Use sanitize_text_field with wp_unslash

Automattic · Aug 26, 2023 · 61fef48 · 61fef48
1 parent 13e49c3
commit 61fef48
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/src/Internal/Payment/PaymentRequest.php b/src/Internal/Payment/PaymentRequest.php
@@ -35,7 +35,7 @@ public function __construct( array $request = null ) {
 	 */
 	public function get_fraud_prevention_token(): ?string {
 		return isset( $this->request['wcpay-fraud-prevention-token'] )
-			? sanitize_text_field( $this->request['wcpay-fraud-prevention-token'] )
+			? sanitize_text_field( wp_unslash( ( $this->request['wcpay-fraud-prevention-token'] ) ) )
 			: null;
 	}
 
@@ -55,7 +55,7 @@ public function is_woopay_preflight_check(): bool {
 	 */
 	public function get_woopay_intent_id(): ?string {
 		return isset( $this->request['platform-checkout-intent'] )
-			? sanitize_text_field( $this->request['platform-checkout-intent'] )
+			? sanitize_text_field( wp_unslash( ( $this->request['platform-checkout-intent'] ) ) )
 			: null;
 	}
 
@@ -75,7 +75,7 @@ public function get_order_id(): ?int {
 	 */
 	public function get_intent_id(): ?string {
 		return isset( $this->request['intent_id'] )
-			? sanitize_text_field( $this->request['intent_id'] )
+			? sanitize_text_field( wp_unslash( ( $this->request['intent_id'] ) ) )
 			: null;
 	}
 
@@ -86,7 +86,7 @@ public function get_intent_id(): ?string {
 	 */
 	public function get_payment_method_id(): ?string {
 		return isset( $this->request['payment_method_id'] )
-			? sanitize_text_field( $this->request['payment_method_id'] )
+			? sanitize_text_field( wp_unslash( ( $this->request['payment_method_id'] ) ) )
 			: null;
 	}
 }