Escaping iframe URL src.

10up · Aug 2, 2018 · a090d2d · a090d2d
1 parent c7b5b0a
commit a090d2d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/includes/class-bc-utility.php b/includes/class-bc-utility.php
@@ -1151,12 +1151,13 @@ class="video-js"
 			if ( ! empty( $mute ) ) {
 				$mute = '&' . $mute;
 			}
+			$iframesrc = 'https://players.brightcove.net/' . $account_id . '/' . $player_id . '_default/index.html?playlistId=' . $id . '&usage=' . self::get_usage_data() . 'iframe' . $autoplay . $mute;
 			?>
 
 			<div style="display: block; position: relative; min-width: <?php echo esc_attr( $min_width ); ?>; max-width: <?php echo esc_attr( $max_width ); ?>;">
 				<div style="padding-top: <?php echo esc_attr( $padding_top ); ?>; ">
 					<iframe
-							src="//players.brightcove.net/<?php echo esc_attr( $account_id ); ?>/<?php echo esc_attr( $player_id ); ?>_default/index.html?playlistId=<?php echo esc_attr( $id ); ?>&usage=<?php echo esc_attr( self::get_usage_data() ); ?>iframe<?php echo esc_attr( $autoplay ); ?><?php echo esc_attr( $mute ); ?>"
+							src="<?php echo esc_url( $iframesrc ); ?>"
 							allowfullscreen
 							webkitallowfullscreen
 							mozallowfullscreen