depicter / vendor / averta / wordpress / src / Utility / Sanitize.php

Sanitize.php in Depicter — Popup & Slider Builder 1.2.0, at vendor/averta/wordpress/src/Utility/Sanitize.php

629 lines 15.9 KB

Raw Download Zip

1	<?php
2	namespace Averta\WordPress\Utility;
3
4	class Sanitize
5	{
6	/**
7	* Sanitize title.
8	*
9	* @param string $input
10	*
11	* @return string
12	*/
13	public static function title( $input )
14	{
15	return sanitize_title( $input );
16	}
17
18	/**
19	* Sanitize slug.
20	*
21	* @param string $input
22	*
23	* @return string
24	*/
25	public static function slug( $input )
26	{
27	return sanitize_title( static::dash( $input ) );
28	}
29
30	/**
31	* Sanitize a textarea input field. Removes bad html like <script> and <html>.
32	*
33	* @param string $input
34	*
35	* @return string
36	*/
37	public static function textarea( $input )
38	{
39	global $allowedposttags;
40	return wp_kses( $input, $allowedposttags );
41	}
42
43	/**
44	* Sanitize nothing.
45	*
46	* @param string $input
47	*
48	* @return string
49	*/
50	public static function raw( $input )
51	{
52	return $input;
53	}
54
55	/**
56	* Sanitize URL
57	*
58	* Remove all characters except letters, digits and !#$%&'*+-=?^_`{\|}~@.[].
59	*
60	* @param string $url
61	*
62	* @return string
63	*/
64	public static function url( $url )
65	{
66	return filter_var( $url, FILTER_SANITIZE_URL );
67	}
68
69	/**
70	* Sanitize Number int
71	*
72	* Remove all characters except digits, plus and minus sign.
73	*
74	* @param string $input
75	*
76	* @return string
77	*/
78	public static function int( $input )
79	{
80	return absint( filter_var( $input, FILTER_SANITIZE_NUMBER_INT ) );
81	}
82
83	/**
84	* Sanitize Attribute.
85	*
86	* @param string $input
87	*
88	* @return string
89	*/
90	public static function attribute( $input )
91	{
92	return esc_attr( $input );
93	}
94	/**
95	* Sanitize SQL
96	*
97	* @param string $input
98	*
99	* @return string
100	*/
101	public static function sql( $input )
102	{
103	return esc_sql( $input );
104	}
105
106	/**
107	* Sanitize text as plaintext.
108	*
109	* @param string $input
110	*
111	* @return string
112	*/
113	public static function plaintext( $input )
114	{
115	return wp_kses( $input, [] );
116	}
117
118	/**
119	* Sanitizes a string from user input or from the database.
120	*
121	* @param string $input
122	*
123	* @return string
124	*/
125	public static function textfield( $input )
126	{
127	return sanitize_text_field( $input );
128	}
129
130	/**
131	* Strips out all characters that are not allowable in an email.
132	*
133	* @param string $input
134	*
135	* @return string
136	*/
137	public static function email( $input )
138	{
139	return sanitize_email( $input );
140	}
141
142	/**
143	* Sanitizes an HTML classname to ensure it only contains valid characters.
144	*
145	* @param string $input
146	*
147	* @return string
148	*/
149	public static function htmlClass( $input )
150	{
151	return sanitize_html_class( $input );
152	}
153
154	/**
155	* Sanitizes a string key.
156	*
157	* Keys are used as internal identifiers. Lowercase alphanumeric characters, dashes, and underscores are allowed.
158	*
159	* @param string $input
160	*
161	* @return string
162	*/
163	public static function key( $input )
164	{
165	return sanitize_key( $input );
166	}
167
168	/**
169	* Sanitize editor data. Much like textarea remove <script> and <html>.
170	* However, if the user can create unfiltered HTML allow it.
171	*
172	* @param string $input
173	* @param bool $force_filter
174	* @param bool $auto_p
175	* @param null $allowed_tags
176	*
177	* @return string
178	*/
179	public static function editor( $input, $force_filter = false, $auto_p = false, $allowed_tags = null )
180	{
181	if (current_user_can( 'unfiltered_html' ) && !$force_filter) {
182	$output = trim( $input );
183	} else {
184	global $allowedtags;
185	$output = wp_kses( trim($input), apply_filters('averta/wordpress/sanitize/editor/tags', $allowed_tags ?? $allowedtags) );
186	}
187
188	if( $auto_p ) {
189	$output = wpautop($output);
190	}
191
192	return $output;
193	}
194
195	/**
196	* Sanitizes content for allowed HTML tags for post content.
197	*
198	* @param string $input Post content to filter.
199	* @return string Filtered post content with allowed HTML tags and attributes intact.
200	*/
201	public static function post( $input )
202	{
203	return wp_kses_post( $input );
204	}
205
206	/**
207	* Sanitizes content for allowed HTML tags.
208	*
209	* @param string $input HTML input
210	* @param null\|array $allowed_tags allowed tags for wp_kses
211	* @param null\|string $namespace
212	* @param bool $auto_p
213	*
214	* @return string
215	*/
216	public static function html( $input, $allowed_tags = null, $namespace = null, $auto_p = false ) {
217	$tags = apply_filters('averta/wordpress/sanitize/html/tags/' . ($namespace ? $namespace : 'default'), $allowed_tags ? $allowed_tags : self::defaultAllowedTags() );
218
219	$output = trim( wp_kses( trim( $input ), $tags ) );
220
221	if( $auto_p ) {
222	$output = wpautop( $output );
223	}
224
225	return $output;
226	}
227
228	/**
229	* Sanitizes json for allowed HTML tags.
230	*
231	* @param string $input HTML input
232	* @param null\|array $allowed_tags allowed tags for wp_kses
233	* @param null\|string $namespace
234	*
235	* @return string
236	*/
237	public static function json( $input, $allowed_tags = null, $namespace = null ) {
238	$tags = apply_filters('averta/wordpress/sanitize/json/tags/' . ($namespace ? $namespace : 'default'), $allowed_tags ? $allowed_tags : self::defaultAllowedTags() );
239
240	$output = trim( wp_kses( trim( $input ), $tags ) );
241
242	return $output;
243	}
244
245	/**
246	* Retrieves default WordPress HTML tags
247	*
248	* @return array
249	*/
250	protected static function defaultAllowedTags(){
251	$tags = [
252	'em' => [],
253	'strong' => [],
254	'small' => [],
255	'sub' => [],
256	'sup' => [],
257	'b' => [],
258	'i' => [],
259	'ul' => [],
260	'ol' => [],
261	'hgroup' => [],
262	'h1' => [],
263	'h2' => [],
264	'h3' => [],
265	'h4' => [],
266	'h5' => [],
267	'h6' => [],
268	'table' => [],
269	'tbody' => [],
270	'tfoot' => [],
271	'thead' => [],
272	'dd' => [],
273	'dt' => [],
274	'dl' => [],
275	'tr' => [],
276	'th' => [],
277	'td' => [],
278	'figure' => [],
279	'figcaption' => [],
280	'caption' => [],
281	'desc' => [],
282	'line' => [],
283	'marker' => [],
284	'mask' => [],
285	'metadata' => [],
286	'pattern' => [],
287	'textpath' => [],
288	'use' => [],
289	'div' => [],
290	'img' => [
291	'src' => true,
292	'alt' => true,
293	'title' => true,
294	'data-*' => true
295	],
296	'video' => [
297	'autoplay' => true,
298	'controls' => true,
299	'height' => true,
300	'loop' => true,
301	'muted' => true,
302	'playsinline' => true,
303	'poster' => true,
304	'preload' => true,
305	'src' => true,
306	'width' => true,
307	'data-*' => true
308	],
309	'a' => [
310	'id' => true,
311	'class' => true,
312	'style' => true,
313	'href' => true,
314	'title' => true,
315	'rev' => true,
316	'rel' => true,
317	'target' => true,
318	'download' => ['valueless' => 'y'],
319	'data-*' => true
320	],
321	'li' => [],
322	'blockquote' => [],
323	'cite' => [],
324	'code' => [],
325	'hr' => [],
326	'p' => [],
327	'br' => [],
328	'link' => [
329	'rel' => true,
330	'id' => true,
331	'href' => true,
332	'media' => true
333	],
334	'script' => [
335	'id' => true,
336	'src' => true
337	],
338	'style' => [
339	'type' => true
340	],
341	'meta' => [
342	'charset' => true,
343	'name' => true,
344	'content' => true
345	],
346	'body' => [
347	'class' => true
348	],
349	'picture' => [
350	'id' => true,
351	'class' => true,
352	'style' => true,
353	'data-*'=> true
354	],
355	'source' => [
356	'media' => true,
357	'srcset' => true,
358	'src' => true,
359	'data-*' => true
360	],
361	'iframe' => [
362	'src' => true,
363	'height' => true,
364	'width' => true,
365	'frameborder' => true,
366	'allowfullscreen' => true,
367	],
368	'svg' => [
369	'xmlns' => [],
370	'fill' => [],
371	'viewbox' => [],
372	'role' => [],
373	'aria-hidden' => [],
374	'focusable' => [],
375	'width' => [],
376	'height' => [],
377	'style' => [],
378	'class' => []
379	],
380	'path' => [
381	'id' => [],
382	'class' => [],
383	'd' => [],
384	'fill' => [],
385	'fill-rule' => [],
386	'width' => [],
387	'height' => [],
388	'transform' => [],
389	'stroke-width' => [],
390	'stroke' => [],
391	'opacity' => [],
392	'style' => []
393	],
394	'g' => [
395	'id' => [],
396	'class' => [],
397	'fill' => [],
398	'width' => [],
399	'height' => [],
400	'transform' => [],
401	'data-name' => [],
402	'stroke-width' => [],
403	'stroke' => [],
404	'opacity' => [],
405	'style' => []
406	],
407	'rect' => [
408	'id' => [],
409	'class' => [],
410	'fill' => [],
411	'width' => [],
412	'height' => [],
413	'transform' => [],
414	'opacity' => [],
415	'data-name' => [],
416	'x' => [],
417	'y' => [],
418	'rx' => [],
419	'ry' => [],
420	'style' => []
421	],
422	'circle' => [
423	'id' => [],
424	'class' => [],
425	'fill' => [],
426	'transform' => [],
427	'data-name' => [],
428	'cx' => [],
429	'cy' => [],
430	'r' => [],
431	'stroke-width' => [],
432	'stroke' => [],
433	'opacity' => [],
434	'style' => []
435	],
436	'ellipse' => [
437	'id' => [],
438	'class' => [],
439	'fill' => [],
440	'transform' => [],
441	'opacity' => [],
442	'data-name' => [],
443	'style' => [],
444	'cx' => [],
445	'cy' => [],
446	'rx' => [],
447	'ry' => []
448	],
449	'text' => [
450	'fill' => [],
451	'width' => [],
452	'height' => [],
453	'transform' => [],
454	'font-size' => [],
455	'font-family' => [],
456	'font-weight' => [],
457	'letter-spacing' => [],
458	'x' => [],
459	'y' => [],
460	'opacity' => []
461	],
462	'lineargradient' => [
463	'id' => [],
464	'href'=> [],
465	'x1' => [],
466	'x2' => [],
467	'y1' => [],
468	'y2' => [],
469	'spreadMethod' => [],
470	'gradientUnits' => []
471	],
472	'stop' => [
473	'offset' => [],
474	'stop-color' => []
475	],
476	'radialgradient' => [],
477	'defs' => [],
478	'clippath' => [],
479	'filter' => [
480	'filterUnits' => [],
481	'id' => [],
482	'class' => [],
483	'width' => [],
484	'height' => [],
485	'x' => [],
486	'y' => [],
487	'opacity' => []
488	],
489	'feOffset' => [
490	'dx' => [],
491	'dy' => [],
492	'input' => [],
493	],
494	'feGaussianBlur' => [
495	'stdDeviation' => [],
496	'result' => []
497	],
498	'feFlood' => [
499	'flood-color' => []
500	],
501	'feComposite' => [
502	'operator' => [],
503	'in' => [],
504	'in2' => [],
505	],
506	'symbol' => [
507	'id' => [],
508	'class' => [],
509	'viewbox' => [],
510	'preserveaspectratio' => []
511	]
512	];
513
514	return $tags;
515	}
516
517	/**
518	* Sanitize Hex Color Value
519	*
520	* If the hex does not validate return a default instead.
521	*
522	* @param string $hex
523	* @param string $default
524	*
525	* @return string
526	*/
527	public static function hex( $hex, $default = '#000000' )
528	{
529	if ( preg_match("/^\#?([a-fA-F0-9]{3}){1,2}$/", $hex ) ) {
530	return $hex;
531	}
532
533	return $default;
534	}
535
536	/**
537	* Sanitize Underscore
538	*
539	* Remove all special characters and replace spaces and dashes with underscores
540	* allowing only a single underscore after trimming whitespace form string and
541	* lower casing
542	*
543	* ` --"2_ _e''X AM!pl'e-"-1_@` -> _2_ex_ample_1_
544	*
545	* @param string $name
546	* @param bool $keep_dots
547	*
548	* @return mixed\|string
549	*/
550	public static function underscore( $name, $keep_dots = false )
551	{
552	if (is_string( $name )) {
553
554	if($keep_dots) {
555	$name = preg_replace( '/[\.]+/', '.', $name );
556	$name = preg_replace("/[^A-Za-z0-9\.\\s\\-\\_?]/",'', strtolower(trim($name)) );
557	} else {
558	$name = preg_replace( '/[\.]+/', '_', $name );
559	$name = preg_replace("/[^A-Za-z0-9\\s\\-\\_?]/",'', strtolower(trim($name)) );
560	}
561
562
563	$name = preg_replace( '/[-\\s]+/', '_', $name );
564	$name = preg_replace( '/_+/', '_', $name );
565	}
566
567	return $name;
568	}
569
570	/**
571	* Sanitize Dash
572	*
573	* Remove all special characters and replace spaces and underscores with dashes
574	* allowing only a single dash after trimming whitespace form string and
575	* lower casing
576	*
577	* ` --"2_ _e\'\'X AM!pl\'e-"-1_@` -> -2-ex-ample-1-
578	*
579	* @param string $name
580	*
581	* @return mixed\|string
582	*/
583	public static function dash( $name )
584	{
585	if (is_string( $name )) {
586	$name = preg_replace( '/[\.]+/', '_', $name );
587	$name = preg_replace("/[^A-Za-z0-9\\s\\-\\_?]/",'', strtolower(trim($name)) );
588	$name = preg_replace( '/[_\\s]+/', '-', $name );
589	$name = preg_replace( '/-+/', '-', $name );
590	}
591
592	return $name;
593	}
594
595	/**
596	* Sanitizes a filename, replacing whitespace with dashes.
597	*
598	* @param $filename
599	*
600	* @return string
601	*/
602	public static function fileName( $filename ){
603	return sanitize_file_name( $filename );
604	}
605
606	/**
607	* Removes only shortcode tags from the given content but keeps content of shortcodes
608	*
609	* @param string $content
610	* @param array $excludeStripShortcodeTags
611	*
612	* @return array\|string\|string[]\|null
613	*/
614	public static function stripShortcodes( $content, $excludeStripShortcodeTags = [] ) {
615	if( ! $content )
616	return $content;
617
618	if( ! $excludeStripShortcodeTags )
619	$excludeStripShortcodeTags = apply_filters( "averta/wordpress/exclude/strip/shortcode/tags", [] );
620
621	if( empty( $excludeStripShortcodeTags ) \|\| ! is_array( $excludeStripShortcodeTags ) )
622	return preg_replace('/\[[^\]]*\]/', '', $content);
623
624	$exclude_codes = join('\|', $excludeStripShortcodeTags );
625
626	return preg_replace( "~(?:\[/?)(?!(?:$exclude_codes))[^/\]]+/?\]~s", '', $content );
627	}
628	}
629