depicter / vendor / averta / wordpress / src / Utility / Sanitize.php

Sanitize.php in Depicter — Popup & Slider Builder 1.6.2, at vendor/averta/wordpress/src/Utility/Sanitize.php

635 lines 16.1 KB

Raw Download Zip

1	<?php
2	namespace Averta\WordPress\Utility;
3
4	class Sanitize
5	{
6	/**
7	* Sanitize title.
8	*
9	* @param string $input
10	*
11	* @return string
12	*/
13	public static function title( $input )
14	{
15	return sanitize_title( $input );
16	}
17
18	/**
19	* Sanitize slug.
20	*
21	* @param string $input
22	*
23	* @return string
24	*/
25	public static function slug( $input )
26	{
27	return sanitize_title( static::dash( $input ) );
28	}
29
30	/**
31	* Sanitize a textarea input field. Removes bad html like <script> and <html>.
32	*
33	* @param string $input
34	*
35	* @return string
36	*/
37	public static function textarea( $input )
38	{
39	global $allowedposttags;
40	return wp_kses( $input, $allowedposttags );
41	}
42
43	/**
44	* Sanitize nothing.
45	*
46	* @param string $input
47	*
48	* @return string
49	*/
50	public static function raw( $input )
51	{
52	return $input;
53	}
54
55	/**
56	* Sanitize URL
57	*
58	* Remove all characters except letters, digits and !#$%&'*+-=?^_`{\|}~@.[].
59	*
60	* @param string $url
61	*
62	* @return string
63	*/
64	public static function url( $url )
65	{
66	return filter_var( $url, FILTER_SANITIZE_URL );
67	}
68
69	/**
70	* Sanitize Number int
71	*
72	* Remove all characters except digits, plus and minus sign.
73	*
74	* @param string $input
75	*
76	* @return string
77	*/
78	public static function int( $input )
79	{
80	return absint( filter_var( $input, FILTER_SANITIZE_NUMBER_INT ) );
81	}
82
83	/**
84	* Sanitize Attribute.
85	*
86	* @param string $input
87	*
88	* @return string
89	*/
90	public static function attribute( $input )
91	{
92	return esc_attr( $input );
93	}
94	/**
95	* Sanitize SQL
96	*
97	* @param string $input
98	*
99	* @return string
100	*/
101	public static function sql( $input )
102	{
103	return esc_sql( $input );
104	}
105
106	/**
107	* Sanitize text as plaintext.
108	*
109	* @param string $input
110	*
111	* @return string
112	*/
113	public static function plaintext( $input )
114	{
115	return wp_kses( $input, [] );
116	}
117
118	/**
119	* Sanitizes a string from user input or from the database.
120	*
121	* @param string $input
122	*
123	* @return string
124	*/
125	public static function textfield( $input )
126	{
127	return sanitize_text_field( $input );
128	}
129
130	/**
131	* Strips out all characters that are not allowable in an email.
132	*
133	* @param string $input
134	*
135	* @return string
136	*/
137	public static function email( $input )
138	{
139	return sanitize_email( $input );
140	}
141
142	/**
143	* Sanitizes an HTML classname to ensure it only contains valid characters.
144	*
145	* @param string $input
146	*
147	* @return string
148	*/
149	public static function htmlClass( $input )
150	{
151	return sanitize_html_class( $input );
152	}
153
154	/**
155	* Sanitizes a string key.
156	*
157	* Keys are used as internal identifiers. Lowercase alphanumeric characters, dashes, and underscores are allowed.
158	*
159	* @param string $input
160	*
161	* @return string
162	*/
163	public static function key( $input )
164	{
165	return sanitize_key( $input );
166	}
167
168	/**
169	* Sanitize editor data. Much like textarea remove <script> and <html>.
170	* However, if the user can create unfiltered HTML allow it.
171	*
172	* @param string $input
173	* @param bool $force_filter
174	* @param bool $auto_p
175	* @param null $allowed_tags
176	*
177	* @return string
178	*/
179	public static function editor( $input, $force_filter = false, $auto_p = false, $allowed_tags = null )
180	{
181	if (current_user_can( 'unfiltered_html' ) && !$force_filter) {
182	$output = trim( $input );
183	} else {
184	global $allowedtags;
185	$output = wp_kses( trim($input), apply_filters('averta/wordpress/sanitize/editor/tags', $allowed_tags ?? $allowedtags) );
186	}
187
188	if( $auto_p ) {
189	$output = wpautop($output);
190	}
191
192	return $output;
193	}
194
195	/**
196	* Sanitizes content for allowed HTML tags for post content.
197	*
198	* @param string $input Post content to filter.
199	* @return string Filtered post content with allowed HTML tags and attributes intact.
200	*/
201	public static function post( $input )
202	{
203	return wp_kses_post( $input );
204	}
205
206	/**
207	* Sanitizes content for allowed HTML tags.
208	*
209	* @param string $input HTML input
210	* @param null\|array $allowed_tags allowed tags for wp_kses
211	* @param null\|string $namespace
212	* @param bool $auto_p
213	*
214	* @return string
215	*/
216	public static function html( $input, $allowed_tags = null, $namespace = null, $auto_p = false ) {
217	$tags = apply_filters('averta/wordpress/sanitize/html/tags/' . ($namespace ? $namespace : 'default'), $allowed_tags ? $allowed_tags : self::defaultAllowedTags() );
218
219	$output = trim( wp_kses( trim( $input ), $tags ) );
220
221	if( $auto_p ) {
222	$output = wpautop( $output );
223	}
224
225	return $output;
226	}
227
228	/**
229	* Sanitizes json for allowed HTML tags.
230	*
231	* @param string $input HTML input
232	* @param null\|array $allowed_tags allowed tags for wp_kses
233	* @param null\|string $namespace
234	*
235	* @return string
236	*/
237	public static function json( $input, $allowed_tags = null, $namespace = null ) {
238	$tags = apply_filters('averta/wordpress/sanitize/json/tags/' . ($namespace ? $namespace : 'default'), $allowed_tags ? $allowed_tags : self::defaultAllowedTags() );
239
240	$output = trim( wp_kses( trim( $input ), $tags ) );
241
242	return $output;
243	}
244
245	/**
246	* Retrieves default WordPress HTML tags
247	*
248	* @return array
249	*/
250	protected static function defaultAllowedTags(){
251	$tags = [
252	'em' => [],
253	'strong' => [],
254	'small' => [],
255	'sub' => [],
256	'sup' => [],
257	'b' => [],
258	'i' => [],
259	'ul' => [],
260	'ol' => [],
261	'hgroup' => [],
262	'h1' => [],
263	'h2' => [],
264	'h3' => [],
265	'h4' => [],
266	'h5' => [],
267	'h6' => [],
268	'table' => [],
269	'tbody' => [],
270	'tfoot' => [],
271	'thead' => [],
272	'dd' => [],
273	'dt' => [],
274	'dl' => [],
275	'tr' => [],
276	'th' => [],
277	'td' => [],
278	'figure' => [],
279	'figcaption' => [],
280	'caption' => [],
281	'desc' => [],
282	'line' => [],
283	'marker' => [],
284	'mask' => [],
285	'metadata' => [],
286	'pattern' => [],
287	'textpath' => [],
288	'use' => [],
289	'div' => [],
290	'img' => [
291	'src' => true,
292	'alt' => true,
293	'title' => true,
294	'data-*' => true
295	],
296	'video' => [
297	'autoplay' => true,
298	'controls' => true,
299	'height' => true,
300	'loop' => true,
301	'muted' => true,
302	'playsinline' => true,
303	'poster' => true,
304	'preload' => true,
305	'src' => true,
306	'width' => true,
307	'data-*' => true
308	],
309	'a' => [
310	'id' => true,
311	'class' => true,
312	'style' => true,
313	'href' => true,
314	'title' => true,
315	'rev' => true,
316	'rel' => true,
317	'target' => true,
318	'download' => ['valueless' => 'y'],
319	'data-*' => true
320	],
321	'li' => [],
322	'blockquote' => [],
323	'cite' => [],
324	'code' => [],
325	'hr' => [],
326	'p' => [],
327	'br' => [],
328	'link' => [
329	'id' => true,
330	'rel' => true,
331	'href' => true,
332	'media' => true,
333	'as' => true,
334	'imagesrcset' =>true,
335	'type' => true
336	],
337	'script' => [
338	'id' => true,
339	'src' => true
340	],
341	'style' => [
342	'id' => true,
343	'type' => true
344	],
345	'meta' => [
346	'charset' => true,
347	'name' => true,
348	'content' => true
349	],
350	'body' => [
351	'id' => true,
352	'class' => true,
353	'dir' => true
354	],
355	'picture' => [
356	'id' => true,
357	'class' => true,
358	'style' => true,
359	'data-*'=> true
360	],
361	'source' => [
362	'media' => true,
363	'srcset' => true,
364	'src' => true,
365	'data-*' => true
366	],
367	'iframe' => [
368	'src' => true,
369	'height' => true,
370	'width' => true,
371	'frameborder' => true,
372	'allowfullscreen' => true,
373	],
374	'svg' => [
375	'xmlns' => [],
376	'fill' => [],
377	'viewbox' => [],
378	'role' => [],
379	'aria-hidden' => [],
380	'focusable' => [],
381	'width' => [],
382	'height' => [],
383	'style' => [],
384	'class' => []
385	],
386	'path' => [
387	'id' => [],
388	'class' => [],
389	'd' => [],
390	'fill' => [],
391	'fill-rule' => [],
392	'width' => [],
393	'height' => [],
394	'transform' => [],
395	'stroke-width' => [],
396	'stroke' => [],
397	'opacity' => [],
398	'style' => []
399	],
400	'g' => [
401	'id' => [],
402	'class' => [],
403	'fill' => [],
404	'width' => [],
405	'height' => [],
406	'transform' => [],
407	'data-name' => [],
408	'stroke-width' => [],
409	'stroke' => [],
410	'opacity' => [],
411	'style' => []
412	],
413	'rect' => [
414	'id' => [],
415	'class' => [],
416	'fill' => [],
417	'width' => [],
418	'height' => [],
419	'transform' => [],
420	'opacity' => [],
421	'data-name' => [],
422	'x' => [],
423	'y' => [],
424	'rx' => [],
425	'ry' => [],
426	'style' => []
427	],
428	'circle' => [
429	'id' => [],
430	'class' => [],
431	'fill' => [],
432	'transform' => [],
433	'data-name' => [],
434	'cx' => [],
435	'cy' => [],
436	'r' => [],
437	'stroke-width' => [],
438	'stroke' => [],
439	'opacity' => [],
440	'style' => []
441	],
442	'ellipse' => [
443	'id' => [],
444	'class' => [],
445	'fill' => [],
446	'transform' => [],
447	'opacity' => [],
448	'data-name' => [],
449	'style' => [],
450	'cx' => [],
451	'cy' => [],
452	'rx' => [],
453	'ry' => []
454	],
455	'text' => [
456	'fill' => [],
457	'width' => [],
458	'height' => [],
459	'transform' => [],
460	'font-size' => [],
461	'font-family' => [],
462	'font-weight' => [],
463	'letter-spacing' => [],
464	'x' => [],
465	'y' => [],
466	'opacity' => []
467	],
468	'lineargradient' => [
469	'id' => [],
470	'href'=> [],
471	'x1' => [],
472	'x2' => [],
473	'y1' => [],
474	'y2' => [],
475	'spreadMethod' => [],
476	'gradientUnits' => []
477	],
478	'stop' => [
479	'offset' => [],
480	'stop-color' => []
481	],
482	'radialgradient' => [],
483	'defs' => [],
484	'clippath' => [],
485	'filter' => [
486	'filterUnits' => [],
487	'id' => [],
488	'class' => [],
489	'width' => [],
490	'height' => [],
491	'x' => [],
492	'y' => [],
493	'opacity' => []
494	],
495	'feOffset' => [
496	'dx' => [],
497	'dy' => [],
498	'input' => [],
499	],
500	'feGaussianBlur' => [
501	'stdDeviation' => [],
502	'result' => []
503	],
504	'feFlood' => [
505	'flood-color' => []
506	],
507	'feComposite' => [
508	'operator' => [],
509	'in' => [],
510	'in2' => [],
511	],
512	'symbol' => [
513	'id' => [],
514	'class' => [],
515	'viewbox' => [],
516	'preserveaspectratio' => []
517	]
518	];
519
520	return $tags;
521	}
522
523	/**
524	* Sanitize Hex Color Value
525	*
526	* If the hex does not validate return a default instead.
527	*
528	* @param string $hex
529	* @param string $default
530	*
531	* @return string
532	*/
533	public static function hex( $hex, $default = '#000000' )
534	{
535	if ( preg_match("/^\#?([a-fA-F0-9]{3}){1,2}$/", $hex ) ) {
536	return $hex;
537	}
538
539	return $default;
540	}
541
542	/**
543	* Sanitize Underscore
544	*
545	* Remove all special characters and replace spaces and dashes with underscores
546	* allowing only a single underscore after trimming whitespace form string and
547	* lower casing
548	*
549	* ` --"2_ _e''X AM!pl'e-"-1_@` -> _2_ex_ample_1_
550	*
551	* @param string $name
552	* @param bool $keep_dots
553	*
554	* @return mixed\|string
555	*/
556	public static function underscore( $name, $keep_dots = false )
557	{
558	if (is_string( $name )) {
559
560	if($keep_dots) {
561	$name = preg_replace( '/[\.]+/', '.', $name );
562	$name = preg_replace("/[^A-Za-z0-9\.\\s\\-\\_?]/",'', strtolower(trim($name)) );
563	} else {
564	$name = preg_replace( '/[\.]+/', '_', $name );
565	$name = preg_replace("/[^A-Za-z0-9\\s\\-\\_?]/",'', strtolower(trim($name)) );
566	}
567
568
569	$name = preg_replace( '/[-\\s]+/', '_', $name );
570	$name = preg_replace( '/_+/', '_', $name );
571	}
572
573	return $name;
574	}
575
576	/**
577	* Sanitize Dash
578	*
579	* Remove all special characters and replace spaces and underscores with dashes
580	* allowing only a single dash after trimming whitespace form string and
581	* lower casing
582	*
583	* ` --"2_ _e\'\'X AM!pl\'e-"-1_@` -> -2-ex-ample-1-
584	*
585	* @param string $name
586	*
587	* @return mixed\|string
588	*/
589	public static function dash( $name )
590	{
591	if (is_string( $name )) {
592	$name = preg_replace( '/[\.]+/', '_', $name );
593	$name = preg_replace("/[^A-Za-z0-9\\s\\-\\_?]/",'', strtolower(trim($name)) );
594	$name = preg_replace( '/[_\\s]+/', '-', $name );
595	$name = preg_replace( '/-+/', '-', $name );
596	}
597
598	return $name;
599	}
600
601	/**
602	* Sanitizes a filename, replacing whitespace with dashes.
603	*
604	* @param $filename
605	*
606	* @return string
607	*/
608	public static function fileName( $filename ){
609	return sanitize_file_name( $filename );
610	}
611
612	/**
613	* Removes only shortcode tags from the given content but keeps content of shortcodes
614	*
615	* @param string $content
616	* @param array $excludeStripShortcodeTags
617	*
618	* @return array\|string\|string[]\|null
619	*/
620	public static function stripShortcodes( $content, $excludeStripShortcodeTags = [] ) {
621	if( ! $content )
622	return $content;
623
624	if( ! $excludeStripShortcodeTags )
625	$excludeStripShortcodeTags = apply_filters( "averta/wordpress/exclude/strip/shortcode/tags", [] );
626
627	if( empty( $excludeStripShortcodeTags ) \|\| ! is_array( $excludeStripShortcodeTags ) )
628	return preg_replace('/\[[^\]]*\]/', '', $content);
629
630	$exclude_codes = join('\|', $excludeStripShortcodeTags );
631
632	return preg_replace( "~(?:\[/?)(?!(?:$exclude_codes))[^/\]]+/?\]~s", '', $content );
633	}
634	}
635