| 1 |
<?php |
| 2 |
|
| 3 |
namespace RexTheme\WPVR\Content; |
| 4 |
|
| 5 |
/** |
| 6 |
* Sanitize overlay rich text without stripping the editor's video embeds. |
| 7 |
*/ |
| 8 |
class TextOverlayContent { |
| 9 |
|
| 10 |
public static function sanitize( string $html ): string { |
| 11 |
$allowed_html = wp_kses_allowed_html( 'post' ); |
| 12 |
|
| 13 |
// YouTube, Vimeo and other iframe players inserted through Media or HTML. |
| 14 |
// Keep srcdoc and inline event handlers excluded. |
| 15 |
$allowed_html['iframe'] = [ |
| 16 |
'src' => true, |
| 17 |
'width' => true, |
| 18 |
'height' => true, |
| 19 |
'title' => true, |
| 20 |
'class' => true, |
| 21 |
'style' => true, |
| 22 |
'frameborder' => true, |
| 23 |
'allow' => true, |
| 24 |
'allowfullscreen' => true, |
| 25 |
'webkitallowfullscreen' => true, |
| 26 |
'mozallowfullscreen' => true, |
| 27 |
'referrerpolicy' => true, |
| 28 |
'loading' => true, |
| 29 |
'sandbox' => true, |
| 30 |
]; |
| 31 |
|
| 32 |
// TinyMCE uses child sources for direct video URLs and alternative formats. |
| 33 |
$allowed_html['source'] = [ |
| 34 |
'src' => true, |
| 35 |
'type' => true, |
| 36 |
'media' => true, |
| 37 |
]; |
| 38 |
// Native video/audio tags, playback attributes and caption tracks use |
| 39 |
// the standard post allowlist above. |
| 40 |
return wp_kses( $html, $allowed_html ); |
| 41 |
} |
| 42 |
} |
| 43 |
|
