Skip to content

Commit 3d193e1

Browse files
jissereitsmajissereitsma
committed
Add escaping
1 parent dbb34f0 commit 3d193e1

2 files changed

Lines changed: 31 additions & 24 deletions

File tree

‎view/frontend/templates/minicart.phtml‎

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,19 @@
11
<?php declare(strict_types=1);
22

3-
/** @version 0.0.4 */
4-
53
use Magento\Framework\View\Element\Template;
64

5+
/** @version 0.0.4 */
76
/** @var Template $block */
87
?>
98
<template x-if="hasCartItems">
109
<div id="minicart-content-wrapper">
1110
<div class="block-title">
1211
<strong>
13-
<span class="text"><?= __('My Cart') ?></span>
12+
<span class="text"><?= $escaper->escapeHtml(__('My Cart')) ?></span>
1413
<span
1514
class="qty"
1615
:class="qtyClass"
17-
title="<?= __('Items in Cart') ?>"
16+
title="<?= $escaper->escapeHtml(__('Items in Cart')) ?>"
1817
x-html="cart.summary_count">0</span>
1918
</strong>
2019
</div>
@@ -31,12 +30,12 @@ use Magento\Framework\View\Element\Template;
3130

3231
<div class="items-total">
3332
<span class="count" x-html="cart.summary_count">0</span>
34-
<span><?= __('Items in Cart') ?></span>
33+
<span><?= $escaper->escapeHtml(__('Items in Cart')) ?></span>
3534
</div>
3635

3736
<div class="subtotal">
3837
<span class="label">
39-
<span><?= __('Cart Subtotal') ?></span>
38+
<span><?= $escaper->escapeHtml(__('Cart Subtotal')) ?></span>
4039
</span>
4140

4241
<div class="amount price-container">
@@ -51,12 +50,17 @@ use Magento\Framework\View\Element\Template;
5150
<button id="top-cart-btn-checkout" type="button"
5251
class="action primary checkout"
5352
@click="proceedToCheckout"
54-
title="<?= __('Proceed to Checkout') ?>"><?= __('Proceed to Checkout') ?>
53+
title="<?= $escaper->escapeHtml(__('Proceed to Checkout')) ?>"
54+
>
55+
<?= $escaper->escapeHtml(__('Proceed to Checkout')) ?>
5556
</button>
5657
</div>
5758
</div>
5859

59-
<strong class="subtitle"><?= __('Recently added item(s)') ?></strong>
60+
<strong class="subtitle">
61+
<?= $escaper->escapeHtml(__('Recently added item(s)')) ?>
62+
</strong>
63+
6064
<div class="minicart-items-wrapper">
6165
<ol id="mini-cart" class="minicart-items">
6266
<template x-for="item in cart.items">
@@ -92,8 +96,9 @@ use Magento\Framework\View\Element\Template;
9296
</div>
9397

9498
<div class="details-qty qty">
95-
<label class="label"
96-
:for="'cart-item-' + item.item_id + '-qty'"><?= __('Qty') ?></label>
99+
<label class="label" :for="'cart-item-' + item.item_id + '-qty'">
100+
<?= $escaper->escapeHtml(__('Qty')) ?>
101+
</label>
97102
<input type="number" min="0" size="4"
98103
class="item-qty cart-item-qty"
99104
:id="'cart-item-' + item.item_id + '-qty'"
@@ -104,8 +109,8 @@ use Magento\Framework\View\Element\Template;
104109
<button class="update-cart-item"
105110
:data-cart-item="item.item_id"
106111
@click="updateCartItemQty"
107-
title="<?= __('Update') ?>">
108-
<span><?= __('Update') ?></span>
112+
title="<?= $escaper->escapeHtml(__('Update')) ?>">
113+
<span><?= $escaper->escapeHtml(__('Update')) ?></span>
109114
</button>
110115
</div>
111116
</div>
@@ -114,16 +119,18 @@ use Magento\Framework\View\Element\Template;
114119
<div class="primary">
115120
<a class="action edit"
116121
:href="item.configure_url"
117-
title="<?= __('Edit item') ?>">
118-
<span><?= __('Edit') ?></span>
122+
title="<?= $escaper->escapeHtml(__('Edit item')) ?>"
123+
>
124+
<span><?= $escaper->escapeHtml(__('Edit')) ?></span>
119125
</a>
120126
</div>
121127
<div class="secondary">
122128
<a @click="removeCartItem"
123129
class="action delete"
124130
:data-cart-item="item.item_id"
125-
title="<?= __('Remove item') ?>">
126-
<span><?= __('Remove') ?></span>
131+
title="<?= $escaper->escapeHtml(__('Remove item')) ?>"
132+
>
133+
<span><?= $escaper->escapeHtml(__('Remove')) ?></span>
127134
</a>
128135
</div>
129136
</div>
@@ -137,8 +144,8 @@ use Magento\Framework\View\Element\Template;
137144
<div class="actions">
138145
<div class="secondary">
139146
<a class="action viewcart"
140-
href="<?= $block->getUrl('checkout/cart') ?>">
141-
<span><?= __('View and Edit Cart') ?></span>
147+
href="<?= /* @noEscape */ $block->getUrl('checkout/cart') ?>">
148+
<span><?= $escaper->escapeHtml(__('View and Edit Cart')) ?></span>
142149
</a>
143150
</div>
144151
</div>
@@ -151,6 +158,6 @@ use Magento\Framework\View\Element\Template;
151158

152159
<template x-if="hasNoCartItems">
153160
<div>
154-
<?= __('Your cart is empty') ?>
161+
<?= $escaper->escapeHtml(__('Your cart is empty')) ?>
155162
</div>
156163
</template>

‎view/frontend/templates/script/components/minicart.phtml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ use Magento\Framework\View\Element\Template;
5454
minicartBlock.style.display = 'none';
5555
},
5656
proceedToCheckout() {
57-
window.location = '<?= $block->getUrl('checkout') ?>';
57+
window.location = '<?= /* @noEscape */ $block->getUrl('checkout') ?>';
5858
},
5959
updateCartItemQty(event) {
6060
const cartItemId = this.$el.getAttribute('data-cart-item');
@@ -67,7 +67,7 @@ use Magento\Framework\View\Element\Template;
6767
return;
6868
}
6969

70-
const ajaxUpdateUrl = '<?= $block->getUrl(
70+
const ajaxUpdateUrl = '<?= /* @noEscape */ $block->getUrl(
7171
'checkout/sidebar/updateItemQty'
7272
) ?>';
7373

@@ -88,7 +88,7 @@ use Magento\Framework\View\Element\Template;
8888
Alpine.store('LumaLocalStorage').refresh('cart');
8989
}
9090

91-
Alpine.store('LumaMessageStore').addNoticeMessage('<?= __('Updated quantity') ?>');
91+
Alpine.store('LumaMessageStore').addNoticeMessage('<?= $escaper->escapeHtml(__('Updated quantity')) ?>');
9292
});
9393
},
9494
hasCartItems() {
@@ -104,7 +104,7 @@ use Magento\Framework\View\Element\Template;
104104
removeCartItem(event) {
105105
const cartItemId = this.$el.getAttribute('data-cart-item');
106106

107-
const ajaxUpdateUrl = '<?= $block->getUrl(
107+
const ajaxUpdateUrl = '<?= /* @noEscape */ $block->getUrl(
108108
'checkout/sidebar/removeItem'
109109
) ?>';
110110

@@ -124,7 +124,7 @@ use Magento\Framework\View\Element\Template;
124124
Alpine.store('LumaLocalStorage').refresh('cart');
125125
}
126126

127-
Alpine.store('LumaMessageStore').addNoticeMessage('<?= __('Removed item') ?>');
127+
Alpine.store('LumaMessageStore').addNoticeMessage('<?= $escaper->escapeHtml(__('Removed item')) ?>');
128128
});
129129
}
130130
}));

0 commit comments

Comments
 (0)