← All changes | library/shortcode-access.php +70 -19 20260110 → 20260916 View file →

		@@ -1,19 +1,19 @@
1	1	<?php // User Submitted Posts - Access Control
2	2
3	3	/*
4		- Shortcode: require login based on capability
	4	+ Shortcode: display content based on user capability
5	5	Syntax: [usp_access cap="read" deny=""][/usp_access]
6	6	Can use {tag} to output <tag>
7		- See @ https://codex.wordpress.org/Roles_and_Capabilities#Capabilities
	7	+ https://wordpress.org/documentation/article/roles-and-capabilities/
8	8	*/
	9	+
9	10	if (!function_exists('usp_access')) :
	11	+
10	12	function usp_access($attr, $content = null) {
11		- extract(shortcode_atts(array(
12		- 'cap' => 'read',
13		- 'deny' => '',
14		- ), $attr));
15	13
	14	+ extract(shortcode_atts(array('cap' => 'read', 'deny' => ''), $attr));
	15	+
16	16	// deny message
17	17
18	18	$deny = htmlspecialchars($deny, ENT_QUOTES);
19	19
		@@ -19,9 +19,9 @@
19	19
20	20	$deny = str_replace("{", "<", $deny);
21	21	$deny = str_replace("}", ">", $deny);
22	22
23		- $deny = preg_replace('#<script(.*)>(.*)</script>#is', '', $deny);
	23	+ $deny = wp_kses_post($deny);
24	24
25	25	// content
26	26
27	27	$content = htmlspecialchars($content, ENT_QUOTES);
		@@ -28,9 +28,9 @@
28	28
29	29	$content = str_replace("{", "<", $content);
30	30	$content = str_replace("}", ">", $content);
31	31
32		- $content = preg_replace('#<script(.*)>(.*)</script>#is', '', $content);
	32	+ $content = wp_kses_post($content);
33	33
34	34	//
35	35
36	36	$caps = array_map('trim', explode(',', $cap));
		@@ -35,66 +35,107 @@
35	35
36	36	$caps = array_map('trim', explode(',', $cap));
37	37
38	38	foreach ($caps as $c) {
	39	+
39	40	if (current_user_can($c) && !is_null($content) && !is_feed()) return do_shortcode($content);
	41	+
40	42	}
41	43
42	44	return $deny;
	45	+
43	46	}
	47	+
44	48	add_shortcode('usp_access', 'usp_access');
	49	+
45	50	endif;
46	51
47	52
48	53
49	54	/*
50		- Shortcode: show content to visitors
	55	+ Shortcode: display content to visitors (not logged in)
51	56	Syntax: [usp_visitor deny=""][/usp_visitor]
52	57	Can use {tag} to output <tag>
53	58	*/
	59	+
54	60	if (!function_exists('usp_visitor')) :
	61	+
55	62	function usp_visitor($attr, $content = null) {
56		- extract(shortcode_atts(array(
57		- 'deny' => '',
58		- ), $attr));
59	63
	64	+ extract(shortcode_atts(array('deny' => ''), $attr));
	65	+
	66	+ // deny message
	67	+
	68	+ $deny = htmlspecialchars($deny, ENT_QUOTES);
	69	+
60	70	$deny = str_replace("{", "<", $deny);
61	71	$deny = str_replace("}", ">", $deny);
62	72
63		- $deny = htmlspecialchars($deny, ENT_QUOTES);
	73	+ $deny = wp_kses_post($deny);
	74	+
	75	+ // content
	76	+
64	77	$content = htmlspecialchars($content, ENT_QUOTES);
65	78
	79	+ $content = str_replace("{", "<", $content);
	80	+ $content = str_replace("}", ">", $content);
	81	+
	82	+ $content = wp_kses_post($content);
	83	+
	84	+ //
	85	+
66	86	if ((!is_user_logged_in() && !is_null($content)) || is_feed()) return do_shortcode($content);
67	87
68	88	return $deny;
	89	+
69	90	}
	91	+
70	92	add_shortcode('usp_visitor', 'usp_visitor');
	93	+
71	94	endif;
72	95
73	96
74	97
75	98	/*
76		- Shortcode: show content to members
	99	+ Shortcode: display content to members (logged in)
77	100	Syntax: [usp_member deny=""][/usp_member]
78	101	Can use {tag} to output <tag>
79	102	*/
	103	+
80	104	if (!function_exists('usp_member')) :
	105	+
81	106	function usp_member($attr, $content = null) {
82		- extract(shortcode_atts(array(
83		- 'deny' => '',
84		- ), $attr));
85	107
	108	+ extract(shortcode_atts(array('deny' => ''), $attr));
	109	+
	110	+ // deny message
	111	+
	112	+ $deny = htmlspecialchars($deny, ENT_QUOTES);
	113	+
86	114	$deny = str_replace("{", "<", $deny);
87	115	$deny = str_replace("}", ">", $deny);
88	116
89		- $deny = htmlspecialchars($deny, ENT_QUOTES);
	117	+ $deny = wp_kses_post($deny);
	118	+
	119	+ // content
	120	+
90	121	$content = htmlspecialchars($content, ENT_QUOTES);
91	122
	123	+ $content = str_replace("{", "<", $content);
	124	+ $content = str_replace("}", ">", $content);
	125	+
	126	+ $content = wp_kses_post($content);
	127	+
	128	+ //
	129	+
92	130	if (is_user_logged_in() && !is_null($content) && !is_feed()) return do_shortcode($content);
93	131
94	132	return $deny;
	133	+
95	134	}
	135	+
96	136	add_shortcode('usp_member', 'usp_member');
	137	+
97	138	endif;
98	139
99	140
100	141
		@@ -100,17 +141,27 @@
100	141
101	142	/*
102	143	Shortcode Empty Paragraph Fix
103	144	*/
	145	+
104	146	if (!function_exists('usp_shortcode_empty_p_fix')) :
	147	+
105	148	function usp_shortcode_empty_p_fix($content) {
	149	+
106	150	$array = array(
	151	+
107	152	'<p>[' => '[',
108	153	']</p>' => ']',
109	154	']<br />' => ']',
110	155	']<br>' => ']'
	156	+
111	157	);
	158	+
112	159	$content = strtr($content, $array);
	160	+
113	161	return $content;
	162	+
114	163	}
	164	+
115	165	add_filter('the_content', 'usp_shortcode_empty_p_fix');
116		-endif;
	166	+
	167	+endif;