← All changes | classes/core.php +42 -6 0.3.2 → 0.3.6 View file →

		@@ -83,14 +83,17 @@
83	83	return [
84	84	//Safemode
85	85	"safe_mode_status" => "on", // on, off, whitelist
86	86	"safe_mode_whitelist" => [],
	87	+ //"disallow_block_php" => true, // Do not allow PHP code to be execute through Blocks "code" parameter
	88	+ "code_blocks" => false,
	89	+ "code_blocks_whitelist" => [], // Whitelist for code blocks, if empty, all code blocks are allowed
87	90
88	91	//LOGS
89	92	"server_debug_mode" => false,
90	93
91	94	//UI
92		- "ui_show_preview" => true,
	95	+ "ui_show_preview" => false,
93	96
94	97	//AI
95	98	"ai_suggestions" => false,
96	99	"ai_engine_status"=> false,
		@@ -580,11 +583,14 @@
580	583
581	584	$blocked = false;
582	585	$page = isset( $_GET["page"] ) ? sanitize_text_field( $_GET["page"] ) : null;
583	586
584		- // Block on settings page for safety
	587	+
585	588	if ( $page === 'mwcode_settings' ) {
586		- $blocked = true;
	589	+ // If we blocks global snippets like nonce_life filter, we would block the settings page so let's remove the block for this page
	590	+
	591	+ $blocked = false;
	592	+ //$blocked = true;
587	593	}
588	594	// Block REST requests that aren't whitelisted
589	595	elseif ( MeowCommon_Helpers::is_rest() && !Meow_MWCODE_Core::is_white_listed_rest() ) {
590	596	$blocked = true;
		@@ -648,13 +654,38 @@
648	654
649	655	$id = $atts['id'];
650	656	$target = $atts['target'];
651	657	$code = $atts['code'];
652		-
	658	+ $current_post = get_post();
	659	+
	660	+ $no_js = defined( 'DISALLOW_UNFILTERED_HTML' ) && DISALLOW_UNFILTERED_HTML;
	661	+ $allow_php = $this->get_option( 'code_blocks', false );
	662	+ $allow_php_whitelist = $this->get_option( 'code_blocks_whitelist', [] );
	663	+
653	664	// If the ID is null, it means it comes from a Guttenberg block
654	665	$is_block = empty( $id ) && !empty( $code );
655		- if( $is_block ){
656	666
	667	+ if( $is_block ) {
	668	+
	669	+ if( $target !== 'js' && $target !== 'php' ) {
	670	+ return '<b>Code Engine:</b> Please provide a valid target (js or php).';
	671	+ }
	672	+
	673	+ if ( $no_js && $target === 'js' ) {
	674	+ return '<b>Code Engine:</b> Code Block JS are disabled because unfiltered HTML is not allowed on your server.';
	675	+ }
	676	+
	677	+ if ( $target === 'php' ) {
	678	+
	679	+ if ( !$allow_php ) {
	680	+ return '<b>Code Engine:</b> Code Block PHP are disabled. If you are an administrator, you can enable it in the settings, this is not recommended. Please use a Content Snippet ( PHP ) instead.';
	681	+ }
	682	+
	683	+ if ( !empty( $allow_php_whitelist ) && !in_array( $current_post->ID, $allow_php_whitelist ) ) {
	684	+ return '<b>Code Engine:</b> Code Block PHP are disabled for this post. If you are an administrator, you can enable it in the settings, this is not recommended. Please use a Content Snippet ( PHP ) instead.';
	685	+ }
	686	+ }
	687	+
657	688	// Because the code from Blocks are sanitized, we need to replace the &quot; with "
658	689	$code = str_replace( '&quot;', '"', $code );
659	690
660	691	if ( $target === 'js' ) {
		@@ -667,8 +698,9 @@
667	698
668	699	return $output;
669	700	}
670	701
	702	+ // If not a block, we get the snippet by ID
671	703	// If the ID is not null, it means it comes from a shortcode
672	704	if ( empty( $id ) && empty( $code ) ) {
673	705	return '<b>Code Engine:</b> Please provide a snippet ID.';
674	706	}
		@@ -680,12 +712,16 @@
680	712	}
681	713
682	714	//Check if the snippet scope is either content_php or content_js
683	715	$is_content_php = $snippet['scope'] === 'content_php';
684		- $is_content_js = $snippet['scope'] === 'content_js';
	716	+ $is_content_js = $snippet['scope'] === 'content_js';
685	717
686	718	if ( !$is_content_php && !$is_content_js ) {
687	719	return '<b>Code Engine:</b> The snippet is not a content snippet.';
	720	+ }
	721	+
	722	+ if( $no_js && $is_content_js ) {
	723	+ return '<b>Code Engine:</b> Code Engine JS snippets are disabled because unfiltered HTML is not allowed on your server.';
688	724	}
689	725
690	726	//Check if the snippet is active
691	727	if ( !$snippet['active'] ) {