← All changes | Inc/Core/FB/Box.php +174 -4 3.1.10 → 3.1.14 View file →

		@@ -1,8 +1,8 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.10 Free
	4	+ * @version 3.1.14 Free
5	5	*
6	6	* @author FirePlugins <[email protected]>
7	7	* @link https://www.fireplugins.com
8	8	* @copyright Copyright © 2026 FirePlugins All Rights Reserved
		@@ -275,9 +275,22 @@
275	275	{
276	276	return '';
277	277	}
278	278
279		- return $this->box->params->get('customcss', '');
	279	+ $css = $this->box->params->get('customcss', '');
	280	+
	281	+ if (!is_string($css))
	282	+ {
	283	+ return '';
	284	+ }
	285	+
	286	+ /**
	287	+ * The CSS lands inside an inline <style> element, where a literal "</style>"
	288	+ * would end the element and let markup (e.g. a <script>) escape into the page.
	289	+ * Strip tags the same way core's wp_custom_css_cb() does — legitimate CSS
	290	+ * contains no tags, so this only neuters breakout attempts.
	291	+ */
	292	+ return wp_strip_all_tags($css);
280	293	}
281	294
282	295	/**
283	296	* Recursively casts an object/array tree to a plain array, without the
		@@ -368,11 +381,19 @@
368	381	wp_enqueue_script('firebox-main');
369	382
370	383
371	384
372		- // Add Custom Javascript
	385	+ /**
	386	+ * Add Custom Javascript.
	387	+ *
	388	+ * Emitted verbatim into every visitor's page, so it is gated on the author
	389	+ * holding unfiltered_html — the campaign meta is writable by any
	390	+ * edit_fireboxes user (editor, REST, import) and must not be a way to run
	391	+ * script that user could not write elsewhere.
	392	+ */
373	393	$custom_code = $box->get('params.data.customcode', '');
374		- if (is_string($custom_code) && !empty($custom_code))
	394	+ if (is_string($custom_code) && !empty($custom_code)
	395	+ && \FireBox\Core\Helpers\CustomCode::isAllowedForCampaign($box->get('ID')))
375	396	{
376	397	$custom_code = html_entity_decode(stripslashes($custom_code));
377	398	BoxHelper::addInlineScript($custom_code);
378	399	}
		@@ -686,8 +707,25 @@
686	707
687	708	// Normalize to an array; an empty or invalid-JSON "rules" string decodes to null.
688	709	$rules = is_array($rules) ? $rules : [];
689	710
	711	+ // The "PHP" display condition runs campaign-authored PHP server-side on every
	712	+ // visitor request (Conditions\PHP -> Executer). Evaluate it only when the campaign
	713	+ // author holds firebox_execute_php; otherwise treat the PHP condition as unmet
	714	+ // rather than running it — an "all" group that requires it fails, an "any" group
	715	+ // falls back to its other conditions. If every group depended on PHP, there is
	716	+ // nothing left to match and the campaign does not show. Runs after the mirror merge
	717	+ // above, so it also covers PHP rules pulled in from a mirrored box.
	718	+ if (self::hasPHPRule($rules) && !\FireBox\Core\Helpers\PHPExecution::isAllowedForCampaign($this->box->ID))
	719	+ {
	720	+ $rules = self::withoutPHPRules($rules);
	721	+
	722	+ if (empty($rules))
	723	+ {
	724	+ return false;
	725	+ }
	726	+ }
	727	+
690	728	// If testmode is enabled disable the User Groups condition
691	729	if ($this->box->params->get('testmode'))
692	730	{
693	731	foreach ($rules as $key => &$group)
		@@ -729,8 +767,140 @@
729	767	*/
730	768	public function getClientRuleGroups()
731	769	{
732	770	return $this->clientRuleGroups;
	771	+ }
	772	+
	773	+ /**
	774	+ * Whether a single rule is a "PHP" condition that carries code to run.
	775	+ *
	776	+ * The name is matched case-insensitively: PHP class names resolve regardless
	777	+ * of case, so ConditionsHelper::getCondition() would load the PHP condition for
	778	+ * 'php', 'Php', etc. An empty value is ignored: there is nothing to run.
	779	+ *
	780	+ * @param array $rule A single display-condition rule.
	781	+ *
	782	+ * @return bool
	783	+ */
	784	+ private static function isPHPRule($rule)
	785	+ {
	786	+ if (!is_array($rule) || !isset($rule['name']) || !is_string($rule['name']))
	787	+ {
	788	+ return false;
	789	+ }
	790	+
	791	+ if (strtolower(trim($rule['name'])) !== 'php')
	792	+ {
	793	+ return false;
	794	+ }
	795	+
	796	+ // Only a non-empty string value can be executed as PHP.
	797	+ return isset($rule['value']) && is_string($rule['value']) && trim($rule['value']) !== '';
	798	+ }
	799	+
	800	+ /**
	801	+ * Whether any rule in the given groups is a "PHP" condition that carries code.
	802	+ *
	803	+ * @param array $rules Recursive display-condition groups.
	804	+ *
	805	+ * @return bool
	806	+ */
	807	+ private static function hasPHPRule($rules)
	808	+ {
	809	+ if (!is_array($rules))
	810	+ {
	811	+ return false;
	812	+ }
	813	+
	814	+ foreach ($rules as $group)
	815	+ {
	816	+ if (!isset($group['rules']) || !is_array($group['rules']))
	817	+ {
	818	+ continue;
	819	+ }
	820	+
	821	+ foreach ($group['rules'] as $rule)
	822	+ {
	823	+ if (self::isPHPRule($rule))
	824	+ {
	825	+ return true;
	826	+ }
	827	+ }
	828	+ }
	829	+
	830	+ return false;
	831	+ }
	832	+
	833	+ /**
	834	+ * Returns the rule groups with runnable "PHP" conditions treated as unmet, for a
	835	+ * campaign whose author may not run PHP. A group's matching_method decides how:
	836	+ *
	837	+ * - "all" (every rule must pass): the PHP condition can never be satisfied, so the
	838	+ * whole group fails and is dropped.
	839	+ * - "any" (one rule is enough): the PHP condition is removed so it cannot be the
	840	+ * reason the group passes, but the group's other conditions still evaluate. A group
	841	+ * left with no other conditions is dropped.
	842	+ *
	843	+ * Groups without a PHP condition are returned untouched.
	844	+ *
	845	+ * @param array $rules Recursive display-condition groups.
	846	+ *
	847	+ * @return array
	848	+ */
	849	+ private static function withoutPHPRules($rules)
	850	+ {
	851	+ if (!is_array($rules))
	852	+ {
	853	+ return [];
	854	+ }
	855	+
	856	+ $filtered = [];
	857	+
	858	+ foreach ($rules as $group)
	859	+ {
	860	+ if (!isset($group['rules']) || !is_array($group['rules']))
	861	+ {
	862	+ $filtered[] = $group;
	863	+ continue;
	864	+ }
	865	+
	866	+ $kept = [];
	867	+ $hasPHP = false;
	868	+
	869	+ foreach ($group['rules'] as $rule)
	870	+ {
	871	+ if (self::isPHPRule($rule))
	872	+ {
	873	+ $hasPHP = true;
	874	+ continue;
	875	+ }
	876	+
	877	+ $kept[] = $rule;
	878	+ }
	879	+
	880	+ if (!$hasPHP)
	881	+ {
	882	+ $filtered[] = $group;
	883	+ continue;
	884	+ }
	885	+
	886	+ $method = isset($group['matching_method']) ? $group['matching_method'] : 'all';
	887	+
	888	+ // "all": a required PHP condition is unmet, so the group can never pass.
	889	+ if ($method === 'all')
	890	+ {
	891	+ continue;
	892	+ }
	893	+
	894	+ // "any": keep the remaining alternatives, unless PHP was the only one.
	895	+ if (!empty($kept))
	896	+ {
	897	+ $group['rules'] = $kept;
	898	+ $filtered[] = $group;
	899	+ }
	900	+ }
	901	+
	902	+ return $filtered;
733	903	}
734	904
735	905	/**
736	906	* Check if a box passes local conditions