| 1 |
<?php |
| 2 |
/** |
| 3 |
* PHP render for HTML Block. |
| 4 |
* |
| 5 |
* A content block that outputs author-supplied custom markup within the donation |
| 6 |
* form. It carries no submission value and does not participate in field |
| 7 |
* validation. The markup is sanitized with wp_kses_post() on output, which also |
| 8 |
* strips form controls (form/input/button/select/textarea) so the block cannot |
| 9 |
* nest a form inside the donation form. Shortcodes are expanded only when the |
| 10 |
* form's author has the unfiltered_html capability; otherwise the raw markup is |
| 11 |
* rendered without shortcode execution. |
| 12 |
* |
| 13 |
* @package SureDonation |
| 14 |
* @since 1.1.1 |
| 15 |
*/ |
| 16 |
|
| 17 |
namespace SureDonation\Inc\Blocks\Html; |
| 18 |
|
| 19 |
use SureDonation\Inc\Blocks\Base; |
| 20 |
use SureDonation\Inc\Helper; |
| 21 |
|
| 22 |
if ( ! defined( 'ABSPATH' ) ) { |
| 23 |
exit; // Exit if accessed directly. |
| 24 |
} |
| 25 |
|
| 26 |
/** |
| 27 |
* HTML Block. |
| 28 |
* |
| 29 |
* @since 1.1.1 |
| 30 |
*/ |
| 31 |
class Block extends Base { |
| 32 |
/** |
| 33 |
* Render the block. |
| 34 |
* |
| 35 |
* @param array<string, mixed> $attributes Block attributes. |
| 36 |
* @param string $content Block content. |
| 37 |
* @return string |
| 38 |
* @since 1.1.1 |
| 39 |
*/ |
| 40 |
public function render( $attributes, $content = '' ) { |
| 41 |
unset( $content ); // Unused parameter. |
| 42 |
|
| 43 |
if ( empty( $attributes ) ) { |
| 44 |
return ''; |
| 45 |
} |
| 46 |
|
| 47 |
$html_content = isset( $attributes['htmlContent'] ) ? Helper::get_string_value( $attributes['htmlContent'] ) : ''; |
| 48 |
if ( '' === trim( $html_content ) ) { |
| 49 |
return ''; |
| 50 |
} |
| 51 |
|
| 52 |
$wrapper_classes = self::get_display_block_classes( $attributes, 'sd-html-block' ); |
| 53 |
|
| 54 |
// Expand shortcodes only when the form's author is allowed to run them |
| 55 |
// (unfiltered_html). The capability is checked on the form author, not the |
| 56 |
// current viewer: render happens on the public, usually logged-out front |
| 57 |
// end, so the trust boundary is who authored the content. Editing a form |
| 58 |
// only needs edit_posts (Author level), so an untrusted author must not be |
| 59 |
// able to have arbitrary shortcodes execute on the published form. |
| 60 |
$form_id = isset( $attributes['formId'] ) ? absint( $attributes['formId'] ) : 0; |
| 61 |
$allow_shortcodes = $form_id > 0 && author_can( $form_id, 'unfiltered_html' ); |
| 62 |
$processed = $allow_shortcodes ? do_shortcode( $html_content ) : $html_content; |
| 63 |
|
| 64 |
ob_start(); |
| 65 |
?> |
| 66 |
<div class="<?php echo esc_attr( $wrapper_classes ); ?>"> |
| 67 |
<?php |
| 68 |
// wp_kses_post() is the final pass on every render path: it strips |
| 69 |
// disallowed elements — including <form> and other form controls, |
| 70 |
// whether author-typed or shortcode-emitted — so the donation form |
| 71 |
// never ends up with a nested form. |
| 72 |
echo wp_kses_post( $processed ); |
| 73 |
?> |
| 74 |
</div> |
| 75 |
<?php |
| 76 |
$output = ob_get_clean(); |
| 77 |
return false !== $output ? $output : ''; |
| 78 |
} |
| 79 |
} |
| 80 |
|
