← All changes | controllers/coupling/shortcode/block/block.php +15 -54 trunk → 8.0.3 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2	/**
3		-*
	3	+*
4	4	*/
5	5
6	6	// Disallow direct access.
7	7	defined('ABSPATH') or die("Access denied");
		@@ -9,40 +9,40 @@
9	9	/**
10	10	* Handle block Shortcode.
11	11	*/
12	12	class CJT_Controllers_Coupling_Shortcode_Block extends CJTHookableClass {
13		-
	13	+
14	14	/**
15	15	* put your comment there...
16		- *
	16	+ *
17	17	* @var mixed
18	18	*/
19	19	protected $attributes;
20		-
	20	+
21	21	/**
22	22	* put your comment there...
23		- *
	23	+ *
24	24	* @var mixed
25	25	*/
26	26	protected $content = null;
27		-
	27	+
28	28	/**
29	29	* put your comment there...
30		- *
	30	+ *
31	31	* @var mixed
32	32	*/
33	33	protected $options = array('force' => 'true', 'tag' => 'span');
34		-
	34	+
35	35	/**
36	36	* put your comment there...
37		- *
	37	+ *
38	38	* @var mixed
39	39	*/
40	40	protected $parameters = array();
41		-
	41	+
42	42	/**
43	43	* put your comment there...
44		- *
	44	+ *
45	45	* @param mixed $attributes
46	46	* @param mixed $content
47	47	* @return CJT_Controllers_Coupling_Shortcode_Block
48	48	*/
		@@ -55,9 +55,9 @@
55	55	}
56	56
57	57	/**
58	58	* put your comment there...
59		- *
	59	+ *
60	60	*/
61	61	public function __toString() {
62	62	// Initialize.
63	63	$replacement = '';
		@@ -93,24 +93,9 @@
93	93	// Get block code, execute it as PHP!
94	94	$blockCode = CJTPHPCodeEvaluator::getInstance($block)->exec(array('cb' => $spi))->getOutput();
95	95	// CJT Shortcode markup interface (CSMI)!
96	96	// CSMI is HTML markup to identify the CJT block Shortcode replacement.
97		-
98		- // SECURITY: The wrapper tag name is user-controllable via the shortcode
99		- // 'tag' attribute. It must NEVER be allowed to become an executable.
100		- // Normalise tag to a bare, lowercase
101		- // element name and validate against a strict allow-list of safe container
102		- // elements, falling back to the default 'span' otherwise.
103		- $__tag = $this->getSafeTag($this->options['tag']);
104		-
105		- // CODE UPDATED -- START
106		- $replacement = "\n\n<!-- CJT Shortcode Block ({$block->id}) - {$block->name} - START -->\n
107		- <{$__tag} id='{$spi->containerElementId()}' class='csmi csmi-bid-{$block->id} csmi-{$block->name}'>
108		- {$this->content}{$blockCode}
109		- </{$__tag}>\n
110		- <!-- CJT Shortcode Block ({$block->id}) - {$block->name} - END -->\n\n";
111		- // CODE UPDATED -- END
112		-
	97	+ $replacement = "<{$this->options['tag']} id='{$spi->containerElementId()}' class='csmi csmi-bid-{$block->id} csmi-{$block->name}'>{$this->content}{$blockCode}</{$this->options['tag']}>";
113	98	// Get linked templates.
114	99	$linkedStylesheets = '';
115	100	$templates = $model->getLinkedTemplates($block->id);
116	101	$reverseTypes = array_flip(CJTCouplingModel::$templateTypes);
		@@ -130,9 +115,9 @@
130	115	$queue->enqueue($template->queueName);
131	116	}
132	117	}
133	118	// Prepend linked Stylesheets to the replacement.
134		- if (isset($linkedStylesheets) && !empty($linkedStylesheets)) {
	119	+ if (isset($linkedStylesheets)) {
135	120	$replacement = "<style type='text/css'>{$linkedStylesheets}</style>{$replacement}";
136	121	}
137	122	}
138	123	}
		@@ -143,32 +128,8 @@
143	128	// Return shortcode replacement string.
144	129	return $replacement;
145	130	}
146	131
147		- /**
148		- * Resolve a safe wrapper element name for the shortcode replacement.
149		- *
150		- *
151		- * @param string $tag Raw tag value coming from the shortcode attributes.
152		- * @return string A safe, allow-listed element name.
153		- */
154		- protected function getSafeTag($tag) {
155		- // Default / fallback tag.
156		- $default = 'span';
157		- // Strip to a bare element name: letters and digits only, lowercased.
158		- $tag = strtolower(preg_replace('/[^a-zA-Z0-9]/', '', (string) $tag));
159		- // Allow-list of inert elements that are safe to use as a wrapper.
160		- static $allowed = array(
161		- 'span', 'div', 'p', 'section', 'article', 'aside', 'header', 'footer',
162		- 'main', 'nav', 'figure', 'figcaption', 'blockquote', 'pre', 'code',
163		- 'ul', 'ol', 'li', 'dl', 'dt', 'dd',
164		- 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
165		- 'em', 'strong', 'small', 'mark', 'sub', 'sup', 'i', 'b', 'u', 's',
166		- 'abbr', 'cite', 'q', 'time', 'kbd', 'samp', 'var',
167		- );
168		- return in_array($tag, $allowed, true) ? $tag : $default;
169		- }
170		-
171	132	} // End class.
172	133
173	134	// Hookable!
174		-CJT_Controllers_Coupling_Shortcode_Block::define('CJT_Controllers_Coupling_Shortcode_Block');
	135	+CJT_Controllers_Coupling_Shortcode_Block::define('CJT_Controllers_Coupling_Shortcode_Block');