Block
1 week ago
Listing
1 month ago
RestApi
1 month ago
Templates
2 years ago
Util
2 months ago
ApiDataSanitizer.php
2 weeks ago
AssetsController.php
2 months ago
BlockStylesRenderer.php
3 years ago
BlockWrapperRenderer.php
3 years ago
BlocksRenderer.php
1 week ago
DisplayFormInWPContent.php
2 months ago
FormHtmlSanitizer.php
1 month ago
FormMessageController.php
4 years ago
FormSaveController.php
1 year ago
FormsRepository.php
1 year ago
PreviewPage.php
2 months ago
PreviewWidget.php
1 year ago
Renderer.php
2 months ago
Widget.php
2 months ago
index.php
3 years ago
ApiDataSanitizer.php
85 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\Form; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\WP\Functions as WPFunctions; |
| 9 | |
| 10 | class ApiDataSanitizer { |
| 11 | /** @var FormHtmlSanitizer */ |
| 12 | private $htmlSanitizer; |
| 13 | |
| 14 | /** @var WPFunctions */ |
| 15 | private $wp; |
| 16 | |
| 17 | /** |
| 18 | * List of blocks and their parameters that will be sanitized |
| 19 | * @var string[][] |
| 20 | */ |
| 21 | private $htmlSanitizeConfig = [ |
| 22 | 'paragraph' => [ |
| 23 | 'content', |
| 24 | ], |
| 25 | 'heading' => [ |
| 26 | 'content', |
| 27 | ], |
| 28 | 'image' => [ |
| 29 | 'caption', |
| 30 | ], |
| 31 | 'checkbox' => [ |
| 32 | 'values', |
| 33 | ], |
| 34 | ]; |
| 35 | |
| 36 | public function __construct( |
| 37 | FormHtmlSanitizer $htmlSanitizer, |
| 38 | WPFunctions $wp |
| 39 | ) { |
| 40 | $this->htmlSanitizer = $htmlSanitizer; |
| 41 | $this->wp = $wp; |
| 42 | } |
| 43 | |
| 44 | public function sanitizeBody(array $body): array { |
| 45 | foreach ($body as $key => $block) { |
| 46 | $sanitizedBlock = $this->sanitizeBlock($block); |
| 47 | if (isset($sanitizedBlock['body']) && is_array($sanitizedBlock['body']) && !empty($sanitizedBlock['body'])) { |
| 48 | $sanitizedBlock['body'] = $this->sanitizeBody($sanitizedBlock['body']); |
| 49 | } |
| 50 | $body[$key] = $sanitizedBlock; |
| 51 | } |
| 52 | return $body; |
| 53 | } |
| 54 | |
| 55 | public function sanitizeBlock(array $block): array { |
| 56 | if (isset($block['id'])) { |
| 57 | $block['id'] = is_scalar($block['id']) ? $this->wp->sanitizeKey((string)$block['id']) : ''; |
| 58 | } |
| 59 | if (!isset($this->htmlSanitizeConfig[$block['type']])) { |
| 60 | return $block; |
| 61 | } |
| 62 | $params = $block['params'] ?? []; |
| 63 | foreach ($this->htmlSanitizeConfig[$block['type']] as $parameter) { |
| 64 | if (!isset($params[$parameter])) continue; |
| 65 | |
| 66 | if ($parameter === 'values' && is_array($params[$parameter])) { |
| 67 | $params[$parameter] = $this->sanitizeValues($params[$parameter]); |
| 68 | } else { |
| 69 | $params[$parameter] = $this->htmlSanitizer->sanitize($params[$parameter]); |
| 70 | } |
| 71 | |
| 72 | } |
| 73 | $block['params'] = $params; |
| 74 | return $block; |
| 75 | } |
| 76 | |
| 77 | private function sanitizeValues(array $values) { |
| 78 | foreach ($values as $key => $value) { |
| 79 | if (!isset($value['value'])) continue; |
| 80 | $values[$key]['value'] = $this->htmlSanitizer->sanitize($value['value']); |
| 81 | } |
| 82 | return $values; |
| 83 | } |
| 84 | } |
| 85 |