← All changes | modules/wp-rest/classes/elementor-post-meta.php +29 -0 4.1.3 → 4.3.0-beta3 View file →

		@@ -77,11 +77,31 @@
77	77	'context' => [ 'edit' ],
78	78	],
79	79	],
80	80	'auth_callback' => [ $this, 'check_edit_permission' ],
	81	+ 'sanitize_callback' => [ $this, 'sanitize_elementor_data' ],
81	82	]);
82	83	}
83	84
	85	+ public function sanitize_elementor_data( $value ) {
	86	+ if ( current_user_can( 'unfiltered_html' ) ) {
	87	+ return $value;
	88	+ }
	89	+
	90	+ if ( ! is_string( $value ) ) {
	91	+ return Utils::kses_post_deep( $value );
	92	+ }
	93	+
	94	+ $elementor_data = json_decode( $value, true );
	95	+
	96	+ if ( JSON_ERROR_NONE !== json_last_error() || empty( $elementor_data ) ) {
	97	+ // Not valid Elementor JSON (or empty): treat the whole string as HTML to be safe.
	98	+ return wp_kses_post( $value );
	99	+ }
	100	+
	101	+ return wp_json_encode( Utils::kses_post_deep( $elementor_data ) );
	102	+ }
	103	+
84	104	private function register_page_settings_meta( string $post_type ): void {
85	105	register_meta( 'post', '_elementor_page_settings', [
86	106	'single' => true,
87	107	'object_subtype' => $post_type,
		@@ -103,9 +123,18 @@
103	123	'context' => [ 'edit' ],
104	124	],
105	125	],
106	126	'auth_callback' => [ $this, 'check_edit_permission' ],
	127	+ 'sanitize_callback' => [ $this, 'sanitize_page_settings' ],
107	128	]);
	129	+ }
	130	+
	131	+ public function sanitize_page_settings( $value ) {
	132	+ if ( current_user_can( 'unfiltered_html' ) ) {
	133	+ return $value;
	134	+ }
	135	+
	136	+ return Utils::kses_post_deep( $value );
108	137	}
109	138
110	139	private function register_conditions_meta( string $post_type ): void {
111	140	register_meta( 'post', '_elementor_conditions', [