| 1 |
<?php |
| 2 |
/** |
| 3 |
* Starter-image URL resolution. |
| 4 |
* |
| 5 |
* @package Booking Calendar |
| 6 |
* @since 11.6.0 |
| 7 |
*/ |
| 8 |
|
| 9 |
if ( ! defined( 'ABSPATH' ) ) { |
| 10 |
exit; |
| 11 |
} |
| 12 |
|
| 13 |
/** |
| 14 |
* Resolve a bundled starter image from the configured local or remote source. |
| 15 |
* |
| 16 |
* The relative path is allow-listed to the plugin assets hierarchy. Absolute |
| 17 |
* paths, parent traversal, query strings, and fragments are rejected so the |
| 18 |
* helper cannot become an arbitrary URL proxy. Local URLs retain their plugin |
| 19 |
* subdirectory; the remote source uses the filename in its flat asset folder. |
| 20 |
* |
| 21 |
* @param string $relative_path Path below the plugin `assets` directory. |
| 22 |
* |
| 23 |
* @return string Sanitized image URL, or an empty string for an invalid path. |
| 24 |
*/ |
| 25 |
function wpbc_get_starter_asset_url( $relative_path ) { |
| 26 |
$relative_path = str_replace( '\\', '/', trim( (string) $relative_path ) ); |
| 27 |
$relative_path = ltrim( $relative_path, '/' ); |
| 28 |
|
| 29 |
if ( |
| 30 |
'' === $relative_path |
| 31 |
|| false !== strpos( $relative_path, '..' ) |
| 32 |
|| false !== strpos( $relative_path, '?' ) |
| 33 |
|| false !== strpos( $relative_path, '#' ) |
| 34 |
|| 1 !== preg_match( '#^[a-zA-Z0-9_./-]+$#', $relative_path ) |
| 35 |
) { |
| 36 |
return ''; |
| 37 |
} |
| 38 |
|
| 39 |
$is_remote_source = defined( 'WPBC_STARTER_ASSETS_SOURCE' ) |
| 40 |
&& 'remote' === strtolower( (string) WPBC_STARTER_ASSETS_SOURCE ); |
| 41 |
$assets_base_url = $is_remote_source |
| 42 |
? 'https://wpbookingcalendar.com/assets/plugin/assets/' |
| 43 |
: trailingslashit( WPBC_PLUGIN_URL ) . 'assets/'; |
| 44 |
// $asset_path = $is_remote_source ? wp_basename( $relative_path ) : $relative_path; |
| 45 |
$asset_path = $relative_path; |
| 46 |
|
| 47 |
return esc_url_raw( $assets_base_url . $asset_path ); |
| 48 |
} |
| 49 |
|
