← All changes | Add_Ons/WP/Widget.php +77 -48 2.40 → 3.37 View file →

		@@ -1,13 +1,19 @@
1	1	<?php
	2	+
2	3	namespace Photonic_Plugin\Add_Ons\WP;
3	4
	5	+use Photonic_Plugin\Core\Photonic;
4	6	use WP_Widget;
5	7
6	8	class Widget extends WP_Widget {
7		- private $empty_shortcode, $invalid_shortcode, $edit_shortcode;
8		- function __construct() {
9		- $widget_ops = ['classname' => 'widget-photonic',
	9	+ private string $empty_shortcode;
	10	+ public string $invalid_shortcode;
	11	+ public string $edit_shortcode;
	12	+
	13	+ public function __construct() {
	14	+ $widget_ops = [
	15	+ 'classname' => 'widget-photonic',
10	16	'description' => __("A widget for displaying a Photonic Gallery.", 'photonic')
11	17	];
12	18
13	19	$control_ops = [];
		@@ -17,53 +23,74 @@
17	23
18	24	parent::__construct("photonic-widget", __("Photonic Gallery", 'photonic'), $widget_ops, $control_ops);
19	25	}
20	26
21		- function widget($args, $instance) {
22		- extract($args);
23		-
	27	+ public function widget($args, $instance) {
24	28	$title = empty($instance['title']) ? '' : $instance['title'];
25	29	$shortcode = empty($instance['shortcode']) ? '' : $instance['shortcode'];
26	30
27		- echo $before_widget;
28		- if ($title != '') {
29		- echo $before_title.$title.$after_title;
	31	+ echo wp_kses_post($args['before_widget']);
	32	+ if ('' !== $title) {
	33	+ echo wp_kses_post($args['before_title'] . $title . $args['after_title']);
30	34	}
31	35
32		- $output = do_shortcode($shortcode);
33		- echo $output;
	36	+ // Input is coming via content saved in a widget, so we have to ensure it is safe.
	37	+ // The input is expected to be a Photonic shortcode, so the simplest way is to strip out all instances of the Photonic
	38	+ // shortcode and verify that the input is blank. If it is blank, then all that the input had was a Photonic shortcode.
34	39
35		- echo $after_widget;
	40	+ global $photonic_alternative_shortcode;
	41	+ $content_without_shortcodes = strip_shortcodes($shortcode);
	42	+ $shortcode_tag = esc_attr($photonic_alternative_shortcode ?: 'gallery');
	43	+
	44	+ if (!empty(trim($shortcode)) && has_shortcode($shortcode, $shortcode_tag) && empty(trim($content_without_shortcodes))) {
	45	+ // Looks good. Let's proceed.
	46	+ $output = do_shortcode($shortcode);
	47	+ echo wp_kses($output, Photonic::$safe_tags);
	48	+ }
	49	+
	50	+ echo wp_kses_post($args['after_widget']);
36	51	}
37	52
38		- function update($new_instance, $old_instance) {
	53	+ public function update($new_instance, $old_instance) {
39	54	$instance = $old_instance;
40		- $instance['title'] = esc_attr($new_instance['title']);
41		- $instance['shortcode'] = $new_instance['shortcode'];
	55	+ $instance['title'] = sanitize_text_field($new_instance['title']);
	56	+ $instance['shortcode'] = sanitize_text_field($new_instance['shortcode']);
42	57	return $instance;
43	58	}
44	59
45		- function form($instance) {
	60	+ public function form($instance) {
46	61	global $photonic_alternative_shortcode;
47		- $tag = empty($photonic_alternative_shortcode) ? 'gallery' : $photonic_alternative_shortcode;
	62	+ $tag = $photonic_alternative_shortcode ?: 'gallery';
48	63
49	64	$defaults = [
50		- 'title' => '',
	65	+ 'title' => '',
51	66	'custom_class' => '',
52		- 'shortcode' => ''
	67	+ 'shortcode' => ''
53	68	];
54		- $instance = wp_parse_args((array)$instance, $defaults);
	69	+ $instance = wp_parse_args(
	70	+ (array) $instance,
	71	+ $defaults
	72	+ );
55	73
56	74	add_thickbox();
57		- $url = add_query_arg([
58		- 'action' => 'photonic_wizard',
59		- 'class' => 'photonic-flow',
60		- 'post_id' => '',
61		- 'width' => '1000',
62		- 'height' => '600',
63		- 'TB_iframe' => 'true',
64		- ], admin_url( 'admin.php' ) );
	75	+ $user = get_current_user_id();
	76	+ if (0 === $user) {
	77	+ $user = wp_rand(1);
	78	+ }
65	79
	80	+ $url = add_query_arg(
	81	+ [
	82	+ 'action' => 'photonic_wizard',
	83	+ 'class' => 'photonic-flow',
	84	+ 'post_id' => '',
	85	+ 'nonce' => wp_create_nonce('photonic-wizard-' . $user),
	86	+ 'width' => '1000',
	87	+ 'height' => '600',
	88	+ 'TB_iframe' => 'true',
	89	+ ],
	90	+ admin_url('admin.php')
	91	+ );
	92	+
66	93	$shortcode = $instance['shortcode'];
67	94	$types = ['default', 'wp', 'flickr', 'smugmug', 'picasa', 'google', 'zenfolio', 'instagram'];
68	95	$layouts = ['square', 'circle', 'random', 'masonry', 'mosaic', 'strip-above', 'strip-below', 'strip-right', 'no-strip'];
69	96
		@@ -74,17 +101,17 @@
74	101	$message = $this->edit_shortcode;
75	102	if (empty($shortcode)) {
76	103	$message = $this->empty_shortcode;
77	104	}
78		- else if (!empty($matches) && !empty($matches[0]) && !empty($matches[1]) && !empty($matches[2]) && !empty($matches[3])) {
79		- foreach ($matches[1] as $instance => $start) {
80		- if ($start[0] === '') {
81		- if (!empty($matches[3][$instance])) {
82		- $shortcode_attr = shortcode_parse_atts($matches[3][$instance][0]);
83		- if (!empty($shortcode_attr['type']) && in_array($shortcode_attr['type'], $types)) {
	105	+ elseif (!empty($matches) && !empty($matches[0]) && !empty($matches[1]) && !empty($matches[2]) && !empty($matches[3])) {
	106	+ foreach ($matches[1] as $index => $start) {
	107	+ if ('' === $start[0]) {
	108	+ if (!empty($matches[3][$index])) {
	109	+ $shortcode_attr = shortcode_parse_atts($matches[3][$index][0]);
	110	+ if (!empty($shortcode_attr['type']) && in_array($shortcode_attr['type'], $types, true)) {
84	111	$type = $shortcode_attr['type'];
85	112	}
86		- else if (empty($shortcode_attr['type']) && !empty($shortcode_attr['style']) && in_array($shortcode_attr['style'], $layouts)) {
	113	+ elseif (empty($shortcode_attr['type']) && !empty($shortcode_attr['style']) && in_array($shortcode_attr['style'], $layouts, true)) {
87	114	$type = 'wp';
88	115	}
89	116	else {
90	117	$message = $this->invalid_shortcode;
		@@ -100,32 +127,34 @@
100	127	}
101	128	?>
102	129	<div class="photonic-widget">
103	130	<p>
104		- <label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title', 'photonic'); ?></label>
105		- <input id="<?php echo $this->get_field_id('title'); ?>" value="<?php echo $instance['title']; ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" class="widefat" />
	131	+ <label for="<?php echo esc_attr($this->get_field_id('title')); ?>"><?php esc_attr_e('Title', 'photonic'); ?></label>
	132	+ <input id="<?php echo esc_attr($this->get_field_id('title')); ?>" value="<?php echo esc_attr($instance['title']); ?>"
	133	+ name="<?php echo esc_attr($this->get_field_name('title')); ?>" type="text" class="widefat"/>
106	134	</p>
107	135
108		- <input id="<?php echo $this->get_field_id('shortcode'); ?>" value="<?php echo $shortcode; ?>" type="hidden" name="<?php echo $this->get_field_name('shortcode'); ?>" class="photonic-shortcode"/>
	136	+ <input id="<?php echo esc_attr($this->get_field_id('shortcode')); ?>" value="<?php echo esc_attr($shortcode); ?>" type="hidden"
	137	+ name="<?php echo esc_attr($this->get_field_name('shortcode')); ?>" class="photonic-shortcode"/>
109	138
110	139	<div class="photonic-source">
111		- <a class="photonic-wizard <?php echo $type; ?>" href="<?php echo $url; ?>"></a>
	140	+ <a class="photonic-wizard <?php echo esc_attr($type); ?>" href="<?php echo esc_url($url); ?>"></a>
112	141	<p>
113		- <?php echo $message; ?>
	142	+ <?php echo wp_kses_post($message); ?>
114	143	</p>
115	144	</div>
116	145
117	146	<div class="photonic-shortcode-display">
118		- <?php
119		- if ($shortcode !== '') {
	147	+ <?php
	148	+ if ('' !== $shortcode) {
	149	+ ?>
	150	+ <h4><?php echo esc_html__('Current shortcode', 'photonic'); ?></h4>
	151	+ <code><?php echo wp_kses_post($shortcode); ?></code>
	152	+ <?php
	153	+ }
120	154	?>
121		- <h4><?php echo esc_html__('Current shortcode', 'photonic'); ?></h4>
122		- <code><?php echo $shortcode; ?></code>
123		- <?php
124		- }
125		- ?>
126	155	</div>
127	156	</div>
128	157	<?php
129	158	}
130	159
131		-}
	160	+}