← All changes | src/PostSnippets/Shortcode.php +47 -28 4.2.2 → trunk View file →

		@@ -37,11 +37,10 @@
37	37
38	38	if( !empty($snippet) ){
39	39
40	40	$default_atts = self::filterVars( $snippet['snippet_vars'] );
	41	+ $render_raw_html = self::shouldRenderRawHtml( $snippet );
41	42
42		- $texturize = $snippet["snippet_wptexturize"]?? false;
43		-
44	43	foreach ((array) $atts as $key => $val) {
45	44	if ( is_numeric($key) ) {
46	45	$attribute = explode('=', $val, 2);
47	46
		@@ -70,9 +69,10 @@
70	69	}
71	70	$snippet_content = self::replaceSnippetVariables(
72	71	$snippet_content,
73	72	$short_atts,
74		- ! empty( $snippet['snippet_php'] ) && (int) $snippet['snippet_php'] === 1
	73	+ ! empty( $snippet['snippet_php'] ) && (int) $snippet['snippet_php'] === 1,
	74	+ $render_raw_html
75	75	);
76	76
77	77	// There might be the case that a snippet contains
78	78	// the post snippets reserved variable {content} to
		@@ -92,11 +92,9 @@
92	92	}
93	93
94	94	} else {
95	95	if ( ! empty( $snippet['snippet_wptexturize'] ) && ( $snippet['snippet_wptexturize'] == true ) ) {
96		- $snippet_content = html_entity_decode ( addslashes ( wptexturize ( htmlentities( stripslashes ( $snippet_content ), ENT_NOQUOTES ) ) ) );
97		- } else {
98		- $snippet_content = html_entity_decode ( $snippet_content );
	96	+ $snippet_content = addslashes( wptexturize( stripslashes( $snippet_content ) ) );
99	97	}
100	98	}
101	99
102	100	$snippet_content = do_shortcode( stripslashes( $snippet_content ) );
		@@ -127,12 +125,12 @@
127	125
128	126	return addslashes($content);
129	127	}
130	128
131		- public static function replaceSnippetVariables($snippet_content, $short_atts, $php_snippet = false)
	129	+ public static function replaceSnippetVariables($snippet_content, $short_atts, $php_snippet = false, $render_raw_html = true)
132	130	{
133	131	foreach ( $short_atts as $key => $val ) {
134		- $short_atts[ $key ] = self::sanitizeVariableValue( $key, $val, $php_snippet );
	132	+ $short_atts[ $key ] = self::sanitizeVariableValue( $key, $val, $php_snippet, $render_raw_html );
135	133	}
136	134
137	135	if ( $php_snippet ) {
138	136	return self::replacePhpVariables( $snippet_content, $short_atts );
		@@ -144,9 +142,9 @@
144	142
145	143	return $snippet_content;
146	144	}
147	145
148		- public static function sanitizeVariableValue($key, $val, $php_snippet = false)
	146	+ public static function sanitizeVariableValue($key, $val, $php_snippet = false, $render_raw_html = true)
149	147	{
150	148	$val = (string) $val;
151	149
152	150	$colon = strpos($key, ':');
		@@ -155,9 +153,9 @@
155	153	$text = explode(":", $key);
156	154
157	155	switch (strtolower($text[1])) {
158	156	case 'url':
159		- $val = esc_url_raw( $val );
	157	+ $val = esc_url( $val );
160	158	break;
161	159	case 'text':
162	160	$val = esc_html( $val );
163	161	break;
		@@ -176,17 +174,27 @@
176	174	if ( $php_snippet ) {
177	175	return $val;
178	176	}
179	177
180		- return strtr(
181		- $val,
182		- array(
183		- '"' => '"',
184		- "'" => ''',
185		- )
186		- );
	178	+ if ( $colon !== false ) {
	179	+ return $val;
	180	+ }
	181	+
	182	+ // Normalize entity-encoded HTML first, then either allow it through (raw mode) or escape it once (text mode)
	183	+ $val = html_entity_decode( $val, ENT_QUOTES );
	184	+
	185	+ return $render_raw_html ? $val : esc_html( $val );
187	186	}
188	187
	188	+ public static function shouldRenderRawHtml( $snippet )
	189	+ {
	190	+ if ( ! array_key_exists( 'snippet_rawhtml', $snippet ) ) {
	191	+ return true;
	192	+ }
	193	+
	194	+ return (int) $snippet['snippet_rawhtml'] === 1;
	195	+ }
	196	+
189	197	public static function replacePhpVariables($snippet_content, $short_atts)
190	198	{
191	199	$string_pattern = '/\'(?:\\\\.|[^\'\\\\])*\'|"(?:\\\\.|[^"\\\\])*"/s';
192	200
		@@ -243,20 +251,33 @@
243	251	* @return array The result of the evaluation
244	252	*/
245	253	public static function filterVars($vars = '')
246	254	{
247		- if( !empty($vars) ){
	255	+ if ( empty($vars) ) {
	256	+ return array();
	257	+ }
248	258
249		- $vars = explode(",", $vars );
	259	+ if ( is_string($vars) ) {
	260	+ $vars = explode(",", $vars);
	261	+ }
250	262
	263	+ if ( is_array($vars) ) {
251	264	$default_atts = array();
252		-
253		- foreach ($vars as $var) {
254	265
	266	+ foreach ($vars as $key => $var) {
	267	+ if ( !is_numeric($key) ) {
	268	+ $default_atts[$key] = is_scalar($var) ? (string)$var : '';
	269	+ continue;
	270	+ }
	271	+
	272	+ if ( !is_string($var) ) {
	273	+ continue;
	274	+ }
	275	+
255	276	$attribute = explode('=', $var); /**This Results in array seperated by = sign */
256	277
257		- foreach ($attribute as $key => $value) { //Filtering Empty Values generated with such variable texts one,two=,,,=xx=one,,==two
258		- if( empty($value) ) unset($attribute[$key]);
	278	+ foreach ($attribute as $attr_key => $value) { //Filtering Empty Values generated with such variable texts one,two=,,,=xx=one,,==two
	279	+ if( empty($value) ) unset($attribute[$attr_key]);
259	280	}
260	281
261	282	if( empty($attribute) ) continue; /**After Unsetting Empty values above, any empty array still remains, so this line is skipping that */
262	283
		@@ -262,16 +283,14 @@
262	283
263	284	$attribute = array_values($attribute); //resetting index to start with zero
264	285
265	286	$default_value = (count($attribute) > 1) ? $attribute[1] : ''; /**Default values of vars, if set any */
266		-
	287	+
267	288	$default_atts[$attribute[0]] = $default_value; /**Setting Default Atts for shortcode_atts */
268		-
269	289	}
270	290
271	291	return $default_atts;
272	292	}
273		- else{
274		- return array();
275		- }
	293	+
	294	+ return array();
276	295	}
277	296	}