← All changes | templates/template-metasync-blank.php +36 -59 2.7.0 → 2.7.2 View file →

		@@ -1,91 +1,68 @@
	1	+<?php
	2	+// If this file is called directly, abort before emitting any document output.
	3	+if (!defined('ABSPATH')) {
	4	+ exit;
	5	+}
	6	+?>
1	7	<!DOCTYPE html>
2	8	<html <?php language_attributes(); ?>>
3	9	<head>
4	10	<meta charset="<?php bloginfo('charset'); ?>" />
5	11	<?php
6		- // If this file is called directly, abort.
7		- if (!defined('ABSPATH')) {
8		- exit;
9		- }
10	12	wp_head();
11	13	?>
12	14
13	15	</head>
14	16	<?php
15		-// get the post ID
16	17	$post_id = get_the_ID();
17		-// get post meta data for css_links
18	18	$css_links = get_post_meta($post_id, 'css_links', true);
19		-// get post meta data for inline_css
20	19	$inline_css = get_post_meta($post_id, 'inline_css', true);
21		-// get post meta data for js_links
22	20	$js_links = get_post_meta($post_id, 'js_links', true);
23		-// get post meta data for inline_js
24		-$inline_js = get_post_meta($post_id, 'inline_js', true);
25		-// check if the key css_links exist
26		-if($css_links!==''){
27		-// Loop through all the css link
28		-$decoded_css_links = json_decode($css_links);
29		-if (is_array($decoded_css_links)) {
30		-foreach ($decoded_css_links as $css_link) {
31		- // SECURITY FIX: Validate and escape CSS URLs
32		- if (filter_var($css_link, FILTER_VALIDATE_URL) && (strpos($css_link, 'http') === 0)) {
	21	+
	22	+$decode_meta_list = static function ($value) {
	23	+ if (is_array($value)) {
	24	+ return $value;
	25	+ }
	26	+ if (!is_string($value) || '' === $value) {
	27	+ return array();
	28	+ }
	29	+
	30	+ $decoded = json_decode($value, true);
	31	+ return is_array($decoded) ? $decoded : array();
	32	+};
	33	+
	34	+foreach ($decode_meta_list($css_links) as $css_link) {
	35	+ if (is_string($css_link) && filter_var($css_link, FILTER_VALIDATE_URL) && 0 === strpos($css_link, 'http')) {
	36	+ // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet -- Dynamic per-post CSS URLs from the user's page settings (css_links meta) must print in <head> of this bare custom-page template; enqueueing after wp_head() would relocate them to the footer.
33	37	echo '<link href="' . esc_url($css_link) . '" rel="stylesheet"/>';
34	38	}
35	39	}
	40	+
	41	+foreach ($decode_meta_list($inline_css) as $css) {
	42	+ if (is_string($css)) {
	43	+ // SECURITY FIX: Sanitize CSS to prevent XSS.
	44	+ $sanitized_css = wp_strip_all_tags($css);
	45	+ echo '<style>' . esc_html($sanitized_css) . '</style>';
	46	+ }
36	47	}
37		-}
38		-// check if the key inline_css exist
39		-if($inline_css!==''){
40		-// Loop through all the inline css and print it
41		-$decoded_inline_css = json_decode($inline_css);
42		-if (is_array($decoded_inline_css)) {
43		-foreach ($decoded_inline_css as $css) {
44		- // SECURITY FIX: Sanitize CSS to prevent XSS
45		- $sanitized_css = wp_strip_all_tags($css);
46		- echo '<style>' . esc_html($sanitized_css) . '</style>';
47		-}
48		-}
49		-}
50		-// check if the key js_links exist
51		-$js_links_decoded = !empty($js_links) ? json_decode($js_links) : null;
52		-if(is_array($js_links_decoded)){
53		-// Loop through all the js link and print it script tags
54		-$decoded_js_links = json_decode($js_links);
55		-if (is_array($decoded_js_links)) {
56		-foreach ($decoded_js_links as $js_link) {
57		- // SECURITY FIX: Validate and escape JS URLs
58		- if (filter_var($js_link, FILTER_VALIDATE_URL) && (strpos($js_link, 'http') === 0)) {
	48	+
	49	+foreach ($decode_meta_list($js_links) as $js_link) {
	50	+ if (is_string($js_link) && filter_var($js_link, FILTER_VALIDATE_URL) && 0 === strpos($js_link, 'http')) {
	51	+ // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Dynamic per-post JS URLs from the user's page settings (js_links meta) must print in <head> of this bare custom-page template; enqueueing after wp_head() would relocate them to the footer.
59	52	echo '<script src="' . esc_url($js_link) . '"></script>';
60	53	}
61	54	}
62		-}
63		-}
64	55	?>
65	56
66		-<body class="text-gray-800 font-sans leading-normal gradient-bg postid-<?= esc_attr($post_id) ?>">
	57	+<body class="text-gray-800 font-sans leading-normal gradient-bg postid-<?php echo esc_attr($post_id); ?>">
67	58	<?php
68		- // get content of the post
69	59	$content = apply_filters('the_content', get_the_content());
	60	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- the_content() passthrough in a blank page template; escaping would corrupt the document
70	61	echo $content;
71	62	?>
72	63	</body>
73	64	<?php
74	65	wp_footer();
75		-// check if the key inline_js exist
76		-$inline_js_decoded = !empty($inline_js) ? json_decode($inline_js) : null;
77		-if(is_array($inline_js_decoded)){
78		-// Loop through all the inline script and print the script tags after body
79		-$decoded_inline_js = json_decode($inline_js);
80		-if (is_array($decoded_inline_js)) {
81		-foreach ($decoded_inline_js as $js) {
82		- // SECURITY FIX: Completely block inline JS to prevent XSS
83		- // This feature is disabled for security reasons
84		- error_log('MetaSync Security: Inline JS blocked for security - content: ' . substr($js, 0, 100));
85		-}
86		-}
87		-}
88		-
89	66	?>
90	67
91		-</html>
	68	+</html>