Fix "All output should be run through an escaping function".

pronamic · Mar 26, 2024 · bb98644 · bb98644
1 parent b22a1d1
commit bb98644
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/src/PaymentAddOn.php b/src/PaymentAddOn.php
@@ -234,9 +234,11 @@ public function get_menu_icon() {
 
 		if ( ! \is_readable( $file ) ) {
 			throw new \Exception(
-				\sprintf(
-					'Could not read WordPress admin menu icon from file: %s.',
-					$file
+				\esc_html(
+					\sprintf(
+						'Could not read WordPress admin menu icon from file: %s.',
+						$file
+					) 
 				)
 			);
 		}
@@ -245,9 +247,11 @@ public function get_menu_icon() {
 
 		if ( false === $svg ) {
 			throw new \Exception(
-				\sprintf(
-					'Could not read WordPress admin menu icon from file: %s.',
-					$file
+				\esc_html(
+					\sprintf(
+						'Could not read WordPress admin menu icon from file: %s.',
+						$file
+					) 
 				)
 			);
 		}