| 1 |
<?php |
| 2 |
|
| 3 |
defined('ABSPATH') || die(); |
| 4 |
|
| 5 |
function hashform_sanitize_checkbox($input) { |
| 6 |
if ($input == 'on') { |
| 7 |
return 'on'; |
| 8 |
} else { |
| 9 |
return 'off'; |
| 10 |
} |
| 11 |
} |
| 12 |
|
| 13 |
function hashform_sanitize_number($input) { |
| 14 |
if (is_numeric($input)) { |
| 15 |
return intval($input); |
| 16 |
} else { |
| 17 |
return ''; |
| 18 |
} |
| 19 |
} |
| 20 |
|
| 21 |
/** |
| 22 |
* A heading level, held to the six that exist. |
| 23 |
* |
| 24 |
* The stored value is written into the tag name itself, where escaping is no |
| 25 |
* protection: `h2 onmouseover=alert(1)` carries no quotes to escape and lands |
| 26 |
* as an attribute on the element. Anything else falls back to the default. |
| 27 |
*/ |
| 28 |
function hashform_sanitize_heading_type($input) { |
| 29 |
$tag = strtolower(trim((string) $input)); |
| 30 |
|
| 31 |
return in_array($tag, hashform_heading_levels(), true) ? $tag : 'h3'; |
| 32 |
} |
| 33 |
|
| 34 |
function hashform_heading_levels() { |
| 35 |
return array('h1', 'h2', 'h3', 'h4', 'h5', 'h6'); |
| 36 |
} |
| 37 |
|
| 38 |
function hashform_sanitize_float($input) { |
| 39 |
if (is_numeric($input)) { |
| 40 |
return (float) $input; |
| 41 |
} else { |
| 42 |
return ''; |
| 43 |
} |
| 44 |
} |
| 45 |
|
| 46 |
function hashform_sanitize_color($color) { |
| 47 |
// Is this an rgba color or a hex? |
| 48 |
$mode = (false === strpos($color, 'rgba')) ? 'hex' : 'rgba'; |
| 49 |
if ('rgba' === $mode) { |
| 50 |
$color = str_replace(' ', '', $color); |
| 51 |
sscanf($color, 'rgba(%d,%d,%d,%f)', $red, $green, $blue, $alpha); |
| 52 |
return 'rgba(' . $red . ',' . $green . ',' . $blue . ',' . $alpha . ')'; |
| 53 |
} else { |
| 54 |
return sanitize_hex_color($color); |
| 55 |
} |
| 56 |
} |
| 57 |
|
| 58 |
function hashform_sanitize_url($url) { |
| 59 |
$sanitized_url = wp_strip_all_tags(stripslashes(filter_var($url, FILTER_VALIDATE_URL))); |
| 60 |
return $sanitized_url; |
| 61 |
} |
| 62 |
|
| 63 |
function hashform_sanitize_checkbox_boolean($input) { |
| 64 |
if (true == $input) { |
| 65 |
return true; |
| 66 |
} else { |
| 67 |
return false; |
| 68 |
} |
| 69 |
} |
| 70 |
|
| 71 |
/** |
| 72 |
* File extensions an upload field may be configured with. |
| 73 |
* |
| 74 |
* The one list. It used to be written out twice, here and in the upload AJAX |
| 75 |
* handler, and the two drifted: a format present in one and missing from the |
| 76 |
* other left a field that accepted nothing at all. |
| 77 |
* |
| 78 |
* This is only the outer bound. get_allowed_mime_types() is applied on top when |
| 79 |
* the file actually arrives, so a type this site has disabled is still refused. |
| 80 |
*/ |
| 81 |
function hashform_allowed_file_extensions() { |
| 82 |
return apply_filters('hashform_allowed_file_extensions', array( |
| 83 |
'pdf', 'doc', 'docx', 'xls', 'xlsx', 'odt', 'ppt', 'pptx', 'pps', 'ppsx', |
| 84 |
'jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp', 'avif', 'heic', 'heif', |
| 85 |
'mp3', 'm4a', 'mp4', 'ogg', 'wav', 'm4v', 'mov', 'wmv', 'avi', 'mpg', |
| 86 |
'ogv', 'webm', '3gp', |
| 87 |
'txt', 'zip', 'rar', '7z', 'csv', |
| 88 |
)); |
| 89 |
} |
| 90 |
|
| 91 |
function hashform_sanitize_allowed_file_extensions($extensions) { |
| 92 |
$new_extensions = array(); |
| 93 |
$extensions = explode(',', $extensions); |
| 94 |
$allowed_extensions = hashform_allowed_file_extensions(); |
| 95 |
foreach ($extensions as $row) { |
| 96 |
$extension = trim($row); |
| 97 |
if (in_array($extension, $allowed_extensions)) { |
| 98 |
$new_extensions[] = $extension; |
| 99 |
} |
| 100 |
} |
| 101 |
return implode(',', $new_extensions); |
| 102 |
} |
| 103 |
|
