| @@ -44,30 +44,14 @@ | ||
| 44 | 44 | $form_id = (int) $form->ID; |
| 45 | 45 | $campaign_id = (int) $campaign_id; |
| 46 | 46 | $unique_form_id = 'suredonation-form-' . $form_id . '-' . wp_rand(); |
| 47 | 47 | $form_style = Form_Styling::get_style_attr( $form_id ); |
| 48 | - $custom_css = Form_Custom_CSS::get_style_block( $form_id ); | |
| 49 | 48 | $nonce_action = Helper::get_donation_nonce_action( $campaign_id ); |
| 50 | 49 | $blocks = parse_blocks( $form->post_content ); |
| 51 | 50 | |
| 52 | - // Marker class when default styling is disabled, so custom CSS can | |
| 53 | - // target the unstyled state (get_style_attr already returned ''). | |
| 54 | - $container_classes = 'sd-form-container'; | |
| 55 | - if ( Form_Styling::is_default_styling_disabled( $form_id ) ) { | |
| 56 | - $container_classes .= ' sd-styling-none'; | |
| 57 | - } | |
| 58 | - | |
| 59 | 51 | ob_start(); |
| 60 | 52 | ?> |
| 61 | - <div id="<?php echo esc_attr( $unique_form_id ); ?>" class="<?php echo esc_attr( $container_classes ); ?>" data-form-id="<?php echo esc_attr( (string) $form_id ); ?>" data-campaign-id="<?php echo esc_attr( (string) $campaign_id ); ?>"<?php echo '' !== $form_style ? ' style="' . esc_attr( $form_style ) . '"' : ''; ?>> | |
| 62 | - <?php | |
| 63 | - // Generated markup whose CSS is already sanitized by | |
| 64 | - // Form_Custom_CSS::sanitize(). It must not go through | |
| 65 | - // Helper::get_allowed_form_html() like the block output below: that | |
| 66 | - // allowlist permits `style` attributes but not the `style` tag, so kses | |
| 67 | - // would strip the whole block. | |
| 68 | - echo $custom_css; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 69 | - ?> | |
| 53 | + <div id="<?php echo esc_attr( $unique_form_id ); ?>" class="sd-form-container" data-form-id="<?php echo esc_attr( (string) $form_id ); ?>" data-campaign-id="<?php echo esc_attr( (string) $campaign_id ); ?>"<?php echo '' !== $form_style ? ' style="' . esc_attr( $form_style ) . '"' : ''; ?>> | |
| 70 | 54 | <form class="sd-form" method="post"> |
| 71 | 55 | <?php wp_nonce_field( $nonce_action, 'suredonation_nonce' ); ?> |
| 72 | 56 | <input type="hidden" name="form_id" value="<?php echo esc_attr( (string) $form_id ); ?>"> |
| 73 | 57 | <input type="hidden" name="campaign_id" value="<?php echo esc_attr( (string) $campaign_id ); ?>"> |
| @@ -77,35 +61,14 @@ | ||
| 77 | 61 | <input type="hidden" name="action" value="suredonation_submit_donation"> |
| 78 | 62 | <?php Helper::render_honeypot_field(); ?> |
| 79 | 63 | |
| 80 | 64 | <?php |
| 81 | - // Privacy fields (consent / privacy policy / terms) enabled in the | |
| 82 | - // Privacy settings are injected as the last thing before the submit | |
| 83 | - // button so the donor sees them right before submitting. Anchor on the | |
| 84 | - // donate button; if a form has none, fall back to the payment block, and | |
| 85 | - // finally to the end of the form. The anchor may be nested inside a | |
| 86 | - // layout block (Group/Columns), so match the top-level block that either | |
| 87 | - // is, or contains, the anchor. | |
| 88 | - $privacy_fields = \SureDonation\Inc\Privacy\Privacy_Frontend::render_form_fields(); | |
| 89 | - $privacy_anchor = Helper::block_tree_contains( $blocks, 'suredonation/donate-button' ) ? 'suredonation/donate-button' : 'suredonation/payment'; | |
| 90 | - $privacy_injected = false; | |
| 91 | 65 | foreach ( $blocks as $block ) { |
| 92 | 66 | if ( empty( $block['blockName'] ) ) { |
| 93 | 67 | continue; |
| 94 | 68 | } |
| 95 | - $is_anchor = $block['blockName'] === $privacy_anchor | |
| 96 | - || ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) && Helper::block_tree_contains( $block['innerBlocks'], $privacy_anchor ) ); | |
| 97 | - if ( ! $privacy_injected && '' !== $privacy_fields && $is_anchor ) { | |
| 98 | - echo wp_kses( $privacy_fields, Helper::get_allowed_form_html() ); | |
| 99 | - $privacy_injected = true; | |
| 100 | - } | |
| 101 | 69 | $block['attrs']['formId'] = $form_id; |
| 102 | - // Allow the data: protocol so a lazy-load optimizer's inline SVG | |
| 103 | - // placeholder (Image block) survives this second kses pass. | |
| 104 | - echo wp_kses( render_block( $block ), Helper::get_allowed_form_html(), array_merge( wp_allowed_protocols(), [ 'data' ] ) ); | |
| 105 | - } | |
| 106 | - if ( ! $privacy_injected && '' !== $privacy_fields ) { | |
| 107 | - echo wp_kses( $privacy_fields, Helper::get_allowed_form_html() ); | |
| 70 | + echo wp_kses( render_block( $block ), Helper::get_allowed_form_html() ); | |
| 108 | 71 | } |
| 109 | 72 | ?> |
| 110 | 73 | </form> |
| 111 | 74 | <!-- Success Message Container --> |
