← All changes | includes/utils.php +7 -119 4.3.0-beta1 → 4.0.9 View file →

		@@ -46,29 +46,8 @@
46	46	'section',
47	47	'span',
48	48	];
49	49
50		- /**
51		- * Tags that must never be usable as an HTML wrapper tag, regardless of what
52		- * `elementor/allowed_html_wrapper_tags` filters return. These are the classic
53		- * script-execution / markup-injection vectors (XSS), so they're enforced as a
54		- * hard denylist rather than left to filter authors to avoid re-adding them.
55		- */
56		- const FORBIDDEN_HTML_WRAPPER_TAGS = [
57		- 'script',
58		- 'iframe',
59		- 'object',
60		- 'embed',
61		- 'style',
62		- 'link',
63		- 'meta',
64		- 'base',
65		- 'noscript',
66		- 'template',
67		- 'svg',
68		- 'math',
69		- ];
70		-
71	50	const EXTENDED_ALLOWED_HTML_TAGS = [
72	51	'iframe' => [
73	52	'iframe' => [
74	53	'allow' => true,
		@@ -658,12 +637,8 @@
658	637	public static function has_pro() {
659	638	return defined( 'ELEMENTOR_PRO_VERSION' );
660	639	}
661	640
662		- public static function is_license_active(): bool {
663		- return class_exists( '\ElementorPro\License\API' ) && \ElementorPro\License\API::is_license_active();
664		- }
665		-
666	641	public static function is_pro_installed_and_not_active(): bool {
667	642	if ( ! function_exists( 'get_plugins' ) ) {
668	643	require_once ABSPATH . 'wp-admin/includes/plugin.php';
669	644	}
		@@ -754,19 +729,13 @@
754	729	if ( $id === $element['id'] ) {
755	730	return $element;
756	731	}
757	732
758		- $inner_elements = apply_filters(
759		- 'elementor/utils/find_element_recursive/inner_elements',
760		- $element['elements'] ?? [],
761		- $element
762		- );
	733	+ if ( ! empty( $element['elements'] ) ) {
	734	+ $element = self::find_element_recursive( $element['elements'], $id );
763	735
764		- if ( ! empty( $inner_elements ) ) {
765		- $found = self::find_element_recursive( $inner_elements, $id );
766		-
767		- if ( $found ) {
768		- return $found;
	736	+ if ( $element ) {
	737	+ return $element;
769	738	}
770	739	}
771	740	}
772	741
		@@ -796,45 +765,8 @@
796	765	}
797	766	}
798	767
799	768	/**
800		- * @var string[]|null
801		- */
802		- private static $resolved_allowed_html_wrapper_tags;
803		-
804		- /**
805		- * Get allowed HTML wrapper tags.
806		- *
807		- * @since 4.4.0
808		- *
809		- * @return string[]
810		- */
811		- public static function get_allowed_html_wrapper_tags(): array {
812		- if ( null !== self::$resolved_allowed_html_wrapper_tags ) {
813		- return self::$resolved_allowed_html_wrapper_tags;
814		- }
815		-
816		- /**
817		- * Allowed HTML wrapper tags.
818		- *
819		- * Filters the list of allowed HTML tag names used by `validate_html_tag()`.
820		- *
821		- * Note: tags in `Utils::FORBIDDEN_HTML_WRAPPER_TAGS` (e.g. `script`, `iframe`,
822		- * `object`) are always stripped after this filter runs and cannot be re-added,
823		- * to prevent XSS via a wrapper tag that executes script or embeds external content.
824		- *
825		- * @since 4.4.0
826		- *
827		- * @param string[] $tags A list of lowercase HTML tag name strings.
828		- */
829		- $tags = apply_filters( 'elementor/allowed_html_wrapper_tags', self::ALLOWED_HTML_WRAPPER_TAGS );
830		-
831		- self::$resolved_allowed_html_wrapper_tags = self::normalize_allowed_html_wrapper_tags( $tags );
832		-
833		- return self::$resolved_allowed_html_wrapper_tags;
834		- }
835		-
836		- /**
837	769	* Validate an HTML tag against a safe allowed list.
838	770	*
839	771	* @param string $tag
840	772	*
		@@ -840,37 +772,12 @@
840	772	*
841	773	* @return string
842	774	*/
843	775	public static function validate_html_tag( $tag ) {
844		- return $tag && in_array( strtolower( $tag ), self::get_allowed_html_wrapper_tags(), true ) ? $tag : 'div';
	776	+ return $tag && in_array( strtolower( $tag ), self::ALLOWED_HTML_WRAPPER_TAGS ) ? $tag : 'div';
845	777	}
846	778
847	779	/**
848		- * @param array $tags
849		- *
850		- * @return string[]
851		- */
852		- private static function normalize_allowed_html_wrapper_tags( array $tags ): array {
853		- $normalized_tags = [];
854		-
855		- foreach ( $tags as $tag ) {
856		- if ( ! is_string( $tag ) ) {
857		- continue;
858		- }
859		-
860		- $tag = strtolower( $tag );
861		-
862		- if ( in_array( $tag, self::FORBIDDEN_HTML_WRAPPER_TAGS, true ) ) {
863		- continue;
864		- }
865		-
866		- $normalized_tags[] = $tag;
867		- }
868		-
869		- return array_values( array_unique( $normalized_tags ) );
870		- }
871		-
872		- /**
873	780	* Safe print a validated HTML tag.
874	781	*
875	782	* @param string $tag
876	783	*/
		@@ -922,14 +829,8 @@
922	829
923	830	echo wp_kses( $text, $allowed_html );
924	831	}
925	832
926		- public static function kses_post_deep( $data ) {
927		- return map_deep( $data, function ( $value ) {
928		- return is_string( $value ) ? wp_kses_post( $value ) : $value;
929		- } );
930		- }
931		-
932	833	public static function is_elementor_path( $path ) {
933	834	$path = wp_normalize_path( $path );
934	835
935	836	/**
		@@ -1021,10 +922,10 @@
1021	922	return $cache;
1022	923	}
1023	924
1024	925	public static function is_sale_time(): bool {
1025		- $sale_start_time = gmmktime( 10, 0, 0, 6, 15, 2026 );
1026		- $sale_end_time = gmmktime( 3, 59, 0, 6, 17, 2026 );
	926	+ $sale_start_time = gmmktime( 12, 0, 0, 11, 25, 2025 );
	927	+ $sale_end_time = gmmktime( 3, 59, 0, 12, 3, 2025 );
1027	928
1028	929	$now_time = gmdate( 'U' );
1029	930
1030	931	return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
		@@ -1070,19 +971,6 @@
1070	971	}
1071	972
1072	973	public static function encode_string( string $decoded_string ): string {
1073	974	return base64_encode( $decoded_string );
1074		- }
1075		-
1076		- public static function html_to_plain_text( string $html ): string {
1077		- if ( empty( $html ) ) {
1078		- return '';
1079		- }
1080		-
1081		- $text = preg_replace( '#<br\s*/?\s*>#i', ' ', $html );
1082		- $text = preg_replace( '#</?[a-z][^>]*>#i', ' ', $text );
1083		- $text = html_entity_decode( $text, ENT_QUOTES, 'UTF-8' );
1084		- $text = str_replace( "\xE2\x80\x8B", '', $text );
1085		-
1086		- return trim( preg_replace( '/\s+/', ' ', $text ) );
1087	975	}
1088	976	}