← All changes | classes/core.php +31 -6 0.3.2 → 0.3.4 View file →

		@@ -83,14 +83,15 @@
83	83	return [
84	84	//Safemode
85	85	"safe_mode_status" => "on", // on, off, whitelist
86	86	"safe_mode_whitelist" => [],
	87	+ "disallow_block_php" => true, // Do not allow PHP code to be execute through Blocks "code" parameter
87	88
88	89	//LOGS
89	90	"server_debug_mode" => false,
90	91
91	92	//UI
92		- "ui_show_preview" => true,
	93	+ "ui_show_preview" => false,
93	94
94	95	//AI
95	96	"ai_suggestions" => false,
96	97	"ai_engine_status"=> false,
		@@ -580,11 +581,14 @@
580	581
581	582	$blocked = false;
582	583	$page = isset( $_GET["page"] ) ? sanitize_text_field( $_GET["page"] ) : null;
583	584
584		- // Block on settings page for safety
	585	+
585	586	if ( $page === 'mwcode_settings' ) {
586		- $blocked = true;
	587	+ // If we blocks global snippets like nonce_life filter, we would block the settings page so let's remove the block for this page
	588	+
	589	+ $blocked = false;
	590	+ //$blocked = true;
587	591	}
588	592	// Block REST requests that aren't whitelisted
589	593	elseif ( MeowCommon_Helpers::is_rest() && !Meow_MWCODE_Core::is_white_listed_rest() ) {
590	594	$blocked = true;
		@@ -648,13 +652,29 @@
648	652
649	653	$id = $atts['id'];
650	654	$target = $atts['target'];
651	655	$code = $atts['code'];
652		-
	656	+
	657	+ $no_js = defined( 'DISALLOW_UNFILTERED_HTML' ) && DISALLOW_UNFILTERED_HTML;
	658	+ $no_php = $this->get_option( 'disallow_block_php', true );
	659	+
653	660	// If the ID is null, it means it comes from a Guttenberg block
654	661	$is_block = empty( $id ) && !empty( $code );
655		- if( $is_block ){
656	662
	663	+ if( $is_block ) {
	664	+
	665	+ if( $target !== 'js' && $target !== 'php' ) {
	666	+ return '<b>Code Engine:</b> Please provide a valid target (js or php).';
	667	+ }
	668	+
	669	+ if ( $no_js && $target === 'js' ) {
	670	+ return '<b>Code Engine:</b> Code Block JS are disabled because unfiltered HTML is not allowed on your server.';
	671	+ }
	672	+
	673	+ if ( $no_php && $target === 'php' ) {
	674	+ return '<b>Code Engine:</b> Code Block PHP are disabled. If you are an administrator, you can enable it in the settings, this is not recommended. Please use a Content Snippet ( PHP ) instead.';
	675	+ }
	676	+
657	677	// Because the code from Blocks are sanitized, we need to replace the &quot; with "
658	678	$code = str_replace( '&quot;', '"', $code );
659	679
660	680	if ( $target === 'js' ) {
		@@ -667,8 +687,9 @@
667	687
668	688	return $output;
669	689	}
670	690
	691	+ // If not a block, we get the snippet by ID
671	692	// If the ID is not null, it means it comes from a shortcode
672	693	if ( empty( $id ) && empty( $code ) ) {
673	694	return '<b>Code Engine:</b> Please provide a snippet ID.';
674	695	}
		@@ -680,12 +701,16 @@
680	701	}
681	702
682	703	//Check if the snippet scope is either content_php or content_js
683	704	$is_content_php = $snippet['scope'] === 'content_php';
684		- $is_content_js = $snippet['scope'] === 'content_js';
	705	+ $is_content_js = $snippet['scope'] === 'content_js';
685	706
686	707	if ( !$is_content_php && !$is_content_js ) {
687	708	return '<b>Code Engine:</b> The snippet is not a content snippet.';
	709	+ }
	710	+
	711	+ if( $no_js && $is_content_js ) {
	712	+ return '<b>Code Engine:</b> Code Engine JS snippets are disabled because unfiltered HTML is not allowed on your server.';
688	713	}
689	714
690	715	//Check if the snippet is active
691	716	if ( !$snippet['active'] ) {