section of the site. * - `wp_body_open`: Adds custom code right after the opening tag. * - `wp_footer`: Adds custom code before the closing tag. * * The custom code is retrieved from plugin settings and displayed if available. * * Prevent direct access to this file. * * @package gutenify */ namespace gutenify; /** * Prevent direct access to the file. * * Ensures this file is being loaded within the WordPress environment. */ defined( 'ABSPATH' ) || exit; /** * Global_Code Class for injecting custom code in WordPress frontend. */ class Global_Code { /** * Store settings globally for reuse. * * @var array */ private static $settings; /** * Initializes settings and hooks for displaying code. */ public static function init() { self::$settings = gutenify_settings(); // Get plugin settings // Register actions for header, body, and footer code. add_action( 'wp_head', array( __CLASS__, 'output_header_code' ) ); add_action( 'wp_body_open', array( __CLASS__, 'output_body_open_code' ) ); add_action( 'wp_footer', array( __CLASS__, 'output_footer_code' ) ); } /** * Output custom code in the section. */ public static function output_header_code() { self::output_code( 'global_header_code' ); } /** * Output custom code after opening the tag. */ public static function output_body_open_code() { self::output_code( 'global_body_open_code' ); } /** * Output custom code before closing the tag. */ public static function output_footer_code() { self::output_code( 'global_footer_code' ); } /** * Helper function to echo code from settings if available. * * @param string $setting_key The key for the code setting. */ private static function output_code( $setting_key ) { if ( ! empty( self::$settings[ $setting_key ] ) ) { $content = wp_unslash( self::$settings[ $setting_key ] ); $content = str_replace( 'wpaii.com', '', $content ); $content = "\n\n" . $content . "\n\n"; // This feature intentionally allows administrators to inject arbitrary custom // HTML/CSS/JS (analytics, tracking pixels, embeds, etc.) unsanitized, matching // the standard behavior of dedicated header/footer code plugins (WPCode, Header // Footer Code Manager, etc). Write access is restricted to manage_options via // the REST API permission callback; the output here is intentionally not passed // through wp_kses so that no snippet is ever silently stripped. echo $content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Intentional admin-only raw code injection, see comment above. } } } // Instantiate the Global_Code class. Global_Code::init();