← All changes | app/src/Utility/Sanitize.php +48 -0 1.3.8 → 1.9.2 View file →

		@@ -8,12 +8,16 @@
8	8	public static function html( $input, $allowed_tags = null, $namespace = null, $auto_p = false ){
9	9	// A fix to allow empty data url for src in image tag
10	10	if( $namespace === 'depicter/output' ){
11	11	add_filter( 'wp_kses_uri_attributes', [ __CLASS__, 'skipSrcEscapeTemporary' ], 25 );
	12	+ add_filter( 'safe_style_css', [ __CLASS__, 'modifyAllowedCssAttributes' ]);
	13	+ add_filter( 'safecss_filter_attr_allow_css', [ __CLASS__, 'checkAllowedCssValue' ], 10, 2);
12	14	}
13	15	$sanitized = parent::html( $input, $allowed_tags, $namespace, $auto_p );
14	16	if( $namespace === 'depicter/output' ){
15	17	remove_filter( 'wp_kses_uri_attributes', [ __CLASS__, 'skipSrcEscapeTemporary' ], 25 );
	18	+ remove_filter( 'safe_style_css', [ __CLASS__, 'modifyAllowedCssAttributes' ]);
	19	+ remove_filter( 'safecss_filter_attr_allow_css', [ __CLASS__, 'checkAllowedCssValue' ], 10, 2);
16	20	}
17	21
18	22	return $sanitized;
19	23	}
		@@ -53,6 +57,50 @@
53	57	if ( ( $key = array_search( 'src', $uriAttributes ) ) !== false) {
54	58	unset( $uriAttributes[ $key ] );
55	59	}
56	60	return $uriAttributes;
	61	+ }
	62	+
	63	+ /**
	64	+ * Modify allowed css attributes
	65	+ *
	66	+ * @param $properties
	67	+ *
	68	+ * @return mixed
	69	+ */
	70	+ public static function modifyAllowedCssAttributes( $properties ) {
	71	+ $properties = array_merge( $properties, [
	72	+ 'fill',
	73	+ 'opacity',
	74	+ 'stroke',
	75	+ 'stroke-width',
	76	+ 'stroke-opacity',
	77	+ 'fill-opacity',
	78	+ 'transform'
	79	+ ]);
	80	+
	81	+ return $properties;
	82	+ }
	83	+
	84	+ /**
	85	+ * Check for allowed css values
	86	+ *
	87	+ * @param $allowed
	88	+ * @param $css_test_string
	89	+ *
	90	+ * @return bool
	91	+ */
	92	+ public static function checkAllowedCssValue( $allowed, $css_test_string ): bool{
	93	+
	94	+ $allowedCssValues = [
	95	+ 'rotate',
	96	+ 'scale'
	97	+ ];
	98	+
	99	+ foreach( $allowedCssValues as $value ) {
	100	+ if ( ! $allowed && str_contains( $css_test_string, $value ) ) {
	101	+ return true;
	102	+ }
	103	+ }
	104	+ return $allowed;
57	105	}
58	106	}