Editor
3 months ago
Embed
1 week ago
Links
3 months ago
Listing
9 months ago
Options
2 years ago
Preview
2 months ago
Renderer
2 weeks ago
RestApi
3 weeks ago
Scheduler
2 weeks ago
Segment
1 year ago
Sending
3 weeks ago
Sharing
1 month ago
Shortcodes
2 weeks ago
Statistics
3 weeks ago
ViewInBrowser
1 week ago
ApiDataSanitizer.php
3 years ago
AutomatedLatestContent.php
2 months ago
AutomaticEmailsRepository.php
3 years ago
BlockPostQuery.php
3 months ago
BulkActionController.php
2 months ago
BulkActionException.php
2 months ago
DynamicProducts.php
1 year ago
NewsletterCoupon.php
3 months ago
NewsletterDeleteController.php
2 years ago
NewsletterHtmlSanitizer.php
2 years ago
NewsletterPostsRepository.php
2 years ago
NewsletterResendController.php
2 weeks ago
NewsletterSaveController.php
2 months ago
NewsletterValidator.php
1 year ago
NewslettersRepository.php
1 month ago
StatusController.php
2 months ago
Url.php
2 months ago
index.php
3 years ago
ApiDataSanitizer.php
61 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\Newsletter; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | class ApiDataSanitizer { |
| 9 | /** @var NewsletterHtmlSanitizer */ |
| 10 | private $htmlSanitizer; |
| 11 | |
| 12 | /** |
| 13 | * Configuration specifies which block types and properties within newsletters content blocks are sanitized |
| 14 | */ |
| 15 | private const SANITIZATION_CONFIG = [ |
| 16 | 'header' => ['text'], |
| 17 | 'footer' => ['text'], |
| 18 | 'text' => ['text'], |
| 19 | ]; |
| 20 | |
| 21 | public function __construct( |
| 22 | NewsletterHtmlSanitizer $htmlSanitizer |
| 23 | ) { |
| 24 | $this->htmlSanitizer = $htmlSanitizer; |
| 25 | } |
| 26 | |
| 27 | public function sanitizeBody(array $body): array { |
| 28 | if (isset($body['content']) && isset($body['content']['blocks']) && is_array($body['content']['blocks'])) { |
| 29 | $body['content']['blocks'] = $this->sanitizeBlocks($body['content']['blocks']); |
| 30 | } |
| 31 | return $body; |
| 32 | } |
| 33 | |
| 34 | private function sanitizeBlocks(array $blocks): array { |
| 35 | foreach ($blocks as $key => $block) { |
| 36 | if (!is_array($block) || !isset($block['type'])) { |
| 37 | continue; |
| 38 | } |
| 39 | if (isset($block['blocks']) && is_array($block['blocks'])) { |
| 40 | $blocks[$key]['blocks'] = $this->sanitizeBlocks($block['blocks']); |
| 41 | } else { |
| 42 | $blocks[$key] = $this->sanitizeBlock($block); |
| 43 | } |
| 44 | }; |
| 45 | return $blocks; |
| 46 | } |
| 47 | |
| 48 | private function sanitizeBlock(array $block): array { |
| 49 | if (!isset(self::SANITIZATION_CONFIG[$block['type']])) { |
| 50 | return $block; |
| 51 | } |
| 52 | foreach (self::SANITIZATION_CONFIG[$block['type']] as $property) { |
| 53 | if (!isset($block[$property])) { |
| 54 | continue; |
| 55 | } |
| 56 | $block[$property] = $this->htmlSanitizer->sanitize($block[$property]); |
| 57 | } |
| 58 | return $block; |
| 59 | } |
| 60 | } |
| 61 |