← All changes | taboola_widget.php +22 -65 3.1.0 → 3.0.2 View file →

		@@ -2,13 +2,13 @@
2	2	/**
3	3	* Plugin Name: Taboola
4	4	* Plugin URI: https://developers.taboola.com/web-integrations/docs/wordpress-plugin
5	5	* Description: Taboola
6		- * Version: 3.1.0
	6	+ * Version: 3.0.2
7	7	* Author: Taboola
8	8	*/
9	9
10		-define( 'TABOOLA_PLUGIN_VERSION', '3.1.0' ); // track every release
	10	+define( 'TABOOLA_PLUGIN_VERSION', '3.0.2' ); // track every release
11	11	define( 'TABOOLA_MIN_VER', '3.0' ); // bump only when DB changes
12	12	define( 'TABOOLA_DEBUG_MODE', false );
13	13
14	14	define( 'TABOOLA_OPTION_NAME', 'taboola_plugin_version' );
		@@ -503,31 +503,8 @@
503	503	implode( "\n", $arr[TABOOLA_CONTENT_FORMAT_SCRIPT] ?? [] ) .
504	504	'</script>',
505	505	]);
506	506	}
507		- /* ------------------------------------------------------------------
508		- * wpautop() hardening for anything injected through the_content.
509		- *
510		- * wpautop() pads block-level tags with blank lines, then splits the
511		- * content on blank lines and wraps each chunk in <p>. Its <script>
512		- * protection only runs after that split, so two things tear an injected
513		- * <script> apart and spill its tail onto the page as reader-visible text:
514		- * 1. a blank line anywhere in the script body, and
515		- * 2. a block-level tag (e.g. <div>) sitting inside a JS string literal.
516		- * Both have to be neutralised; fixing only one still breaks.
517		- * ------------------------------------------------------------------*/
518		-
519		- // Hide markup from wpautop's block-tag scan. \x3C decodes back to "<"
520		- // when the surrounding JS string literal is evaluated.
521		- private function js_escape_markup($markup){
522		- return str_replace('<', '\x3C', (string) $markup);
523		- }
524		-
525		- // Collapse blank lines so wpautop has no paragraph boundary to split on.
526		- private function wpautop_safe_script($script){
527		- return preg_replace('/(\R[ \t]*){2,}/', "\n", (string) $script);
528		- }
529		-
530	507	// Below-article widget
531	508	// Do the actual logic of choosing where to place the taboola content.
532	509	function embed_taboola_content_location($content, $taboola_content){
533	510	$do_default = true;
		@@ -535,13 +512,13 @@
535	512	// tag is placed outside of content in order to allow "read more" functionality.
536	513	if ($this->settings->out_of_content_enabled){
537	514
538	515	$scriptWrapper = new JavaScriptWrapper("js_inject.min.js",array(
539		- "{{HTML}}" => $this->js_escape_markup($this->format_taboola_content($taboola_content,TABOOLA_CONTENT_FORMAT_HTML)),
540		- "{{SCRIPT}}" => $this->js_escape_markup($this->format_taboola_content($taboola_content,TABOOLA_CONTENT_FORMAT_SCRIPT)))
	516	+ "{{HTML}}" => $this->format_taboola_content($taboola_content,TABOOLA_CONTENT_FORMAT_HTML),
	517	+ "{{SCRIPT}}" => $this->format_taboola_content($taboola_content,TABOOLA_CONTENT_FORMAT_SCRIPT))
541	518	);
542	519	$scriptWrapper->appendScript("injectWidgetByMarker('tbmarker');");
543		- $content = $content."<span id='tbmarker'></span><script type='text/javascript'>".$this->wpautop_safe_script($scriptWrapper)."</script>";
	520	+ $content = $content."<span id='tbmarker'></span><script type='text/javascript'>".$scriptWrapper."</script>";
544	521	$do_default = false;
545	522	}
546	523
547	524	// Default for below-article widget - add to the end of the content
		@@ -567,13 +544,13 @@
567	544	if ($full_indicator == TABOOLA_JS_INDICATOR){
568	545
569	546	$xpath = substr($location,strlen(TABOOLA_JS_INDICATOR));
570	547	$scriptWrapper = new JavaScriptWrapper("js_inject.min.js",array(
571		- "{{HTML}}" => $this->js_escape_markup($this->format_taboola_content_mid($taboola_content_mid,TABOOLA_CONTENT_FORMAT_HTML)),
572		- "{{SCRIPT}}" => $this->js_escape_markup($this->format_taboola_content_mid($taboola_content_mid,TABOOLA_CONTENT_FORMAT_SCRIPT)))
	548	+ "{{HTML}}" => $this->format_taboola_content_mid($taboola_content_mid,TABOOLA_CONTENT_FORMAT_HTML),
	549	+ "{{SCRIPT}}" => $this->format_taboola_content_mid($taboola_content_mid,TABOOLA_CONTENT_FORMAT_SCRIPT))
573	550	);
574	551	$scriptWrapper->appendScript("injectWidgetByXpath('".$xpath."');");
575		- $content = $content."<span id='tbdefault'></span><script type='text/javascript'>".$this->wpautop_safe_script($scriptWrapper)."</script>";
	552	+ $content = $content."<span id='tbdefault'></span><script type='text/javascript'>".$scriptWrapper."</script>";
576	553
577	554	$do_default = false;
578	555	}
579	556
		@@ -631,13 +608,13 @@
631	608	if ($full_indicator == TABOOLA_JS_INDICATOR){
632	609
633	610	$xpath = substr($location,strlen(TABOOLA_JS_INDICATOR));
634	611	$scriptWrapper = new JavaScriptWrapper("js_inject.min.js",array(
635		- "{{HTML}}" => $this->js_escape_markup($this->format_taboola_content_home($taboola_content_home,TABOOLA_CONTENT_FORMAT_HTML)),
636		- "{{SCRIPT}}" => $this->js_escape_markup($this->format_taboola_content_home($taboola_content_home,TABOOLA_CONTENT_FORMAT_SCRIPT)))
	612	+ "{{HTML}}" => $this->format_taboola_content_home($taboola_content_home,TABOOLA_CONTENT_FORMAT_HTML),
	613	+ "{{SCRIPT}}" => $this->format_taboola_content_home($taboola_content_home,TABOOLA_CONTENT_FORMAT_SCRIPT))
637	614	);
638	615	$scriptWrapper->appendScript("injectWidgetByXpath('".$xpath."');");
639		- $content = $content."<span id='tbdefault'></span><script type='text/javascript'>".$this->wpautop_safe_script($scriptWrapper)."</script>";
	616	+ $content = $content."<span id='tbdefault'></span><script type='text/javascript'>".$scriptWrapper."</script>";
640	617
641	618	$do_default = false;
642	619	}
643	620
		@@ -674,19 +651,12 @@
674	651	global $current_user;
675	652	add_menu_page(__('Taboola','taboola_widget'), __('Taboola','taboola_widget'), 'manage_options', 'taboola_widget', array(&$this, 'admin_taboola_settings'), $this->plugin_url.'img/taboola_icon.png', 110);
676	653	}
677	654
678		- // Empty numeric inputs must reach MySQL as NULL, not '', or strict mode
679		- // rejects the whole row.
680		- private function nullable_int($value){
681		- return (isset($value) && trim((string) $value) !== '') ? (int) $value : null;
682		- }
683		-
684	655	function admin_taboola_settings(){
685	656	global $wpdb;
686	657	$settings = $wpdb->get_row("select * from ".$wpdb->prefix."_taboola_settings limit 1");
687	658	$taboola_errors = array();
688		- $taboola_save_error = '';
689	659	if($_SERVER['REQUEST_METHOD'] == 'POST'){
690	660
691	661	if(trim(strip_tags($_POST['publisher_id'])) == ''){
692	662	$taboola_errors[] = "Publisher ID";
		@@ -768,38 +738,33 @@
768	738	}
769	739	}
770	740	$mid_widgets_json = json_encode($mid_widgets_data);
771	741
772		- /* $wpdb formats every value as %s unless told otherwise, so a PHP
773		- false or an empty string reaches MySQL as ''. Under
774		- STRICT_TRANS_TABLES (the MySQL 8 default) '' is rejected for the
775		- TINYINT/INT columns and the whole write is refused. Send real
776		- integers for the flags and NULL for empty numeric fields. */
777	742	$data = array(
778	743	"publisher_id" => trim($_POST['publisher_id']),
779	744
780		- "web_push_enabled" => isset($_POST['web_push_enabled']) ? 1 : 0,
781		- "publisher_id_push" => $this->nullable_int($_POST['publisher_id_push'] ?? null),
	745	+ "web_push_enabled" => isset($_POST['web_push_enabled']) ? true : false,
	746	+ "publisher_id_push" => !empty($_POST['publisher_id_push']) ? trim($_POST['publisher_id_push']) : '',
782	747
783		- "first_bc_enabled" => isset($_POST['first_bc_enabled']) ? 1 : 0,
	748	+ "first_bc_enabled" => isset($_POST['first_bc_enabled']) ? true : false,
784	749	"first_bc_widget_id" => !empty($_POST['first_bc_widget_id']) ? trim($_POST['first_bc_widget_id']) : '',
785	750	"first_bc_placement" => !empty($_POST['first_bc_placement']) ? trim($_POST['first_bc_placement']) : '',
786	751
787		- "out_of_content_enabled" => isset($_POST['out_of_content_enabled']) ? 1 : 0,
	752	+ "out_of_content_enabled" => isset($_POST['out_of_content_enabled']) ? true : false,
788	753
789		- "mid_enabled" => isset($_POST['mid_enabled']) ? 1 : 0,
	754	+ "mid_enabled" => isset($_POST['mid_enabled']) ? true : false,
790	755	"mid_widgets" => $mid_widgets_json,
791	756
792		- "home_enabled" => isset($_POST['home_enabled']) ? 1 : 0,
	757	+ "home_enabled" => isset($_POST['home_enabled']) ? true : false,
793	758	"home_widget_id" => !empty($_POST['home_widget_id']) ? trim($_POST['home_widget_id']) : '',
794	759	"home_placement" => !empty($_POST['home_placement']) ? trim($_POST['home_placement']) : '',
795	760
796		- "home_location_string_occurrence" => $this->nullable_int($_POST['home_location_string_occurrence'] ?? null),
	761	+ "home_location_string_occurrence" => !empty($_POST['home_location_string_occurrence']) ? $_POST['home_location_string_occurrence'] : '',
797	762	"home_location_string" => !empty($_POST['home_location_string']) ? trim($_POST['home_location_string']) : '',
798		- "category_enabled" => isset($_POST['category_enabled']) ? 1 : 0,
	763	+ "category_enabled" => isset($_POST['category_enabled']) ? true : false,
799	764	"category_widget_id" => !empty($_POST['category_widget_id']) ? trim($_POST['category_widget_id']) : '',
800	765	"category_placement" => !empty($_POST['category_placement']) ? trim($_POST['category_placement']) : '',
801		- "category_location_string_occurrence" => $this->nullable_int($_POST['category_location_string_occurrence'] ?? null),
	766	+ "category_location_string_occurrence" => !empty($_POST['category_location_string_occurrence']) ? $_POST['category_location_string_occurrence'] : '',
802	767	"category_location_string" => !empty($_POST['category_location_string']) ? trim($_POST['category_location_string']) : '',
803	768
804	769	);
805	770
		@@ -810,20 +775,12 @@
810	775	}
811	776
812	777	if ($is_valid_nonce) {
813	778	if($settings == NULL){
814		- $saved = $wpdb->insert($this->tbl_taboola_settings, $data);
	779	+ $wpdb->insert($this->tbl_taboola_settings, $data);
815	780	} else {
816		- $saved = $wpdb->update($this->tbl_taboola_settings, $data, array('id' => $settings->id));
	781	+ $wpdb->update($this->tbl_taboola_settings, $data, array('id' => $settings->id));
817	782	}
818		-
819		- // update() returns 0 when nothing changed; only false is a failure.
820		- if ($saved === false) {
821		- $taboola_save_error = "The database rejected the write, so your changes were not saved: "
822		- . ($wpdb->last_error !== '' ? $wpdb->last_error : 'unknown database error');
823		- }
824		- } else {
825		- $taboola_save_error = "Security check failed - the settings page had been open too long. Reload it and apply your changes again.";
826	783	}
827	784	}
828	785	$settings = $wpdb->get_row("select * from ".$wpdb->prefix."_taboola_settings limit 1");
829	786	}