56244f14fa
Upgrade WordPress core to version 7.0.3 and implement various security hardening measures, including improved input sanitization, enhanced URL validation for HTTP requests, and stricter CSS filtering. - Update version to 7.0.3 in version.php and about.php - Implement stricter IP address validation in wp_http_validate_url() - Add escaping to user-related error messages and authentication flows - Improve sanitization in block rendering (post-content, post-date) - Enhance CSS filtering in kses.php to handle PCRE errors - Add validation for tagName attributes in post-content block - Update emoji loader to use more secure DOM selection patterns - Enable WP_DEBUG and error logging in wp-config.php - Add new ifnex theme directory
97 lines
2.6 KiB
PHP
97 lines
2.6 KiB
PHP
<?php
|
|
/**
|
|
* Server-side rendering of the `core/post-content` block.
|
|
*
|
|
* @package WordPress
|
|
*/
|
|
|
|
/**
|
|
* Renders the `core/post-content` block on the server.
|
|
*
|
|
* @since 5.8.0
|
|
*
|
|
* @param array $attributes Block attributes.
|
|
* @param string $content Block default content.
|
|
* @param WP_Block $block Block instance.
|
|
* @return string Returns the filtered post content of the current post.
|
|
*/
|
|
function render_block_core_post_content( $attributes, $content, $block ) {
|
|
static $seen_ids = array();
|
|
|
|
if ( ! isset( $block->context['postId'] ) ) {
|
|
return '';
|
|
}
|
|
|
|
$post_id = $block->context['postId'];
|
|
|
|
if ( isset( $seen_ids[ $post_id ] ) ) {
|
|
// WP_DEBUG_DISPLAY must only be honored when WP_DEBUG. This precedent
|
|
// is set in `wp_debug_mode()`.
|
|
$is_debug = WP_DEBUG && WP_DEBUG_DISPLAY;
|
|
|
|
return $is_debug ?
|
|
// translators: Visible only in the front end, this warning takes the place of a faulty block.
|
|
__( '[block rendering halted]' ) :
|
|
'';
|
|
}
|
|
|
|
$seen_ids[ $post_id ] = true;
|
|
|
|
// When inside the main loop, we want to use queried object
|
|
// so that `the_preview` for the current post can apply.
|
|
// We force this behavior by omitting the third argument (post ID) from the `get_the_content`.
|
|
$content = get_the_content();
|
|
// Check for nextpage to display page links for paginated posts.
|
|
if ( has_block( 'core/nextpage' ) ) {
|
|
$content .= wp_link_pages( array( 'echo' => 0 ) );
|
|
}
|
|
|
|
/** This filter is documented in wp-includes/post-template.php */
|
|
$content = apply_filters( 'the_content', str_replace( ']]>', ']]>', $content ) );
|
|
unset( $seen_ids[ $post_id ] );
|
|
|
|
if ( empty( $content ) ) {
|
|
return '';
|
|
}
|
|
|
|
$tag_name = 'div';
|
|
|
|
if ( isset( $attributes['tagName'] ) && is_string( $attributes['tagName'] ) ) {
|
|
/**
|
|
* The allowed tag names match the options offered in the editor.
|
|
*
|
|
* @see packages/block-library/src/post-content/edit.js
|
|
*/
|
|
$allowed_tag_names = array( 'div', 'main', 'section', 'article' );
|
|
$normalized_tag_name = strtolower( $attributes['tagName'] );
|
|
|
|
if ( in_array( $normalized_tag_name, $allowed_tag_names, true ) ) {
|
|
$tag_name = $normalized_tag_name;
|
|
}
|
|
}
|
|
|
|
$wrapper_attributes = get_block_wrapper_attributes( array( 'class' => 'entry-content' ) );
|
|
|
|
return sprintf(
|
|
'<%1$s %2$s>%3$s</%1$s>',
|
|
$tag_name,
|
|
$wrapper_attributes,
|
|
$content
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Registers the `core/post-content` block on the server.
|
|
*
|
|
* @since 5.8.0
|
|
*/
|
|
function register_block_core_post_content() {
|
|
register_block_type_from_metadata(
|
|
__DIR__ . '/post-content',
|
|
array(
|
|
'render_callback' => 'render_block_core_post_content',
|
|
)
|
|
);
|
|
}
|
|
add_action( 'init', 'register_block_core_post_content' );
|