← All changes | classes/core.php +52 -9 0.3.2 → 0.3.8 View file →

		@@ -12,8 +12,9 @@
12	12	public $is_rest = false;
13	13	public $is_cli = false;
14	14	public $site_url = null;
15	15	public $mwcode = null;
	16	+ public $licenser = null;
16	17
17	18	private $option_name = 'mwcode_options';
18	19
19	20	public function __construct() {
		@@ -37,8 +38,13 @@
37	38	add_action( 'plugins_loaded', array( $this, 'init' ) );
38	39	}
39	40
40	41	function init() {
	42	+ // Initialize the licenser for Pro version
	43	+ if ( class_exists( 'MeowCommonPro_Licenser' ) ) {
	44	+ $this->licenser = new MeowCommonPro_Licenser( MWCODE_PREFIX, MWCODE_ENTRY, MWCODE_DOMAIN, MWCODE_ITEM_ID, MWCODE_VERSION );
	45	+ }
	46	+
41	47	// Part of the core, settings and stuff
42	48	$this->admin = new Meow_MWCODE_Admin( $this );
43	49
44	50	// Only for REST
		@@ -83,14 +89,17 @@
83	89	return [
84	90	//Safemode
85	91	"safe_mode_status" => "on", // on, off, whitelist
86	92	"safe_mode_whitelist" => [],
	93	+ //"disallow_block_php" => true, // Do not allow PHP code to be execute through Blocks "code" parameter
	94	+ "code_blocks" => false,
	95	+ "code_blocks_whitelist" => [], // Whitelist for code blocks, if empty, all code blocks are allowed
87	96
88	97	//LOGS
89	98	"server_debug_mode" => false,
90	99
91	100	//UI
92		- "ui_show_preview" => true,
	101	+ "ui_show_preview" => false,
93	102
94	103	//AI
95	104	"ai_suggestions" => false,
96	105	"ai_engine_status"=> false,
		@@ -276,10 +285,10 @@
276	285	$value = array_map( 'trim', $value );
277	286	}
278	287
279	288	if ( $type === 'array' ) {
280		- $value = json_encode( $value );
281		- $value = str_replace( '\\', '', $value );
	289	+ // Convert to PHP array format instead of JSON
	290	+ $value = var_export( $value, true );
282	291	}
283	292
284	293	return [ $name, $value ];
285	294	}
		@@ -432,13 +441,14 @@
432	441	if ( $index < count( $params['args'] ) - 1 ) {
433	442	$params['code'] .= ', ';
434	443	}
435	444	}
	445	+
436	446	$params['code'] .= ");\necho print_r(\$mwcode_result, true);";
437	447
438	448	$error = null;
439	449	$output = null;
440		-
	450	+
441	451	try {
442	452	ob_start();
443	453	eval( $params['code'] );
444	454	$output = ob_get_clean();
		@@ -580,11 +590,14 @@
580	590
581	591	$blocked = false;
582	592	$page = isset( $_GET["page"] ) ? sanitize_text_field( $_GET["page"] ) : null;
583	593
584		- // Block on settings page for safety
	594	+
585	595	if ( $page === 'mwcode_settings' ) {
586		- $blocked = true;
	596	+ // If we blocks global snippets like nonce_life filter, we would block the settings page so let's remove the block for this page
	597	+
	598	+ $blocked = false;
	599	+ //$blocked = true;
587	600	}
588	601	// Block REST requests that aren't whitelisted
589	602	elseif ( MeowCommon_Helpers::is_rest() && !Meow_MWCODE_Core::is_white_listed_rest() ) {
590	603	$blocked = true;
		@@ -648,13 +661,38 @@
648	661
649	662	$id = $atts['id'];
650	663	$target = $atts['target'];
651	664	$code = $atts['code'];
652		-
	665	+ $current_post = get_post();
	666	+
	667	+ $no_js = defined( 'DISALLOW_UNFILTERED_HTML' ) && DISALLOW_UNFILTERED_HTML;
	668	+ $allow_php = $this->get_option( 'code_blocks', false );
	669	+ $allow_php_whitelist = $this->get_option( 'code_blocks_whitelist', [] );
	670	+
653	671	// If the ID is null, it means it comes from a Guttenberg block
654	672	$is_block = empty( $id ) && !empty( $code );
655		- if( $is_block ){
656	673
	674	+ if( $is_block ) {
	675	+
	676	+ if( $target !== 'js' && $target !== 'php' ) {
	677	+ return '<b>Code Engine:</b> Please provide a valid target (js or php).';
	678	+ }
	679	+
	680	+ if ( $no_js && $target === 'js' ) {
	681	+ return '<b>Code Engine:</b> Code Block JS are disabled because unfiltered HTML is not allowed on your server.';
	682	+ }
	683	+
	684	+ if ( $target === 'php' ) {
	685	+
	686	+ if ( !$allow_php ) {
	687	+ return '<b>Code Engine:</b> Code Block PHP are disabled. If you are an administrator, you can enable it in the settings, this is not recommended. Please use a Content Snippet ( PHP ) instead.';
	688	+ }
	689	+
	690	+ if ( !empty( $allow_php_whitelist ) && !in_array( $current_post->ID, $allow_php_whitelist ) ) {
	691	+ return '<b>Code Engine:</b> Code Block PHP are disabled for this post. If you are an administrator, you can enable it in the settings, this is not recommended. Please use a Content Snippet ( PHP ) instead.';
	692	+ }
	693	+ }
	694	+
657	695	// Because the code from Blocks are sanitized, we need to replace the &quot; with "
658	696	$code = str_replace( '&quot;', '"', $code );
659	697
660	698	if ( $target === 'js' ) {
		@@ -667,8 +705,9 @@
667	705
668	706	return $output;
669	707	}
670	708
	709	+ // If not a block, we get the snippet by ID
671	710	// If the ID is not null, it means it comes from a shortcode
672	711	if ( empty( $id ) && empty( $code ) ) {
673	712	return '<b>Code Engine:</b> Please provide a snippet ID.';
674	713	}
		@@ -680,12 +719,16 @@
680	719	}
681	720
682	721	//Check if the snippet scope is either content_php or content_js
683	722	$is_content_php = $snippet['scope'] === 'content_php';
684		- $is_content_js = $snippet['scope'] === 'content_js';
	723	+ $is_content_js = $snippet['scope'] === 'content_js';
685	724
686	725	if ( !$is_content_php && !$is_content_js ) {
687	726	return '<b>Code Engine:</b> The snippet is not a content snippet.';
	727	+ }
	728	+
	729	+ if( $no_js && $is_content_js ) {
	730	+ return '<b>Code Engine:</b> Code Engine JS snippets are disabled because unfiltered HTML is not allowed on your server.';
688	731	}
689	732
690	733	//Check if the snippet is active
691	734	if ( !$snippet['active'] ) {