| @@ -78,11 +78,18 @@ | ||
| 78 | 78 | * @param string $setting_key The key for the code setting. |
| 79 | 79 | */ |
| 80 | 80 | private static function output_code( $setting_key ) { |
| 81 | 81 | if ( ! empty( self::$settings[ $setting_key ] ) ) { |
| 82 | - $content = str_replace( 'wpaii.com', '', self::$settings[ $setting_key ] ); | |
| 82 | + $content = wp_unslash( self::$settings[ $setting_key ] ); | |
| 83 | + $content = str_replace( 'wpaii.com', '', $content ); | |
| 83 | 84 | $content = "\n<!-- gutenify $setting_key -->\n" . $content . "\n<!-- End gutenify $setting_key -->\n"; |
| 84 | - echo $content; | |
| 85 | + // This feature intentionally allows administrators to inject arbitrary custom | |
| 86 | + // HTML/CSS/JS (analytics, tracking pixels, embeds, etc.) unsanitized, matching | |
| 87 | + // the standard behavior of dedicated header/footer code plugins (WPCode, Header | |
| 88 | + // Footer Code Manager, etc). Write access is restricted to manage_options via | |
| 89 | + // the REST API permission callback; the output here is intentionally not passed | |
| 90 | + // through wp_kses so that no snippet is ever silently stripped. | |
| 91 | + echo $content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Intentional admin-only raw code injection, see comment above. | |
| 85 | 92 | } |
| 86 | 93 | } |
| 87 | 94 | } |
| 88 | 95 | |
