| @@ -19,10 +19,8 @@ | ||
| 19 | 19 | // get post meta data for inline_css |
| 20 | 20 | $inline_css = get_post_meta($post_id, 'inline_css', true); |
| 21 | 21 | // get post meta data for js_links |
| 22 | 22 | $js_links = get_post_meta($post_id, 'js_links', true); |
| 23 | -// get post meta data for inline_js | |
| 24 | -$inline_js = get_post_meta($post_id, 'inline_js', true); | |
| 25 | 23 | // check if the key css_links exist |
| 26 | 24 | if($css_links!==''){ |
| 27 | 25 | // Loop through all the css link |
| 28 | 26 | $decoded_css_links = json_decode($css_links); |
| @@ -29,8 +27,9 @@ | ||
| 29 | 27 | if (is_array($decoded_css_links)) { |
| 30 | 28 | foreach ($decoded_css_links as $css_link) { |
| 31 | 29 | // SECURITY FIX: Validate and escape CSS URLs |
| 32 | 30 | if (filter_var($css_link, FILTER_VALIDATE_URL) && (strpos($css_link, 'http') === 0)) { |
| 31 | + // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet -- Dynamic per-post CSS URLs from the user's page settings (css_links meta) must print in <head> of this bare custom-page template; enqueueing after wp_head() would relocate them to the footer. | |
| 33 | 32 | echo '<link href="' . esc_url($css_link) . '" rel="stylesheet"/>'; |
| 34 | 33 | } |
| 35 | 34 | } |
| 36 | 35 | } |
| @@ -55,8 +54,9 @@ | ||
| 55 | 54 | if (is_array($decoded_js_links)) { |
| 56 | 55 | foreach ($decoded_js_links as $js_link) { |
| 57 | 56 | // SECURITY FIX: Validate and escape JS URLs |
| 58 | 57 | if (filter_var($js_link, FILTER_VALIDATE_URL) && (strpos($js_link, 'http') === 0)) { |
| 58 | + // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Dynamic per-post JS URLs from the user's page settings (js_links meta) must print in <head> of this bare custom-page template; enqueueing after wp_head() would relocate them to the footer. | |
| 59 | 59 | echo '<script src="' . esc_url($js_link) . '"></script>'; |
| 60 | 60 | } |
| 61 | 61 | } |
| 62 | 62 | } |
| @@ -62,9 +62,9 @@ | ||
| 62 | 62 | } |
| 63 | 63 | } |
| 64 | 64 | ?> |
| 65 | 65 | |
| 66 | -<body class="text-gray-800 font-sans leading-normal gradient-bg postid-<?= esc_attr($post_id) ?>"> | |
| 66 | +<body class="text-gray-800 font-sans leading-normal gradient-bg postid-<?php echo esc_attr($post_id); ?>"> | |
| 67 | 67 | <?php |
| 68 | 68 | // get content of the post |
| 69 | 69 | $content = apply_filters('the_content', get_the_content()); |
| 70 | 70 | echo $content; |
| @@ -71,21 +71,8 @@ | ||
| 71 | 71 | ?> |
| 72 | 72 | </body> |
| 73 | 73 | <?php |
| 74 | 74 | wp_footer(); |
| 75 | -// check if the key inline_js exist | |
| 76 | -$inline_js_decoded = !empty($inline_js) ? json_decode($inline_js) : null; | |
| 77 | -if(is_array($inline_js_decoded)){ | |
| 78 | -// Loop through all the inline script and print the script tags after body | |
| 79 | -$decoded_inline_js = json_decode($inline_js); | |
| 80 | -if (is_array($decoded_inline_js)) { | |
| 81 | -foreach ($decoded_inline_js as $js) { | |
| 82 | - // SECURITY FIX: Completely block inline JS to prevent XSS | |
| 83 | - // This feature is disabled for security reasons | |
| 84 | - error_log('MetaSync Security: Inline JS blocked for security - content: ' . substr($js, 0, 100)); | |
| 85 | -} | |
| 86 | -} | |
| 87 | -} | |
| 88 | 75 | |
| 89 | 76 | ?> |
| 90 | 77 | |
| 91 | 78 | </html> |
