| @@ -1,119 +1,106 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /* |
| 3 | 3 | Plugin Name: iframe |
| 4 | 4 | Plugin URI: http://wordpress.org/plugins/iframe/ |
| 5 | -Description: [iframe src="http://www.youtube.com/embed/A3PDXmYoF5U" width="100%" height="480"] shortcode | |
| 6 | -Version: 2.7 | |
| 5 | +Description: [iframe src="http://www.youtube.com/embed/dUpTjDqjQoo" width="100%" height="500"] shortcode | |
| 6 | +Version: 5.0 | |
| 7 | 7 | Author: webvitaly |
| 8 | -Author URI: http://web-profile.com.ua/wordpress/plugins/ | |
| 9 | -License: GPLv2 or later | |
| 8 | +Author URI: http://web-profile.net/wordpress/plugins/ | |
| 9 | +License: GPLv3 | |
| 10 | 10 | */ |
| 11 | 11 | |
| 12 | +if ( ! defined( 'ABSPATH' ) ) { // Avoid direct calls to this file and prevent full path disclosure | |
| 13 | + exit; | |
| 14 | +} | |
| 12 | 15 | |
| 13 | -if ( ! function_exists( 'iframe_unqprfx_embed_shortcode' ) ) : | |
| 16 | +define('IFRAME_PLUGIN_VERSION', '5.0'); | |
| 14 | 17 | |
| 15 | - function iframe_unqprfx_enqueue_script() { | |
| 16 | - wp_enqueue_script( 'jquery' ); | |
| 17 | - } | |
| 18 | - add_action( 'wp_enqueue_scripts', 'iframe_unqprfx_enqueue_script' ); | |
| 19 | - | |
| 20 | - function iframe_unqprfx_embed_shortcode( $atts, $content = null ) { | |
| 21 | - $defaults = array( | |
| 22 | - 'src' => 'http://www.youtube.com/embed/A3PDXmYoF5U', | |
| 23 | - 'width' => '100%', | |
| 24 | - 'height' => '480', | |
| 25 | - 'scrolling' => 'no', | |
| 26 | - 'class' => 'iframe-class', | |
| 27 | - 'frameborder' => '0' | |
| 28 | - ); | |
| 18 | +function iframe_plugin_add_shortcode_cb( $atts ) { | |
| 19 | + $defaults = array( | |
| 20 | + 'src' => 'http://www.youtube.com/embed/dUpTjDqjQoo', | |
| 21 | + 'width' => '100%', | |
| 22 | + 'height' => '500', | |
| 23 | + 'scrolling' => 'yes', | |
| 24 | + 'class' => 'iframe-class', | |
| 25 | + 'frameborder' => '0' | |
| 26 | + ); | |
| 29 | 27 | |
| 30 | - foreach ( $defaults as $default => $value ) { // add defaults | |
| 31 | - if ( ! @array_key_exists( $default, $atts ) ) { // hide warning with "@" when no params at all | |
| 32 | - $atts[$default] = $value; | |
| 33 | - } | |
| 34 | - } | |
| 28 | + $allowed_tags = array( | |
| 29 | + 'h1' => array(), | |
| 30 | + 'h2' => array(), | |
| 31 | + 'h3' => array(), | |
| 32 | + 'h4' => array(), | |
| 33 | + 'h5' => array(), | |
| 34 | + 'h6' => array(), | |
| 35 | + 'p' => array(), | |
| 36 | + 'a' => array( | |
| 37 | + 'href' => true, | |
| 38 | + 'title' => true, | |
| 39 | + ), | |
| 40 | + 'br' => array(), | |
| 41 | + 'em' => array(), | |
| 42 | + 'strong' => array() | |
| 43 | + ); | |
| 35 | 44 | |
| 36 | - $src_cut = substr( $atts["src"], 0, 35 ); // special case for google maps | |
| 37 | - if( strpos( $src_cut, 'maps.google' ) ){ | |
| 38 | - $atts["src"] .= '&output=embed'; | |
| 39 | - } | |
| 45 | + if ( ! is_array( $atts ) ) { | |
| 46 | + $atts = array(); | |
| 47 | + } | |
| 40 | 48 | |
| 41 | - // get_params_from_url | |
| 42 | - if( isset( $atts["get_params_from_url"] ) && ( $atts["get_params_from_url"] == '1' || $atts["get_params_from_url"] == 1 || $atts["get_params_from_url"] == 'true' ) ) { | |
| 43 | - if( $_GET != NULL ){ | |
| 44 | - if( strpos( $atts["src"], '?' ) ){ // if we already have '?' and GET params | |
| 45 | - $encode_string = '&'; | |
| 46 | - }else{ | |
| 47 | - $encode_string = '?'; | |
| 48 | - } | |
| 49 | - foreach( $_GET as $key => $value ){ | |
| 50 | - $encode_string .= $key.'='.$value.'&'; | |
| 51 | - } | |
| 52 | - } | |
| 53 | - $atts["src"] .= $encode_string; | |
| 49 | + foreach ( $defaults as $default => $value ) { // add defaults | |
| 50 | + if ( ! @array_key_exists( $default, $atts ) ) { // mute warning with "@" when no params at all | |
| 51 | + $atts[$default] = $value; | |
| 54 | 52 | } |
| 53 | + } | |
| 55 | 54 | |
| 56 | - $html = ''; | |
| 57 | - if( isset( $atts["same_height_as"] ) ){ | |
| 58 | - $same_height_as = $atts["same_height_as"]; | |
| 59 | - }else{ | |
| 60 | - $same_height_as = ''; | |
| 55 | + $html = "\n".'<!-- iframe plugin v.'.IFRAME_PLUGIN_VERSION.' wordpress.org/plugins/iframe/ -->'."\n"; | |
| 56 | + $html .= '<iframe'; | |
| 57 | + foreach( $atts as $attr => $value ) { | |
| 58 | + if ( strtolower($attr) == 'src' ) { // sanitize url | |
| 59 | + $value = esc_url( $value ); | |
| 61 | 60 | } |
| 62 | - | |
| 63 | - if( $same_height_as != '' ){ | |
| 64 | - $atts["same_height_as"] = ''; | |
| 65 | - if( $same_height_as != 'content' ){ // we are setting the height of the iframe like as target element | |
| 66 | - if( $same_height_as == 'document' || $same_height_as == 'window' ){ // remove quotes for window or document selectors | |
| 67 | - $target_selector = $same_height_as; | |
| 68 | - }else{ | |
| 69 | - $target_selector = '"' . $same_height_as . '"'; | |
| 70 | - } | |
| 71 | - $html .= ' | |
| 72 | - <script> | |
| 73 | - jQuery(function($){ | |
| 74 | - var target_height = $(' . $target_selector . ').height(); | |
| 75 | - $("iframe.' . $atts["class"] . '").height(target_height); | |
| 76 | - //alert(target_height); | |
| 77 | - }); | |
| 78 | - </script> | |
| 79 | - '; | |
| 80 | - }else{ // set the actual height of the iframe (show all content of the iframe without scroll) | |
| 81 | - $html .= ' | |
| 82 | - <script> | |
| 83 | - jQuery(function($){ | |
| 84 | - $("iframe.' . $atts["class"] . '").bind("load", function() { | |
| 85 | - var embed_height = $(this).contents().find("body").height(); | |
| 86 | - $(this).height(embed_height); | |
| 87 | - }); | |
| 88 | - }); | |
| 89 | - </script> | |
| 90 | - '; | |
| 91 | - } | |
| 61 | + if ( strtolower($attr) == 'srcdoc' ) { // sanitize html | |
| 62 | + $value = htmlspecialchars_decode( $value ); | |
| 63 | + $value = wp_kses( $value, $allowed_tags ); | |
| 64 | + $value = esc_html( $value ); | |
| 92 | 65 | } |
| 93 | - $html .= "\n".'<!-- iframe plugin v.2.7 wordpress.org/plugins/iframe/ -->'."\n"; | |
| 94 | - $html .= '<iframe'; | |
| 95 | - foreach( $atts as $attr => $value ) { | |
| 96 | - if( $attr != 'same_height_as' ){ // remove some attributes | |
| 97 | - if( $value != '' ) { // adding all attributes | |
| 98 | - $html .= ' ' . $attr . '="' . $value . '"'; | |
| 99 | - } else { // adding empty attributes | |
| 100 | - $html .= ' ' . $attr; | |
| 101 | - } | |
| 66 | + // Remove all attributes starting with "on". Examples: onload, onmouseover, onfocus, onpageshow, onclick | |
| 67 | + if ( strpos( strtolower( $attr ), 'on' ) !== 0 ) { | |
| 68 | + if ( $value != '' ) { // adding all attributes | |
| 69 | + $html .= ' ' . esc_attr( $attr ) . '="' . esc_attr( $value ) . '"'; | |
| 70 | + } else { // adding empty attributes | |
| 71 | + $html .= ' ' . esc_attr( $attr ); | |
| 102 | 72 | } |
| 103 | 73 | } |
| 104 | - $html .= '></iframe>'; | |
| 105 | - return $html; | |
| 106 | 74 | } |
| 107 | - add_shortcode( 'iframe', 'iframe_unqprfx_embed_shortcode' ); | |
| 108 | - | |
| 75 | + $html .= '></iframe>'."\n"; | |
| 109 | 76 | |
| 110 | - function iframe_unqprfx_plugin_meta( $links, $file ) { // add 'Plugin page' and 'Donate' links to plugin meta row | |
| 111 | - if ( strpos( $file, 'iframe.php' ) !== false ) { | |
| 112 | - $links = array_merge( $links, array( '<a href="http://web-profile.com.ua/wordpress/plugins/iframe/" title="Plugin page">' . __('Iframe') . '</a>' ) ); | |
| 113 | - $links = array_merge( $links, array( '<a href="http://web-profile.com.ua/donate/" title="Support the development">' . __('Donate') . '</a>' ) ); | |
| 114 | - } | |
| 115 | - return $links; | |
| 77 | + if ( isset( $atts["same_height_as"] ) ) { | |
| 78 | + $html .= ' | |
| 79 | + <script> | |
| 80 | + document.addEventListener("DOMContentLoaded", function(){ | |
| 81 | + var target_element, iframe_element; | |
| 82 | + iframe_element = document.querySelector("iframe.' . esc_attr( $atts["class"] ) . '"); | |
| 83 | + target_element = document.querySelector("' . esc_attr( $atts["same_height_as"] ) . '"); | |
| 84 | + iframe_element.style.height = target_element.offsetHeight + "px"; | |
| 85 | + }); | |
| 86 | + </script> | |
| 87 | + '; | |
| 116 | 88 | } |
| 117 | - add_filter( 'plugin_row_meta', 'iframe_unqprfx_plugin_meta', 10, 2 ); | |
| 118 | - | |
| 119 | -endif; // end of if(function_exists('iframe_unqprfx_embed_shortcode')) | |
| 89 | + | |
| 90 | + return $html; | |
| 91 | +} | |
| 92 | +add_shortcode( 'iframe', 'iframe_plugin_add_shortcode_cb' ); | |
| 93 | + | |
| 94 | + | |
| 95 | +function iframe_plugin_row_meta_cb( $links, $file ) { | |
| 96 | + if ( $file == plugin_basename( __FILE__ ) ) { | |
| 97 | + $row_meta = array( | |
| 98 | + 'support' => '<a href="http://web-profile.net/wordpress/plugins/iframe/" target="_blank">' . __( 'Iframe', 'iframe' ) . '</a>', | |
| 99 | + 'donate' => '<a href="http://web-profile.net/donate/" target="_blank">' . __( 'Donate', 'iframe' ) . '</a>', | |
| 100 | + 'pro' => '<a href="https://1.envato.market/Ym5aq" target="_blank">' . __( 'Advanced iFrame Pro', 'iframe' ) . '</a>' | |
| 101 | + ); | |
| 102 | + $links = array_merge( $links, $row_meta ); | |
| 103 | + } | |
| 104 | + return (array) $links; | |
| 105 | +} | |
| 106 | +add_filter( 'plugin_row_meta', 'iframe_plugin_row_meta_cb', 10, 2 ); | |
