check if widget value correct to avoid injection

Author: emnbdx

admin/js/hello-asso-admin.js

@@ -132,6 +132,12 @@ function ha_shortcode($atts)
 			{
 				$height = preg_match($pattern, $atts['height'] ?? 0) ? $atts['height'] : "450px";
 				$styleIframe = 'style="width:350px; height:'. $height . '; border:none;"';
+			} else {
+				$type = "";
+			}
+
+			if(!str_starts_with($url, "https://www.helloasso.com/")) {
+				$url = "";
 			}
 
 			ob_start();