← All changes | includes/performance/script-gate.php +9 -1 2.12.0 → 2.13.1 View file →

		@@ -111,10 +111,18 @@
111	111	$extra .= sprintf( 'data-ablocks-type="%s" ', esc_attr( $found[1] ) );
112	112	$tag = preg_replace( '/\stype=["\'][^"\']*["\']/i', '', $tag, 1 );
113	113	}
114	114
	115	+ // `\b` rather than `\s`. Stripping the type above can leave the tag as
	116	+ // a bare `<script>` — that is the whole of a Meta Pixel snippet's
	117	+ // opening tag once `type='text/javascript'` is taken out — and a
	118	+ // pattern demanding whitespace after the name silently matches
	119	+ // nothing, returning the tag ungated with no error anywhere. A tag
	120	+ // that merely also carried an `id` was rewritten fine, which is why
	121	+ // this survived: it only ever missed the scripts whose sole attribute
	122	+ // was the type.
115	123	return preg_replace(
116		- '/^<script\s/',
	124	+ '/^<script\b/i',
117	125	sprintf( '<script type="%s" %s', esc_attr( $type ), $extra ),
118	126	$tag,
119	127	1
120	128	);