acf-field-group
5 months ago
acf-post-type
5 months ago
acf-taxonomy
6 months ago
global
6 months ago
tools
6 months ago
upgrade
6 months ago
browse-fields-modal.php
6 months ago
email-opt-in-banner.php
1 month ago
escaped-html-notice.php
6 months ago
index.php
2 years ago
options-page-preview.php
6 months ago
escaped-html-notice.php
78 lines
| 1 | <?php |
| 2 | /** |
| 3 | * @package ACF |
| 4 | * @author WP Engine |
| 5 | * |
| 6 | * © 2026 Advanced Custom Fields (ACF®). All rights reserved. |
| 7 | * "ACF" is a trademark of WP Engine. |
| 8 | * Licensed under the GNU General Public License v2 or later. |
| 9 | * https://www.gnu.org/licenses/gpl-2.0.html |
| 10 | */ |
| 11 | |
| 12 | $acf_plugin_name = acf_is_pro() ? 'ACF PRO' : 'ACF'; |
| 13 | $acf_plugin_name = '<strong>' . $acf_plugin_name . ' —</strong>'; |
| 14 | $acf_learn_how_to_fix = '<a href="' . acf_add_url_utm_tags( 'https://www.advancedcustomfields.com/escaping-the-field/', 'docs', '6-2-5-security-changes' ) . '" target="_blank">' . __( 'Learn more', 'acf' ) . '</a>'; |
| 15 | $acf_class = 'notice-error'; |
| 16 | $acf_user_can_acf = false; |
| 17 | |
| 18 | if ( current_user_can( acf_get_setting( 'capability' ) ) ) { |
| 19 | $acf_user_can_acf = true; |
| 20 | $acf_dismiss_url = add_query_arg( array( 'acf-dismiss-esc-html-notice' => wp_create_nonce( 'acf/dismiss_escaped_html_notice' ) ) ); |
| 21 | |
| 22 | // "Show/Hide Details" is a button for accessibility purposes, because it isn't a link. But since the design shows a link, we need to make it look like a link. |
| 23 | $acf_style_button_as_link = trim( |
| 24 | 'display: inline; |
| 25 | padding: 0; |
| 26 | background: none; |
| 27 | border: none; |
| 28 | color: #0073aa; |
| 29 | text-decoration: underline; |
| 30 | cursor: pointer;' |
| 31 | ); |
| 32 | |
| 33 | $acf_show_details = '<button style="' . esc_attr( $acf_style_button_as_link ) . '" class="acf-show-more-details">' . __( 'Show details', 'acf' ) . '</button>'; |
| 34 | $acf_show_details .= ' | <a class="acf-dismiss-permanently-button" href="' . esc_url( $acf_dismiss_url ) . '">' . __( 'Dismiss permanently', 'acf' ) . '</a>'; |
| 35 | } else { |
| 36 | $acf_show_details = __( 'Please contact your site administrator or developer for more details.', 'acf' ); |
| 37 | } |
| 38 | |
| 39 | $acf_error_msg = sprintf( |
| 40 | /* translators: %1$s - name of the ACF plugin. %2$s - Link to documentation. */ |
| 41 | __( '%1$s ACF now automatically escapes unsafe HTML when rendered by <code>the_field</code> or the ACF shortcode. We\'ve detected the output of some of your fields has been modified by this change, but this may not be a breaking change. %2$s.', 'acf' ), |
| 42 | $acf_plugin_name, |
| 43 | $acf_learn_how_to_fix |
| 44 | ); |
| 45 | |
| 46 | |
| 47 | ?> |
| 48 | <div class="acf-admin-notice notice acf-escaped-html-notice <?php echo esc_attr( $acf_class ); ?>"> |
| 49 | <p style="margin-bottom: 0.5em; padding-bottom: 2px;"><?php echo acf_esc_html( $acf_error_msg ); ?></p> |
| 50 | <p style="margin: 0.5em 0; padding: 2px;"><?php echo acf_esc_html( $acf_show_details ); ?></p> |
| 51 | <?php if ( $acf_user_can_acf && ! empty( $acf_escaped ) ) : ?> |
| 52 | <div class="acf-error-details" style="display: none; list-style: disc; margin-left: 14px;"> |
| 53 | <ul class="acf-error-details" style="display: none; list-style: disc; margin-left: 14px;"> |
| 54 | <?php |
| 55 | foreach ( $acf_escaped as $acf_field_key => $acf_data ) { |
| 56 | $acf_error = sprintf( |
| 57 | /* translators: %1$s - The selector used %2$s The field name 3%$s The parent function name */ |
| 58 | __( '%1$s (%2$s) - rendered via %3$s', 'acf' ), |
| 59 | $acf_data['selector'], |
| 60 | $acf_data['field'], |
| 61 | $acf_data['function'] |
| 62 | ); |
| 63 | |
| 64 | echo '<li>' . esc_html( $acf_error ) . '</li>'; |
| 65 | } |
| 66 | ?> |
| 67 | </ul> |
| 68 | <p style="margin: 0.5em 0; padding: 2px;"> |
| 69 | <?php |
| 70 | $acf_clear_logs_url = add_query_arg( array( 'acf-clear-esc-html-log' => wp_create_nonce( 'acf/clear_escaped_html_log' ) ) ); |
| 71 | // translators: %s - The clear log button opening HTML tag. %s - The closing HTML tag. |
| 72 | echo acf_esc_html( '<i>' . sprintf( __( 'This data is logged as we detect values that have been changed during output. %1$sClear log and dismiss%2$s after escaping the values in your code. The notice will reappear if we detect changed values again.', 'acf' ), '<a class="acf-clear-log-button" href="' . esc_url( $acf_clear_logs_url ) . '">', '</a>' ) . '</i>' ); |
| 73 | ?> |
| 74 | </p> |
| 75 | </div> |
| 76 | <?php endif; ?> |
| 77 | </div> |
| 78 |