class-shortcodes.php — Advanced Ads – Ad Manager & AdSense trunk

advanced-ads / includes / class-shortcodes.php

advanced-ads / includes Last commit date

class-shortcodes.php

226 lines

1	<?php
2	/**
3	* Shortcodes.
4	*
5	* @package AdvancedAds
6	* @author Advanced Ads <info@wpadvancedads.com>
7	* @since 1.50.0
8	*/
9
10	namespace AdvancedAds;
11
12	use AdvancedAds\Framework\Interfaces\Integration_Interface;
13
14	defined( 'ABSPATH' ) \|\| exit;
15
16	/**
17	* Shortcodes.
18	*/
19	class Shortcodes implements Integration_Interface {
20
21	/**
22	* Hook into WordPress.
23	*
24	* @return void
25	*/
26	public function hooks(): void {
27	add_shortcode( 'the_ad', [ $this, 'render_ad' ] );
28	add_shortcode( 'the_ad_group', [ $this, 'render_group' ] );
29	add_shortcode( 'the_ad_placement', [ $this, 'render_placement' ] );
30	}
31
32	/**
33	* Renders an ad based on the provided attributes.
34	*
35	* @param array<string, mixed> $atts The attributes for the ad.
36	*
37	* @return string The rendered ad.
38	*/
39	public function render_ad( $atts ): string {
40	$ad = wp_advads_get_ad( absint( $atts['id'] ?? 0 ) );
41	// Early bail!!
42	if ( ! $ad ) {
43	return '';
44	}
45
46	$atts = is_array( $atts ) ? $atts : [];
47
48	// Check if there is an inline attribute with or without value.
49	if ( isset( $atts['inline'] ) \|\| in_array( 'inline', $atts, true ) ) {
50	$atts['inline_wrapper_element'] = true;
51	}
52
53	$atts = $this->prepare_shortcode_atts( $atts );
54
55	$this->set_shortcode_atts( $ad, $atts );
56
57	return get_the_ad( $ad, '', $atts );
58	}
59
60	/**
61	* Renders a group based on the provided attributes.
62	*
63	* @param array<string, mixed> $atts The attributes for the group.
64	*
65	* @return string The rendered group.
66	*/
67	public function render_group( $atts ): string {
68	$group = wp_advads_get_group( absint( $atts['id'] ?? 0 ) );
69	// Early bail!!
70	if ( ! $group ) {
71	return '';
72	}
73
74	$atts = is_array( $atts ) ? $atts : [];
75	$atts = $this->prepare_shortcode_atts( $atts );
76
77	$this->set_shortcode_atts( $group, $atts );
78
79	return get_the_group( $group, '', $atts );
80	}
81
82	/**
83	* Renders a placement based on the provided attributes.
84	*
85	* @param array<string, mixed> $atts The attributes for the placement.
86	*
87	* @return string The rendered placement.
88	*/
89	public function render_placement( $atts ): string {
90	$placement = wp_advads_get_placement( (string) ( $atts['id'] ?? '' ) );
91	// Early bail!!
92	if ( ! $placement ) {
93	return '';
94	}
95
96	$atts = is_array( $atts ) ? $atts : [];
97	$atts = $this->prepare_shortcode_atts( $atts );
98
99	$this->set_shortcode_atts( $placement, $atts );
100
101	return get_the_placement( $placement, '', $atts );
102	}
103
104	/**
105	* Prepare shortcode attributes.
106	*
107	* @param array<string, mixed> $atts array with strings.
108	*
109	* @return array<string, mixed>
110	*/
111	private function prepare_shortcode_atts( $atts ): array {
112	$result = [];
113
114	/**
115	* Prepare attributes by converting strings to multi-dimensional array
116	* Example: [ 'output__margin__top' => 1 ] => ['output']['margin']['top'] = 1
117	*/
118	if ( ! defined( 'ADVANCED_ADS_DISABLE_CHANGE' ) \|\| ! ADVANCED_ADS_DISABLE_CHANGE ) {
119	foreach ( $atts as $attr => $data ) {
120	// Remove the prefix (change-ad__, change-group__, change-placement__).
121	$attr = preg_replace( '/^(change-ad\|change-group\|change-placement)__/', '', $attr );
122	$levels = explode( '__', $attr );
123	$last = array_pop( $levels );
124
125	$cur_lvl = &$result;
126
127	foreach ( $levels as $lvl ) {
128	if ( ! isset( $cur_lvl[ $lvl ] ) ) {
129	$cur_lvl[ $lvl ] = [];
130	}
131
132	$cur_lvl = &$cur_lvl[ $lvl ];
133	}
134
135	$cur_lvl[ $last ] = $data;
136	}
137
138	$result = array_diff_key(
139	$result,
140	[
141	'id' => false,
142	'blog_id' => false,
143	'ad_args' => false,
144	]
145	);
146	}
147
148	// Ad type: 'content' and a shortcode inside.
149	if ( isset( $atts['ad_args'] ) ) {
150	$result = array_merge( $result, $this->parse_shortcode_ad_args( $atts['ad_args'] ) );
151	}
152
153	// Flat output array for Ad.
154	if ( isset( $result['output'] ) && is_array( $result['output'] ) ) {
155	$result = array_merge( $result, $result['output'] );
156	unset( $result['output'] );
157	}
158
159	// Special cases.
160	if ( isset( $result['tracking']['link'] ) ) {
161	$result['url'] = $result['tracking']['link'];
162	unset( $result['tracking']['link'] );
163	}
164
165	if ( isset( $result['content'] ) && is_string( $result['content'] ) ) {
166	$result['content'] = $this->sanitize_shortcode_content( $result['content'] );
167	}
168
169	if ( isset( $result['override'] ) && is_string( $result['override'] ) ) {
170	$result['override'] = $this->sanitize_shortcode_content( $result['override'] );
171	}
172
173	return $result;
174	}
175
176	/**
177	* Sanitize shortcode content by stripping PHP payloads and running wp_kses_post().
178	*
179	* @param string $content Content override from shortcode attributes (ad_args, change-ad__, etc.).
180	*
181	* @return string
182	*/
183	private function sanitize_shortcode_content( string $content ): string {
184	do {
185	$before = $content;
186	$content = preg_replace( '/<\\?(?:php\|=)?[\\s\\S]*?(?:\\x3F\\x3E\|$)/i', '', $content );
187	} while ( $content !== $before );
188
189	$content = str_replace( '<?', '', (string) $content );
190
191	return '' !== $content ? wp_kses_post( $content ) : '';
192	}
193
194	/**
195	* Parse ad_args payload for shortcode rendering.
196	*
197	* @param string $ad_args Raw urlencoded ad_args value.
198	*
199	* @return array<string, mixed>
200	*/
201	private function parse_shortcode_ad_args( string $ad_args ): array {
202	$decoded_ad_args = json_decode( urldecode( $ad_args ), true );
203
204	return is_array( $decoded_ad_args ) ? $decoded_ad_args : [];
205	}
206
207	/**
208	* Set shortcode attributes.
209	*
210	* @param object $entity The entity object.
211	* @param array<string, mixed> $atts The attributes to set for the entity.
212	*
213	* @return void
214	*/
215	private function set_shortcode_atts( $entity, $atts ): void {
216	foreach ( $atts as $key => $value ) {
217	$entity->set_prop_temp( $key, $value );
218	}
219
220	// WP Security: disable PHP for shortcode renders. prevents unauthorized PHP execution.
221	if ( isset( $atts['allow_php'] ) ) {
222	$entity->set_prop_temp( 'allow_php', false );
223	}
224	}
225	}
226