← All changes | back/Helpers/global/security.php +7 -6 11.0.1 → 11.1.0 View file →

		@@ -15,9 +15,9 @@
15	15	if (!preg_match('#[&<>"\']#', $text)) {
16	16	return $text;
17	17	}
18	18
19		- return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
	19	+ return htmlspecialchars($text, ENT_QUOTES, 'UTF-8', false);
20	20	}
21	21
22	22	/**
23	23	* To secure text echoed in HTML content
		@@ -131,19 +131,20 @@
131	131	$url = str_replace("'", '&#039;', $url);
132	132
133	133	if (strpos($url, '[') !== false || strpos($url, ']') !== false) {
134	134	$to_unset = [];
	135	+ $urlToParse = $url;
135	136
136	137	if (strpos($url, '//') === 0) {
137	138	$to_unset[] = 'scheme';
138		- $url = 'placeholder:'.$url;
	139	+ $urlToParse = 'placeholder:'.$url;
139	140	} elseif (strpos($url, '/') === 0) {
140	141	$to_unset[] = 'scheme';
141	142	$to_unset[] = 'host';
142		- $url = 'placeholder://placeholder'.$url;
	143	+ $urlToParse = 'placeholder://placeholder'.$url;
143	144	}
144	145
145		- $parsed = acym_parseUrl($url);
	146	+ $parsed = acym_parseUrl($urlToParse);
146	147
147	148	if (!empty($parsed)) {
148	149	foreach ($to_unset as $key) {
149	150	unset($parsed[$key]);
		@@ -307,11 +308,11 @@
307	308	}
308	309
309	310	function acym_displayErrors(): void
310	311	{
311		- // phpcs:ignore WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting -- intended error printing on export and debug mode.
	312	+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting,PluginCheck.CodeAnalysis.PHPErrorReporting.DirectErrorReportingCall -- intended error printing on export and debug mode.
312	313	error_reporting(E_ALL);
313		- // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Error display is toggled intentionally for debugging purposes.
	314	+ // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged,PluginCheck.CodeAnalysis.PHPErrorReporting.IniDirectiveDisplay_errors -- Error display is toggled intentionally for debugging purposes.
314	315	@ini_set('display_errors', 1);
315	316	}
316	317
317	318	function acym_checkRobots(): void