← All changes | classes/Controllers/Shortcodes.php +3 -21 trunk → 2.6.1 View file →

		@@ -30,13 +30,8 @@
30	30
31	31	/**
32	32	* Process the [content_control] shortcode.
33	33	*
34		- * When access is allowed, nested shortcode content is intentionally returned
35		- * as rendered HTML. Applying KSES after `do_shortcode()` would break forms,
36		- * embeds, SVG, and script-backed output produced by otherwise-authorized
37		- * nested shortcodes.
38		- *
39	34	* @param array<string,string|int|null> $atts Array or shortcode attributes.
40	35	* @param string $content Content inside shortcode.
41	36	*
42	37	* @return string
		@@ -52,9 +47,8 @@
52	47	'status' => 'logged_in', // 'logged_in' or 'logged_out
53	48	'allowed_roles' => null,
54	49	'excluded_roles' => null,
55	50	'class' => '',
56		- 'inline' => false,
57	51	'message' => $this->container->get_option( 'defaultDenialMessage', '' ),
58	52	], $this->normalize_empty_atts( $atts ), 'content_control' );
59	53
60	54	// Handle old args.
		@@ -84,33 +78,23 @@
84	78	$classes[] = 'content-control-container';
85	79	// @deprecated 2.0.0
86	80	$classes[] = 'jp-cc';
87	81
88		- $tag = wp_validate_boolean( $atts['inline'] ) ? 'span' : 'div';
89		-
90	82	if ( user_meets_requirements( $atts['status'], $user_roles, $match_type ) ) {
91	83	$classes[] = 'content-control-accessible';
92	84	// @deprecated 2.0.0
93	85	$classes[] = 'jp-cc-accessible';
94		- // Keep nested shortcode output intact; KSES here would strip functional rendered markup.
95		- $output = do_shortcode( $content );
	86	+ $container = '<div class="%1$s">%2$s</div>';
96	87	} else {
97	88	$classes[] = 'content-control-not-accessible';
98	89	// @deprecated 2.0.0
99	90	$classes[] = 'jp-cc-not-accessible';
100		- // Denial messages are shortcode attributes and intentionally limited to post-safe HTML.
101		- $output = wp_kses_post( do_shortcode( $atts['message'] ) );
	91	+ $container = '<div class="%1$s">%3$s</div>';
102	92	}
103	93
104	94	$classes = implode( ' ', $classes );
105	95
106		- // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Contains intentional rendered nested-shortcode HTML.
107		- return sprintf(
108		- '<%1$s class="%2$s">%3$s</%1$s>',
109		- $tag,
110		- esc_attr( $classes ),
111		- $output
112		- );
	96	+ return sprintf( $container, esc_attr( $classes ), do_shortcode( $content ), do_shortcode( $atts['message'] ) );
113	97	}
114	98
115	99	/**
116	100	* Takes set but empty attributes and sets them to true.
		@@ -123,10 +107,8 @@
123	107	*
124	108	* @psalm-return array<int|string, int|null|string|true>
125	109	*/
126	110	public function normalize_empty_atts( $atts = [] ) {
127		- // Sanity check to ensure $atts is an array.
128		- // @phpstan-ignore-next-line .
129	111	if ( ! is_array( $atts ) || empty( $atts ) ) {
130	112	$atts = [];
131	113	}
132	114