| @@ -294,24 +294,49 @@ | ||
| 294 | 294 | private function render_notice( $notice ) { |
| 295 | 295 | $type = $notice['type']; |
| 296 | 296 | $dismissible = $notice['dismissible'] ? 'is-dismissible' : ''; |
| 297 | 297 | $notice_class = "notice notice-{$type} {$dismissible}"; |
| 298 | - | |
| 299 | - $data_attrs = ''; | |
| 300 | - if ( $notice['dismissible'] ) { | |
| 301 | - $data_attrs = sprintf( | |
| 302 | - 'data-notice-id="%s" data-nonce="%s"', | |
| 303 | - esc_attr( $notice['id'] ), | |
| 304 | - wp_create_nonce( 'winp_dismiss_notice_' . $notice['id'] ) | |
| 305 | - ); | |
| 306 | - } | |
| 298 | + $notice_text = is_string( $notice['text'] ) ? $notice['text'] : ''; | |
| 307 | 299 | |
| 308 | - printf( | |
| 309 | - '<div class="%s winp-admin-notice" %s>%s</div>', | |
| 310 | - esc_attr( $notice_class ), | |
| 311 | - $data_attrs, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 312 | - $notice['text'] // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 313 | - ); | |
| 300 | + ?> | |
| 301 | + <div | |
| 302 | + class="<?php echo esc_attr( $notice_class ); ?> winp-admin-notice" | |
| 303 | + <?php if ( $notice['dismissible'] ) : ?> | |
| 304 | + data-notice-id="<?php echo esc_attr( $notice['id'] ); ?>" | |
| 305 | + data-nonce="<?php echo esc_attr( wp_create_nonce( 'winp_dismiss_notice_' . $notice['id'] ) ); ?>" | |
| 306 | + <?php endif; ?> | |
| 307 | + > | |
| 308 | + <?php echo wp_kses( $notice_text, $this->get_allowed_notice_html() ); ?> | |
| 309 | + </div> | |
| 310 | + <?php | |
| 311 | + } | |
| 312 | + | |
| 313 | + /** | |
| 314 | + * Allowed HTML markup for notice messages. | |
| 315 | + * | |
| 316 | + * @return array<string, array<string, bool>> | |
| 317 | + */ | |
| 318 | + private function get_allowed_notice_html() { | |
| 319 | + $allowed_html = wp_kses_allowed_html( 'post' ); | |
| 320 | + | |
| 321 | + $allowed_html['a']['class'] = true; | |
| 322 | + $allowed_html['a']['target'] = true; | |
| 323 | + $allowed_html['a']['rel'] = true; | |
| 324 | + $allowed_html['div']['class'] = true; | |
| 325 | + $allowed_html['span']['class'] = true; | |
| 326 | + $allowed_html['details'] = [ | |
| 327 | + 'class' => true, | |
| 328 | + 'open' => true, | |
| 329 | + ]; | |
| 330 | + $allowed_html['summary'] = [ 'class' => true ]; | |
| 331 | + $allowed_html['code']['class'] = true; | |
| 332 | + $allowed_html['button'] = [ | |
| 333 | + 'class' => true, | |
| 334 | + 'type' => true, | |
| 335 | + 'disabled' => true, | |
| 336 | + ]; | |
| 337 | + | |
| 338 | + return $allowed_html; | |
| 314 | 339 | } |
| 315 | 340 | |
| 316 | 341 | /** |
| 317 | 342 | * Check if notice is dismissed |
