← All changes | includes/shortcodes/shortcodes.php +24 -5 2.7.0 → 2.7.7 View file →

		@@ -80,11 +80,20 @@
80	80	*
81	81	* @return string
82	82	*/
83	83	public function render( $attr, $content, $tag ) {
	84	+ if ( WINP_Helper::is_safe_mode() ) {
	85	+ return '';
	86	+ }
	87	+
84	88	ob_start();
85		- $this->html( $attr, $content ?? '', $tag );
86		- $html = ob_get_clean();
	89	+ $result = $this->html( $attr, $content ?? '', $tag );
	90	+ $html = ob_get_clean();
	91	+
	92	+ if ( is_string( $result ) ) {
	93	+ $html = ( false !== $html ? $html : '' ) . $result;
	94	+ }
	95	+
87	96	return false !== $html ? $html : '';
88	97	}
89	98
90	99	/**
		@@ -151,10 +160,20 @@
151	160	*/
152	161	public function get_snippet_id( $attr, $type ) {
153	162	$id = isset( $attr['id'] ) ? (int) $attr['id'] : null;
154	163
155		- if ( $id && WINP_Helper::get_snippet_type( $id ) !== $type ) {
156		- $id = 0;
	164	+ $snippet_type = null;
	165	+
	166	+ // Only resolve snippet type when a valid (truthy) ID is provided to avoid
	167	+ // unnecessary request parsing or database lookups for invalid IDs.
	168	+ if ( $id ) {
	169	+ $snippet_type = WINP_Helper::get_snippet_type( $id );
	170	+
	171	+ // Security: Reject if get_snippet_type() returned false (invalid post type)
	172	+ // or if the snippet type doesn't match the expected type.
	173	+ if ( false === $snippet_type || $snippet_type !== $type ) {
	174	+ $id = 0;
	175	+ }
157	176	}
158	177
159	178	return $id;
160	179	}
		@@ -216,9 +235,9 @@
216	235	* @param array<string, mixed> $attr Shortcode attributes.
217	236	* @param string $content Shortcode content.
218	237	* @param string $tag Shortcode tag.
219	238	*
220		- * @return void
	239	+ * @return mixed Rendered content when returned directly, if any.
221	240	*/
222	241	public function html( $attr, $content, $tag ) {
223	242	}
224	243	}