diff --git a/composer.lock b/composer.lock index 41c8f1df..f47b69c3 100644 --- a/composer.lock +++ b/composer.lock @@ -121,16 +121,16 @@ }, { "name": "codeinwp/themeisle-sdk", - "version": "3.3.1", + "version": "3.3.11", "source": { "type": "git", "url": "https://github.com/Codeinwp/themeisle-sdk.git", - "reference": "efb66935e69935b21ad99b0e55484e611ce4549d" + "reference": "583c474d8b5a8d12592f4a78ab8fa335aaf42fc0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/efb66935e69935b21ad99b0e55484e611ce4549d", - "reference": "efb66935e69935b21ad99b0e55484e611ce4549d", + "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/583c474d8b5a8d12592f4a78ab8fa335aaf42fc0", + "reference": "583c474d8b5a8d12592f4a78ab8fa335aaf42fc0", "shasum": "" }, "require-dev": { @@ -153,7 +153,11 @@ "keywords": [ "wordpress" ], - "time": "2023-06-21T06:55:46+00:00" + "support": { + "issues": "https://github.com/Codeinwp/themeisle-sdk/issues", + "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.11" + }, + "time": "2023-12-12T10:06:27+00:00" } ], "packages-dev": [ @@ -498,5 +502,5 @@ "platform-overrides": { "php": "5.6" }, - "plugin-api-version": "2.3.0" + "plugin-api-version": "2.6.0" } diff --git a/obfx_modules/header-footer-scripts/init.php b/obfx_modules/header-footer-scripts/init.php index 79a47dfc..a4bf9af7 100644 --- a/obfx_modules/header-footer-scripts/init.php +++ b/obfx_modules/header-footer-scripts/init.php @@ -86,6 +86,56 @@ public function hooks() { $this->loader->add_action( 'wp_head', $this, 'do_header_scripts' ); $this->loader->add_action( 'wp_footer', $this, 'do_footer_scripts' ); + + /** + * Since we allow for the script meta to be unfiltered, we need to make sure that + * the current user is allowed to add unfiltered html. If not we prevent the meta from being saved or listed. + */ + $this->loader->add_filter( 'add_post_metadata', $this, 'check_post_metadata', 10, 5 ); + $this->loader->add_filter( 'update_post_metadata', $this, 'check_post_metadata', 10, 5 ); + $this->loader->add_filter( 'is_protected_meta', $this, 'is_meta_protected', 10, 3 ); + } + + /** + * Check if meta is protected. + * + * @param bool $protected Whether the key is considered protected. + * @param string $meta_key Metadata key. + * @param string $meta_type Type of object metadata is for. Accepts 'post', 'comment', 'term', 'user', or any other object type with an associated meta table. + * + * @return bool + */ + final public function is_meta_protected( $protected, $meta_key, $meta_type ) { + if ( ! in_array( $meta_key, array( 'obfx-header-scripts', 'obfx-footer-scripts' ), true ) ) { + return $protected; + } + + if ( current_user_can( 'unfiltered_html' ) ) { + return $protected; + } + + return true; + } + + /** + * @param null | bool $check Whether the meta key is allowed for update or add actions. + * @param int $object_id Object ID. + * @param string $meta_key Metadata key. + * @param mixed $meta_value Metadata value. + * @param mixed $prev_value Previous value of metadata. + * + * @return null | bool + */ + final public function check_post_metadata( $check, $object_id, $meta_key, $meta_value, $prev_value ) { + if ( ! in_array( $meta_key, array( 'obfx-header-scripts', 'obfx-footer-scripts' ), true ) ) { + return $check; + } + + if ( current_user_can( 'unfiltered_html' ) ) { + return $check; + } + + return false; } /** diff --git a/obfx_modules/template-directory/init.php b/obfx_modules/template-directory/init.php index e84c3c23..a605a386 100644 --- a/obfx_modules/template-directory/init.php +++ b/obfx_modules/template-directory/init.php @@ -211,7 +211,7 @@ public function admin_enqueue() { 'cta' => $this->get_state( 'tpc' ), 'activate' => $this->get_tcp_activation_link(), ), - 'tpcAdminURL' => ( defined( 'NEVE_COMPATIBILITY_FEATURES' ) && isset( NEVE_COMPATIBILITY_FEATURES['theme_dedicated_menu'] ) ) ? admin_url( 'admin.php?page=tiob-starter-sites' ) : admin_url( 'themes.php?page=tiob-starter-sites' ), + 'tpcAdminURL' => admin_url( 'admin.php?page=tiob-starter-sites' ), 'nonce' => wp_create_nonce( 'wp_rest' ), 'strings' => array( 'themeNotInstalled' => __( 'In order to import any starter sites, Neve theme & Templates Cloud plugin need to be installed and activated. Click the button below to install and activate Neve.', 'themeisle-companion' ),