fix: improved attribute handling

Automattic · Apr 23, 2024 · b53415a · b53415a
1 parent a89bfe0
commit b53415a
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/includes/class-newspack-popups-inserter.php b/includes/class-newspack-popups-inserter.php
@@ -721,11 +721,18 @@ public static function enqueue_scripts() {
 	 * @return HTML
 	 */
 	public static function popup_shortcode( $atts = array() ) {
+		$default_atts = [
+			'id'    => 0,
+			'class' => '',
+		];
+		$atts = \shortcode_atts( $default_atts, $atts, 'newspack-popup' );
+
+		$found_popup = false;
 		if ( Newspack_Popups::preset_popup_id() ) {
 			$found_popup = Newspack_Popups_Presets::retrieve_preset_popup( Newspack_Popups::preset_popup_id() );
-		} elseif ( isset( $atts['id'] ) ) {
+		} elseif ( ! empty( $atts['id'] ) && is_numeric( $atts['id'] ) ) {
 			$include_unpublished = Newspack_Popups::is_preview_request();
-			$found_popup         = Newspack_Popups_Model::retrieve_popup_by_id( $atts['id'], $include_unpublished );
+			$found_popup         = Newspack_Popups_Model::retrieve_popup_by_id( (int) $atts['id'], $include_unpublished );
 		}
 		if ( ! $found_popup ) {
 			return;
@@ -742,7 +749,7 @@ public static function popup_shortcode( $atts = array() ) {
 
 		$class_names = '';
 		if ( ! empty( $atts['class'] ) ) {
-			$class_names .= ' class="' . $atts['class'] . '"';
+			$class_names = sprintf( ' class="%s"', \esc_attr( $atts['class'] ) );
 		}
 
 		// Wrapping the inline popup in an aside element prevents the markup from being mangled