← All changes | includes/shortcodes/shortcodes.php +22 -42 2.4.9 → 2.2.7 View file →

		@@ -9,18 +9,18 @@
9	9	if ( ! defined( 'ABSPATH' ) ) {
10	10	exit;
11	11	}
12	12
13		-class WINP_SnippetShortcode extends Wbcr_FactoryShortcodes333_Shortcode {
14		-
	13	+class WINP_SnippetShortcode extends Wbcr_FactoryShortcodes329_Shortcode {
	14	+
15	15	public $shortcode_name = 'wbcr_php_snippet';
16		-
	16	+
17	17	/**
18	18	* Includes assets
19	19	* @var bool
20	20	*/
21	21	public $assets_in_header = true;
22		-
	22	+
23	23	/**
24	24	* Filter attributes
25	25	*
26	26	* @param $attr
		@@ -30,18 +30,18 @@
30	30	*/
31	31	public function filterAttributes( $attr, $post_id ) {
32	32	if ( ! empty( $attr ) ) {
33	33	$available_tags = WINP_Helper::getMetaOption( $post_id, 'snippet_tags', null );
34		-
	34	+
35	35	if ( ! empty( $available_tags ) ) {
36	36	$available_tags = explode( ',', $available_tags );
37	37	$available_tags = array_map( 'trim', $available_tags );
38	38	}
39		-
	39	+
40	40	foreach ( $attr as $name => $value ) {
41	41	$is_allow_attr = in_array( $name, array( 'id', 'title' ) );
42	42	$validate_name = preg_match( '/^[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*/', $name );
43		-
	43	+
44	44	if ( ! $is_allow_attr && ( ( ! empty( $available_tags ) && ! in_array( $name, $available_tags ) ) || ! $validate_name ) ) {
45	45	unset( $attr[ $name ] );
46	46	} else {
47	47	// issue PCS-1
		@@ -46,35 +46,30 @@
46	46	} else {
47	47	// issue PCS-1
48	48	// before sending the value to the shortcode, using encodeURIComponent(val).replace(/\./g, ‘%2E’); fixes the issue. Will the next update stop this from working?
49	49	$value = urldecode( $value );
50		-
	50	+
51	51	// Remove script tag
52	52	$value = preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $value );
53		-
	53	+
54	54	// Remove any attribute starting with "on" or xmlns
55	55	$value = preg_replace( '#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $value );
56		-
	56	+
57	57	// Remove javascript: and vbscript: protocols
58	58	$value = preg_replace( '#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $value );
59	59	$value = preg_replace( '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $value );
60	60	$value = preg_replace( '#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $value );
61		-
	61	+
62	62	// Filter value
63		- if ( version_compare( phpversion(), '7.3.0', '>=' ) ) {
64		- $filter = FILTER_SANITIZE_ADD_SLASHES;
65		- } else {
66		- $filter = FILTER_SANITIZE_MAGIC_QUOTES;
67		- }
68	63	$value = filter_var( $value, FILTER_SANITIZE_SPECIAL_CHARS );
69		- $attr[ $name ] = filter_var( $value, $filter );
	64	+ $attr[ $name ] = filter_var( $value, FILTER_SANITIZE_MAGIC_QUOTES );
70	65	}
71	66	}
72	67	}
73		-
	68	+
74	69	return $attr;
75	70	}
76		-
	71	+
77	72	/**
78	73	* Get snippet id
79	74	*
80	75	* @param $attr
		@@ -86,12 +81,12 @@
86	81	$id = isset( $attr['id'] ) ? (int) $attr['id'] : null;
87	82	if ( $id && $type != WINP_Helper::get_snippet_type( $id ) ) {
88	83	$id = 0;
89	84	}
90		-
	85	+
91	86	return $id;
92	87	}
93		-
	88	+
94	89	/**
95	90	* Get snippet activate
96	91	*
97	92	* @param $snippet_meta
		@@ -98,21 +93,11 @@
98	93	*
99	94	* @return bool
100	95	*/
101	96	public function getSnippetActivate( $snippet_meta ) {
102		- // WPML Compatibility
103		- if ( defined( 'WPML_PLUGIN_FILE' ) ) {
104		- $wpml_langs = isset( $snippet_meta[ $this->plugin->getPrefix() . 'snippet_wpml_lang' ][0] ) ? $snippet_meta[ $this->plugin->getPrefix() . 'snippet_wpml_lang' ][0] : '';
105		- if ( $wpml_langs !== '' && defined( 'ICL_LANGUAGE_CODE' ) ) {
106		- if ( ! in_array( ICL_LANGUAGE_CODE, explode( ',', $wpml_langs ) ) ) {
107		- return false;
108		- }
109		- }
110		- }
111		-
112	97	return isset( $snippet_meta[ $this->plugin->getPrefix() . 'snippet_activate' ] ) && $snippet_meta[ $this->plugin->getPrefix() . 'snippet_activate' ][0];
113	98	}
114		-
	99	+
115	100	/**
116	101	* Get snippet scope
117	102	*
118	103	* @param $snippet_meta
		@@ -121,9 +106,9 @@
121	106	*/
122	107	public function getSnippetScope( $snippet_meta ) {
123	108	return isset( $snippet_meta[ $this->plugin->getPrefix() . 'snippet_scope' ] ) ? $snippet_meta[ $this->plugin->getPrefix() . 'snippet_scope' ][0] : null;
124	109	}
125		-
	110	+
126	111	/**
127	112	* Get snippet content
128	113	*
129	114	* @param WP_Post $snippet
		@@ -132,17 +117,12 @@
132	117	*
133	118	* @return null|string
134	119	*/
135	120	public function getSnippetContent( $snippet, $snippet_meta, $id ) {
136		- $snippet_code = WINP_Helper::get_snippet_code( $snippet );
137		-
138		- if ( WINP_Plugin::app()->getOption( 'execute_shortcode' ) ) {
139		- $snippet_code = do_shortcode( $snippet_code );
140		- }
141		-
	121	+ $snippet_code = WINP_Helper::get_snippet_code($snippet);
142	122	return WINP_Plugin::app()->getExecuteObject()->prepareCode( $snippet_code, $id );
143	123	}
144		-
	124	+
145	125	/**
146	126	* Content render
147	127	*
148	128	* @param array $attr
		@@ -149,8 +129,8 @@
149	129	* @param string $content
150	130	* @param string $tag
151	131	*/
152	132	public function html( $attr, $content, $tag ) {
153		-
	133	+
154	134	}
155		-
	135	+
156	136	}