| @@ -438,39 +438,13 @@ | ||
| 438 | 438 | return $slug . '-' . $index; |
| 439 | 439 | } |
| 440 | 440 | |
| 441 | 441 | /** |
| 442 | - * Generate a unique block ID for a server-created block. | |
| 443 | - * | |
| 444 | - * Mirrors the client-side generateBlockId() used in each block's edit.js | |
| 445 | - * (a 7-character base36 string). Blocks created programmatically (e.g. the | |
| 446 | - * default form auto-generated when a campaign is published) never run the | |
| 447 | - * editor, so they would otherwise have no block_id. The server-side payment | |
| 448 | - * validation config is keyed on block_id, so without one no config is stored | |
| 449 | - * and donations fail with "Invalid form configuration." until the form is | |
| 450 | - * opened and saved in the editor. | |
| 451 | - * | |
| 452 | - * @return string A 7-character base36 identifier. | |
| 453 | - * @since 1.1.1 | |
| 454 | - */ | |
| 455 | - public static function generate_block_id() { | |
| 456 | - $chars = '0123456789abcdefghijklmnopqrstuvwxyz'; | |
| 457 | - $block_id = ''; | |
| 458 | - for ( $i = 0; $i < 7; $i++ ) { | |
| 459 | - $block_id .= $chars[ wp_rand( 0, 35 ) ]; | |
| 460 | - } | |
| 461 | - return $block_id; | |
| 462 | - } | |
| 463 | - | |
| 464 | - /** | |
| 465 | 442 | * Get client IP address for logging purposes. |
| 466 | 443 | * |
| 467 | - * Uses REMOTE_ADDR only — forwarded headers (HTTP_X_FORWARDED_FOR, | |
| 468 | - * HTTP_CLIENT_IP) are deliberately ignored because they are trivially | |
| 469 | - * spoofable. Note: behind a proxy/CDN that does not restore the real client | |
| 470 | - * IP, this returns the proxy's address. Suitable for informational logging | |
| 471 | - * and best-effort geolocation only — do NOT use for security-critical IP | |
| 472 | - * validation. | |
| 444 | + * Checks forwarded headers first (for proxied/load-balanced environments) | |
| 445 | + * then falls back to REMOTE_ADDR. This is suitable for informational | |
| 446 | + * logging only — do NOT use for security-critical IP validation. | |
| 473 | 447 | * |
| 474 | 448 | * @return string Client IP address. |
| 475 | 449 | * @since 0.0.1 |
| 476 | 450 | */ |
| @@ -562,9 +536,8 @@ | ||
| 562 | 536 | 'data-subscription-billing-cycles' => true, |
| 563 | 537 | 'data-currency-symbol' => true, |
| 564 | 538 | 'data-message-format' => true, |
| 565 | 539 | 'data-payment-methods' => true, |
| 566 | - 'data-payment-available' => true, | |
| 567 | 540 | 'data-method' => true, |
| 568 | 541 | 'data-slug' => true, |
| 569 | 542 | 'data-required' => true, |
| 570 | 543 | 'data-fee-percentage' => true, |
| @@ -571,28 +544,13 @@ | ||
| 571 | 544 | 'data-fee-fixed' => true, |
| 572 | 545 | 'data-fee-mode' => true, |
| 573 | 546 | 'data-gateway-fees' => true, |
| 574 | 547 | 'data-invalid-email-msg' => true, |
| 575 | - 'data-invalid-url-msg' => true, | |
| 576 | 548 | 'data-sd-mask' => true, |
| 577 | 549 | 'data-custom-sd-mask' => true, |
| 578 | - // Dropdown (tom-select) field. | |
| 579 | - 'data-multiple' => true, | |
| 580 | - 'data-searchable' => true, | |
| 581 | - 'data-preselected' => true, | |
| 582 | - 'data-min-selection' => true, | |
| 583 | - 'data-max-selection' => true, | |
| 584 | - 'data-placeholder' => true, | |
| 585 | - // Phone (intl-tel-input) field. | |
| 586 | - 'data-default-country' => true, | |
| 587 | - 'data-auto-country' => true, | |
| 588 | - 'data-enable-country-filter' => true, | |
| 589 | - 'data-country-filter-type' => true, | |
| 590 | - 'data-include-countries' => true, | |
| 591 | - 'data-exclude-countries' => true, | |
| 592 | 550 | ]; |
| 593 | 551 | |
| 594 | - $allowed = [ | |
| 552 | + return [ | |
| 595 | 553 | 'div' => array_merge( |
| 596 | 554 | [ |
| 597 | 555 | 'id' => true, |
| 598 | 556 | 'class' => true, |
| @@ -597,12 +555,10 @@ | ||
| 597 | 555 | 'id' => true, |
| 598 | 556 | 'class' => true, |
| 599 | 557 | 'style' => true, |
| 600 | 558 | 'role' => true, |
| 601 | - 'tabindex' => true, | |
| 602 | 559 | 'aria-live' => true, |
| 603 | 560 | 'aria-atomic' => true, |
| 604 | - 'aria-hidden' => true, | |
| 605 | 561 | 'aria-labelledby' => true, |
| 606 | 562 | ], |
| 607 | 563 | $common_data_attrs |
| 608 | 564 | ), |
| @@ -643,11 +599,8 @@ | ||
| 643 | 599 | 'checked' => true, |
| 644 | 600 | 'disabled' => true, |
| 645 | 601 | 'readonly' => true, |
| 646 | 602 | 'required' => true, |
| 647 | - 'tabindex' => true, | |
| 648 | - 'autocomplete' => true, | |
| 649 | - 'inputmode' => true, | |
| 650 | 603 | 'aria-describedby' => true, |
| 651 | 604 | 'aria-required' => true, |
| 652 | 605 | 'aria-hidden' => true, |
| 653 | 606 | ], |
| @@ -668,11 +621,8 @@ | ||
| 668 | 621 | 'class' => true, |
| 669 | 622 | 'name' => true, |
| 670 | 623 | 'disabled' => true, |
| 671 | 624 | 'required' => true, |
| 672 | - 'multiple' => true, | |
| 673 | - 'tabindex' => true, | |
| 674 | - 'autocomplete' => true, | |
| 675 | 625 | 'aria-describedby' => true, |
| 676 | 626 | 'aria-required' => true, |
| 677 | 627 | ], |
| 678 | 628 | $common_data_attrs |
| @@ -678,9 +628,8 @@ | ||
| 678 | 628 | $common_data_attrs |
| 679 | 629 | ), |
| 680 | 630 | 'option' => [ |
| 681 | 631 | 'value' => true, |
| 682 | - 'class' => true, | |
| 683 | 632 | 'selected' => true, |
| 684 | 633 | 'disabled' => true, |
| 685 | 634 | ], |
| 686 | 635 | 'textarea' => array_merge( |
| @@ -714,32 +663,8 @@ | ||
| 714 | 663 | 'class' => true, |
| 715 | 664 | 'style' => true, |
| 716 | 665 | 'role' => true, |
| 717 | 666 | ], |
| 718 | - 'h1' => [ | |
| 719 | - 'id' => true, | |
| 720 | - 'class' => true, | |
| 721 | - ], | |
| 722 | - 'h2' => [ | |
| 723 | - 'id' => true, | |
| 724 | - 'class' => true, | |
| 725 | - ], | |
| 726 | - 'h3' => [ | |
| 727 | - 'id' => true, | |
| 728 | - 'class' => true, | |
| 729 | - ], | |
| 730 | - 'h4' => [ | |
| 731 | - 'id' => true, | |
| 732 | - 'class' => true, | |
| 733 | - ], | |
| 734 | - 'h5' => [ | |
| 735 | - 'id' => true, | |
| 736 | - 'class' => true, | |
| 737 | - ], | |
| 738 | - 'h6' => [ | |
| 739 | - 'id' => true, | |
| 740 | - 'class' => true, | |
| 741 | - ], | |
| 742 | 667 | 'a' => [ |
| 743 | 668 | 'id' => true, |
| 744 | 669 | 'class' => true, |
| 745 | 670 | 'href' => true, |
| @@ -762,11 +687,8 @@ | ||
| 762 | 687 | 'li' => [ |
| 763 | 688 | 'class' => true, |
| 764 | 689 | ], |
| 765 | 690 | 'br' => [], |
| 766 | - 'hr' => [ | |
| 767 | - 'class' => true, | |
| 768 | - ], | |
| 769 | 691 | 'svg' => [ |
| 770 | 692 | 'class' => true, |
| 771 | 693 | 'width' => true, |
| 772 | 694 | 'height' => true, |
| @@ -801,19 +723,8 @@ | ||
| 801 | 723 | 'stroke-linejoin' => true, |
| 802 | 724 | 'fill' => true, |
| 803 | 725 | ], |
| 804 | 726 | ]; |
| 805 | - | |
| 806 | - /** | |
| 807 | - * Filter the allowed HTML tags/attributes for SureDonation form markup. | |
| 808 | - * | |
| 809 | - * Lets extensions (e.g. the SureDonation Pro date/time pickers) permit the | |
| 810 | - * extra tags or data attributes their fields render. | |
| 811 | - * | |
| 812 | - * @since 1.1.1 | |
| 813 | - * @param array<string, array<string, bool>> $allowed Allowed tags/attributes. | |
| 814 | - */ | |
| 815 | - return apply_filters( 'suredonation_allowed_form_html', $allowed ); | |
| 816 | 727 | } |
| 817 | 728 | |
| 818 | 729 | /** |
| 819 | 730 | * Get the nonce action string for a donation form. |
| @@ -1127,9 +1038,9 @@ | ||
| 1127 | 1038 | /** |
| 1128 | 1039 | * Render a styled payment-status badge for the donation confirmation. |
| 1129 | 1040 | * |
| 1130 | 1041 | * @param string $status Payment status (e.g. completed, pending, failed). |
| 1131 | - * @return array Badge HTML. | |
| 1042 | + * @return string Badge HTML. | |
| 1132 | 1043 | * @since 1.0.0 |
| 1133 | 1044 | */ |
| 1134 | 1045 | public static function get_payment_status_config( $status ) { |
| 1135 | 1046 | $status = strtolower( trim( (string) $status ) ); |
| @@ -1311,62 +1222,6 @@ | ||
| 1311 | 1222 | |
| 1312 | 1223 | $rendered = Email_Handler::process_smart_tags( $template, $donation_data, $campaign ); |
| 1313 | 1224 | |
| 1314 | 1225 | return wp_kses_post( $rendered ); |
| 1315 | - } | |
| 1316 | - | |
| 1317 | - /** | |
| 1318 | - * Check whether the OttoKit (formerly SureTriggers) plugin is active and | |
| 1319 | - * authenticated with the OttoKit SaaS. | |
| 1320 | - * | |
| 1321 | - * @return bool True when OttoKit is installed, active and connected. | |
| 1322 | - * @since 1.2.0 | |
| 1323 | - */ | |
| 1324 | - public static function is_suretriggers_ready() { | |
| 1325 | - if ( ! defined( 'SURE_TRIGGERS_FILE' ) ) { | |
| 1326 | - // Plugin is deactivated or not installed at all. | |
| 1327 | - return false; | |
| 1328 | - } | |
| 1329 | - | |
| 1330 | - $suretriggers_data = get_option( 'suretrigger_options', [] ); | |
| 1331 | - if ( ! is_array( $suretriggers_data ) || empty( $suretriggers_data['secret_key'] ) || ! is_string( $suretriggers_data['secret_key'] ) ) { | |
| 1332 | - // OttoKit is not authenticated yet. | |
| 1333 | - return false; | |
| 1334 | - } | |
| 1335 | - | |
| 1336 | - return true; | |
| 1337 | - } | |
| 1338 | - | |
| 1339 | - /** | |
| 1340 | - * Get OttoKit (formerly SureTriggers) integration metadata. | |
| 1341 | - * | |
| 1342 | - * Shared by the admin app and the donation form editor so both surface the | |
| 1343 | - * same install/activate/connect state. | |
| 1344 | - * | |
| 1345 | - * @return array<string,mixed> Integration metadata. | |
| 1346 | - * @since 1.2.0 | |
| 1347 | - */ | |
| 1348 | - public static function get_ottokit_integration() { | |
| 1349 | - $plugin_file = 'suretriggers/suretriggers.php'; | |
| 1350 | - | |
| 1351 | - if ( ! function_exists( 'is_plugin_active' ) ) { | |
| 1352 | - include_once ABSPATH . 'wp-admin/includes/plugin.php'; | |
| 1353 | - } | |
| 1354 | - | |
| 1355 | - $status = 'Install'; | |
| 1356 | - if ( is_plugin_active( $plugin_file ) ) { | |
| 1357 | - $status = 'Activated'; | |
| 1358 | - } elseif ( array_key_exists( $plugin_file, get_plugins() ) ) { | |
| 1359 | - $status = 'Installed'; | |
| 1360 | - } | |
| 1361 | - | |
| 1362 | - return [ | |
| 1363 | - 'title' => 'OttoKit', | |
| 1364 | - 'slug' => 'suretriggers', | |
| 1365 | - 'path' => $plugin_file, | |
| 1366 | - 'status' => $status, | |
| 1367 | - // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Filter is owned by the OttoKit plugin. | |
| 1368 | - 'connected' => apply_filters( 'suretriggers_is_user_connected', '' ), | |
| 1369 | - 'connection_url' => admin_url( 'admin.php?page=suretriggers' ), | |
| 1370 | - ]; | |
| 1371 | 1226 | } |
| 1372 | 1227 | } |
