Block
1 month ago
Listing
2 months ago
RestApi
2 months ago
Templates
2 years ago
Util
3 months ago
ApiDataSanitizer.php
1 month ago
AssetsController.php
3 months ago
BlockStylesRenderer.php
3 years ago
BlockWrapperRenderer.php
3 years ago
BlocksRenderer.php
1 year ago
DisplayFormInWPContent.php
3 months ago
FormHtmlSanitizer.php
2 months ago
FormMessageController.php
4 years ago
FormSaveController.php
2 years ago
FormsRepository.php
1 year ago
PreviewPage.php
3 months ago
PreviewWidget.php
1 year ago
Renderer.php
3 months ago
Widget.php
3 months ago
index.php
3 years ago
FormHtmlSanitizer.php
106 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\Form; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\WP\Functions as WPFunctions; |
| 9 | |
| 10 | class FormHtmlSanitizer { |
| 11 | |
| 12 | /** |
| 13 | * @var array |
| 14 | * Configuration of allowed tags for form blocks that may contain some html. |
| 15 | * Covers all tags available in the form editor's Rich Text component and which we allow in checkbox label. |
| 16 | * This doesn't cover CustomHTML block. |
| 17 | */ |
| 18 | const ALLOWED_HTML = [ |
| 19 | 'a' => [ |
| 20 | 'class' => true, |
| 21 | 'href' => true, |
| 22 | 'title' => true, |
| 23 | 'data-id' => true, |
| 24 | 'data-type' => true, |
| 25 | 'target' => true, |
| 26 | 'rel' => true, |
| 27 | ], |
| 28 | 'br' => [], |
| 29 | 'code' => [], |
| 30 | 'em' => [], |
| 31 | 'img' => [ |
| 32 | 'class' => true, |
| 33 | 'style' => true, |
| 34 | 'src' => true, |
| 35 | 'alt' => true, |
| 36 | ], |
| 37 | 'kbd' => [], |
| 38 | 'span' => [ |
| 39 | 'style' => true, |
| 40 | 'data-font' => true, |
| 41 | 'class' => true, |
| 42 | ], |
| 43 | 'math' => [ |
| 44 | 'data-latex' => true, |
| 45 | 'display' => true, |
| 46 | ], |
| 47 | 'semantics' => [], |
| 48 | 'annotation' => [ |
| 49 | 'encoding' => true, |
| 50 | ], |
| 51 | 'mrow' => [], |
| 52 | 'mi' => [], |
| 53 | 'mn' => [], |
| 54 | 'mo' => [ |
| 55 | 'movablelimits' => true, |
| 56 | ], |
| 57 | 'mtext' => [], |
| 58 | 'mspace' => [ |
| 59 | 'height' => true, |
| 60 | 'width' => true, |
| 61 | ], |
| 62 | 'mfrac' => [ |
| 63 | 'linethickness' => true, |
| 64 | ], |
| 65 | 'msqrt' => [], |
| 66 | 'mroot' => [], |
| 67 | 'msub' => [], |
| 68 | 'msup' => [], |
| 69 | 'msubsup' => [], |
| 70 | 'munder' => [], |
| 71 | 'mover' => [], |
| 72 | 'munderover' => [], |
| 73 | 'mtable' => [ |
| 74 | 'columnalign' => true, |
| 75 | 'rowspacing' => true, |
| 76 | 'columnspacing' => true, |
| 77 | ], |
| 78 | 'mtr' => [], |
| 79 | 'mtd' => [ |
| 80 | 'columnalign' => true, |
| 81 | 'rowalign' => true, |
| 82 | 'style' => true, |
| 83 | ], |
| 84 | 'mark' => [ |
| 85 | 'style' => true, |
| 86 | 'class' => true, |
| 87 | ], |
| 88 | 'strong' => [], |
| 89 | 'sub' => [], |
| 90 | 'sup' => [], |
| 91 | 's' => [], |
| 92 | ]; |
| 93 | /** @var WPFunctions */ |
| 94 | private $wp; |
| 95 | |
| 96 | public function __construct( |
| 97 | WPFunctions $wp |
| 98 | ) { |
| 99 | $this->wp = $wp; |
| 100 | } |
| 101 | |
| 102 | public function sanitize(string $html): string { |
| 103 | return $this->wp->wpKses($html, self::ALLOWED_HTML); |
| 104 | } |
| 105 | } |
| 106 |