| 1 |
<?php |
| 2 |
|
| 3 |
namespace BitCode\BitForm\Core\Util; |
| 4 |
|
| 5 |
if (!defined('ABSPATH')) { |
| 6 |
exit; |
| 7 |
} |
| 8 |
|
| 9 |
/** |
| 10 |
* Helper for escaping output with configurable allowed HTML tags. |
| 11 |
*/ |
| 12 |
final class EscapingHelper |
| 13 |
{ |
| 14 |
/** |
| 15 |
* Returns the default allowed HTML tags for form/shortcode output. |
| 16 |
* Filterable via 'bitforms_allowed_html_tags'. |
| 17 |
* |
| 18 |
* @return array<string, array<string, bool>> wp_kses-compatible allowed tags and attributes |
| 19 |
*/ |
| 20 |
public static function getAllowedHtmlTags() |
| 21 |
{ |
| 22 |
$default = wp_kses_allowed_html('post'); |
| 23 |
$default['script'] = array_fill_keys(['type', 'src', 'id', 'async', 'defer'], true); |
| 24 |
$default['style'] = array_fill_keys(['type', 'id'], true); |
| 25 |
$allowed = apply_filters('bitforms_allowed_html_tags', $default); |
| 26 |
return is_array($allowed) ? $allowed : $default; |
| 27 |
} |
| 28 |
|
| 29 |
/** |
| 30 |
* Sanitizes HTML for form/shortcode output using the filterable allowed tags list. |
| 31 |
* |
| 32 |
* @param string $html Raw HTML to sanitize |
| 33 |
* @return string Sanitized HTML |
| 34 |
*/ |
| 35 |
public static function ksesFormOutput($html) |
| 36 |
{ |
| 37 |
return wp_kses($html, self::getAllowedHtmlTags()); |
| 38 |
} |
| 39 |
} |
| 40 |
|
