Check $error to be not empty before running htmlspecialchars.

google · Nov 1, 2022 · 94076fe · 94076fe
1 parent 1803281
commit 94076fe
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/includes/Modules/Analytics.php b/includes/Modules/Analytics.php
@@ -277,10 +277,10 @@ protected function handle_provisioning_callback() {
 		}
 
 		// Check for a returned error.
-		$error = htmlspecialchars( $input->filter( INPUT_GET, 'error' ) );
+		$error = $input->filter( INPUT_GET, 'error' );
 		if ( ! empty( $error ) ) {
 			wp_safe_redirect(
-				$this->context->admin_url( 'module-analytics', array( 'error_code' => $error ) )
+				$this->context->admin_url( 'module-analytics', array( 'error_code' => htmlspecialchars( $error ) ) )
 			);
 			exit;
 		}