WordPress.org
Get WordPress

Plugin Directory

Changeset 3367712


Ignore:
Timestamp:
09/25/2025 09:28:56 AM (6 months ago)
Author:
nko
Message:

Update to version 4.1.1 from GitHub

Location:
lazy-blocks
Files:
18 edited
1 copied

Legend:

Unmodified
Added
Removed

  • lazy-blocks/tags/4.1.1/assets/admin/tools/tools.js

    r3304975 r3367712  
    4747        const typeLabel = type.charAt(0).toUpperCase() + type.slice(1);
    4848        let url = window.location.href;
     49
     50        // Add export nonce for CSRF protection
     51        if (data.export_nonce) {
     52            url += `&lazyblocks_export_nonce=${data.export_nonce}`;
     53        }
    4954
    5055        data[type].forEach((item) => {

  • lazy-blocks/tags/4.1.1/build/admin-tools.asset.php

    r3304975 r3367712  
    1 <?php return array('dependencies' => array('wp-components', 'wp-element', 'wp-i18n'), 'version' => 'ef9e249564ec49e19956');
     1<?php return array('dependencies' => array('wp-components', 'wp-element', 'wp-i18n'), 'version' => '05bb6126d0a5b8d21d57');

  • lazy-blocks/tags/4.1.1/build/admin-tools.js

    r3304975 r3367712  
    1 (()=>{"use strict";const e=window.wp.element,t=window.wp.i18n,n=window.wp.components;function l(e){var n=e.children;return wp.element.createElement("div",{className:"lazyblocks-component-copied"},n||(0,t.__)("Copied!","lazy-blocks"))}function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},o(e)}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);t&&(l=l.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,l)}return n}function r(e,t,n){return(t=function(e){var t=function(e){if("object"!=o(e)||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=o(n))return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==o(t)?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var l,o,a,r,c=[],i=!0,s=!1;try{if(a=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;i=!1}else for(;!(i=(l=a.call(n)).done)&&(c.push(l.value),c.length!==t);i=!0);}catch(e){s=!0,o=e}finally{try{if(!i&&null!=n.return&&(r=n.return(),Object(r)!==r))return}finally{if(s)throw o}}return c}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?i(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,l=Array(t);n<t;n++)l[n]=e[n];return l}var s=window,m=s.navigator,p=s.lazyblocksToolsData;function u(){var o=c((0,e.useState)(!1),2),i=o[0],s=o[1],u=c((0,e.useState)(!1),2),d=u[0],b=u[1],w=c((0,e.useState)({}),2),y=w[0],h=w[1],f=c((0,e.useState)({}),2),v=f[0],E=f[1],k=c((0,e.useState)(!1),2),_=k[0],g=k[1],x=c((0,e.useState)(!1),2),N=x[0],S=x[1],z={showBlocksPHP:i,showTemplatesPHP:d},O={disabledBlocks:y,disabledTemplates:v},j={copiedBlocks:_,copiedTemplates:N},P=(0,e.useRef)({});function T(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n=window.location.href;return p[e].forEach((function(l){O["disabled".concat(t)][l.data.id]||(n+="&lazyblocks_export_".concat(e,"[]=").concat(l.data.id))})),n}function B(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n="";return p[e].forEach((function(e){O["disabled".concat(t)][e.data.id]||(n+=e.php_string_code)})),n&&(n="add_action( 'lzb/init', function() {\n".concat(n,"\n} );")),n}function C(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",o=e.charAt(0).toUpperCase()+e.slice(1),c=Object.keys(O["disabled".concat(o)]).length===p[e].length;return wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement(n.BaseControl,{__nextHasNoMarginBottom:!0},wp.element.createElement(n.ToggleControl,{label:(0,t.__)("Select all","lazy-blocks"),checked:0===Object.keys(O["disabled".concat(o)]).length,onChange:function(){var t={};0===Object.keys(O["disabled".concat(o)]).length&&p[e].forEach((function(e){t[e.data.id]=!0})),"Blocks"===o?h(t):"Templates"===o&&E(t)},__nextHasNoMarginBottom:!0}),p[e].map((function(t){var l=!O["disabled".concat(o)][t.data.id];return wp.element.createElement(n.ToggleControl,{key:t.data.id,label:wp.element.createElement(wp.element.Fragment,null,"blocks"===e?wp.element.createElement(wp.element.Fragment,null,t.data.icon&&/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{className:t.data.icon}):"",t.data.icon&&!/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{dangerouslySetInnerHTML:{__html:t.data.icon}}):""," "):"",t.data.title),checked:l,onChange:function(){var e=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},O["disabled".concat(o)]);l&&!e[t.data.id]?e[t.data.id]=!0:l||void 0===e[t.data.id]||delete e[t.data.id],"Blocks"===o?h(e):"Templates"===o&&E(e)},__nextHasNoMarginBottom:!0})})))),z["show".concat(o,"PHP")]?wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-textarea"},wp.element.createElement(n.TextareaControl,{className:"lzb-export-code",readOnly:!0,value:B(e),__next40pxDefaultSize:!0,__nextHasNoMarginBottom:!0})),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button",onClick:function(){!function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1);m.clipboard.writeText(B(e)).then((function(){"Blocks"===t?g(!0):"Templates"===t&&S(!0),clearTimeout(P.current[t]),P.current[t]=setTimeout((function(){"Blocks"===t?g(!1):"Templates"===t&&S(!1)}),350)}))}(e)}},(0,t.__)("Copy to Clipboard","lazy-blocks"),j["copied".concat(o)]?wp.element.createElement(l,null):""))):wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("a",{className:"button button-primary",disabled:c,href:T(e)},(0,t.__)("Export JSON","lazy-blocks")),wp.element.createElement("button",{className:"button",onClick:function(){"Blocks"===o?s(!0):"Templates"===o&&b(!0)},disabled:c},(0,t.__)("Generate PHP","lazy-blocks"))))}return wp.element.createElement("div",{className:"metabox-holder"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{id:"normal-sortables"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Blocks","lazy-blocks"))),p.blocks&&p.blocks.length?wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the blocks you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("blocks")):wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("There are no blocks to export.")))),p.templates&&p.templates.length?wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Templates","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the templates you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("templates"))):null),wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Import","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the Lazy Blocks JSON file you want to import. When you click the import button below, Lazy Blocks will import the blocks.")),wp.element.createElement("form",{method:"post",encType:"multipart/form-data"},wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement("input",{type:"file",name:"lzb_tools_import_json"})),wp.element.createElement("input",{type:"hidden",name:"lzb_tools_import_nonce",value:p.nonce}),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button button-primary"},(0,t.__)("Import","lazy-blocks"))))))))))}window.addEventListener("load",(function(){(0,e.render)(wp.element.createElement(u,null),document.querySelector(".lazyblocks-tools-page"))}))})();
     1(()=>{"use strict";const e=window.wp.element,t=window.wp.i18n,n=window.wp.components;function l(e){var n=e.children;return wp.element.createElement("div",{className:"lazyblocks-component-copied"},n||(0,t.__)("Copied!","lazy-blocks"))}function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},o(e)}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);t&&(l=l.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,l)}return n}function r(e,t,n){return(t=function(e){var t=function(e){if("object"!=o(e)||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=o(n))return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==o(t)?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var l,o,a,r,c=[],i=!0,s=!1;try{if(a=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;i=!1}else for(;!(i=(l=a.call(n)).done)&&(c.push(l.value),c.length!==t);i=!0);}catch(e){s=!0,o=e}finally{try{if(!i&&null!=n.return&&(r=n.return(),Object(r)!==r))return}finally{if(s)throw o}}return c}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?i(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,l=Array(t);n<t;n++)l[n]=e[n];return l}var s=window,m=s.navigator,p=s.lazyblocksToolsData;function u(){var o=c((0,e.useState)(!1),2),i=o[0],s=o[1],u=c((0,e.useState)(!1),2),d=u[0],b=u[1],w=c((0,e.useState)({}),2),y=w[0],h=w[1],f=c((0,e.useState)({}),2),v=f[0],E=f[1],_=c((0,e.useState)(!1),2),k=_[0],g=_[1],x=c((0,e.useState)(!1),2),N=x[0],z=x[1],S={showBlocksPHP:i,showTemplatesPHP:d},O={disabledBlocks:y,disabledTemplates:v},j={copiedBlocks:k,copiedTemplates:N},P=(0,e.useRef)({});function T(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n=window.location.href;return p.export_nonce&&(n+="&lazyblocks_export_nonce=".concat(p.export_nonce)),p[e].forEach((function(l){O["disabled".concat(t)][l.data.id]||(n+="&lazyblocks_export_".concat(e,"[]=").concat(l.data.id))})),n}function B(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n="";return p[e].forEach((function(e){O["disabled".concat(t)][e.data.id]||(n+=e.php_string_code)})),n&&(n="add_action( 'lzb/init', function() {\n".concat(n,"\n} );")),n}function C(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",o=e.charAt(0).toUpperCase()+e.slice(1),c=Object.keys(O["disabled".concat(o)]).length===p[e].length;return wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement(n.BaseControl,{__nextHasNoMarginBottom:!0},wp.element.createElement(n.ToggleControl,{label:(0,t.__)("Select all","lazy-blocks"),checked:0===Object.keys(O["disabled".concat(o)]).length,onChange:function(){var t={};0===Object.keys(O["disabled".concat(o)]).length&&p[e].forEach((function(e){t[e.data.id]=!0})),"Blocks"===o?h(t):"Templates"===o&&E(t)},__nextHasNoMarginBottom:!0}),p[e].map((function(t){var l=!O["disabled".concat(o)][t.data.id];return wp.element.createElement(n.ToggleControl,{key:t.data.id,label:wp.element.createElement(wp.element.Fragment,null,"blocks"===e?wp.element.createElement(wp.element.Fragment,null,t.data.icon&&/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{className:t.data.icon}):"",t.data.icon&&!/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{dangerouslySetInnerHTML:{__html:t.data.icon}}):""," "):"",t.data.title),checked:l,onChange:function(){var e=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},O["disabled".concat(o)]);l&&!e[t.data.id]?e[t.data.id]=!0:l||void 0===e[t.data.id]||delete e[t.data.id],"Blocks"===o?h(e):"Templates"===o&&E(e)},__nextHasNoMarginBottom:!0})})))),S["show".concat(o,"PHP")]?wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-textarea"},wp.element.createElement(n.TextareaControl,{className:"lzb-export-code",readOnly:!0,value:B(e),__next40pxDefaultSize:!0,__nextHasNoMarginBottom:!0})),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button",onClick:function(){!function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1);m.clipboard.writeText(B(e)).then((function(){"Blocks"===t?g(!0):"Templates"===t&&z(!0),clearTimeout(P.current[t]),P.current[t]=setTimeout((function(){"Blocks"===t?g(!1):"Templates"===t&&z(!1)}),350)}))}(e)}},(0,t.__)("Copy to Clipboard","lazy-blocks"),j["copied".concat(o)]?wp.element.createElement(l,null):""))):wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("a",{className:"button button-primary",disabled:c,href:T(e)},(0,t.__)("Export JSON","lazy-blocks")),wp.element.createElement("button",{className:"button",onClick:function(){"Blocks"===o?s(!0):"Templates"===o&&b(!0)},disabled:c},(0,t.__)("Generate PHP","lazy-blocks"))))}return wp.element.createElement("div",{className:"metabox-holder"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{id:"normal-sortables"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Blocks","lazy-blocks"))),p.blocks&&p.blocks.length?wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the blocks you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("blocks")):wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("There are no blocks to export.")))),p.templates&&p.templates.length?wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Templates","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the templates you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("templates"))):null),wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Import","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the Lazy Blocks JSON file you want to import. When you click the import button below, Lazy Blocks will import the blocks.")),wp.element.createElement("form",{method:"post",encType:"multipart/form-data"},wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement("input",{type:"file",name:"lzb_tools_import_json"})),wp.element.createElement("input",{type:"hidden",name:"lzb_tools_import_nonce",value:p.nonce}),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button button-primary"},(0,t.__)("Import","lazy-blocks"))))))))))}window.addEventListener("load",(function(){(0,e.render)(wp.element.createElement(u,null),document.querySelector(".lazyblocks-tools-page"))}))})();

  • lazy-blocks/tags/4.1.1/classes/class-blocks.php

    r3346570 r3367712  
    368368                        array(
    369369                            'lazyblocks_export_block' => intval( $post->ID ),
     370                            'lazyblocks_export_nonce' => wp_create_nonce( 'lzb-export-blocks-nonce' ),
    370371                        )
    371372                    ),
    … …  
    14031404     * @param string $code - user code string.
    14041405     * @param array  $attributes - block attributes.
     1406     * @param array  $context - block context.
    14051407     *
    14061408     * @return string
    … …  
    17331735
    17341736        // add filter for block output.
    1735         $result = apply_filters( 'lzb/block_render/output', $result, $attributes, $render_location, $block, $context );
     1737        $result = apply_filters( 'lzb/block_render/output', $result, $attributes, $render_location, $block, $context, $content );
    17361738        // phpcs:ignore
    1737         $result = apply_filters( $block['slug'] . '/' . $render_location . '_output', $result, $attributes, $block, $context );
     1739        $result = apply_filters( $block['slug'] . '/' . $render_location . '_output', $result, $attributes, $block, $context, $content );
    17381740        // phpcs:ignore
    1739         $result = apply_filters( $block['slug'] . '/output', $result, $attributes, $render_location, $block, $context );
     1741        $result = apply_filters( $block['slug'] . '/output', $result, $attributes, $render_location, $block, $context, $content );
    17401742
    17411743        return $result;

  • lazy-blocks/tags/4.1.1/classes/class-tools.php

    r3346570 r3367712  
    246246        $templates = lazyblocks()->templates()->get_templates( true, true );
    247247        $data      = array(
    248             'blocks'    => array(),
    249             'templates' => array(),
    250             'nonce'     => wp_create_nonce( 'lzb-tools-import-nonce' ),
     248            'blocks'       => array(),
     249            'templates'    => array(),
     250            'nonce'        => wp_create_nonce( 'lzb-tools-import-nonce' ),
     251            'export_nonce' => wp_create_nonce( 'lzb-export-blocks-nonce' ),
    251252        );
    252253
    … …  
    474475     */
    475476    public function maybe_export_json() {
     477        // Check if any export parameters are present.
     478        $has_export_params = isset( $_GET['lazyblocks_export_block'] ) ||
     479                            isset( $_GET['lazyblocks_export_blocks'] ) ||
     480                            isset( $_GET['lazyblocks_export_templates'] ) ||
     481                            isset( $_GET['lazyblocks_export_nonce'] );
     482
     483        // Exit early if no export parameters - this is the normal case on every admin page.
     484        if ( ! $has_export_params ) {
     485            return;
     486        }
     487
     488        // Verify nonce for CSRF protection - required for all export operations.
     489        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     490        $nonce = isset( $_GET['lazyblocks_export_nonce'] ) ? sanitize_key( $_GET['lazyblocks_export_nonce'] ) : false;
     491
     492        if ( ! $nonce || ! wp_verify_nonce( $nonce, 'lzb-export-blocks-nonce' ) ) {
     493            wp_die( esc_html__( 'Export permission denied.', 'lazy-blocks' ) );
     494        }
     495
    476496        $block_id  = filter_input( INPUT_GET, 'lazyblocks_export_block', FILTER_SANITIZE_NUMBER_INT );
    477497        $block_ids = filter_input_array(
    … …  
    497517        $template_ids = is_array( $template_ids ) && isset( $template_ids['lazyblocks_export_templates'] ) ? $template_ids['lazyblocks_export_templates'] : array();
    498518
    499         if ( isset( $block_id ) && current_user_can( 'read_lazyblock', $block_id ) ) {
     519        // Security: Only administrators with edit_lazyblocks capability can export.
     520        // This prevents contributors from bypassing UI restrictions via direct URL access.
     521        if ( isset( $block_id ) && current_user_can( 'edit_lazyblocks' ) ) {
    500522            $this->export_json( array( $block_id ) );
    501         } elseif ( isset( $block_ids ) && ! empty( $block_ids ) && current_user_can( 'read_lazyblock', $block_ids[0] ) ) {
     523        } elseif ( isset( $block_ids ) && ! empty( $block_ids ) && current_user_can( 'edit_lazyblocks' ) ) {
    502524            $this->export_json( $block_ids );
    503         } elseif ( isset( $template_ids ) && ! empty( $template_ids ) && current_user_can( 'read_lazyblock', $template_ids[0] ) ) {
     525        } elseif ( isset( $template_ids ) && ! empty( $template_ids ) && current_user_can( 'edit_lazyblocks' ) ) {
    504526            $this->export_json( $template_ids, 'templates' );
    505527        }
    … …  
    668690
    669691        // Duplicate block.
    670         if ( isset( $block_id ) && current_user_can( 'read_lazyblock', $block_id ) ) {
     692        if ( isset( $block_id ) && current_user_can( 'edit_lazyblocks' ) ) {
    671693            $this->duplicate_block( $block_id );
    672694        }

  • lazy-blocks/tags/4.1.1/languages/lazy-blocks.json

    r3304975 r3367712  
    99            ""
    1010         ],
     11         "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline": [
     12            ""
     13         ],
    1114         "Easily create custom blocks and custom meta fields for Gutenberg without hard coding.": [
    1215            ""
    1316         ],
    1417         "Lazy Blocks Team": [
    15             ""
    16          ],
    17          "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline": [
    1818            ""
    1919         ],
    … …  
    183183            "",
    184184            "Imported %s templates"
     185         ],
     186         "Export permission denied.": [
     187            ""
    185188         ],
    186189         "Template for these post types '%s' already exists.": [

  • lazy-blocks/tags/4.1.1/languages/lazy-blocks.pot

    r3346570 r3367712  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Lazy Blocks 4.1.0\n"
     5"Project-Id-Version: Lazy Blocks 4.1.1\n"
    66"Report-Msgid-Bugs-To: https://github.com/nk-crew/lazyblocks/issues\n"
    77"Last-Translator: Lazy Blocks Team\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2025-08-18T17:07:40+00:00\n"
     12"POT-Creation-Date: 2025-09-25T09:27:58+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    1919#: classes/class-admin.php:252
    2020#: classes/class-blocks.php:187
    21 #: classes/class-blocks.php:1222
     21#: classes/class-blocks.php:1223
    2222msgid "Lazy Blocks"
     23msgstr ""
     24
     25#. Plugin URI of the plugin
     26#. Author URI of the plugin
     27#: lazy-blocks.php
     28msgid "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline"
    2329msgstr ""
    2430
    … …  
    3137#: lazy-blocks.php
    3238msgid "Lazy Blocks Team"
    33 msgstr ""
    34 
    35 #. Author URI of the plugin
    36 #: lazy-blocks.php
    37 msgid "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline"
    3839msgstr ""
    3940
    … …  
    8889
    8990#. translators: %1$ - post title.
    90 #: classes/class-blocks.php:374
     91#: classes/class-blocks.php:375
    9192#, php-format
    9293msgid "Export “%1$s”"
    9394msgstr ""
    9495
    95 #: classes/class-blocks.php:377
    96 #: classes/class-blocks.php:412
     96#: classes/class-blocks.php:378
     97#: classes/class-blocks.php:413
    9798msgid "Export"
    9899msgstr ""
    99100
    100101#. translators: %1$ - post title.
    101 #: classes/class-blocks.php:389
     102#: classes/class-blocks.php:390
    102103#, php-format
    103104msgid "Deactivate “%1$s”"
    … …  
    105106
    106107#. translators: %1$ - post title.
    107 #: classes/class-blocks.php:389
     108#: classes/class-blocks.php:390
    108109#, php-format
    109110msgid "Activate “%1$s”"
    110111msgstr ""
    111112
    112 #: classes/class-blocks.php:393
    113 #: classes/class-blocks.php:416
     113#: classes/class-blocks.php:394
     114#: classes/class-blocks.php:417
    114115msgid "Deactivate"
    115116msgstr ""
    116117
    117 #: classes/class-blocks.php:393
    118 #: classes/class-blocks.php:414
     118#: classes/class-blocks.php:394
     119#: classes/class-blocks.php:415
    119120msgid "Activate"
    120121msgstr ""
    121122
    122 #: classes/class-blocks.php:456
     123#: classes/class-blocks.php:457
    123124#: assets/block-builder/boxes/general/index.js:179
    124125msgid "Icon"
    125126msgstr ""
    126127
    127 #: classes/class-blocks.php:458
     128#: classes/class-blocks.php:459
    128129#: assets/block-builder/boxes/general/index.js:46
    129130msgid "Slug"
    130131msgstr ""
    131132
    132 #: classes/class-blocks.php:459
     133#: classes/class-blocks.php:460
    133134#: assets/block-builder/boxes/general/index.js:94
    134135msgid "Category"
    135136msgstr ""
    136137
    137 #: classes/class-blocks.php:460
     138#: classes/class-blocks.php:461
    138139#: assets/block-builder/boxes/general/index.js:213
    139140#: assets/block-builder/boxes/wizard/index.js:276
    … …  
    249250
    250251#. translators: %s - block title.
    251 #: classes/class-tools.php:330
     252#: classes/class-tools.php:331
    252253#, php-format
    253254msgid "Block \"%s\" activated successfully."
    … …  
    255256
    256257#. translators: %s - block title.
    257 #: classes/class-tools.php:330
     258#: classes/class-tools.php:331
    258259#, php-format
    259260msgid "Block \"%s\" deactivated successfully."
    … …  
    261262
    262263#. translators: %s - number of blocks.
    263 #: classes/class-tools.php:333
     264#: classes/class-tools.php:334
    264265#, php-format
    265266msgid "Activated %s block"
    … …  
    269270
    270271#. translators: %s - number of blocks.
    271 #: classes/class-tools.php:333
     272#: classes/class-tools.php:334
    272273#, php-format
    273274msgid "Deactivated %s block"
    … …  
    276277msgstr[1] ""
    277278
    278 #: classes/class-tools.php:372
     279#: classes/class-tools.php:373
    279280msgid "No file selected"
    280281msgstr ""
    281282
    282 #: classes/class-tools.php:382
     283#: classes/class-tools.php:383
    283284msgid "Error uploading file. Please try again"
    284285msgstr ""
    285286
    286 #: classes/class-tools.php:388
     287#: classes/class-tools.php:389
    287288msgid "Incorrect file type"
    288289msgstr ""
    289290
    290 #: classes/class-tools.php:399
     291#: classes/class-tools.php:400
    291292msgid "Import file empty"
    292293msgstr ""
    293294
    294295#. translators: %s - number of blocks.
    295 #: classes/class-tools.php:438
     296#: classes/class-tools.php:439
    296297#, php-format
    297298msgid "Imported %s block"
    … …  
    301302
    302303#. translators: %s - number of templates.
    303 #: classes/class-tools.php:458
     304#: classes/class-tools.php:459
    304305#, php-format
    305306msgid "Imported %s template"
    … …  
    308309msgstr[1] ""
    309310
     311#: classes/class-tools.php:493
     312msgid "Export permission denied."
     313msgstr ""
     314
    310315#. translators: %s - post type.
    311 #: classes/class-tools.php:634
     316#: classes/class-tools.php:656
    312317#, php-format
    313318msgid "Template for these post types '%s' already exists."
    … …  
    315320
    316321#. translators: %s - post title.
    317 #: classes/class-tools.php:680
     322#: classes/class-tools.php:702
    318323#, php-format
    319324msgid "Added new block '%s'."
    320325msgstr ""
    321326
    322 #: classes/class-tools.php:711
     327#: classes/class-tools.php:733
    323328msgid "(Copy)"
    324329msgstr ""
    … …  
    439444msgstr ""
    440445
    441 #: assets/admin/tools/tools.js:117
     446#: assets/admin/tools/tools.js:122
    442447msgid "Select all"
    443448msgstr ""
    444449
    445 #: assets/admin/tools/tools.js:245
     450#: assets/admin/tools/tools.js:250
    446451msgid "Copy to Clipboard"
    447452msgstr ""
    448453
    449 #: assets/admin/tools/tools.js:261
     454#: assets/admin/tools/tools.js:266
    450455msgid "Export JSON"
    451456msgstr ""
    452457
    453 #: assets/admin/tools/tools.js:275
     458#: assets/admin/tools/tools.js:280
    454459msgid "Generate PHP"
    455460msgstr ""
    456461
    457 #: assets/admin/tools/tools.js:291
     462#: assets/admin/tools/tools.js:296
    458463msgid "Export Blocks"
    459464msgstr ""
    460465
    461 #: assets/admin/tools/tools.js:316
     466#: assets/admin/tools/tools.js:321
    462467msgid "Export Templates"
    463468msgstr ""
    464469
    465 #: assets/admin/tools/tools.js:334
    466 #: assets/admin/tools/tools.js:363
     470#: assets/admin/tools/tools.js:339
     471#: assets/admin/tools/tools.js:368
    467472msgid "Import"
    468473msgstr ""

  • lazy-blocks/tags/4.1.1/lazy-blocks.php

    r3357405 r3367712  
    33 * Plugin Name:  Lazy Blocks
    44 * Description:  Easily create custom blocks and custom meta fields for Gutenberg without hard coding.
    5  * Version:      4.1.0
     5 * Version:      4.1.1
    66 * Plugin URI:   https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline
    77 * Author:       Lazy Blocks Team
    … …  
    1919
    2020if ( ! defined( 'LAZY_BLOCKS_VERSION' ) ) {
    21     define( 'LAZY_BLOCKS_VERSION', '4.1.0' );
     21    define( 'LAZY_BLOCKS_VERSION', '4.1.1' );
    2222}
    2323

  • lazy-blocks/tags/4.1.1/readme.txt

    r3347329 r3367712  
    77* Tested up to: 6.8
    88* Requires PHP: 8.0
    9 * Stable tag: 4.1.0
     9* Stable tag: 4.1.1
    1010* License: GPLv2 or later
    1111* License URI: <http://www.gnu.org/licenses/gpl-2.0.html>
    … …  
    139139
    140140## Changelog
     141
     142= 4.1.1 - Sep 25, 2025 =
     143
     144* security fix: prevent unauthorized block export access
     145* added `$content` attribute to `lzb/block_render/output` filters
     146* **Pro:**
     147* fixed rendering blocks in widgets screen when Rank Math is active
    141148
    142149= 4.1.0 - Aug 18, 2025 =

  • lazy-blocks/trunk/assets/admin/tools/tools.js

    r3304975 r3367712  
    4747        const typeLabel = type.charAt(0).toUpperCase() + type.slice(1);
    4848        let url = window.location.href;
     49
     50        // Add export nonce for CSRF protection
     51        if (data.export_nonce) {
     52            url += `&lazyblocks_export_nonce=${data.export_nonce}`;
     53        }
    4954
    5055        data[type].forEach((item) => {

  • lazy-blocks/trunk/build/admin-tools.asset.php

    r3304975 r3367712  
    1 <?php return array('dependencies' => array('wp-components', 'wp-element', 'wp-i18n'), 'version' => 'ef9e249564ec49e19956');
     1<?php return array('dependencies' => array('wp-components', 'wp-element', 'wp-i18n'), 'version' => '05bb6126d0a5b8d21d57');

  • lazy-blocks/trunk/build/admin-tools.js

    r3304975 r3367712  
    1 (()=>{"use strict";const e=window.wp.element,t=window.wp.i18n,n=window.wp.components;function l(e){var n=e.children;return wp.element.createElement("div",{className:"lazyblocks-component-copied"},n||(0,t.__)("Copied!","lazy-blocks"))}function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},o(e)}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);t&&(l=l.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,l)}return n}function r(e,t,n){return(t=function(e){var t=function(e){if("object"!=o(e)||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=o(n))return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==o(t)?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var l,o,a,r,c=[],i=!0,s=!1;try{if(a=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;i=!1}else for(;!(i=(l=a.call(n)).done)&&(c.push(l.value),c.length!==t);i=!0);}catch(e){s=!0,o=e}finally{try{if(!i&&null!=n.return&&(r=n.return(),Object(r)!==r))return}finally{if(s)throw o}}return c}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?i(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,l=Array(t);n<t;n++)l[n]=e[n];return l}var s=window,m=s.navigator,p=s.lazyblocksToolsData;function u(){var o=c((0,e.useState)(!1),2),i=o[0],s=o[1],u=c((0,e.useState)(!1),2),d=u[0],b=u[1],w=c((0,e.useState)({}),2),y=w[0],h=w[1],f=c((0,e.useState)({}),2),v=f[0],E=f[1],k=c((0,e.useState)(!1),2),_=k[0],g=k[1],x=c((0,e.useState)(!1),2),N=x[0],S=x[1],z={showBlocksPHP:i,showTemplatesPHP:d},O={disabledBlocks:y,disabledTemplates:v},j={copiedBlocks:_,copiedTemplates:N},P=(0,e.useRef)({});function T(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n=window.location.href;return p[e].forEach((function(l){O["disabled".concat(t)][l.data.id]||(n+="&lazyblocks_export_".concat(e,"[]=").concat(l.data.id))})),n}function B(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n="";return p[e].forEach((function(e){O["disabled".concat(t)][e.data.id]||(n+=e.php_string_code)})),n&&(n="add_action( 'lzb/init', function() {\n".concat(n,"\n} );")),n}function C(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",o=e.charAt(0).toUpperCase()+e.slice(1),c=Object.keys(O["disabled".concat(o)]).length===p[e].length;return wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement(n.BaseControl,{__nextHasNoMarginBottom:!0},wp.element.createElement(n.ToggleControl,{label:(0,t.__)("Select all","lazy-blocks"),checked:0===Object.keys(O["disabled".concat(o)]).length,onChange:function(){var t={};0===Object.keys(O["disabled".concat(o)]).length&&p[e].forEach((function(e){t[e.data.id]=!0})),"Blocks"===o?h(t):"Templates"===o&&E(t)},__nextHasNoMarginBottom:!0}),p[e].map((function(t){var l=!O["disabled".concat(o)][t.data.id];return wp.element.createElement(n.ToggleControl,{key:t.data.id,label:wp.element.createElement(wp.element.Fragment,null,"blocks"===e?wp.element.createElement(wp.element.Fragment,null,t.data.icon&&/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{className:t.data.icon}):"",t.data.icon&&!/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{dangerouslySetInnerHTML:{__html:t.data.icon}}):""," "):"",t.data.title),checked:l,onChange:function(){var e=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},O["disabled".concat(o)]);l&&!e[t.data.id]?e[t.data.id]=!0:l||void 0===e[t.data.id]||delete e[t.data.id],"Blocks"===o?h(e):"Templates"===o&&E(e)},__nextHasNoMarginBottom:!0})})))),z["show".concat(o,"PHP")]?wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-textarea"},wp.element.createElement(n.TextareaControl,{className:"lzb-export-code",readOnly:!0,value:B(e),__next40pxDefaultSize:!0,__nextHasNoMarginBottom:!0})),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button",onClick:function(){!function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1);m.clipboard.writeText(B(e)).then((function(){"Blocks"===t?g(!0):"Templates"===t&&S(!0),clearTimeout(P.current[t]),P.current[t]=setTimeout((function(){"Blocks"===t?g(!1):"Templates"===t&&S(!1)}),350)}))}(e)}},(0,t.__)("Copy to Clipboard","lazy-blocks"),j["copied".concat(o)]?wp.element.createElement(l,null):""))):wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("a",{className:"button button-primary",disabled:c,href:T(e)},(0,t.__)("Export JSON","lazy-blocks")),wp.element.createElement("button",{className:"button",onClick:function(){"Blocks"===o?s(!0):"Templates"===o&&b(!0)},disabled:c},(0,t.__)("Generate PHP","lazy-blocks"))))}return wp.element.createElement("div",{className:"metabox-holder"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{id:"normal-sortables"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Blocks","lazy-blocks"))),p.blocks&&p.blocks.length?wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the blocks you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("blocks")):wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("There are no blocks to export.")))),p.templates&&p.templates.length?wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Templates","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the templates you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("templates"))):null),wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Import","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the Lazy Blocks JSON file you want to import. When you click the import button below, Lazy Blocks will import the blocks.")),wp.element.createElement("form",{method:"post",encType:"multipart/form-data"},wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement("input",{type:"file",name:"lzb_tools_import_json"})),wp.element.createElement("input",{type:"hidden",name:"lzb_tools_import_nonce",value:p.nonce}),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button button-primary"},(0,t.__)("Import","lazy-blocks"))))))))))}window.addEventListener("load",(function(){(0,e.render)(wp.element.createElement(u,null),document.querySelector(".lazyblocks-tools-page"))}))})();
     1(()=>{"use strict";const e=window.wp.element,t=window.wp.i18n,n=window.wp.components;function l(e){var n=e.children;return wp.element.createElement("div",{className:"lazyblocks-component-copied"},n||(0,t.__)("Copied!","lazy-blocks"))}function o(e){return o="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},o(e)}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);t&&(l=l.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,l)}return n}function r(e,t,n){return(t=function(e){var t=function(e){if("object"!=o(e)||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=o(n))return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==o(t)?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var l,o,a,r,c=[],i=!0,s=!1;try{if(a=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;i=!1}else for(;!(i=(l=a.call(n)).done)&&(c.push(l.value),c.length!==t);i=!0);}catch(e){s=!0,o=e}finally{try{if(!i&&null!=n.return&&(r=n.return(),Object(r)!==r))return}finally{if(s)throw o}}return c}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?i(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,l=Array(t);n<t;n++)l[n]=e[n];return l}var s=window,m=s.navigator,p=s.lazyblocksToolsData;function u(){var o=c((0,e.useState)(!1),2),i=o[0],s=o[1],u=c((0,e.useState)(!1),2),d=u[0],b=u[1],w=c((0,e.useState)({}),2),y=w[0],h=w[1],f=c((0,e.useState)({}),2),v=f[0],E=f[1],_=c((0,e.useState)(!1),2),k=_[0],g=_[1],x=c((0,e.useState)(!1),2),N=x[0],z=x[1],S={showBlocksPHP:i,showTemplatesPHP:d},O={disabledBlocks:y,disabledTemplates:v},j={copiedBlocks:k,copiedTemplates:N},P=(0,e.useRef)({});function T(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n=window.location.href;return p.export_nonce&&(n+="&lazyblocks_export_nonce=".concat(p.export_nonce)),p[e].forEach((function(l){O["disabled".concat(t)][l.data.id]||(n+="&lazyblocks_export_".concat(e,"[]=").concat(l.data.id))})),n}function B(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1),n="";return p[e].forEach((function(e){O["disabled".concat(t)][e.data.id]||(n+=e.php_string_code)})),n&&(n="add_action( 'lzb/init', function() {\n".concat(n,"\n} );")),n}function C(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",o=e.charAt(0).toUpperCase()+e.slice(1),c=Object.keys(O["disabled".concat(o)]).length===p[e].length;return wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement(n.BaseControl,{__nextHasNoMarginBottom:!0},wp.element.createElement(n.ToggleControl,{label:(0,t.__)("Select all","lazy-blocks"),checked:0===Object.keys(O["disabled".concat(o)]).length,onChange:function(){var t={};0===Object.keys(O["disabled".concat(o)]).length&&p[e].forEach((function(e){t[e.data.id]=!0})),"Blocks"===o?h(t):"Templates"===o&&E(t)},__nextHasNoMarginBottom:!0}),p[e].map((function(t){var l=!O["disabled".concat(o)][t.data.id];return wp.element.createElement(n.ToggleControl,{key:t.data.id,label:wp.element.createElement(wp.element.Fragment,null,"blocks"===e?wp.element.createElement(wp.element.Fragment,null,t.data.icon&&/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{className:t.data.icon}):"",t.data.icon&&!/^dashicons/.test(t.data.icon)?wp.element.createElement("span",{dangerouslySetInnerHTML:{__html:t.data.icon}}):""," "):"",t.data.title),checked:l,onChange:function(){var e=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},O["disabled".concat(o)]);l&&!e[t.data.id]?e[t.data.id]=!0:l||void 0===e[t.data.id]||delete e[t.data.id],"Blocks"===o?h(e):"Templates"===o&&E(e)},__nextHasNoMarginBottom:!0})})))),S["show".concat(o,"PHP")]?wp.element.createElement(wp.element.Fragment,null,wp.element.createElement("div",{className:"lzb-export-textarea"},wp.element.createElement(n.TextareaControl,{className:"lzb-export-code",readOnly:!0,value:B(e),__next40pxDefaultSize:!0,__nextHasNoMarginBottom:!0})),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button",onClick:function(){!function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"blocks",t=e.charAt(0).toUpperCase()+e.slice(1);m.clipboard.writeText(B(e)).then((function(){"Blocks"===t?g(!0):"Templates"===t&&z(!0),clearTimeout(P.current[t]),P.current[t]=setTimeout((function(){"Blocks"===t?g(!1):"Templates"===t&&z(!1)}),350)}))}(e)}},(0,t.__)("Copy to Clipboard","lazy-blocks"),j["copied".concat(o)]?wp.element.createElement(l,null):""))):wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("a",{className:"button button-primary",disabled:c,href:T(e)},(0,t.__)("Export JSON","lazy-blocks")),wp.element.createElement("button",{className:"button",onClick:function(){"Blocks"===o?s(!0):"Templates"===o&&b(!0)},disabled:c},(0,t.__)("Generate PHP","lazy-blocks"))))}return wp.element.createElement("div",{className:"metabox-holder"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{id:"normal-sortables"},wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Blocks","lazy-blocks"))),p.blocks&&p.blocks.length?wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the blocks you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("blocks")):wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("There are no blocks to export.")))),p.templates&&p.templates.length?wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Export Templates","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the templates you would like to export and then select your export method. Use the download button to export to a .json file which you can then import to another Lazy Blocks installation. Use the generate button to export to PHP code which you can place in your theme.")),C("templates"))):null),wp.element.createElement("div",{className:"postbox-container"},wp.element.createElement("div",{className:"postbox"},wp.element.createElement("h2",{className:"hndle"},wp.element.createElement("span",null,(0,t.__)("Import","lazy-blocks"))),wp.element.createElement("div",{className:"inside"},wp.element.createElement("p",null,(0,t.__)("Select the Lazy Blocks JSON file you want to import. When you click the import button below, Lazy Blocks will import the blocks.")),wp.element.createElement("form",{method:"post",encType:"multipart/form-data"},wp.element.createElement("div",{className:"lzb-export-select-items"},wp.element.createElement("input",{type:"file",name:"lzb_tools_import_json"})),wp.element.createElement("input",{type:"hidden",name:"lzb_tools_import_nonce",value:p.nonce}),wp.element.createElement("div",{className:"lzb-export-buttons"},wp.element.createElement("button",{className:"button button-primary"},(0,t.__)("Import","lazy-blocks"))))))))))}window.addEventListener("load",(function(){(0,e.render)(wp.element.createElement(u,null),document.querySelector(".lazyblocks-tools-page"))}))})();

  • lazy-blocks/trunk/classes/class-blocks.php

    r3346570 r3367712  
    368368                        array(
    369369                            'lazyblocks_export_block' => intval( $post->ID ),
     370                            'lazyblocks_export_nonce' => wp_create_nonce( 'lzb-export-blocks-nonce' ),
    370371                        )
    371372                    ),
    … …  
    14031404     * @param string $code - user code string.
    14041405     * @param array  $attributes - block attributes.
     1406     * @param array  $context - block context.
    14051407     *
    14061408     * @return string
    … …  
    17331735
    17341736        // add filter for block output.
    1735         $result = apply_filters( 'lzb/block_render/output', $result, $attributes, $render_location, $block, $context );
     1737        $result = apply_filters( 'lzb/block_render/output', $result, $attributes, $render_location, $block, $context, $content );
    17361738        // phpcs:ignore
    1737         $result = apply_filters( $block['slug'] . '/' . $render_location . '_output', $result, $attributes, $block, $context );
     1739        $result = apply_filters( $block['slug'] . '/' . $render_location . '_output', $result, $attributes, $block, $context, $content );
    17381740        // phpcs:ignore
    1739         $result = apply_filters( $block['slug'] . '/output', $result, $attributes, $render_location, $block, $context );
     1741        $result = apply_filters( $block['slug'] . '/output', $result, $attributes, $render_location, $block, $context, $content );
    17401742
    17411743        return $result;

  • lazy-blocks/trunk/classes/class-tools.php

    r3346570 r3367712  
    246246        $templates = lazyblocks()->templates()->get_templates( true, true );
    247247        $data      = array(
    248             'blocks'    => array(),
    249             'templates' => array(),
    250             'nonce'     => wp_create_nonce( 'lzb-tools-import-nonce' ),
     248            'blocks'       => array(),
     249            'templates'    => array(),
     250            'nonce'        => wp_create_nonce( 'lzb-tools-import-nonce' ),
     251            'export_nonce' => wp_create_nonce( 'lzb-export-blocks-nonce' ),
    251252        );
    252253
    … …  
    474475     */
    475476    public function maybe_export_json() {
     477        // Check if any export parameters are present.
     478        $has_export_params = isset( $_GET['lazyblocks_export_block'] ) ||
     479                            isset( $_GET['lazyblocks_export_blocks'] ) ||
     480                            isset( $_GET['lazyblocks_export_templates'] ) ||
     481                            isset( $_GET['lazyblocks_export_nonce'] );
     482
     483        // Exit early if no export parameters - this is the normal case on every admin page.
     484        if ( ! $has_export_params ) {
     485            return;
     486        }
     487
     488        // Verify nonce for CSRF protection - required for all export operations.
     489        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     490        $nonce = isset( $_GET['lazyblocks_export_nonce'] ) ? sanitize_key( $_GET['lazyblocks_export_nonce'] ) : false;
     491
     492        if ( ! $nonce || ! wp_verify_nonce( $nonce, 'lzb-export-blocks-nonce' ) ) {
     493            wp_die( esc_html__( 'Export permission denied.', 'lazy-blocks' ) );
     494        }
     495
    476496        $block_id  = filter_input( INPUT_GET, 'lazyblocks_export_block', FILTER_SANITIZE_NUMBER_INT );
    477497        $block_ids = filter_input_array(
    … …  
    497517        $template_ids = is_array( $template_ids ) && isset( $template_ids['lazyblocks_export_templates'] ) ? $template_ids['lazyblocks_export_templates'] : array();
    498518
    499         if ( isset( $block_id ) && current_user_can( 'read_lazyblock', $block_id ) ) {
     519        // Security: Only administrators with edit_lazyblocks capability can export.
     520        // This prevents contributors from bypassing UI restrictions via direct URL access.
     521        if ( isset( $block_id ) && current_user_can( 'edit_lazyblocks' ) ) {
    500522            $this->export_json( array( $block_id ) );
    501         } elseif ( isset( $block_ids ) && ! empty( $block_ids ) && current_user_can( 'read_lazyblock', $block_ids[0] ) ) {
     523        } elseif ( isset( $block_ids ) && ! empty( $block_ids ) && current_user_can( 'edit_lazyblocks' ) ) {
    502524            $this->export_json( $block_ids );
    503         } elseif ( isset( $template_ids ) && ! empty( $template_ids ) && current_user_can( 'read_lazyblock', $template_ids[0] ) ) {
     525        } elseif ( isset( $template_ids ) && ! empty( $template_ids ) && current_user_can( 'edit_lazyblocks' ) ) {
    504526            $this->export_json( $template_ids, 'templates' );
    505527        }
    … …  
    668690
    669691        // Duplicate block.
    670         if ( isset( $block_id ) && current_user_can( 'read_lazyblock', $block_id ) ) {
     692        if ( isset( $block_id ) && current_user_can( 'edit_lazyblocks' ) ) {
    671693            $this->duplicate_block( $block_id );
    672694        }

  • lazy-blocks/trunk/languages/lazy-blocks.json

    r3304975 r3367712  
    99            ""
    1010         ],
     11         "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline": [
     12            ""
     13         ],
    1114         "Easily create custom blocks and custom meta fields for Gutenberg without hard coding.": [
    1215            ""
    1316         ],
    1417         "Lazy Blocks Team": [
    15             ""
    16          ],
    17          "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline": [
    1818            ""
    1919         ],
    … …  
    183183            "",
    184184            "Imported %s templates"
     185         ],
     186         "Export permission denied.": [
     187            ""
    185188         ],
    186189         "Template for these post types '%s' already exists.": [

  • lazy-blocks/trunk/languages/lazy-blocks.pot

    r3346570 r3367712  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Lazy Blocks 4.1.0\n"
     5"Project-Id-Version: Lazy Blocks 4.1.1\n"
    66"Report-Msgid-Bugs-To: https://github.com/nk-crew/lazyblocks/issues\n"
    77"Last-Translator: Lazy Blocks Team\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2025-08-18T17:07:40+00:00\n"
     12"POT-Creation-Date: 2025-09-25T09:27:58+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    1919#: classes/class-admin.php:252
    2020#: classes/class-blocks.php:187
    21 #: classes/class-blocks.php:1222
     21#: classes/class-blocks.php:1223
    2222msgid "Lazy Blocks"
     23msgstr ""
     24
     25#. Plugin URI of the plugin
     26#. Author URI of the plugin
     27#: lazy-blocks.php
     28msgid "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline"
    2329msgstr ""
    2430
    … …  
    3137#: lazy-blocks.php
    3238msgid "Lazy Blocks Team"
    33 msgstr ""
    34 
    35 #. Author URI of the plugin
    36 #: lazy-blocks.php
    37 msgid "https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline"
    3839msgstr ""
    3940
    … …  
    8889
    8990#. translators: %1$ - post title.
    90 #: classes/class-blocks.php:374
     91#: classes/class-blocks.php:375
    9192#, php-format
    9293msgid "Export “%1$s”"
    9394msgstr ""
    9495
    95 #: classes/class-blocks.php:377
    96 #: classes/class-blocks.php:412
     96#: classes/class-blocks.php:378
     97#: classes/class-blocks.php:413
    9798msgid "Export"
    9899msgstr ""
    99100
    100101#. translators: %1$ - post title.
    101 #: classes/class-blocks.php:389
     102#: classes/class-blocks.php:390
    102103#, php-format
    103104msgid "Deactivate “%1$s”"
    … …  
    105106
    106107#. translators: %1$ - post title.
    107 #: classes/class-blocks.php:389
     108#: classes/class-blocks.php:390
    108109#, php-format
    109110msgid "Activate “%1$s”"
    110111msgstr ""
    111112
    112 #: classes/class-blocks.php:393
    113 #: classes/class-blocks.php:416
     113#: classes/class-blocks.php:394
     114#: classes/class-blocks.php:417
    114115msgid "Deactivate"
    115116msgstr ""
    116117
    117 #: classes/class-blocks.php:393
    118 #: classes/class-blocks.php:414
     118#: classes/class-blocks.php:394
     119#: classes/class-blocks.php:415
    119120msgid "Activate"
    120121msgstr ""
    121122
    122 #: classes/class-blocks.php:456
     123#: classes/class-blocks.php:457
    123124#: assets/block-builder/boxes/general/index.js:179
    124125msgid "Icon"
    125126msgstr ""
    126127
    127 #: classes/class-blocks.php:458
     128#: classes/class-blocks.php:459
    128129#: assets/block-builder/boxes/general/index.js:46
    129130msgid "Slug"
    130131msgstr ""
    131132
    132 #: classes/class-blocks.php:459
     133#: classes/class-blocks.php:460
    133134#: assets/block-builder/boxes/general/index.js:94
    134135msgid "Category"
    135136msgstr ""
    136137
    137 #: classes/class-blocks.php:460
     138#: classes/class-blocks.php:461
    138139#: assets/block-builder/boxes/general/index.js:213
    139140#: assets/block-builder/boxes/wizard/index.js:276
    … …  
    249250
    250251#. translators: %s - block title.
    251 #: classes/class-tools.php:330
     252#: classes/class-tools.php:331
    252253#, php-format
    253254msgid "Block \"%s\" activated successfully."
    … …  
    255256
    256257#. translators: %s - block title.
    257 #: classes/class-tools.php:330
     258#: classes/class-tools.php:331
    258259#, php-format
    259260msgid "Block \"%s\" deactivated successfully."
    … …  
    261262
    262263#. translators: %s - number of blocks.
    263 #: classes/class-tools.php:333
     264#: classes/class-tools.php:334
    264265#, php-format
    265266msgid "Activated %s block"
    … …  
    269270
    270271#. translators: %s - number of blocks.
    271 #: classes/class-tools.php:333
     272#: classes/class-tools.php:334
    272273#, php-format
    273274msgid "Deactivated %s block"
    … …  
    276277msgstr[1] ""
    277278
    278 #: classes/class-tools.php:372
     279#: classes/class-tools.php:373
    279280msgid "No file selected"
    280281msgstr ""
    281282
    282 #: classes/class-tools.php:382
     283#: classes/class-tools.php:383
    283284msgid "Error uploading file. Please try again"
    284285msgstr ""
    285286
    286 #: classes/class-tools.php:388
     287#: classes/class-tools.php:389
    287288msgid "Incorrect file type"
    288289msgstr ""
    289290
    290 #: classes/class-tools.php:399
     291#: classes/class-tools.php:400
    291292msgid "Import file empty"
    292293msgstr ""
    293294
    294295#. translators: %s - number of blocks.
    295 #: classes/class-tools.php:438
     296#: classes/class-tools.php:439
    296297#, php-format
    297298msgid "Imported %s block"
    … …  
    301302
    302303#. translators: %s - number of templates.
    303 #: classes/class-tools.php:458
     304#: classes/class-tools.php:459
    304305#, php-format
    305306msgid "Imported %s template"
    … …  
    308309msgstr[1] ""
    309310
     311#: classes/class-tools.php:493
     312msgid "Export permission denied."
     313msgstr ""
     314
    310315#. translators: %s - post type.
    311 #: classes/class-tools.php:634
     316#: classes/class-tools.php:656
    312317#, php-format
    313318msgid "Template for these post types '%s' already exists."
    … …  
    315320
    316321#. translators: %s - post title.
    317 #: classes/class-tools.php:680
     322#: classes/class-tools.php:702
    318323#, php-format
    319324msgid "Added new block '%s'."
    320325msgstr ""
    321326
    322 #: classes/class-tools.php:711
     327#: classes/class-tools.php:733
    323328msgid "(Copy)"
    324329msgstr ""
    … …  
    439444msgstr ""
    440445
    441 #: assets/admin/tools/tools.js:117
     446#: assets/admin/tools/tools.js:122
    442447msgid "Select all"
    443448msgstr ""
    444449
    445 #: assets/admin/tools/tools.js:245
     450#: assets/admin/tools/tools.js:250
    446451msgid "Copy to Clipboard"
    447452msgstr ""
    448453
    449 #: assets/admin/tools/tools.js:261
     454#: assets/admin/tools/tools.js:266
    450455msgid "Export JSON"
    451456msgstr ""
    452457
    453 #: assets/admin/tools/tools.js:275
     458#: assets/admin/tools/tools.js:280
    454459msgid "Generate PHP"
    455460msgstr ""
    456461
    457 #: assets/admin/tools/tools.js:291
     462#: assets/admin/tools/tools.js:296
    458463msgid "Export Blocks"
    459464msgstr ""
    460465
    461 #: assets/admin/tools/tools.js:316
     466#: assets/admin/tools/tools.js:321
    462467msgid "Export Templates"
    463468msgstr ""
    464469
    465 #: assets/admin/tools/tools.js:334
    466 #: assets/admin/tools/tools.js:363
     470#: assets/admin/tools/tools.js:339
     471#: assets/admin/tools/tools.js:368
    467472msgid "Import"
    468473msgstr ""

  • lazy-blocks/trunk/lazy-blocks.php

    r3357405 r3367712  
    33 * Plugin Name:  Lazy Blocks
    44 * Description:  Easily create custom blocks and custom meta fields for Gutenberg without hard coding.
    5  * Version:      4.1.0
     5 * Version:      4.1.1
    66 * Plugin URI:   https://www.lazyblocks.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=byline
    77 * Author:       Lazy Blocks Team
    … …  
    1919
    2020if ( ! defined( 'LAZY_BLOCKS_VERSION' ) ) {
    21     define( 'LAZY_BLOCKS_VERSION', '4.1.0' );
     21    define( 'LAZY_BLOCKS_VERSION', '4.1.1' );
    2222}
    2323

  • lazy-blocks/trunk/readme.txt

    r3347329 r3367712  
    77* Tested up to: 6.8
    88* Requires PHP: 8.0
    9 * Stable tag: 4.1.0
     9* Stable tag: 4.1.1
    1010* License: GPLv2 or later
    1111* License URI: <http://www.gnu.org/licenses/gpl-2.0.html>
    … …  
    139139
    140140## Changelog
     141
     142= 4.1.1 - Sep 25, 2025 =
     143
     144* security fix: prevent unauthorized block export access
     145* added `$content` attribute to `lzb/block_render/output` filters
     146* **Pro:**
     147* fixed rendering blocks in widgets screen when Rank Math is active
    141148
    142149= 4.1.0 - Aug 18, 2025 =
Note: See TracChangeset for help on using the changeset viewer.