From bc41932bee657df1ddb12b2322327daaf935048e Mon Sep 17 00:00:00 2001
From: Tom J Nowell <contact@tomjn.com>
Date: Thu, 17 Aug 2017 18:00:18 +0100
Subject: [PATCH 1/3] fixes 4 unescaped variables embedded in 2 strings

---
 jw-player/include/media.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/jw-player/include/media.php b/jw-player/include/media.php
index 78b2787..b2e92ce 100644
--- a/jw-player/include/media.php
+++ b/jw-player/include/media.php
@@ -21,8 +21,8 @@ function jwplayer_media_sync_form_html( $media ) {
 		$html .= 'Disabling sync is currently not possible, because it would break your media embeds. ';
 		$html .= '</p>';
 	} else {
-		$html .= "<label for='attachments[$media->ID][jwplayer_media_sync]'>";
-		$html .= "<input type='checkbox' value='sync' name='attachments[$media->ID][jwplayer_media_sync]' />";
+		$html .= "<label for='".esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]').">'";
+		$html .= "<input type='checkbox' value='sync' name='".esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]' )."' />";
 		$html .= '&nbsp;&nbsp;Sync to JW Player';
 		$html .= '</label>';
 		$html .= '<p class="description">';

From 17f85d10fd1dc768aed56cb65e1f9e6f206a8b0a Mon Sep 17 00:00:00 2001
From: Tom J Nowell <contact@tomjn.com>
Date: Thu, 17 Aug 2017 18:04:10 +0100
Subject: [PATCH 2/3] swaps the quotes around and fixes a stray single quote

---
 jw-player/include/media.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/jw-player/include/media.php b/jw-player/include/media.php
index b2e92ce..90df9a5 100644
--- a/jw-player/include/media.php
+++ b/jw-player/include/media.php
@@ -21,8 +21,8 @@ function jwplayer_media_sync_form_html( $media ) {
 		$html .= 'Disabling sync is currently not possible, because it would break your media embeds. ';
 		$html .= '</p>';
 	} else {
-		$html .= "<label for='".esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]').">'";
-		$html .= "<input type='checkbox' value='sync' name='".esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]' )."' />";
+		$html .= '<label for="'.esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]').'">';
+		$html .= '<input type="checkbox" value="sync" name="'.esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]' ).' />';
 		$html .= '&nbsp;&nbsp;Sync to JW Player';
 		$html .= '</label>';
 		$html .= '<p class="description">';

From e7619cdf0203c3e183c31270e38b80cfd7883b7b Mon Sep 17 00:00:00 2001
From: Tom J Nowell <contact@tomjn.com>
Date: Thu, 17 Aug 2017 18:04:59 +0100
Subject: [PATCH 3/3] readds a missing closing quote

---
 jw-player/include/media.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jw-player/include/media.php b/jw-player/include/media.php
index 90df9a5..1b8689f 100644
--- a/jw-player/include/media.php
+++ b/jw-player/include/media.php
@@ -22,7 +22,7 @@ function jwplayer_media_sync_form_html( $media ) {
 		$html .= '</p>';
 	} else {
 		$html .= '<label for="'.esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]').'">';
-		$html .= '<input type="checkbox" value="sync" name="'.esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]' ).' />';
+		$html .= '<input type="checkbox" value="sync" name="'.esc_attr( 'attachments['.$media->ID.'][jwplayer_media_sync]' ).'" />';
 		$html .= '&nbsp;&nbsp;Sync to JW Player';
 		$html .= '</label>';
 		$html .= '<p class="description">';