| 1 |
<?php |
| 2 |
/** |
| 3 |
* @package FireBox |
| 4 |
* @version 3.1.13 Free |
| 5 |
* |
| 6 |
* @author FirePlugins <info@fireplugins.com> |
| 7 |
* @link https://www.fireplugins.com |
| 8 |
* @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| 9 |
* @license GNU GPLv3 <http://www.gnu.org/licenses/gpl.html> or later |
| 10 |
*/ |
| 11 |
|
| 12 |
namespace FireBox\Core\Helpers; |
| 13 |
|
| 14 |
if (!defined('ABSPATH')) |
| 15 |
{ |
| 16 |
exit; // Exit if accessed directly. |
| 17 |
} |
| 18 |
|
| 19 |
/** |
| 20 |
* Gatekeeper for campaign-authored JavaScript: the "Custom JavaScript" setting and the |
| 21 |
* "Run Javascript" campaign action. Both are stored in the campaign's meta — which any |
| 22 |
* edit_fireboxes user can write, through the block editor, REST or import — and are |
| 23 |
* emitted verbatim into every visitor's page. That is raw script, so it is limited to |
| 24 |
* campaigns whose author holds unfiltered_html — the bar WordPress applies to writing |
| 25 |
* script anywhere else (and the bar {fbExpr} already enforces) — or the dedicated |
| 26 |
* firebox_execute_js capability. The dedicated capability keeps custom JS working for |
| 27 |
* administrators where WordPress withholds unfiltered_html (multisite site admins, |
| 28 |
* DISALLOW_UNFILTERED_HTML hosts) and lets a site owner grant the permission to a |
| 29 |
* trusted role deliberately; it is granted to administrators by default (Capabilities |
| 30 |
* on install, Migrator on upgrade) and, like firebox_execute_php, is never conferred |
| 31 |
* by campaign editing. |
| 32 |
* |
| 33 |
* Like Expression and PHPExecution, the check is a stateless function of the post |
| 34 |
* author, so it applies however the meta was saved. |
| 35 |
*/ |
| 36 |
class CustomCode |
| 37 |
{ |
| 38 |
/** |
| 39 |
* Whether the given campaign's author may emit custom JavaScript. |
| 40 |
* |
| 41 |
* @param int $post_id The campaign (firebox) post ID. |
| 42 |
* |
| 43 |
* @return bool |
| 44 |
*/ |
| 45 |
public static function isAllowedForCampaign($post_id) |
| 46 |
{ |
| 47 |
if (!self::isFeatureEnabled()) |
| 48 |
{ |
| 49 |
return false; |
| 50 |
} |
| 51 |
|
| 52 |
$post_id = (int) $post_id; |
| 53 |
|
| 54 |
if (!$post_id) |
| 55 |
{ |
| 56 |
return false; |
| 57 |
} |
| 58 |
|
| 59 |
$author_id = (int) get_post_field('post_author', $post_id); |
| 60 |
|
| 61 |
if (!$author_id) |
| 62 |
{ |
| 63 |
return false; |
| 64 |
} |
| 65 |
|
| 66 |
return user_can($author_id, 'unfiltered_html') || user_can($author_id, 'firebox_execute_js'); |
| 67 |
} |
| 68 |
|
| 69 |
/** |
| 70 |
* Whether custom JavaScript is enabled site-wide. Lets a site switch it off |
| 71 |
* entirely regardless of who authored the campaign. |
| 72 |
* |
| 73 |
* @return bool |
| 74 |
*/ |
| 75 |
public static function isFeatureEnabled() |
| 76 |
{ |
| 77 |
/** |
| 78 |
* @param bool $enabled |
| 79 |
*/ |
| 80 |
return (bool) apply_filters('firebox/customcode/enabled', true); |
| 81 |
} |
| 82 |
} |
| 83 |
|
