Edit File by line

<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Widget API: WP_Widget_Custom_HTML class

[2] Fix | Delete

[3] Fix | Delete

* @package WordPress

[4] Fix | Delete

* @subpackage Widgets

[5] Fix | Delete

* @since 4.8.1

[6] Fix | Delete

[7] Fix | Delete

[8] Fix | Delete

/**

[9] Fix | Delete

* Core class used to implement a Custom HTML widget.

[10] Fix | Delete

[11] Fix | Delete

* @since 4.8.1

[12] Fix | Delete

[13] Fix | Delete

* @see WP_Widget

[14] Fix | Delete

[15] Fix | Delete

class WP_Widget_Custom_HTML extends WP_Widget {

[16] Fix | Delete

[17] Fix | Delete

/**

[18] Fix | Delete

* Whether or not the widget has been registered yet.

[19] Fix | Delete

[20] Fix | Delete

* @since 4.9.0

[21] Fix | Delete

* @var bool

[22] Fix | Delete

[23] Fix | Delete

protected $registered = false;

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Default instance.

[27] Fix | Delete

[28] Fix | Delete

* @since 4.8.1

[29] Fix | Delete

* @var array

[30] Fix | Delete

[31] Fix | Delete

protected $default_instance = array(

[32] Fix | Delete

'title' => '',

[33] Fix | Delete

'content' => '',

[34] Fix | Delete

);

[35] Fix | Delete

[36] Fix | Delete

/**

[37] Fix | Delete

* Sets up a new Custom HTML widget instance.

[38] Fix | Delete

[39] Fix | Delete

* @since 4.8.1

[40] Fix | Delete

[41] Fix | Delete

public function __construct() {

[42] Fix | Delete

$widget_ops = array(

[43] Fix | Delete

'classname' => 'widget_custom_html',

[44] Fix | Delete

'description' => __( 'Arbitrary HTML code.' ),

[45] Fix | Delete

'customize_selective_refresh' => true,

[46] Fix | Delete

'show_instance_in_rest' => true,

[47] Fix | Delete

);

[48] Fix | Delete

$control_ops = array(

[49] Fix | Delete

'width' => 400,

[50] Fix | Delete

'height' => 350,

[51] Fix | Delete

);

[52] Fix | Delete

parent::__construct( 'custom_html', __( 'Custom HTML' ), $widget_ops, $control_ops );

[53] Fix | Delete

}

[54] Fix | Delete

[55] Fix | Delete

/**

[56] Fix | Delete

* Add hooks for enqueueing assets when registering all widget instances of this widget class.

[57] Fix | Delete

[58] Fix | Delete

* @since 4.9.0

[59] Fix | Delete

[60] Fix | Delete

* @param int $number Optional. The unique order number of this widget instance

[61] Fix | Delete

* compared to other instances of the same class. Default -1.

[62] Fix | Delete

[63] Fix | Delete

public function _register_one( $number = -1 ) {

[64] Fix | Delete

parent::_register_one( $number );

[65] Fix | Delete

if ( $this->registered ) {

[66] Fix | Delete

return;

[67] Fix | Delete

}

[68] Fix | Delete

$this->registered = true;

[69] Fix | Delete

[70] Fix | Delete

[71] Fix | Delete

* Note that the widgets component in the customizer will also do

[72] Fix | Delete

* the 'admin_print_scripts-widgets.php' action in WP_Customize_Widgets::print_scripts().

[73] Fix | Delete

[74] Fix | Delete

add_action( 'admin_print_scripts-widgets.php', array( $this, 'enqueue_admin_scripts' ) );

[75] Fix | Delete

[76] Fix | Delete

[77] Fix | Delete

* Note that the widgets component in the customizer will also do

[78] Fix | Delete

* the 'admin_footer-widgets.php' action in WP_Customize_Widgets::print_footer_scripts().

[79] Fix | Delete

[80] Fix | Delete

add_action( 'admin_footer-widgets.php', array( 'WP_Widget_Custom_HTML', 'render_control_template_scripts' ) );

[81] Fix | Delete

[82] Fix | Delete

// Note this action is used to ensure the help text is added to the end.

[83] Fix | Delete

add_action( 'admin_head-widgets.php', array( 'WP_Widget_Custom_HTML', 'add_help_text' ) );

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

/**

[87] Fix | Delete

* Filters gallery shortcode attributes.

[88] Fix | Delete

[89] Fix | Delete

* Prevents all of a site's attachments from being shown in a gallery displayed on a

[90] Fix | Delete

* non-singular template where a $post context is not available.

[91] Fix | Delete

[92] Fix | Delete

* @since 4.9.0

[93] Fix | Delete

[94] Fix | Delete

* @param array $attrs Attributes.

[95] Fix | Delete

* @return array Attributes.

[96] Fix | Delete

[97] Fix | Delete

public function _filter_gallery_shortcode_attrs( $attrs ) {

[98] Fix | Delete

if ( ! is_singular() && empty( $attrs['id'] ) && empty( $attrs['include'] ) ) {

[99] Fix | Delete

$attrs['id'] = -1;

[100] Fix | Delete

}

[101] Fix | Delete

return $attrs;

[102] Fix | Delete

}

[103] Fix | Delete

[104] Fix | Delete

/**

[105] Fix | Delete

* Outputs the content for the current Custom HTML widget instance.

[106] Fix | Delete

[107] Fix | Delete

* @since 4.8.1

[108] Fix | Delete

[109] Fix | Delete

* @global WP_Post $post Global post object.

[110] Fix | Delete

[111] Fix | Delete

* @param array $args Display arguments including 'before_title', 'after_title',

[112] Fix | Delete

* 'before_widget', and 'after_widget'.

[113] Fix | Delete

* @param array $instance Settings for the current Custom HTML widget instance.

[114] Fix | Delete

[115] Fix | Delete

public function widget( $args, $instance ) {

[116] Fix | Delete

global $post;

[117] Fix | Delete

[118] Fix | Delete

// Override global $post so filters (and shortcodes) apply in a consistent context.

[119] Fix | Delete

$original_post = $post;

[120] Fix | Delete

if ( is_singular() ) {

[121] Fix | Delete

// Make sure post is always the queried object on singular queries (not from another sub-query that failed to clean up the global $post).

[122] Fix | Delete

$post = get_queried_object();

[123] Fix | Delete

} else {

[124] Fix | Delete

// Nullify the $post global during widget rendering to prevent shortcodes from running with the unexpected context on archive queries.

[125] Fix | Delete

$post = null;

[126] Fix | Delete

}

[127] Fix | Delete

[128] Fix | Delete

// Prevent dumping out all attachments from the media library.

[129] Fix | Delete

add_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );

[130] Fix | Delete

[131] Fix | Delete

$instance = array_merge( $this->default_instance, $instance );

[132] Fix | Delete

[133] Fix | Delete

/** This filter is documented in wp-includes/widgets/class-wp-widget-pages.php */

[134] Fix | Delete

$title = apply_filters( 'widget_title', $instance['title'], $instance, $this->id_base );

[135] Fix | Delete

[136] Fix | Delete

// Prepare instance data that looks like a normal Text widget.

[137] Fix | Delete

$simulated_text_widget_instance = array_merge(

[138] Fix | Delete

$instance,

[139] Fix | Delete

array(

[140] Fix | Delete

'text' => isset( $instance['content'] ) ? $instance['content'] : '',

[141] Fix | Delete

'filter' => false, // Because wpautop is not applied.

[142] Fix | Delete

'visual' => false, // Because it wasn't created in TinyMCE.

[143] Fix | Delete

)

[144] Fix | Delete

);

[145] Fix | Delete

unset( $simulated_text_widget_instance['content'] ); // Was moved to 'text' prop.

[146] Fix | Delete

[147] Fix | Delete

/** This filter is documented in wp-includes/widgets/class-wp-widget-text.php */

[148] Fix | Delete

$content = apply_filters( 'widget_text', $instance['content'], $simulated_text_widget_instance, $this );

[149] Fix | Delete

[150] Fix | Delete

// Adds 'noopener' relationship, without duplicating values, to all HTML A elements that have a target.

[151] Fix | Delete

$content = wp_targeted_link_rel( $content );

[152] Fix | Delete

[153] Fix | Delete

/**

[154] Fix | Delete

* Filters the content of the Custom HTML widget.

[155] Fix | Delete

[156] Fix | Delete

* @since 4.8.1

[157] Fix | Delete

[158] Fix | Delete

* @param string $content The widget content.

[159] Fix | Delete

* @param array $instance Array of settings for the current widget.

[160] Fix | Delete

* @param WP_Widget_Custom_HTML $widget Current Custom HTML widget instance.

[161] Fix | Delete

[162] Fix | Delete

$content = apply_filters( 'widget_custom_html_content', $content, $instance, $this );

[163] Fix | Delete

[164] Fix | Delete

// Restore post global.

[165] Fix | Delete

$post = $original_post;

[166] Fix | Delete

remove_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );

[167] Fix | Delete

[168] Fix | Delete

// Inject the Text widget's container class name alongside this widget's class name for theme styling compatibility.

[169] Fix | Delete

$args['before_widget'] = preg_replace( '/(?<=\sclass=["\'])/', 'widget_text ', $args['before_widget'] );

[170] Fix | Delete

[171] Fix | Delete

echo $args['before_widget'];

[172] Fix | Delete

if ( ! empty( $title ) ) {

[173] Fix | Delete

echo $args['before_title'] . $title . $args['after_title'];

[174] Fix | Delete

}

[175] Fix | Delete

echo '<div class="textwidget custom-html-widget">'; // The textwidget class is for theme styling compatibility.

[176] Fix | Delete

echo $content;

[177] Fix | Delete

echo '</div>';

[178] Fix | Delete

echo $args['after_widget'];

[179] Fix | Delete

}

[180] Fix | Delete

[181] Fix | Delete

/**

[182] Fix | Delete

* Handles updating settings for the current Custom HTML widget instance.

[183] Fix | Delete

[184] Fix | Delete

* @since 4.8.1

[185] Fix | Delete

[186] Fix | Delete

* @param array $new_instance New settings for this instance as input by the user via

[187] Fix | Delete

* WP_Widget::form().

[188] Fix | Delete

* @param array $old_instance Old settings for this instance.

[189] Fix | Delete

* @return array Settings to save or bool false to cancel saving.

[190] Fix | Delete

[191] Fix | Delete

public function update( $new_instance, $old_instance ) {

[192] Fix | Delete

$instance = array_merge( $this->default_instance, $old_instance );

[193] Fix | Delete

$instance['title'] = sanitize_text_field( $new_instance['title'] );

[194] Fix | Delete

if ( current_user_can( 'unfiltered_html' ) ) {

[195] Fix | Delete

$instance['content'] = $new_instance['content'];

[196] Fix | Delete

} else {

[197] Fix | Delete

$instance['content'] = wp_kses_post( $new_instance['content'] );

[198] Fix | Delete

}

[199] Fix | Delete

return $instance;

[200] Fix | Delete

}

[201] Fix | Delete

[202] Fix | Delete

/**

[203] Fix | Delete

* Loads the required scripts and styles for the widget control.

[204] Fix | Delete

[205] Fix | Delete

* @since 4.9.0

[206] Fix | Delete

[207] Fix | Delete

public function enqueue_admin_scripts() {

[208] Fix | Delete

$settings = wp_enqueue_code_editor(

[209] Fix | Delete

array(

[210] Fix | Delete

'type' => 'text/html',

[211] Fix | Delete

'codemirror' => array(

[212] Fix | Delete

'indentUnit' => 2,

[213] Fix | Delete

'tabSize' => 2,

[214] Fix | Delete

[215] Fix | Delete

)

[216] Fix | Delete

);

[217] Fix | Delete

[218] Fix | Delete

wp_enqueue_script( 'custom-html-widgets' );

[219] Fix | Delete

wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) );

[220] Fix | Delete

[221] Fix | Delete

if ( empty( $settings ) ) {

[222] Fix | Delete

$settings = array(

[223] Fix | Delete

'disabled' => true,

[224] Fix | Delete

);

[225] Fix | Delete

}

[226] Fix | Delete

wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings ) ), 'after' );

[227] Fix | Delete

[228] Fix | Delete

$l10n = array(

[229] Fix | Delete

'errorNotice' => array(

[230] Fix | Delete

/* translators: %d: Error count. */

[231] Fix | Delete

'singular' => _n( 'There is %d error which must be fixed before you can save.', 'There are %d errors which must be fixed before you can save.', 1 ),

[232] Fix | Delete

/* translators: %d: Error count. */

[233] Fix | Delete

'plural' => _n( 'There is %d error which must be fixed before you can save.', 'There are %d errors which must be fixed before you can save.', 2 ),

[234] Fix | Delete

// @todo This is lacking, as some languages have a dedicated dual form. For proper handling of plurals in JS, see #20491.

[235] Fix | Delete

[236] Fix | Delete

);

[237] Fix | Delete

wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n ) ), 'after' );

[238] Fix | Delete

}

[239] Fix | Delete

[240] Fix | Delete

/**

[241] Fix | Delete

* Outputs the Custom HTML widget settings form.

[242] Fix | Delete

[243] Fix | Delete

* @since 4.8.1

[244] Fix | Delete

* @since 4.9.0 The form contains only hidden sync inputs. For the control UI, see `WP_Widget_Custom_HTML::render_control_template_scripts()`.

[245] Fix | Delete

[246] Fix | Delete

* @see WP_Widget_Custom_HTML::render_control_template_scripts()

[247] Fix | Delete

[248] Fix | Delete

* @param array $instance Current instance.

[249] Fix | Delete

[250] Fix | Delete

public function form( $instance ) {

[251] Fix | Delete

$instance = wp_parse_args( (array) $instance, $this->default_instance );

[252] Fix | Delete

[253] Fix | Delete

<input id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" class="title sync-input" type="hidden" value="<?php echo esc_attr( $instance['title'] ); ?>" />

[254] Fix | Delete

<textarea id="<?php echo $this->get_field_id( 'content' ); ?>" name="<?php echo $this->get_field_name( 'content' ); ?>" class="content sync-input" hidden><?php echo esc_textarea( $instance['content'] ); ?></textarea>

[255] Fix | Delete

<?php

[256] Fix | Delete

}

[257] Fix | Delete

[258] Fix | Delete

/**

[259] Fix | Delete

* Render form template scripts.

[260] Fix | Delete

[261] Fix | Delete

* @since 4.9.0

[262] Fix | Delete

[263] Fix | Delete

public static function render_control_template_scripts() {

[264] Fix | Delete

[265] Fix | Delete

[266] Fix | Delete

<# var elementIdPrefix = 'el' + String( Math.random() ).replace( /\D/g, '' ) + '_' #>

[267] Fix | Delete

<p>

[268] Fix | Delete

[269] Fix | Delete

[270] Fix | Delete

</p>

[271] Fix | Delete

[272] Fix | Delete

<p>

[273] Fix | Delete

[274] Fix | Delete

[275] Fix | Delete

</p>

[276] Fix | Delete

[277] Fix | Delete

<?php if ( ! current_user_can( 'unfiltered_html' ) ) : ?>

[278] Fix | Delete

<?php

[279] Fix | Delete

$probably_unsafe_html = array( 'script', 'iframe', 'form', 'input', 'style' );

[280] Fix | Delete

$allowed_html = wp_kses_allowed_html( 'post' );

[281] Fix | Delete

$disallowed_html = array_diff( $probably_unsafe_html, array_keys( $allowed_html ) );

[282] Fix | Delete

[283] Fix | Delete

<?php if ( ! empty( $disallowed_html ) ) : ?>

[284] Fix | Delete

<# if ( data.codeEditorDisabled ) { #>

[285] Fix | Delete

<p>

[286] Fix | Delete

<?php _e( 'Some HTML tags are not permitted, including:' ); ?>

[287] Fix | Delete

<code><?php echo implode( '</code>, <code>', $disallowed_html ); ?></code>

[288] Fix | Delete

</p>

[289] Fix | Delete

<# } #>

[290] Fix | Delete

<?php endif; ?>

[291] Fix | Delete

<?php endif; ?>

[292] Fix | Delete

[293] Fix | Delete

[294] Fix | Delete

</script>

[295] Fix | Delete

<?php

[296] Fix | Delete

}

[297] Fix | Delete

[298] Fix | Delete

/**

[299] Fix | Delete

* Add help text to widgets admin screen.

[300] Fix | Delete

[301] Fix | Delete

* @since 4.9.0

[302] Fix | Delete

[303] Fix | Delete

public static function add_help_text() {

[304] Fix | Delete

$screen = get_current_screen();

[305] Fix | Delete

[306] Fix | Delete

$content = '<p>';

[307] Fix | Delete

$content .= __( 'Use the Custom HTML widget to add arbitrary HTML code to your widget areas.' );

[308] Fix | Delete

$content .= '</p>';

[309] Fix | Delete

[310] Fix | Delete

if ( 'false' !== wp_get_current_user()->syntax_highlighting ) {

[311] Fix | Delete

$content .= '<p>';

[312] Fix | Delete

$content .= sprintf(

[313] Fix | Delete

/* translators: 1: Link to user profile, 2: Additional link attributes, 3: Accessibility text. */

[314] Fix | Delete

__( 'The edit field automatically highlights code syntax. You can disable this in your <a href="%1$s" %2$s>user profile%3$s</a> to work in plain text mode.' ),

[315] Fix | Delete

esc_url( get_edit_profile_url() ),

[316] Fix | Delete

'class="external-link" target="_blank"',

[317] Fix | Delete

sprintf(

[318] Fix | Delete

'<span class="screen-reader-text"> %s</span>',

[319] Fix | Delete

/* translators: Hidden accessibility text. */

[320] Fix | Delete

__( '(opens in a new tab)' )

[321] Fix | Delete

)

[322] Fix | Delete

);

[323] Fix | Delete

$content .= '</p>';

[324] Fix | Delete

[325] Fix | Delete

$content .= '<p id="editor-keyboard-trap-help-1">' . __( 'When using a keyboard to navigate:' ) . '</p>';

[326] Fix | Delete

$content .= '<ul>';

[327] Fix | Delete

$content .= '<li id="editor-keyboard-trap-help-2">' . __( 'In the editing area, the Tab key enters a tab character.' ) . '</li>';

[328] Fix | Delete

$content .= '<li id="editor-keyboard-trap-help-3">' . __( 'To move away from this area, press the Esc key followed by the Tab key.' ) . '</li>';

[329] Fix | Delete

$content .= '<li id="editor-keyboard-trap-help-4">' . __( 'Screen reader users: when in forms mode, you may need to press the Esc key twice.' ) . '</li>';

[330] Fix | Delete

$content .= '</ul>';

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

$screen->add_help_tab(

[334] Fix | Delete

array(

[335] Fix | Delete

'id' => 'custom_html_widget',

[336] Fix | Delete

'title' => __( 'Custom HTML Widget' ),

[337] Fix | Delete

'content' => $content,

[338] Fix | Delete

)

[339] Fix | Delete

);

[340] Fix | Delete

}

[341] Fix | Delete

}

[342] Fix | Delete

[343] Fix | Delete