| @@ -133,15 +133,8 @@ | ||
| 133 | 133 | if (strtoupper($method) === 'POST') { |
| 134 | 134 | $headers['Content-Type'] = 'application/json'; |
| 135 | 135 | } |
| 136 | 136 | |
| 137 | - // Resolve requested platform: $_REQUEST wins (frontend-supplied), then caller's extra_headers, then default. | |
| 138 | - if ( isset( $_REQUEST['requested_platform'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 139 | - $extra_headers['x-templately-requested-platform'] = sanitize_text_field( wp_unslash( $_REQUEST['requested_platform'] ) ); | |
| 140 | - } elseif ( ! isset( $extra_headers['x-templately-requested-platform'] ) ) { | |
| 141 | - $extra_headers['x-templately-requested-platform'] = 'templately'; | |
| 142 | - } | |
| 143 | - | |
| 144 | 137 | // Merge additional headers |
| 145 | 138 | $headers = array_merge($headers, $extra_headers); |
| 146 | 139 | |
| 147 | 140 | $args = [ |
| @@ -226,46 +219,8 @@ | ||
| 226 | 219 | break; |
| 227 | 220 | } |
| 228 | 221 | |
| 229 | 222 | return $sanitized_value; |
| 230 | - } | |
| 231 | - | |
| 232 | - /** | |
| 233 | - * Escape a string for safe embedding inside a GraphQL or JSON string literal. | |
| 234 | - * | |
| 235 | - * GraphQL string escaping rules are identical to JSON string escaping (per the | |
| 236 | - * GraphQL spec), so wp_json_encode() is the authoritative escaper. We strip the | |
| 237 | - * outer quotes it adds and return only the escaped inner content, ready to be | |
| 238 | - * wrapped in your own quote pair. | |
| 239 | - * | |
| 240 | - * Handles pre-encoded JSON: when the caller has already run json_encode() + | |
| 241 | - * wp_slash() on a value (e.g. categories, dependencies in Items.php), the | |
| 242 | - * quotes are already escaped as \" and the string is ready to embed. Calling | |
| 243 | - * wp_json_encode() again would double-escape those backslashes. We detect this | |
| 244 | - * case by checking whether wp_unslash() produces valid JSON, and if so, return | |
| 245 | - * the value directly without further encoding. | |
| 246 | - * | |
| 247 | - * @param string $value Raw string or wp_slash(json_encode()) output. | |
| 248 | - * @return string Escaped string, safe to place between double quotes in GraphQL/JSON. | |
| 249 | - */ | |
| 250 | - public static function esc_json_string( $value ) { | |
| 251 | - $value = (string) $value; | |
| 252 | - | |
| 253 | - // If wp_slash() was applied to a JSON string upstream, the quotes are | |
| 254 | - // already escaped (e.g. {\"key\":\"val\"}). Detect this by unslashing and | |
| 255 | - // checking for valid JSON — if it matches, the value is already suitable | |
| 256 | - // for embedding in a string literal; return it as-is to avoid doubling backslashes. | |
| 257 | - $unslashed = wp_unslash( $value ); | |
| 258 | - if ( $unslashed !== $value ) { | |
| 259 | - $decoded = json_decode( $unslashed, true ); | |
| 260 | - if ( json_last_error() === JSON_ERROR_NONE && null !== $decoded ) { | |
| 261 | - return $value; | |
| 262 | - } | |
| 263 | - } | |
| 264 | - | |
| 265 | - $encoded = wp_json_encode( $value ); | |
| 266 | - // wp_json_encode wraps the value in "...", strip those outer quotes. | |
| 267 | - return substr( $encoded, 1, -1 ); | |
| 268 | 223 | } |
| 269 | 224 | |
| 270 | 225 | /** |
| 271 | 226 | * Check for X-Templately-Verified header and update user verification status |
