← All changes | views/template-parts/category-list.php +22 -2 4.4.0 → 4.9.3 View file →

		@@ -1,6 +1,11 @@
1	1	<?php
2		- use WPDeveloper\BetterDocs\Utils\Helper;
	2	+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- view template receives variables via extract(); prefixing is impractical.
	3	+
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
	7	+use WPDeveloper\BetterDocs\Utils\Helper;
3	8
4	9	$posts = betterdocs()->query->get_posts( $query_args, true );
5	10
6	11	if ( ! $posts->have_posts() ) {
		@@ -114,9 +119,24 @@
114	119
115	120	echo wp_sprintf(
116	121	'<li>%4$s<a %1$s><span>%2$s</span> %3$s</a></li>',
117	122	$_link_attributes, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
118		- betterdocs()->template_helper->kses( get_the_title() ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	123	+ /**
	124	+ * Filter a doc item's title markup in category/sidebar doc
	125	+ * lists (e.g. to prepend an API method badge). Deliberately
	126	+ * NOT core `the_title` — this must stay scoped to list items.
	127	+ *
	128	+ * SECURITY CONTRACT: the return value is echoed as HTML and
	129	+ * is NOT escaped afterwards — it has to be, or a callback
	130	+ * could not add the markup this filter exists for. The value
	131	+ * passed in is already kses'd; a callback that wraps or
	132	+ * appends to it is responsible for escaping whatever IT
	133	+ * introduces. Never hand this filter unsanitised user input.
	134	+ *
	135	+ * @param string $title_html Kses'd title markup.
	136	+ * @param int $post_id
	137	+ */
	138	+ apply_filters( 'betterdocs_docs_list_item_title', betterdocs()->template_helper->kses( get_the_title() ), get_the_ID() ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
119	139	( $show_icon && 'right' == $pos ) ? betterdocs()->template_helper->icon( $icon ) : '', // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
120	140	( $show_icon && 'left' == $pos ) ? betterdocs()->template_helper->icon( $icon ) : '' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
121	141	);
122	142	endwhile;