← All changes | includes/base/widget-base.php +21 -28 4.2.4 → 3.26.2 View file →

		@@ -1,9 +1,8 @@
1	1	<?php
2	2	namespace Elementor;
3	3
4	4	use Elementor\Core\Utils\Promotions\Filtered_Promotions_Manager;
5		-use Elementor\Utils;
6	5
7	6	if ( ! defined( 'ABSPATH' ) ) {
8	7	exit; // Exit if accessed directly.
9	8	}
		@@ -300,9 +299,9 @@
300	299	foreach ( $skins as $skin_id => $skin ) {
301	300	$skin_options[ $skin_id ] = $skin->get_title();
302	301	}
303	302
304		- // Get the first item for default value.
	303	+ // Get the first item for default value
305	304	$default_value = array_keys( $skin_options );
306	305	$default_value = array_shift( $default_value );
307	306
308	307	if ( 1 >= count( $skin_options ) ) {
		@@ -379,9 +378,9 @@
379	378	'categories' => $this->get_categories(),
380	379	'html_wrapper_class' => $this->get_html_wrapper_class(),
381	380	'show_in_panel' => $this->show_in_panel(),
382	381	'hide_on_search' => $this->hide_on_search(),
383		- 'upsale_data' => Plugin::$instance->experiments->is_feature_active( 'e_panel_promotions' ) ? null : $this->get_upsale_data(),
	382	+ 'upsale_data' => $this->get_upsale_data(),
384	383	'is_dynamic_content' => $this->is_dynamic_content(),
385	384	'has_widget_inner_wrapper' => $this->has_widget_inner_wrapper(),
386	385	];
387	386
		@@ -426,9 +425,9 @@
426	425	protected function print_template_content( $template_content ) {
427	426	if ( $this->has_widget_inner_wrapper() ) : ?>
428	427	<div class="elementor-widget-container">
429	428	<?php endif;
430		- Utils::print_unescaped_internal_string( $template_content );
	429	+ echo $template_content; // XSS ok.
431	430	if ( $this->has_widget_inner_wrapper() ) : ?>
432	431	</div>
433	432	<?php endif;
434	433	}
		@@ -541,17 +540,18 @@
541	540	*
542	541	* Used to add Light-Box-related data attributes to links that open media files.
543	542	*
544	543	* @param array|string $element The link HTML element.
545		- * @param int $id The ID of the image.
546		- * @param string $lightbox_setting_key The setting key that dictates whether to open the image in a lightbox.
547		- * @param string $group_id Unique ID for a group of lightbox images.
548		- * @param bool $overwrite Optional. Whether to overwrite existing
549		- * attribute. Default is false, not to overwrite.
	544	+ * @param int $id The ID of the image
	545	+ * @param string $lightbox_setting_key The setting key that dictates whether to open the image in a lightbox
	546	+ * @param string $group_id Unique ID for a group of lightbox images
	547	+ * @param bool $overwrite Optional. Whether to overwrite existing
	548	+ * attribute. Default is false, not to overwrite.
550	549	*
551	550	* @return Widget_Base Current instance of the widget.
552	551	* @since 2.9.0
553	552	* @access public
	553	+ *
554	554	*/
555	555	public function add_lightbox_data_attributes( $element, $id = null, $lightbox_setting_key = null, $group_id = null, $overwrite = false ) {
556	556	$kit = Plugin::$instance->kits_manager->get_active_kit();
557	557
		@@ -659,9 +659,10 @@
659	659	* @param string $widget_content The content of the widget.
660	660	* @param Widget_Base $this The widget.
661	661	*/
662	662	$widget_content = apply_filters( 'elementor/widget/render_content', $widget_content, $this );
663		- Utils::print_unescaped_internal_string( $widget_content );
	663	+
	664	+ echo $widget_content; // XSS ok.
664	665	?>
665	666	<?php if ( $this->has_widget_inner_wrapper() ) : ?>
666	667	</div>
667	668	<?php endif;
		@@ -696,16 +697,8 @@
696	697	public function render_plain_content() {
697	698	$this->render_content();
698	699	}
699	700
700		- public function render_markdown(): string {
701		- ob_start();
702		- $this->render_content();
703		- $html = ob_get_clean();
704		-
705		- return wp_strip_all_tags( $html );
706		- }
707		-
708	701	/**
709	702	* Before widget rendering.
710	703	*
711	704	* Used to add stuff before the widget `_wrapper` element.
		@@ -787,10 +780,10 @@
787	780	*
788	781	* Script tags are allowed on frontend according to the WP theme securing policy.
789	782	*
790	783	* @param string $setting
791		- * @param null $repeater_name
792		- * @param null $index
	784	+ * @param null $repeater_name
	785	+ * @param null $index
793	786	*/
794	787	final public function print_unescaped_setting( $setting, $repeater_name = null, $index = null ) {
795	788	if ( $repeater_name ) {
796	789	$repeater = $this->get_settings_for_display( $repeater_name );
		@@ -855,9 +848,9 @@
855	848	* @access protected
856	849	*
857	850	* @param string $setting_key The current setting key inside the repeater item (e.g. `tab_title`).
858	851	* @param string $repeater_key The repeater key containing the array of all the items in the repeater (e.g. `tabs`).
859		- * @param int $repeater_item_index The current item index in the repeater array (e.g. `3`).
	852	+ * @param int $repeater_item_index The current item index in the repeater array (e.g. `3`).
860	853	*
861	854	* @return string The repeater setting key (e.g. `tabs.3.tab_title`).
862	855	*/
863	856	protected function get_repeater_setting_key( $setting_key, $repeater_key, $repeater_item_index ) {
		@@ -1014,12 +1007,12 @@
1014	1007	return $this->get_name();
1015	1008	}
1016	1009
1017	1010	/**
1018		- * @param string $plugin_title Plugin's title.
1019		- * @param string $since Plugin version widget was deprecated.
1020		- * @param string $last Plugin version in which the widget will be removed.
1021		- * @param string $replacement Widget replacement.
	1011	+ * @param string $plugin_title Plugin's title
	1012	+ * @param string $since Plugin version widget was deprecated
	1013	+ * @param string $last Plugin version in which the widget will be removed
	1014	+ * @param string $replacement Widget replacement
1022	1015	*/
1023	1016	protected function deprecated_notice( $plugin_title, $since, $last = '', $replacement = '' ) {
1024	1017	$this->start_controls_section(
1025	1018	'Deprecated',
		@@ -1065,11 +1058,11 @@
1065	1058	* Mark widget as deprecated.
1066	1059	*
1067	1060	* Use `get_deprecation_message()` method to print the message control at specific location in register_controls().
1068	1061	*
1069		- * @param string $version The version of Elementor that deprecated the widget.
1070		- * @param string $message A message regarding the deprecation.
1071		- * @param string $replacement The widget that should be used instead.
	1062	+ * @param $version string The version of Elementor that deprecated the widget.
	1063	+ * @param $message string A message regarding the deprecation.
	1064	+ * @param $replacement string The widget that should be used instead.
1072	1065	*/
1073	1066	protected function add_deprecation_message( $version, $message, $replacement ) {
1074	1067	// Expose the config for handling in JS.
1075	1068	$this->set_config( 'deprecation', [