janniclas.loosenandClaude Opus 5.5
b24eb6c3e9
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
52 lines
1.4 KiB
PHP
52 lines
1.4 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace LIT\MCP\Integrations\Divi\Pages;
|
||
|
||
use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
|
||
|
||
defined('ABSPATH') || exit;
|
||
|
||
/**
|
||
* WordPress sanitizing of Divi values (spec §5.6/§10). Because DiviSaver bypasses kses for the
|
||
* page as a whole (kses would re-serialize every untouched block, D7), every value this plugin
|
||
* writes goes through here instead – always via ValueCleaner::clean(), which also checks
|
||
* $variable(…)$ references before and after these sanitizers.
|
||
*
|
||
* Rich text and code depend on unfiltered_html like in core (ruling S4): administrators keep
|
||
* their embeds, forms and scripts; everybody else gets wp_kses_post.
|
||
*/
|
||
final class WpValueSanitizer implements ValueSanitizer
|
||
{
|
||
public function text(string $value): string
|
||
{
|
||
return sanitize_text_field($value);
|
||
}
|
||
|
||
public function html(string $value): string
|
||
{
|
||
return $this->allowsUnfilteredHtml() ? $value : wp_kses_post($value);
|
||
}
|
||
|
||
public function code(string $value): string
|
||
{
|
||
return $this->allowsUnfilteredHtml() ? $value : wp_kses_post($value);
|
||
}
|
||
|
||
public function url(string $value): string
|
||
{
|
||
return esc_url_raw(trim($value));
|
||
}
|
||
|
||
public function allowsUnfilteredHtml(): bool
|
||
{
|
||
return current_user_can('unfiltered_html');
|
||
}
|
||
|
||
public function canReadPost(int $id): bool
|
||
{
|
||
return current_user_can('read_post', $id);
|
||
}
|
||
}
|