| @@ -240,112 +240,13 @@ | ||
| 240 | 240 | $sanitized_settings[ $key ] = sanitize_textarea_field( $settings[ $key ] ); |
| 241 | 241 | } else { |
| 242 | 242 | $sanitized_settings[ $key ] = $defaults[ $key ]; |
| 243 | 243 | } |
| 244 | - | |
| 245 | - if ( 'custom_css' !== $key ) { | |
| 246 | - $sanitized_settings[ $key ] = $this->strip_invalid_characters( $sanitized_settings[ $key ] ); | |
| 247 | - } | |
| 248 | 244 | } |
| 249 | 245 | return $sanitized_settings; |
| 250 | 246 | } |
| 251 | 247 | |
| 252 | 248 | /** |
| 253 | - * Remove any characters that should not be used in CSS. | |
| 254 | - * | |
| 255 | - * @since 6.2.3 | |
| 256 | - * | |
| 257 | - * @param string $setting | |
| 258 | - * @return string | |
| 259 | - */ | |
| 260 | - private function strip_invalid_characters( $setting ) { | |
| 261 | - $characters_to_remove = array( '{', '}', ';', '[', ']' ); | |
| 262 | - | |
| 263 | - // RGB is handled instead in self::maybe_sanitize_rgba_value. | |
| 264 | - if ( 0 !== strpos( $setting, 'rgb' ) ) { | |
| 265 | - $setting = $this->maybe_fix_braces( $setting, $characters_to_remove ); | |
| 266 | - } | |
| 267 | - | |
| 268 | - return str_replace( $characters_to_remove, '', $setting ); | |
| 269 | - } | |
| 270 | - | |
| 271 | - /** | |
| 272 | - * @since 6.2.3 | |
| 273 | - * | |
| 274 | - * @param string $setting | |
| 275 | - * @param array $characters_to_remove | |
| 276 | - * @return string | |
| 277 | - */ | |
| 278 | - private function maybe_fix_braces( $setting, &$characters_to_remove ) { | |
| 279 | - $number_of_opening_braces = substr_count( $setting, '(' ); | |
| 280 | - $number_of_closing_braces = substr_count( $setting, ')' ); | |
| 281 | - | |
| 282 | - if ( $number_of_opening_braces === $number_of_closing_braces ) { | |
| 283 | - return $this->trim_braces( $setting ); | |
| 284 | - } | |
| 285 | - | |
| 286 | - if ( $this->should_remove_every_brace( $setting ) ) { | |
| 287 | - // Add to $characters_to_remove to remove when str_replace is called. | |
| 288 | - array_push( $characters_to_remove, '(', ')' ); | |
| 289 | - return $setting; | |
| 290 | - } | |
| 291 | - | |
| 292 | - return $this->trim_braces( $setting ); | |
| 293 | - } | |
| 294 | - | |
| 295 | - /** | |
| 296 | - * @since 6.2.3 | |
| 297 | - * | |
| 298 | - * @param string $input | |
| 299 | - * @return string | |
| 300 | - */ | |
| 301 | - private function trim_braces( $input ) { | |
| 302 | - $output = $input; | |
| 303 | - // Remove any ( from the start of the string as no CSS values expect at the first character. | |
| 304 | - if ( $output ) { | |
| 305 | - if ( in_array( $output[0], array( '(', ')' ), true ) ) { | |
| 306 | - $output = ltrim( $output, '()' ); | |
| 307 | - } | |
| 308 | - } | |
| 309 | - // Remove extra braces from the end. | |
| 310 | - if ( in_array( substr( $output, -1 ), array( '(', ')' ), true ) ) { | |
| 311 | - $output = rtrim( $output, '()' ); | |
| 312 | - if ( false !== strpos( $output, '(' ) ) { | |
| 313 | - $output .= ')'; | |
| 314 | - } | |
| 315 | - } | |
| 316 | - return $output; | |
| 317 | - } | |
| 318 | - | |
| 319 | - /** | |
| 320 | - * @since 6.2.3 | |
| 321 | - * | |
| 322 | - * @param string $setting | |
| 323 | - * @return bool | |
| 324 | - */ | |
| 325 | - private function should_remove_every_brace( $setting ) { | |
| 326 | - if ( 0 === strpos( trim( $setting, '()' ), 'calc' ) ) { | |
| 327 | - // Support calc() sizes. We do not want to remove all braces when calc is used. | |
| 328 | - return false; | |
| 329 | - } | |
| 330 | - | |
| 331 | - // Matches hex values but also checks for unexpected ( and ). | |
| 332 | - $looks_like_a_hex_value = preg_match( '/^(?:\()?(?!#?[a-fA-F0-9]*[^\(#\)\da-fA-F])[a-fA-F0-9\(\)]*(?:\))?$/', $setting ); | |
| 333 | - if ( $looks_like_a_hex_value ) { | |
| 334 | - return true; | |
| 335 | - } | |
| 336 | - | |
| 337 | - // Matches size values but also checks for unexpected ( and ). | |
| 338 | - // This is case insensitive so it will catch PX, PT, etc, as well. | |
| 339 | - $looks_like_a_size = preg_match( '/\(?[+-]?\d*\.?\d+(?:px|%|em|rem|ex|pt|pc|mm|cm|in)\)?/i', $setting ); | |
| 340 | - if ( $looks_like_a_size ) { | |
| 341 | - return true; | |
| 342 | - } | |
| 343 | - | |
| 344 | - return false; | |
| 345 | - } | |
| 346 | - | |
| 347 | - /** | |
| 348 | 249 | * @since 3.01.01 |
| 349 | 250 | * |
| 350 | 251 | * @param string $setting |
| 351 | 252 | * @return bool |
| @@ -769,9 +670,9 @@ | ||
| 769 | 670 | ); |
| 770 | 671 | } |
| 771 | 672 | |
| 772 | 673 | /** |
| 773 | - * Don't let imbalanced font families ruin the whole stylesheet. | |
| 674 | + * Don't let imbalanced font families ruin the whole stylesheet | |
| 774 | 675 | * |
| 775 | 676 | * @param string $value |
| 776 | 677 | * @return string |
| 777 | 678 | */ |
| @@ -779,18 +680,12 @@ | ||
| 779 | 680 | $balanced_characters = array( '"', "'" ); |
| 780 | 681 | foreach ( $balanced_characters as $char ) { |
| 781 | 682 | $char_count = substr_count( $value, $char ); |
| 782 | 683 | $is_balanced = $char_count % 2 == 0; |
| 783 | - | |
| 784 | - if ( $is_balanced ) { | |
| 785 | - continue; | |
| 786 | - } | |
| 787 | - | |
| 788 | - if ( $value && $char === $value[ strlen( $value ) - 1 ] ) { | |
| 789 | - $value = $char . $value; | |
| 790 | - } else { | |
| 684 | + if ( ! $is_balanced ) { | |
| 791 | 685 | $value .= $char; |
| 792 | 686 | } |
| 793 | 687 | } |
| 688 | + | |
| 794 | 689 | return $value; |
| 795 | 690 | } |
| 796 | 691 | } |
