← All changes | inc/fields/form-styling.php +23 -104 1.6.0 → 1.1.0 View file →

		@@ -90,40 +90,36 @@
90	90	* @since 1.0.0
91	91	*/
92	92	public static function get_defaults() {
93	93	return [
94		- 'bgType' => 'color',
95		- 'bgColor' => '',
96		- 'bgGradient' => 'linear-gradient(90deg,#FFC9B2 0%,#C7CBFF 100%)',
97		- 'bgImage' => '',
98		- 'bgImageId' => 0,
99		- 'bgImageSize' => 'cover',
100		- 'bgImagePosition' => 'center center',
101		- 'bgImageRepeat' => 'no-repeat',
	94	+ 'bgType' => 'color',
	95	+ 'bgColor' => '',
	96	+ 'bgGradient' => 'linear-gradient(90deg,#FFC9B2 0%,#C7CBFF 100%)',
	97	+ 'bgImage' => '',
	98	+ 'bgImageId' => 0,
	99	+ 'bgImageSize' => 'cover',
	100	+ 'bgImagePosition' => 'center center',
	101	+ 'bgImageRepeat' => 'no-repeat',
102	102	// Colors default to empty here so unset values fall through to the
103	103	// :root defaults in _variables.scss (the editor's STYLE_DEFAULTS seeds
104	104	// the actual hex values instead, only to populate the panel swatches).
105		- 'primaryColor' => '',
106		- 'textColor' => '',
107		- 'textOnPrimaryColor' => '',
108		- 'padding' => [
	105	+ 'primaryColor' => '',
	106	+ 'textColor' => '',
	107	+ 'textOnPrimaryColor' => '',
	108	+ 'padding' => [
109	109	'top' => '',
110	110	'right' => '',
111	111	'bottom' => '',
112	112	'left' => '',
113	113	],
114		- 'borderRadius' => [
	114	+ 'borderRadius' => [
115	115	'top' => '',
116	116	'right' => '',
117	117	'bottom' => '',
118	118	'left' => '',
119	119	],
120		- 'fieldSpacing' => 'medium',
121		- 'buttonAlignment' => 'justify',
122		- // When true the form renders without the SureDonation stylesheet and
123		- // inline CSS variables so the site's own CSS fully controls its
124		- // appearance (mirrors SureForms' disable_default_styles).
125		- 'disable_default_styles' => false,
	120	+ 'fieldSpacing' => 'medium',
	121	+ 'buttonAlignment' => 'justify',
126	122	];
127	123	}
128	124
129	125	/**
		@@ -191,52 +187,13 @@
191	187	$clean['borderRadius'] = self::sanitize_box( $decoded['borderRadius'] ?? [], $defaults['borderRadius'] );
192	188	$clean['fieldSpacing'] = in_array( $decoded['fieldSpacing'] ?? '', [ 'small', 'medium', 'large' ], true ) ? $decoded['fieldSpacing'] : 'medium';
193	189	$clean['buttonAlignment'] = in_array( $decoded['buttonAlignment'] ?? '', [ 'left', 'center', 'right', 'justify' ], true ) ? $decoded['buttonAlignment'] : 'justify';
194	190
195		- // Boolean flag, not a style value — must survive sanitization or an
196		- // editor save silently re-enables the default styling.
197		- $clean['disable_default_styles'] = ! empty( $decoded['disable_default_styles'] );
198		-
199	191	$encoded = wp_json_encode( $clean );
200	192	return is_string( $encoded ) ? $encoded : '';
201	193	}
202	194
203	195	/**
204		- * Check whether the form renders without SureDonation's default styling.
205		- *
206		- * When enabled the frontend stylesheet is not enqueued for the form and the
207		- * inline CSS-variable style attribute is omitted, so the site's own CSS
208		- * fully controls the form's appearance. The container is stamped with an
209		- * `sd-styling-none` marker class so custom CSS can target the state.
210		- *
211		- * @param int $form_id Form post ID.
212		- * @return bool True when default styling is disabled for the form.
213		- * @since 1.4.0
214		- */
215		- public static function is_default_styling_disabled( $form_id ) {
216		- $form_id = absint( $form_id );
217		- if ( ! $form_id ) {
218		- return false;
219		- }
220		-
221		- $settings = self::get_settings( $form_id );
222		- $disabled = ! empty( $settings['disable_default_styles'] );
223		-
224		- /**
225		- * Filters whether SureDonation's default frontend styling is disabled for a form.
226		- *
227		- * Lets themes/plugins toggle the unstyled mode programmatically, overriding
228		- * the stored per-form meta. Return true to render the form without the
229		- * SureDonation stylesheet and inline CSS variables.
230		- *
231		- * @param bool $disabled Whether default styling is disabled (from meta).
232		- * @param int $form_id Form post ID.
233		- * @since 1.4.0
234		- */
235		- return (bool) apply_filters( 'suredonation_disable_default_styles', $disabled, $form_id );
236		- }
237		-
238		- /**
239	196	* Build the inline CSS custom-property string for the form wrapper.
240	197	*
241	198	* Returns the CSS declarations only (no surrounding style attribute). The
242	199	* caller is expected to output the result via esc_attr() inside a style
		@@ -246,14 +203,8 @@
246	203	* @return string CSS declarations, or '' when nothing is customized.
247	204	* @since 1.0.0
248	205	*/
249	206	public static function get_style_attr( $form_id ) {
250		- // Unstyled mode: no inline CSS variables either — an inline style on the
251		- // container would override any site/custom CSS that themes the form.
252		- if ( self::is_default_styling_disabled( $form_id ) ) {
253		- return '';
254		- }
255		-
256	207	$settings = self::get_settings( $form_id );
257	208	$vars = [];
258	209
259	210	// Colors. Color-derived tints are emitted per-form so they track the
		@@ -324,42 +275,14 @@
324	275	$vars['--sd-btn-align-items'] = $align_map[ $settings['buttonAlignment'] ];
325	276	$vars['--sd-btn-width'] = 'auto';
326	277	}
327	278
328		- /**
329		- * Filter the form style CSS custom properties before they are serialized
330		- * onto the `.sd-form-container` wrapper.
331		- *
332		- * Add-ons (e.g. SureDonation Pro) use this to contribute additional
333		- * `--sd-*` variables. Runs before the empty-check so an add-on can style a
334		- * form even when the free panel set nothing. Values must be pre-sanitized
335		- * CSS tokens — they are emitted verbatim inside the inline style attribute.
336		- *
337		- * @param array<string, string> $vars Map of `--sd-*` variable => value.
338		- * @param int $form_id Form post ID.
339		- * @param array<string, mixed> $settings Merged free style settings.
340		- * @since 1.5.0
341		- */
342		- $vars = apply_filters( 'suredonation_form_style_vars', $vars, (int) $form_id, $settings );
343		-
344		- if ( ! is_array( $vars ) || empty( $vars ) ) {
	279	+ if ( empty( $vars ) ) {
345	280	return '';
346	281	}
347	282
348	283	$declarations = [];
349	284	foreach ( $vars as $name => $value ) {
350		- // Defense-in-depth for the public filter above: only emit custom
351		- // properties with scalar, declaration-safe values, so a
352		- // non-sanitizing add-on callback cannot append arbitrary
353		- // declarations or trigger array-to-string notices. Values are
354		- // additionally escaped by the caller via esc_attr().
355		- if (
356		- ! is_scalar( $value )
357		- || ! preg_match( '/^--[A-Za-z0-9_-]+$/', (string) $name )
358		- || preg_match( '/[;{}]/', (string) $value )
359		- ) {
360		- continue;
361		- }
362	285	$declarations[] = $name . ':' . $value;
363	286	}
364	287
365	288	return implode( ';', $declarations ) . ';';
		@@ -435,9 +358,9 @@
435	358	* @param array<string, mixed> $fallback Default box.
436	359	* @return array<string, mixed>
437	360	* @since 1.0.0
438	361	*/
439		- public static function sanitize_box( $box, $fallback ) {
	362	+ private static function sanitize_box( $box, $fallback ) {
440	363	if ( ! is_array( $box ) ) {
441	364	return $fallback;
442	365	}
443	366
		@@ -451,25 +374,21 @@
451	374
452	375	/**
453	376	* Validate a CSS length (e.g. "10px", "1.5rem"); bare numbers become px.
454	377	*
455		- * Negative values are rejected: every consumer here (padding, border
456		- * radius) is invalid with a negative length, which the browser would
457		- * silently drop.
458		- *
459	378	* @param mixed $value Incoming value.
460		- * @return string Valid length, or '' when invalid/empty/negative.
	379	+ * @return string Valid length, or '' when invalid/empty.
461	380	* @since 1.0.0
462	381	*/
463		- public static function sanitize_length( $value ) {
	382	+ private static function sanitize_length( $value ) {
464	383	if ( is_numeric( $value ) ) {
465		- return $value < 0 ? '' : ( 0 + $value ) . 'px';
	384	+ return ( 0 + $value ) . 'px';
466	385	}
467	386	$value = is_string( $value ) ? trim( $value ) : '';
468	387	if ( '' === $value ) {
469	388	return '';
470	389	}
471		- return preg_match( '/^\d*\.?\d+(px|em|rem|%|vw|vh)$/', $value ) ? $value : '';
	390	+ return preg_match( '/^-?\d*\.?\d+(px|em|rem|%|vw|vh)$/', $value ) ? $value : '';
472	391	}
473	392
474	393	/**
475	394	* Sanitize a color value via a strict allowlist.
		@@ -481,9 +400,9 @@
481	400	* @param mixed $value Incoming color.
482	401	* @return string Valid color, or '' when invalid/empty.
483	402	* @since 1.0.0
484	403	*/
485		- public static function sanitize_color( $value ) {
	404	+ private static function sanitize_color( $value ) {
486	405	$value = is_string( $value ) ? trim( $value ) : '';
487	406	if ( '' === $value ) {
488	407	return '';
489	408	}
		@@ -521,9 +440,9 @@
521	440	* @param mixed $value Incoming gradient.
522	441	* @return string Valid gradient, or '' when invalid/empty.
523	442	* @since 1.0.0
524	443	*/
525		- public static function sanitize_gradient( $value ) {
	444	+ private static function sanitize_gradient( $value ) {
526	445	$value = is_string( $value ) ? trim( $value ) : '';
527	446	if ( '' === $value ) {
528	447	return '';
529	448	}