← All changes | includes/utils.php +7 -120 4.3.0-beta2 → 3.35.7 View file →

		@@ -29,9 +29,8 @@
29	29	'a',
30	30	'article',
31	31	'aside',
32	32	'button',
33		- 'form',
34	33	'div',
35	34	'footer',
36	35	'h1',
37	36	'h2',
		@@ -46,29 +45,8 @@
46	45	'section',
47	46	'span',
48	47	];
49	48
50		- /**
51		- * Tags that must never be usable as an HTML wrapper tag, regardless of what
52		- * `elementor/allowed_html_wrapper_tags` filters return. These are the classic
53		- * script-execution / markup-injection vectors (XSS), so they're enforced as a
54		- * hard denylist rather than left to filter authors to avoid re-adding them.
55		- */
56		- const FORBIDDEN_HTML_WRAPPER_TAGS = [
57		- 'script',
58		- 'iframe',
59		- 'object',
60		- 'embed',
61		- 'style',
62		- 'link',
63		- 'meta',
64		- 'base',
65		- 'noscript',
66		- 'template',
67		- 'svg',
68		- 'math',
69		- ];
70		-
71	49	const EXTENDED_ALLOWED_HTML_TAGS = [
72	50	'iframe' => [
73	51	'iframe' => [
74	52	'allow' => true,
		@@ -658,12 +636,8 @@
658	636	public static function has_pro() {
659	637	return defined( 'ELEMENTOR_PRO_VERSION' );
660	638	}
661	639
662		- public static function is_license_active(): bool {
663		- return class_exists( '\ElementorPro\License\API' ) && \ElementorPro\License\API::is_license_active();
664		- }
665		-
666	640	public static function is_pro_installed_and_not_active(): bool {
667	641	if ( ! function_exists( 'get_plugins' ) ) {
668	642	require_once ABSPATH . 'wp-admin/includes/plugin.php';
669	643	}
		@@ -754,19 +728,13 @@
754	728	if ( $id === $element['id'] ) {
755	729	return $element;
756	730	}
757	731
758		- $inner_elements = apply_filters(
759		- 'elementor/utils/find_element_recursive/inner_elements',
760		- $element['elements'] ?? [],
761		- $element
762		- );
	732	+ if ( ! empty( $element['elements'] ) ) {
	733	+ $element = self::find_element_recursive( $element['elements'], $id );
763	734
764		- if ( ! empty( $inner_elements ) ) {
765		- $found = self::find_element_recursive( $inner_elements, $id );
766		-
767		- if ( $found ) {
768		- return $found;
	735	+ if ( $element ) {
	736	+ return $element;
769	737	}
770	738	}
771	739	}
772	740
		@@ -796,45 +764,8 @@
796	764	}
797	765	}
798	766
799	767	/**
800		- * @var string[]|null
801		- */
802		- private static $resolved_allowed_html_wrapper_tags;
803		-
804		- /**
805		- * Get allowed HTML wrapper tags.
806		- *
807		- * @since 4.4.0
808		- *
809		- * @return string[]
810		- */
811		- public static function get_allowed_html_wrapper_tags(): array {
812		- if ( null !== self::$resolved_allowed_html_wrapper_tags ) {
813		- return self::$resolved_allowed_html_wrapper_tags;
814		- }
815		-
816		- /**
817		- * Allowed HTML wrapper tags.
818		- *
819		- * Filters the list of allowed HTML tag names used by `validate_html_tag()`.
820		- *
821		- * Note: tags in `Utils::FORBIDDEN_HTML_WRAPPER_TAGS` (e.g. `script`, `iframe`,
822		- * `object`) are always stripped after this filter runs and cannot be re-added,
823		- * to prevent XSS via a wrapper tag that executes script or embeds external content.
824		- *
825		- * @since 4.4.0
826		- *
827		- * @param string[] $tags A list of lowercase HTML tag name strings.
828		- */
829		- $tags = apply_filters( 'elementor/allowed_html_wrapper_tags', self::ALLOWED_HTML_WRAPPER_TAGS );
830		-
831		- self::$resolved_allowed_html_wrapper_tags = self::normalize_allowed_html_wrapper_tags( $tags );
832		-
833		- return self::$resolved_allowed_html_wrapper_tags;
834		- }
835		-
836		- /**
837	768	* Validate an HTML tag against a safe allowed list.
838	769	*
839	770	* @param string $tag
840	771	*
		@@ -840,37 +771,12 @@
840	771	*
841	772	* @return string
842	773	*/
843	774	public static function validate_html_tag( $tag ) {
844		- return $tag && in_array( strtolower( $tag ), self::get_allowed_html_wrapper_tags(), true ) ? $tag : 'div';
	775	+ return $tag && in_array( strtolower( $tag ), self::ALLOWED_HTML_WRAPPER_TAGS ) ? $tag : 'div';
845	776	}
846	777
847	778	/**
848		- * @param array $tags
849		- *
850		- * @return string[]
851		- */
852		- private static function normalize_allowed_html_wrapper_tags( array $tags ): array {
853		- $normalized_tags = [];
854		-
855		- foreach ( $tags as $tag ) {
856		- if ( ! is_string( $tag ) ) {
857		- continue;
858		- }
859		-
860		- $tag = strtolower( $tag );
861		-
862		- if ( in_array( $tag, self::FORBIDDEN_HTML_WRAPPER_TAGS, true ) ) {
863		- continue;
864		- }
865		-
866		- $normalized_tags[] = $tag;
867		- }
868		-
869		- return array_values( array_unique( $normalized_tags ) );
870		- }
871		-
872		- /**
873	779	* Safe print a validated HTML tag.
874	780	*
875	781	* @param string $tag
876	782	*/
		@@ -922,14 +828,8 @@
922	828
923	829	echo wp_kses( $text, $allowed_html );
924	830	}
925	831
926		- public static function kses_post_deep( $data ) {
927		- return map_deep( $data, function ( $value ) {
928		- return is_string( $value ) ? wp_kses_post( $value ) : $value;
929		- } );
930		- }
931		-
932	832	public static function is_elementor_path( $path ) {
933	833	$path = wp_normalize_path( $path );
934	834
935	835	/**
		@@ -1021,10 +921,10 @@
1021	921	return $cache;
1022	922	}
1023	923
1024	924	public static function is_sale_time(): bool {
1025		- $sale_start_time = gmmktime( 10, 0, 0, 6, 15, 2026 );
1026		- $sale_end_time = gmmktime( 3, 59, 0, 6, 17, 2026 );
	925	+ $sale_start_time = gmmktime( 12, 0, 0, 11, 25, 2025 );
	926	+ $sale_end_time = gmmktime( 3, 59, 0, 12, 3, 2025 );
1027	927
1028	928	$now_time = gmdate( 'U' );
1029	929
1030	930	return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
		@@ -1070,19 +970,6 @@
1070	970	}
1071	971
1072	972	public static function encode_string( string $decoded_string ): string {
1073	973	return base64_encode( $decoded_string );
1074		- }
1075		-
1076		- public static function html_to_plain_text( string $html ): string {
1077		- if ( empty( $html ) ) {
1078		- return '';
1079		- }
1080		-
1081		- $text = preg_replace( '#<br\s*/?\s*>#i', ' ', $html );
1082		- $text = preg_replace( '#</?[a-z][^>]*>#i', ' ', $text );
1083		- $text = html_entity_decode( $text, ENT_QUOTES, 'UTF-8' );
1084		- $text = str_replace( "\xE2\x80\x8B", '', $text );
1085		-
1086		- return trim( preg_replace( '/\s+/', ' ', $text ) );
1087	974	}
1088	975	}