| @@ -7,8 +7,11 @@ | ||
| 7 | 7 | * mid-body (e.g. during a settings page render) must wait for the global to |
| 8 | 8 | * appear. We poll for up to ~3s, then fall back to a hidden DOM queue that |
| 9 | 9 | * the toast script flushes when it boots. |
| 10 | 10 | */ |
| 11 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 12 | + exit; | |
| 13 | +} | |
| 11 | 14 | function _easy_invoice_emit_toast_script($type, $message, $options) { |
| 12 | 15 | $type = in_array($type, array('success', 'error', 'warning', 'info'), true) ? $type : 'info'; |
| 13 | 16 | $message = (string) $message; |
| 14 | 17 | $payload = wp_json_encode( |
| @@ -28,9 +31,12 @@ | ||
| 28 | 31 | // appended to <body> by its jQuery-ready init() — calling show() before |
| 29 | 32 | // the container exists crashes on `toastContainer.append(...)`. |
| 30 | 33 | // The `fired` latch guarantees we fire exactly once across the interval, |
| 31 | 34 | // DOMContentLoaded, and load triggers. |
| 32 | - echo "<script>(function(){var p=" . $payload . ";var fired=false;" | |
| 35 | + // The payload is JSON built with JSON_HEX_* above, which is what makes it | |
| 36 | + // safe inside <script>; esc_html() would turn its quotes into " and | |
| 37 | + // the script would not parse. | |
| 38 | + echo "<script>(function(){var p=" . $payload . ";var fired=false;" // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 33 | 39 | . "function ready(){return !!(window.EasyInvoiceToast" |
| 34 | 40 | . "&&typeof window.EasyInvoiceToast[p.type]==='function'" |
| 35 | 41 | . "&&document.getElementById('easy-invoice-toast-container'));}" |
| 36 | 42 | . "function fire(){if(fired)return true;if(!ready())return false;" |
