(script.dataset.errorMessage));div.setAttribute(\'class\', \'error-message\');div.appendChild(span);Object.assign(div.style,{overflow:\'scroll\',border:\'1px solid rgb(221, 221, 221)\',textAlign:\'center\',display:\'inline-block\',padding:\'5px\'});script.parentElement.appendChild(div);}})(this)"';
 }
-// phpcs:ignore WordPress.WP.EnqueuedResources
-$html = '<script async src="https://telegram.org/js/telegram-widget.js?6" data-telegram-login="' . $login_options['bot_username'] . '" data-size="' . $login_options['button_style'] . '" data-auth-url="' . $login_options['callback_url'] . '" data-request-access="write" ' . $atts . '></script>';
+
+$html = sprintf(
+	// phpcs:ignore WordPress.WP.EnqueuedResources
+	'<script async src="https://telegram.org/js/telegram-widget.js?%1$s" data-telegram-login="%2$s" data-size="%3$s" data-auth-url="%4$s" data-request-access="write" %5$s></script>',
+	esc_attr( WPTG_Login()->version() ),
+	esc_attr( $login_options['bot_username'] ),
+	esc_attr( ( $login_options['button_style'] ) ),
+	esc_url( $login_options['callback_url'] ),
+	$atts
+);
 ?>
 <div class="wptelegram-login-output-wrap container">
 	<?php echo $html; // phpcs:ignore WordPress.Security.EscapeOutput ?>