| @@ -24,8 +24,9 @@ | ||
| 24 | 24 | use Elementor\Modules\System_Info\Module as System_Info_Module; |
| 25 | 25 | use Elementor\Data\Manager as Data_Manager; |
| 26 | 26 | use Elementor\Data\V2\Manager as Data_Manager_V2; |
| 27 | 27 | use Elementor\Core\Files\Uploads_Manager; |
| 28 | +use WP_REST_Request; | |
| 28 | 29 | |
| 29 | 30 | if ( ! defined( 'ABSPATH' ) ) { |
| 30 | 31 | exit; |
| 31 | 32 | } |
| @@ -41,8 +42,14 @@ | ||
| 41 | 42 | class Plugin { |
| 42 | 43 | |
| 43 | 44 | const ELEMENTOR_DEFAULT_POST_TYPES = [ 'page', 'post' ]; |
| 44 | 45 | |
| 46 | + private const SANITIZABLE_META_KEYS = [ | |
| 47 | + '_elementor_data', | |
| 48 | + '_elementor_page_settings', | |
| 49 | + '_elementor_global_class_data', | |
| 50 | + ]; | |
| 51 | + | |
| 45 | 52 | /** |
| 46 | 53 | * Instance. |
| 47 | 54 | * |
| 48 | 55 | * Holds the plugin instance. |
| @@ -824,12 +831,46 @@ | ||
| 824 | 831 | Compatibility::register_actions(); |
| 825 | 832 | |
| 826 | 833 | add_action( 'init', [ $this, 'init' ], 0 ); |
| 827 | 834 | add_action( 'rest_api_init', [ $this, 'on_rest_api_init' ], 9 ); |
| 835 | + add_filter( 'rest_pre_insert_post', [ $this, 'sanitize_post_data' ], 10, 2 ); | |
| 828 | 836 | } |
| 829 | 837 | |
| 830 | 838 | final public static function get_title() { |
| 831 | 839 | return esc_html__( 'Elementor', 'elementor' ); |
| 840 | + } | |
| 841 | + | |
| 842 | + public function sanitize_post_data( $post, WP_REST_Request $request ) { | |
| 843 | + if ( current_user_can( 'unfiltered_html' ) ) { | |
| 844 | + return $post; | |
| 845 | + } | |
| 846 | + | |
| 847 | + $meta = $request->get_param( 'meta' ); | |
| 848 | + if ( empty( $meta ) || ! is_array( $meta ) ) { | |
| 849 | + return $post; | |
| 850 | + } | |
| 851 | + | |
| 852 | + foreach ( self::SANITIZABLE_META_KEYS as $meta_key ) { | |
| 853 | + $elementor_data = $meta[ $meta_key ] ?? null; | |
| 854 | + if ( is_null( $elementor_data ) ) { | |
| 855 | + continue; | |
| 856 | + } | |
| 857 | + if ( is_string( $elementor_data ) ) { | |
| 858 | + $elementor_data = json_decode( $elementor_data, true ); | |
| 859 | + } | |
| 860 | + if ( empty( $elementor_data ) ) { | |
| 861 | + continue; | |
| 862 | + } | |
| 863 | + | |
| 864 | + $elementor_data = map_deep($elementor_data, function ( $value ) { | |
| 865 | + return is_bool( $value ) || is_null( $value ) ? $value : wp_kses_post( $value ); | |
| 866 | + }); | |
| 867 | + | |
| 868 | + $meta[ $meta_key ] = wp_json_encode( $elementor_data ); | |
| 869 | + } | |
| 870 | + | |
| 871 | + $request->set_param( 'meta', $meta ); | |
| 872 | + return $post; | |
| 832 | 873 | } |
| 833 | 874 | } |
| 834 | 875 | |
| 835 | 876 | if ( ! defined( 'ELEMENTOR_TESTS' ) ) { |
