laoyang
eaabc7717f
原来主题里有个 custom/ 目录（custom.css / custom.js / custom.php）， 是给用户随手加样式的入口。问题是它位于主题目录内，而 WordPress 升级 主题的做法是把整个主题目录删掉再解压（class-theme-upgrader.php 里 clear_destination = true，随后 delete_old_theme() 递归删除）， 所以每次升级这些文件都会丢。custom.php 还会被 require， 等于在主题里留了一个执行任意 PHP 的口子。 改成后台选项： - 主题选项新增「自定义代码」组，含自定义 CSS / 自定义 JS 两个输入框 - 内容存在数据库的 kratos 选项里，与主题文件解耦，升级、重装都不影响 - 分别在主题样式和主题脚本之后加载，优先级最高 为此新增了 code 字段类型，没有复用 textarea：textarea 的 sanitizer 走 wp_kses()，CSS 的子选择器 > 和 JS 的 < 会被当成 HTML 标签剥掉， 样式会静默失效。code 类型只去掉 PHP 标签、打断 </style> 和 </script>， 其余原样保留。渲染时也不走公共的 stripslashes —— options.php 已经 wp_unslash 过，再剥一层会把 CSS 的 \f101、JS 的 \n 啃坏。 自定义 CSS 的默认值就是原来 custom.css 的内容，逐字节一致（354 字节）， 所以升级瞬间站点外观没有任何变化。清空输入框保存即可彻底去掉。 验证：真实 WP 7.1.3 / PHP 8.5.12 环境 20 条断言全过（含 DB 往返、 子选择器 / 反斜杠保真、危险内容过滤），生产选项指纹前后一致； 反向注入「默认值改空」能立刻被抓到。
290 lines
13 KiB
PHP
290 lines
13 KiB
PHP
<?php
|
||
/**
|
||
* @package Options_Framework
|
||
* @author Devin Price <devin@wptheming.com>
|
||
* @license GPL-2.0+
|
||
* @link http://wptheming.com
|
||
* @copyright 2010-2014 WP Theming
|
||
*/
|
||
|
||
class Options_Framework_Interface
|
||
{
|
||
|
||
/**
|
||
* Generates the tabs that are used in the options menu
|
||
*/
|
||
public static function optionsframework_tabs()
|
||
{
|
||
$counter = 0;
|
||
$options = &Options_Framework::_optionsframework_options();
|
||
$menu = '';
|
||
|
||
foreach ($options as $value) {
|
||
// Heading for Navigation
|
||
if ($value['type'] == "heading") {
|
||
$counter++;
|
||
$class = '';
|
||
$class = !empty($value['id']) ? $value['id'] : $value['name'];
|
||
$class = preg_replace('/[^a-zA-Z0-9._\-]/', '', strtolower($class)) . '-tab';
|
||
$menu .= '<a id="options-group-' . $counter . '-tab" class="nav-tab ' . $class . '" title="' . esc_attr($value['name']) . '" href="' . esc_attr('#options-group-' . $counter) . '">' . esc_html($value['name']) . '</a>';
|
||
}
|
||
}
|
||
|
||
return $menu;
|
||
}
|
||
|
||
/**
|
||
* Generates the options fields that are used in the form.
|
||
*/
|
||
public static function optionsframework_fields()
|
||
{
|
||
|
||
global $allowedtags;
|
||
|
||
$options_framework = new Options_Framework;
|
||
$option_name = $options_framework->get_option_name();
|
||
$settings = get_option($option_name);
|
||
$options = &Options_Framework::_optionsframework_options();
|
||
|
||
$counter = 0;
|
||
$menu = '';
|
||
|
||
foreach ($options as $value) {
|
||
|
||
$val = '';
|
||
$select_value = '';
|
||
$output = '';
|
||
|
||
// Wrap all options
|
||
if (($value['type'] != "heading") && ($value['type'] != "info") && ($value['type'] != "about")) {
|
||
|
||
// Keep all ids lowercase with no spaces
|
||
$value['id'] = preg_replace('/[^a-zA-Z0-9._\-]/', '', strtolower($value['id']));
|
||
|
||
$id = 'section-' . $value['id'];
|
||
|
||
$class = 'section';
|
||
if (isset($value['type'])) {
|
||
$class .= ' section-' . $value['type'];
|
||
}
|
||
if (isset($value['class'])) {
|
||
$class .= ' ' . $value['class'];
|
||
}
|
||
|
||
$output .= '<div id="' . esc_attr($id) . '" class="' . esc_attr($class) . '">' . "\n";
|
||
if (isset($value['name'])) {
|
||
$output .= '<h4 class="heading">' . esc_html($value['name']) . '</h4>' . "\n";
|
||
}
|
||
if ($value['type'] != 'editor') {
|
||
$output .= '<div class="option">' . "\n" . '<div class="controls">' . "\n";
|
||
} else {
|
||
$output .= '<div class="option">' . "\n" . '<div>' . "\n";
|
||
}
|
||
}
|
||
|
||
// Set default value to $val
|
||
if (isset($value['std'])) {
|
||
$val = $value['std'];
|
||
}
|
||
|
||
// If the option is already saved, override $val
|
||
if (($value['type'] != 'heading') && ($value['type'] != 'info') && ($value['type'] != "about")) {
|
||
if (isset($settings[($value['id'])])) {
|
||
$val = $settings[($value['id'])];
|
||
// Striping slashes of non-array options
|
||
if (!is_array($val)) {
|
||
$val = stripslashes($val);
|
||
}
|
||
}
|
||
}
|
||
|
||
// If there is a description save it for labels
|
||
$explain_value = '';
|
||
if (isset($value['desc'])) {
|
||
$explain_value = $value['desc'];
|
||
}
|
||
|
||
// Set the placeholder if one exists
|
||
$placeholder = '';
|
||
if (isset($value['placeholder'])) {
|
||
$placeholder = ' placeholder="' . esc_attr($value['placeholder']) . '"';
|
||
}
|
||
|
||
if (has_filter('optionsframework_' . $value['type'])) {
|
||
$output .= apply_filters('optionsframework_' . $value['type'], $option_name, $value, $val);
|
||
}
|
||
|
||
switch ($value['type']) {
|
||
|
||
// Basic text input
|
||
case 'text':
|
||
$output .= '<input id="' . esc_attr($value['id']) . '" class="of-input" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" type="text" value="' . esc_attr($val) . '"' . $placeholder . ' />';
|
||
break;
|
||
|
||
// Password input
|
||
case 'password':
|
||
$output .= '<input id="' . esc_attr($value['id']) . '" class="of-input" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" type="password" value="' . esc_attr($val) . '" />';
|
||
break;
|
||
|
||
// Textarea
|
||
case 'textarea':
|
||
$rows = '8';
|
||
|
||
if (isset($value['settings']['rows'])) {
|
||
$custom_rows = $value['settings']['rows'];
|
||
if (is_numeric($custom_rows)) {
|
||
$rows = $custom_rows;
|
||
}
|
||
}
|
||
|
||
$val = stripslashes($val);
|
||
$output .= '<textarea id="' . esc_attr($value['id']) . '" class="of-input" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" rows="' . $rows . '"' . $placeholder . '>' . esc_textarea($val) . '</textarea>';
|
||
break;
|
||
|
||
// Raw code textarea（自定义 CSS / JS 用）
|
||
// 这里必须直接读 $settings 拿原始值，不能用 $val：
|
||
// 上面的公共逻辑对所有非数组值做了 stripslashes()，那是给老版本
|
||
// WP 入库带反斜杠的历史写法留的兼容；现在 options.php 已经
|
||
// wp_unslash 过，值本身是干净的，再剥一层会把 CSS 里合法的
|
||
// 转义（content: "\f101"）和 JS 的 "\n" 啃坏。
|
||
case 'code':
|
||
$rows = '10';
|
||
|
||
if (isset($value['settings']['rows'])) {
|
||
$custom_rows = $value['settings']['rows'];
|
||
if (is_numeric($custom_rows)) {
|
||
$rows = $custom_rows;
|
||
}
|
||
}
|
||
|
||
if (isset($settings[($value['id'])])) {
|
||
$raw = $settings[($value['id'])];
|
||
} elseif (isset($value['std'])) {
|
||
$raw = $value['std'];
|
||
} else {
|
||
$raw = '';
|
||
}
|
||
if (!is_string($raw)) {
|
||
$raw = '';
|
||
}
|
||
|
||
$output .= '<textarea id="' . esc_attr($value['id']) . '" class="of-input code" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" rows="' . $rows . '"' . $placeholder . ' spellcheck="false">' . esc_textarea($raw) . '</textarea>';
|
||
break;
|
||
|
||
// Select Box
|
||
case 'select':
|
||
$output .= '<select class="of-input" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" id="' . esc_attr($value['id']) . '">';
|
||
|
||
foreach ($value['options'] as $key => $option) {
|
||
$output .= '<option' . selected($val, $key, false) . ' value="' . esc_attr($key) . '">' . esc_html($option) . '</option>';
|
||
}
|
||
$output .= '</select>';
|
||
break;
|
||
|
||
// Radio Box
|
||
case "radio":
|
||
$name = $option_name . '[' . $value['id'] . ']';
|
||
foreach ($value['options'] as $key => $option) {
|
||
$id = $option_name . '-' . $value['id'] . '-' . $key;
|
||
$output .= '<input class="of-input of-radio" type="radio" name="' . esc_attr($name) . '" id="' . esc_attr($id) . '" value="' . esc_attr($key) . '" ' . checked($val, $key, false) . ' /><label for="' . esc_attr($id) . '">' . esc_html($option) . '</label>';
|
||
}
|
||
break;
|
||
|
||
// Image Selectors
|
||
case "images":
|
||
$name = $option_name . '[' . $value['id'] . ']';
|
||
foreach ($value['options'] as $key => $option) {
|
||
$selected = '';
|
||
if ($val != '' && ($val == $key)) {
|
||
$selected = ' of-radio-img-selected';
|
||
}
|
||
$output .= '<input type="radio" id="' . esc_attr($value['id'] . '_' . $key) . '" class="of-radio-img-radio" value="' . esc_attr($key) . '" name="' . esc_attr($name) . '" ' . checked($val, $key, false) . ' />';
|
||
$output .= '<div class="of-radio-img-label">' . esc_html($key) . '</div>';
|
||
$output .= '<img src="' . esc_url($option) . '" alt="' . $option . '" class="of-radio-img-img' . $selected . '" onclick="document.getElementById(\'' . esc_attr($value['id'] . '_' . $key) . '\').checked=true;" />';
|
||
}
|
||
break;
|
||
|
||
// Checkbox
|
||
case "checkbox":
|
||
$output .= '<input id="' . esc_attr($value['id']) . '" class="checkbox of-input" type="checkbox" name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" ' . checked($val, 1, false) . ' />';
|
||
$output .= '<label class="explain" for="' . esc_attr($value['id']) . '">' . wp_kses($explain_value, $allowedtags) . '</label>';
|
||
break;
|
||
|
||
// Color picker
|
||
case "color":
|
||
$default_color = '';
|
||
if (isset($value['std'])) {
|
||
if ($val != $value['std']) {
|
||
$default_color = ' data-default-color="' . $value['std'] . '" ';
|
||
}
|
||
|
||
}
|
||
$output .= '<input name="' . esc_attr($option_name . '[' . $value['id'] . ']') . '" id="' . esc_attr($value['id']) . '" class="of-color" type="text" value="' . esc_attr($val) . '"' . $default_color . ' />';
|
||
|
||
break;
|
||
|
||
// Uploader
|
||
case "upload":
|
||
$output .= Options_Framework_Media_Uploader::optionsframework_uploader($value['id'], $val, null);
|
||
|
||
break;
|
||
|
||
case "info":
|
||
$id = '';
|
||
$class = 'section';
|
||
if (isset($value['id'])) {
|
||
$id = 'id="' . esc_attr($value['id']) . '" ';
|
||
}
|
||
if (isset($value['type'])) {
|
||
$class .= ' section-' . $value['type'];
|
||
}
|
||
if (isset($value['class'])) {
|
||
$class .= ' ' . $value['class'];
|
||
}
|
||
|
||
$output .= '<div ' . $id . 'class="' . esc_attr($class) . '">' . "\n";
|
||
if (isset($value['name'])) {
|
||
$output .= '<h4 class="heading">' . esc_html($value['name']) . '</h4>' . "\n";
|
||
}
|
||
if (isset($value['desc'])) {
|
||
$output .= $value['desc'] . "\n";
|
||
}
|
||
$output .= '</div>' . "\n";
|
||
break;
|
||
case "sendmail":
|
||
$output .= '<input type="submit" name="sendmail" class="button-secondary" value="' . __('测试邮件', 'kratos') . '">';
|
||
break;
|
||
|
||
// Heading for Navigation
|
||
case "heading":
|
||
$counter++;
|
||
if ($counter >= 2) {
|
||
$output .= '</div>' . "\n";
|
||
}
|
||
$class = '';
|
||
$class = !empty($value['id']) ? $value['id'] : $value['name'];
|
||
$class = preg_replace('/[^a-zA-Z0-9._\-]/', '', strtolower($class));
|
||
$output .= '<div id="options-group-' . $counter . '" class="group ' . $class . '">';
|
||
$output .= '<h3>' . esc_html($value['name']) . '</h3>' . "\n";
|
||
break;
|
||
}
|
||
|
||
if (($value['type'] != "heading") && ($value['type'] != "info") && ($value['type'] != "about")) {
|
||
$output .= '</div>';
|
||
if (($value['type'] != "checkbox") && ($value['type'] != "editor")) {
|
||
$output .= '<div class="explain">' . wp_kses($explain_value, $allowedtags) . '</div>' . "\n";
|
||
}
|
||
$output .= '</div></div>' . "\n";
|
||
}
|
||
|
||
echo $output;
|
||
}
|
||
|
||
// Outputs closing div if there tabs
|
||
if (Options_Framework_Interface::optionsframework_tabs() != '') {
|
||
echo '</div>';
|
||
}
|
||
}
|
||
|
||
}
|