WordPress.org
Get WordPress

Plugin Directory

Changeset 3285202


Ignore:
Timestamp:
04/30/2025 06:43:23 PM (11 months ago)
Author:
urkekg
Message:

bugfix release

Location:
head-footer-code
Files:
31 added
4 edited

Legend:

Unmodified
Added
Removed

  • head-footer-code/trunk/classes/techwebux/hfc/class-common.php

    r3277444 r3285202  
    245245
    246246    /**
     247     * Sanitize HTML code by temporarily removing
     248     * <script>...</script> and <style>...</style>
     249     * before filtering allowed HTML through wp_kses
     250     *
     251     * @param string $content
     252     * @return string Sanitized content (code inside SCRIPT and STYLE is untouched)
     253     */
     254    public static function sanitize_html_with_scripts( $content ) {
     255        $allowed_html = self::allowed_html();
     256
     257        $placeholders = array();
     258
     259        // Match <script>...</script>
     260        if ( preg_match_all( '#<script\b[^>]*>.*?</script>#is', $content, $matches ) ) {
     261            foreach ( $matches[0] as $i => $match ) {
     262                $placeholder                  = "__TWU_SCRIPT_PLACEHOLDER_{$i}__";
     263                $placeholders[ $placeholder ] = $match;
     264                $content                      = str_replace( $match, $placeholder, $content );
     265            }
     266        }
     267
     268        // Match <style>...</style>
     269        if ( preg_match_all( '#<style\b[^>]*>.*?</style>#is', $content, $matches ) ) {
     270            foreach ( $matches[0] as $i => $match ) {
     271                $placeholder                  = "__TWU_STYLE_PLACEHOLDER_{$i}__";
     272                $placeholders[ $placeholder ] = $match;
     273                $content                      = str_replace( $match, $placeholder, $content );
     274            }
     275        }
     276
     277        // Sanitize rest of content (outside scripts/styles)
     278        $content = wp_kses( $content, $allowed_html );
     279
     280        // Restore script/style blocks
     281        foreach ( $placeholders as $placeholder => $original ) {
     282            $content = str_replace( $placeholder, $original, $content );
     283        }
     284
     285        return $content;
     286    }
     287
     288    /**
    247289     * Get values of metabox fields
    248290     *

  • head-footer-code/trunk/classes/techwebux/hfc/class-metabox-article.php

    r3271581 r3285202  
    9595        }
    9696
    97         // Allow safe HTML, JS, and CSS.
    98         $allowed_html = Common::allowed_html();
    99 
    10097        // Sanitize each field separately.
    10198        $data = array(
    10299            'behavior' => isset( $_POST['auhfc']['behavior'] ) ? sanitize_key( $_POST['auhfc']['behavior'] ) : '',
    103             'head'     => isset( $_POST['auhfc']['head'] ) ? wp_kses( $_POST['auhfc']['head'], $allowed_html ) : '',
    104             'body'     => isset( $_POST['auhfc']['body'] ) ? wp_kses( $_POST['auhfc']['body'], $allowed_html ) : '',
    105             'footer'   => isset( $_POST['auhfc']['footer'] ) ? wp_kses( $_POST['auhfc']['footer'], $allowed_html ) : '',
     100            'head'     => isset( $_POST['auhfc']['head'] ) ? Common::sanitize_html_with_scripts( $_POST['auhfc']['head'] ) : '',
     101            'body'     => isset( $_POST['auhfc']['body'] ) ? Common::sanitize_html_with_scripts( $_POST['auhfc']['body'] ) : '',
     102            'footer'   => isset( $_POST['auhfc']['footer'] ) ? Common::sanitize_html_with_scripts( $_POST['auhfc']['footer'] ) : '',
    106103        );
     104
    107105        update_post_meta( $post_id, '_auhfc', wp_slash( $data ) );
    108106    } // END public function save

  • head-footer-code/trunk/head-footer-code.php

    r3277444 r3285202  
    1111 * Plugin URI:  https://urosevic.net/wordpress/plugins/head-footer-code/
    1212 * Description: Easy add site-wide, category or article specific custom code before the closing <strong>&lt;/head&gt;</strong> and <strong>&lt;/body&gt;</strong> or after opening <strong>&lt;body&gt;</strong> HTML tag.
    13  * Version:     1.4.2
     13 * Version:     1.4.3
    1414 * Author:      Aleksandar Urošević
    1515 * Author URI:  https://urosevic.net/
    … …  
    3030}
    3131
    32 define( 'HFC_VER', '1.4.2' );
     32define( 'HFC_VER', '1.4.3' );
    3333define( 'HFC_VER_DB', '9' );
    3434define( 'HFC_FILE', __FILE__ );

  • head-footer-code/trunk/readme.txt

    r3277444 r3285202  
    66Requires at least: 4.9
    77Tested up to: 6.8
    8 Stable tag: 1.4.2
     8Stable tag: 1.4.3
    99Requires PHP: 5.5
    1010License: GPLv3
    … …  
    191191## Changelog
    192192
     193### 1.4.3 (2025-04-30)
     194* Fix: Relaxed filtering to allow <script> blocks with `<`, `>`, `=>` characters and `type="application/ld+json"` for structured data (rich snippets), following stricter sanitization introduced in 1.4.0.
     195
    193196### 1.4.2 (2025-04-20)
    194197* Fix: meta tag broken by security introduced in 1.4.0
Note: See TracChangeset for help on using the changeset viewer.