$attributes Block attributes.
* @param string $content Block content.
* @return string
* @since 1.1.1
*/
public function render( $attributes, $content = '' ) {
unset( $content ); // Unused parameter.
if ( empty( $attributes ) ) {
return '';
}
$html_content = isset( $attributes['htmlContent'] ) ? Helper::get_string_value( $attributes['htmlContent'] ) : '';
if ( '' === trim( $html_content ) ) {
return '';
}
$wrapper_classes = self::get_display_block_classes( $attributes, 'sd-html-block' );
// Expand shortcodes only when the form's author is allowed to run them
// (unfiltered_html). The capability is checked on the form author, not the
// current viewer: render happens on the public, usually logged-out front
// end, so the trust boundary is who authored the content. Editing a form
// only needs edit_posts (Author level), so an untrusted author must not be
// able to have arbitrary shortcodes execute on the published form.
$form_id = isset( $attributes['formId'] ) ? absint( $attributes['formId'] ) : 0;
$allow_shortcodes = $form_id > 0 && author_can( $form_id, 'unfiltered_html' );
$processed = $allow_shortcodes ? do_shortcode( $html_content ) : $html_content;
ob_start();
?>
and other form controls,
// whether author-typed or shortcode-emitted — so the donation form
// never ends up with a nested form.
echo wp_kses_post( $processed );
?>