From 0bbd65ac61f009ea234ddf59baf5b10e507ca11d Mon Sep 17 00:00:00 2001
From: Sam Najian <sam.najian@automattic.com>
Date: Tue, 10 Jan 2023 10:47:05 +0100
Subject: [PATCH] Sanitize segment data when persisty via public API

[MAILPOET-4942]
---
 mailpoet/lib/API/MP/v1/Segments.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mailpoet/lib/API/MP/v1/Segments.php b/mailpoet/lib/API/MP/v1/Segments.php
index 7c32fecb85..f7ce734ea0 100644
--- a/mailpoet/lib/API/MP/v1/Segments.php
+++ b/mailpoet/lib/API/MP/v1/Segments.php
@@ -42,7 +42,9 @@ class Segments {
     $this->validateSegmentName($data);
 
     try {
-      $segment = $this->segmentsRepository->createOrUpdate($data['name'], $data['description'] ?? '');
+      $name = sanitize_text_field($data['name']);
+      $description = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
+      $segment = $this->segmentsRepository->createOrUpdate($name, $description);
     } catch (\Exception $e) {
       throw new APIException(
         __('The list couldn’t be created in the database', 'mailpoet'),