← All changes | legacy/admin/js/wpvr-admin.js +46 -9 9.0.2 → 9.2.0 View file →

		@@ -364,9 +364,13 @@
364	364	val["clickHandlerArgs"].replace(/<[^>]*>/g, '').trim() !== ''
365	365	) {
366	366	val["clickHandlerFunc"] = wpvrhotspot;
367	367	}
368		- if (
	368	+ if (val.hotspot_type === 'sticker' || val.stickerTemplate) {
	369	+ val["createTooltipFunc"] = function (div) {
	370	+ window.wpvrRenderStickerHotspot(div, val);
	371	+ };
	372	+ } else if (
369	373	val["createTooltipArgs"] &&
370	374	val["createTooltipArgs"].replace(/<[^>]*>/g, '').trim() !== ''
371	375	) {
372	376	val["createTooltipFunc"] = wpvrtooltip;
		@@ -910,16 +914,49 @@
910	914	}
911	915	});
912	916	});
913	917
	918	+ function wpvrSanitizeHtml(rawHtml) {
	919	+ if (!rawHtml || typeof rawHtml !== 'string') return '';
	920	+ var clean = rawHtml.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
	921	+ try {
	922	+ var parser = new DOMParser();
	923	+ var doc = parser.parseFromString(clean, 'text/html');
	924	+ var elements = doc.body.querySelectorAll('*');
	925	+ for (var i = 0; i < elements.length; i++) {
	926	+ var el = elements[i];
	927	+ var tag = el.tagName.toLowerCase();
	928	+ if (['script', 'object', 'embed', 'applet', 'link', 'meta', 'base'].indexOf(tag) !== -1) {
	929	+ el.parentNode && el.parentNode.removeChild(el);
	930	+ continue;
	931	+ }
	932	+ var attrs = el.attributes;
	933	+ for (var a = attrs.length - 1; a >= 0; a--) {
	934	+ var attrName = attrs[a].name.toLowerCase();
	935	+ var attrVal = attrs[a].value;
	936	+ if (attrName.indexOf('on') === 0) {
	937	+ el.removeAttribute(attrs[a].name);
	938	+ } else if (['href', 'src', 'action', 'formaction', 'xlink:href'].indexOf(attrName) !== -1) {
	939	+ if (/^\s*(javascript|vbscript|data:text\/html):/i.test(attrVal)) {
	940	+ el.removeAttribute(attrs[a].name);
	941	+ }
	942	+ }
	943	+ }
	944	+ }
	945	+ return doc.body.innerHTML;
	946	+ } catch (e) {
	947	+ return clean.replace(/\s*on\w+\s*=\s*["'][^"']*["']/gi, '').replace(/\s*on\w+\s*=\s*[^\s>]+/gi, '');
	948	+ }
	949	+ }
	950	+
914	951	function wpvrhotspot(hotSpotDiv, args) {
915	952	if (args) {
916		- const hasTextContent = args.replace(/<[^>]*>/g, '').trim() !== '';
917		- const hasMediaContent = /<(img|video|audio|iframe|embed|object)\b[^>]*>/i.test(args);
918		- const hasOtherContent = args.replace(/<(p|br|div|span)\b[^>]*\/?>/gi, '').trim() !== '';
	953	+ const hasTextContent = typeof args === 'string' && args.replace(/<[^>]*>/g, '').trim() !== '';
	954	+ const hasMediaContent = typeof args === 'string' && /<(img|video|audio|iframe|embed|object)\b[^>]*>/i.test(args);
	955	+ const hasOtherContent = typeof args === 'string' && args.replace(/<(p|br|div|span)\b[^>]*\/?>/gi, '').trim() !== '';
919	956
920	957	if (hasTextContent || hasMediaContent || hasOtherContent) {
921		- const cleanArgs = args.replace(/\\/g, '');
	958	+ const cleanArgs = wpvrSanitizeHtml(args.replace(/\\/g, ''));
922	959	$("#custom-ifram").html(cleanArgs);
923	960	$("#custom-ifram").fadeToggle();
924	961	$(".iframe-wrapper").toggleClass("show-modal");
925	962	}
		@@ -927,14 +964,14 @@
927	964	}
928	965
929	966	function wpvrtooltip(hotSpotDiv, args) {
930	967	if (args) {
931		- const hasTextContent = args.replace(/<[^>]*>/g, '').trim() !== '';
932		- const hasMediaContent = /<(img|video|audio|iframe|embed|object)\b[^>]*>/i.test(args);
933		- const hasOtherContent = args.replace(/<(p|br|div|span)\b[^>]*\/?>/gi, '').trim() !== '';
	968	+ const hasTextContent = typeof args === 'string' && args.replace(/<[^>]*>/g, '').trim() !== '';
	969	+ const hasMediaContent = typeof args === 'string' && /<(img|video|audio|iframe|embed|object)\b[^>]*>/i.test(args);
	970	+ const hasOtherContent = typeof args === 'string' && args.replace(/<(p|br|div|span)\b[^>]*\/?>/gi, '').trim() !== '';
934	971
935	972	if (hasTextContent || hasMediaContent || hasOtherContent) {
936		- const cleanArgs = args.replace(/\\/g, '');
	973	+ const cleanArgs = wpvrSanitizeHtml(args.replace(/\\/g, ''));
937	974	hotSpotDiv.classList.add('custom-tooltip');
938	975
939	976	const span = document.createElement('p');
940	977	span.innerHTML = cleanArgs;