jetformbuilder / modules / rich-content / module.php

module.php in JetFormBuilder — Dynamic Blocks Form Builder 3.6.6, at modules/rich-content/module.php

168 lines 4.5 KB

Raw Download Zip

1	<?php
2
3	namespace JFB_Modules\Rich_Content;
4
5	use Jet_Form_Builder\Classes\Tools;
6	use Jet_Form_Builder\Presets\Types\Dynamic_Preset;
7	use JFB_Components\Module\Base_Module_It;
8
9	// If this file is called directly, abort.
10	if ( ! defined( 'WPINC' ) ) {
11	die;
12	}
13
14	class Module implements Base_Module_It {
15
16	/**
17	* @var Macros_Parser
18	*/
19	private $parser;
20
21	/**
22	* @var Dynamic_Preset
23	*/
24	private $dynamic_preset;
25
26	public function rep_item_id() {
27	return 'rich-content';
28	}
29
30	public function condition(): bool {
31	return true;
32	}
33
34	public function init_hooks() {
35	add_filter(
36	'jet-form-builder/rich-content',
37	array( $this, 'apply_submit_macros' )
38	);
39	add_filter(
40	'jet-form-builder/rich-content',
41	array( $this, 'apply_dynamic_preset' ),
42	10,
43	4
44	);
45	add_filter(
46	'jet-form-builder/rich-content',
47	array( $this, 'apply_shortcodes' )
48	);
49	}
50
51	public function remove_hooks() {
52	remove_filter(
53	'jet-form-builder/rich-content',
54	array( $this, 'apply_submit_macros' )
55	);
56	remove_filter(
57	'jet-form-builder/rich-content',
58	array( $this, 'apply_dynamic_preset' )
59	);
60	remove_filter(
61	'jet-form-builder/rich-content',
62	array( $this, 'apply_shortcodes' )
63	);
64	}
65
66	public static function rich( string $value ): string {
67	return apply_filters( 'jet-form-builder/rich-content', $value );
68	}
69
70	/**
71	* Same macros/preset/shortcodes pipeline as rich(), but for a value that
72	* is provably admin-authored - a block attribute stored in the form's
73	* own post content, never a value submitted with the request. Declares
74	* the preset trusted, so an explicit `restricted: false` saved through
75	* the field's own "Restrict access" toggle is honoured, the same way it
76	* already is for validation rules, date limits, conditions and dynamic
77	* value. See Preset_Manager::get_field_value() and
78	* jet_fb_parse_dynamic_trusted() for the same distinction elsewhere.
79	*
80	* The regular dynamic-preset callback stays registered in its original
81	* position on the shared filter. Filter arguments identify this invocation
82	* and its exact original content, preserving the established macros ->
83	* preset -> shortcodes order without mutable hook state. If macros change
84	* the content, its result is parsed as untrusted request-derived data.
85	*
86	* @param string $value
87	*
88	* @return string
89	*/
90	public function rich_trusted( string $value ): string {
91	return apply_filters( 'jet-form-builder/rich-content', $value, true, $value );
92	}
93
94	/**
95	* Runs macros and shortcodes while deliberately skipping dynamic presets.
96	* Kept as a filter argument rather than removing/re-adding the callback so
97	* its position and accepted-arguments count never change for later calls.
98	*
99	* @param string $value
100	*
101	* @return string
102	*/
103	public function rich_without_preset( string $value ): string {
104	return apply_filters( 'jet-form-builder/rich-content', $value, false, '', true );
105	}
106
107	public function apply_submit_macros( string $content ): string {
108	return $this->get_parser()->parse_macros( $content );
109	}
110
111	public function apply_dynamic_preset(
112	string $content,
113	bool $trusted = false,
114	string $trusted_content = '',
115	bool $without_preset = false
116	): string {
117	if ( $without_preset ) {
118	return $content;
119	}
120
121	// Macros execute before this callback and can expand request-controlled
122	// values. A trusted parse is safe only when the content is still the
123	// exact admin-authored string passed to rich_trusted().
124	if ( $trusted && $content === $trusted_content ) {
125	return $this->apply_dynamic_preset_trusted( $content );
126	}
127
128	return Tools::to_string( $this->get_dynamic_preset()->parse_json( $content ) );
129	}
130
131	public function apply_dynamic_preset_trusted( string $content ): string {
132	// Do not use get_dynamic_preset(): it is shared by ordinary rich() calls.
133	// A preset-sanitize callback may make a nested ordinary call while this
134	// source is resolving, so the trusted origin must be invocation-local.
135	$preset = new Dynamic_Preset();
136	$preset->trust_restriction_flag( true );
137
138	return Tools::to_string( $preset->parse_json( $content ) );
139	}
140
141	public function apply_shortcodes( string $content ): string {
142	return do_shortcode( $content );
143	}
144
145
146	/**
147	* @return Macros_Parser
148	*/
149	public function get_parser(): Macros_Parser {
150	if ( is_null( $this->parser ) ) {
151	$this->parser = new Macros_Parser();
152	}
153
154	return $this->parser;
155	}
156
157	/**
158	* @return Dynamic_Preset
159	*/
160	public function get_dynamic_preset(): Dynamic_Preset {
161	if ( is_null( $this->dynamic_preset ) ) {
162	$this->dynamic_preset = new Dynamic_Preset();
163	}
164
165	return $this->dynamic_preset;
166	}
167	}
168