Changeset 3074011

Timestamp:

04/19/2024 06:29:05 PM (2 years ago)

Author:

baden03

Message:

the tag, targtag and elwrap will be filtered to only allow certain tags

Location:

jquery-collapse-o-matic/trunk

Files:

• README.md (modified) (1 diff)
• collapse-o-matic.php (modified) (8 diffs)
• readme.txt (modified) (3 diffs)

jquery-collapse-o-matic/trunk/README.md

@@ -4 +4 @@
 * Tags: collapse, expand, collapsible, expandable, expandable content, collapsable content, shortcode, hidden, hide, display, accordion, accordion, jQuery, javascript, roll-your-own, twinpictures, read me, read more, more, plugin oven
 * Requires at least: 4.9
-* Tested up to: 6.3.1
-* Stable tag: 1.8.5.5
+* Tested up to: 6.5.3
+* Stable tag: 1.8.5.6
 * Requires PHP: 7.2
 * License: GPLv2 or later

jquery-collapse-o-matic/trunk/collapse-o-matic.php

@@ -5 +5 @@
 Plugin URI: https://pluginoven.com/plugins/collapse-o-matic/
 Description: Collapse-O-Matic adds an [expand] shortcode that wraps content into a lovely, jQuery collapsible div.
-Version: 1.8.5.5
+Version: 1.8.5.6
 Author: twinpictures, baden03
 Author URI: https://twinpictures.de/
@@ -30 +30 @@
      * @var string
      */
-    var $version = '1.8.5.5';
+    var $version = '1.8.5.6';
 
     /**
@@ -291 +291 @@
         $swapout_arr = array('<', '>', '[', ']');
 
+        $allowed_tags = [
+            "div", "span", "p", "li", "ul", "ol", "strong", "b",
+            "em", "i", "u", "h1", "h2", "h3", "h4", "h5", "h6",
+            "blockquote", "a", "img", "tr", "td", "th", "caption", "small", "cite", "q"
+        ];
+
+        
+        if(!empty($tag)){
+            $tag = $this->filter_allowed_tags( $tag, $allowed_tags );
+        }
+
         $title = do_shortcode(str_replace($placeholder_arr, $swapout_arr, $title));
         if($swaptitle){
@@ -302 +313 @@
         }
         //need to check for a few versions, because of new option setting. can be removed after a few revisiosn.
-        if(empty($targtag)){
+        if(!empty($targtag)){
+            $targtag = $this->filter_allowed_tags( $targtag, $allowed_tags );
+        }
+        else{
             $targtag = 'div';
         }
+
         
         if(!empty($elwraptag)){
@@ -311 +326 @@
                 $ewclass = 'class="'.esc_attr($elwrapclass).'"';
             }
-            $ewo = '<'. esc_attr( $elwraptag ) .' '.$ewclass.'>';
-            $ewc = '</'. esc_attr( $elwraptag ) .'>';
+            $elwraptag = $this->filter_allowed_tags( $elwraptag, $allowed_tags );
+
+            $ewo = '<'. $elwraptag .' '.$ewclass.'>';
+            $ewc = '</'. $elwraptag .'>';
         }
 
@@ -336 +353 @@
             }
             if($excerptpos == 'above-trigger'){
-                $nibble = '<'. esc_attr( $excerpttag ) .' id="excerpt-'.esc_attr($id).'" class="'.esc_attr($excerptclass).'">' . $excerpt . '</'. esc_attr( $excerpttag ) .'>';
+                $nibble = '<'. esc_attr( $excerpttag ) .' id="excerpt-'.esc_attr($id).'" class="'.esc_attr($excerptclass).'">'. esc_attr( $excerpt ).'</'. esc_attr( $excerpttag ) .'>';
             }
             else{
@@ -346 +363 @@
                 $swapexcerpt = do_shortcode($swapexcerpt);
                 $swapexcerpt = apply_filters( 'colomat_swapexcerpt', $swapexcerpt );
-                $nibble .= '<'. esc_attr( $excerpttag ) .' id="swapexcerpt-'.esc_attr($id).'" style="display:none;">' . $swapexcerpt . '</'. esc_attr( $excerpttag ) .'>';
+                $nibble .= '<'. esc_attr( $excerpttag ) .' id="swapexcerpt-'.esc_attr($id).'" style="display:none;">'. esc_attr( $swapexcerpt ).'</'. esc_attr( $excerpttag ) .'>';
             }
         }
@@ -920 +937 @@
     }
 
+    /**
+     * Filter $input to allow only tags from $allowed_tags array
+     */
+    function filter_allowed_tags( $input, $allowed_tags ) {
+        $pattern = '/\A(' . implode( '|', $allowed_tags ) . ')\Z/';
+        if ( preg_match( $pattern, $input, $matches ) ) {
+            $output = $matches[0];
+        } else {
+            $output = '';
+        }
+
+        return $output;
+    }
+
 } // end class WP_Collapse_O_Matic
 

jquery-collapse-o-matic/trunk/readme.txt

@@ -5 +5 @@
 Tags: collapse, expand, collapsible, expandable, expandable content, collapsable content, shortcode, hidden, hide, display, accordion, accordion, jQuery, javascript, roll-your-own, twinpictures, read me, read more, more, plugin oven
 Requires at least: 4.9
-Tested up to: 6.3.1
-Stable tag: 1.8.5.5
+Tested up to: 6.5.2
+Stable tag: 1.8.5.6
 Requires PHP: 7.2
 License: GPLv2 or later
@@ -51 +51 @@
 
 == Changelog ==
+
+= 1.8.5.6 =
+* the tag, targtag and elwrap will be filtered to only allow certain tags
 
 = 1.8.5.5 =
@@ -433 +436 @@
 
 == Upgrade Notice ==
-* removed escaping on excerpt/swapexcerpt
+* the tag, targtag and elwrap will be filtered to only allow certain tags