| @@ -1358,8 +1358,29 @@ | ||
| 1358 | 1358 | |
| 1359 | 1359 | return $block; |
| 1360 | 1360 | } |
| 1361 | 1361 | |
| 1362 | +// Walk a parsed block tree and sanitize every Pagelayer block in it, at any depth | |
| 1363 | +function pagelayer_sanitize_block_tree($block){ | |
| 1364 | + | |
| 1365 | + $block_name = isset($block['blockName']) ? $block['blockName'] : ''; | |
| 1366 | + | |
| 1367 | + // Is pagelayer block ? pagelayer_sanitize_blocks_save_pre() walks the | |
| 1368 | + // whole subtree, so we are done for this branch | |
| 1369 | + if(is_string($block_name) && 0 === strpos($block_name, 'pagelayer/')){ | |
| 1370 | + return pagelayer_sanitize_blocks_save_pre($block); | |
| 1371 | + } | |
| 1372 | + | |
| 1373 | + // Any other block can still hold Pagelayer blocks inside it | |
| 1374 | + if(!empty($block['innerBlocks']) && is_array($block['innerBlocks'])){ | |
| 1375 | + foreach($block['innerBlocks'] as $k => $inner){ | |
| 1376 | + $block['innerBlocks'][$k] = pagelayer_sanitize_block_tree($inner); | |
| 1377 | + } | |
| 1378 | + } | |
| 1379 | + | |
| 1380 | + return $block; | |
| 1381 | +} | |
| 1382 | + | |
| 1362 | 1383 | // Check for XSS codes in our shortcode attributes |
| 1363 | 1384 | function pagelayer_sanitize_shortcode_atts($content){ |
| 1364 | 1385 | |
| 1365 | 1386 | // Do we have something suspicious ? |
| @@ -1464,13 +1485,8 @@ | ||
| 1464 | 1485 | $post_id = $post->ID; |
| 1465 | 1486 | }else{ |
| 1466 | 1487 | return false; |
| 1467 | 1488 | } |
| 1468 | - } | |
| 1469 | - | |
| 1470 | - // Rule 1: only warn users who can edit posts | |
| 1471 | - if(!current_user_can('edit_posts')){ | |
| 1472 | - return false; | |
| 1473 | 1489 | } |
| 1474 | 1490 | |
| 1475 | 1491 | // Rule 5: user already acknowledged — don't block again |
| 1476 | 1492 | $view_token = get_transient('pagelayer_xss_view_'.$post_id.'_'.get_current_user_id()); |
