| @@ -1,9 +1,7 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | namespace Elementor; |
| 3 | 3 | |
| 4 | -use Elementor\Core\Settings\Page\Manager; | |
| 5 | - | |
| 6 | 4 | if ( ! defined( 'ABSPATH' ) ) { |
| 7 | 5 | exit; // Exit if accessed directly. |
| 8 | 6 | } |
| 9 | 7 | |
| @@ -22,8 +20,9 @@ | ||
| 22 | 20 | /** |
| 23 | 21 | * A list of safe tage for `validate_html_tag` method. |
| 24 | 22 | */ |
| 25 | 23 | const ALLOWED_HTML_WRAPPER_TAGS = [ |
| 24 | + 'a', | |
| 26 | 25 | 'article', |
| 27 | 26 | 'aside', |
| 28 | 27 | 'div', |
| 29 | 28 | 'footer', |
| @@ -151,18 +150,8 @@ | ||
| 151 | 150 | "SET `meta_value` = REPLACE(`meta_value`, '" . str_replace( '/', '\\\/', $from ) . "', '" . str_replace( '/', '\\\/', $to ) . "') " . |
| 152 | 151 | "WHERE `meta_key` = '_elementor_data' AND `meta_value` LIKE '[%' ;" ); // meta_value LIKE '[%' are json formatted |
| 153 | 152 | // @codingStandardsIgnoreEnd |
| 154 | 153 | |
| 155 | - $second_rows_affected = $wpdb->query( | |
| 156 | - "UPDATE {$wpdb->postmeta} " . | |
| 157 | - $wpdb->prepare( 'SET `meta_value` = REPLACE(`meta_value`, %s, %s) ', $from, $to ) . | |
| 158 | - 'WHERE `meta_key` = \'' . Manager::META_KEY . '\'' | |
| 159 | - ); | |
| 160 | - | |
| 161 | - if ( $second_rows_affected ) { | |
| 162 | - $rows_affected += $second_rows_affected; | |
| 163 | - } | |
| 164 | - | |
| 165 | 154 | if ( false === $rows_affected ) { |
| 166 | 155 | throw new \Exception( __( 'An error occurred', 'elementor' ) ); |
| 167 | 156 | } |
| 168 | 157 | |
| @@ -475,8 +464,20 @@ | ||
| 475 | 464 | |
| 476 | 465 | return implode( ' ', $rendered_attributes ); |
| 477 | 466 | } |
| 478 | 467 | |
| 468 | + /** | |
| 469 | + * Safe print html attributes | |
| 470 | + * | |
| 471 | + * @access public | |
| 472 | + * @static | |
| 473 | + * @param array $attributes | |
| 474 | + */ | |
| 475 | + public static function print_html_attributes( array $attributes ) { | |
| 476 | + // PHPCS - the method render_html_attributes is safe. | |
| 477 | + echo self::render_html_attributes( $attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 478 | + } | |
| 479 | + | |
| 479 | 480 | public static function get_meta_viewport( $context = '' ) { |
| 480 | 481 | $meta_tag = '<meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />'; |
| 481 | 482 | /** |
| 482 | 483 | * Viewport meta tag. |
| @@ -669,8 +670,25 @@ | ||
| 669 | 670 | * @return string |
| 670 | 671 | */ |
| 671 | 672 | public static function validate_html_tag( $tag ) { |
| 672 | 673 | return in_array( strtolower( $tag ), self::ALLOWED_HTML_WRAPPER_TAGS ) ? $tag : 'div'; |
| 674 | + } | |
| 675 | + | |
| 676 | + /** | |
| 677 | + * Safe print a validated HTML tag. | |
| 678 | + * | |
| 679 | + * @param string $tag | |
| 680 | + */ | |
| 681 | + public static function print_validated_html_tag( $tag ) { | |
| 682 | + // PHPCS - the method validate_html_tag is safe. | |
| 683 | + echo self::validate_html_tag( $tag ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 684 | + } | |
| 685 | + | |
| 686 | + /** | |
| 687 | + * Print internal content (not user input) without escaping. | |
| 688 | + */ | |
| 689 | + public static function print_unescaped_internal_string( $string ) { | |
| 690 | + echo $string; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 673 | 691 | } |
| 674 | 692 | |
| 675 | 693 | /** |
| 676 | 694 | * Get recently edited posts query. |
