← All changes | app/Functions/helpers.php +24 -2 2.0.12 → 2.2.0 View file →

		@@ -1,7 +1,8 @@
1	1	<?php
2	2
3	3	use FluentBoards\App\App;
	4	+use FluentBoards\App\Services\Constant;
4	5
5	6	// $app is available
6	7
7	8	if (!function_exists('fluentBoards')) {
		@@ -27,9 +28,30 @@
27	28
28	29	return $url ? '[' . $url . '](' . str_replace(')', '%29', $url) . ')' : $matches[0];
29	30	}, (string) $description);
30	31
31		- return wp_kses_post($description);
	32	+ // Markdown email autolinks otherwise look like disallowed HTML to KSES.
	33	+ $description = preg_replace_callback('/<(?:mailto:)?([^<>\s]+@[^<>\s]+)>/i', function ($matches) {
	34	+ $email = html_entity_decode($matches[1], ENT_QUOTES | ENT_HTML5, 'UTF-8');
	35	+ if (!is_email($email)) {
	36	+ return $matches[0];
	37	+ }
	38	+
	39	+ $label = str_replace(['*', '_', '`'], ['\\*', '\\_', '\\`'], $email);
	40	+ return '[' . $label . '](mailto:' . $email . ')';
	41	+ }, $description);
	42	+
	43	+ // KSES encodes standalone > characters, which breaks Markdown quotes.
	44	+ // Protect only quote prefixes; all HTML still passes through KSES.
	45	+ $quotePrefix = 'fbs-quote-' . wp_generate_uuid4() . '-';
	46	+ $quotes = [];
	47	+ $description = preg_replace_callback('/^[ \t]*(?:>[ \t]*)+/m', function ($matches) use (&$quotes, $quotePrefix) {
	48	+ $key = $quotePrefix . count($quotes);
	49	+ $quotes[$key] = $matches[0];
	50	+ return $key;
	51	+ }, $description);
	52	+
	53	+ return strtr(wp_kses_post($description), $quotes);
32	54	}
33	55	}
34	56
35	57	if (!function_exists('fluent_boards_user_avatar')) {
		@@ -37,9 +59,9 @@
37	59	{
38	60	$user = get_user_by('email', $email);
39	61
40	62	if ($user) {
41		- $photo_url = get_user_meta($user->ID, 'fbs_profile_photo', true);
	63	+ $photo_url = get_user_meta($user->ID, Constant::PROFILE_PHOTO_META_KEY, true);
42	64	if ($photo_url) {
43	65	return apply_filters('fluent_boards/get_avatar', $photo_url, $email);
44	66	}
45	67