diff --git a/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php b/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php index 5a6edc8..2ebb813 100644 --- a/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php +++ b/plugins/story-blocks/shortcodes/ChapterBreakShortcode.php @@ -11,7 +11,7 @@ class ChapterBreakShortcode extends Shortcode $plugin = $this->grav['plugins']->getPlugin('story-blocks'); $page = $plugin ? $plugin->getCurrentPage() : null; - $imageName = $sc->getParameter('image', ''); + $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES); $title = htmlspecialchars($sc->getParameter('title', ''), ENT_QUOTES); $number = htmlspecialchars($sc->getParameter('number', ''), ENT_QUOTES); $alt = htmlspecialchars($sc->getParameter('alt', $title), ENT_QUOTES); diff --git a/plugins/story-blocks/shortcodes/PullQuoteShortcode.php b/plugins/story-blocks/shortcodes/PullQuoteShortcode.php index 4401f7d..78e5981 100644 --- a/plugins/story-blocks/shortcodes/PullQuoteShortcode.php +++ b/plugins/story-blocks/shortcodes/PullQuoteShortcode.php @@ -11,9 +11,9 @@ class PullQuoteShortcode extends Shortcode $plugin = $this->grav['plugins']->getPlugin('story-blocks'); $page = $plugin ? $plugin->getCurrentPage() : null; - $imageName = $sc->getParameter('image', ''); + $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES); $alt = htmlspecialchars($sc->getParameter('alt', ''), ENT_QUOTES); - $content = trim($sc->getContent()); + $content = trim($sc->getContent()); // ShortcodeCore renders inner Markdown to HTML; trusted author content $imageUrl = ($page && $imageName) ? $page->url() . '/' . $imageName : ''; $bgHtml = ''; diff --git a/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php b/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php index 077829e..736f47e 100644 --- a/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php +++ b/plugins/story-blocks/shortcodes/ScrollySectionShortcode.php @@ -11,10 +11,10 @@ class ScrollySectionShortcode extends Shortcode $plugin = $this->grav['plugins']->getPlugin('story-blocks'); $page = $plugin ? $plugin->getCurrentPage() : null; - $imageName = $sc->getParameter('image', ''); + $imageName = htmlspecialchars($sc->getParameter('image', ''), ENT_QUOTES); $alt = htmlspecialchars($sc->getParameter('alt', ''), ENT_QUOTES); $caption = htmlspecialchars($sc->getParameter('caption', ''), ENT_QUOTES); - $content = $sc->getContent(); /* raw inner content — Scrollama JS splits on