| @@ -44,8 +44,9 @@ | ||
| 44 | 44 | $form_id = (int) $form->ID; |
| 45 | 45 | $campaign_id = (int) $campaign_id; |
| 46 | 46 | $unique_form_id = 'suredonation-form-' . $form_id . '-' . wp_rand(); |
| 47 | 47 | $form_style = Form_Styling::get_style_attr( $form_id ); |
| 48 | + $custom_css = Form_Custom_CSS::get_style_block( $form_id ); | |
| 48 | 49 | $nonce_action = Helper::get_donation_nonce_action( $campaign_id ); |
| 49 | 50 | $blocks = parse_blocks( $form->post_content ); |
| 50 | 51 | |
| 51 | 52 | // Marker class when default styling is disabled, so custom CSS can |
| @@ -57,8 +58,16 @@ | ||
| 57 | 58 | |
| 58 | 59 | ob_start(); |
| 59 | 60 | ?> |
| 60 | 61 | <div id="<?php echo esc_attr( $unique_form_id ); ?>" class="<?php echo esc_attr( $container_classes ); ?>" data-form-id="<?php echo esc_attr( (string) $form_id ); ?>" data-campaign-id="<?php echo esc_attr( (string) $campaign_id ); ?>"<?php echo '' !== $form_style ? ' style="' . esc_attr( $form_style ) . '"' : ''; ?>> |
| 62 | + <?php | |
| 63 | + // Generated markup whose CSS is already sanitized by | |
| 64 | + // Form_Custom_CSS::sanitize(). It must not go through | |
| 65 | + // Helper::get_allowed_form_html() like the block output below: that | |
| 66 | + // allowlist permits `style` attributes but not the `style` tag, so kses | |
| 67 | + // would strip the whole block. | |
| 68 | + echo $custom_css; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 69 | + ?> | |
| 61 | 70 | <form class="sd-form" method="post"> |
| 62 | 71 | <?php wp_nonce_field( $nonce_action, 'suredonation_nonce' ); ?> |
| 63 | 72 | <input type="hidden" name="form_id" value="<?php echo esc_attr( (string) $form_id ); ?>"> |
| 64 | 73 | <input type="hidden" name="campaign_id" value="<?php echo esc_attr( (string) $campaign_id ); ?>"> |
