use wp_kses to allow safe HTML in post meta and byline

NicktheGeek · Dec 21, 2017 · 9bcddbc · 9bcddbc
1 parent 5b61c3d
commit 9bcddbc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/inc/classes/class-genesis-featured-widget-amplified.php b/inc/classes/class-genesis-featured-widget-amplified.php
@@ -1152,7 +1152,7 @@ function gfwa_do_post_title( $instance ) {
  */
 function gfwa_do_byline( $instance ) {
 	if ( ! empty( $instance['show_byline'] ) && ! empty( $instance['post_info'] ) ) {
-		printf( '<p class="byline post-info">%s</p>', do_shortcode( esc_html( $instance['post_info'] ) ) );
+		printf( '<p class="byline post-info">%s</p>', do_shortcode( wp_kses_post( $instance['post_info'] ) ) );
 	}
 }
 
@@ -1193,7 +1193,7 @@ function gfwa_do_post_content( $instance ) {
  */
 function gfwa_do_post_meta( $instance ) {
 	if ( ! empty( $instance['show_archive_line'] ) && ! empty( $instance['post_meta'] ) ) {
-		printf( '<p class="post-meta">%s</p>', do_shortcode( esc_html( $instance['post_meta'] ) ) );
+		printf( '<p class="post-meta">%s</p>', do_shortcode( wp_kses_post( $instance['post_meta'] ) ) );
 	}
 }