← All changes | classes/CryptX.php +339 -1864 trunk → 4.0.1 View file →

		@@ -3,174 +3,28 @@
3	3	namespace CryptX;
4	4
5	5	final class CryptX
6	6	{
	7	+
7	8	const NOT_FOUND = false;
8		-
9		- /**
10		- * Kept for compatibility: it is public, so a theme may reference it.
11		- *
12		- * @deprecated 4.1.1 The guard that used it compared against an already
13		- * sanitised address and could therefore never match --
14		- * sanitize_email('?subject=x') returns an empty string. Query
15		- * handling now lives in sanitizeMailtoQuery().
16		- */
	9	+ const MAIL_IDENTIFIER = 'mailto:';
17	10	const SUBJECT_IDENTIFIER = "?subject=";
18		-
19		- /** Upper bound for a single mailto header value, in characters. */
20		- private const MAX_MAILTO_VALUE_LENGTH = 512;
21		-
22		- /**
23		- * Upper bound for the whole "mailto:..." target, in characters.
24		- *
25		- * Matches CONFIG.MAX_URL_LENGTH in js/cryptx.js and the limit in
26		- * SecureEncryption::validateUrl(). Above it the click handler refuses to
27		- * navigate, and the link silently does nothing.
28		- */
29		- private const MAX_MAILTO_URL_LENGTH = 2048;
30		-
31		- /**
32		- * Shortcode attributes that describe the mail, not the plugin's settings.
33		- *
34		- * The names are those of the mailto headers in RFC 6068, so
35		- * [cryptx subject="..."] and href="mailto:...?subject=..." mean the same
36		- * thing and are cleaned by the same code.
37		- */
38		- private const MAILTO_ATTRIBUTES = ['subject', 'body', 'cc', 'bcc'];
39		-
40		- /**
41		- * The filters whose content a visitor wrote, not the site owner.
42		- *
43		- * A setting is the owner speaking about their own pages. Where the text
44		- * came in from outside, a blanket rule that switches protection off has to
45		- * be read narrowly -- see isAddressExempt().
46		- *
47		- * Only comments can be told apart with certainty. Forum and front-end
48		- * submission plugins -- bbPress, BuddyPress -- send visitor text through
49		- * 'the_content', which is also the owner's own filter, so no name can
50		- * separate the two. That is a limit of the approach and is documented in
51		- * the readme rather than papered over here.
52		- */
53		- private const VISITOR_WRITTEN_FILTERS = ['comment_text', 'comment_text_rss'];
54		-
55		- /**
56		- * Option keys a shortcode attribute must never reach.
57		- *
58		- * A shortcode may be written by anybody who may write a post. Key material
59		- * is not a presentation setting.
60		- */
61		- private const NOT_SETTABLE_BY_SHORTCODE = [
62		- 'encryption_password',
63		- 'image_token_secret',
64		- // The retired image secret is key material too -- it opens every token
65		- // made before the last rotation. Leaving it out was the exact mistake
66		- // this list exists to prevent, made one release after the list was
67		- // written.
68		- 'image_token_secret_previous',
69		- 'image_token_secret_previous_until',
70		- 'secrets_rotated_at',
71		- 'version',
72		- // Not key material, but not presentation either: shortcode_atts()
73		- // makes every key of the option array settable, so leaving this one in
74		- // would let anybody who may write a post move the date on which the
75		- // site owner is asked for a review.
76		- 'review_prompt_due',
77		- ];
78		-
79		- /**
80		- * The feed counterpart of each content filter.
81		- *
82		- * WordPress builds a feed from its own filters, not from the ones that
83		- * render a page: <description> comes from 'the_excerpt_rss',
84		- * <content:encoded> from 'the_content_feed'.
85		- */
86		- private const FEED_FILTERS = [
87		- 'the_content' => 'the_content_feed',
88		- 'the_excerpt' => 'the_excerpt_rss',
89		- 'comment_text' => 'comment_text_rss',
90		- ];
91		-
92		- /**
93		- * Filters after which WordPress expands shortcodes.
94		- *
95		- * Measured, not assumed: has_filter($name, 'do_shortcode') is 11 for these
96		- * four and false for the other five CryptX hangs on. Only here may an
97		- * unexpanded [cryptx] be set aside, because only here does something come
98		- * along afterwards to deal with it.
99		- */
100		- private const SHORTCODE_EXPANDED_AFTER = [
101		- 'the_content',
102		- 'render_block',
103		- 'widget_text_content',
104		- 'widget_block_content',
105		- ];
	11	+ const INDEX_TO_CHECK = 4;
	12	+ const PATTERN = '/(.*)(">)/i';
106	13	const ASCII_VALUES_BLACKLIST = ['32', '34', '39', '60', '62', '63', '92', '94', '96', '127'];
107		- /** Upper bound for the text rendered into a PNG, see cryptXtinyUrl(). */
108		- private const MAX_IMAGE_TEXT_LENGTH = 254;
109		-
110		- /**
111		- * Upper bound for the path segment the image endpoint reads.
112		- *
113		- * Wider than the text it may draw, because a token is longer than the
114		- * address inside it -- padded to a multiple of 32, plus IV and tag, plus
115		- * base64. Wide enough for the longest address the drawing limit allows,
116		- * and still nowhere near a size that could hurt.
117		- */
118		- private const MAX_IMAGE_REQUEST_LENGTH = 512;
119	14	private static ?self $instance = null;
120	15	private static array $cryptXOptions = [];
121	16	private static int $imageCounter = 0;
122		-
123		- /** CSS class of the links the click handler in cryptx.js listens for. */
124		- private const LINK_CLASS = 'cryptx-link';
125		-
126		- /** Marks a save request as coming from the post meta box. */
127		- private const METABOX_NONCE_ACTION = 'cryptx_metabox';
128		- private const METABOX_NONCE_FIELD = 'cryptx_metabox_nonce';
129		-
130		- /**
131		- * Set as soon as something on this page actually needs them. Version 3.2.7
132		- * once had this property ("the javascript will be loaded only if really
133		- * needed!"); the 4.0 rewrite lost it and loaded both files on every page,
134		- * including pages without a single address.
135		- */
136		- private static bool $scriptNeeded = false;
137		- private static bool $styleNeeded = false;
138		-
139		- /**
140		- * Parsed once per request instead of on every call. Both lists are read
141		- * from a comma separated option for every filter pass and, in the case of
142		- * the whitelist, for every single address found.
143		- */
144		- private static ?array $excludedIdCache = null;
145		- private static ?array $whiteListCache = null;
146		- private static ?array $exemptAddressCache = null;
147		-
148		- /**
149		- * True while the shortcode handler is processing its own content.
150		- *
151		- * Set in one place rather than threaded through the three stages: each of
152		- * them already carries a shortcode flag, but the decisions that need it sit
153		- * inside preg_replace_callback() handlers with fixed signatures, and
154		- * rewriting that machinery to pass an argument would risk more than it
155		- * buys.
156		- */
157		- private bool $inShortcode = false;
158		-
159	17	private const FONT_EXTENSION = 'ttf';
160	18	private const PAYPAL_DONATION_URL = 'https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=4026696';
161		- private Admin\SettingsPage $settingsPage;
162		- private Admin\SiteHealth $siteHealth;
163		- private Admin\ReviewNotice $reviewNotice;
164		- private Block $block;
	19	+ private const MAILTO_PATTERN = '/<a (.*?)(href=("|\')mailto:(.*?)("|\')(.*?)|)>\s*(.*?)\s*<\/a>/i';
	20	+ private const EMAIL_PATTERN = "/([_a-zA-Z0-9-+]+(\.[_a-zA-Z0-9-+]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*(\.[a-zA-Z]{2,}))/i";
	21	+ private CryptXSettingsTabs $settingsTabs;
165	22	private Config $config;
166	23
167	24	private function __construct()
168	25	{
169		- $this->settingsPage = new Admin\SettingsPage();
170		- $this->siteHealth = new Admin\SiteHealth();
171		- $this->reviewNotice = new Admin\ReviewNotice();
172		- $this->block = new Block();
	26	+ $this->settingsTabs = new CryptXSettingsTabs($this);
173	27	$this->config = new Config(get_option('cryptX', []));
174	28	self::$cryptXOptions = $this->loadCryptXOptionsWithDefaults();
175	29	}
176	30
		@@ -205,16 +59,8 @@
205	59	* @return void
206	60	*/
207	61	public function startCryptX(): void
208	62	{
209		- // The settings screen registers its own menu entry and REST routes.
210		- // Doing it here rather than in the constructor keeps the hooks out of
211		- // object construction, where they are easy to trigger by accident.
212		- $this->settingsPage->register();
213		- $this->siteHealth->register();
214		- $this->reviewNotice->register();
215		- $this->block->register();
216		-
217	63	$this->checkAndUpdateVersion();
218	64	$this->addUniversalWidgetFilters(); // Add this line
219	65	$this->initializePluginFilters();
220	66	$this->registerCoreHooks();
		@@ -222,52 +68,8 @@
222	68	$this->registerAdditionalHooks();
223	69	}
224	70
225	71	/**
226		- * Rebuilds the cached options and configuration for the site now in scope.
227		- *
228		- * Hooked to 'switch_blog', which WordPress fires for both switch_to_blog()
229		- * and restore_current_blog(), so the object follows the site rather than
230		- * the request.
231		- *
232		- * @return void
233		- */
234		- public function refreshForCurrentSite(): void
235		- {
236		- // wp_insert_site() switches into the new site BEFORE its tables exist,
237		- // and reading options there produces a database error in the log while
238		- // telling us nothing. wp_is_site_initialized() answers the question
239		- // without that -- it suppresses errors around its own query.
240		- //
241		- // The flag is not needed for the call below as the core stands today:
242		- // wp_is_site_initialized() only switches when the id differs from the
243		- // current one (wp-includes/ms-site.php), and we pass our own. It is
244		- // here for the two ways that changes -- a plugin filtering
245		- // 'pre_wp_is_site_initialized', or a later core version that switches
246		- // unconditionally -- either of which would call this method back into
247		- // itself.
248		- static $busy = false;
249		-
250		- if ($busy) {
251		- return;
252		- }
253		-
254		- $busy = true;
255		-
256		- try {
257		- if (is_multisite() && !wp_is_site_initialized(get_current_blog_id())) {
258		- return;
259		- }
260		-
261		- $this->config = new Config(get_option('cryptX', []));
262		- self::$cryptXOptions = $this->loadCryptXOptionsWithDefaults();
263		- self::resetOptionCaches();
264		- } finally {
265		- $busy = false;
266		- }
267		- }
268		-
269		- /**
270	72	* Checks the current version of the application against the stored version and updates settings if the application version is newer.
271	73	*
272	74	* @return void
273	75	*/
		@@ -273,49 +75,16 @@
273	75	*/
274	76	private function checkAndUpdateVersion(): void
275	77	{
276	78	$currentVersion = self::$cryptXOptions['version'] ?? null;
277		-
278	79	if ($currentVersion && version_compare(CRYPTX_VERSION, $currentVersion) > 0) {
279	80	$this->updateCryptXSettings();
280		-
281		- return;
282	81	}
283		-
284		- if ($currentVersion) {
285		- return;
286		- }
287		-
288		- // No stamp at all, and the option nevertheless exists. That is not the
289		- // fresh install it looks like: Config::save() writes the whole option
290		- // array whenever it has to mint a secret, and on a front-end request
291		- // that happens without installCryptX() ever running -- so the row is
292		- // created with 'version' => null, from Config::DEFAULT_OPTIONS.
293		- //
294		- // Left alone, that state is permanent. updateCryptXSettings() treats a
295		- // null version as "nothing to migrate" and returns, and nothing else
296		- // ever writes the stamp, so every future migration is skipped in
297		- // silence. Stamping it here costs one write, once.
298		- //
299		- // Stamping rather than migrating is the right half: a null version
300		- // means there is no earlier CryptX data to bring forward, which is
301		- // exactly the case the migrations already decline to handle.
302		- if (get_option('cryptX', null) === null) {
303		- return;
304		- }
305		-
306		- self::$cryptXOptions['version'] = CRYPTX_VERSION;
307		- update_option('cryptX', self::$cryptXOptions);
308	82	}
309	83
310	84	/**
311		- * Initializes and registers plugin filters based on the configuration settings.
	85	+ * Initializes and applies plugin filters based on the defined configuration options.
312	86	*
313		- * This method retrieves the active filters from the configuration and applies
314		- * each filter by either adding widget-specific filters or other plugin-related filters.
315		- * If the theme is a block theme, it transforms certain filters to an appropriate block-based equivalent.
316		- * It also checks if autolink functionality is enabled and adds the respective filters when applicable.
317		- *
318	87	* @return void
319	88	*/
320	89	public function initializePluginFilters(): void
321	90	{
		@@ -324,15 +93,8 @@
324	93	}
325	94
326	95	$activeFilters = $this->config->getActiveFilters();
327	96
328		- if (function_exists('wp_is_block_theme') && wp_is_block_theme()) {
329		- $activeFilters = array_map(
330		- fn($value) => $value === 'the_content' ? 'render_block' : $value,
331		- $activeFilters
332		- );
333		- }
334		-
335	97	foreach ($activeFilters as $filter) {
336	98	if ($filter === 'widget_text') {
337	99	$this->addWidgetFilters();
338	100	} else {
		@@ -337,65 +99,16 @@
337	99	$this->addWidgetFilters();
338	100	} else {
339	101	// Add autolink filters for non-widget filters if autolink is enabled
340	102	if ($this->config->isAutolinkEnabled()) {
341		- $this->addAutoLinkFilters($filter, 11);
	103	+ $this->addAutoLinkFilters($filter, 10);
342	104	}
343	105	$this->addOtherFilters($filter);
344	106	}
345	107	}
346		-
347		- $this->addFeedFilters();
348	108	}
349	109
350	110	/**
351		- * Registers the feed counterparts of the active content filters.
352		- *
353		- * Without these, "Leave RSS feeds unprotected = off" only half worked. A
354		- * feed's <description> comes from the_excerpt_rss(), and nothing CryptX
355		- * hangs on runs on the way there: on a block theme the plugin sits on
356		- * 'render_block', which fires only from do_blocks() -- and
357		- * wp_trim_excerpt() detaches do_blocks before building the excerpt. The
358		- * address went out in the feed while the setting said it would not.
359		- *
360		- * The guard inside the three stages stays as it is; it is what makes the
361		- * option work in the other direction, for filters that run in both feed
362		- * and page context.
363		- *
364		- * @return void
365		- */
366		- private function addFeedFilters(): void
367		- {
368		- // The default: feeds are deliberately left alone, because a feed
369		- // reader runs no JavaScript and a protected link would be dead in it.
370		- //
371		- // Read from the store rather than from the static list. The two agree
372		- // when this runs during startup, but the static one is swapped for the
373		- // duration of a shortcode and of the settings preview -- and a method
374		- // that decides which hooks exist has no business depending on which of
375		- // those happened to be in flight.
376		- $options = $this->loadCryptXOptionsWithDefaults();
377		-
378		- if (!empty($options['disable_rss'])) {
379		- return;
380		- }
381		-
382		- foreach ($this->config->getActiveFilters() as $filter) {
383		- if (!isset(self::FEED_FILTERS[$filter])) {
384		- continue;
385		- }
386		-
387		- $feedFilter = self::FEED_FILTERS[$filter];
388		-
389		- if ($this->config->isAutolinkEnabled()) {
390		- $this->addAutoLinkFilters($feedFilter, 11);
391		- }
392		-
393		- $this->addOtherFilters($feedFilter);
394		- }
395		- }
396		-
397		- /**
398	111	* Registers core hooks for the plugin's functionality.
399	112	*
400	113	* @return void
401	114	*/
		@@ -401,20 +114,9 @@
401	114	*/
402	115	private function registerCoreHooks(): void
403	116	{
404	117	add_action('activate_' . CRYPTX_BASENAME, [$this, 'installCryptX']);
405		-
406		- // Multisite: this object is built once per request, from whichever site
407		- // was current at the time. switch_to_blog() changes what get_option()
408		- // returns but not what this instance already holds -- and
409		- // getCryptXOptionsDefaults() hands out $this->config, which is the
410		- // FIRST site's stored values, not a set of defaults. Everything read
411		- // after a switch therefore came from the wrong site, up to and
412		- // including its encryption secret.
413		- add_action('switch_blog', [$this, 'refreshForCurrentSite']);
414	118	add_action('wp_enqueue_scripts', [$this, 'loadJavascriptFiles']);
415		- // Priority 1 so this still runs before wp_print_footer_scripts.
416		- add_action('wp_footer', [$this, 'enqueueAssetsIfNeeded'], 1);
417	119	}
418	120
419	121	/**
420	122	* Initializes the meta box functionality if enabled in the configuration.
		@@ -430,16 +132,10 @@
430	132	return;
431	133	}
432	134
433	135	add_action('admin_menu', [$this, 'metaBox']);
434		-
435		- // Only 'wp_insert_post'. There was a second registration on
436		- // 'wp_update_post' -- a hook WordPress does not have: the core defines
437		- // a *function* of that name, and the only do_action() calls are
438		- // 'wp_insert_post' in wp-includes/post.php. Since wp_update_post()
439		- // routes through wp_insert_post(), an update was covered all along;
440		- // the line did nothing and suggested it did.
441	136	add_action('wp_insert_post', [$this, 'addPostIdToExcludedList']);
	137	+ add_action('wp_update_post', [$this, 'addPostIdToExcludedList']);
442	138	}
443	139
444	140	/**
445	141	* Registers additional WordPress hooks and shortcodes.
		@@ -448,11 +144,9 @@
448	144	*/
449	145	private function registerAdditionalHooks(): void
450	146	{
451	147	add_filter('plugin_row_meta', [$this, 'add_plugin_action_links'], 10, 2);
452		- // add_action, nicht add_filter: 'init' ist eine Action. Intern
453		- // dasselbe, aber der Aufruf soll sagen, was er tut.
454		- add_action('init', [$this, 'cryptXtinyUrl']);
	148	+ add_filter('init', [$this, 'cryptXtinyUrl']);
455	149	add_shortcode('cryptx', [$this, 'cryptXShortcode']);
456	150	}
457	151
458	152	/**
		@@ -516,193 +210,8 @@
516	210	*
517	211	* @param array $attributes The array of attributes, potentially encoded.
518	212	* @return array The array of decoded attributes with the 'encoded' key removed if present.
519	213	*/
520		- /**
521		- * Runs a processing step with unexpanded [cryptx] shortcodes masked out.
522		- *
523		- * On a block theme the three filters hang on 'render_block', which fires
524		- * from do_blocks() at 'the_content' priority 9 -- while do_shortcode()
525		- * runs at priority 11. CryptX therefore sees the shortcode as raw text,
526		- * long before it becomes anything.
527		- *
528		- * Left alone, that ends badly in two ways. The address inside
529		- * "[cryptx]info@example.com[/cryptx]" is not linked, because it sits
530		- * behind a "]", yet the display stage replaces it anyway -- the same
531		- * silent failure the autolink patterns were widened for. And once the
532		- * replacement inserts "[at]" and "[dot]", the new square brackets tear the
533		- * shortcode apart, so the parser later prints the wreckage into the page.
534		- *
535		- * Masking hands the shortcode to do_shortcode() untouched. It does its own
536		- * encrypting, with its own attributes, exactly as on a classic theme.
537		- *
538		- * @param string $content The content.
539		- * @param callable $process Receives the masked content, returns the result.
540		- *
541		- * @return string The processed content, with the shortcodes back in place.
542		- */
543		- private function withShortcodesProtected(string $content, callable $process): string
544		- {
545		- // Masking is only safe where do_shortcode() runs after us. In
546		- // 'comment_text', 'the_excerpt', 'the_meta_key', 'widget_text' and
547		- // 'widget_custom_html_content' it does not -- WordPress never expands
548		- // shortcodes there. Masking unconditionally therefore handed the
549		- // address to nobody at all: it was skipped here and never picked up
550		- // later, and a "[cryptx]" written into a comment shipped the address in
551		- // the clear. 4.1.0 at least obfuscated it.
552		- //
553		- // Where the shortcode is not going to be expanded, the literal
554		- // "[cryptx]" stays visible in the output and the address inside it is
555		- // obfuscated like any other. Ugly, and the same as before -- but the
556		- // address is covered.
557		- if (stripos($content, '[cryptx') === false) {
558		- return $process($content);
559		- }
560		-
561		- if (!in_array(current_filter(), self::SHORTCODE_EXPANDED_AFTER, true)) {
562		- // The shortcode never runs here, so cryptXShortcode() never sets
563		- // its flag -- and without it the exemption list would win over a
564		- // "[cryptx]" that was written precisely to overrule it. On a site
565		- // that exempts its own domain, an address wrapped in a shortcode
566		- // inside a hand-written excerpt or a custom field would have gone
567		- // out in the clear: not a shortcoming of the new list, but a step
568		- // back from 4.1.1, which obfuscated it.
569		- //
570		- // The flag covers the whole string rather than the shortcode's
571		- // body, because finding the body means splitting the content, and
572		- // splitting changes what the autolink patterns see either side of
573		- // the cut. The cost is that an exempt address elsewhere in the same
574		- // excerpt is obfuscated too. That is the harmless direction: too
575		- // much protection in a rare case, never too little.
576		- $wasInShortcode = $this->inShortcode;
577		- $this->inShortcode = true;
578		-
579		- try {
580		- return $process($content);
581		- } finally {
582		- $this->inShortcode = $wasInShortcode;
583		- }
584		- }
585		-
586		- $store = [];
587		- $prefix = $this->maskingPrefix('sc');
588		-
589		- // WordPress' own idea of what a shortcode looks like, rather than a
590		- // hand-rolled one: it knows the self-closing form, the enclosing form
591		- // and -- the reason this matters below -- the escaped form.
592		- $pattern = '/' . get_shortcode_regex(['cryptx']) . '/s';
593		-
594		- $masked = preg_replace_callback(
595		- $pattern,
596		- static function (array $match) use (&$store, $prefix): string {
597		- // "[[cryptx]...[/cryptx]]" is how a page shows a shortcode
598		- // instead of running it -- an instructions page explaining
599		- // CryptX, typically. do_shortcode() deliberately leaves it as
600		- // text, so masking it would carry the address straight through
601		- // to the visitor in the clear. Groups 1 and 6 are the extra
602		- // brackets; when both are there, this is not ours to protect
603		- // and has to go through the normal obfuscation.
604		- if (($match[1] ?? '') === '[' && ($match[6] ?? '') === ']') {
605		- return $match[0];
606		- }
607		-
608		- $store[] = $match[0];
609		-
610		- return sprintf('<!--%s:%d-->', $prefix, count($store) - 1);
611		- },
612		- $content
613		- );
614		-
615		- // A PCRE failure must not cost the content; process it unmasked.
616		- if ($masked === null) {
617		- return $process($content);
618		- }
619		-
620		- $result = $process($masked);
621		-
622		- // Under 'render_block' the shortcode is expanded here rather than left
623		- // for later. The other three entries in SHORTCODE_EXPANDED_AFTER carry
624		- // do_shortcode() themselves; 'render_block' does not -- it relies on
625		- // the_content running afterwards, and there are core paths where that
626		- // never happens. A block pattern pulled in through core/pattern is
627		- // rendered by do_blocks() alone (wp-includes/blocks/pattern.php), so a
628		- // masked shortcode would have been handed to nobody and the address
629		- // would have reached the page in the clear.
630		- //
631		- // Expanding twice is harmless: whatever runs later finds an anchor, no
632		- // shortcode.
633		- if (current_filter() === 'render_block') {
634		- $store = array_map('do_shortcode', $store);
635		- }
636		-
637		- $tokens = array_map(
638		- static fn(int $index): string => sprintf('<!--%s:%d-->', $prefix, $index),
639		- array_keys($store)
640		- );
641		-
642		- return str_replace($tokens, $store, $result);
643		- }
644		-
645		- /**
646		- * Builds a mailto query from the shortcode's mail attributes.
647		- *
648		- * @param array<string, mixed> $attributes Lower-cased shortcode attributes.
649		- *
650		- * @return string The cleaned query, or an empty string.
651		- */
652		- private function buildMailtoQueryFromAttributes(array $attributes): string
653		- {
654		- $pairs = [];
655		-
656		- foreach (self::MAILTO_ATTRIBUTES as $name) {
657		- if (!isset($attributes[$name]) || is_array($attributes[$name])) {
658		- continue;
659		- }
660		-
661		- $value = (string) $attributes[$name];
662		-
663		- if (trim($value) === '') {
664		- continue;
665		- }
666		-
667		- $pairs[] = $name . '=' . rawurlencode($value);
668		- }
669		-
670		- // Straight through the same gate an address in the page goes through,
671		- // so the shortcode cannot express anything a link could not.
672		- return $this->sanitizeMailtoQuery(implode('&', $pairs));
673		- }
674		-
675		- /**
676		- * Appends a query to every mailto link that does not already carry one.
677		- *
678		- * A link written by hand with its own "?subject=" keeps it: the more
679		- * specific instruction wins over the shortcode's blanket one.
680		- *
681		- * @param string $content The content, after autolinking.
682		- * @param string $query The query to append, without the "?".
683		- *
684		- * @return string The content with the query in place.
685		- */
686		- private function addQueryToMailtoLinks(string $content, string $query): string
687		- {
688		- $result = preg_replace_callback(
689		- '/(href\s*=\s*(["\']))mailto:([^"\']+)(\2)/i',
690		- static function (array $match) use ($query): string {
691		- if (strpos($match[3], '?') !== false) {
692		- return $match[0];
693		- }
694		-
695		- return $match[1] . 'mailto:' . $match[3] . '?' . $query . $match[4];
696		- },
697		- $content
698		- );
699		-
700		- // Same reasoning as every other preg_* call site here: a PCRE failure
701		- // yields null, and handing that on would empty the content.
702		- return $result ?? $content;
703		- }
704		-
705	214	private function decodeAttributes(array $attributes): array
706	215	{
707	216	if (($attributes['encoded'] ?? '') !== 'true') {
708	217	return $attributes;
		@@ -728,73 +237,44 @@
728	237	public function cryptXShortcode(array $atts = [], string $content = '', string $tag = ''): string
729	238	{
730	239	// Decode attributes if needed
731	240	$attributes = $this->decodeAttributes($atts);
732		- $attributes = array_change_key_case($attributes, CASE_LOWER);
733	241
734		- // The mail headers are pulled out first. They are not options -- there
735		- // is no "subject" in the option store and never was -- so leaving them
736		- // in would hand them to shortcode_atts(), which drops anything it does
737		- // not recognise. That is precisely what happened to "subject" for
738		- // years: accepted by the parser, silently discarded, and documented as
739		- // working.
740		- $mailQuery = $this->buildMailtoQueryFromAttributes($attributes);
741		- $attributes = array_diff_key($attributes, array_flip(self::MAILTO_ATTRIBUTES));
742		-
743	242	// Update options if attributes provided
744	243	if (!empty($attributes)) {
745		- // shortcode_atts() keeps whatever is in the defaults it is given,
746		- // so the option array decides which attribute names have an effect
747		- // -- and the option array holds the two secrets. Nothing reads them
748		- // from here today (both go through Config), so this changes no
749		- // behaviour; it is here so that the next person to reach for
750		- // self::$cryptXOptions cannot accidentally make key material
751		- // settable by anyone who may write a post.
752		- $overridable = array_diff_key(
753		- $this->loadCryptXOptionsWithDefaults(),
754		- array_flip(self::NOT_SETTABLE_BY_SHORTCODE)
	244	+ self::$cryptXOptions = shortcode_atts(
	245	+ $this->loadCryptXOptionsWithDefaults(),
	246	+ array_change_key_case($attributes, CASE_LOWER),
	247	+ $tag
755	248	);
	249	+ }
756	250
757		- self::$cryptXOptions = array_merge(
758		- array_intersect_key(
759		- $this->loadCryptXOptionsWithDefaults(),
760		- array_flip(self::NOT_SETTABLE_BY_SHORTCODE)
761		- ),
762		- shortcode_atts($overridable, $attributes, $tag)
763		- );
764		- self::resetOptionCaches();
	251	+ // Process content (inline the encryptAndLinkContent logic)
	252	+ if (self::$cryptXOptions['autolink'] ?? false) {
	253	+ $content = $this->addLinkToEmailAddresses($content, true);
765	254	}
766	255
767		- // Saved and restored rather than set to false at the end: should this
768		- // ever run nested, the outer shortcode must keep its own state.
769		- $wasInShortcode = $this->inShortcode;
770		- $this->inShortcode = true;
	256	+ $content = $this->findEmailAddressesInContent($content, true);
	257	+ $processedContent = $this->replaceEmailInContent($content, true);
771	258
772		- try {
773		- // Process content (inline the encryptAndLinkContent logic)
774		- if (self::$cryptXOptions['autolink'] ?? false) {
775		- $content = $this->addLinkToEmailAddresses($content, true);
776		- }
	259	+ // Reset options to defaults
	260	+ self::$cryptXOptions = $this->loadCryptXOptionsWithDefaults();
777	261
778		- // After autolinking, so a bare address in the shortcode body has a
779		- // link to carry the headers, and before encrypting, so they end up
780		- // inside the payload rather than in the page.
781		- if ($mailQuery !== '') {
782		- $content = $this->addQueryToMailtoLinks($content, $mailQuery);
783		- }
	262	+ return $processedContent;
	263	+ }
784	264
785		- $content = $this->findEmailAddressesInContent($content, true);
786		- $processedContent = $this->replaceEmailInContent($content, true);
787		- } finally {
788		- // Restored in a finally block: self::$cryptXOptions is static, so
789		- // an exception escaping from here would leave the shortcode's
790		- // values in place for the rest of the request.
791		- $this->inShortcode = $wasInShortcode;
792		- self::$cryptXOptions = $this->loadCryptXOptionsWithDefaults();
793		- self::resetOptionCaches();
794		- }
	265	+ /**
	266	+ * Encrypts and links content.
	267	+ *
	268	+ * @param string $content The content to be encrypted and linked.
	269	+ *
	270	+ * @return string The encrypted and linked content.
	271	+ */
	272	+ private function encryptAndLinkContent(string $content, bool $shortcode = false): string
	273	+ {
	274	+ $content = $this->findEmailAddressesInContent($content, $shortcode);
795	275
796		- return $processedContent;
	276	+ return $this->replaceEmailInContent($content, $shortcode);
797	277	}
798	278
799	279	/**
800	280	* Retrieves the ID of the current post.
		@@ -814,152 +294,49 @@
814	294	* @return void
815	295	*/
816	296	public function cryptXtinyUrl(): void
817	297	{
818		- // sanitize_text_field(), not esc_url(): the latter is an output
819		- // escaper and turned "&" into "&#038;" on the way in.
820		- $url = (!empty($_SERVER['REQUEST_URI']))
821		- ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI']))
822		- : '';
	298	+ $url = $_SERVER['REQUEST_URI'];
823	299	$params = explode('/', $url);
824		-
825		- if (count($params) < 2) {
826		- return;
827		- }
828		-
829		- if (!hash_equals(md5(get_bloginfo('url')), $params[count($params) - 2])) {
830		- return;
831		- }
832		-
833		- // Everything below writes an image to the output stream. Any PHP notice
834		- // that slips through would end up inside that stream, be served as
835		- // image/png and disclose the server path to the visitor. So every
836		- // prerequisite is checked first and the request is abandoned quietly
837		- // if one is missing.
838		- if (!function_exists('imagettfbbox')) {
839		- return;
840		- }
841		-
842		- $fontFile = self::$cryptXOptions['c2i_font'] ?? $this->getDefaultFont();
843		- if (!is_string($fontFile) || $fontFile === '') {
844		- return;
845		- }
846		-
847		- // basename() keeps the option from reaching outside the fonts folder,
848		- // even if it was tampered with in the database.
849		- $font = CRYPTX_DIR_PATH . 'fonts/' . basename(str_replace(' ', '_', $fontFile));
850		- // is_file(), not is_readable(): the latter is true for a directory as
851		- // well, and imagettfbbox() would then emit "Could not read font" with
852		- // the full server path -- exactly the disclosure this rewrite removes.
853		- if (!is_file($font) || !is_readable($font)) {
854		- return;
855		- }
856		-
857		- // Two different bounds, and they used to be one. What has to be limited
858		- // is the text that gets DRAWN -- without a bound a long request sizes
859		- // the canvas up accordingly and exhausts the memory limit, a cheap
860		- // denial of service. What arrives in the URL is now a token, and a
861		- // token is longer than the address inside it: cutting the request at
862		- // the drawing limit silently broke every address from about 160
863		- // characters upwards, because the token was truncated before it could
864		- // be read. So the request gets a bound of its own, wide enough for any
865		- // token and still far from anything that could hurt.
866		- $requested = substr(rawurldecode($params[count($params) - 1]), 0, self::MAX_IMAGE_REQUEST_LENGTH);
867		- if ($requested === '') {
868		- return;
869		- }
870		-
871		- $msg = ImageToken::read($requested);
872		-
873		- if ($msg === '') {
874		- // No token: either an URL from a page cached before the update, or
875		- // somebody asking for arbitrary text to be drawn. Pages cached
876		- // before the update carry the address entity-encoded, and dropping
877		- // them would leave a broken image where an address should be for as
878		- // long as the cache lives -- so they are still served.
879		- //
880		- // But only if what they ask for really is an address. That is the
881		- // difference to before: this endpoint used to draw whatever text a
882		- // request named, which made it a picture generator for anyone who
883		- // found it. The old form stays workable, the abuse does not.
884		- //
885		- // The entity decoding is belt and braces with no path to it, and
886		- // that is worth saying so nobody later mistakes it for a tested
887		- // guarantee: a browser resolves the entities before it makes the
888		- // request, so what arrives here is the plain address. The encoded
889		- // form cannot even reach this line -- sanitize_text_field() above
890		- // strips percent sequences, and an unencoded "#" is cut off as a
891		- // fragment. It stays because it costs nothing and would carry a
892		- // proxy that did deliver the encoded form.
893		- $decoded = html_entity_decode($requested, ENT_QUOTES | ENT_HTML5, 'UTF-8');
894		-
895		- if (!Exposure::isAddress($decoded)) {
896		- return;
	300	+ if (count($params) > 1) {
	301	+ $tiny_url = $params[count($params) - 2];
	302	+ if ($tiny_url == md5(get_bloginfo('url'))) {
	303	+ $font = CRYPTX_DIR_PATH . 'fonts/' . self::$cryptXOptions['c2i_font'];
	304	+ $msg = $params[count($params) - 1];
	305	+ $size = self::$cryptXOptions['c2i_fontSize'];
	306	+ $pad = 1;
	307	+ $transparent = 1;
	308	+ $rgb = str_replace("#", "", self::$cryptXOptions['c2i_fontRGB']);
	309	+ $red = hexdec(substr($rgb, 0, 2));
	310	+ $grn = hexdec(substr($rgb, 2, 2));
	311	+ $blu = hexdec(substr($rgb, 4, 2));
	312	+ $bg_red = 255 - $red;
	313	+ $bg_grn = 255 - $grn;
	314	+ $bg_blu = 255 - $blu;
	315	+ $width = 0;
	316	+ $height = 0;
	317	+ $offset_x = 0;
	318	+ $offset_y = 0;
	319	+ $bounds = array();
	320	+ $image = "";
	321	+ $bounds = ImageTTFBBox($size, 0, $font, "W");
	322	+ $font_height = abs($bounds[7] - $bounds[1]);
	323	+ $bounds = ImageTTFBBox($size, 0, $font, $msg);
	324	+ $width = abs($bounds[4] - $bounds[6]);
	325	+ $height = abs($bounds[7] - $bounds[1]);
	326	+ $offset_y = $font_height + abs(($height - $font_height) / 2) - 1;
	327	+ $offset_x = 0;
	328	+ $image = imagecreatetruecolor($width + ($pad * 2), $height + ($pad * 2));
	329	+ imagesavealpha($image, true);
	330	+ $foreground = ImageColorAllocate($image, $red, $grn, $blu);
	331	+ $background = imagecolorallocatealpha($image, 0, 0, 0, 127);
	332	+ imagefill($image, 0, 0, $background);
	333	+ ImageTTFText($image, $size, 0, round($offset_x + $pad, 0), round($offset_y + $pad, 0), $foreground, $font, $msg);
	334	+ Header("Content-type: image/png");
	335	+ imagePNG($image);
	336	+ die;
897	337	}
898		-
899		- $msg = $decoded;
900	338	}
901		-
902		- // Whichever way it arrived, this is the bound that matters: it is what
903		- // gets drawn, and therefore what sizes the canvas. Exposure::isAddress()
904		- // has no length limit of its own.
905		- $msg = substr($msg, 0, self::MAX_IMAGE_TEXT_LENGTH);
906		-
907		- $size = (int) (self::$cryptXOptions['c2i_fontSize'] ?? 10);
908		- $size = max(1, min(96, $size));
909		-
910		- $rgb = ltrim((string) (self::$cryptXOptions['c2i_fontRGB'] ?? '#000000'), '#');
911		- if (!preg_match('/^[0-9a-f]{6}$/i', $rgb)) {
912		- $rgb = '000000';
913		- }
914		- $red = hexdec(substr($rgb, 0, 2));
915		- $grn = hexdec(substr($rgb, 2, 2));
916		- $blu = hexdec(substr($rgb, 4, 2));
917		-
918		- $pad = 1;
919		- $bounds = imagettfbbox($size, 0, $font, 'W');
920		- if ($bounds === false) {
921		- return;
922		- }
923		- $font_height = abs($bounds[7] - $bounds[1]);
924		-
925		- $bounds = imagettfbbox($size, 0, $font, $msg);
926		- if ($bounds === false) {
927		- return;
928		- }
929		- $width = abs($bounds[4] - $bounds[6]);
930		- $height = abs($bounds[7] - $bounds[1]);
931		- if ($width < 1 || $height < 1) {
932		- return;
933		- }
934		-
935		- $offset_y = $font_height + abs(($height - $font_height) / 2) - 1;
936		- $offset_x = 0;
937		-
938		- $image = imagecreatetruecolor($width + ($pad * 2), $height + ($pad * 2));
939		- if ($image === false) {
940		- return;
941		- }
942		- imagesavealpha($image, true);
943		- $foreground = imagecolorallocate($image, $red, $grn, $blu);
944		- $background = imagecolorallocatealpha($image, 0, 0, 0, 127);
945		-
946		- // Both return false when the palette is exhausted. Passing that on
947		- // would emit a warning into the image stream -- the very thing this
948		- // method is built to avoid.
949		- if ($foreground === false || $background === false) {
950		- imagedestroy($image);
951		- return;
952		- }
953		-
954		- imagefill($image, 0, 0, $background);
955		- imagettftext($image, $size, 0, (int) round($offset_x + $pad), (int) round($offset_y + $pad), $foreground, $font, $msg);
956		-
957		- header('Content-Type: image/png');
958		- header('X-Content-Type-Options: nosniff');
959		- imagepng($image);
960		- imagedestroy($image);
961		- die;
962	339	}
963	340
964	341	/**
965	342	* Adds common filters to a given filter name.
		@@ -1013,21 +390,9 @@
1013	390	{
1014	391	$widgetFilters = $this->config->getWidgetFilters();
1015	392
1016	393	foreach ($widgetFilters as $widgetFilter) {
1017		- // No isAutolinkEnabled() check here, unlike the branch above that
1018		- // handles every other filter -- so switching autolink off leaves it
1019		- // on in widgets. Measured, not assumed: with autolink=0,
1020		- // has_filter() is false for the_content, the_excerpt and
1021		- // comment_text and true for all three widget filters.
1022		- //
1023		- // Left as it is on purpose. The difference errs towards protection:
1024		- // a plain address in a sidebar is linked and encrypted rather than
1025		- // left readable. Honouring the setting here would mean an update
1026		- // that makes addresses readable on sites that never asked for that,
1027		- // which is the one direction this plugin must not move in silently.
1028		- // The setting's help text says so instead.
1029		- $this->addAutoLinkFilters($widgetFilter, 11);
	394	+ $this->addAutoLinkFilters($widgetFilter, 10);
1030	395	$this->addOtherFilters($widgetFilter);
1031	396	}
1032	397	}
1033	398
		@@ -1039,36 +404,14 @@
1039	404	* @return bool Returns true if the ID is excluded, false otherwise.
1040	405	*/
1041	406	private function isIdExcluded(int $ID): bool
1042	407	{
1043		- if (self::$excludedIdCache === null) {
1044		- $raw = (string) (self::$cryptXOptions['excludedIDs'] ?? '');
1045		- self::$excludedIdCache = array_map(
1046		- 'intval',
1047		- array_filter(array_map('trim', explode(',', $raw)), 'strlen')
1048		- );
1049		- }
	408	+ $excludedIds = explode(",", self::$cryptXOptions['excludedIDs']);
1050	409
1051		- return in_array($ID, self::$excludedIdCache, true);
	410	+ return in_array($ID, $excludedIds);
1052	411	}
1053	412
1054	413	/**
1055		- * Drops the parsed option lists.
1056		- *
1057		- * Both caches mirror values from self::$cryptXOptions. Whenever those are
1058		- * replaced -- by the shortcode or after saving -- the caches have to go
1059		- * with them, otherwise a stale exclusion list survives the change.
1060		- *
1061		- * @return void
1062		- */
1063		- private static function resetOptionCaches(): void
1064		- {
1065		- self::$excludedIdCache = null;
1066		- self::$whiteListCache = null;
1067		- self::$exemptAddressCache = null;
1068		- }
1069		-
1070		- /**
1071	414	* Replaces email addresses in content with link texts.
1072	415	*
1073	416	* @param string|null $content The content to replace the email addresses in.
1074	417	* @param bool $isShortcode Flag indicating whether the method is called from a shortcode.
		@@ -1080,15 +423,8 @@
1080	423	global $post;
1081	424
1082	425	if (self::$cryptXOptions['disable_rss'] && $this->isRssFeed()) return $content;
1083	426
1084		- // Nothing to find without an at sign. Bailing out here skips the whole
1085		- // regular expression machinery for the vast majority of content -- and
1086		- // on a block theme this filter runs once per block, not once per post.
1087		- if ($content === null || strpos($content, '@') === false) {
1088		- return $content;
1089		- }
1090		-
1091	427	// Check if current filter is a widget filter
1092	428	$widgetFilters = $this->config->getWidgetFilters();
1093	429	$isWidgetContext = in_array(current_filter(), $widgetFilters);
1094	430
		@@ -1095,12 +431,9 @@
1095	431	$postId = (is_object($post)) ? $post->ID : -1;
1096	432
1097	433	// For widgets, always process; for other content, check exclusion rules
1098	434	if (($isWidgetContext || !$this->isIdExcluded($postId) || $isShortcode) && !empty($content)) {
1099		- $content = $this->withShortcodesProtected(
1100		- $content,
1101		- fn(string $masked): string => $this->replaceEmailWithLinkText($masked)
1102		- );
	435	+ $content = $this->replaceEmailWithLinkText($content);
1103	436	}
1104	437
1105	438	return $content;
1106	439	}
		@@ -1116,14 +449,9 @@
1116	449	private function replaceEmailWithLinkText(string $content): string
1117	450	{
1118	451	$emailPattern = "/([_a-zA-Z0-9-+]+(\.[_a-zA-Z0-9-+]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*(\.[a-zA-Z]{2,}))/i";
1119	452
1120		- $result = preg_replace_callback($emailPattern, [$this, 'encodeEmailToLinkText'], $content);
1121		-
1122		- // On a PCRE error -- a backtrack or recursion limit on unusually large
1123		- // or awkward content -- preg_* returns null. Handing that back would
1124		- // make the whole post body disappear, so the untouched content wins.
1125		- return $result ?? $content;
	453	+ return preg_replace_callback($emailPattern, [$this, 'encodeEmailToLinkText'], $content);
1126	454	}
1127	455
1128	456	/**
1129	457	* Encode email address to link text.
		@@ -1133,9 +461,9 @@
1133	461	* @return string The encoded link text.
1134	462	*/
1135	463	private function encodeEmailToLinkText(array $Match): string
1136	464	{
1137		- if ($this->inWhiteList($Match) || $this->isAddressExempt($Match[1])) {
	465	+ if ($this->inWhiteList($Match)) {
1138	466	return $Match[1];
1139	467	}
1140	468	switch (self::$cryptXOptions['opt_linktext']) {
1141	469	case 1:
		@@ -1145,11 +473,9 @@
1145	473	$text = $this->getLinkImage();
1146	474	break;
1147	475	case 3:
1148	476	$img_url = wp_get_attachment_url(self::$cryptXOptions['alt_uploadedimage']);
1149		- // false when the attachment was deleted; would have produced
1150		- // <img src=""> and a TypeError on the string parameter.
1151		- $text = $img_url === false ? $this->getDefaultLinkText($Match) : $this->getUploadedImage($img_url);
	477	+ $text = $this->getUploadedImage($img_url);
1152	478	self::$imageCounter++;
1153	479	break;
1154	480	case 4:
1155	481	$text = antispambot($Match[1]);
		@@ -1165,165 +491,8 @@
1165	491	return $text;
1166	492	}
1167	493
1168	494	/**
1169		- * A placeholder that content cannot forge.
1170		- *
1171		- * The masking steps set a piece of content aside, run something over the
1172		- * rest, and put it back by searching for the placeholder they left. With a
1173		- * fixed placeholder that search cannot tell its own marker from one an
1174		- * author typed: a post explaining CryptX, a code example, or a comment
1175		- * written by a stranger. Whoever wrote it got the stored value substituted
1176		- * into their text -- an address they never wrote, appearing in their post.
1177		- *
1178		- * Nothing could be injected that way, because the store only ever holds
1179		- * matches of the address pattern and those cannot contain a markup
1180		- * character. But it altered content, and content nobody typed is a bug
1181		- * whatever its contents. The random part per call closes it: the author
1182		- * cannot write a placeholder that this call will look for.
1183		- *
1184		- * @param string $kind Distinguishes the two masking steps.
1185		- *
1186		- * @return string The prefix, unique to this call.
1187		- */
1188		- private function maskingPrefix(string $kind): string
1189		- {
1190		- try {
1191		- $nonce = bin2hex(random_bytes(8));
1192		- } catch (\Exception $e) {
1193		- // Only reachable when the platform has no source of randomness at
1194		- // all. Falling back keeps the page rendering; wp_rand() is seeded
1195		- // well enough for a marker that lives for one request.
1196		- $nonce = dechex(wp_rand(0, PHP_INT_MAX)) . dechex(wp_rand(0, PHP_INT_MAX));
1197		- }
1198		-
1199		- return 'cryptx-' . $kind . '-' . $nonce;
1200		- }
1201		-
1202		- /**
1203		- * Runs a step with the exempt addresses masked out of the content.
1204		- *
1205		- * @param string $content The content.
1206		- * @param callable $process Receives the masked content, returns the result.
1207		- *
1208		- * @return string The processed content, addresses back in place.
1209		- */
1210		- private function withExemptAddressesProtected(string $content, callable $process): string
1211		- {
1212		- if (strpos($content, '@') === false) {
1213		- return $process($content);
1214		- }
1215		-
1216		- $store = [];
1217		- $prefix = $this->maskingPrefix('keep');
1218		-
1219		- $masked = preg_replace_callback(
1220		- '/[_a-zA-Z0-9-+]+(\.[_a-zA-Z0-9-+]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*(\.[a-zA-Z]{2,})/',
1221		- function (array $match) use (&$store, $prefix): string {
1222		- if (!$this->isAddressExempt($match[0])) {
1223		- return $match[0];
1224		- }
1225		-
1226		- $store[] = $match[0];
1227		-
1228		- // No "@" in the token, so none of the address patterns can see
1229		- // it, and no square brackets, so a shortcode cannot be torn
1230		- // apart by it either.
1231		- return sprintf('<!--%s:%d-->', $prefix, count($store) - 1);
1232		- },
1233		- $content
1234		- );
1235		-
1236		- if ($masked === null) {
1237		- return $process($content);
1238		- }
1239		-
1240		- $result = $process($masked);
1241		-
1242		- $tokens = array_map(
1243		- static fn(int $index): string => sprintf('<!--%s:%d-->', $prefix, $index),
1244		- array_keys($store)
1245		- );
1246		-
1247		- return str_replace($tokens, $store, $result);
1248		- }
1249		-
1250		- /**
1251		- * Whether an address is one the site owner asked CryptX to leave alone.
1252		- *
1253		- * The endings list next door answers a different question -- it keeps
1254		- * "logo@2x.png" from being mistaken for an address at all. This one is
1255		- * about real addresses that are meant to stay readable: a support address
1256		- * a helpdesk parses out of the page, an address in a code example, an
1257		- * address a partner site scrapes on purpose. Until now the answer was "not
1258		- * possible", and the FAQ said so.
1259		- *
1260		- * An entry is either a whole address, or "@example.com" for every address
1261		- * at that domain. The domain form is the common case: a site tends to want
1262		- * its own addresses treated alike.
1263		- *
1264		- * Two places deliberately do not honour the list, both for the same
1265		- * reason -- a blanket setting must not overrule a narrower instruction:
1266		- *
1267		- * Inside "[cryptx]...[/cryptx]" nothing is exempt. The shortcode is
1268		- * somebody writing "protect this one, here"; a list entry set months ago on
1269		- * another screen is not an answer to that. The reverse order let a site
1270		- * that had exempted its own domain publish, in the clear, exactly the
1271		- * address it had wrapped in a shortcode to protect.
1272		- *
1273		- * In comments only the whole-address form counts. Comments are written by
1274		- * strangers, and "@example.com" is a statement about the site's own
1275		- * addresses, not about every address at that domain a visitor might leave
1276		- * behind. Honouring the domain form there turned the comment section into a
1277		- * harvest for anyone who could guess the domain. A whole address is
1278		- * different: the site owner named that one address exactly, and a visitor
1279		- * quoting it is quoting the site's own.
1280		- *
1281		- * @param string $address The address, as written in the content.
1282		- *
1283		- * @return bool True when CryptX must not touch it.
1284		- */
1285		- private function isAddressExempt(string $address): bool
1286		- {
1287		- if ($this->inShortcode) {
1288		- return false;
1289		- }
1290		-
1291		- if (self::$exemptAddressCache === null) {
1292		- $raw = (string) (self::$cryptXOptions['exemptAddresses'] ?? '');
1293		- self::$exemptAddressCache = array_filter(
1294		- array_map(
1295		- static fn(string $entry): string => strtolower(trim($entry)),
1296		- explode(',', $raw)
1297		- ),
1298		- 'strlen'
1299		- );
1300		- }
1301		-
1302		- if (self::$exemptAddressCache === []) {
1303		- return false;
1304		- }
1305		-
1306		- $address = strtolower(trim($address));
1307		-
1308		- if (in_array($address, self::$exemptAddressCache, true)) {
1309		- return true;
1310		- }
1311		-
1312		- if (in_array(current_filter(), self::VISITOR_WRITTEN_FILTERS, true)) {
1313		- return false;
1314		- }
1315		-
1316		- $at = strrpos($address, '@');
1317		-
1318		- if ($at === false) {
1319		- return false;
1320		- }
1321		-
1322		- return in_array(substr($address, $at), self::$exemptAddressCache, true);
1323		- }
1324		-
1325		- /**
1326	495	* Check if the given match is in the whitelist.
1327	496	*
1328	497	* @param array $Match The match to check against the whitelist.
1329	498	*
		@@ -1330,20 +499,12 @@
1330	499	* @return bool True if the match is in the whitelist, false otherwise.
1331	500	*/
1332	501	private function inWhiteList(array $Match): bool
1333	502	{
1334		- if (self::$whiteListCache === null) {
1335		- $raw = (string) (self::$cryptXOptions['whiteList'] ?? '');
1336		- self::$whiteListCache = array_filter(array_map('trim', explode(',', $raw)), 'strlen');
1337		- }
1338		-
1339		- if (self::$whiteListCache === []) {
1340		- return false;
1341		- }
1342		-
	503	+ $whiteList = array_filter(array_map('trim', explode(",", self::$cryptXOptions['whiteList'])));
1343	504	$tmp = explode(".", $Match[0]);
1344	505
1345		- return in_array(end($tmp), self::$whiteListCache, true);
	506	+ return in_array(end($tmp), $whiteList);
1346	507	}
1347	508
1348	509	/**
1349	510	* Get the link text from cryptXOptions
		@@ -1351,19 +512,9 @@
1351	512	* @return string The link text
1352	513	*/
1353	514	private function getLinkText(): string
1354	515	{
1355		- // Escaped here rather than at the source: a shortcode attribute of the
1356		- // same name reaches self::$cryptXOptions without passing through the
1357		- // settings validation at all.
1358		- //
1359		- // esc_html and not wp_kses_post, although the settings screen stores
1360		- // the value with wp_kses_post: the link text sits inside an anchor that
1361		- // CryptX builds itself, and markup there could close that anchor early.
1362		- // The two stages therefore mean different things on purpose -- storage
1363		- // keeps what a post may contain, output shows it as text. See
1364		- // SettingsSchema::sanitizeValue().
1365		- return esc_html((string) self::$cryptXOptions['alt_linktext']);
	516	+ return self::$cryptXOptions['alt_linktext'];
1366	517	}
1367	518
1368	519	/**
1369	520	* Generate an HTML image tag with the link image URL as the source
		@@ -1371,17 +522,9 @@
1371	522	* @return string The HTML image tag
1372	523	*/
1373	524	private function getLinkImage(): string
1374	525	{
1375		- self::$styleNeeded = true;
1376		- $title = (string) self::$cryptXOptions['alt_linkimage_title'];
1377		-
1378		- return sprintf(
1379		- '<img src="%s" class="cryptxImage" alt="%s" title="%s" />',
1380		- esc_url(self::$cryptXOptions['alt_linkimage']),
1381		- esc_attr($title),
1382		- esc_attr(antispambot($title))
1383		- );
	526	+ return "<img src=\"" . self::$cryptXOptions['alt_linkimage'] . "\" class=\"cryptxImage\" alt=\"" . self::$cryptXOptions['alt_linkimage_title'] . "\" title=\"" . antispambot(self::$cryptXOptions['alt_linkimage_title']) . "\" />";
1384	527	}
1385	528
1386	529	/**
1387	530	* Get the HTML tag for an uploaded image.
		@@ -1391,20 +534,9 @@
1391	534	* @return string The HTML tag for the image.
1392	535	*/
1393	536	private function getUploadedImage(string $img_url): string
1394	537	{
1395		- self::$styleNeeded = true;
1396		- $title = (string) self::$cryptXOptions['http_linkimage_title'];
1397		-
1398		- // The alt attribute used to be missing its closing quote, which ran the
1399		- // title straight into it and produced broken markup.
1400		- return sprintf(
1401		- '<img src="%s" class="cryptxImage cryptxImage_%d" alt="%s" title="%s" />',
1402		- esc_url($img_url),
1403		- self::$imageCounter,
1404		- esc_attr($title),
1405		- esc_attr(antispambot($title))
1406		- );
	538	+ return "<img src=\"" . $img_url . "\" class=\"cryptxImage cryptxImage_" . self::$imageCounter . "\" alt=\"" . self::$cryptXOptions['http_linkimage_title'] . " title=\"" . antispambot(self::$cryptXOptions['http_linkimage_title']) . "\" />";
1407	539	}
1408	540
1409	541	/**
1410	542	* Converts a matched image URL into an HTML image element with cryptX classes and attributes.
		@@ -1414,68 +546,9 @@
1414	546	* @return string Returns the HTML image element.
1415	547	*/
1416	548	private function getImageFromText(array $Match): string
1417	549	{
1418		- self::$styleNeeded = true;
1419		-
1420		- $address = (string) $Match[1];
1421		-
1422		- // Until 4.2.0 this put antispambot($address) into the URL, the alt and
1423		- // the title. Entity-encoding stops nothing that decodes entities -- and
1424		- // the browser decodes them before it makes the request, so the address
1425		- // travelled in the request line of every image load: into the access
1426		- // log, and through every proxy and CDN on the way. A visitor's browser
1427		- // handed the address to more machines than a plainly written one would
1428		- // have.
1429		-
1430		- // Built before the token, because the fallback below needs it too.
1431		- //
1432		- // _x() rather than __(): on its own the phrase could be a field label,
1433		- // a heading or a column name, and a translator seeing it in a list has
1434		- // no way to tell.
1435		- $label = _x(
1436		- 'Email address',
1437		- 'alt text of the picture that shows an email address',
1438		- 'cryptx'
1439		- );
1440		-
1441		- $token = ImageToken::mint($address);
1442		-
1443		- if ($token === '') {
1444		- // No token, no picture. Three answers were possible and two are
1445		- // wrong. Falling back to the old URL would put the address straight
1446		- // back where this took it out. Returning an empty string leaves
1447		- // "<a href=\"#\" data-cx=\"...\"></a>" -- a link with nothing in it,
1448		- // invisible on the page and nameless to a screen reader.
1449		- //
1450		- // The third, and the tempting one, is the ordinary obfuscated text.
1451		- // It writes the address as " [at] " and " [dot] ", which any
1452		- // harvester undoes with a single regular expression -- and escaping
1453		- // exactly that is why somebody chose this variant. Worse, those two
1454		- // separators are free-text settings: a site that put them back to
1455		- // "@" and "." would have the address written out in full.
1456		- //
1457		- // So the label the picture would have carried, and no address
1458		- // anywhere.
1459		- return esc_html($label);
1460		- }
1461		-
1462		- // Not the address in the alt attribute either. An alt is read out by
1463		- // screen readers and indexed by crawlers alike; putting the address
1464		- // there would hand it to both, and the link works for either of them
1465		- // without it. "Email address" says what the picture is, which is what
1466		- // an alt attribute is for.
1467		-
1468		- // No title attribute. It used to repeat the alt text, which some
1469		- // assistive software then reads out twice and which adds nothing for
1470		- // anybody else. While both carried the address that was merely
1471		- // pointless; now it would be noise.
1472		- return sprintf(
1473		- '<img src="%s" class="cryptxImage cryptxImage_%d" alt="%s" />',
1474		- esc_url(get_bloginfo('url') . '/' . md5(get_bloginfo('url')) . '/' . $token),
1475		- self::$imageCounter,
1476		- esc_attr($label)
1477		- );
	550	+ return "<img src=\"" . get_bloginfo('url') . "/" . md5(get_bloginfo('url')) . "/" . antispambot($Match[1]) . "\" class=\"cryptxImage cryptxImage_" . self::$imageCounter . "\" alt=\"" . antispambot($Match[1]) . "\" title=\"" . antispambot($Match[1]) . "\" />";
1478	551	}
1479	552
1480	553	/**
1481	554	* Replaces specific characters with values from cryptX options in a given string.
		@@ -1489,19 +562,11 @@
1489	562	* for each element.
1490	563	*/
1491	564	private function getDefaultLinkText(array $Match): string
1492	565	{
1493		- // Escaped here for the same reason as in getLinkText(): the settings
1494		- // page runs both values through wp_kses_post(), but a shortcode
1495		- // attribute of the same name reaches self::$cryptXOptions unfiltered.
1496		- // Today only KSES stops an author from putting markup here -- that is
1497		- // WordPress protecting the plugin, not the plugin protecting itself.
1498		- $at = esc_html((string) self::$cryptXOptions['at']);
1499		- $dot = esc_html((string) self::$cryptXOptions['dot']);
	566	+ $text = str_replace("@", self::$cryptXOptions['at'], $Match[1]);
1500	567
1501		- $text = str_replace("@", $at, $Match[1]);
1502		-
1503		- return str_replace(".", $dot, $text);
	568	+ return str_replace(".", self::$cryptXOptions['dot'], $text);
1504	569	}
1505	570
1506	571	/**
1507	572	* List all files in a directory that match the given filter.
		@@ -1513,26 +578,17 @@
1513	578	* @return array An array of file names that match the filter.
1514	579	*/
1515	580	public function getFilesInDirectory(string $path, array $filter): array
1516	581	{
1517		- if (!is_dir($path)) {
1518		- return [];
1519		- }
1520		-
1521		- $directoryContent = [];
1522		- foreach (new \DirectoryIterator($path) as $file) {
1523		- if (!$file->isFile()) {
1524		- continue;
	582	+ $directoryHandle = opendir($path);
	583	+ $directoryContent = array();
	584	+ while ($file = readdir($directoryHandle)) {
	585	+ $fileExtension = substr(strtolower($file), -3);
	586	+ if (in_array($fileExtension, $filter)) {
	587	+ $directoryContent[] = $file;
1525	588	}
1526		- if (in_array(strtolower($file->getExtension()), $filter, true)) {
1527		- $directoryContent[] = $file->getFilename();
1528		- }
1529	589	}
1530	590
1531		- // readdir() order depends on the file system, which made the default
1532		- // font differ between servers. Sorting keeps it reproducible.
1533		- sort($directoryContent);
1534		-
1535	591	return $directoryContent;
1536	592	}
1537	593
1538	594	/**
		@@ -1554,14 +610,8 @@
1554	610	if ($content === null) {
1555	611	return null;
1556	612	}
1557	613
1558		- // A mailto link without an at sign cannot carry an address. Cheapest
1559		- // possible way out before the regular expression runs.
1560		- if (strpos($content, '@') === false) {
1561		- return $content;
1562		- }
1563		-
1564	614	// Check if current filter is a widget filter
1565	615	$widgetFilters = $this->config->getWidgetFilters();
1566	616	$isWidgetContext = in_array(current_filter(), $widgetFilters);
1567	617
		@@ -1567,32 +617,139 @@
1567	617
1568	618	$postId = (is_object($post)) ? $post->ID : -1;
1569	619	$isIdExcluded = $this->isIdExcluded($postId);
1570	620
1571		- // Quoted attribute values may contain ">", so the tag must not simply
1572		- // end at the first one -- title="a > b" used to cut the match in half
1573		- // and produce mangled markup. Same construction as in
1574		- // rewriteOpeningAnchorTag(); the two have to agree on what a tag is.
1575		- $mailtoRegex = '/<a\b(?:[^>"\']|"[^"]*"|\'[^\']*\')*?href\s*=\s*(["\'])mailto:([^"\']+)\1(?:[^>"\']|"[^"]*"|\'[^\']*\')*>(.*?)<\/a>/is';
1576		- $that = $this;
	621	+ $mailtoRegex = '/<a\s+[^>]*href=(["\'])mailto:([^"\']+)\1[^>]*>(.*?)<\/a>/is';
1577	622
1578	623	// For widgets, always process since there's no specific post context
1579	624	// For other content, check exclusion rules
1580	625	if ($isWidgetContext || !$isIdExcluded || $shortcode) {
1581		- $content = $this->withShortcodesProtected($content, static function (string $masked) use ($mailtoRegex, $that): string {
1582		- $result = preg_replace_callback($mailtoRegex, [$that, 'encryptEmailAddressSecure'], $masked);
	626	+ // $content = preg_replace_callback($mailtoRegex, [$this, 'encryptEmailAddressNew'], $content);
	627	+ $content = preg_replace_callback($mailtoRegex, [$this, 'encryptEmailAddressSecure'], $content);
	628	+ }
1583	629
1584		- // null means PCRE gave up (backtrack limit). Keeping the
1585		- // original content is far better than returning null and
1586		- // wiping the page.
1587		- return $result ?? $masked;
1588		- });
	630	+ return $content;
	631	+ }
	632	+
	633	+
	634	+ /**
	635	+ * Encrypts email addresses in search results.
	636	+ *
	637	+ * @param array $searchResults The search results containing email addresses.
	638	+ *
	639	+ * @return string The search results with encrypted email addresses.
	640	+ */
	641	+ private function encryptEmailAddress(array $searchResults): string
	642	+ {
	643	+ $originalValue = $searchResults[0];
	644	+
	645	+ if (strpos($searchResults[self::INDEX_TO_CHECK], '@') === self::NOT_FOUND) {
	646	+ return $originalValue;
1589	647	}
1590	648
1591		- return $content;
	649	+ $mailReference = self::MAIL_IDENTIFIER . $searchResults[self::INDEX_TO_CHECK];
	650	+
	651	+ if (str_starts_with($searchResults[self::INDEX_TO_CHECK], self::SUBJECT_IDENTIFIER)) {
	652	+ return $originalValue;
	653	+ }
	654	+
	655	+ $return = $originalValue;
	656	+
	657	+ // Apply JavaScript handler if enabled
	658	+ if (!empty(self::$cryptXOptions['java'])) {
	659	+ $javaHandler = "javascript:DeCryptX('" . $this->generateHashFromString($searchResults[self::INDEX_TO_CHECK]) . "')";
	660	+ $return = str_replace(self::MAIL_IDENTIFIER . $searchResults[self::INDEX_TO_CHECK], $javaHandler, $originalValue);
	661	+ } else {
	662	+ // Only apply antispambot if JavaScript is not enabled
	663	+ $return = str_replace($mailReference, antispambot($mailReference), $return);
	664	+ }
	665	+
	666	+ // Add CSS attributes if specified
	667	+ if (!empty(self::$cryptXOptions['css_id'])) {
	668	+ $return = preg_replace(self::PATTERN, '$1" id="' . self::$cryptXOptions['css_id'] . '">', $return);
	669	+ }
	670	+
	671	+ if (!empty(self::$cryptXOptions['css_class'])) {
	672	+ $return = preg_replace(self::PATTERN, '$1" class="' . self::$cryptXOptions['css_class'] . '">', $return);
	673	+ }
	674	+
	675	+ return $return;
1592	676	}
1593	677
1594	678	/**
	679	+ * Encrypts an email address within the provided search results and generates a secure or obfuscated link.
	680	+ * If secure encryption is enabled, the function uses secure encryption. Otherwise, it falls back to legacy methods
	681	+ * or antispambot obfuscation if JavaScript is not enabled. Additional CSS attributes can be added if specified.
	682	+ *
	683	+ * @param array $searchResults The array containing match results:
	684	+ * - Index 0: The full match value (original string),
	685	+ * - Index 2: The email address to encrypt,
	686	+ * - Index 3: The link text for the email link.
	687	+ * @return string Returns the modified string where the email address is encrypted or obfuscated based on the configuration.
	688	+ */
	689	+ private function encryptEmailAddressNew(array $searchResults): string
	690	+ {
	691	+ $originalValue = $searchResults[0]; // Full match
	692	+ $emailAddress = $searchResults[2]; // Email address (now at index 2)
	693	+ $linkText = $searchResults[3]; // Link text (now at index 3)
	694	+
	695	+ if (strpos($emailAddress, '@') === self::NOT_FOUND) {
	696	+ return $originalValue;
	697	+ }
	698	+
	699	+ if (str_starts_with($emailAddress, self::SUBJECT_IDENTIFIER)) {
	700	+ return $originalValue;
	701	+ }
	702	+
	703	+ $return = $originalValue;
	704	+
	705	+ // Apply JavaScript handler if enabled
	706	+ if (!empty(self::$cryptXOptions['java'])) {
	707	+ // Check if secure encryption is enabled and working
	708	+ if ($this->config->isSecureEncryptionEnabled()) {
	709	+ try {
	710	+ // Use secure encryption - encrypt the full mailto URL
	711	+ $password = $this->config->getEncryptionPassword();
	712	+ $mailtoUrl = 'mailto:' . $emailAddress;
	713	+ $encryptedEmail = SecureEncryption::encrypt($mailtoUrl, $password);
	714	+
	715	+ $javaHandler = "javascript:secureDecryptAndNavigate('" .
	716	+ $this->escapeJavaScript($encryptedEmail) . "', '" .
	717	+ $this->escapeJavaScript($password) . "')";
	718	+ } catch (\Exception $e) {
	719	+ // Fallback to legacy encryption if secure encryption fails
	720	+ error_log('CryptX Secure Encryption failed: ' . $e->getMessage());
	721	+ $encryptedEmail = $this->generateHashFromString($emailAddress);
	722	+ $javaHandler = "javascript:DeCryptX('" . $this->escapeJavaScript($encryptedEmail) . "')";
	723	+ }
	724	+ } else {
	725	+ // Use legacy encryption
	726	+ $encryptedEmail = $this->generateHashFromString($emailAddress);
	727	+ $javaHandler = "javascript:DeCryptX('" . $this->escapeJavaScript($encryptedEmail) . "')";
	728	+ }
	729	+
	730	+ $return = str_replace('mailto:' . $emailAddress, $javaHandler, $originalValue);
	731	+ } else {
	732	+ // Fallback to antispambot if JavaScript is not enabled
	733	+ $return = str_replace('mailto:' . $emailAddress,
	734	+ antispambot('mailto:' . $emailAddress), $return);
	735	+ }
	736	+
	737	+ // Add CSS attributes if specified
	738	+ if (!empty(self::$cryptXOptions['css_id'])) {
	739	+ $return = preg_replace('/(<a\s+[^>]*)(>)/i',
	740	+ '$1 id="' . self::$cryptXOptions['css_id'] . '"$2', $return);
	741	+ }
	742	+
	743	+ if (!empty(self::$cryptXOptions['css_class'])) {
	744	+ $return = preg_replace('/(<a\s+[^>]*)(>)/i',
	745	+ '$1 class="' . self::$cryptXOptions['css_class'] . '"$2', $return);
	746	+ }
	747	+
	748	+ return $return;
	749	+ }
	750	+
	751	+ /**
1595	752	* Generate a hash string for the given input string.
1596	753	*
1597	754	* @param string $inputString The input string to generate a hash for.
1598	755	*
		@@ -1604,9 +761,9 @@
1604	761	$crypt = '';
1605	762
1606	763	for ($i = 0; $i < strlen($inputString); $i++) {
1607	764	do {
1608		- $salt = wp_rand(0, 3);
	765	+ $salt = mt_rand(0, 3);
1609	766	$asciiValue = ord(substr($inputString, $i)) + $salt;
1610	767	if (8364 <= $asciiValue) {
1611	768	$asciiValue = 128;
1612	769	}
		@@ -1632,32 +789,8 @@
1632	789	public function addLinkToEmailAddresses(string $content, bool $shortcode = false): string
1633	790	{
1634	791	global $post;
1635	792
1636		- // The same gate the other two stages carry, and missing here until
1637		- // 4.1.1. "Leave RSS feeds unprotected" is meant as "do not touch
1638		- // feeds"; without this, the autolink stage still turned a bare address
1639		- // into a mailto link in the feed, while the two stages that protect it
1640		- // stepped aside. The result was not a leak -- with the option on, the
1641		- // address is in the feed either way -- but it was CryptX changing
1642		- // content it had just been told to leave alone.
1643		- //
1644		- // The $shortcode exception is made here and not in the other two
1645		- // stages: those bail out of a feed unconditionally. Keeping it means
1646		- // the shortcode path behaves exactly as it did before this guard
1647		- // existed, which is the point -- the shortcode is an explicit
1648		- // instruction and outranks a blanket setting.
1649		- if (!$shortcode && self::$cryptXOptions['disable_rss'] && $this->isRssFeed()) {
1650		- return $content;
1651		- }
1652		-
1653		- // Eight regular expressions follow, each carrying the full address
1654		- // pattern. Without an at sign not one of them can match, so this test
1655		- // saves the entire pass.
1656		- if (strpos($content, '@') === false) {
1657		- return $content;
1658		- }
1659		-
1660	793	// Check if current filter is a widget filter
1661	794	$widgetFilters = $this->config->getWidgetFilters();
1662	795	$isWidgetContext = in_array(current_filter(), $widgetFilters);
1663	796
		@@ -1669,29 +802,14 @@
1669	802	}
1670	803
1671	804	$emailPattern = "[_a-zA-Z0-9-+]+(\\.[_a-zA-Z0-9-+]+)*@[a-zA-Z0-9-]+(\\.[a-zA-Z0-9-]+)*(\\.[a-zA-Z]{2,})";
1672	805	$linkPattern = "<a href=\"mailto:\\2\">\\2</a>";
1673		- // Two widenings, both from the same report. The patterns after ">"
1674		- // required a "<" or whitespace to follow, so an address that ended the
1675		- // string right after a tag -- "Kontakt:<br>info@example.com" -- was
1676		- // never linked; hence the "$" variant. And they accepted only ">",
1677		- // while wp_kses_post() turns a bare ">" into "&gt;", leaving a ";"
1678		- // in front of the address; hence "[>;]", which covers the end of any
1679		- // HTML entity.
1680		- //
1681		- // In post content neither showed much, because a closing tag almost
1682		- // always follows an address. Through cryptx_encrypt() both showed every
1683		- // time. Worse than the missing link was what came next: the display
1684		- // stage still swapped the address for the configured link text, so the
1685		- // address vanished from the page without anything working taking its
1686		- // place.
1687	806	$src = [
1688	807	"/([\\s])($emailPattern)/si",
1689		- "/([>;])($emailPattern)(<)/si",
	808	+ "/(>)($emailPattern)(<)/si",
1690	809	"/(\\()($emailPattern)(\\))/si",
1691		- "/([>;])($emailPattern)([\\s])/si",
	810	+ "/(>)($emailPattern)([\\s])/si",
1692	811	"/([\\s])($emailPattern)(<)/si",
1693		- "/([>;])($emailPattern)$/si",
1694	812	"/^($emailPattern)/si",
1695	813	"/(<a[^>]*>)<a[^>]*>/",
1696	814	"/(<\\/A>)<\\/A>/i"
1697	815	];
		@@ -1700,30 +818,14 @@
1700	818	"\\1$linkPattern\\6",
1701	819	"\\1$linkPattern\\6",
1702	820	"\\1$linkPattern\\6",
1703	821	"\\1$linkPattern\\6",
1704		- "\\1$linkPattern",
1705	822	"<a href=\"mailto:\\0\">\\0</a>",
1706	823	"\\1",
1707	824	"\\1"
1708	825	];
1709	826
1710		- return $this->withShortcodesProtected($content, function (string $masked) use ($src, $tar): string {
1711		- // Exempt addresses are set aside for the duration. The eight
1712		- // patterns below are a preg_replace, not a callback, so there is no
1713		- // per-match decision to hook into -- and rewriting that machinery
1714		- // to get one would risk far more than it buys.
1715		- return $this->withExemptAddressesProtected(
1716		- $masked,
1717		- static function (string $inner) use ($src, $tar): string {
1718		- $result = preg_replace($src, $tar, $inner);
1719		-
1720		- // Same reasoning as elsewhere: a PCRE failure yields null,
1721		- // and handing that on would silently empty the page.
1722		- return $result ?? $inner;
1723		- }
1724		- );
1725		- });
	827	+ return preg_replace($src, $tar, $content);
1726	828	}
1727	829
1728	830	/**
1729	831	* Installs the CryptX plugin by updating its options and loading default values.
		@@ -1730,57 +832,12 @@
1730	832	*/
1731	833	public function installCryptX(): void
1732	834	{
1733	835	global $wpdb;
1734		-
1735		- // Load-bearing, not a duplicate of the 'switch_blog' hook -- do not
1736		- // remove it as one. When a plugin is activated, WordPress includes its
1737		- // file from activate_plugin(), long after plugins_loaded has fired, so
1738		- // startCryptX() never runs in that request and the hook is not
1739		- // registered. Measured: activating an inactive plugin, has_action(
1740		- // 'switch_blog') is false throughout. Without this line the network
1741		- // activation loop writes site 1's values into every other site --
1742		- // secret, link text and exclusion list -- which is how the bug was
1743		- // found in the first place.
1744		- $this->refreshForCurrentSite();
1745		-
1746		- // Nothing is written into a site whose tables do not exist yet.
1747		- // refreshForCurrentSite() returns early in that case WITHOUT touching
1748		- // the static option list -- and that list is static, so it survives
1749		- // switch_to_blog(). The update_option() at the end of this method would
1750		- // then write the PREVIOUS site's values into the new one, exclusion
1751		- // list included: the 4.1.1 bug, reached through a different door.
1752		- //
1753		- // No caller does that today (wp_initialize_site runs at priority 20,
1754		- // after the tables exist), which is exactly why this is here: the
1755		- // guarantee should not depend on the priority of somebody else's hook.
1756		- if (is_multisite() && !wp_is_site_initialized(get_current_blog_id())) {
1757		- return;
1758		- }
1759		-
1760		- // A site that has never stored anything starts from the network's
1761		- // defaults rather than the plugin's. Only then: a site with a stored
1762		- // option has an administrator who chose something, and a network
1763		- // default is a starting point, not an instruction. Getting that
1764		- // backwards is how 4.1.1 came to publish addresses on sites whose
1765		- // owners had excluded them -- the two settings that caused it are not
1766		- // shareable at all, see Admin\NetworkDefaults.
1767		- if (is_multisite() && get_option('cryptX', null) === null) {
1768		- self::$cryptXOptions = array_merge(
1769		- self::$cryptXOptions,
1770		- Admin\NetworkDefaults::forNewSite()
1771		- );
1772		- }
1773		-
1774	836	self::$cryptXOptions['admin_notices_deprecated'] = true;
1775	837	if (self::$cryptXOptions['excludedIDs'] == "") {
1776	838	$tmp = array();
1777		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
1778		- $excludes = $wpdb->get_results($wpdb->prepare(
1779		- "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s",
1780		- 'cryptxoff',
1781		- 'true'
1782		- ));
	839	+ $excludes = $wpdb->get_results("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'cryptxoff' AND meta_value = 'true'");
1783	840	if (count($excludes) > 0) {
1784	841	foreach ($excludes as $exclude) {
1785	842	$tmp[] = $exclude->post_id;
1786	843	}
		@@ -1787,20 +844,13 @@
1787	844	sort($tmp);
1788	845	self::$cryptXOptions['excludedIDs'] = implode(",", $tmp);
1789	846	update_option('cryptX', self::$cryptXOptions);
1790	847	self::$cryptXOptions = $this->loadCryptXOptionsWithDefaults(); // reread Options
1791		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
1792		- $wpdb->query($wpdb->prepare(
1793		- "DELETE FROM {$wpdb->postmeta} WHERE meta_key = %s",
1794		- 'cryptxoff'
1795		- ));
	848	+ $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'cryptxoff'");
1796	849	}
1797	850	}
1798	851	if (empty(self::$cryptXOptions['c2i_font'])) {
1799		- // Only the file name is stored here. cryptXtinyUrl() prepends
1800		- // CRYPTX_DIR_PATH . 'fonts/' itself, so an absolute path would
1801		- // produce an unusable font path.
1802		- self::$cryptXOptions['c2i_font'] = $this->getDefaultFont();
	852	+ self::$cryptXOptions['c2i_font'] = CRYPTX_DIR_PATH . 'fonts/' . $firstFont[0];
1803	853	}
1804	854	if (empty(self::$cryptXOptions['c2i_fontSize'])) {
1805	855	self::$cryptXOptions['c2i_fontSize'] = 10;
1806	856	}
		@@ -1834,19 +884,13 @@
1834	884	**/
1835	885	public function metaCheckbox(): void
1836	886	{
1837	887	global $post;
1838		-
1839		- if (!is_object($post)) {
1840		- return;
1841		- }
1842		-
1843		- wp_nonce_field(self::METABOX_NONCE_ACTION, self::METABOX_NONCE_FIELD);
1844	888	?>
1845	889	<label><input type="checkbox" name="disable_cryptx_pageid" <?php if ($this->isIdExcluded($post->ID)) {
1846	890	echo 'checked="checked"';
1847	891	} ?>/>
1848		- <?php esc_html_e('Disable CryptX for this post/page', 'cryptx'); ?></label>
	892	+ Disable CryptX for this post/page</label>
1849	893	<?php
1850	894	}
1851	895
1852	896	/**
		@@ -1857,24 +901,20 @@
1857	901	*/
1858	902	public function metaOptionFieldset(): void
1859	903	{
1860	904	global $post;
1861		-
1862		- if (!is_object($post) || !current_user_can('edit_post', $post->ID)) {
1863		- return;
	905	+ if (current_user_can('edit_posts')) { ?>
	906	+ <fieldset id="cryptxoption" class="dbx-box">
	907	+ <h3 class="dbx-handle">CryptX</h3>
	908	+ <div class="dbx-content">
	909	+ <label><input type="checkbox"
	910	+ name="disable_cryptx_pageid" <?php if ($this->isIdExcluded($post->ID)) {
	911	+ echo 'checked="checked"';
	912	+ } ?>/> Disable CryptX for this post/page</label>
	913	+ </div>
	914	+ </fieldset>
	915	+ <?php
1864	916	}
1865		- ?>
1866		- <fieldset id="cryptxoption" class="dbx-box">
1867		- <h3 class="dbx-handle">CryptX</h3>
1868		- <div class="dbx-content">
1869		- <?php wp_nonce_field(self::METABOX_NONCE_ACTION, self::METABOX_NONCE_FIELD); ?>
1870		- <label><input type="checkbox"
1871		- name="disable_cryptx_pageid" <?php if ($this->isIdExcluded($post->ID)) {
1872		- echo 'checked="checked"';
1873		- } ?>/> <?php esc_html_e('Disable CryptX for this post/page', 'cryptx'); ?></label>
1874		- </div>
1875		- </fieldset>
1876		- <?php
1877	917	}
1878	918
1879	919	/**
1880	920	* Adds a post ID to the excluded list in the cryptX options.
		@@ -1884,49 +924,12 @@
1884	924	* @return void
1885	925	*/
1886	926	public function addPostIdToExcludedList(int $postId): void
1887	927	{
1888		- // The meta box has to have taken part in this request. Without this
1889		- // gate every save that carries no $_POST at all -- REST, WP-CLI,
1890		- // autosave, the block editor's first pass -- removed the post from the
1891		- // exclusion list and silently switched CryptX back on for it.
1892		- //
1893		- // The gate hangs on the nonce, deliberately not on the checkbox: an
1894		- // unchecked box is not submitted at all, so "checkbox missing" would
1895		- // mean both "meta box was not involved" and "user cleared the tick".
1896		- // Guarding on that would make an excluded post impossible to include
1897		- // again.
1898		- if (!isset($_POST[self::METABOX_NONCE_FIELD])) {
1899		- return;
1900		- }
1901		-
1902		- $nonce = sanitize_text_field(wp_unslash($_POST[self::METABOX_NONCE_FIELD]));
1903		- if (!wp_verify_nonce($nonce, self::METABOX_NONCE_ACTION)) {
1904		- return;
1905		- }
1906		-
1907	928	$postId = wp_is_post_revision($postId) ?: $postId;
1908		-
1909		- if (!current_user_can('edit_post', $postId)) {
1910		- return;
1911		- }
1912		-
1913		- // Read the option fresh instead of writing back self::$cryptXOptions.
1914		- // That property is static and the shortcode overwrites it while it
1915		- // runs; storing it wholesale could persist a shortcode's temporary
1916		- // values. Only the one key we are responsible for is touched.
1917		- $options = get_option('cryptX', []);
1918		- if (!is_array($options)) {
1919		- $options = [];
1920		- }
1921		-
1922		- $excludedIds = $this->updateExcludedIdsList((string) ($options['excludedIDs'] ?? ''), $postId);
1923		- $options['excludedIDs'] = implode(',', array_filter($excludedIds));
1924		-
1925		- update_option('cryptX', $options);
1926		-
1927		- self::$cryptXOptions['excludedIDs'] = $options['excludedIDs'];
1928		- self::resetOptionCaches();
	929	+ $excludedIds = $this->updateExcludedIdsList(self::$cryptXOptions['excludedIDs'], $postId);
	930	+ self::$cryptXOptions['excludedIDs'] = implode(",", array_filter($excludedIds));
	931	+ update_option('cryptX', self::$cryptXOptions);
1929	932	}
1930	933
1931	934	/**
1932	935	* Updates the excluded IDs list based on a given ID and the current list.
		@@ -1974,18 +977,8 @@
1974	977	* @return array The updated array of excluded IDs.
1975	978	*/
1976	979	private function addPostIdToExcludedIdsIfNecessary(array $excludedIds, int $postId): array
1977	980	{
1978		- // The only caller, addPostIdToExcludedList(), checks the nonce field,
1979		- // then wp_verify_nonce(), then current_user_can('edit_post', $postId)
1980		- // before reaching this method. The scanner cannot follow three call
1981		- // levels and sees only the superglobal. Read as presence or absence of
1982		- // a checkbox; the value is never used.
1983		- //
1984		- // The annotation has to sit on the line directly above the statement --
1985		- // with the explanation above it, it silenced the next comment line and
1986		- // the warning stayed.
1987		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
1988	981	if (isset($_POST['disable_cryptx_pageid'])) {
1989	982	$excludedIds[] = $postId;
1990	983	}
1991	984
		@@ -2007,8 +1000,27 @@
2007	1000	return $excludedIds;
2008	1001	}
2009	1002
2010	1003	/**
	1004	+ * Displays a message in a styled div.
	1005	+ *
	1006	+ * @param string $message The message to be displayed.
	1007	+ * @param bool $errormsg Optional. Indicates whether the message is an error message. Default is false.
	1008	+ *
	1009	+ * @return void
	1010	+ */
	1011	+ private function showMessage(string $message, bool $errormsg = false): void
	1012	+ {
	1013	+ if ($errormsg) {
	1014	+ echo '<div id="message" class="error">';
	1015	+ } else {
	1016	+ echo '<div id="message" class="updated fade">';
	1017	+ }
	1018	+
	1019	+ echo "$message</div>";
	1020	+ }
	1021	+
	1022	+ /**
2011	1023	* Retrieves the domain from the current site URL.
2012	1024	*
2013	1025	* @return string The domain of the current site URL.
2014	1026	*/
		@@ -2055,117 +1067,19 @@
2055	1067	return $domain;
2056	1068	}
2057	1069
2058	1070	/**
2059		- * Registers the frontend assets.
	1071	+ * Loads Javascript files required for CryptX functionality.
2060	1072	*
2061		- * Registering is not loading. Whether the files end up on the page is
2062		- * decided in enqueueAssetsIfNeeded() once the content has been processed
2063		- * and it is known whether anything was encrypted at all.
2064		- *
2065		- * One exception: with the script placed in the head (load_java = 0) that
2066		- * decision cannot be deferred -- the head is sent before the content runs.
2067		- * In that configuration the script is enqueued unconditionally, as before.
2068		- *
2069		- * That head branch deliberately does not look at "java" at all, and never
2070		- * did -- this method leaves it untouched. It follows that a
2071		- * "[cryptx java=...]" shortcode override has nothing to add there: the
2072		- * script is already on every page regardless of the global setting, so
2073		- * only the footer branch below needs to read "java" or care about a
2074		- * shortcode overriding it.
2075		- *
2076	1073	* @return void
2077	1074	*/
2078	1075	public function loadJavascriptFiles(): void
2079	1076	{
2080		- $inFooter = !empty(self::$cryptXOptions['load_java']);
2081		-
2082		- wp_register_script('cryptx-js', CRYPTX_DIR_URL . 'js/cryptx.min.js', [], CRYPTX_VERSION, $inFooter);
2083		- wp_localize_script('cryptx-js', 'cryptxConfig', SecureEncryption::getJavaScriptConfig());
2084		- wp_register_style('cryptx-styles', CRYPTX_DIR_URL . 'css/cryptx.css', [], CRYPTX_VERSION);
2085		-
2086		- if (!$inFooter) {
2087		- wp_enqueue_script('cryptx-js');
2088		- wp_enqueue_style('cryptx-styles');
2089		- } elseif (!empty(self::$cryptXOptions['java'])) {
2090		- // Footer placement, JavaScript handler enabled: enqueue cryptx-js
2091		- // unconditionally, here, before it is known whether THIS request's
2092		- // content carries an address. wp_register_script() above already
2093		- // registered it with $inFooter = true, so this does not move the
2094		- // print location -- it still prints in wp_footer, exactly as
2095		- // before. Deferring to enqueueAssetsIfNeeded() (scriptNeeded) only
2096		- // covers a classic page load, where the address a visitor clicks
2097		- // is guaranteed to be in the same document that carried the
2098		- // script. A client-side navigation (swup.js, PJAX, Barba, Turbo)
2099		- // can land a visitor on a page with no address at all and then
2100		- // drop .cryptx-link elements in later, without ever loading a
2101		- // second script -- the delegated handler in cryptx.js was simply
2102		- // never attached. See
2103		- // docs/entscheidungen/2026-09-11-assets-bei-clientseitiger-navigation.md
2104		- // for the analysis.
2105		- //
2106		- // Known remaining gap, not closable from here: this branch only
2107		- // reads the global "java" setting. A page whose first load carries
2108		- // no [cryptx java="1"] shortcode, under a global java = 0, still
2109		- // enqueues nothing here -- so a later client-side navigation to a
2110		- // page that DOES carry that shortcode still finds no click handler
2111		- // attached. See the decision doc above for why this is left open.
2112		- wp_enqueue_script('cryptx-js');
2113		- }
	1077	+ wp_enqueue_script('cryptx-js', CRYPTX_DIR_URL . 'js/cryptx.min.js', false, false, self::$cryptXOptions['load_java']);
	1078	+ wp_enqueue_style('cryptx-styles', CRYPTX_DIR_URL . 'css/cryptx.css');
2114	1079	}
2115	1080
2116	1081	/**
2117		- * Loads the assets that this page turned out to need.
2118		- *
2119		- * Runs late, in the footer, when every filter has done its work.
2120		- *
2121		- * @return void
2122		- */
2123		- public function enqueueAssetsIfNeeded(): void
2124		- {
2125		- if (self::$scriptNeeded) {
2126		- // Still needed as a net: a shortcode can set java=1 for its own
2127		- // instance while the global setting says java=0, since "java" is
2128		- // not in NOT_SETTABLE_BY_SHORTCODE. loadJavascriptFiles() only
2129		- // sees the global setting, so this is what catches that case. A
2130		- // second wp_enqueue_script() on an already-enqueued handle is a
2131		- // no-op.
2132		- wp_enqueue_script('cryptx-js');
2133		- }
2134		-
2135		- // wp_register_style() has no footer flag to lean on the way the
2136		- // script does, and enqueuing the stylesheet at wp_enqueue_scripts
2137		- // would move it from the footer to <head> -- a behaviour change for
2138		- // classic navigation, which is exactly what must not happen. So the
2139		- // same client-side-navigation gap for a configured picture variant
2140		- // (opt_linktext 2/3/5, the only settings that need img.cryptxImage
2141		- // { height: 1em }) is closed here instead, gated on the setting
2142		- // alone rather than on whether THIS request's content produced one.
2143		- if (self::$styleNeeded || self::isPictureLinktext((int) (self::$cryptXOptions['opt_linktext'] ?? 0))) {
2144		- wp_enqueue_style('cryptx-styles');
2145		- }
2146		- }
2147		-
2148		- /**
2149		- * Whether an opt_linktext setting renders links as pictures.
2150		- *
2151		- * Same known gap as the script branch in loadJavascriptFiles(), and purely
2152		- * cosmetic here: a page whose first load carries no picture-producing
2153		- * shortcode override, under a global opt_linktext that is not 2/3/5, still
2154		- * skips the stylesheet -- a later client-side navigation to a page that
2155		- * DOES render a picture link can arrive without img.cryptxImage. See
2156		- * docs/entscheidungen/2026-09-11-assets-bei-clientseitiger-navigation.md.
2157		- *
2158		- * @param int $optLinktext The opt_linktext setting value.
2159		- *
2160		- * @return bool
2161		- */
2162		- private static function isPictureLinktext(int $optLinktext): bool
2163		- {
2164		- return in_array($optLinktext, [2, 3, 5], true);
2165		- }
2166		-
2167		- /**
2168	1082	* Updates the CryptX settings.
2169	1083	*
2170	1084	* This method retrieves the current CryptX options from the database and checks if the version of CryptX
2171	1085	* stored in the options is less than the current version of CryptX. If the version is outdated, the method
		@@ -2175,74 +1089,27 @@
2175	1089	*/
2176	1090	private function updateCryptXSettings(): void
2177	1091	{
2178	1092	self::$cryptXOptions = get_option('cryptX');
2179		-
2180		- $storedVersion = self::$cryptXOptions['version'] ?? null;
2181		-
2182		- if ($storedVersion === null || version_compare(CRYPTX_VERSION, $storedVersion) <= 0) {
2183		- return;
2184		- }
2185		-
2186		- // Every step below used to run on EVERY version bump, although each was
2187		- // written for one particular upgrade. Measured on an installation
2188		- // carrying 4.1.0: the chosen font fell back to the first available one,
2189		- // the colour "#3366ff" became "##3366ff" -- gaining another "#" with
2190		- // every future update -- and the encryption secret was thrown away, so
2191		- // every link on an already cached page stopped resolving. None of that
2192		- // was intended, and none of it was visible to the site owner.
2193		- //
2194		- // Each migration is now tied to the version it belongs to, or written
2195		- // so that repeating it changes nothing.
2196		-
2197		- // Up to 4.0.11 the password was derived from AUTH_KEY and
2198		- // SECURE_AUTH_KEY, and that value is published in the markup of every
2199		- // page. Since site_url is public, an attacker could test candidate keys
2200		- // offline -- above all the placeholders from wp-config-sample.php that
2201		- // unattended installations still carry. Dropping it lets
2202		- // Config::getEncryptionPassword() mint a random one. The price is that
2203		- // links on pages already sitting in a cache stop resolving until that
2204		- // cache turns over, which is why it must happen exactly once.
2205		- if (version_compare($storedVersion, '4.0.12', '<')) {
2206		- unset(self::$cryptXOptions['encryption_password']);
2207		-
2208		- // 4.0.12 replaced the bundled Arial, Times New Roman and Verdana
2209		- // with freely licensed faces. A stored name from the old set no
2210		- // longer exists on disk, so the choice has to be made again.
2211		- unset(self::$cryptXOptions['c2i_font']);
2212		- }
2213		-
2214		- // Value-based rather than version-based, and therefore harmless to
2215		- // repeat: colours were stored without the leading "#" before 4.0.
2216		- if (!empty(self::$cryptXOptions['c2i_fontRGB'])
2217		- && strpos((string) self::$cryptXOptions['c2i_fontRGB'], '#') !== 0) {
2218		- self::$cryptXOptions['c2i_fontRGB'] = '#' . self::$cryptXOptions['c2i_fontRGB'];
2219		- }
2220		-
2221		- // Also value-based: an attachment id that is not an id is unusable, no
2222		- // matter which version wrote it.
2223		- if (isset(self::$cryptXOptions['alt_uploadedimage'])
2224		- && !is_int(self::$cryptXOptions['alt_uploadedimage'])
2225		- && !ctype_digit((string) self::$cryptXOptions['alt_uploadedimage'])) {
2226		- unset(self::$cryptXOptions['alt_uploadedimage']);
2227		-
2228		- if ((int) (self::$cryptXOptions['opt_linktext'] ?? 0) === 3) {
2229		- unset(self::$cryptXOptions['opt_linktext']);
	1093	+ if (isset(self::$cryptXOptions['version']) && version_compare(CRYPTX_VERSION, self::$cryptXOptions['version']) > 0) {
	1094	+ if (isset(self::$cryptXOptions['version'])) {
	1095	+ unset(self::$cryptXOptions['version']);
2230	1096	}
	1097	+ if (isset(self::$cryptXOptions['c2i_font'])) {
	1098	+ unset(self::$cryptXOptions['c2i_font']);
	1099	+ }
	1100	+ if (isset(self::$cryptXOptions['c2i_fontRGB'])) {
	1101	+ self::$cryptXOptions['c2i_fontRGB'] = "#" . self::$cryptXOptions['c2i_fontRGB'];
	1102	+ }
	1103	+ if (isset(self::$cryptXOptions['alt_uploadedimage']) && !is_int(self::$cryptXOptions['alt_uploadedimage'])) {
	1104	+ unset(self::$cryptXOptions['alt_uploadedimage']);
	1105	+ if (self::$cryptXOptions['opt_linktext'] == 3) {
	1106	+ unset(self::$cryptXOptions['opt_linktext']);
	1107	+ }
	1108	+ }
	1109	+ self::$cryptXOptions = wp_parse_args(self::$cryptXOptions, $this->getCryptXOptionsDefaults());
	1110	+ update_option('cryptX', self::$cryptXOptions);
2231	1111	}
2232		-
2233		- // Only a feature update earns a review prompt, and only in a fortnight
2234		- // -- Admin\ReviewNotice decides both, because that is where the rule
2235		- // can be read next to the reason for it. This is the only place that
2236		- // still knows which version was installed before.
2237		- self::$cryptXOptions = Admin\ReviewNotice::scheduleAfterUpdate(
2238		- self::$cryptXOptions,
2239		- (string) $storedVersion
2240		- );
2241		-
2242		- self::$cryptXOptions['version'] = CRYPTX_VERSION;
2243		- self::$cryptXOptions = wp_parse_args(self::$cryptXOptions, $this->getCryptXOptionsDefaults());
2244		- update_option('cryptX', self::$cryptXOptions);
2245	1112	}
2246	1113
2247	1114	/**
2248	1115	* Encodes a string by replacing special characters with their corresponding HTML entities.
		@@ -2284,9 +1151,9 @@
2284	1151	{
2285	1152	$string = "";
2286	1153	if (!empty($args)) {
2287	1154	foreach ($args as $key => $value) {
2288		- $string .= sprintf(" %s=\"%s\"", $key, esc_attr($value));
	1155	+ $string .= sprintf(" %s=\"%s\"", $key, $this->encodeString($value));
2289	1156	}
2290	1157	$string .= " encoded=\"true\"";
2291	1158	}
2292	1159
		@@ -2330,16 +1197,12 @@
2330	1197	* @return string The HTML link to the settings page.
2331	1198	*/
2332	1199	private function create_settings_link(): string
2333	1200	{
2334		- // Admin\SettingsPage::MENU_SLUG und nicht CRYPTX_BASEFOLDER: die
2335		- // Seite haengt am Slug, nicht am Verzeichnisnamen. Auf wordpress.org
2336		- // sind beide 'cryptx', nach einem Umbenennen des Ordners zeigte der
2337		- // Link ins Leere.
2338	1201	return sprintf(
2339		- '<a href="%s">%s</a>',
2340		- esc_url(admin_url('options-general.php?page=' . Admin\SettingsPage::MENU_SLUG)),
2341		- esc_html__('Settings', 'cryptx')
	1202	+ '<a href="options-general.php?page=%s">%s</a>',
	1203	+ CRYPTX_BASEFOLDER,
	1204	+ __('Settings')
2342	1205	);
2343	1206	}
2344	1207
2345	1208	/**
		@@ -2350,10 +1213,10 @@
2350	1213	private function create_donation_link(): string
2351	1214	{
2352	1215	return sprintf(
2353	1216	'<a href="%s">%s</a>',
2354		- esc_url(self::PAYPAL_DONATION_URL),
2355		- esc_html__('Donate', 'cryptx')
	1217	+ self::PAYPAL_DONATION_URL,
	1218	+ __('Donate', 'cryptx')
2356	1219	);
2357	1220	}
2358	1221
2359	1222	/**
		@@ -2367,23 +1230,18 @@
2367	1230	add_filter('widget_display_callback', [$this, 'processWidgetContent'], 10, 3);
2368	1231	}
2369	1232
2370	1233	/**
2371		- * Processes widget content to handle email addresses by adding links, identifying occurrences,
2372		- * and replacing them based on predefined rules.
	1234	+ * Processes the widget content to detect and modify email addresses.
2373	1235	*
2374		- * @param array|false $instance An array containing widget instance data, or false if no instance was provided.
2375		- * @param object $widget The widget object whose content is being processed.
2376		- * @param array $args Additional arguments provided to the widget.
	1236	+ * @param array $instance The current widget instance settings.
	1237	+ * @param object $widget The widget object being processed.
	1238	+ * @param array $args Additional arguments passed by the widget function.
2377	1239	*
2378		- * @return array|false Modified widget instance data as an array, or false if processing was not applicable.
	1240	+ * @return array The modified widget instance with updated content.
2379	1241	*/
2380		- public function processWidgetContent(array|false $instance, $widget, $args): array|false
	1242	+ public function processWidgetContent($instance, $widget, $args)
2381	1243	{
2382		- if ($instance === false) {
2383		- return false;
2384		- }
2385		-
2386	1244	// Only process if widget_text option is enabled
2387	1245	if (!(self::$cryptXOptions['widget_text'] ?? false)) {
2388	1246	return $instance;
2389	1247	}
		@@ -2405,206 +1263,54 @@
2405	1263	return $instance;
2406	1264	}
2407	1265
2408	1266	/**
2409		- * Enhanced email encryption with security validation
	1267	+ * Generates hash using secure or legacy encryption based on settings
2410	1268	*
2411		- * @param array $searchResults
	1269	+ * @param string $inputString
2412	1270	* @return string
2413	1271	*/
2414		- /**
2415		- * Cleans the query of a mailto link -- the "?subject=..." part.
2416		- *
2417		- * A positive list, not an exclusion list, because this value ends up
2418		- * decrypted in the browser and handed to window.location. RFC 6068 defines
2419		- * exactly these four headers as safe to accept from a link; everything else
2420		- * is dropped rather than escaped, because there is no legitimate reason for
2421		- * it to be there and no way to be sure what a mail client would do with it.
2422		- *
2423		- * Values are decoded and re-encoded rather than passed through: an incoming
2424		- * "Hallo%20Welt" must not become "Hallo%2520Welt", and a raw space must not
2425		- * stay a raw space.
2426		- *
2427		- * @param string $rawQuery The query as written in the href, without the "?".
2428		- * @param int $budget How many characters the finished query may occupy.
2429		- *
2430		- * @return string The cleaned query, or an empty string if nothing survives.
2431		- */
2432		- private function sanitizeMailtoQuery(string $rawQuery, int $budget = PHP_INT_MAX): string
	1272	+ private function generateSecureHashFromString(string $inputString): string
2433	1273	{
2434		- if ($rawQuery === '' || $budget <= 0) {
2435		- return '';
2436		- }
2437		-
2438		- // "&amp;" is how a second parameter is spelled in valid HTML, and that
2439		- // is what the regular expression handed us.
2440		- $rawQuery = html_entity_decode($rawQuery, ENT_QUOTES, 'UTF-8');
2441		-
2442		- $allowed = ['subject', 'body', 'cc', 'bcc'];
2443		- $parts = [];
2444		-
2445		- foreach (explode('&', $rawQuery) as $pair) {
2446		- if ($pair === '' || strpos($pair, '=') === false) {
2447		- continue;
	1274	+ if ($this->config->isSecureEncryptionEnabled()) {
	1275	+ try {
	1276	+ $password = $this->config->getEncryptionPassword();
	1277	+ return SecureEncryption::encrypt($inputString, $password);
	1278	+ } catch (\Exception $e) {
	1279	+ error_log('CryptX Secure Encryption failed: ' . $e->getMessage());
	1280	+ // Fallback to legacy encryption
	1281	+ return $this->generateHashFromString($inputString);
2448	1282	}
2449		-
2450		- [$key, $value] = explode('=', $pair, 2);
2451		- $key = strtolower(trim($key));
2452		-
2453		- if (!in_array($key, $allowed, true) || isset($parts[$key])) {
2454		- continue;
2455		- }
2456		-
2457		- $value = rawurldecode($value);
2458		-
2459		- // A recipient list is still a list of addresses, and an invalid one
2460		- // has no business being carried into a mail client.
2461		- if ($key === 'cc' || $key === 'bcc') {
2462		- $addresses = array_filter(array_map(
2463		- static fn($address) => sanitize_email(trim($address)),
2464		- explode(',', $value)
2465		- ));
2466		-
2467		- if ($addresses === []) {
2468		- continue;
2469		- }
2470		-
2471		- $value = implode(',', $addresses);
2472		- } else {
2473		- // Control characters would let a payload break out of the
2474		- // header it is written into.
2475		- $value = preg_replace('/[\x00-\x1F\x7F]/u', '', $value) ?? '';
2476		-
2477		- if (trim($value) === '') {
2478		- continue;
2479		- }
2480		-
2481		- $value = mb_substr($value, 0, self::MAX_MAILTO_VALUE_LENGTH);
2482		- }
2483		-
2484		- $pair = $this->fitPairToBudget(
2485		- $key,
2486		- $value,
2487		- // What is left once the pairs already collected, and the "&"
2488		- // that would join this one, are accounted for.
2489		- $budget - strlen(implode('&', $parts)) - ($parts === [] ? 0 : 1),
2490		- ($key === 'cc' || $key === 'bcc') ? ',' : ''
2491		- );
2492		-
2493		- if ($pair === '') {
2494		- continue;
2495		- }
2496		-
2497		- $parts[$key] = $pair;
2498	1283	}
2499	1284
2500		- return implode('&', $parts);
	1285	+ return $this->generateHashFromString($inputString);
2501	1286	}
2502	1287
2503	1288	/**
2504		- * Encodes one header and shortens it until it fits the space left.
	1289	+ * Enhanced email encryption with security validation
2505	1290	*
2506		- * The value is cut before encoding, never after: percent encoding turns one
2507		- * character into up to twelve, and a cut through "%C3%A4" leaves a sequence
2508		- * no client can read.
2509		- *
2510		- * Why there is a budget at all: cryptx.js refuses to navigate to a URL
2511		- * longer than 2048 characters, and so does SecureEncryption::validateUrl().
2512		- * Counting the value in characters before encoding is not the same measure
2513		- * -- 512 characters of Japanese become over 4000 once encoded. The link
2514		- * then did nothing at all, with nothing on the page to say why.
2515		- *
2516		- * @param string $key The header name.
2517		- * @param string $value The decoded value.
2518		- * @param int $available Characters left for the encoded pair.
2519		- * @param string $separator Set for list values: whole entries are dropped
2520		- * instead of characters.
2521		- *
2522		- * @return string The encoded pair, or an empty string if it cannot fit.
	1291	+ * @param array $searchResults
	1292	+ * @return string
2523	1293	*/
2524		- private function fitPairToBudget(
2525		- string $key,
2526		- string $value,
2527		- int $available,
2528		- string $separator = ''
2529		- ): string {
2530		- $encodedKey = rawurlencode($key);
2531		-
2532		- // The shortest useful pair is "key=" plus one character.
2533		- if ($available < strlen($encodedKey) + 2) {
2534		- return '';
2535		- }
2536		-
2537		- $pair = $encodedKey . '=' . rawurlencode($value);
2538		-
2539		- // A recipient list is not free text. Cutting it by characters leaves a
2540		- // fragment like "chef@examp" in a header a mail client will act on --
2541		- // either bouncing or, worse, delivering somewhere unintended. Whole
2542		- // addresses go, or the header goes.
2543		- if ($separator !== '') {
2544		- $items = explode($separator, $value);
2545		-
2546		- while (strlen($pair) > $available && count($items) > 1) {
2547		- array_pop($items);
2548		- $pair = $encodedKey . '=' . rawurlencode(implode($separator, $items));
2549		- }
2550		-
2551		- return strlen($pair) > $available ? '' : $pair;
2552		- }
2553		-
2554		- while (strlen($pair) > $available && $value !== '') {
2555		- $value = mb_substr($value, 0, mb_strlen($value) - 1);
2556		- $pair = $encodedKey . '=' . rawurlencode($value);
2557		- }
2558		-
2559		- return $value === '' ? '' : $pair;
2560		- }
2561		-
2562	1294	private function encryptEmailAddressSecure(array $searchResults): string
2563	1295	{
2564	1296	$originalValue = $searchResults[0]; // Full match
2565		- $rawTarget = $searchResults[2]; // Everything after "mailto:", verbatim
	1297	+ $emailAddress = $searchResults[2]; // Email address
	1298	+ $linkText = $searchResults[3]; // Link text
2566	1299
2567		- // Address and query are separated BEFORE sanitising. sanitize_email()
2568		- // used to run over the whole target, and it strips "?" and "=" -- so
2569		- // "sales@example.com?subject=Hello" became
2570		- // "sales@example.comsubjectHello". Two things followed from that, both
2571		- // reported in the support forum and neither obvious: the payload
2572		- // carried a broken address, and the str_replace() below could no longer
2573		- // find its needle, so the untouched "mailto:" href stayed in the page.
2574		- $queryPosition = strpos($rawTarget, '?');
2575		- $rawAddress = $queryPosition === false ? $rawTarget : substr($rawTarget, 0, $queryPosition);
2576		- $rawQuery = $queryPosition === false ? '' : substr($rawTarget, $queryPosition + 1);
2577		-
2578		- $emailAddress = sanitize_email($rawAddress);
2579		-
2580	1300	if (strpos($emailAddress, '@') === self::NOT_FOUND) {
2581	1301	return $originalValue;
2582	1302	}
2583	1303
2584		- // Left exactly as written, link and all. "Leave this address alone"
2585		- // has to mean all three stages, not just the visible text -- an
2586		- // address that keeps its readable form but loses its working mailto is
2587		- // neither protected nor usable.
2588		- if ($this->isAddressExempt($emailAddress)) {
	1304	+ if (str_starts_with($emailAddress, self::SUBJECT_IDENTIFIER)) {
2589	1305	return $originalValue;
2590	1306	}
2591	1307
2592		- // The budget is what the browser will still accept once "mailto:",
2593		- // the address and the "?" are in place.
2594		- $query = $this->sanitizeMailtoQuery(
2595		- $rawQuery,
2596		- self::MAX_MAILTO_URL_LENGTH - strlen('mailto:' . $emailAddress . '?')
2597		- );
2598		- $mailtoTarget = $emailAddress . ($query === '' ? '' : '?' . $query);
2599		-
2600	1308	$return = $originalValue;
2601	1309
2602	1310	// Apply JavaScript handler if enabled
2603	1311	if (!empty(self::$cryptXOptions['java'])) {
2604	1312	$encryptionMode = $this->config->getEncryptionMode();
2605		- $payloadMode = 'legacy';
2606		- $password = '';
2607	1313
2608	1314	// Determine which encryption method to use
2609	1315	if ($encryptionMode === 'secure' &&
2610	1316	$this->config->isSecureEncryptionEnabled() &&
		@@ -2612,89 +1318,42 @@
2612	1318
2613	1319	// Use modern AES-256-GCM encryption
2614	1320	try {
2615	1321	$password = $this->config->getEncryptionPassword();
2616		- $mailtoUrl = 'mailto:' . $mailtoTarget;
	1322	+ $mailtoUrl = 'mailto:' . $emailAddress;
2617	1323	$encryptedEmail = SecureEncryption::encrypt($mailtoUrl, $password);
2618		- $payloadMode = 'secure';
	1324	+
	1325	+ $javaHandler = "javascript:secureDecryptAndNavigate('" .
	1326	+ $this->escapeJavaScript($encryptedEmail) . "', '" .
	1327	+ $this->escapeJavaScript($password) . "')";
2619	1328	} catch (\Exception $e) {
2620	1329	// Fallback to legacy if secure encryption fails
2621		- $encryptedEmail = $this->generateHashFromString($mailtoTarget);
2622		- $password = '';
	1330	+ error_log('CryptX Secure Encryption failed, falling back to legacy: ' . $e->getMessage());
	1331	+ $encryptedEmail = $this->generateHashFromString($emailAddress);
	1332	+ $javaHandler = "javascript:DeCryptX('" . $this->escapeJavaScript($encryptedEmail) . "')";
2623	1333	}
2624	1334	} else {
2625		- // Use legacy encryption (original algorithm). cryptx.js puts
2626		- // "mailto:" in front of whatever comes out, so the query rides
2627		- // along here as well.
2628		- $encryptedEmail = $this->generateHashFromString($mailtoTarget);
	1335	+ // Use legacy encryption (original algorithm)
	1336	+ $encryptedEmail = $this->generateHashFromString($emailAddress);
	1337	+ $javaHandler = "javascript:DeCryptX('" . $this->escapeJavaScript($encryptedEmail) . "')";
2629	1338	}
2630	1339
2631		- self::$scriptNeeded = true;
2632		-
2633		- if ($this->getLinkMode() === 'data') {
2634		- // Preferred form: the payload travels in data attributes and a
2635		- // delegated click handler in cryptx.js does the work. A
2636		- // "javascript:" URI would be blocked outright by any halfway
2637		- // strict Content-Security-Policy, taking every CryptX link on
2638		- // the page with it -- silently.
2639		- $attributes = sprintf(
2640		- ' data-cx="%s" data-cxm="%s"',
2641		- esc_attr($encryptedEmail),
2642		- esc_attr($payloadMode)
2643		- );
2644		- if ($payloadMode === 'secure') {
2645		- // The key travels with the link, so changing the secret
2646		- // never breaks one that is already out there. The iteration
2647		- // count did not, and that was the real dead-link problem:
2648		- // it was read from the global cryptxConfig at click time,
2649		- // so raising it in the settings silently killed every link
2650		- // in every cached page and in every browser tab still open.
2651		- // Now each link says how it was made.
2652		- $attributes .= sprintf(
2653		- ' data-cxk="%s" data-cxi="%d"',
2654		- esc_attr($password),
2655		- SecureEncryption::getIterations()
2656		- );
2657		- }
2658		-
2659		- // The raw target, not the sanitised address: they differ as
2660		- // soon as a query is present, and a needle that is not in the
2661		- // haystack leaves the plain "mailto:" href untouched.
2662		- //
2663		- // str_ireplace, because the pattern above matches case
2664		- // insensitively: an href written "MAILTO:" was found, but a
2665		- // lower-case needle then missed it -- same failure, reached
2666		- // through the spelling of the scheme instead of the query.
2667		- $return = str_ireplace('mailto:' . $rawTarget, '#', $originalValue);
2668		- $return = $this->addAttributesToAnchor($return, $attributes);
2669		- $return = $this->addClassToAnchor($return, self::LINK_CLASS);
2670		- } else {
2671		- // Legacy form, kept for installations that depend on it.
2672		- // The iteration count is passed here too, as a third argument.
2673		- // Older pages call the function with two, which still works --
2674		- // it then falls back to the configured value, exactly as before.
2675		- $javaHandler = $payloadMode === 'secure'
2676		- ? "javascript:secureDecryptAndNavigate('" . esc_js($encryptedEmail) . "', '"
2677		- . esc_js($password) . "', " . SecureEncryption::getIterations() . ")"
2678		- : "javascript:DeCryptX('" . esc_js($encryptedEmail) . "')";
2679		-
2680		- $return = str_ireplace('mailto:' . $rawTarget, $javaHandler, $originalValue);
2681		- }
	1340	+ $return = str_replace('mailto:' . $emailAddress, $javaHandler, $originalValue);
2682	1341	} else {
2683	1342	// Fallback to antispambot if JavaScript is not enabled
2684		- $return = str_ireplace('mailto:' . $rawTarget,
2685		- antispambot('mailto:' . $mailtoTarget), $return);
	1343	+ $return = str_replace('mailto:' . $emailAddress,
	1344	+ antispambot('mailto:' . $emailAddress), $return);
2686	1345	}
2687	1346
2688	1347	// Add CSS attributes if specified
2689	1348	if (!empty(self::$cryptXOptions['css_id'])) {
2690		- // Guarded like every other preg_* call site in this class: a PCRE
2691		- // error yields null, and $return is declared string.
2692		- $return = $this->addIdToAnchor($return, self::$cryptXOptions['css_id']);
	1349	+ $return = preg_replace('/(<a\s+[^>]*)(>)/i',
	1350	+ '$1 id="' . self::$cryptXOptions['css_id'] . '"$2', $return);
2693	1351	}
2694	1352
2695	1353	if (!empty(self::$cryptXOptions['css_class'])) {
2696		- $return = $this->addClassToAnchor($return, self::$cryptXOptions['css_class']);
	1354	+ $return = preg_replace('/(<a\s+[^>]*)(>)/i',
	1355	+ '$1 class="' . self::$cryptXOptions['css_class'] . '"$2', $return);
2697	1356	}
2698	1357
2699	1358	return $return;
2700	1359	}
		@@ -2699,214 +1358,30 @@
2699	1358	return $return;
2700	1359	}
2701	1360
2702	1361	/**
2703		- * Runs a sample through the real processing chain for the settings preview.
	1362	+ * Escapes string for safe JavaScript usage
2704	1363	*
2705		- * Deliberately not a reimplementation: the preview calls the same three
2706		- * filters the front end calls, with the same encryption. A separate
2707		- * "preview renderer" would drift away from the truth sooner or later, and
2708		- * a preview that lies is worse than none.
2709		- *
2710		- * Nothing is written. Both the static option list and the Config instance
2711		- * are swapped for the duration and restored in a finally block -- Config
2712		- * matters because the encryption path reads its mode and password from
2713		- * there, not from the static list.
2714		- *
2715		- * @param array $overrides Option values as they stand in the unsaved form.
2716		- * @param string $content The sample content.
2717		- *
2718		- * @return string The processed markup.
	1364	+ * @param string $string
	1365	+ * @return string
2719	1366	*/
2720		- public function renderPreviewMarkup(array $overrides, string $content): string
	1367	+ private function escapeJavaScript(string $string): string
2721	1368	{
2722		- $previousOptions = self::$cryptXOptions;
2723		- $previousConfig = $this->config;
2724		-
2725		- // Make sure a secret exists before the swap, and mint it through the
2726		- // REAL Config if it does not.
2727		- //
2728		- // Config::getEncryptionPassword() writes when it has to mint, and
2729		- // Config::save() stores the whole option array -- which, on the
2730		- // throwaway Config below, is the administrator's unsaved form state.
2731		- // A preview would then silently persist settings that were only being
2732		- // tried out. The window is real: updateCryptXSettings() drops the
2733		- // secret on every version bump, and the settings screen is the first
2734		- // place an administrator goes after an update.
2735		- $stored = $this->loadCryptXOptionsWithDefaults();
2736		-
2737		- if (empty($stored['encryption_password'])) {
2738		- // Mint through a Config built from the STORED options, and carry the
2739		- // result into $merged by hand.
2740		- //
2741		- // Doing it through the live Config instead was not enough: that one
2742		- // holds an in-memory copy taken at startup, so it can believe it has
2743		- // a password while the row no longer does. It then writes nothing,
2744		- // $merged is still without a secret, and the throwaway Config below
2745		- // mints -- persisting the unsaved form along with it. A test that
2746		- // watches pre_update_option_cryptX found exactly that.
2747		- $stored['encryption_password'] = (new Config($stored))->getEncryptionPassword();
2748		- }
2749		-
2750		- // Same reasoning, same trap, second secret. The image variant mints one
2751		- // of its own the first time an address is drawn as a picture -- and the
2752		- // first time that happens is usually in this very preview, the moment
2753		- // an administrator picks "image" from the list. Minting it through the
2754		- // throwaway Config below would save the unsaved form along with it.
2755		- if (empty($stored['image_token_secret'])) {
2756		- $stored['image_token_secret'] = (new Config($stored))->getImageTokenSecret();
2757		- }
2758		-
2759		- $merged = wp_parse_args($overrides, $stored);
2760		-
2761		- self::$cryptXOptions = $merged;
2762		- $this->config = new Config($merged);
2763		- self::resetOptionCaches();
2764		-
2765		- try {
2766		- if (!empty(self::$cryptXOptions['autolink'])) {
2767		- $content = $this->addLinkToEmailAddresses($content, true);
2768		- }
2769		-
2770		- $content = $this->findEmailAddressesInContent($content, true);
2771		-
2772		- return (string) $this->replaceEmailInContent($content, true);
2773		- } finally {
2774		- self::$cryptXOptions = $previousOptions;
2775		- $this->config = $previousConfig;
2776		- self::resetOptionCaches();
2777		- }
2778		- }
2779		-
2780		- /**
2781		- * Which link form the encrypted address is delivered in.
2782		- *
2783		- * 'data' puts the payload into data attributes and lets a delegated click
2784		- * handler take over -- the only form that survives a Content-Security-Policy.
2785		- * 'js' is the historical "javascript:" URI, offered under Advanced for
2786		- * installations that depend on the old behaviour.
2787		- *
2788		- * @return string Either 'data' or 'js'.
2789		- */
2790		- private function getLinkMode(): string
2791		- {
2792		- $mode = (string) (self::$cryptXOptions['link_mode'] ?? 'data');
2793		-
2794		- return $mode === 'js' ? 'js' : 'data';
2795		- }
2796		-
2797		- /**
2798		- * Inserts additional attributes into the opening tag of an anchor.
2799		- *
2800		- * @param string $html The anchor markup.
2801		- * @param string $attributes Attribute string, starting with a space.
2802		- *
2803		- * @return string The markup with the attributes added.
2804		- */
2805		- private function addAttributesToAnchor(string $html, string $attributes): string
2806		- {
2807		- return $this->rewriteOpeningAnchorTag(
2808		- $html,
2809		- static fn(string $tag): string => preg_replace('/(\s*\/?>)$/', $attributes . '$1', $tag, 1) ?? $tag
	1369	+ return str_replace(
	1370	+ ['\\', "'", '"', "\n", "\r", "\t"],
	1371	+ ['\\\\', "\\'", '\\"', '\\n', '\\r', '\\t'],
	1372	+ $string
2810	1373	);
2811	1374	}
2812	1375
2813	1376	/**
2814		- * Adds a class to an anchor, keeping any class that is already there.
	1377	+ * Secure URL validation
2815	1378	*
2816		- * @param string $html The anchor markup.
2817		- * @param string $class The class to add.
2818		- *
2819		- * @return string The markup with the class added.
	1379	+ * @param string $url
	1380	+ * @return bool
2820	1381	*/
2821		- private function addClassToAnchor(string $html, string $class): string
	1382	+ private function isValidUrl(string $url): bool
2822	1383	{
2823		- $class = esc_attr($class);
2824		-
2825		- return $this->rewriteOpeningAnchorTag(
2826		- $html,
2827		- function (string $tag) use ($class): string {
2828		- // (?:^|\s) rather than \b: a word boundary also sits
2829		- // between the quote and the "c" of an attribute value such
2830		- // as data-x="class='y'", so \bclass would bind to the text
2831		- // inside that value. Requiring whitespace before the name
2832		- // makes this an attribute rather than any occurrence of the
2833		- // word -- and it holds no matter which attribute comes
2834		- // first, which the greedy and the lazy variant each got
2835		- // wrong in one of the two orders.
2836		- if (preg_match('/(?:^|\s)class\s*=\s*(["\'])(.*?)\1/i', $tag)) {
2837		- return preg_replace(
2838		- '/((?:^|\s)class\s*=\s*(["\']))(.*?)\2/i',
2839		- '$1$3 ' . $class . '$2',
2840		- $tag,
2841		- 1
2842		- ) ?? $tag;
2843		- }
2844		-
2845		- return preg_replace('/(\s*\/?>)$/', ' class="' . $class . '"$1', $tag, 1) ?? $tag;
2846		- }
2847		- );
2848		- }
2849		-
2850		- /**
2851		- * Applies a rewrite to the opening tag of the first anchor only.
2852		- *
2853		- * Regular expressions on HTML are a poor tool, and this is the narrow case
2854		- * where it is still defensible: the markup comes from CryptX's own mailto
2855		- * pattern, so there is exactly one anchor and the payload is escaped before
2856		- * it gets here. Isolating the opening tag keeps the rewrite from reaching
2857		- * into attribute values or into the link text.
2858		- *
2859		- * @param string $html The anchor markup.
2860		- * @param callable $rewrite Receives the opening tag, returns the new one.
2861		- *
2862		- * @return string The markup with the rewritten opening tag.
2863		- */
2864		- private function rewriteOpeningAnchorTag(string $html, callable $rewrite): string
2865		- {
2866		- // Quoted attribute values may legitimately contain ">", so a plain
2867		- // [^>]* would end the tag too early and splice the new attribute into
2868		- // the middle of somebody else's title.
2869		- $openingTag = '/<a\b(?:[^>"\']|"[^"]*"|\'[^\']*\')*>/i';
2870		-
2871		- if (!preg_match($openingTag, $html, $matches, PREG_OFFSET_CAPTURE)) {
2872		- return $html;
2873		- }
2874		-
2875		- $tag = $matches[0][0];
2876		- $offset = $matches[0][1];
2877		- $rewritten = $rewrite($tag);
2878		-
2879		- return substr($html, 0, $offset) . $rewritten . substr($html, $offset + strlen($tag));
2880		- }
2881		-
2882		- /**
2883		- * Adds an id to an anchor, keeping any id that is already there.
2884		- *
2885		- * @param string $html The anchor markup.
2886		- * @param string $id The id to add.
2887		- *
2888		- * @return string The markup with the id added.
2889		- */
2890		- private function addIdToAnchor(string $html, string $id): string
2891		- {
2892		- $id = esc_attr($id);
2893		-
2894		- return $this->rewriteOpeningAnchorTag(
2895		- $html,
2896		- function (string $tag) use ($id): string {
2897		- // Same reasoning as in addClassToAnchor().
2898		- if (preg_match('/(?:^|\s)id\s*=\s*(["\'])(.*?)\1/i', $tag)) {
2899		- return preg_replace(
2900		- '/((?:^|\s)id\s*=\s*(["\']))(.*?)\2/i',
2901		- '$1$3 ' . $id . '$2',
2902		- $tag,
2903		- 1
2904		- ) ?? $tag;
2905		- }
2906		-
2907		- return preg_replace('/(\s*\/?>)$/', ' id="' . $id . '"$1', $tag, 1) ?? $tag;
2908		- }
2909		- );
	1384	+ return SecureEncryption::validateUrl($url);
2910	1385	}
2911	1386
2912	1387	}