← All changes | inc/fields/form-renderer.php +39 -2 1.1.2 → 1.6.1 View file →

		@@ -44,14 +44,30 @@
44	44	$form_id = (int) $form->ID;
45	45	$campaign_id = (int) $campaign_id;
46	46	$unique_form_id = 'suredonation-form-' . $form_id . '-' . wp_rand();
47	47	$form_style = Form_Styling::get_style_attr( $form_id );
	48	+ $custom_css = Form_Custom_CSS::get_style_block( $form_id );
48	49	$nonce_action = Helper::get_donation_nonce_action( $campaign_id );
49	50	$blocks = parse_blocks( $form->post_content );
50	51
	52	+ // Marker class when default styling is disabled, so custom CSS can
	53	+ // target the unstyled state (get_style_attr already returned '').
	54	+ $container_classes = 'sd-form-container';
	55	+ if ( Form_Styling::is_default_styling_disabled( $form_id ) ) {
	56	+ $container_classes .= ' sd-styling-none';
	57	+ }
	58	+
51	59	ob_start();
52	60	?>
53		- <div id="<?php echo esc_attr( $unique_form_id ); ?>" class="sd-form-container" data-form-id="<?php echo esc_attr( (string) $form_id ); ?>" data-campaign-id="<?php echo esc_attr( (string) $campaign_id ); ?>"<?php echo '' !== $form_style ? ' style="' . esc_attr( $form_style ) . '"' : ''; ?>>
	61	+ <div id="<?php echo esc_attr( $unique_form_id ); ?>" class="<?php echo esc_attr( $container_classes ); ?>" data-form-id="<?php echo esc_attr( (string) $form_id ); ?>" data-campaign-id="<?php echo esc_attr( (string) $campaign_id ); ?>"<?php echo '' !== $form_style ? ' style="' . esc_attr( $form_style ) . '"' : ''; ?>>
	62	+ <?php
	63	+ // Generated markup whose CSS is already sanitized by
	64	+ // Form_Custom_CSS::sanitize(). It must not go through
	65	+ // Helper::get_allowed_form_html() like the block output below: that
	66	+ // allowlist permits `style` attributes but not the `style` tag, so kses
	67	+ // would strip the whole block.
	68	+ echo $custom_css; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	69	+ ?>
54	70	<form class="sd-form" method="post">
55	71	<?php wp_nonce_field( $nonce_action, 'suredonation_nonce' ); ?>
56	72	<input type="hidden" name="form_id" value="<?php echo esc_attr( (string) $form_id ); ?>">
57	73	<input type="hidden" name="campaign_id" value="<?php echo esc_attr( (string) $campaign_id ); ?>">
		@@ -61,14 +77,35 @@
61	77	<input type="hidden" name="action" value="suredonation_submit_donation">
62	78	<?php Helper::render_honeypot_field(); ?>
63	79
64	80	<?php
	81	+ // Privacy fields (consent / privacy policy / terms) enabled in the
	82	+ // Privacy settings are injected as the last thing before the submit
	83	+ // button so the donor sees them right before submitting. Anchor on the
	84	+ // donate button; if a form has none, fall back to the payment block, and
	85	+ // finally to the end of the form. The anchor may be nested inside a
	86	+ // layout block (Group/Columns), so match the top-level block that either
	87	+ // is, or contains, the anchor.
	88	+ $privacy_fields = \SureDonation\Inc\Privacy\Privacy_Frontend::render_form_fields();
	89	+ $privacy_anchor = Helper::block_tree_contains( $blocks, 'suredonation/donate-button' ) ? 'suredonation/donate-button' : 'suredonation/payment';
	90	+ $privacy_injected = false;
65	91	foreach ( $blocks as $block ) {
66	92	if ( empty( $block['blockName'] ) ) {
67	93	continue;
68	94	}
	95	+ $is_anchor = $block['blockName'] === $privacy_anchor
	96	+ || ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) && Helper::block_tree_contains( $block['innerBlocks'], $privacy_anchor ) );
	97	+ if ( ! $privacy_injected && '' !== $privacy_fields && $is_anchor ) {
	98	+ echo wp_kses( $privacy_fields, Helper::get_allowed_form_html() );
	99	+ $privacy_injected = true;
	100	+ }
69	101	$block['attrs']['formId'] = $form_id;
70		- echo wp_kses( render_block( $block ), Helper::get_allowed_form_html() );
	102	+ // Allow the data: protocol so a lazy-load optimizer's inline SVG
	103	+ // placeholder (Image block) survives this second kses pass.
	104	+ echo wp_kses( render_block( $block ), Helper::get_allowed_form_html(), array_merge( wp_allowed_protocols(), [ 'data' ] ) );
	105	+ }
	106	+ if ( ! $privacy_injected && '' !== $privacy_fields ) {
	107	+ echo wp_kses( $privacy_fields, Helper::get_allowed_form_html() );
71	108	}
72	109	?>
73	110	</form>
74	111	<!-- Success Message Container -->