← All changes | includes/utils.php +25 -165 4.3.0-beta2 → 3.31.2 View file →

		@@ -29,9 +29,8 @@
29	29	'a',
30	30	'article',
31	31	'aside',
32	32	'button',
33		- 'form',
34	33	'div',
35	34	'footer',
36	35	'h1',
37	36	'h2',
		@@ -46,29 +45,8 @@
46	45	'section',
47	46	'span',
48	47	];
49	48
50		- /**
51		- * Tags that must never be usable as an HTML wrapper tag, regardless of what
52		- * `elementor/allowed_html_wrapper_tags` filters return. These are the classic
53		- * script-execution / markup-injection vectors (XSS), so they're enforced as a
54		- * hard denylist rather than left to filter authors to avoid re-adding them.
55		- */
56		- const FORBIDDEN_HTML_WRAPPER_TAGS = [
57		- 'script',
58		- 'iframe',
59		- 'object',
60		- 'embed',
61		- 'style',
62		- 'link',
63		- 'meta',
64		- 'base',
65		- 'noscript',
66		- 'template',
67		- 'svg',
68		- 'math',
69		- ];
70		-
71	49	const EXTENDED_ALLOWED_HTML_TAGS = [
72	50	'iframe' => [
73	51	'iframe' => [
74	52	'allow' => true,
		@@ -220,9 +198,9 @@
220	198	* @param string $from
221	199	* @param string $to
222	200	*
223	201	* @return string
224		- * @throws \Exception If URLs are missing or invalid URLs provided.
	202	+ * @throws \Exception Replace URL exception.
225	203	*/
226	204	public static function replace_urls( $from, $to ) {
227	205	$from = trim( $from );
228	206	$to = trim( $to );
		@@ -534,14 +512,14 @@
534	512	* @since 2.1.2
535	513	* @access public
536	514	* @static
537	515	*/
538		- public static function array_inject( $base_array, $key, $insert ) {
539		- $length = array_search( $key, array_keys( $base_array ), true ) + 1;
	516	+ public static function array_inject( $array, $key, $insert ) {
	517	+ $length = array_search( $key, array_keys( $array ), true ) + 1;
540	518
541		- return array_slice( $base_array, 0, $length, true ) +
	519	+ return array_slice( $array, 0, $length, true ) +
542	520	$insert +
543		- array_slice( $base_array, $length, null, true );
	521	+ array_slice( $array, $length, null, true );
544	522	}
545	523
546	524	/**
547	525	* Render html attributes
		@@ -658,34 +636,15 @@
658	636	public static function has_pro() {
659	637	return defined( 'ELEMENTOR_PRO_VERSION' );
660	638	}
661	639
662		- public static function is_license_active(): bool {
663		- return class_exists( '\ElementorPro\License\API' ) && \ElementorPro\License\API::is_license_active();
664		- }
665		-
666		- public static function is_pro_installed_and_not_active(): bool {
667		- if ( ! function_exists( 'get_plugins' ) ) {
668		- require_once ABSPATH . 'wp-admin/includes/plugin.php';
669		- }
670		-
671		- $file_path = self::get_elementor_pro_file_path();
672		- $installed_plugins = get_plugins();
673		-
674		- return isset( $installed_plugins[ $file_path ] );
675		- }
676		-
677		- private static function get_elementor_pro_file_path(): string {
678		- return 'elementor-pro/elementor-pro.php';
679		- }
680		-
681	640	/**
682	641	* Convert HTMLEntities to UTF-8 characters
683	642	*
684		- * @param string $html_string
	643	+ * @param string $string
685	644	* @return string
686	645	*/
687		- public static function urlencode_html_entities( $html_string ) {
	646	+ public static function urlencode_html_entities( $string ) {
688	647	$entities_dictionary = [
689	648	'‘' => "'", // Opening single quote
690	649	'’' => "'", // Closing single quote
691	650	'“' => '"', // Closing double quote
		@@ -698,11 +657,11 @@
698	657	'„' => '"', // Double low quote
699	658	];
700	659
701	660	// Decode decimal entities
702		- $html_string = str_replace( array_keys( $entities_dictionary ), array_values( $entities_dictionary ), $html_string );
	661	+ $string = str_replace( array_keys( $entities_dictionary ), array_values( $entities_dictionary ), $string );
703	662
704		- return rawurlencode( html_entity_decode( $html_string, ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
	663	+ return rawurlencode( html_entity_decode( $string, ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
705	664	}
706	665
707	666	/**
708	667	* Parse attributes that come as a string of comma-delimited key|value pairs.
		@@ -754,19 +713,13 @@
754	713	if ( $id === $element['id'] ) {
755	714	return $element;
756	715	}
757	716
758		- $inner_elements = apply_filters(
759		- 'elementor/utils/find_element_recursive/inner_elements',
760		- $element['elements'] ?? [],
761		- $element
762		- );
	717	+ if ( ! empty( $element['elements'] ) ) {
	718	+ $element = self::find_element_recursive( $element['elements'], $id );
763	719
764		- if ( ! empty( $inner_elements ) ) {
765		- $found = self::find_element_recursive( $inner_elements, $id );
766		-
767		- if ( $found ) {
768		- return $found;
	720	+ if ( $element ) {
	721	+ return $element;
769	722	}
770	723	}
771	724	}
772	725
		@@ -796,45 +749,8 @@
796	749	}
797	750	}
798	751
799	752	/**
800		- * @var string[]|null
801		- */
802		- private static $resolved_allowed_html_wrapper_tags;
803		-
804		- /**
805		- * Get allowed HTML wrapper tags.
806		- *
807		- * @since 4.4.0
808		- *
809		- * @return string[]
810		- */
811		- public static function get_allowed_html_wrapper_tags(): array {
812		- if ( null !== self::$resolved_allowed_html_wrapper_tags ) {
813		- return self::$resolved_allowed_html_wrapper_tags;
814		- }
815		-
816		- /**
817		- * Allowed HTML wrapper tags.
818		- *
819		- * Filters the list of allowed HTML tag names used by `validate_html_tag()`.
820		- *
821		- * Note: tags in `Utils::FORBIDDEN_HTML_WRAPPER_TAGS` (e.g. `script`, `iframe`,
822		- * `object`) are always stripped after this filter runs and cannot be re-added,
823		- * to prevent XSS via a wrapper tag that executes script or embeds external content.
824		- *
825		- * @since 4.4.0
826		- *
827		- * @param string[] $tags A list of lowercase HTML tag name strings.
828		- */
829		- $tags = apply_filters( 'elementor/allowed_html_wrapper_tags', self::ALLOWED_HTML_WRAPPER_TAGS );
830		-
831		- self::$resolved_allowed_html_wrapper_tags = self::normalize_allowed_html_wrapper_tags( $tags );
832		-
833		- return self::$resolved_allowed_html_wrapper_tags;
834		- }
835		-
836		- /**
837	753	* Validate an HTML tag against a safe allowed list.
838	754	*
839	755	* @param string $tag
840	756	*
		@@ -840,37 +756,12 @@
840	756	*
841	757	* @return string
842	758	*/
843	759	public static function validate_html_tag( $tag ) {
844		- return $tag && in_array( strtolower( $tag ), self::get_allowed_html_wrapper_tags(), true ) ? $tag : 'div';
	760	+ return $tag && in_array( strtolower( $tag ), self::ALLOWED_HTML_WRAPPER_TAGS ) ? $tag : 'div';
845	761	}
846	762
847	763	/**
848		- * @param array $tags
849		- *
850		- * @return string[]
851		- */
852		- private static function normalize_allowed_html_wrapper_tags( array $tags ): array {
853		- $normalized_tags = [];
854		-
855		- foreach ( $tags as $tag ) {
856		- if ( ! is_string( $tag ) ) {
857		- continue;
858		- }
859		-
860		- $tag = strtolower( $tag );
861		-
862		- if ( in_array( $tag, self::FORBIDDEN_HTML_WRAPPER_TAGS, true ) ) {
863		- continue;
864		- }
865		-
866		- $normalized_tags[] = $tag;
867		- }
868		-
869		- return array_values( array_unique( $normalized_tags ) );
870		- }
871		-
872		- /**
873	764	* Safe print a validated HTML tag.
874	765	*
875	766	* @param string $tag
876	767	*/
		@@ -881,10 +772,10 @@
881	772
882	773	/**
883	774	* Print internal content (not user input) without escaping.
884	775	*/
885		- public static function print_unescaped_internal_string( $internal_string ) {
886		- echo $internal_string; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	776	+ public static function print_unescaped_internal_string( $string ) {
	777	+ echo $string; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
887	778	}
888	779
889	780	/**
890	781	* Get recently edited posts query.
		@@ -909,9 +800,9 @@
909	800
910	801	return new \WP_Query( $args );
911	802	}
912	803
913		- public static function print_wp_kses_extended( $text, array $tags ) {
	804	+ public static function print_wp_kses_extended( $string, array $tags ) {
914	805	$allowed_html = wp_kses_allowed_html( 'post' );
915	806
916	807	foreach ( $tags as $tag ) {
917	808	if ( isset( self::EXTENDED_ALLOWED_HTML_TAGS[ $tag ] ) ) {
		@@ -919,17 +810,11 @@
919	810	$allowed_html = array_replace_recursive( $allowed_html, $extended_tags );
920	811	}
921	812	}
922	813
923		- echo wp_kses( $text, $allowed_html );
	814	+ echo wp_kses( $string, $allowed_html );
924	815	}
925	816
926		- public static function kses_post_deep( $data ) {
927		- return map_deep( $data, function ( $value ) {
928		- return is_string( $value ) ? wp_kses_post( $value ) : $value;
929		- } );
930		- }
931		-
932	817	public static function is_elementor_path( $path ) {
933	818	$path = wp_normalize_path( $path );
934	819
935	820	/**
		@@ -991,21 +876,21 @@
991	876
992	877	/**
993	878	* Return specific object property value if exist from array of keys.
994	879	*
995		- * @param array $base_array
	880	+ * @param array $array
996	881	* @param array $keys
997	882	* @return mixed|null
998	883	*/
999		- public static function get_array_value_by_keys( $base_array, $keys ) {
	884	+ public static function get_array_value_by_keys( $array, $keys ) {
1000	885	$keys = (array) $keys;
1001	886	foreach ( $keys as $key ) {
1002		- if ( ! isset( $base_array[ $key ] ) ) {
	887	+ if ( ! isset( $array[ $key ] ) ) {
1003	888	return null;
1004	889	}
1005		- $base_array = $base_array[ $key ];
	890	+ $array = $array[ $key ];
1006	891	}
1007		- return $base_array;
	892	+ return $array;
1008	893	}
1009	894
1010	895	public static function get_cached_callback( $callback, $cache_key, $cache_time = 24 * HOUR_IN_SECONDS ) {
1011	896	$cache = get_site_transient( $cache_key );
		@@ -1021,10 +906,10 @@
1021	906	return $cache;
1022	907	}
1023	908
1024	909	public static function is_sale_time(): bool {
1025		- $sale_start_time = gmmktime( 10, 0, 0, 6, 15, 2026 );
1026		- $sale_end_time = gmmktime( 3, 59, 0, 6, 17, 2026 );
	910	+ $sale_start_time = gmmktime( 12, 0, 0, 6, 10, 2025 );
	911	+ $sale_end_time = gmmktime( 3, 59, 0, 6, 17, 2025 );
1027	912
1028	913	$now_time = gmdate( 'U' );
1029	914
1030	915	return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
		@@ -1058,31 +943,6 @@
1058	943	}
1059	944
1060	945	public static function is_custom_kit_applied() {
1061	946	return (bool) Plugin::$instance->kits_manager->get_previous_id();
1062		- }
1063		-
1064		- public static function decode_string( string $encoded_string, ?string $fallback = '' ) {
1065		- try {
1066		- return base64_decode( $encoded_string, true ) ?? $fallback;
1067		- } catch ( \Exception $e ) {
1068		- return $fallback;
1069		- }
1070		- }
1071		-
1072		- public static function encode_string( string $decoded_string ): string {
1073		- return base64_encode( $decoded_string );
1074		- }
1075		-
1076		- public static function html_to_plain_text( string $html ): string {
1077		- if ( empty( $html ) ) {
1078		- return '';
1079		- }
1080		-
1081		- $text = preg_replace( '#<br\s*/?\s*>#i', ' ', $html );
1082		- $text = preg_replace( '#</?[a-z][^>]*>#i', ' ', $text );
1083		- $text = html_entity_decode( $text, ENT_QUOTES, 'UTF-8' );
1084		- $text = str_replace( "\xE2\x80\x8B", '', $text );
1085		-
1086		- return trim( preg_replace( '/\s+/', ' ', $text ) );
1087	947	}
1088	948	}