` blocks.
- //
- $text = preg_replace_callback( '{
- (?:\n\n|\A\n?)
- ( # $1 = the code block -- one or more lines, starting with a space/tab
- (?>
- [ ]{' . $this->tab_width . '} # Lines must start with a tab or a tab-width of spaces
- .*\n+
- )+
- )
- ((?=^[ ]{0,' . $this->tab_width . '}\S)|\Z) # Lookahead for non-space at line-start, or end of doc
- }xm', array( &$this, '_doCodeBlocks_callback' ), $text );
-
- return $text;
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _doCodeBlocks_callback( $matches ) {
-
- $codeblock = $matches[1];
-
- $codeblock = $this->outdent( $codeblock );
- $codeblock = htmlspecialchars( $codeblock, ENT_NOQUOTES );
-
- // trim leading newlines and trailing newlines
- $codeblock = preg_replace( '/\A\n+|\n+\z/', '', $codeblock );
-
- $codeblock = "$codeblock\n
";
-
- return "\n\n" . $this->hashBlock( $codeblock ) . "\n\n";
- }
-
- /**
- * @param $code
- *
- * @return string
- */
- public function makeCodeSpan( $code ) {
-
- //
- // Create a code span markup for $code. Called from handleSpanToken.
- //
- $code = htmlspecialchars( trim( $code ), ENT_NOQUOTES );
-
- return $this->hashPart( "$code" );
- }
-
- public $em_relist = array(
- '' => '(?:(? '(?<=\S|^)(? '(?<=\S|^)(? '(?:(? '(?<=\S|^)(? '(?<=\S|^)(? '(?:(? '(?<=\S|^)(? '(?<=\S|^)(?em_relist as $em => $em_re ) {
- foreach ( $this->strong_relist as $strong => $strong_re ) {
- // Construct list of allowed token expressions.
- $token_relist = array();
- if ( isset( $this->em_strong_relist["$em$strong"] ) ) {
- $token_relist[] = $this->em_strong_relist["$em$strong"];
- }
- $token_relist[] = $em_re;
- $token_relist[] = $strong_re;
-
- // Construct master expression from list.
- $token_re = '{(' . implode( '|', $token_relist ) . ')}';
- $this->em_strong_prepared_relist["$em$strong"] = $token_re;
- }
- }
- }
-
- /**
- * @param $text
- *
- * @return string
- */
- public function doItalicsAndBold( $text ) {
-
- $token_stack = array( '' );
- $text_stack = array( '' );
- $em = '';
- $strong = '';
- $tree_char_em = false;
-
- while ( 1 ) {
- //
- // Get prepared regular expression for seraching emphasis tokens
- // in current context.
- //
- $token_re = $this->em_strong_prepared_relist["$em$strong"];
-
- //
- // Each loop iteration search for the next emphasis token.
- // Each token is then passed to handleSpanToken.
- //
- $parts = preg_split( $token_re, $text, 2, PREG_SPLIT_DELIM_CAPTURE );
- $text_stack[0] .= $parts[0];
- $token =& $parts[1];
- $text =& $parts[2];
-
- if ( empty( $token ) ) {
- // Reached end of text span: empty stack without emitting.
- // any more emphasis.
- while ( $token_stack[0] ) {
- $text_stack[1] .= array_shift( $token_stack );
- $text_stack[0] .= array_shift( $text_stack );
- }
- break;
- }
-
- $token_len = strlen( $token );
- if ( $tree_char_em ) {
- // Reached closing marker while inside a three-char emphasis.
- if ( $token_len == 3 ) {
- // Three-char closing marker, close em and strong.
- array_shift( $token_stack );
- $span = array_shift( $text_stack );
- $span = $this->runSpanGamut( $span );
- $span = "$span";
- $text_stack[0] .= $this->hashPart( $span );
- $em = '';
- $strong = '';
- } else {
- // Other closing marker: close one em or strong and
- // change current token state to match the other
- $token_stack[0] = str_repeat( $token[0], 3 - $token_len );
- $tag = $token_len == 2 ? 'strong' : 'em';
- $span = $text_stack[0];
- $span = $this->runSpanGamut( $span );
- $span = "<$tag>$span";
- $text_stack[0] = $this->hashPart( $span );
- $$tag = '';
- // $$tag stands for $em or $strong
- }//end if
- $tree_char_em = false;
- } elseif ( $token_len == 3 ) {
- if ( $em ) {
- // Reached closing marker for both em and strong.
- // Closing strong marker:
- for ( $i = 0; $i < 2; ++ $i ) {
- $shifted_token = array_shift( $token_stack );
- $tag = strlen( $shifted_token ) == 2 ? 'strong' : 'em';
- $span = array_shift( $text_stack );
- $span = $this->runSpanGamut( $span );
- $span = "<$tag>$span";
- $text_stack[0] .= $this->hashPart( $span );
- $$tag = '';
- // $$tag stands for $em or $strong
- }
- } else {
- // Reached opening three-char emphasis marker. Push on token
- // stack; will be handled by the special condition above.
- $em = $token[0];
- $strong = "$em$em";
- array_unshift( $token_stack, $token );
- array_unshift( $text_stack, '' );
- $tree_char_em = true;
- }//end if
- } elseif ( $token_len == 2 ) {
- if ( $strong ) {
- // Unwind any dangling emphasis marker:
- if ( strlen( $token_stack[0] ) == 1 ) {
- $text_stack[1] .= array_shift( $token_stack );
- $text_stack[0] .= array_shift( $text_stack );
- }
- // Closing strong marker:
- array_shift( $token_stack );
- $span = array_shift( $text_stack );
- $span = $this->runSpanGamut( $span );
- $span = "$span";
- $text_stack[0] .= $this->hashPart( $span );
- $strong = '';
- } else {
- array_unshift( $token_stack, $token );
- array_unshift( $text_stack, '' );
- $strong = $token;
- }
- } else {
- // Here $token_len == 1
- if ( $em ) {
- if ( strlen( $token_stack[0] ) == 1 ) {
- // Closing emphasis marker:
- array_shift( $token_stack );
- $span = array_shift( $text_stack );
- $span = $this->runSpanGamut( $span );
- $span = "$span";
- $text_stack[0] .= $this->hashPart( $span );
- $em = '';
- } else {
- $text_stack[0] .= $token;
- }
- } else {
- array_unshift( $token_stack, $token );
- array_unshift( $text_stack, '' );
- $em = $token;
- }
- }//end if
- }//end while
-
- return $text_stack[0];
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function doBlockQuotes( $text ) {
-
- $text = preg_replace_callback( '/
- ( # Wrap whole match in $1
- (?>
- ^[ ]*>[ ]? # ">" at the start of a line
- .+\n # rest of the first line
- (.+\n)* # subsequent consecutive lines
- \n* # blanks
- )+
- )
- /xm', array( &$this, '_doBlockQuotes_callback' ), $text );
-
- return $text;
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _doBlockQuotes_callback( $matches ) {
-
- $bq = $matches[1];
- // trim one level of quoting - trim whitespace-only lines
- $bq = preg_replace( '/^[ ]*>[ ]?|^[ ]+$/m', '', $bq );
- $bq = $this->runBlockGamut( $bq );
- // recurse
- $bq = preg_replace( '/^/m', ' ', $bq );
- // These leading spaces cause problem with content,
- // so we need to fix that:
- $bq = preg_replace_callback( '{(\s*.+?
)}sx', array( &$this, '_doBlockQuotes_callback2' ), $bq );
-
- return "\n" . $this->hashBlock( "\n$bq\n
" ) . "\n\n";
- }
-
- /**
- * @param $matches
- *
- * @return mixed
- */
- public function _doBlockQuotes_callback2( $matches ) {
-
- $pre = $matches[1];
- $pre = preg_replace( '/^ /m', '', $pre );
-
- return $pre;
- }
-
- /**
- * @param $text
- *
- * @return string
- */
- public function formParagraphs( $text ) {
-
- //
- // Params:
- // $text - string to process with html tags
- //
- // Strip leading and trailing lines:
- $text = preg_replace( '/\A\n+|\n+\z/', '', $text );
-
- $grafs = preg_split( '/\n{2,}/', $text, - 1, PREG_SPLIT_NO_EMPTY );
-
- //
- // Wrap
tags and unhashify HTML blocks
- //
- foreach ( $grafs as $key => $value ) {
- if ( ! preg_match( '/^B\x1A[0-9]+B$/', $value ) ) {
- // Is a paragraph.
- $value = $this->runSpanGamut( $value );
- $value = preg_replace( '/^([ ]*)/', '
', $value );
- $value .= '
';
- $grafs[ $key ] = $this->unhash( $value );
- } else {
- // Is a block.
- // Modify elements of @grafs in-place...
- $graf = $value;
- $block = $this->html_hashes[ $graf ];
- $graf = $block;
- // if (preg_match('{
- // \A
- // ( # $1 = tag
- //
]*
- // \b
- // markdown\s*=\s* ([\'"]) # $2 = attr quote char
- // 1
- // \2
- // [^>]*
- // >
- // )
- // ( # $3 = contents
- // .*
- // )
- // (
) # $4 = closing tag
- // \z
- // }xs', $block, $matches))
- // {
- // list(, $div_open, , $div_content, $div_close) = $matches;
- //
- // # We can't call Markdown(), because that resets the hash;
- // # that initialization code should be pulled into its own sub, though.
- // $div_content = $this->hashHTMLBlocks($div_content);
- //
- // # Run document gamut methods on the content.
- // foreach ($this->document_gamut as $method => $priority) {
- // $div_content = $this->$method($div_content);
- // }
- //
- // $div_open = preg_replace(
- // '{\smarkdown\s*=\s*([\'"]).+?\1}', '', $div_open);
- //
- // $graf = $div_open . "\n" . $div_content . "\n" . $div_close;
- // }
- $grafs[ $key ] = $graf;
- }//end if
- }//end foreach
-
- return implode( "\n\n", $grafs );
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function encodeAttribute( $text ) {
-
- //
- // Encode text for a double-quoted HTML attribute. This function
- // is *not* suitable for attributes enclosed in single quotes.
- //
- $text = $this->encodeAmpsAndAngles( $text );
- $text = str_replace( '"', '"', $text );
-
- return $text;
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function encodeAmpsAndAngles( $text ) {
-
- //
- // Smart processing for ampersands and angle brackets that need to
- // be encoded. Valid character entities are left alone unless the
- // no-entities mode is set.
- //
- if ( $this->no_entities ) {
- $text = str_replace( '&', '&', $text );
- } else {
- // Ampersand-encoding based entirely on Nat Irons's Amputator
- // MT plugin:
- $text = preg_replace( '/&(?!#?[xX]?(?:[0-9a-fA-F]+|\w+);)/', '&', $text );
- }
- // Encode remaining <'s
- $text = str_replace( '<', '<', $text );
-
- return $text;
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function doAutoLinks( $text ) {
-
- $text = preg_replace_callback( '{<((https?|ftp|dict):[^\'">\s]+)>}i', array(
- &$this,
- '_doAutoLinks_url_callback',
- ), $text );
-
- // Email addresses:
- $text = preg_replace_callback( '{
- <
- (?:mailto:)?
- (
- (?:
- [-!#$%&\'*+/=?^_`.{|}~\w\x80-\xFF]+
- |
- ".*?"
- )
- \@
- (?:
- [-a-z0-9\x80-\xFF]+(\.[-a-z0-9\x80-\xFF]+)*\.[a-z]+
- |
- \[[\d.a-fA-F:]+\] # IPv4 & IPv6
- )
- )
- >
- }xi', array( &$this, '_doAutoLinks_email_callback' ), $text );
- $text = preg_replace_callback( '{<(tel:([^\'">\s]+))>}i', array(
- &$this,
- '_doAutoLinks_tel_callback',
- ), $text );
-
- return $text;
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _doAutoLinks_tel_callback( $matches ) {
-
- $url = $this->encodeAttribute( $matches[1] );
- $tel = $this->encodeAttribute( $matches[2] );
- $link = "$tel";
-
- return $this->hashPart( $link );
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _doAutoLinks_url_callback( $matches ) {
-
- $url = $this->encodeAttribute( $matches[1] );
- $link = "$url";
-
- return $this->hashPart( $link );
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _doAutoLinks_email_callback( $matches ) {
-
- $address = $matches[1];
- $link = $this->encodeEmailAddress( $address );
-
- return $this->hashPart( $link );
- }
-
- /**
- * @param $addr
- *
- * @return string
- */
- public function encodeEmailAddress( $addr ) {
-
- //
- // Input: an email address, e.g. "foo@example.com"
- //
- // Output: the email address as a mailto link, with each character
- // of the address encoded as either a decimal or hex entity, in
- // the hopes of foiling most address harvesting spam bots. E.g.:
- //
- // foo@exampl
- // e.com
- //
- // Based by a filter by Matthew Wickline, posted to BBEdit-Talk.
- // With some optimizations by Milian Wolff.
- //
- $addr = 'mailto:' . $addr;
- $chars = preg_split( '/(? $char ) {
- $ord = ord( $char );
- // Ignore non-ascii chars.
- if ( $ord < 128 ) {
- $r = ( $seed * ( 1 + $key ) ) % 100;
- // Pseudo-random function.
- // roughly 10% raw, 45% hex, 45% dec
- // '@' *must* be encoded. I insist.
- if ( $r > 90 && $char != '@' ) { /* do nothing */
- } elseif ( $r < 45 ) {
- $chars[ $key ] = '&#x' . dechex( $ord ) . ';';
- } else {
- $chars[ $key ] = '&#' . $ord . ';';
- }
- }
- }
-
- $addr = implode( '', $chars );
- $text = implode( '', array_slice( $chars, 7 ) );
- // text without `mailto:`
- $addr = "$text";
-
- return $addr;
- }
-
- /**
- * @param $str
- *
- * @return string
- */
- public function parseSpan( $str ) {
-
- //
- // Take the string $str and parse it into tokens, hashing embeded HTML,
- // escaped characters and handling code spans.
- //
- $output = '';
-
- $span_re = '{
- (
- \\\\' . $this->escape_chars_re . '
- |
- (?no_markup ? '' : '
- |
- # comment
- |
- <\?.*?\?> | <%.*?%> # processing instruction
- |
- <[!$]?[-a-zA-Z0-9:_]+ # regular tags
- (?>
- \s
- (?>[^"\'>]+|"[^"]*"|\'[^\']*\')*
- )?
- >
- |
- <[-a-zA-Z0-9:_]+\s*/> # xml-style empty tag
- |
- # closing tag
- ' ) . '
- )
- }xs';
-
- while ( 1 ) {
- //
- // Each loop iteration seach for either the next tag, the next
- // openning code span marker, or the next escaped character.
- // Each token is then passed to handleSpanToken.
- //
- $parts = preg_split( $span_re, $str, 2, PREG_SPLIT_DELIM_CAPTURE );
-
- // Create token from text preceding tag.
- if ( $parts[0] != '' ) {
- $output .= $parts[0];
- }
-
- // Check if we reach the end.
- if ( isset( $parts[1] ) ) {
- $output .= $this->handleSpanToken( $parts[1], $parts[2] );
- $str = $parts[2];
- } else {
- break;
- }
- }//end while
-
- return $output;
- }
-
- /**
- * @param $token
- * @param $str
- *
- * @return string
- */
- public function handleSpanToken( $token, &$str ) {
-
- //
- // Handle $token provided by parseSpan by determining its nature and
- // returning the corresponding value that should replace it.
- //
- switch ( $token[0] ) {
- case '\\':
- return $this->hashPart( '&#' . ord( $token[1] ) . ';' );
- case '`':
- // Search for end marker in remaining text.
- if ( preg_match( '/^(.*?[^`])' . preg_quote( $token ) . '(?!`)(.*)$/sm', $str, $matches ) ) {
- $str = $matches[2];
- $codespan = $this->makeCodeSpan( $matches[1] );
-
- return $this->hashPart( $codespan );
- }
-
- return $token;
- // return as text since no ending marker found.
- default:
- return $this->hashPart( $token );
- }
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function outdent( $text ) {
-
- //
- // Remove one level of line-leading tabs or spaces
- //
- return preg_replace( '/^(\t|[ ]{1,' . $this->tab_width . '})/m', '', $text );
- }
-
-
- // String length function for detab. `_initDetab` will create a function to
- // hanlde UTF-8 if the default function does not exist.
- public $utf8_strlen = 'mb_strlen';
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function detab( $text ) {
-
- //
- // Replace tabs with the appropriate amount of space.
- //
- // For each line we separate the line in blocks delemited by
- // tab characters. Then we reconstruct every line by adding the
- // appropriate number of space between each blocks.
- $text = preg_replace_callback( '/^.*\t.*$/m', array( &$this, '_detab_callback' ), $text );
-
- return $text;
- }
-
- /**
- * @param $matches
- *
- * @return string
- */
- public function _detab_callback( $matches ) {
-
- $line = $matches[0];
- $strlen = $this->utf8_strlen;
- // strlen function for UTF-8.
- // Split in blocks.
- $blocks = explode( "\t", $line );
- // Add each blocks to the line.
- $line = $blocks[0];
- unset( $blocks[0] );
- // Do not add first block twice.
- foreach ( $blocks as $block ) {
- // Calculate amount of space, insert spaces, insert block.
- $amount = $this->tab_width - $strlen( $line, 'UTF-8' ) % $this->tab_width;
- $line .= str_repeat( ' ', $amount ) . $block;
- }
-
- return $line;
- }
-
- public function _initDetab() {
-
- //
- // Check for the availability of the function in the `utf8_strlen` property
- // (initially `mb_strlen`). If the function is not available, create a
- // function that will loosely count the number of UTF-8 characters with a
- // regular expression.
- //
- if ( function_exists( $this->utf8_strlen ) ) {
- return;
- }
- $this->utf8_strlen = create_function( '$text', 'return preg_match_all(
- "/[\\\\x00-\\\\xBF]|[\\\\xC0-\\\\xFF][\\\\x80-\\\\xBF]*/",
- $text, $m);' );
- }
-
- /**
- * @param $text
- *
- * @return mixed
- */
- public function unhash( $text ) {
-
- //
- // Swap back in all the tags hashed by _HashHTMLBlocks.
- //
- return preg_replace_callback( '/(.)\x1A[0-9]+\1/', array( &$this, '_unhash_callback' ), $text );
- }
-
- /**
- * @param $matches
- *
- * @return mixed
- */
- public function _unhash_callback( $matches ) {
-
- return $this->html_hashes[ $matches[0] ];
- }
+add_filter( 'pods_admin_setup_edit_paragraph_additional_field_options', 'pods_markdown_maybe_add_field_display_option', 10, 2 );
+add_filter( 'pods_admin_setup_edit_wysiwyg_additional_field_options', 'pods_markdown_maybe_add_field_display_option', 10, 2 );
+/**
+ * Maybe add field display option for Markdown.
+ *
+ * @since 3.1.0
+ *
+ * @param array $type_options The additional field type options.
+ * @param string $type Field type.
+ *
+ * @return array The additional field type options.
+ */
+function pods_markdown_maybe_add_field_display_option(
+ $type_options,
+ $type
+) {
+ if ( ! class_exists( 'Pods__Prefixed__Parsedown' ) || ! isset( $type_options['output_options']['boolean_group'] ) ) {
+ return $type_options;
}
- /*
- PHP Markdown
- ============
-
- Description
- -----------
-
- This is a PHP translation of the original Markdown formatter written in
- Perl by John Gruber.
-
- Markdown is a text-to-HTML filter; it translates an easy-to-read /
- easy-to-write structured text format into HTML. Markdown's text format
- is mostly similar to that of plain text email, and supports features such
- as headers, *emphasis*, code blocks, blockquotes, and links.
-
- Markdown's syntax is designed not as a generic markup language, but
- specifically to serve as a front-end to (X)HTML. You can use span-level
- HTML tags anywhere in a Markdown document, and you can use block level
- HTML tags (like and
as well).
-
- For more information about Markdown's syntax, see:
-
-
-
-
- Bugs
- ----
-
- To file bug reports please send email to:
-
-
-
- Please include with your report: (1) the example input; (2) the output you
- expected; (3) the output Markdown actually produced.
-
-
- Version History
- ---------------
-
- See the readme file for detailed release notes for this version.
-
-
- Copyright and License
- ---------------------
-
- PHP Markdown
- Copyright (c) 2004-2013 Michel Fortin
-
- All rights reserved.
-
- Based on Markdown
- Copyright (c) 2003-2006 John Gruber
-
- All rights reserved.
-
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are
- met:
-
- * Redistributions of source code must retain the above copyright notice,
- this list of conditions and the following disclaimer.
-
- * Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
-
- * Neither the name "Markdown" nor the names of its contributors may
- be used to endorse or promote products derived from this software
- without specific prior written permission.
-
- This software is provided by the copyright holders and contributors "as
- is" and any express or implied warranties, including, but not limited
- to, the implied warranties of merchantability and fitness for a
- particular purpose are disclaimed. In no event shall the copyright owner
- or contributors be liable for any direct, indirect, incidental, special,
- exemplary, or consequential damages (including, but not limited to,
- procurement of substitute goods or services; loss of use, data, or
- profits; or business interruption) however caused and on any theory of
- liability, whether in contract, strict liability, or tort (including
- negligence or otherwise) arising in any way out of the use of this
- software, even if advised of the possibility of such damage.
+ $type_options['output_options']['boolean_group'][ $type . '_allow_markdown' ] = [
+ 'label' => __( 'Allow Markdown Syntax', 'pods' ),
+ 'default' => 0,
+ 'type' => 'boolean',
+ ];
- */
-endif;
+ return $type_options;
+}
diff --git a/components/Templates/Templates.php b/components/Templates/Templates.php
index e1e7f7386a..0db5e5d524 100644
--- a/components/Templates/Templates.php
+++ b/components/Templates/Templates.php
@@ -523,11 +523,12 @@ public function save_meta( $_null, $post_ID = null, $meta_key = null, $meta_valu
* @param string $code Custom template code to use instead
* @param object $obj The Pods object
* @param bool $deprecated Whether to use deprecated functionality based on old function usage
+ * @param bool $check_access Whether to check access for Posts that are Password-protected.
*
* @return mixed|string|void
* @since 2.0.0
*/
- public static function template( $template_name, $code = null, $obj = null, $deprecated = false ) {
+ public static function template( $template_name, $code = null, $obj = null, $deprecated = false, $check_access = false ) {
if ( ! empty( $obj ) ) {
self::$obj =& $obj;
@@ -603,16 +604,41 @@ public static function template( $template_name, $code = null, $obj = null, $dep
$code = apply_filters( 'pods_templates_pre_template', $code, $template, $obj );
$code = apply_filters( "pods_templates_pre_template_{$slug}", $code, $template, $obj );
+ $info = $check_access ? pods_info_from_args( [ 'pods' => $obj ] ) : [];
+
ob_start();
if ( ! empty( $code ) ) {
// Only detail templates need $this->id
if ( empty( $obj->id ) ) {
while ( $obj->fetch() ) {
+ $info['item_id'] = $obj->id();
+
+ // Ensure the post is not password protected.
+ if (
+ $check_access
+ && (
+ pods_access_bypass_post_with_password( $info )
+ || pods_access_bypass_private_post( $info )
+ )
+ ) {
+ continue;
+ }
+
echo self::do_template( $code, $obj );
}
} else {
- echo self::do_template( $code, $obj );
+ $info['item_id'] = $obj->id();
+
+ if (
+ ! $check_access
+ || (
+ ! pods_access_bypass_post_with_password( $info )
+ && ! pods_access_bypass_private_post( $info )
+ )
+ ) {
+ echo self::do_template( $code, $obj );
+ }
}
} elseif ( $template_name == trim( preg_replace( '/[^a-zA-Z0-9_\-\/]/', '', $template_name ), ' /-' ) ) {
$default_templates = array(
@@ -625,10 +651,33 @@ public static function template( $template_name, $code = null, $obj = null, $dep
if ( empty( $obj->id ) ) {
while ( $obj->fetch() ) {
+ $info['item_id'] = $obj->id();
+
+ // Ensure the post is not password protected.
+ if (
+ $check_access
+ && (
+ pods_access_bypass_post_with_password( $info )
+ || pods_access_bypass_private_post( $info )
+ )
+ ) {
+ continue;
+ }
+
pods_template_part( $default_templates, compact( array_keys( get_defined_vars() ) ) );
}
} else {
- pods_template_part( $default_templates, compact( array_keys( get_defined_vars() ) ) );
+ $info['item_id'] = $obj->id();
+
+ if (
+ ! $check_access
+ || (
+ ! pods_access_bypass_post_with_password( $info )
+ && ! pods_access_bypass_private_post( $info )
+ )
+ ) {
+ pods_template_part( $default_templates, compact( array_keys( get_defined_vars() ) ) );
+ }
}
}//end if
diff --git a/components/Templates/includes/functions-view_template.php b/components/Templates/includes/functions-view_template.php
index 33f43d04eb..fdf8f8dc5b 100644
--- a/components/Templates/includes/functions-view_template.php
+++ b/components/Templates/includes/functions-view_template.php
@@ -503,12 +503,14 @@ function frontier_do_subtemplate( $atts, $content ) {
$target_id = $entry['term_id'];
}
- $out .= pods_shortcode(
+ $out .= pods_shortcode_run_safely(
array(
'name' => $field['pick_val'],
'slug' => $target_id,
'index' => $key,
- ), $template
+ ),
+ $template,
+ false
);
}//end foreach
diff --git a/composer.json b/composer.json
index 7a32d4c487..bba36a84a9 100644
--- a/composer.json
+++ b/composer.json
@@ -58,12 +58,13 @@
],
"require": {
"composer/installers": "2.2.*",
- "lucatume/di52": "^3.3.0",
+ "erusev/parsedown": "^1.7.4",
+ "lucatume/di52": "^3.3.5",
"mustangostang/spyc": "^0.6.3",
"php": ">=7.2"
},
"require-dev": {
- "automattic/vipwpcs": "^2.0",
+ "automattic/vipwpcs": "^3.0.0",
"bvanhoekelen/performance": "^2.5.1",
"codeception/codeception": "^4.0",
"codeception/module-asserts": "^1.0",
@@ -84,9 +85,9 @@
"phpcompatibility/phpcompatibility-wp": "*",
"phpunit/phpunit": "^6.5",
"spatie/phpunit-snapshot-assertions": "^1.4.2",
- "the-events-calendar/coding-standards": "dev-master",
+ "the-events-calendar/coding-standards": "dev-main",
"wp-cli/wp-cli": "2.*",
- "wp-coding-standards/wpcs": "^2.1"
+ "wp-coding-standards/wpcs": "^3.0.1"
},
"minimum-stability": "stable",
"prefer-stable": true,
@@ -95,7 +96,7 @@
},
"scripts": {
"strauss": [
- "test -f ./bin/strauss.phar || curl -o bin/strauss.phar -L -C - https://github.com/BrianHenryIE/strauss/releases/download/0.14.0/strauss.phar",
+ "test -f ./bin/strauss.phar || curl -o bin/strauss.phar -L -C - https://github.com/BrianHenryIE/strauss/releases/latest/download/strauss.phar",
"@php bin/strauss.phar"
],
"post-install-cmd": [
@@ -114,6 +115,7 @@
"constant_prefix": "PODS_PREFIXED_",
"function_prefix": "pods_prefixed_",
"packages": [
+ "erusev/parsedown",
"lucatume/di52",
"mustangostang/spyc"
],
diff --git a/includes/access.php b/includes/access.php
new file mode 100644
index 0000000000..dccc2eafb3
--- /dev/null
+++ b/includes/access.php
@@ -0,0 +1,2344 @@
+ null,
+ 'object_name' => null,
+ 'item_id' => null,
+ 'pods' => null,
+ 'pod' => null,
+ ];
+
+ $build_pods = false;
+ $build_pod = false;
+
+ if ( isset( $args['build_pods'] ) ) {
+ $build_pods = $args['build_pods'];
+
+ unset( $args['build_pods'] );
+ }
+
+ if ( isset( $args['build_pod'] ) ) {
+ $build_pod = $args['build_pod'];
+
+ unset( $args['build_pod'] );
+ }
+
+ // Merge in the args with the defaults.
+ $info = array_merge( $info, $args );
+
+ $object_type_set = null !== $info['object_type'];
+ $object_name_set = null !== $info['object_name'];
+
+ // Maybe auto-set the object name from the type if we can.
+ if (
+ $object_type_set
+ && ! $object_name_set
+ && in_array( $info['object_type'], [ 'comment', 'media', 'user' ], true )
+ ) {
+ $info['object_name'] = $info['object_type'];
+
+ $object_name_set = true;
+ }
+
+ // Normalize the Pods info to null if it's not valid.
+ if (
+ $info['pods'] instanceof Pods
+ && ! $info['pods']->is_valid()
+ ) {
+ $info['pods'] = null;
+ }
+
+ // Maybe build the Pods object from the info.
+ if (
+ $build_pods
+ && $object_name_set
+ && ! $info['pods'] instanceof Pods
+ ) {
+ $pods = pods_get_instance( $info['object_name'], $info['item_id'], true );
+
+ if (
+ $pods instanceof Pods
+ && $pods->is_valid()
+ && (
+ empty( $info['object_type'] )
+ || $info['object_type'] === $pods->pod_data->get_type()
+ )
+ ) {
+ $info['pods'] = $pods;
+
+ if ( ! $info['pod'] instanceof Pod ) {
+ $info['pod'] = clone $pods->pod_data;
+ }
+ }
+ } elseif (
+ $info['pods'] instanceof Pods
+ && $info['pods']->is_valid()
+ && ! $info['pod'] instanceof Pod
+ ) {
+ $info['pod'] = clone $info['pods']->pod_data;
+ }
+
+ // Maybe build the Pod object from the info.
+ if (
+ $build_pod
+ && $object_name_set
+ && ! $info['pod'] instanceof Pod
+ ) {
+ try {
+ $pod = pods_api()->load_pod( [
+ 'name' => $info['object_name'],
+ ] );
+ } catch ( Exception $e ) {
+ $pod = null;
+ }
+
+ if (
+ $pod instanceof Pod
+ && (
+ empty( $info['object_type'] )
+ || $info['object_type'] === $pod->get_type()
+ )
+ ) {
+ $info['pod'] = $pod;
+ }
+ }
+
+ if ( $info['pod'] instanceof Pod ) {
+ $info['object_type'] = $info['pod']->get_type();
+ $info['object_name'] = $info['pod']->get_name();
+ }
+
+ return $info;
+}
+
+/**
+ * Determine whether the current user has access to an object.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param int|null $user_id The user ID to check against, set to 0 or null for anonymous access check.
+ * @param string $access_type The type of access to check for (read, add, edit, delete).
+ * @param string|null $context The unique slug that can be referenced by hooks for context.
+ *
+ * @return bool Whether the current user has access to an object.
+ */
+function pods_user_can_access_object( array $args, ?int $user_id, string $access_type = 'edit', ?string $context = null ): bool {
+ $info = pods_info_from_args( $args );
+
+ if ( null === $user_id ) {
+ $user_id = 0;
+ }
+
+ // Check if the user exists.
+ $user = get_userdata( $user_id );
+
+ if ( ! $user || is_wp_error( $user ) ) {
+ // If the user does not exist and it was not anonymous, do not allow access to an invalid user.
+ if ( 0 < $user_id ) {
+ return false;
+ }
+
+ // If the user was 0 to begin with (anonymous) then set up a user object to work with.
+ $user = new WP_User();
+ }
+
+ // Determine if this is a user in WP that has full access.
+ if ( $user_id && pods_is_user_admin( $user_id ) ) {
+ return true;
+ }
+
+ if ( 'pod' === $info['object_type'] || 'table' === $info['object_type'] ) {
+ // If no object name is provided, we cannot check access.
+ if ( empty( $info['object_name'] ) ) {
+ return false;
+ }
+
+ // Determine if this user has full content access.
+ if ( $user->has_cap('pods_content' ) ) {
+ return true;
+ }
+ }
+
+ $capabilities = pods_access_map_capabilities( $info, $user_id );
+
+ // Unsupported capabilities returned.
+ if ( null === $capabilities ) {
+ return false;
+ }
+
+ /**
+ * Allow filtering the list of capabilities used for checking access against an object.
+ *
+ * @since 3.1.0
+ *
+ * @param array $capabilities The list of capabilities used for checking access against an object.
+ * @param int $user_id The user ID to check against.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ * @param string $access_type The type of access to check for (read, add, edit, delete).
+ * @param string|null $context The unique slug that can be referenced by hooks for context.
+ */
+ $capabilities = (array) apply_filters(
+ 'pods_user_can_access_object_get_capabilities',
+ $capabilities,
+ $user_id,
+ $info,
+ $access_type,
+ $context
+ );
+
+ // No capability mapped, do not allow access.
+ if ( ! array_key_exists( $access_type, $capabilities ) ) {
+ return false;
+ }
+
+ /**
+ * Allow filtering whether a user has access to an object before the normal capability check runs.
+ *
+ * @since 3.1.0
+ *
+ * @param null|bool $can_access Whether a user has access to an object (return null to run normal check).
+ * @param int $user_id The user ID to check against.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ * @param string $access_type The type of access to check for (read, add, edit, delete).
+ * @param string|null $context The unique slug that can be referenced by hooks for context.
+ * @param array $capabilities The list of capabilities used for checking access against an object.
+ */
+ $can_access = apply_filters(
+ 'pods_user_can_access_object_pre_check',
+ null,
+ $user_id,
+ $info,
+ $access_type,
+ $context,
+ $capabilities
+ );
+
+ // Check for access override and return that instead.
+ if ( null !== $can_access ) {
+ return $can_access;
+ }
+
+ // If we are allowing all access, null will be set for the capability.
+ if ( null === $capabilities[ $access_type ] ) {
+ $can_access = true;
+ } else {
+ // Support multiple capability checks ("OR" logic).
+ $capabilities[ $access_type ] = (array) $capabilities[ $access_type ];
+
+ $can_access = false;
+
+ foreach ( $capabilities[ $access_type ] as $capability ) {
+ if ( $info['item_id'] ) {
+ $can_access = $user->has_cap( $capability, $info['item_id'] );
+ } else {
+ $can_access = $user->has_cap( $capability );
+ }
+
+ if ( $can_access ) {
+ break;
+ }
+ }
+ }
+
+ $is_read_access = 'read' === $access_type;
+
+ // Check for password-protected post.
+ if (
+ $can_access
+ && 'post_type' === $info['object_type']
+ && $info['item_id']
+ && (
+ (
+ $is_read_access
+ && pods_access_bypass_post_with_password( $info )
+ )
+ || (
+ ! $is_read_access
+ && post_password_required( $info['item_id'] )
+ )
+ )
+ ) {
+ $can_access = false;
+ }
+
+ /**
+ * Allow filtering whether a user has access to an object after the normal capability check runs.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $can_access Whether a user has access to an object.
+ * @param int $user_id The user ID to check against.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ * @param string $access_type The type of access to check for (read, add, edit, delete).
+ * @param string|null $context The unique slug that can be referenced by hooks for context.
+ * @param array $capabilities The list of capabilities used for checking access against an object.
+ */
+ return (bool) apply_filters(
+ 'pods_user_can_access_object',
+ $can_access,
+ $user_id,
+ $info,
+ $access_type,
+ $context,
+ $capabilities
+ );
+}
+
+/**
+ * Determine whether the current user has access to an object.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param string $access_type The type of access to check for (read, add, edit, delete).
+ * @param string|null $context The unique slug that can be referenced by hooks for context.
+ *
+ * @return bool Whether the current user has access to an object.
+ */
+function pods_current_user_can_access_object( array $args, string $access_type = 'edit', ?string $context = null ): bool {
+ $user_id = null;
+
+ if ( is_user_logged_in() ) {
+ $user_id = get_current_user_id();
+ }
+
+ return pods_user_can_access_object( $args, $user_id, $access_type, $context );
+}
+
+/**
+ * Build and map the capabilities that a specific object type/name/ID have in relation to a user ID.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param int|null $user_id The user ID accessing the object.
+ * @param bool $strict Whether to strictly get the capabilities or have the 'read' capability evaluate to null if it's public (defaults to false).
+ *
+ * @return array|null The capabilities that a specific object type/name/ID have in relation to a user ID, or null if invalid.
+ */
+function pods_access_map_capabilities( array $args, ?int $user_id = null, bool $strict = false ): ?array {
+ $args['build_pods'] = true;
+ $args['build_pod'] = true;
+
+ $info = pods_info_from_args( $args );
+
+ // If no object type or name, we cannot check access.
+ if ( empty( $info['object_type'] ) || empty( $info['object_name'] ) ) {
+ return null;
+ }
+
+ $wp_object = null;
+
+ $capabilities = [];
+
+ if ( 'post_type' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ if ( $info['item_id'] ) {
+ $capabilities['read'] = 'read_post';
+ $capabilities['edit'] = 'edit_post';
+ $capabilities['delete'] = 'delete_post';
+ } else {
+ $capabilities['read'] = 'read';
+ $capabilities['edit'] = 'edit_posts';
+ $capabilities['delete'] = 'delete_posts';
+ }
+
+ $capabilities['add'] = 'create_posts';
+ $capabilities['read_private'] = 'read_private_posts';
+ $capabilities['edit_others'] = 'edit_others_posts';
+ $capabilities['delete_others'] = 'delete_others_posts';
+ $capabilities['delete_published'] = 'delete_published_posts';
+ $capabilities['delete_private'] = 'delete_private_posts';
+
+ // Maybe map capabilities to the post type.
+ $wp_object = get_post_type_object( $info['object_name'] );
+
+ if ( $info['item_id'] ) {
+ $post = get_post( $info['item_id'] );
+
+ // If the post was found, do fine-grained access checks.
+ if ( $post instanceof WP_Post ) {
+ $status_obj = get_post_status_object( $post->post_status );
+
+ // Check if the person is allowed to read other posts.
+ if (
+ $user_id
+ && $post->post_author
+ && (int) $user_id === (int) $post->post_author
+ ) {
+ // This is their own post, they can have access.
+ $capabilities['read'] = 'read';
+ } elseif (
+ ! $status_obj
+ || $status_obj->private
+ ) {
+ // This is a private post, check private post capability.
+ $capabilities['read'] = $capabilities['read_private'];
+ }
+ }
+ }
+ } elseif ( 'taxonomy' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ $capabilities['read'] = 'read';
+ $capabilities['add'] = 'manage_terms';
+ $capabilities['edit'] = 'edit_terms';
+ $capabilities['delete'] = 'delete_terms';
+
+ // Maybe map capabilities to the post type.
+ $wp_object = get_taxonomy( $info['object_name'] );
+ } elseif ( 'user' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ $capabilities['read'] = 'list_users';
+ $capabilities['add'] = 'create_users';
+ $capabilities['edit'] = 'edit_users';
+ $capabilities['delete'] = 'delete_users';
+
+ // If an object ID is provided, check for access for that specific user.
+ if ( ! empty( $info['item_id'] ) ) {
+ $capabilities['edit'] = 'edit_user';
+ $capabilities['delete'] = 'delete_user';
+ }
+
+ // Fake the WP object for the logic below.
+ $wp_object = (object) [
+ 'public' => false,
+ 'cap' => (object) [],
+ ];
+ } elseif ( 'media' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ $capabilities['read'] = 'read';
+ $capabilities['add'] = 'upload_files';
+ $capabilities['edit'] = 'upload_files';
+ $capabilities['delete'] = 'upload_files';
+
+ // Fake the WP object for the logic below.
+ $wp_object = (object) [
+ 'public' => false,
+ 'cap' => (object) [],
+ ];
+ } elseif ( 'comment' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ $capabilities['read'] = 'read';
+ $capabilities['add'] = 1 === (int) get_option( 'comment_registration' ) ? 'read' : null;
+ $capabilities['edit'] = 'moderate_comments';
+ $capabilities['delete'] = 'moderate_comments';
+
+ // If an object ID is provided, check for access for that specific user.
+ if ( ! empty( $info['item_id'] ) ) {
+ $capabilities['edit'] = 'edit_comment';
+ }
+
+ // Fake the WP object for the logic below.
+ $wp_object = (object) [
+ 'public' => true,
+ 'cap' => (object) [],
+ ];
+ } elseif ( 'settings' === $info['object_type'] ) {
+ $capabilities['read'] = 'manage_options';
+ $capabilities['edit'] = 'manage_options';
+ $capabilities['delete'] = 'manage_options';
+
+ // Fake the WP object for the logic below.
+ $wp_object = (object) [
+ 'public' => false,
+ 'cap' => (object) [],
+ ];
+ } elseif ( 'pod' === $info['object_type'] || 'table' === $info['object_type'] ) {
+ $info['item_id'] = (int) $info['item_id'];
+
+ $capabilities['read'] = 'pods_read_' . $info['object_name'];
+ $capabilities['add'] = 'pods_add_' . $info['object_name'];
+ $capabilities['edit'] = 'pods_edit_' . $info['object_name'];
+ $capabilities['delete'] = 'pods_delete_' . $info['object_name'];
+ $capabilities['edit_others'] = 'pods_edit_others_' . $info['object_name'];
+ $capabilities['delete_others'] = 'pods_delete_others_' . $info['object_name'];
+
+ $is_public = false;
+
+ if ( $info['pods'] instanceof Pods && $info['pod'] instanceof Pod ) {
+ // If an object ID is provided, check for access for that specific item.
+ if ( $info['item_id'] && $info['pods']->exists() ) {
+ // Check for author field.
+ $author_field = $info['pod']->get_field( 'author' );
+
+ $author_user_id = $author_field ? (int) $info['pods']->field( $author_field->get_name() . '.ID' ) : null;
+
+ // If we have an author field, check if they are the author.
+ if ( $author_field ) {
+ if ( $user_id && $author_user_id === $user_id ) {
+ // This is their own post, they can also have access if have edit access.
+ $capabilities['read'] = [
+ $capabilities['read'],
+ 'pods_edit_' . $info['object_name'],
+ ];
+ } else {
+ // This is not their post, check if they have access to others.
+ $capabilities['edit'] = 'pods_edit_others_' . $info['object_name'];
+ $capabilities['delete'] = 'pods_delete_others_' . $info['object_name'];
+ }
+ }
+ }
+
+ $is_public = $info['pod']->get_arg( 'public', '0', true );
+ $is_public = filter_var( $is_public, FILTER_VALIDATE_BOOLEAN );
+
+ // Fake the WP object for the logic below.
+ $wp_object = (object) [
+ 'public' => $is_public,
+ 'cap' => (object) [],
+ ];
+ }
+
+ if ( $is_public ) {
+ $capabilities['read'] = 'read';
+ }
+ }
+
+ // If no post type object is found, we cannot check access.
+ if ( ! $wp_object ) {
+ return null;
+ }
+
+ // Check if there are any capabilities mapped for this type object.
+ foreach ( $capabilities as $access_type => $capability ) {
+ if ( $capability ) {
+ if ( is_array( $capability ) ) {
+ foreach ( $capability as $k => $cap ) {
+ if ( isset( $wp_object->cap->{$cap} ) ) {
+ $capabilities[ $access_type ][ $k ] = $wp_object->cap->{$cap};
+ }
+ }
+ } elseif ( isset( $wp_object->cap->{$capability} ) ) {
+ $capabilities[ $access_type ] = $wp_object->cap->{$capability};
+ }
+ }
+ }
+
+ // If the object is public, allow read for anyone even logged out.
+ if ( ! $strict && $wp_object->public && 'read' === $capabilities['read'] && ! $user_id ) {
+ $capabilities['read'] = null;
+ }
+
+ /**
+ * Allow filtering the list of capabilities used for checking access against an object type or singular object.
+ *
+ * @since 3.1.0
+ *
+ * @param array $capabilities The list of capabilities used for checking access against an object type or singular object.
+ * @param int $user_id The user ID to check against.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ */
+ return (array) apply_filters(
+ 'pods_access_map_capabilities',
+ $capabilities,
+ $user_id,
+ $info
+ );
+}
+
+/**
+ * Determine whether the object type/name is public.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param string $context The context we are checking from (defaults to shortcode).
+ *
+ * @return bool Whether the object type/name is public.
+ */
+function pods_is_type_public( array $args, string $context = 'shortcode' ): bool {
+ $args['build_pod'] = true;
+
+ $info = pods_info_from_args( $args );
+
+ $is_public = true;
+
+ $pod_has_public = null;
+
+ $is_post_type = 'post_type' === $info['object_type'];
+ $is_taxonomy = 'taxonomy' === $info['object_type'];
+ $is_pod = 'pod' === $info['object_type'];
+ $is_settings_pod = 'settings' === $info['object_type'];
+
+ $is_shortcode_context = 'shortcode' === $context;
+
+ if (
+ $info['pod'] instanceof Pod
+ && (
+ $is_post_type
+ || $is_taxonomy
+ || $is_pod
+ || $is_settings_pod
+ )
+ ) {
+ $is_extended = $info['pod']->is_extended();
+
+ if ( ! $is_extended ) {
+ $is_public = $info['pod']->get_arg( 'public', null, true );
+
+ if ( null !== $is_public ) {
+ $pod_has_public = true;
+
+ $is_public = filter_var( $is_public, FILTER_VALIDATE_BOOLEAN );
+
+ if ( $is_post_type || $is_taxonomy ) {
+ $is_public = $is_public && 1 === (int) $info['pod']->get_arg( 'publicly_queryable', $is_public, true );
+ }
+ }
+ }
+ }
+
+ // Maybe handle looking up the visibility based on the object type.
+ if ( null === $pod_has_public ) {
+ if ( $is_post_type ) {
+ // If no object name is provided, we cannot check if it is public.
+ if ( empty( $info['object_name'] ) ) {
+ $is_public = false;
+ } else {
+ $post_type_object = get_post_type_object( $info['object_name'] );
+
+ // Post type not found.
+ if ( ! $post_type_object ) {
+ return false;
+ }
+
+ $is_public = $post_type_object->public && $post_type_object->publicly_queryable;
+ }
+ } elseif ( $is_taxonomy ) {
+ // If no object name is provided, we cannot check if it is public.
+ if ( empty( $info['object_name'] ) ) {
+ $is_public = false;
+ } else {
+ $taxonomy_object = get_taxonomy( $info['object_name'] );
+
+ // Post type not found.
+ if ( ! $taxonomy_object ) {
+ return false;
+ }
+
+ $is_public = $taxonomy_object->public && $taxonomy_object->publicly_queryable;
+ }
+ } elseif ( 'user' === $info['object_type'] ) {
+ // Users are not public for shortcodes.
+ if ( $is_shortcode_context ) {
+ $is_public = false;
+ }
+ } elseif ( $is_pod || $is_settings_pod ) {
+ // Pods need special default handling for shortcodes.
+ if ( $is_shortcode_context ) {
+ $first_pods_version = get_option( 'pods_framework_version_first' );
+ $first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
+
+ $is_public = version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? true : false;
+ }
+ }
+ }
+
+ /**
+ * Allow filtering whether the object type/name is public.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $is_public Whether the object type/name is public.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ * @param string|null $context The context we are checking from (shortcode or null).
+ * @param Pod|null $pod The Pod object if set.
+ */
+ return (bool) apply_filters(
+ 'pods_is_type_public',
+ $is_public,
+ $info,
+ $context
+ );
+}
+
+/**
+ * Determine whether a post should be bypassed because it it has a password.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ *
+ * @return bool Whether a post should be bypassed because it it has a password.
+ */
+function pods_access_bypass_post_with_password( array $args ): bool {
+ $info = pods_info_from_args( $args );
+
+ if ( 'post_type' !== $info['object_type'] || ! $info['item_id'] ) {
+ return false;
+ }
+
+ $post = get_post( (int) $info['item_id'] );
+
+ if ( ! $post instanceof WP_Post ) {
+ return false;
+ }
+
+ // Bypass posts that have a password required but not provided.
+ $bypass_post_with_password = post_password_required( $post );
+
+ /**
+ * Allow filtering whether a post should be bypassed because it it has a password.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $bypass_post_with_password Whether a post should be bypassed because it it has a password.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ */
+ return (bool) apply_filters(
+ 'pods_access_bypass_post_with_password',
+ $bypass_post_with_password,
+ $info
+ );
+}
+
+/**
+ * Determine whether a post should be bypassed because it is private and capabilities are not met.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ *
+ * @return bool Whether a post should be bypassed because it is private and capabilities are not met.
+ */
+function pods_access_bypass_private_post( array $args ): bool {
+ $info = pods_info_from_args( $args );
+
+ if ( 'post_type' !== $info['object_type'] || ! $info['item_id'] ) {
+ return false;
+ }
+
+ $post = get_post( $info['item_id'] );
+
+ if ( ! $post instanceof WP_Post ) {
+ return false;
+ }
+
+ $bypass_private_post = false;
+
+ if ( ! is_post_publicly_viewable( $post ) ) {
+ $bypass_private_post = ! pods_current_user_can_access_object( $info, 'read' );
+ }
+
+ /**
+ * Allow filtering whether a post should be bypassed because it is private.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $bypass_private_post Whether a post should be bypassed because it is private.
+ * @param array $info {
+ * The normalized Pod information referenced.
+ *
+ * @type string|null $object_type The object type (if set).
+ * @type string|null $object_name The object name (if set).
+ * @type int|string|null $item_id The item ID (if set).
+ * @type Pods|null $pods The Pods object (if built or provided).
+ * @type Pod|null $pod The Pod object (if built or provided).
+ * }
+ */
+ return (bool) apply_filters(
+ 'pods_access_bypass_private_post',
+ $bypass_private_post,
+ $info
+ );
+}
+
+/**
+ * Determine whether dynamic features can be used.
+ *
+ * @since 3.1.0
+ *
+ * @return bool Whether dynamic features can be used.
+ */
+function pods_can_use_dynamic_features( ?Pod $pod = null ): bool {
+ // Check if the constant is defined and only override if no $pod is set or dynamic features are totally disabled.
+ if (
+ defined( 'PODS_DYNAMIC_FEATURES_ALLOW' )
+ && (
+ ! $pod
+ || ! PODS_DYNAMIC_FEATURES_ALLOW
+ )
+ ) {
+ return PODS_DYNAMIC_FEATURES_ALLOW;
+ }
+
+ // Check if all dynamic features are disabled.
+ $dynamic_features_allow = pods_get_setting( 'dynamic_features_allow', '1' );
+ $dynamic_features_allow = filter_var( $dynamic_features_allow, FILTER_VALIDATE_BOOLEAN );
+
+ if ( $dynamic_features_allow && $pod instanceof Pod ) {
+ // Check if all dynamic features are disabled for the Pod.
+ $dynamic_features_allow = $pod->get_arg( 'dynamic_features_allow', 'inherit' );
+
+ if ( 'inherit' === $dynamic_features_allow ) {
+ $dynamic_features_allow = pods_is_type_public(
+ [
+ 'pod' => $pod,
+ ]
+ );
+ } else {
+ $dynamic_features_allow = filter_var( $dynamic_features_allow, FILTER_VALIDATE_BOOLEAN );
+ }
+ }
+
+ return $dynamic_features_allow;
+}
+
+/**
+ * Determine whether any or a specific dynamic feature can be used.
+ *
+ * @since 3.1.0
+ *
+ * @param string $type The dynamic feature type.
+ *
+ * @return bool Whether any or a specific dynamic feature can be used.
+ */
+function pods_can_use_dynamic_feature( string $type ): bool {
+ if ( ! pods_can_use_dynamic_features() ) {
+ return false;
+ }
+
+ // Handle the constants.
+ if ( 'view' === $type && defined( 'PODS_SHORTCODE_ALLOW_VIEWS' ) && ! PODS_SHORTCODE_ALLOW_VIEWS ) {
+ return false;
+ }
+
+ if ( empty( $type ) ) {
+ return false;
+ }
+
+ $dynamic_features_enabled = (array) pods_get_setting( 'dynamic_features_enabled', [
+ 'display',
+ 'form',
+ ] );
+ $dynamic_features_enabled = array_filter( $dynamic_features_enabled );
+
+ $constant_dynamic_features_enabled = defined( 'PODS_DYNAMIC_FEATURES_ENABLED' ) ? PODS_DYNAMIC_FEATURES_ENABLED : false;
+
+ if ( false !== $constant_dynamic_features_enabled && ! is_array( $constant_dynamic_features_enabled ) ) {
+ $constant_dynamic_features_enabled = explode( ',', $constant_dynamic_features_enabled );
+ $constant_dynamic_features_enabled = array_filter( $constant_dynamic_features_enabled );
+
+ $dynamic_features_enabled = $constant_dynamic_features_enabled;
+ }
+
+ if ( empty( $dynamic_features_enabled ) ) {
+ return false;
+ }
+
+ return in_array( $type, $dynamic_features_enabled, true );
+}
+
+/**
+ * Determine whether specific dynamic feature is unrestricted.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param string $type The dynamic feature type.
+ * @param string $mode The dynamic feature mode (like "add" or "edit" for the form feature).
+ *
+ * @return bool Whether specific dynamic feature is unrestricted.
+ */
+function pods_can_use_dynamic_feature_unrestricted( array $args, string $type, ?string $mode = null ): bool {
+ if ( ! pods_can_use_dynamic_feature( $type ) ) {
+ return false;
+ }
+
+ if (
+ defined( 'PODS_DYNAMIC_FEATURES_RESTRICT' )
+ && ! PODS_DYNAMIC_FEATURES_RESTRICT
+ ) {
+ $can_use_unrestricted = true;
+ } else {
+ $can_use_unrestricted = false;
+
+ $args['build_pod'] = true;
+
+ $info = pods_info_from_args( $args );
+
+ if ( ! $info['pod'] ) {
+ $can_use_unrestricted = false;
+ } else {
+ $is_public_content_type = pods_is_type_public( $info );
+
+ $default_restricted_dynamic_features = [
+ 'form',
+ ];
+
+ if ( ! $is_public_content_type ) {
+ $default_restricted_dynamic_features[] = 'display';
+ }
+
+ $default_restricted_dynamic_features_forms = [
+ 'edit',
+ ];
+
+ if ( ! $is_public_content_type ) {
+ $default_restricted_dynamic_features_forms[] = 'add';
+ }
+
+ // Check if all dynamic features are unrestricted.
+ $restrict_dynamic_features = $info['pod']->get_arg( 'restrict_dynamic_features', '1' );
+ $restrict_dynamic_features = filter_var( $restrict_dynamic_features, FILTER_VALIDATE_BOOLEAN );
+
+ if ( ! $restrict_dynamic_features ) {
+ $can_use_unrestricted = true;
+ } elseif ( ! empty( $type ) ) {
+ if ( defined( 'PODS_DYNAMIC_FEATURES_RESTRICTED' ) && false !== PODS_DYNAMIC_FEATURES_RESTRICTED ) {
+ $constant_restricted_dynamic_features = PODS_DYNAMIC_FEATURES_RESTRICTED;
+
+ if ( ! is_array( $constant_restricted_dynamic_features ) ) {
+ $constant_restricted_dynamic_features = explode( ',', $constant_restricted_dynamic_features );
+ }
+
+ $restricted_dynamic_features = $constant_restricted_dynamic_features;
+ } else {
+ $restricted_dynamic_features = (array) $info['pod']->get_arg( 'restricted_dynamic_features', $default_restricted_dynamic_features );
+ }
+
+ $restricted_dynamic_features = array_filter( $restricted_dynamic_features );
+
+ if ( empty( $restricted_dynamic_features ) ) {
+ $can_use_unrestricted = true;
+ } else {
+ $can_use_unrestricted = ! in_array( $type, $restricted_dynamic_features, true );
+ }
+
+ if ( ! $can_use_unrestricted && 'form' === $type && $mode ) {
+ if ( defined( 'PODS_DYNAMIC_FEATURES_RESTRICTED_FORMS' ) && false !== PODS_DYNAMIC_FEATURES_RESTRICTED_FORMS ) {
+ $constant_restricted_dynamic_features_forms = PODS_DYNAMIC_FEATURES_RESTRICTED_FORMS;
+
+ if ( ! is_array( $constant_restricted_dynamic_features_forms ) ) {
+ $constant_restricted_dynamic_features_forms = explode( ',', $constant_restricted_dynamic_features_forms );
+ }
+
+ $restricted_dynamic_features_forms = $constant_restricted_dynamic_features_forms;
+ } else {
+ $restricted_dynamic_features_forms = (array) $info['pod']->get_arg( 'restricted_dynamic_features_forms', $default_restricted_dynamic_features_forms );
+ }
+
+ $restricted_dynamic_features_forms = array_filter( $restricted_dynamic_features_forms );
+
+ if ( empty( $restricted_dynamic_features_forms ) ) {
+ $can_use_unrestricted = true;
+ } else {
+ $can_use_unrestricted = ! in_array( $mode, $restricted_dynamic_features_forms, true );
+ }
+ }
+ }
+ }
+ }
+
+ return $can_use_unrestricted;
+}
+
+/**
+ * Get the access notice for admin user based on object type and object name.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param bool $force_message Whether to force the message to show even if messages are hidden by a setting.
+ *
+ * @return string The access notice for admin user based on object type and object name.
+ */
+function pods_get_access_admin_notice( array $args, bool $force_message = false ): string {
+ $args['build_pod'] = true;
+
+ $info = pods_info_from_args( $args );
+
+ $identifier_for_html = esc_html( json_encode( [
+ 'object_type' => $info['object_type'],
+ 'object_name' => $info['object_name'],
+ 'item_id' => $info['item_id'],
+ ] ) );
+
+ // Check if constant is hiding all notices.
+ if ( ! $force_message && defined( 'PODS_ACCESS_HIDE_NOTICES' ) && PODS_ACCESS_HIDE_NOTICES ) {
+ return '';
+ }
+
+ // Check notice setting for the Pod itself.
+ if ( $info['pod'] instanceof Pod ) {
+ $show_access_admin_notices_for_pod = $info['pod']->get_arg( 'show_access_admin_notices', 'inherit' );
+
+ if ( 'inherit' !== $show_access_admin_notices_for_pod ) {
+ $show_access_admin_notices_for_pod = filter_var( $show_access_admin_notices_for_pod, FILTER_VALIDATE_BOOLEAN );
+
+ // Check if all notices have been dismissed for the pod.
+ if ( ! $force_message && ! $show_access_admin_notices_for_pod ) {
+ return '';
+ }
+ }
+ }
+
+ // Show notice that this content may not be visible to others.
+ $show_access_admin_notices = pods_get_setting( 'show_access_admin_notices', true );
+ $show_access_admin_notices = filter_var( $show_access_admin_notices, FILTER_VALIDATE_BOOLEAN );
+
+ // Check if all notices have been dismissed.
+ if ( ! $force_message && ! $show_access_admin_notices ) {
+ return '';
+ }
+
+ $summary = esc_html__( 'Pods Access Rights: Admin-only Notice', 'pods' );
+
+ $content = sprintf(
+ '
+
+ %1$s
+
+
+ %3$s
+ | %5$s
+
+
+ ',
+ esc_html__( 'The content below is not public and may not be available to everyone else.', 'pods' ),
+ esc_url( 'https://docs.pods.io/displaying-pods/access-rights-in-pods/' ),
+ esc_html__( 'How access rights work with Pods (Documentation)', 'pods' ),
+ esc_url( admin_url( 'admin.php?page=pods-settings#heading-security' ) ),
+ esc_html__( 'Edit other access right options', 'pods' )
+ );
+
+ return ''
+ . pods_message(
+ sprintf(
+ '
+
+ %1$s
+ %2$s
+
+ ',
+ strip_tags( ! empty( $info['summary'] ) ? $info['summary'] : $summary ),
+ ! empty( $info['content'] ) ? wpautop( $info['content'] ) : $content
+ ),
+ 'notice',
+ true
+ );
+}
+
+/**
+ * Get the access notice for non-admin user based on object type and object name.
+ *
+ * @since 3.1.0
+ *
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ * @param bool $force_message Whether to force the message to show even if messages are hidden by a setting.
+ * @param string|null $message A custom message to use for the notice text.
+ *
+ * @return string The access notice for non-admin user based on object type and object name.
+ */
+function pods_get_access_user_notice( array $args, bool $force_message = false, ?string $message = null ): string {
+ $args['build_pod'] = true;
+
+ $info = pods_info_from_args( $args );
+
+ $identifier_for_html = esc_html( json_encode( [
+ 'object_type' => $info['object_type'],
+ 'object_name' => $info['object_name'],
+ 'item_id' => $info['item_id'],
+ ] ) );
+
+ // Check for password-protected post.
+ if ( $info['item_id'] && pods_access_bypass_post_with_password( $info ) ) {
+ $message = get_the_password_form( $info['item_id'] );
+
+ return ''
+ . pods_message(
+ sprintf(
+ '%1$s
%2$s',
+ esc_html__( 'Access Restricted', 'pods' ),
+ $message
+ ),
+ 'error',
+ true
+ );
+ }
+
+ // Check if constant is hiding all notices.
+ if ( ! $force_message && defined( 'PODS_ACCESS_HIDE_NOTICES' ) && PODS_ACCESS_HIDE_NOTICES ) {
+ return '';
+ }
+
+ // Check notice setting for the Pod itself.
+ if ( $info['pod'] instanceof Pod ) {
+ $show_access_restricted_messages_for_pod = $info['pod']->get_arg( 'show_access_restricted_messages', 'inherit' );
+
+ if ( 'inherit' !== $show_access_restricted_messages_for_pod ) {
+ $show_access_restricted_messages_for_pod = filter_var( $show_access_restricted_messages_for_pod, FILTER_VALIDATE_BOOLEAN );
+
+ // Check if all notices have been dismissed for the pod.
+ if ( ! $force_message && ! $show_access_restricted_messages_for_pod ) {
+ return '';
+ }
+ }
+ }
+
+ // Show notice that this content may not be visible to others.
+ $show_access_restricted_messages = pods_get_setting( 'show_access_restricted_messages', false );
+ $show_access_restricted_messages = filter_var( $show_access_restricted_messages, FILTER_VALIDATE_BOOLEAN );
+
+ // Check if all notices have been dismissed.
+ if ( ! $force_message && ! $show_access_restricted_messages ) {
+ return '';
+ }
+
+ $message = $message ?? esc_html__( 'You do not have access to this embedded content.', 'pods' );
+
+ return ''
+ . pods_message(
+ sprintf(
+ '%1$s: %2$s
',
+ esc_html__( 'Access Restricted', 'pods' ),
+ $message
+ ),
+ 'error',
+ true
+ );
+}
+
+/**
+ * Determine whether SQL clauses can be used with dynamic features.
+ *
+ * @since 3.1.0
+ *
+ * @param null|string $clause_type The clause type to check if allowed, if null used then it checks if any clauses are allowed.
+ *
+ * @return bool Whether SQL clauses can be used with dynamic features.
+ */
+function pods_can_use_dynamic_feature_sql_clauses( ?string $clause_type = null ): bool {
+ if ( defined( 'PODS_DISABLE_SHORTCODE_SQL' ) ) {
+ // Negate the check since this is a "disable" constant.
+ return ! PODS_DISABLE_SHORTCODE_SQL;
+ }
+
+ if ( defined( 'PODS_DYNAMIC_FEATURES_ALLOW_SQL_CLAUSES' ) ) {
+ $allow_sql_clauses = PODS_DYNAMIC_FEATURES_ALLOW_SQL_CLAUSES;
+ } else {
+ $first_pods_version = get_option( 'pods_framework_version_first' );
+ $first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
+
+ $allow_sql_clauses = pods_get_setting( 'dynamic_features_allow_sql_clauses', version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? 'simple' : '0' );
+ }
+
+ if (
+ false === $allow_sql_clauses
+ || '0' === $allow_sql_clauses
+ ) {
+ return false;
+ }
+
+ if ( null === $clause_type ) {
+ return true;
+ }
+
+ if ( 'simple' === $clause_type && 'all' === $allow_sql_clauses ) {
+ return true;
+ }
+
+ return $clause_type === $allow_sql_clauses;
+}
+
+/**
+ * Determine whether a callback can be used.
+ *
+ * @since 3.1.0
+ *
+ * @param string|callable $callback The callback to check.
+ * @param array $params Parameters used by Pods::helper() method.
+ *
+ * @return bool Whether the callback can be used.
+ */
+function pods_access_callback_allowed( $callback, array $params = [] ): bool {
+ // Real callables are allowed because they are done through PHP calls.
+ if ( ! is_string( $callback ) ) {
+ return true;
+ }
+
+ if ( ! pods_can_use_dynamic_feature( 'display' ) ) {
+ return false;
+ }
+
+ if (
+ defined( 'PODS_DISPLAY_CALLBACKS' )
+ && ! PODS_DISPLAY_CALLBACKS
+ ) {
+ return false;
+ }
+
+ /**
+ * Allows changing whether callbacks are allowed to run.
+ *
+ * @param bool $allow_callbacks Whether callbacks are allowed to run.
+ * @param array $params Parameters used by Pods::helper() method.
+ *
+ * @since 2.8.0
+ */
+ $allow_callbacks = (bool) apply_filters( 'pods_helper_allow_callbacks', true, $params );
+
+ if ( ! $allow_callbacks ) {
+ return false;
+ }
+
+ $disallowed = [
+ // Regex related.
+ 'preg_replace',
+ 'preg_replace_array',
+ 'preg_replace_callback',
+ 'preg_replace_callback_array',
+ 'preg_match',
+ 'preg_match_all',
+ // Shell/Eval related.
+ 'system',
+ 'exec',
+ 'passthru',
+ 'proc_close',
+ 'proc_get_status',
+ 'proc_nice',
+ 'proc_open',
+ 'proc_terminate',
+ 'shell_exec',
+ 'system',
+ 'eval',
+ 'create_function',
+ // File related.
+ 'popen',
+ 'include',
+ 'include_once',
+ 'require',
+ 'require_once',
+ 'file_get_contents',
+ 'file_put_contents',
+ 'get_template_part',
+ // Nonce related.
+ 'wp_nonce_url',
+ 'wp_nonce_field',
+ 'wp_create_nonce',
+ 'check_admin_referer',
+ 'check_ajax_referer',
+ 'wp_verify_nonce',
+ // PHP related.
+ 'constant',
+ 'defined',
+ 'get_current_user',
+ 'get_defined_constants',
+ 'get_defined_functions',
+ 'get_defined_vars',
+ 'get_extension_funcs',
+ 'get_include_path',
+ 'get_included_files',
+ 'get_loaded_extensions',
+ 'get_required_files',
+ 'get_resources',
+ 'getenv',
+ 'getopt',
+ 'ini_alter',
+ 'ini_get',
+ 'ini_get_all',
+ 'ini_restore',
+ 'ini_set',
+ 'php_ini_loaded_file',
+ 'php_ini_scanned_files',
+ 'php_sapi_name',
+ 'php_uname',
+ 'phpinfo',
+ 'phpversion',
+ 'putenv',
+ // WordPress related.
+ 'get_userdata',
+ 'get_currentuserinfo',
+ 'get_post',
+ 'get_term',
+ 'get_comment',
+ ];
+
+ $allowed = [];
+
+ if ( defined( 'PODS_DISPLAY_CALLBACKS' ) ) {
+ $display_callbacks = PODS_DISPLAY_CALLBACKS;
+ } else {
+ $first_pods_version = get_option( 'pods_framework_version_first' );
+ $first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
+
+ $display_callbacks = pods_get_setting( 'display_callbacks', version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? 'restricted' : 'customized' );
+ }
+
+ if ( '0' === $display_callbacks ) {
+ return false;
+ }
+
+ // Maybe specify the list of allowed callbacks.
+ if ( 'customized' === $display_callbacks ) {
+ if ( defined( 'PODS_DISPLAY_CALLBACKS_ALLOWED' ) ) {
+ $display_callbacks_allowed = PODS_DISPLAY_CALLBACKS_ALLOWED;
+ } else {
+ // Maybe specify the list of allowed callbacks
+ $display_callbacks_allowed = pods_get_setting( 'display_callbacks_allowed', 'esc_attr,esc_html' );
+ }
+
+ if ( ! is_array( $display_callbacks_allowed ) ) {
+ $display_callbacks_allowed = str_replace( "\n", ',', $display_callbacks_allowed );
+ $display_callbacks_allowed = explode( ',', $display_callbacks_allowed );
+ }
+
+ $display_callbacks_allowed = array_map( 'trim', $display_callbacks_allowed );
+ $display_callbacks_allowed = array_filter( $display_callbacks_allowed );
+
+ if ( ! empty( $display_callbacks_allowed ) ) {
+ $allowed = $display_callbacks_allowed;
+ }
+ }
+
+ /**
+ * Allows adjusting the disallowed callbacks as needed.
+ *
+ * @param array $disallowed List of callbacks not allowed.
+ * @param array $params Parameters used by Pods::helper() method.
+ *
+ * @since 2.7.0
+ */
+ $disallowed = apply_filters( 'pods_helper_disallowed_callbacks', $disallowed, $params );
+
+ /**
+ * Allows adjusting the allowed callbacks as needed.
+ *
+ * @param array $allowed List of callbacks explicitly allowed.
+ * @param array $params Parameters used by Pods::helper() method.
+ *
+ * @since 2.7.0
+ */
+ $allowed = apply_filters( 'pods_helper_allowed_callbacks', $allowed, $params );
+
+ // Clean up helper callback (if string).
+ if ( is_string( $callback ) ) {
+ $callback = strip_tags( str_replace( array( '`', chr( 96 ) ), "'", $callback ) );
+ }
+
+ return (
+ ! in_array( $callback, $disallowed, true )
+ && (
+ empty( $allowed )
+ || in_array( $callback, $allowed, true )
+ )
+ );
+}
+
+/**
+ * Get the pod access tab options for a specific pod.
+ *
+ * @since 3.1.0
+ *
+ * @param string $pod_type The pod type.
+ * @param string $pod_name The pod name.
+ * @param null|Pod $pod The pod object.
+ *
+ * @return array The pod access tab options for a specific pod.
+ */
+function pods_access_pod_options( string $pod_type, string $pod_name, ?Pod $pod = null ): array {
+ $first_pods_version = get_option( 'pods_framework_version_first' );
+ $first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
+
+ $options = [];
+
+ $options['security_access_rights_info'] = [
+ 'label' => __( 'How access rights work in Pods', 'pods' ),
+ 'type' => 'html',
+ 'html_content' => sprintf(
+ '
+ %1$s
+ %2$s
+ ',
+ __( 'Pods handles access rights similar to how WordPress itself works.', 'pods' ),
+ __( 'Read more about how access rights work in Pods on our Documentation site', 'pods' )
+ ),
+ ];
+
+ if ( 'pod' === $pod_type ) {
+ $options['public'] = [
+ 'label' => __( 'Public', 'pods' ),
+ 'help' => __( 'You can still embed Pods Content and Forms through PHP and make use of other features directly through code.', 'pods' ),
+ 'description' => __( 'When a content type is public, it can be viewed by anyone when it is embedded through Dynamic Features. Otherwise, a user will need to have the corresponding "read" capability for the content type.', 'pods' ),
+ 'type' => 'boolean',
+ 'default' => version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? true : false,
+ 'boolean_yes_label' => '',
+ ];
+ }
+
+ if ( pods_can_use_dynamic_features() ) {
+ $options['dynamic_features_allow'] = [
+ 'label' => __( 'Dynamic Features', 'pods' ),
+ 'help' => [
+ __( 'Enabling Dynamic Features will also enable the additional access rights checks for user access. This ensures that people viewing embedded content and forms have the required capabilties. Even when Dynamic Features are disabled, you can still embed Pods Content and Forms through PHP and make use of other features directly through code.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'description' => __( 'Dynamic features include Pods Shortcodes, Blocks, and Widgets which let you embed content and forms on your site.', 'pods' ),
+ 'type' => 'pick',
+ 'default' => 'inherit',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ 'inherit' => __( 'WP Default - If the content type is marked "Public" with WordPress then Dynamic Features will be enabled.', 'pods' ),
+ '1' => __( 'Enable Dynamic Features including Pods Shortcodes, Blocks, and Widgets for this content type', 'pods' ),
+ '0' => __( 'Disable All Dynamic Features in Pods for this content type', 'pods' ),
+ ],
+ 'dependency' => true,
+ ];
+
+ $is_public_content_type = pods_is_type_public(
+ [
+ 'pod' => $pod,
+ ]
+ );
+
+ $options['restrict_dynamic_features'] = [
+ 'label' => __( 'Restrict Dynamic Features', 'pods' ),
+ 'help' => [
+ __( 'This will check access rights for whether someone should have access to specific content before a they can view, modify, or interact with that content.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'description' => sprintf(
+ '%1$s %2$s',
+ esc_html__( 'Warning:', 'pods' ),
+ esc_html__( 'If you have authors/contributors on your site then disabling this would give them access to embedding content/forms without access checks for them or whoever views the embeds on the front of your site. Caution is always advised before giving access to other users you may not trust.', 'pods' )
+ ),
+ 'type' => 'pick',
+ 'default' => '1',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '0' => __( 'Unrestricted - Do not check for access rights for embedded content (only use this if you trust ALL users who have access to create content)', 'pods' ),
+ '1' => __( 'Restricted - Check access rights for embedded content', 'pods' ),
+ ],
+ 'excludes-on' => [ 'dynamic_features_allow' => '0' ],
+ ];
+
+ $default_restricted_dynamic_features = [
+ 'form',
+ ];
+
+ if ( ! $is_public_content_type ) {
+ $default_restricted_dynamic_features[] = 'display';
+ }
+
+ $options['restricted_dynamic_features'] = [
+ 'label' => __( 'Dynamic Features to Restrict', 'pods' ),
+ 'help' => [
+ __( 'This will check access rights for the dynamic feature for whether someone should have access to specific content before a they can view, modify, or interact with that content.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => $default_restricted_dynamic_features,
+ 'pick_format_type' => 'multi',
+ 'pick_format_multi' => 'checkbox',
+ 'data' => [
+ 'display' => __( 'Restricted Display - Shortcodes and Blocks that allow querying content from this Pod and displaying any field will check access rights.', 'pods' ),
+ 'form' => __( 'Restricted Forms - The Form Shortcode and Block submitting new content or editing existing content will check access rights.', 'pods' ),
+ ],
+ 'depends-on' => [ 'restrict_dynamic_features' => '1' ],
+ 'excludes-on' => [ 'dynamic_features_allow' => '0' ],
+ ];
+
+ $default_restricted_dynamic_features_forms = [
+ 'edit',
+ ];
+
+ if ( ! $is_public_content_type ) {
+ $default_restricted_dynamic_features_forms[] = 'add';
+ }
+
+ $options['restricted_dynamic_features_forms'] = [
+ 'label' => __( 'Dynamic Features to Restrict for Forms', 'pods' ),
+ 'help' => [
+ __( 'This will check access rights for whether someone should have access to specific content before a they can add or edit content.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => $default_restricted_dynamic_features_forms,
+ 'pick_format_type' => 'multi',
+ 'pick_format_multi' => 'checkbox',
+ 'data' => [
+ 'add' => __( 'Restricted Add New Forms - Embedding the Form Shortcode and Block to allow for adding new content will check access rights.', 'pods' ),
+ 'edit' => __( 'Restricted Edit Forms - Embedding the Form Shortcode and Block to allow for editing existing content will check access rights.', 'pods' ),
+ ],
+ 'depends-on-multi' => [ 'restricted_dynamic_features' => 'form' ],
+ 'excludes-on' => [ 'dynamic_features_allow' => '0' ],
+ ];
+
+ $options['show_access_restricted_messages'] = [
+ 'label' => __( 'Access-related Restricted Messages', 'pods' ),
+ 'help' => [
+ __( 'Access-related Restricted Messages will show to anyone who does not have access to add/edit/read a specific item from a content type.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => 'inherit',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '1' => __( 'Enable access-related restricted messages for forms/content displayed (instead of the form/content output)', 'pods' ),
+ '0' => __( 'Disable access-related restricted messages for forms/content displayed (the form/content output will be blank)', 'pods' ),
+ 'inherit' => __( 'Default - Use the global Pods setting for this', 'pods' ),
+ ],
+ 'depends-on' => [ 'restrict_dynamic_features' => '1' ],
+ 'excludes-on' => [ 'dynamic_features_allow' => '0' ],
+ ];
+
+ $options['show_access_admin_notices'] = [
+ 'label' => __( 'Access-related Admin Notices', 'pods' ),
+ 'help' => [
+ __( 'Access-related Admin Notices will only show to admins and will appear above content/forms that may not be entirely public.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => 'inherit',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '1' => __( 'Enable access-related admin notices above forms/content displayed', 'pods' ),
+ '0' => __( 'Disable access-related admin notices above forms/content displayed', 'pods' ),
+ 'inherit' => __( 'Default - Use the global Pods setting for this', 'pods' ),
+ ],
+ 'depends-on' => [ 'restrict_dynamic_features' => '1' ],
+ 'excludes-on' => [ 'dynamic_features_allow' => '0' ],
+ ];
+ }
+
+ $options['security_access_rights_preview'] = [
+ 'label' => __( 'Capabilities preview', 'pods' ),
+ 'type' => 'html',
+ 'html_content' => '
+ ' . esc_html__( 'Below is a list of capabilities that a user will normally need for this content.' ) . '
+ ' . pods_access_get_capabilities_preview( $pod_type, $pod_name ),
+ ];
+
+ return $options;
+}
+
+/**
+ * Get the list of dynamic features allow options.
+ *
+ * @since 3.1.0
+ *
+ * @return array The list of dynamic features allow options.
+ */
+function pods_access_get_dynamic_features_allow_options(): array {
+ return [
+ 'inherit' => __( 'WP Default (if content type is Public)', 'pods' ),
+ '1' => __( 'Enabled', 'pods' ),
+ '0' => '🔒 ' . __( 'Disabled', 'pods' ),
+ ];
+}
+
+/**
+ * Get the list of restricted dynamic features options.
+ *
+ * @since 3.1.0
+ *
+ * @return array The list of restricted dynamic features options.
+ */
+function pods_access_get_restricted_dynamic_features_options(): array {
+ return [
+ 'display' => '🔒 ' . __( 'Display', 'pods' ),
+ 'form' => '🔒 ' . __( 'Form', 'pods' ),
+ ];
+}
+
+/**
+ * Get the access rights capabilities preview HTML.
+ *
+ * @since 3.1.0
+ *
+ * @param string $pod_type The pod type.
+ * @param string $pod_name The pod name.
+ *
+ * @return string The access rights capabilities preview HTML.
+ */
+function pods_access_get_capabilities_preview( string $pod_type, string $pod_name ): string {
+ $capabilities = pods_access_map_capabilities(
+ [
+ 'object_type' => $pod_type,
+ 'object_name' => $pod_name,
+ ],
+ null,
+ true
+ );
+
+ if ( null === $capabilities ) {
+ $capabilities = [
+ 'read' => null,
+ 'add' => null,
+ 'edit' => null,
+ 'delete' => null,
+ ];
+ }
+
+ $capabilities_preview = [
+ 'read' => esc_html__( 'Read capability', 'pods' ),
+ 'add' => esc_html__( 'Add New capability', 'pods' ),
+ 'edit' => esc_html__( 'Edit capability', 'pods' ),
+ 'delete' => esc_html__( 'Delete capability', 'pods' ),
+ 'read_private' => esc_html__( 'Read Private capability', 'pods' ),
+ 'edit_others' => esc_html__( 'Edit Others capability', 'pods' ),
+ 'delete_others' => esc_html__( 'Delete Others capability', 'pods' ),
+ 'delete_published' => esc_html__( 'Delete Published capability', 'pods' ),
+ 'delete_private' => esc_html__( 'Delete Private capability', 'pods' ),
+ ];
+
+ $capabilities_preview_list = [
+ '' . $capabilities_preview['read'] . ': ' . ( $capabilities['read'] ?: __( 'Not restricted', 'pods' ) ),
+ ];
+
+ if ( 'settings' !== $pod_type ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['add'] . ': ' . ( $capabilities['add'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ $capabilities_preview_list[] = '' . $capabilities_preview['edit'] . ': ' . ( $capabilities['edit'] ?: __( 'Not restricted', 'pods' ) );
+
+ if ( 'settings' !== $pod_type ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['delete'] . ': ' . ( $capabilities['delete'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ if ( $capabilities && array_key_exists( 'read_private', $capabilities ) ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['read_private'] . ': ' . ( $capabilities['read_private'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ if ( $capabilities && array_key_exists( 'edit_others', $capabilities ) ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['edit_others'] . ': ' . ( $capabilities['edit_others'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ if ( $capabilities && array_key_exists( 'delete_others', $capabilities ) ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['delete_others'] . ': ' . ( $capabilities['delete_others'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ if ( $capabilities && array_key_exists( 'delete_published', $capabilities ) ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['delete_published'] . ': ' . ( $capabilities['delete_published'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ if ( $capabilities && array_key_exists( 'delete_private', $capabilities ) ) {
+ $capabilities_preview_list[] = '' . $capabilities_preview['delete_private'] . ': ' . ( $capabilities['delete_private'] ?: __( 'Not restricted', 'pods' ) );
+ }
+
+ return '
+
+ - ' . implode( '
- ', $capabilities_preview_list ) . '
+
+ ';
+}
+
+/**
+ * Get the pod settings config for access-related settings.
+ *
+ * @since 3.1.0
+ *
+ * @return array The pod settings config for access-related settings.
+ */
+function pods_access_settings_config(): array {
+ $first_pods_version = get_option( 'pods_framework_version_first' );
+ $first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
+
+ $fields = [];
+
+ $fields['dynamic_features_allow'] = [
+ 'name' => 'dynamic_features_allow',
+ 'label' => __( 'Dynamic Features', 'pods' ),
+ 'help' => [
+ __( 'Enabling Dynamic Features will also enable the additional access rights checks for user access. This ensures that people viewing embedded content and forms have the required capabilties. Even when Dynamic Features are disabled, you can still embed Pods Content and Forms through PHP and make use of other features directly through code.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'description' => __( 'Dynamic features include Pods Shortcodes, Blocks, and Widgets which let you embed content and forms on your site.', 'pods' ),
+ 'type' => 'pick',
+ 'default' => '1',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '1' => __( 'Enable Dynamic Features including Pods Shortcodes, Blocks, and Widgets', 'pods' ),
+ '0' => __( 'Disable All Dynamic Features in Pods', 'pods' ),
+ ],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
+ ];
+
+ $fields['security_access_rights_info'] = [
+ 'name' => 'security_access_rights_info',
+ 'label' => __( 'How access rights work in Pods', 'pods' ),
+ 'type' => 'html',
+ 'html_content' => sprintf(
+ '
+ %1$s
+ %2$s
+ ',
+ __( 'Pods handles access rights similar to how WordPress itself works.', 'pods' ),
+ __( 'Read more about how access rights work in Pods on our Documentation site', 'pods' )
+ ),
+ 'depends-on' => [ 'dynamic_features_allow' => '1' ],
+ ];
+
+ $fields['dynamic_features_enabled'] = [
+ 'name' => 'dynamic_features_enabled',
+ 'label' => __( 'Dynamic Features to Enable', 'pods' ),
+ 'help' => [
+ __( 'You can choose one or more dynamic features to enable. By default, only Display and Form are enabled.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => [
+ 'display',
+ 'form',
+ ],
+ 'pick_format_type' => 'multi',
+ 'pick_format_multi' => 'checkbox',
+ 'data' => [
+ 'display' => __( 'Display - Shortcodes and Blocks that allow querying content from *any* Pod and displaying any field (WordPress access rights are still checked).', 'pods' ),
+ 'form' => __( 'Form - The Form Shortcode and Block that allows submitting new content or editing existing content from *any* Pod (WordPress access rights are still checked).', 'pods' ),
+ 'view' => __( 'View - The View Shortcode and Block that allows embedding *any* theme file on a page.', 'pods' ),
+ ],
+ 'site_health_data' => [
+ 'display' => __( 'Display', 'pods' ),
+ 'form' => __( 'Form', 'pods' ),
+ 'view' => __( 'View', 'pods' ),
+ ],
+ 'depends-on' => [ 'dynamic_features_allow' => '1' ],
+ 'site_health_include_in_info' => true,
+ ];
+
+ $fields['show_access_restricted_messages'] = [
+ 'name' => 'show_access_restricted_messages',
+ 'label' => __( 'Access-related Restricted Messages', 'pods' ),
+ 'help' => [
+ __( 'Access-related Restricted Messages will show to anyone who does not have access to add/edit/read a specific item from a content type.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => '0',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '1' => __( 'Enable access-related restricted messages for forms/content displayed (instead of the form/content output)', 'pods' ),
+ '0' => __( 'Disable access-related restricted messages for forms/content displayed (the form/content output will be blank)', 'pods' ),
+ ],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
+ 'depends-on' => [ 'dynamic_features_allow' => '1' ],
+ ];
+
+ $fields['show_access_admin_notices'] = [
+ 'name' => 'show_access_admin_notices',
+ 'label' => __( 'Access-related Admin Notices', 'pods' ),
+ 'help' => [
+ __( 'Access-related Admin Notices will only show to admins and will appear above content/forms that may not be entirely public.', 'pods' ),
+ 'https://docs.pods.io/displaying-pods/access-rights-in-pods/',
+ ],
+ 'type' => 'pick',
+ 'default' => '1',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ '1' => __( 'Enable access-related admin notices above forms/content displayed', 'pods' ),
+ '0' => __( 'Disable access-related admin notices above forms/content displayed', 'pods' ),
+ ],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
+ 'depends-on' => [ 'dynamic_features_allow' => '1' ],
+ ];
+
+ $fields['dynamic_features_allow_sql_clauses'] = [
+ 'name' => 'dynamic_features_allow_sql_clauses',
+ 'label' => __( 'Allow SQL clauses to be used in Dynamic Features', 'pods' ),
+ 'description' => __( 'SQL clauses in general should only be enabled for sites with trusted users. Since WordPress allows anyone to enter any shortcode or block in the editor, any person with the Contributor role or higher could have access to use this.', 'pods' ),
+ 'type' => 'pick',
+ 'default' => version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? 'simple' : '0',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ 'all' => __( 'Unrestricted - Enable ALL SQL clause usage through dynamic features (only use this if you trust ALL users who have access to create content)', 'pods' ),
+ 'simple' => __( 'Restricted - Enable Simple SQL clause usage (only SELECT, WHERE, and ORDER BY) through dynamic features (only use this if you trust ALL users who have access to create content)', 'pods' ),
+ '0' => __( 'Disable SQL clause usage through dynamic features', 'pods' ),
+ ],
+ 'site_health_data' => [
+ 'all' => __( 'Unrestricted', 'pods' ),
+ 'simple' => __( 'Restricted', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'depends-on' => [
+ 'dynamic_features_allow' => '1',
+ ],
+ 'depends-on-multi' => [
+ 'dynamic_features_enabled' => 'display',
+ ],
+ 'site_health_include_in_info' => true,
+ ];
+
+ $fields['display_callbacks'] = [
+ 'name' => 'display_callbacks',
+ 'label' => __( 'Display callbacks', 'pods' ),
+ 'description' => __( 'Callbacks can be used when using Pods Templating syntax like {@my_field,my_callback} in your magic tags.', 'pods' ),
+ 'type' => 'pick',
+ 'default' => version_compare( $first_pods_version, '3.1.0-a-1', '<' ) ? 'restricted' : 'customized',
+ 'pick_format_type' => 'single',
+ 'pick_format_single' => 'radio',
+ 'data' => [
+ 'restricted' => __( 'Restricted - Certain system PHP functions are disallowed from being used for security reasons.', 'pods' ),
+ 'customized' => __( 'Customized - Only allow a list of specific PHP function callbacks.', 'pods' ),
+ '0' => __( 'Disable display callbacks', 'pods' ),
+ ],
+ 'site_health_data' => [
+ 'restricted' => __( 'Restricted', 'pods' ),
+ 'customized' => __( 'Customized', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'depends-on' => [
+ 'dynamic_features_allow' => '1',
+ ],
+ 'depends-on-multi' => [
+ 'dynamic_features_enabled' => 'display',
+ ],
+ 'site_health_include_in_info' => true,
+ ];
+
+ $fields['display_callbacks_allowed'] = [
+ 'name' => 'display_callbacks_allowed',
+ 'label' => __( 'Display callbacks allowed', 'pods' ),
+ 'description' => __( 'Please provide a comma-separated list of PHP function names to allow in callbacks.', 'pods' ),
+ 'type' => 'text',
+ 'default' => 'esc_attr,esc_html',
+ 'depends-on' => [
+ 'dynamic_features_allow' => '1',
+ 'display_callbacks' => 'allowed',
+ ],
+ 'depends-on-multi' => [
+ 'dynamic_features_enabled' => 'display',
+ ],
+ 'site_health_include_in_info' => true,
+ ];
+
+ return $fields;
+}
+
+/**
+ * Get the bleep placeholder text.
+ *
+ * @since 3.1.0
+ *
+ * @return string The bleep placeholder text.
+ */
+function pods_access_bleep_placeholder(): string {
+ return '****************';
+}
+
+/**
+ * Process the value and bleep it if it needs to be.
+ *
+ * @since 3.1.0
+ *
+ * @param string|mixed $value The value to be bleeped.
+ *
+ * @return string|mixed The bleeped text if not empty, otherwise the value as it was.
+ */
+function pods_access_bleep_text( $value ) {
+ $bleep_text = pods_access_bleep_placeholder();
+
+ if ( 0 < strlen( (string) $value ) ) {
+ $value = $bleep_text;
+ }
+
+ return $value;
+}
+
+/**
+ * Process the data and bleep anything that needs to be.
+ *
+ * @since 3.1.0
+ *
+ * @param array|object $data The data to be bleeped.
+ * @param array $additional_bleep_properties The additional properties to be bleeped from objects and arrays.
+ *
+ * @return array|object The bleeped data.
+ */
+function pods_access_bleep_data( $data, array $additional_bleep_properties = [] ) {
+ $bleep_properties = [
+ 'user_pass',
+ 'user_activation_key',
+ 'post_password',
+ ];
+
+ /**
+ * Allow filtering the additional properties to be bleeped from objects and arrays.
+ *
+ * @since 3.1.0
+ *
+ * @param array $additional_bleep_properties The additional properties to be bleeped from objects and arrays.
+ * @param array|object $data The data to be bleeped.
+ */
+ $additional_bleep_properties = apply_filters( 'pods_access_bleep_properties', $additional_bleep_properties, $data );
+
+ $bleep_properties = array_merge( $bleep_properties, $additional_bleep_properties );
+
+ $bleep_text = pods_access_bleep_placeholder();
+
+ if ( is_object( $data ) ) {
+ foreach ( $bleep_properties as $bleep_property ) {
+ if ( isset( $data->{$bleep_property} ) ) {
+ $data->{$bleep_property} = 0 < strlen( (string) $data->{$bleep_property} ) ? $bleep_text : '';
+ }
+ }
+ } elseif ( is_array( $data ) ) {
+ foreach ( $bleep_properties as $bleep_property ) {
+ if ( isset( $data[ $bleep_property ] ) ) {
+ $data[ $bleep_property ] = 0 < strlen( (string) $data[ $bleep_property ] ) ? $bleep_text : '';
+ }
+ }
+ }
+
+ return $data;
+}
+
+/**
+ * Process the data and bleep anything that needs to be.
+ *
+ * @since 3.1.0
+ *
+ * @param array $items The items to be bleeped.
+ * @param array $additional_bleep_properties The additional properties to be bleeped from objects and arrays.
+ *
+ * @return array|object The bleeped data.
+ */
+function pods_access_bleep_items( array $items, array $additional_bleep_properties = [] ) {
+ // Call the pods_access_bleep_data() function for all items in the $items array.
+ return array_map(
+ static function ( $item ) use ( $additional_bleep_properties ) {
+ return pods_access_bleep_data( $item, $additional_bleep_properties );
+ },
+ $items
+ );
+}
+
+/**
+ * Determine whether the SQL fragment is allowed to be used.
+ *
+ * @since 3.1.0
+ *
+ * @param string $sql The SQL fragment to check.
+ * @param string $context The SQL fragment context.
+ * @param array $args {
+ * The arguments to use.
+ *
+ * @type string|null $object_type The object type.
+ * @type string|null $object_name The object name.
+ * @type int|string|null $item_id The item ID.
+ * @type Pods|null $pods The Pods object.
+ * @type Pod|null $pod The Pod object.
+ * @type bool $build_pods Whether to try to build a Pods object from the object type/name/ID (false by default).
+ * @type bool $build_pod Whether to try to build a Pod object from the object type/name (false by default).
+ * }
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_is_allowed( string $sql, string $context, array $args = [] ): bool {
+ $context = strtoupper( $context );
+
+ $info = pods_info_from_args( $args );
+
+ /**
+ * Allows filtering whether the SQL fragment is allowed to be used.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ * @param string $context The SQL fragment context.
+ * @param array $info Pod information.
+ */
+ return (bool) apply_filters( 'pods_access_sql_fragment_is_allowed', true, $sql, $context, $info );
+}
+
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_mismatch_parenthesis', 10, 2 );
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_unsafe_functions', 10, 2 );
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_unsafe_tables', 10, 2 );
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_double_hyphens', 10, 2 );
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_subqueries', 10, 2 );
+add_filter( 'pods_access_sql_fragment_is_allowed', 'pods_access_sql_fragment_disallow_post_status', 10, 4 );
+
+/**
+ * Disallow mismatched parenthesis from being used in SQL fragments.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_mismatch_parenthesis( bool $allowed, string $sql ): bool {
+ return (
+ $allowed
+ && substr_count( $sql, '(' ) === substr_count( $sql, ')' )
+ );
+}
+
+/**
+ * Disallow unsafe functions from being used in SQL fragments.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_unsafe_functions( bool $allowed, string $sql ): bool {
+ if ( ! $allowed ) {
+ return $allowed;
+ }
+
+ $unsafe_functions = [
+ 'USER',
+ 'DATABASE',
+ 'VERSION',
+ 'FROM_BASE64',
+ 'TO_BASE64',
+ 'SLEEP',
+ 'WAIT_FOR_EXECUTED_GTID_SET',
+ 'WAIT_UNTIL_SQL_THREAD_AFTER_GTIDS',
+ 'MASTER_POS_WAIT',
+ 'SOURCE_POS_WAIT',
+ 'LOAD_FILE',
+ ];
+
+ /**
+ * Allow filtering the list of unsafe functions to disallow.
+ *
+ * @since 3.1.0
+ *
+ * @param array $unsafe_functions The list of unsafe functions to disallow.
+ * @param string $sql The SQL fragment to check.
+ */
+ $unsafe_functions = (array) apply_filters( 'pods_access_sql_fragment_disallow_unsafe_functions', $unsafe_functions, $sql );
+
+ $unsafe_functions = array_filter( $unsafe_functions );
+
+ foreach ( $unsafe_functions as $unsafe_function ) {
+ if ( 1 === (int) preg_match( '/\s*' . preg_quote( $unsafe_function, '/' ) . '\s*\(/i', $sql ) ) {
+ return false;
+ }
+ }
+
+ return $allowed;
+}
+
+/**
+ * Disallow unsafe tables from being used in SQL fragments.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_unsafe_tables( bool $allowed, string $sql ): bool {
+ if ( ! $allowed ) {
+ return $allowed;
+ }
+
+ $unsafe_tables = [
+ 'mysql.',
+ 'information_schema.',
+ 'performance_schema.',
+ 'sys.',
+ ];
+
+ /**
+ * Allow filtering the list of unsafe tables to disallow.
+ *
+ * @since 3.1.0
+ *
+ * @param array $unsafe_tables The list of unsafe tables to disallow.
+ * @param string $sql The SQL fragment to check.
+ */
+ $unsafe_tables = (array) apply_filters( 'pods_access_sql_fragment_disallow_unsafe_tables', $unsafe_tables, $sql );
+
+ $unsafe_tables = array_filter( $unsafe_tables );
+
+ foreach ( $unsafe_tables as $unsafe_table ) {
+ if ( 1 === (int) preg_match( '/\s*' . preg_quote( $unsafe_table, '/' ) . '/i', $sql ) ) {
+ return false;
+ }
+ }
+
+ return $allowed;
+}
+
+/**
+ * Disallow double hyphens from being used in SQL fragments.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_double_hyphens( bool $allowed, string $sql ): bool {
+ return (
+ $allowed
+ && false === strpos( $sql, '--' )
+ );
+}
+
+/**
+ * Disallow subqueries from being used in SQL fragments.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_subqueries( bool $allowed, string $sql ): bool {
+ return (
+ $allowed
+ && 0 === (int) preg_match( '/\s*SELECT(\s|\()+/i', $sql )
+ );
+}
+
+/**
+ * Disallow post_status from being used in the WHERE/HAVING SQL fragment unless they have admin access.
+ *
+ * @since 3.1.0
+ *
+ * @param bool $allowed Whether the SQL fragment is allowed to be used.
+ * @param string $sql The SQL fragment to check.
+ * @param string $context The SQL fragment context.
+ * @param array $info Pod information.
+ *
+ * @return bool Whether the SQL fragment is allowed to be used.
+ */
+function pods_access_sql_fragment_disallow_post_status( bool $allowed, string $sql, string $context, array $info ): bool {
+ if ( 'WHERE' !== $context && 'HAVING' !== $context ) {
+ return $allowed;
+ }
+
+ return (
+ $allowed
+ && (
+ false === stripos( $sql, 'post_status' )
+ || pods_is_admin( 'edit_posts' )
+ )
+ );
+}
+
+/**
+ * Safely unserialize data if it's PHP serialized.
+ *
+ * @since 3.1.0
+ *
+ * @param string|mixed $data The data to unserialize.
+ *
+ * @return array|string|mixed The unserialized data if it was PHP serialized, otherwise the data as it was.
+ */
+function pods_maybe_safely_unserialize( $data ) {
+ // The $options parameter of unserialize() requires PHP 7.0+.
+ if ( version_compare( PHP_VERSION, '7.0', '<' ) ) {
+ // Fall back to normal WP function.
+ return maybe_unserialize( $data );
+ }
+
+ // Check if the data is serialized.
+ if ( is_serialized( $data ) ) {
+ $data = trim( $data );
+
+ // Unserialize the data but exclude classes.
+ return @unserialize( $data, [ 'allowed_classes' => false ] );
+ }
+
+ return $data;
+}
diff --git a/includes/classes.php b/includes/classes.php
index 17566f61e5..f75e68b02c 100644
--- a/includes/classes.php
+++ b/includes/classes.php
@@ -51,7 +51,7 @@ function pods( $type = null, $id = null, $strict = null ) {
* @param bool $strict (optional) If set to true, returns false instead of a Pods object, if the Pod itself doesn't
* exist. Note: If you want to check if the Pods Item itself doesn't exist, use exists().
*
- * @return bool|\Pods returns false if $strict, WP_DEBUG, PODS_STRICT or (PODS_DEPRECATED && PODS_STRICT_MODE) are true
+ * @return bool|\Pods|WP_Error returns false if $strict, WP_DEBUG, PODS_STRICT or (PODS_DEPRECATED && PODS_STRICT_MODE) are true
*
* @link https://docs.pods.io/code/pods/
*/
@@ -259,14 +259,15 @@ function pods_i18n() {
* @param string $cache_mode (optional) Specify the caching method to use for the view, available options include
* cache, transient, or site-transient
* @param bool $return (optional) Whether to return the view or not, defaults to false and will echo it
+ * @param bool $limited (optional) Whether to limit the view to only the theme directory, defaults to false
*
* @return string|bool The view output
*
* @since 2.0.0
* @link https://docs.pods.io/code/pods-view/
*/
-function pods_view( $view, $data = null, $expires = false, $cache_mode = 'cache', $return = false ) {
- $view = PodsView::view( $view, $data, $expires, $cache_mode );
+function pods_view( $view, $data = null, $expires = false, $cache_mode = 'cache', $return = false, $limited = false ) {
+ $view = PodsView::view( $view, $data, $expires, $cache_mode, $limited );
if ( $return ) {
return $view;
diff --git a/includes/data.php b/includes/data.php
index f5381d7dd2..d6b1212b2b 100644
--- a/includes/data.php
+++ b/includes/data.php
@@ -660,6 +660,8 @@ function pods_v( $var = null, $type = 'get', $default = null, $strict = false, $
case 'globals':
if ( isset( $GLOBALS[ $var ] ) ) {
$output = $GLOBALS[ $var ];
+
+ $output = pods_access_bleep_data( $output );
}
break;
case 'cookie':
@@ -681,9 +683,9 @@ function pods_v( $var = null, $type = 'get', $default = null, $strict = false, $
if ( is_user_logged_in() ) {
$user = get_userdata( get_current_user_id() );
- if ( 'user_pass' === $var || 'user_activation_key' === $var ) {
- $value = '';
- } elseif ( isset( $user->{$var} ) ) {
+ $user = pods_access_bleep_data( $user );
+
+ if ( isset( $user->{$var} ) ) {
$value = $user->{$var};
} elseif ( 'role' === $var ) {
$value = '';
@@ -1295,18 +1297,18 @@ function pods_cast( $value, $cast_from = null ) {
}
/**
- * Create a slug from an input string
+ * Create a sanitized slug from a value.
*
- * @param string $orig Original string.
- * @param bool $strict Whether to only support 0-9, a-z, A-Z, and dash characters.
+ * @since 1.8.9
*
- * @return string Sanitized slug
+ * @param string $value The value to create the slug from.
+ * @param bool $strict Whether to only support 0-9, a-z, A-Z, and dash characters.
*
- * @since 1.8.9
+ * @return string The sanitized slug.
*/
-function pods_create_slug( $orig, $strict = true ) {
- $str = remove_accents( $orig );
- $str = preg_replace( '/([_ \\/])/', '-', trim( $orig ) );
+function pods_create_slug( $value, $strict = true ) {
+ $str = remove_accents( $value );
+ $str = preg_replace( '/([_ \\/])/', '-', trim( $str ) );
if ( $strict ) {
$str = preg_replace( '/([^0-9a-z\-])/', '', strtolower( $str ) );
@@ -1316,9 +1318,17 @@ function pods_create_slug( $orig, $strict = true ) {
$str = preg_replace( '/(\-){2,}/', '-', $str );
$str = trim( $str, '-' );
- $str = apply_filters( 'pods_create_slug', $str, $orig );
- return $str;
+ /**
+ * Allow filtering the sanitized slug.
+ *
+ * @since 1.8.9
+ *
+ * @param string $str The sanitized slug.
+ * @param string $value The value to create the slug from.
+ * @param bool $strict Whether to only support 0-9, a-z, A-Z, and dash characters.
+ */
+ return (string) apply_filters( 'pods_create_slug', $str, $value );
}
/**
@@ -2010,15 +2020,7 @@ function pods_serial_comma( $value, $field = null, $fields = null, $and = null,
return $value;
}
- // If something happens with table info, and this is a single select relationship, avoid letting user pass through.
- if ( isset( $value['user_pass'] ) ) {
- unset( $value['user_pass'] );
-
- // Since we know this is a single select, just pass display name through as the fallback.
- if ( isset( $value['display_name'] ) ) {
- $value = array( $value['display_name'] );
- }
- }
+ $value = pods_access_bleep_data( $value );
$original_value = $value;
diff --git a/includes/general.php b/includes/general.php
index c7ee4c4af5..3fbdf0a1cf 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -653,6 +653,11 @@ function pods_is_admin( $capabilities = null ) {
* @return bool Whether user has admin access.
*/
function pods_is_user_admin( int $user_id, $capabilities = null ): bool {
+ // Invalid user.
+ if ( $user_id < 1 ) {
+ return false;
+ }
+
// Normalize the capability we are checking.
if ( empty( $capabilities ) ) {
$capabilities = [];
@@ -1326,6 +1331,22 @@ function pods_doing_json() {
* @return string
*/
function pods_shortcode( $tags, $content = null ) {
+ return pods_shortcode_run_safely( $tags, $content );
+}
+
+/**
+ * Shortcode support for use anywhere that support WP Shortcodes.
+ * Will return error message on failure.
+ *
+ * @since 3.1.0
+ *
+ * @param array $tags An associative array of shortcode properties.
+ * @param string|null $content A string that represents a template override.
+ * @param bool $check_display_access_rights Whether to check access rights for the embedded content.
+ *
+ * @return string
+ */
+function pods_shortcode_run_safely( array $tags, ?string $content = null, bool $check_display_access_rights = true ): string {
pods_doing_shortcode( true );
$return_exception = static function() {
@@ -1335,8 +1356,18 @@ function pods_shortcode( $tags, $content = null ) {
add_filter( 'pods_error_mode', $return_exception, 50 );
add_filter( 'pods_error_exception_fallback_enabled', '__return_false', 50 );
+ $blog_is_switched = false;
+
+ if ( defined( 'PODS_SHORTCODE_ALLOW_BLOG_SWITCHING' ) && PODS_SHORTCODE_ALLOW_BLOG_SWITCHING && is_multisite() ) {
+ if ( ! empty( $tags['blog_id'] ) && is_numeric( $tags['blog_id'] ) && (int) get_current_blog_id() !== (int) $tags['blog_id'] ) {
+ switch_to_blog( (int) $tags['blog_id'] );
+
+ $blog_is_switched = true;
+ }
+ }
+
try {
- $return = pods_shortcode_run( $tags, $content );
+ $return = pods_shortcode_run( $tags, $content, $blog_is_switched, $check_display_access_rights );
} catch ( Throwable $throwable ) {
/**
* Allow filtering whether to throw errors for the shortcode.
@@ -1348,6 +1379,10 @@ function pods_shortcode( $tags, $content = null ) {
$throw_errors = apply_filters( 'pods_shortcode_throw_errors', false );
if ( $throw_errors ) {
+ if ( $blog_is_switched ) {
+ restore_current_blog();
+ }
+
throw $throwable;
}
@@ -1379,7 +1414,7 @@ function pods_shortcode( $tags, $content = null ) {
sprintf(
'%1$s: %2$s',
esc_html__( 'Pods Renderer Error', 'pods' ),
- esc_html__( 'There was a problem displaying this content, enable WP_DEBUG in wp-config.php to show more details.', 'pods' )
+ esc_html__( 'There was a problem displaying this content, enable WP_DEBUG in wp-config.php to show more details.', 'pods' )
),
'error',
true
@@ -1387,6 +1422,10 @@ function pods_shortcode( $tags, $content = null ) {
}
}
+ if ( $blog_is_switched ) {
+ restore_current_blog();
+ }
+
remove_filter( 'pods_error_mode', $return_exception, 50 );
remove_filter( 'pods_error_exception_fallback_enabled', '__return_false', 50 );
@@ -1449,13 +1488,21 @@ function pods_wrap_html( $html, $attributes = [] ) {
*
* @since 2.7.13
*
- * @param array $tags An associative array of shortcode properties.
- * @param string $content A string that represents a template override.
+ * @param array $tags An associative array of shortcode properties.
+ * @param string|null $content A string that represents a template override.
+ * @param bool $blog_is_switched Whether the blog is switched.
+ * @param bool $check_display_access_rights Whether to check access rights for the embedded content.
*
* @return string
*/
-function pods_shortcode_run( $tags, $content = null ) {
+function pods_shortcode_run( $tags, $content = null, $blog_is_switched = false, $check_display_access_rights = true ) {
if ( defined( 'PODS_DISABLE_SHORTCODE' ) && PODS_DISABLE_SHORTCODE ) {
+ if ( empty( $tags['field'] ) && pods_is_admin() ) {
+ return pods_get_access_admin_notice( [
+ 'content' => esc_html__( 'Pods dynamic features are disabled.', 'pods' ),
+ ] );
+ }
+
return '';
}
@@ -1509,6 +1556,7 @@ function pods_shortcode_run( $tags, $content = null ) {
'helper' => null,
'form' => null,
'form_output_type' => 'div',
+ 'form_key' => null,
'fields' => null,
'label' => null,
'thank_you' => null,
@@ -1524,13 +1572,28 @@ function pods_shortcode_run( $tags, $content = null ) {
$defaults = array_merge( $default_other_tags, $default_query_tags );
+ $original_tags = $tags;
+
if ( ! empty( $tags ) ) {
$tags = array_merge( $defaults, $tags );
} else {
$tags = $defaults;
}
- $tags = apply_filters( 'pods_shortcode', $tags );
+ // Bypass custom select if it might be aliasing or selecting data we don't want to work with.
+ if (
+ ! empty( $tags['select'] )
+ && is_string( $tags['select'] )
+ && (
+ false !== stripos( $tags['select'], 'user_pass' )
+ || false !== stripos( $tags['select'], 'user_activation_key' )
+ || false !== stripos( $tags['select'], 'post_password' )
+ )
+ ) {
+ $tags['select'] = null;
+ }
+
+ $tags = apply_filters( 'pods_shortcode', $tags, $content, $original_tags );
$tags['pagination'] = filter_var( $tags['pagination'], FILTER_VALIDATE_BOOLEAN );
$tags['search'] = filter_var( $tags['search'], FILTER_VALIDATE_BOOLEAN );
@@ -1544,8 +1607,12 @@ function pods_shortcode_run( $tags, $content = null ) {
if ( $tags['view'] && 0 < strlen( (string) $tags['view'] ) ) {
$return = '';
- if ( ( ! defined( 'PODS_SHORTCODE_ALLOW_VIEWS' ) || PODS_SHORTCODE_ALLOW_VIEWS ) && ! file_exists( $tags['view'] ) ) {
- $return = pods_view( $tags['view'], null, (int) $tags['expires'], $tags['cache_mode'], true );
+ // Confirm the feature is enabled and the file is allowed.
+ if (
+ pods_can_use_dynamic_feature( 'view' )
+ && PodsView::view_get_path( $tags['view'], true )
+ ) {
+ $return = pods_view( $tags['view'], null, (int) $tags['expires'], $tags['cache_mode'], true, true );
if ( $tags['shortcodes'] && defined( 'PODS_SHORTCODE_ALLOW_SUB_SHORTCODES' ) && PODS_SHORTCODE_ALLOW_SUB_SHORTCODES ) {
$return = do_shortcode( $return );
@@ -1567,14 +1634,25 @@ function pods_shortcode_run( $tags, $content = null ) {
return apply_filters( 'pods_shortcode_output', $return, $tags, null, 'view' );
}
- $blog_is_switched = false;
+ $is_form = ! empty( $tags['form'] );
- if ( defined( 'PODS_SHORTCODE_ALLOW_BLOG_SWITCHING' ) && PODS_SHORTCODE_ALLOW_BLOG_SWITCHING && is_multisite() ) {
- if ( ! empty( $tags['blog_id'] ) && is_numeric( $tags['blog_id'] ) && (int) get_current_blog_id() !== (int) $tags['blog_id'] ) {
- switch_to_blog( (int) $tags['blog_id'] );
+ // If the feature is disabled then return early.
+ if ( $is_form && ! pods_can_use_dynamic_feature( 'form' ) ) {
+ if ( pods_is_admin() ) {
+ return pods_get_access_admin_notice( [
+ 'content' => esc_html__( 'The Pods Form dynamic feature is disabled and this embed will not show.', 'pods' ),
+ ] );
+ }
- $blog_is_switched = true;
+ return '';
+ } elseif ( ! $is_form && ! pods_can_use_dynamic_feature( 'display' ) ) {
+ if ( empty( $tags['field'] ) && pods_is_admin() ) {
+ return pods_get_access_admin_notice( [
+ 'content' => esc_html__( 'The Pods Display dynamic feature is disabled and this embed will not show.', 'pods' ),
+ ] );
}
+
+ return '';
}
if ( ! $tags['use_current'] && empty( $tags['name'] ) ) {
@@ -1607,11 +1685,15 @@ function pods_shortcode_run( $tags, $content = null ) {
}
if ( ! $tags['use_current'] && empty( $tags['name'] ) ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
- return '' . esc_html__( 'Pods embed error: Please provide a Pod name', 'pods' ) . '
';
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'Please provide a Pod name.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
}
@@ -1628,11 +1710,15 @@ function pods_shortcode_run( $tags, $content = null ) {
}
if ( empty( $content ) && empty( $tags['pods_page'] ) && empty( $tags['template'] ) && empty( $tags['field'] ) && empty( $tags['form'] ) ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
- return '' . esc_html__( 'Pods embed error: Please provide either a template or field name', 'pods' ) . '
';
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'Please provide either a template or field name.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
if ( ! $tags['use_current'] && ! isset( $id ) ) {
@@ -1676,11 +1762,15 @@ function pods_shortcode_run( $tags, $content = null ) {
}
if ( empty( $pod ) || ! $pod->valid() ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
- return '' . esc_html__( 'Pods embed error: Pod not found', 'pods' ) . '
';
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'Pod not found.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
$found = 0;
@@ -1688,47 +1778,181 @@ function pods_shortcode_run( $tags, $content = null ) {
$is_singular = ( ! empty( $id ) || $tags['use_current'] );
+ $return = '';
+
+ $info = pods_info_from_args( [
+ 'item_id' => $is_singular ? $id : null,
+ 'pods' => $pod,
+ ] );
+
+ // Determine if this is is a public content type.
+ if (
+ $check_display_access_rights
+ ) {
+ // Check access rights for editor mode and preview of this embed.
+ if ( ! empty( $tags['_is_editor_mode'] ) || ! empty( $tags['_is_preview'] ) || is_preview() ) {
+ $check_post_id = ! empty( $tags['_preview_id'] ) ? (int) $tags['_preview_id'] : get_queried_object_id();
+
+ if ( ! current_user_can( 'publish_post', $check_post_id ) && ! pods_is_admin() ) {
+ // Stop display and only return the notice.
+ return empty( $tags['field'] ) ? pods_get_access_user_notice( $info, true, esc_html__( 'You do not have the capability to preview this Pods embed.', 'pods' ) ) : '';
+ }
+ }
+
+ $access_type = 'read';
+
+ if ( $is_form ) {
+ $access_type = $is_singular ? 'edit' : 'add';
+ }
+
+ if (
+ ! pods_is_type_public( $info )
+ || ! pods_can_use_dynamic_feature_unrestricted( $info, $is_form ? 'form' : 'display', $access_type )
+ ) {
+
+ // Stop handling the display and return the access notice if they do not have access to the private content type.
+ if ( ! pods_current_user_can_access_object( $info, $access_type, 'shortcode' ) ) {
+ // Stop display and only return the notice.
+ return empty( $tags['field'] ) ? pods_get_access_user_notice( $info ) : '';
+ }
+
+ // Show the admin-specific notice that this content may not be visible to others since it is not public.
+ if ( empty( $tags['field'] ) && pods_is_admin() ) {
+ // Include the notice in the display output to let the admin know and continue the display.
+ $return .= pods_get_access_admin_notice( $info );
+ }
+ } elseif (
+ $check_display_access_rights
+ && (
+ pods_access_bypass_post_with_password( $info )
+ || pods_access_bypass_private_post( $info )
+ )
+ ) {
+ // Stop display and only return the notice.
+ return empty( $tags['field'] ) ? pods_get_access_user_notice( $info ) : '';
+ }
+ }
+
if ( ! $is_singular ) {
$params = array();
- if ( ! defined( 'PODS_DISABLE_SHORTCODE_SQL' ) || ! PODS_DISABLE_SHORTCODE_SQL ) {
- $evaluate_tags_args = array(
- 'sanitize' => true,
- 'fallback' => '""',
- 'use_current_pod' => true,
- );
+ $can_use_dynamic_feature_all_sql_clauses = pods_can_use_dynamic_feature_sql_clauses( 'all' );
+ $can_use_dynamic_feature_simple_sql_clauses = pods_can_use_dynamic_feature_sql_clauses( 'simple' );
+ $shortcode_allow_evaluate_tags = pods_shortcode_allow_evaluate_tags();
- if ( $tags['orderby'] && 0 < strlen( (string) $tags['orderby'] ) ) {
- $params['orderby'] = $tags['orderby'];
+ $evaluate_tags_args = array(
+ 'sanitize' => true,
+ 'fallback' => '""',
+ 'use_current_pod' => true,
+ );
+
+ if ( $tags['select'] && 0 < strlen( (string) $tags['select'] ) ) {
+ if ( ! $can_use_dynamic_feature_simple_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['select'], 'SELECT', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'SELECT contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- if ( $tags['where'] && 0 < strlen( (string) $tags['where'] ) ) {
- $params['where'] = $tags['where'];
+ $params['select'] = $tags['select'];
+ }
- if ( pods_shortcode_allow_evaluate_tags() ) {
- $params['where'] = pods_evaluate_tags_sql( html_entity_decode( $params['where'] ), $evaluate_tags_args );
- }
+ if ( $tags['join'] && 0 < strlen( (string) $tags['join'] ) ) {
+ if ( ! $can_use_dynamic_feature_all_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['join'], 'JOIN', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'JOIN contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- if ( $tags['having'] && 0 < strlen( (string) $tags['having'] ) ) {
- $params['having'] = $tags['having'];
+ $params['join'] = $tags['join'];
+ }
- if ( pods_shortcode_allow_evaluate_tags() ) {
- $params['having'] = pods_evaluate_tags_sql( html_entity_decode( $params['having'] ), $evaluate_tags_args );
- }
+ if ( $tags['where'] && 0 < strlen( (string) $tags['where'] ) ) {
+ $tags['where'] = ltrim( $tags['where'], ')' );
+
+ if ( ! $can_use_dynamic_feature_simple_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['where'], 'WHERE', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'WHERE contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- if ( $tags['groupby'] && 0 < strlen( (string) $tags['groupby'] ) ) {
- $params['groupby'] = $tags['groupby'];
+ $params['where'] = $tags['where'];
+
+ if ( $shortcode_allow_evaluate_tags ) {
+ $params['where'] = pods_evaluate_tags_sql( html_entity_decode( $params['where'] ), $evaluate_tags_args );
}
+ }
- if ( $tags['select'] && 0 < strlen( (string) $tags['select'] ) ) {
- $params['select'] = $tags['select'];
+ if ( $tags['groupby'] && 0 < strlen( (string) $tags['groupby'] ) ) {
+ if ( ! $can_use_dynamic_feature_all_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['groupby'], 'GROUP BY', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'GROUP BY contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- if ( $tags['join'] && 0 < strlen( (string) $tags['join'] ) ) {
- $params['join'] = $tags['join'];
+
+ $params['groupby'] = $tags['groupby'];
+ }
+
+ if ( $tags['having'] && 0 < strlen( (string) $tags['having'] ) ) {
+ $tags['having'] = ltrim( $tags['having'], ')' );
+
+ if ( ! $can_use_dynamic_feature_all_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['having'], 'HAVING', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'HAVING contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- }//end if
+
+ $params['having'] = $tags['having'];
+
+ if ( $shortcode_allow_evaluate_tags ) {
+ $params['having'] = pods_evaluate_tags_sql( html_entity_decode( $params['having'] ), $evaluate_tags_args );
+ }
+ }
+
+ if ( $tags['orderby'] && 0 < strlen( (string) $tags['orderby'] ) ) {
+ if ( ! $can_use_dynamic_feature_simple_sql_clauses || ! pods_access_sql_fragment_is_allowed( $tags['orderby'], 'ORDER BY', $info ) ) {
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'ORDER BY contains SQL that is not allowed.', 'pods' )
+ ),
+ 'error',
+ true
+ );
+ }
+
+ $params['orderby'] = $tags['orderby'];
+ }
// Load filters and return HTML for later use.
if (
@@ -1790,40 +2014,35 @@ function pods_shortcode_run( $tags, $content = null ) {
}//end if
// Handle form output.
- if ( ! empty( $tags['form'] ) ) {
+ if ( $is_form ) {
if ( 'user' === $pod->pod ) {
- if ( false !== strpos( $tags['fields'], '_capabilities' ) || false !== strpos( $tags['fields'], '_user_level' ) ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
+ if (
+ false !== strpos( $tags['fields'], '_capabilities' )
+ || false !== strpos( $tags['fields'], '_capabilities' )
+ || false !== strpos( $tags['fields'], 'role' )
+ ) {
// Further hardening of User-based forms
- return '';
+ return pods_get_access_user_notice( $info, false, __( 'You cannot edit role or capabilities for users with Pods', 'pods' ) );
} elseif ( $is_singular && ( ! defined( 'PODS_SHORTCODE_ALLOW_USER_EDIT' ) || ! PODS_SHORTCODE_ALLOW_USER_EDIT ) ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
// Only explicitly allow user edit forms
- return '';
+ return pods_get_access_user_notice( $info, false, __( 'Edit user profile forms have been disabled on this site.', 'pods' ) );
}
}
$form_params = [
- 'fields' => $tags['fields'],
- 'label' => $tags['label'],
- 'thank_you' => $tags['thank_you'],
- 'output_type' => ! empty( $tags['form_output_type'] ) ? $tags['form_output_type'] : 'div',
+ 'fields' => $tags['fields'],
+ 'label' => $tags['label'],
+ 'thank_you' => $tags['thank_you'],
+ 'output_type' => ! empty( $tags['form_output_type'] ) ? $tags['form_output_type'] : 'div',
+ 'form_key' => $tags['form_key'],
+ // We already checked the access so we can bypass this.
+ 'check_access' => false,
];
- $return = $pod->form( $form_params );
+ $return .= $pod->form( $form_params );
$return = pods_wrap_html( $return, $tags );
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
/**
* Allow customization of shortcode output based on shortcode attributes.
*
@@ -1840,17 +2059,32 @@ function pods_shortcode_run( $tags, $content = null ) {
// Handle field output.
if ( ! empty( $tags['field'] ) ) {
if ( $tags['template'] || $content ) {
- $return = '';
$related = $pod->field( $tags['field'], array( 'output' => 'find' ) );
if ( $related instanceof Pods && $related->valid() ) {
// Content is null by default.
- $return .= $related->template( $tags['template'], $content );
+ $return_output = $related->template( $tags['template'], $content );
+
+ if ( null !== $return_output ) {
+ $return .= $return_output;
+ }
}
} elseif ( empty( $tags['helper'] ) ) {
- $return = $pod->display( $tags['field'] );
+ $return_output = $pod->display( $tags['field'] );
+
+ if ( null !== $return_output ) {
+ $return .= $return_output;
+ } else {
+ $return = '';
+ }
} else {
- $return = $pod->helper( $tags['helper'], $pod->field( $tags['field'] ), $tags['field'] );
+ $return_output = $pod->helper( $tags['helper'], $pod->field( $tags['field'] ), $tags['field'] );
+
+ if ( null !== $return_output ) {
+ $return .= $return_output;
+ } else {
+ $return = '';
+ }
}
// @todo $blog_is_switched >> Switch back before running other shortcodes?
@@ -1860,10 +2094,6 @@ function pods_shortcode_run( $tags, $content = null ) {
$return = pods_wrap_html( $return, $tags );
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
/**
* Allow customization of shortcode output based on shortcode attributes.
*
@@ -1882,14 +2112,18 @@ function pods_shortcode_run( $tags, $content = null ) {
$pods_page = Pods_Pages::exists( $tags['pods_page'] );
if ( empty( $pods_page ) ) {
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
- return '' . esc_html__( 'Pods embed error: Pods Page not found.', 'pods' ) . '
';
+ return pods_message(
+ sprintf(
+ '%1$s: %2$s',
+ esc_html__( 'Pods Embed Error', 'pods' ),
+ esc_html__( 'Pods Page not found.', 'pods' )
+ ),
+ 'error',
+ true
+ );
}
- $return = Pods_Pages::content( true, $pods_page );
+ $return .= Pods_Pages::content( true, $pods_page );
// @todo $blog_is_switched >> Switch back before running other shortcodes?
if ( $tags['shortcodes'] && defined( 'PODS_SHORTCODE_ALLOW_SUB_SHORTCODES' ) && PODS_SHORTCODE_ALLOW_SUB_SHORTCODES ) {
@@ -1898,10 +2132,6 @@ function pods_shortcode_run( $tags, $content = null ) {
$return = pods_wrap_html( $return, $tags );
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
/**
* Allow customization of shortcode output based on shortcode attributes.
*
@@ -1953,7 +2183,7 @@ function pods_shortcode_run( $tags, $content = null ) {
echo $pagination;
}
- $content = $pod->template( $tags['template'], $content );
+ $content = $pod->template( $tags['template'], $content, false, true );
if ( '' === trim( $content ) && ! empty( $tags['not_found'] ) ) {
$content = $pod->do_magic_tags( $tags['not_found'] );
@@ -1972,7 +2202,7 @@ function pods_shortcode_run( $tags, $content = null ) {
echo $filters;
}
- $return = ob_get_clean();
+ $return .= ob_get_clean();
if ( $tags['shortcodes'] && defined( 'PODS_SHORTCODE_ALLOW_SUB_SHORTCODES' ) && PODS_SHORTCODE_ALLOW_SUB_SHORTCODES ) {
$return = do_shortcode( $return );
@@ -1980,10 +2210,6 @@ function pods_shortcode_run( $tags, $content = null ) {
$return = pods_wrap_html( $return, $tags );
- if ( $blog_is_switched ) {
- restore_current_blog();
- }
-
/**
* Allow customization of shortcode output based on shortcode attributes.
*
@@ -3374,7 +3600,7 @@ function pods_meta_hook_list( $object_type = 'post', $object = null ) {
$first_pods_version = get_option( 'pods_framework_version_first' );
$first_pods_version = '' === $first_pods_version ? PODS_VERSION : $first_pods_version;
- $metadata_integration = ! $is_types_only && 1 === (int) pods_get_setting( 'metadata_integration', 1 );
+ $metadata_integration = ! $is_types_only && 1 === (int) pods_get_setting( 'metadata_integration', ( function_exists( 'wc_get_product' ) || version_compare( $first_pods_version, '2.9.14', '<' ) ) ? '1' : '0' );
$watch_changed_fields = ! $is_types_only && 1 === (int) pods_get_setting( 'watch_changed_fields', version_compare( $first_pods_version, '2.8.21', '<=' ) ? 1 : 0 );
$media_modal_fields = ! $is_types_only && 1 === (int) pods_get_setting( 'media_modal_fields', version_compare( $first_pods_version, '2.9.16', '<=' ) ? 1 : 0 );
@@ -4051,10 +4277,19 @@ function pods_session_start() {
*/
function pods_session_id() {
if ( false === pods_session_start() ) {
- return '';
+ $session_id = '';
+ } else {
+ $session_id = @session_id();
}
- return @session_id();
+ /**
+ * Allow overriding the session ID used by Pods.
+ *
+ * @since 3.1.0
+ *
+ * @param string $session_id The session ID.
+ */
+ return (string) apply_filters( 'pods_session_id', $session_id );
}
/**
diff --git a/init.php b/init.php
index ecb3c4f10d..8b884b2ea5 100644
--- a/init.php
+++ b/init.php
@@ -4,13 +4,13 @@
*
* @package Pods
* @author Pods Framework Team
- * @copyright 2023 Pods Foundation, Inc
+ * @copyright 2024 Pods Foundation, Inc
* @license GPL v2 or later
*
* Plugin Name: Pods - Custom Content Types and Fields
* Plugin URI: https://pods.io/
* Description: Pods is a framework for creating, managing, and deploying customized content types and fields
- * Version: 3.0.10
+ * Version: 3.1.0
* Author: Pods Framework Team
* Author URI: https://pods.io/about/
* Text Domain: pods
@@ -43,7 +43,7 @@
add_action( 'init', 'pods_deactivate_pods_ui' );
} else {
// Current version.
- define( 'PODS_VERSION', '3.0.10' );
+ define( 'PODS_VERSION', '3.1.0' );
// Current database version, this is the last version the database changed.
define( 'PODS_DB_VERSION', '2.3.5' );
@@ -106,6 +106,7 @@
require_once PODS_DIR . 'vendor/vendor-prefixed/autoload.php';
// Include global functions.
+ require_once PODS_DIR . 'includes/access.php';
require_once PODS_DIR . 'includes/classes.php';
require_once PODS_DIR . 'includes/data.php';
require_once PODS_DIR . 'includes/forms.php';
diff --git a/package.json b/package.json
index 8bf1ef8722..29917cb758 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "pods",
- "version": "3.0.10",
+ "version": "3.1.0",
"description": "Pods is a development framework for creating, extending, managing, and deploying customized content types in WordPress.",
"author": "Pods Foundation, Inc",
"homepage": "https://pods.io/",
diff --git a/readme.txt b/readme.txt
index 267a3ebaaf..28edef1e73 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,9 +3,9 @@ Contributors: sc0ttkclark, zrothauser, keraweb, jimtrue, quasel, nicdford, james
Donate link: https://friends.pods.io/
Tags: pods, custom post types, custom taxonomies, content types, custom fields, block
Requires at least: 6.0
-Tested up to: 6.4
+Tested up to: 6.5
Requires PHP: 7.2
-Stable tag: 3.0.10
+Stable tag: 3.1.0
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -121,7 +121,7 @@ You can enable some of our included components to extend your WordPress site eve
= Extend Pods with Free Third-party Add-Ons =
* [Paid Memberships Pro - Pods Add On](https://wordpress.org/plugins/pmpro-pods/) - Integrates Pods with [Paid Memberships Pro](https://wordpress.org/plugins/paid-memberships-pro/) to extend PMPro objects with custom fields added by Pods
-* [Panda Pods Repeater Field Add-On](https://wordpress.org/plugins/panda-pods-repeater-field/) - Lets you add groups of fields that repeat and are stored in their own custom database table (Advanced setup required)
+* [Panda Pods Repeater Field Add-On](https://wordpress.org/plugins/panda-pods-repeater-field/) - Lets you add groups of fields that repeat and are stored in their own custom database table (Advanced setup required)
= Pods Pro by SKCDEV Premium Add-Ons =
@@ -181,17 +181,40 @@ Pods really wouldn't be where it is without all the contributions from our [dono
== Changelog ==
+= 3.1 - February 21st, 2024 =
+
+*Security Release*
+
+While this release is meant to be as backwards compatible as possible, some aspects of security hardening may require manual intervention by site owners and their developers. There were no known reports and no known attempts to take advantage of the issues resolved by this release except where noted.
+
+Read more about [How access rights work with Pods](https://docs.pods.io/displaying-pods/access-rights-in-pods/) for more details including new filters/snippets that can provide limited access.
+
+* Security hardening: Introduced new access checks and additional fine-grained control over dynamic features across any place in Pods that allows embedding content or forms. This only applies to usage through Pods Blocks or Shortcodes. Using PHP will continue to expect you are handling this on your own unless you pass the appropriate arguments to the corresponding Pods methods. (@sc0ttkclark)
+* Security hardening: Prevent using the Pods Views Block / Shortcode to embed any files outside of the current theme. Props to the Nex Team / Wordfence for responsibly reporting this. (@sc0ttkclark)
+* Security hardening: Prevent output of `user_pass`, `user_activation_key`, and `post_password` through Pods dynamic features / PHP. These values will be set in Pods references to `****************` if they were not-empty so you can still do conditional checks as normal. While Scott was already aware of this in pre-planned security release work, additional props go to the Nex Team / Wordfence for responsibly reporting this too. (@sc0ttkclark)
+* Security hardening: Prevent more unsavory PHP display callbacks from being used with magic tags in addition to those already prevented. Props to the Nex Team / Wordfence for responsibly reporting this. (@sc0ttkclark)
+* Feature: Access rights > Access-related Admin notices and Errors can be hidden by admins in a new setting in Pods Admin > Settings > Security. (@sc0ttkclark)
+* Feature: Dynamic Features > Dynamic features (Pods Blocks and Shortcodes) can be disabled by admins in a new setting in Pods Admin > Settings > Security. (@sc0ttkclark)
+* Changed: Dynamic Features > New installs will now default to not allowing all SQL arguments to be used by dynamic features. Existing installs will default to only allowing simple SQL arguments. All SQL fragments are checked for disallowed usage like subqueries. This can be set in a new setting in Pods Admin > Settings > Security. (@sc0ttkclark)
+* Feature: Pods Display > The Display-related Pods Blocks and Shortcodes have additional checks that limit access to content based on the user viewing it. For Post Types that are non-public, they must have access to the `read` capability from that post type as a normal user. For displaying content from Users, they must have access to `list_users` capability to view that. [Read more about how access rights work with Pods](https://docs.pods.io/displaying-pods/access-rights-in-pods/) (@sc0ttkclark)
+* Feature: Pods Forms > The Pods Form Block and Form Shortcode have additional checks that limit access to creating/editing content based on the user submitting the form. For Post Types that are non-public, they must have access to the 'create' capability from that post type as a normal user. Forms that submit to the Users pod, now require that the submitter must have access to the `create_users` or `edit_users` capability to create or edit that user. [Read more about how access rights work with Pods](https://docs.pods.io/displaying-pods/access-rights-in-pods/) (@sc0ttkclark)
+* Feature: Pods Forms > The Pods Form Block and Form Shortcode now have a new option to identify the form with a custom key you choose that will get passed to various access-related filters so that developers can override access rights more easily. (@sc0ttkclark)
+* Feature: Pods Forms > When a user has access to create or edit content through a Pods form for a post type, the `post_content` field is cleaned based on the level of access they have to prevent inserting unintentional shortcodes or blocks. (@sc0ttkclark)
+* Feature: Markdown functionality has now been replaced by the [Parsedown library](https://github.com/erusev/parsedown) for better security and performance and it's uniquely prefixed so it prevents future conflicts with plugins using the same library. (@sc0ttkclark)
+* Changed: Pods Views > One of the breaking changes in this work is that the Pods Views Block / Shortcode dynamic feature is now disabled by default and must be enabled for new and existing installs. This can be done in a new setting in Pods Admin > Settings > Security. (@sc0ttkclark)
+* Changed: Display PHP callbacks > New installs will now default to only allowing specific callbacks to be used. This defaults the specific callbacks allowed to `esc_attr,esc_html` which can be further customized in Pods Admin > Settings > Security. (@sc0ttkclark)
+
= 3.0.10 - December 11th, 2023 =
* Fixed: The safe rendering handler for Pods Blocks now properly passes along context to all Pods Blocks so that they work within Query Loops again and other places they could take on context. (@sc0ttkclark)
* Fixed: Resolved PHP 8.3 deprecation notice with `get_class()` usage. #7225 (@netlas, @sc0ttkclark)
-* Fixed: File fields using the direct plupload option will properly avoid uploading files above the limit and handle uploading multiple files without losing all but the first file in the file list. #7138 (@sc0ttkclark, @PD-CM)
+* Fixed: File fields using the direct plupload option will properly avoid uploading files above the limit and handle uploading multiple files without losing all but the first file in the file list. #7138 (@sc0ttkclark, @PD-CM)
= 3.0.9 - December 7th, 2023 =
-* Feature: Added support for disabling Quick Edit for custom post types for sites on WP 6.4+. (@sc0ttkclark)
+* Feature: Added support for disabling Quick Edit for custom post types for sites on WP 6.4+. (@sc0ttkclark)
* Tweak: Revamped the Pods Blocks error handling so it looks nicer. (@sc0ttkclark)
-* Tweak: Updated the default values used for "Add New" labels to use "Add New {singularLabel}" instead to follow WP core's direction. (@sc0ttkclark)
+* Tweak: Updated the default values used for "Add New" labels to use "Add New {singularLabel}" instead to follow WP core's direction. (@sc0ttkclark)
* Fixed: Custom capability types now save as empty and remain empty as intended. When empty, they will default to the current post type name and a placeholder shows what that would be. #7218 (@sc0ttkclark)
* Fixed: Added more handling for SQL errors for Pods Blocks. #7207 (@sc0ttkclark)
* Fixed: Resolved WP debug notices when calling `wp_cache_flush_group` by checking if `wp_wp_cache_supports( 'flush_group' )` first. (@sc0ttkclark)
@@ -204,7 +227,7 @@ Pods really wouldn't be where it is without all the contributions from our [dono
= 3.0.7 - October 19th, 2023 =
* Fixed: Avoid duplicate fields showing up when registering fields manually through `pods_group_add()` instead of through normal DB or file-based configs. #6317 (@sc0ttkclark)
-* Fixed: Resolve cases where Settings pod types would treat every save as a new item. (@sc0ttkclark)
+* Fixed: Resolve cases where Settings pod types would treat every save as a new item. (@sc0ttkclark)
* Fixed: Swept through the codebase to fix all remaining return type issues with PHP 8+ for the most common extended/implemented methods. (@sc0ttkclark)
= 3.0.6 - October 2nd, 2023 =
@@ -214,7 +237,7 @@ Pods really wouldn't be where it is without all the contributions from our [dono
= 3.0.5 - October 2nd, 2023 =
-* Tweak: Added the "full" image size to the reference list in the Pods Template editor. #7183 #7184 (@JoryHogeveen)
+* Tweak: Added the "full" image size to the reference list in the Pods Template editor. #7183 #7184 (@JoryHogeveen)
* Fixed: PHP deprecated notices resolved for WYSIWYG field. #7182 (@sc0ttkclark)
* Fixed: Relationships with user capabilities filtered will now work as expected in more cases when using WP multisite. #7181 #7185 (@JoryHogeveen)
* Fixed: Enforce single value for inputs instead of arrays of values in single format for file/relationship field. This resolves issues with Conditional Logic not seeing the initial value on reload. (@sc0ttkclark)
@@ -238,7 +261,7 @@ Pods really wouldn't be where it is without all the contributions from our [dono
* Fixed: Bi-directional field saving has been restored after breaking in Pods 2.9.x. #7172 (@sc0ttkclark)
* Fixed: More PHP notices/warnings/errors with PHP 8+ addressed. #7170 #7171 (@sc0ttkclark)
* Fixed: Settings saving for simple relationships fixed when using a setting pod registered by code/file. #7169 (@sc0ttkclark)
-* Fixed: Settings forms would sometimes say the save failed when it was successful. (@sc0ttkclark)
+* Fixed: Settings forms would sometimes say the save failed when it was successful. (@sc0ttkclark)
* Fixed: Fix relationship rendering in tables for Advanced Content Types. #7173 (@sc0ttkclark)
* Fixed: Potential SQL errors when a Pod does not exist but it's still set a relationship object for a field. (@sc0ttkclark)
* Fixed: Pod config data is now correctly passed in all instances of `pods_meta_default_box_title` filter so it's uniform in usage. (@sc0ttkclark)
@@ -265,7 +288,7 @@ New minimum required versions have been updated as follows which includes notice
**3.0 Changelog**
* Feature: [Conditional Logic for Fields](https://docs.pods.io/fields/conditional-logic-for-fields/) - You can now choose to show or hide a Pods field based on the value of another Pods field. More will be expanded into this functionality in the future. #609 (@zrothauser, @sc0ttkclark, @Shelob9)
-* Feature: Support for the new Command Palettes feature added in WordPress 6.3. This will allow you to contextually go to the Edit Pod screen for the matching Pod configuration of that post type directly from the Edit Post screen. (@sc0ttkclark)
+* Feature: Support for the new Command Palettes feature added in WordPress 6.3. This will allow you to contextually go to the Edit Pod screen for the matching Pod configuration of that post type directly from the Edit Post screen. (@sc0ttkclark)
* Added: Set up backward compatible updates to our prior `depends-on` and related logic for internal conditional logic prior to Pods 3.0 so they now properly translate over to the new format required. (@sc0ttkclark)
* Added: When importing and exporting Pods packages, they now include the list of active components. (@sc0ttkclark)
* Fixed: Media saving issue has been resolved when the Media Modal fields are disabled, it now saves fields as expected. #7158 (@sc0ttkclark, @pd-cm)
@@ -274,7 +297,7 @@ New minimum required versions have been updated as follows which includes notice
* Fixed: When extending a post type or taxonomy it will now use the associated post type or taxonomy label when setting up the pod so it matches. #6350 (@sc0ttkclark)
* Fixed: Resolved problems with saving the featured image from frontend forms when a post type supports featured images. (@sc0ttkclark)
* Fixed: Don't show SQL errors when getting relationship data for forms if the debug display is disabled in WP. (@sc0ttkclark)
-* Fixed: Improved tooltip appearances with better color contrast. #7119 #7118 (@heybran)
+* Fixed: Improved tooltip appearances with better color contrast. #7119 #7118 (@heybran)
* Removed: The Tribe Common library has been removed from Pods and it will alleviate conflicts from plugins like The Events Calendar and Event Tickets going forward. (@sc0ttkclark)
= 2.9.19 - June 28th, 2023 =
@@ -307,7 +330,7 @@ New minimum required versions have been updated as follows which includes notice
= 2.9.15 - May 30th, 2023 =
* Added: Now showing text notices to explain where performance may be improved for Relationship single/multi select fields when relating to dynamic content which direct the admin to use Autocomplete or List View instead in certain circumstances. (@sc0ttkclark)
-* Added: Add repair tool that can help recover any Pods that have an invalid pod type / storage. (@sc0ttkclark)
+* Added: Add repair tool that can help recover any Pods that have an invalid pod type / storage. (@sc0ttkclark)
* Tweak: Make the default as Dropdown for single select relationship fields again after seeing some reported issues. (@sc0ttkclark)
* Fixed: Resolved more PHP 8.x compatibility issues for `strlen()` usage. (@sc0ttkclark)
* Fixed: Set default as Dropdown for relationship field configs across Pods. (@sc0ttkclark)
diff --git a/sql/update-1.x.php b/sql/update-1.x.php
index 33bf734cc9..7e406f845b 100644
--- a/sql/update-1.x.php
+++ b/sql/update-1.x.php
@@ -241,7 +241,7 @@
if ( version_compare( $old_version, '1.7.5', '<' ) ) {
if ( empty( $pods_roles ) && ! is_array( $pods_roles ) ) {
- $pods_roles = @unserialize( get_option( 'pods_roles' ) );
+ $pods_roles = pods_maybe_safely_unserialize( get_option( 'pods_roles' ) );
if ( ! is_array( $pods_roles ) ) {
$pods_roles = array();
diff --git a/sql/upgrade/PodsUpgrade_2_0_0.php b/sql/upgrade/PodsUpgrade_2_0_0.php
index e663e5a875..c6b7c58576 100644
--- a/sql/upgrade/PodsUpgrade_2_0_0.php
+++ b/sql/upgrade/PodsUpgrade_2_0_0.php
@@ -740,7 +740,7 @@ public function migrate_roles() {
$old_roles = get_option( 'pods_roles' );
if ( ! is_array( $old_roles ) && ! empty( $old_roles ) ) {
- $old_roles = @unserialize( $old_roles );
+ $old_roles = pods_maybe_safely_unserialize( $old_roles );
}
if ( ! is_array( $old_roles ) ) {
diff --git a/src/Pods/Admin/Config/Field.php b/src/Pods/Admin/Config/Field.php
index a40e6fdbb5..c5155a571e 100644
--- a/src/Pods/Admin/Config/Field.php
+++ b/src/Pods/Admin/Config/Field.php
@@ -570,16 +570,27 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
}
/**
- * Modify Additional Field Options tab
+ * Modify Additional Field Options tab for a specific field type.
*
* @since 2.7.0
*
- * @param array $type_options Additional field type options,
- * @param string $type Field type,
- * @param array $options Tabs, indexed by label,
+ * @param array $type_options Additional field type options.
+ * @param string $type Field type.
+ * @param array $options Tabs, indexed by label.
* @param null|\Pods\Whatsit\Pod $pod Pods object for the Pod this UI is for.
*/
$type_options = apply_filters( "pods_admin_setup_edit_{$type}_additional_field_options", $type_options, $type, $options, $pod );
+
+ /**
+ * Modify Additional Field Options tab.
+ *
+ * @since 2.7.0
+ *
+ * @param array $type_options Additional field type options.
+ * @param string $type Field type.
+ * @param array $options Tabs, indexed by label.
+ * @param null|\Pods\Whatsit\Pod $pod Pods object for the Pod this UI is for.
+ */
$type_options = apply_filters( 'pods_admin_setup_edit_additional_field_options', $type_options, $type, $options, $pod );
$options[ 'additional-field-' . $type ] = $type_options;
diff --git a/src/Pods/Admin/Config/Pod.php b/src/Pods/Admin/Config/Pod.php
index ede48cd659..3f8f5b3a34 100644
--- a/src/Pods/Admin/Config/Pod.php
+++ b/src/Pods/Admin/Config/Pod.php
@@ -25,6 +25,7 @@ public function get_tabs( \Pods\Whatsit\Pod $pod ) {
$admin_ui = false;
$connections = false;
$advanced = false;
+ $access = true;
$pod_type = pods_v( 'type', $pod );
$is_extended = $pod->is_extended();
@@ -66,6 +67,10 @@ public function get_tabs( \Pods\Whatsit\Pod $pod ) {
$core_tabs['advanced'] = __( 'Advanced Options', 'pods' );
}
+ if ( $access ) {
+ $core_tabs['access-rights'] = __( 'Access Rights', 'pods' );
+ }
+
// Only include kitchen sink if dev mode on and not running Codecept tests.
if ( pods_developer() && ! function_exists( 'codecept_debug' ) ) {
$core_tabs['kitchen-sink'] = __( 'Kitchen Sink (temp)', 'pods' );
@@ -137,14 +142,14 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'label' => __( 'Label', 'pods' ),
'help' => __( 'help', 'pods' ),
'type' => 'text',
- 'default' => pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', pods_v( 'name', $pod ) ) ) ),
+ 'default' => pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', $pod_name ) ) ),
'text_max_length' => 30,
],
'label_singular' => [
'label' => __( 'Singular Label', 'pods' ),
'help' => __( 'help', 'pods' ),
'type' => 'text',
- 'default' => pods_v( 'label_singular', $pod, pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', pods_v( 'name', $pod ) ) ) ) ),
+ 'default' => pods_v( 'label_singular', $pod, pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', $pod_name ) ) ) ),
'text_max_length' => 30,
],
'placeholder_enter_title_here' => [
@@ -640,14 +645,14 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'label' => __( 'Page Title', 'pods' ),
'help' => __( 'help', 'pods' ),
'type' => 'text',
- 'default' => str_replace( '_', ' ', pods_v( 'name', $pod ) ),
+ 'default' => str_replace( '_', ' ', $pod_name ),
'text_max_length' => 30,
],
'menu_name' => [
'label' => __( 'Menu Name', 'pods' ),
'help' => __( 'help', 'pods' ),
'type' => 'text',
- 'default' => pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', pods_v( 'name', $pod ) ) ) ),
+ 'default' => pods_v( 'label', $pod, ucwords( str_replace( '_', ' ', $pod_name ) ) ),
'text_max_length' => 30,
],
];
@@ -730,7 +735,7 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
],
];
- $post_type_name = pods_v( 'name', $pod, 'post_type', true );
+ $post_type_name = $pod_name ?: 'post_type';
/**
* Allow filtering the default post status.
@@ -778,9 +783,10 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
];
$options['advanced'] = [
- 'public' => [
+ 'public' => [
'label' => __( 'Public', 'pods' ),
- 'help' => __( 'help', 'pods' ),
+ 'help' => __( 'Regardless of this setting, you can still embed Pods Content and Forms through PHP and make use of other features directly through code.', 'pods' ),
+ 'description' => __( 'When a content type is public, it can be viewed by anyone when it is embedded through Dynamic Features, WordPress blocks, or through the REST API. Otherwise, a user will need to have the corresponding "read" capability for the content type.', 'pods' ),
'type' => 'boolean',
'default' => true,
'boolean_yes_label' => '',
@@ -817,7 +823,7 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'label' => __( 'Custom User Capability', 'pods' ),
'help' => __( 'help', 'pods' ),
'type' => 'text',
- 'text_placeholder' => pods_v( 'name', $pod ),
+ 'text_placeholder' => $pod_name,
'depends-on' => [ 'capability_type' => 'custom' ],
],
'capability_type_extra' => [
@@ -914,13 +920,6 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'default' => true,
'boolean_yes_label' => '',
],
- 'can_export' => [
- 'label' => __( 'Exportable', 'pods' ),
- 'help' => __( 'help', 'pods' ),
- 'type' => 'boolean',
- 'default' => true,
- 'boolean_yes_label' => '',
- ],
'default_status' => [
'label' => __( 'Default Status', 'pods' ),
'help' => __( 'help', 'pods' ),
@@ -1214,11 +1213,19 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
$options['advanced'] = [
'public' => [
'label' => __( 'Public', 'pods' ),
- 'help' => __( 'help', 'pods' ),
+ 'help' => __( 'Regardless of this setting, you can still embed Pods Content and Forms through PHP and make use of other features directly through code.', 'pods' ),
+ 'description' => __( 'When a content type is public, it can be viewed by anyone when it is embedded through Dynamic Features, WordPress blocks, or through the REST API. Otherwise, a user will need to have the corresponding "read" capability for the content type.', 'pods' ),
'type' => 'boolean',
'default' => true,
'boolean_yes_label' => '',
],
+ 'publicly_queryable' => [
+ 'label' => __( 'Publicly Queryable', 'pods' ),
+ 'help' => __( 'help', 'pods' ),
+ 'type' => 'boolean',
+ 'default' => pods_v( 'public', $pod, true ),
+ 'boolean_yes_label' => '',
+ ],
'hierarchical' => [
'label' => __( 'Hierarchical', 'pods' ),
'help' => __( 'Hierarchical taxonomies will have a list with checkboxes to select an existing category in the taxonomy admin box on the post edit page (like default post categories). Non-hierarchical taxonomies will just have an empty text field to type-in taxonomy terms to associate with the post (like default post tags).', 'pods' ),
@@ -1276,7 +1283,7 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'label' => __( 'Custom User Capability', 'pods' ),
'help' => __( 'Enables additional capabilities for this Taxonomy including: manage_{capability}_terms, edit_{capability}_terms, assign_{capability}_terms, and delete_{capability}_terms', 'pods' ),
'type' => 'text',
- 'text_placeholder' => pods_v( 'name', $pod ),
+ 'text_placeholder' => $pod_name,
'depends-on' => [ 'capability_type' => 'custom' ],
],
'query_var' => [
@@ -1286,14 +1293,6 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'default' => false,
'boolean_yes_label' => '',
],
- 'query_var' => [
- 'label' => __( 'Query Var', 'pods' ),
- 'help' => __( 'help', 'pods' ),
- 'type' => 'boolean',
- 'default' => false,
- 'dependency' => true,
- 'boolean_yes_label' => '',
- ],
'query_var_string' => [
'label' => __( 'Custom Query Var Name', 'pods' ),
'help' => __( 'help', 'pods' ),
@@ -1422,12 +1421,6 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
'depends-on' => [ 'menu_location' => 'top' ],
],
];
-
- // @todo fill this in
- $options['advanced'] = [
- 'temporary' => 'This type has the fields hardcoded',
- // :(
- ];
} elseif ( 'pod' === $pod_type ) {
$actions_enabled = [
'add',
@@ -1635,14 +1628,14 @@ public function get_fields( \Pods\Whatsit\Pod $pod, array $tabs ) {
];
}//end if
+ // Add access rights options.
+ $options['access-rights'] = pods_access_pod_options( $pod_type, $pod_name, $pod );
+
// Only include kitchen sink if dev mode on and not running Codecept tests.
if ( pods_developer() && ! function_exists( 'codecept_debug' ) ) {
$options['kitchen-sink'] = json_decode( file_get_contents( PODS_DIR . 'tests/codeception/_data/kitchen-sink-config.json' ), true );
}
- $pod_type = $pod['type'];
- $pod_name = $pod['name'];
-
/**
* Add admin fields to the Pods editor for a specific Pod.
*
diff --git a/src/Pods/Admin/Settings.php b/src/Pods/Admin/Settings.php
index 84f8d30e23..d0a9e9b24e 100644
--- a/src/Pods/Admin/Settings.php
+++ b/src/Pods/Admin/Settings.php
@@ -191,12 +191,17 @@ public function get_setting_fields() {
'default' => '0',
'readonly' => $is_types_only_overridden,
'description' => $is_types_only_overridden ? $is_types_only_disabled_text : '',
- 'pick_format' => 'single',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'0' => __( 'Enable creating custom fields with Pods', 'pods' ),
'1' => __( 'Disable creating custom fields with Pods (for when using Pods only for content types)', 'pods' ),
],
+ 'site_health_data' => [
+ '0' => __( 'Enable', 'pods' ),
+ '1' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
];
$fields['performance'] = [
@@ -212,13 +217,18 @@ public function get_setting_fields() {
'label' => __( 'Watch changed fields for use in hooks', 'pods' ),
'help' => __( 'By default, Pods does not watch changed fields when a post, term, user, or other Pods items are saved. Enabling this will allow you to use PHP hooks to reference the previous values of those fields after the save has happened.', 'pods' ),
'type' => 'pick',
- 'default' => version_compare( $first_pods_version, '2.8.21', '<=' ) ? '1' : '0',
- 'pick_format' => 'single',
+ 'default' => version_compare( $first_pods_version, '2.8.21', '<' ) ? '1' : '0',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'1' => __( 'Enable watching changed fields (may reduce performance with large processes)', 'pods' ),
'0' => __( 'Disable watching changed fields', 'pods' ),
],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
];
$fields['metadata_integration'] = [
@@ -226,14 +236,19 @@ public function get_setting_fields() {
'label' => __( 'Watch WP Metadata calls', 'pods' ),
'help' => __( 'By default, Pods will watch Metadata calls and send any values to table-based fields as well as index relationship IDs when they are saved. You can disable this if you do not use table-based Pods and you only want to query meta-based Pods or settings.', 'pods' ),
'type' => 'pick',
- 'default' => ! function_exists( 'wc_get_product' ) || version_compare( $first_pods_version, '2.9.14', '<' ) ? '1' : '0',
- 'pick_format' => 'single',
+ 'default' => ( function_exists( 'wc_get_product' ) || version_compare( $first_pods_version, '2.9.14', '<' ) ) ? '1' : '0',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'1' => __( 'Enable watching WP Metadata calls (may reduce performance with large processes)', 'pods' ),
'0' => __( 'Disable watching WP Metadata calls', 'pods' ),
],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
'dependency' => true,
+ 'site_health_include_in_info' => true,
];
$fields['metadata_override_get'] = [
@@ -241,14 +256,19 @@ public function get_setting_fields() {
'label' => __( 'Override WP Metadata values', 'pods' ),
'help' => __( 'By default, Pods will override Metadata values when calling functions like get_post_meta() so that it can provide more Relationship / File field context.', 'pods' ),
'type' => 'pick',
- 'default' => version_compare( $first_pods_version, '2.8.21', '<=' ) ? '1' : '0',
- 'pick_format' => 'single',
+ 'default' => version_compare( $first_pods_version, '2.8.21', '<' ) ? '1' : '0',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'1' => __( 'Enable overriding WP Metadata values (may conflict with certain plugins and decrease performance with large processes)', 'pods' ),
'0' => __( 'Disable overriding WP Metadata values', 'pods' ),
],
- 'depends-on' => [ 'metadata_integration' => '1' ],
+ 'site_health_data' => [
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'depends-on' => [ 'metadata_integration' => '1' ],
+ 'site_health_include_in_info' => true,
];
$fields['media_modal_fields'] = [
@@ -256,20 +276,25 @@ public function get_setting_fields() {
'label' => __( 'Show Pods fields in Media Library modals', 'pods' ),
'help' => __( 'This feature is only used when you have extended the WordPress Media object with Pods', 'pods' ),
'type' => 'pick',
- 'default' => version_compare( $first_pods_version, '2.9.16', '<=' ) ? '1' : '0',
- 'pick_format' => 'single',
+ 'default' => version_compare( $first_pods_version, '2.9.16', '<' ) ? '1' : '0',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'1' => __( 'Enable showing Pods fields in Media Library modals (may decrease performance with large numbers of items on admin screens with media grids)', 'pods' ),
'0' => __( 'Disable showing Pods fields in Media Library modals and only show them when in the full edit screen for an attachment', 'pods' ),
],
+ 'site_health_data' => [
+ '0' => __( 'Enable', 'pods' ),
+ '1' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
];
$session_auto_start = pods_session_auto_start( true );
$session_auto_start_overridden = null !== $session_auto_start;
- $fields['sessions'] = [
- 'label' => __( 'Sessions', 'pods' ),
+ $fields['security'] = [
+ 'label' => __( 'Security', 'pods' ),
'type' => 'heading',
];
@@ -288,15 +313,27 @@ public function get_setting_fields() {
'default' => '0',
'readonly' => $session_auto_start_overridden,
'description' => $session_auto_start_overridden ? $session_auto_start_disabled_text : '',
- 'pick_format' => 'single',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
'auto' => __( 'Auto-detect sessions (enable on first anonymous submission)', 'pods' ),
'1' => __( 'Enable sessions (may decrease performance)', 'pods' ),
'0' => __( 'Disable sessions', 'pods' ),
],
+ 'site_health_data' => [
+ 'auto' => __( 'Auto-detect', 'pods' ),
+ '1' => __( 'Enable', 'pods' ),
+ '0' => __( 'Disable', 'pods' ),
+ ],
+ 'site_health_include_in_info' => true,
];
+ $access_fields = pods_access_settings_config();
+
+ if ( $access_fields ) {
+ $fields = array_merge( $fields, $access_fields );
+ }
+
$pods_init = pods_init();
$is_wisdom_opted_out = ! $pods_init->stats_tracking || ! $pods_init->stats_tracking->get_is_tracking_allowed();
@@ -310,13 +347,15 @@ public function get_setting_fields() {
$fields['wisdom_opt_out'] = [
'name' => 'wisdom_opt_out',
'label' => __( 'Would you like to opt-out of tracking?', 'pods' ),
- 'description' => __( 'Thank you for installing our plugin. We\'d like your permission to track its usage on your site. We won\'t record any sensitive data, only information regarding the WordPress environment and your plugin settings. We will only use this information help us make improvements to the plugin and provide better support when you reach out. Tracking is completely optional.', 'pods' ),
+ 'description' => __( 'Thank you for installing our plugin. We\'d like your permission to track its usage on your site. We won\'t record any sensitive data, only information regarding the WordPress environment and your plugin settings. We will only use this information help us make improvements to the plugin and provide better support when you reach out. Tracking is completely optional.', 'pods' )
+ . "\n\n"
+ . __( 'Any information collected is not shared with third-parties and you will not be signed up for mailing lists.', 'pods' ),
'type' => 'pick',
'default' => $is_wisdom_opted_out ? '1' : '',
- 'pick_format' => 'single',
+ 'pick_format_type' => 'single',
'pick_format_single' => 'radio',
'data' => [
- '' => __( 'Track usage on my site', 'pods' ),
+ '' => __( 'Track usage on my site', 'pods' ),
'1' => __( 'DO NOT track usage on my site', 'pods' ),
],
];
diff --git a/src/Pods/Blocks/API.php b/src/Pods/Blocks/API.php
index 1ffb19c582..fec956bca6 100644
--- a/src/Pods/Blocks/API.php
+++ b/src/Pods/Blocks/API.php
@@ -169,12 +169,24 @@ public function setup_core_blocks() {
do_action( 'pods_blocks_api_pre_init' );
pods_container( 'pods.blocks.collection.pods' );
- pods_container( 'pods.blocks.field' );
- pods_container( 'pods.blocks.form' );
- pods_container( 'pods.blocks.list' );
- pods_container( 'pods.blocks.single' );
- pods_container( 'pods.blocks.single-list-fields' );
- pods_container( 'pods.blocks.view' );
+
+ // Check if the feature is enabled.
+ if ( pods_can_use_dynamic_feature( 'display' ) ) {
+ pods_container( 'pods.blocks.field' );
+ pods_container( 'pods.blocks.list' );
+ pods_container( 'pods.blocks.single' );
+ pods_container( 'pods.blocks.single-list-fields' );
+ }
+
+ // Check if the feature is enabled.
+ if ( pods_can_use_dynamic_feature( 'form' ) ) {
+ pods_container( 'pods.blocks.form' );
+ }
+
+ // Check if the feature is enabled.
+ if ( pods_can_use_dynamic_feature( 'view' ) ) {
+ pods_container( 'pods.blocks.view' );
+ }
/**
* Allow custom blocks to be registered with Pods.
diff --git a/src/Pods/Blocks/Types/Base.php b/src/Pods/Blocks/Types/Base.php
index 5fe228aa3e..5891d67b18 100644
--- a/src/Pods/Blocks/Types/Base.php
+++ b/src/Pods/Blocks/Types/Base.php
@@ -123,6 +123,10 @@ public function attributes( $params = [] ) {
}
}
+ $params['_is_editor_mode'] = $this->in_editor_mode( $params );
+ $params['_is_preview'] = is_preview();
+ $params['_preview_id'] = $params['_is_preview'] ? get_queried_object_id() : null;
+
return parent::attributes( $params );
}
@@ -245,7 +249,7 @@ public function should_preload_block( $attributes = [], $block = null ) {
* @return bool Whether the block is being rendered in editor mode.
*/
public function in_editor_mode( $attributes = [] ) {
- if ( ! empty( $attributes['_is_editor'] ) ) {
+ if ( ! empty( $attributes['_is_editor'] ) && ! empty( $attributes['_is_editor_mode'] ) ) {
return true;
}
diff --git a/src/Pods/Blocks/Types/Field.php b/src/Pods/Blocks/Types/Field.php
index f5538f80d1..48fe3f071d 100644
--- a/src/Pods/Blocks/Types/Field.php
+++ b/src/Pods/Blocks/Types/Field.php
@@ -101,6 +101,17 @@ public function fields() {
'default' => '',
'description' => __( 'Choose the pod to reference, or reference the Pod in the current context of this block.', 'pods' ),
],
+ [
+ 'name' => 'access_rights_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Read about how access rights control what can be displayed to other users: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
[
'name' => 'slug',
'label' => __( 'Slug or ID', 'pods' ),
@@ -128,6 +139,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'display' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
@@ -154,7 +170,8 @@ public function render( $attributes = [], $content = '', $block = null ) {
$attributes['use_current'] = false;
}
- $provided_post_id = absint( pods_v( '_post_id', $attributes, pods_v( 'post_id', 'get', 0, true ), true ) );
+ $provided_post_id = $this->in_editor_mode( $attributes ) ? pods_v( 'post_id', 'get', 0, true ) : get_the_ID();
+ $provided_post_id = absint( pods_v( '_post_id', $attributes, $provided_post_id, true ) );
if ( $attributes['use_current'] && $block instanceof WP_Block && ! empty( $block->context['postType'] ) ) {
// Detect post type / ID from context.
diff --git a/src/Pods/Blocks/Types/Form.php b/src/Pods/Blocks/Types/Form.php
index d74c2cbcca..2da91a90cc 100644
--- a/src/Pods/Blocks/Types/Form.php
+++ b/src/Pods/Blocks/Types/Form.php
@@ -51,39 +51,44 @@ public function block() {
'transforms' => [
'from' => [
[
- 'type' => 'shortcode',
- 'tag' => 'pods-form',
- 'attributes' => [
- 'name' => [
+ 'type' => 'shortcode',
+ 'tag' => 'pods-form',
+ 'attributes' => [
+ 'name' => [
'type' => 'object',
'source' => 'shortcode',
'attribute' => 'name',
],
- 'slug' => [
+ 'slug' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'slug',
],
- 'fields' => [
+ 'fields' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'fields',
],
- 'label' => [
+ 'label' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'label',
],
- 'thank_you' => [
+ 'thank_you' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'thank_you',
],
- 'form_output_type' => [
+ 'form_output_type' => [
'type' => 'object',
'source' => 'shortcode',
'attribute' => 'form_output_type',
],
+ 'form_key' => [
+ 'type' => 'string',
+ 'source' => 'shortcode',
+ 'attribute' => 'form_key',
+ ],
],
'isMatchConfig' => [
[
@@ -93,39 +98,44 @@ public function block() {
],
],
[
- 'type' => 'shortcode',
- 'tag' => 'pods',
- 'attributes' => [
- 'name' => [
+ 'type' => 'shortcode',
+ 'tag' => 'pods',
+ 'attributes' => [
+ 'name' => [
'type' => 'object',
'source' => 'shortcode',
'attribute' => 'name',
],
- 'slug' => [
+ 'slug' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'slug',
],
- 'fields' => [
+ 'fields' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'fields',
],
- 'label' => [
+ 'label' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'label',
],
- 'thank_you' => [
+ 'thank_you' => [
'type' => 'string',
'source' => 'shortcode',
'attribute' => 'thank_you',
],
- 'form_output_type' => [
+ 'form_output_type' => [
'type' => 'object',
'source' => 'shortcode',
'attribute' => 'form_output_type',
],
+ 'form_key' => [
+ 'type' => 'string',
+ 'source' => 'shortcode',
+ 'attribute' => 'form_key',
+ ],
],
'isMatchConfig' => [
[
@@ -156,6 +166,17 @@ public function fields() {
'default' => '',
'description' => __( 'Choose the pod to reference, or reference the Pod in the current context of this block.', 'pods' ),
],
+ [
+ 'name' => 'access_rights_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Read about how access rights control what can be displayed to other users: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
[
'name' => 'slug',
'label' => __( 'Slug or ID', 'pods' ),
@@ -193,6 +214,23 @@ public function fields() {
'default' => 'div',
'description' => __( 'Choose how you want your form HTML to be set up. This allows you flexibility to build and style your forms with any CSS customizations you would like. Some output types are naturally laid out better in certain themes.', 'pods' ),
],
+ [
+ 'name' => 'form_key',
+ 'label' => __( 'Form Access Key', 'pods' ),
+ 'type' => 'text',
+ 'description' => __( 'Give this form a unique slug to reference in our user access checks. When you use the "pods_user_can_access_object" filter, you can selectively allow access through PHP if the user does not normally have access through WordPress itself.', 'pods' ),
+ ],
+ [
+ 'name' => 'access_rights_form_key_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Find out more about how to customize access rights for this form: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
];
}
@@ -208,6 +246,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'form' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
diff --git a/src/Pods/Blocks/Types/Item_List.php b/src/Pods/Blocks/Types/Item_List.php
index 1061d38dd0..de13810fd0 100644
--- a/src/Pods/Blocks/Types/Item_List.php
+++ b/src/Pods/Blocks/Types/Item_List.php
@@ -205,7 +205,7 @@ public function fields() {
*/
$default_cache_mode = apply_filters( 'pods_shortcode_default_cache_mode', 'none' );
- return [
+ $fields = [
[
'name' => 'name',
'label' => __( 'Pod Name', 'pods' ),
@@ -214,6 +214,17 @@ public function fields() {
'default' => '',
'description' => __( 'Choose the pod to reference, or reference the Pod in the current context of this block.', 'pods' ),
],
+ [
+ 'name' => 'access_rights_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Read about how access rights control what can be displayed to other users: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
[
'name' => 'template',
'label' => __( 'Template', 'pods' ),
@@ -342,6 +353,13 @@ public function fields() {
'description' => __( 'Set how long to cache the output for in seconds.', 'pods' ),
],
];
+
+ if ( ! pods_can_use_dynamic_feature_sql_clauses() ) {
+ unset( $fields['orderby'] );
+ unset( $fields['where'] );
+ }
+
+ return $fields;
}
/**
@@ -356,6 +374,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'display' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
@@ -380,7 +403,8 @@ public function render( $attributes = [], $content = '', $block = null ) {
$attributes['name'] = $block->context['postType'];
}
- $provided_post_id = absint( pods_v( '_post_id', $attributes, pods_v( 'post_id', 'get', 0, true ), true ) );
+ $provided_post_id = $this->in_editor_mode( $attributes ) ? pods_v( 'post_id', 'get', 0, true ) : get_the_ID();
+ $provided_post_id = absint( pods_v( '_post_id', $attributes, $provided_post_id, true ) );
if ( empty( $attributes['name'] ) ) {
if (
diff --git a/src/Pods/Blocks/Types/Item_Single.php b/src/Pods/Blocks/Types/Item_Single.php
index 5e5d00795c..dee82c9052 100644
--- a/src/Pods/Blocks/Types/Item_Single.php
+++ b/src/Pods/Blocks/Types/Item_Single.php
@@ -170,6 +170,17 @@ public function fields() {
'default' => '',
'description' => __( 'Choose the pod to reference, or reference the Pod in the current context of this block.', 'pods' ),
],
+ [
+ 'name' => 'access_rights_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Read about how access rights control what can be displayed to other users: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
[
'name' => 'slug',
'label' => __( 'Slug or ID', 'pods' ),
@@ -205,6 +216,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'display' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
@@ -234,7 +250,8 @@ public function render( $attributes = [], $content = '', $block = null ) {
$attributes['use_current'] = false;
}
- $provided_post_id = absint( pods_v( '_post_id', $attributes, pods_v( 'post_id', 'get', 0, true ), true ) );
+ $provided_post_id = $this->in_editor_mode( $attributes ) ? pods_v( 'post_id', 'get', 0, true ) : get_the_ID();
+ $provided_post_id = absint( pods_v( '_post_id', $attributes, $provided_post_id, true ) );
if ( $attributes['use_current'] && $block instanceof WP_Block && ! empty( $block->context['postType'] ) ) {
// Detect post type / ID from context.
diff --git a/src/Pods/Blocks/Types/Item_Single_List_Fields.php b/src/Pods/Blocks/Types/Item_Single_List_Fields.php
index f1adcda4a3..b289469e72 100644
--- a/src/Pods/Blocks/Types/Item_Single_List_Fields.php
+++ b/src/Pods/Blocks/Types/Item_Single_List_Fields.php
@@ -70,6 +70,17 @@ public function fields() {
'default' => '',
'description' => __( 'Choose the pod to reference, or reference the Pod in the current context of this block.', 'pods' ),
],
+ [
+ 'name' => 'access_rights_help',
+ 'label' => __( 'Access Rights', 'pods' ),
+ 'type' => 'html',
+ 'default' => '',
+ 'html_content' => sprintf(
+ // translators: %s is the Read Documentation link.
+ esc_html__( 'Read about how access rights control what can be displayed to other users: %s', 'pods' ),
+ '' . esc_html__( 'Documentation', 'pods' ) . ''
+ ),
+ ],
[
'name' => 'slug',
'label' => __( 'Slug or ID', 'pods' ),
@@ -117,6 +128,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'display' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
diff --git a/src/Pods/Blocks/Types/View.php b/src/Pods/Blocks/Types/View.php
index 19c582ba65..1deedd1279 100644
--- a/src/Pods/Blocks/Types/View.php
+++ b/src/Pods/Blocks/Types/View.php
@@ -139,6 +139,11 @@ public function fields() {
* @return string The block content to render.
*/
public function render( $attributes = [], $content = '', $block = null ) {
+ // If the feature is disabled then return early.
+ if ( ! pods_can_use_dynamic_feature( 'view' ) ) {
+ return '';
+ }
+
$attributes = $this->attributes( $attributes );
$attributes = array_map( 'pods_trim', $attributes );
diff --git a/src/Pods/Data/Conditional_Logic.php b/src/Pods/Data/Conditional_Logic.php
index 5ce26f5b93..9f3eda81b5 100644
--- a/src/Pods/Data/Conditional_Logic.php
+++ b/src/Pods/Data/Conditional_Logic.php
@@ -128,7 +128,7 @@ public static function maybe_setup_from_old_syntax( $object ): ?Conditional_Logi
if ( empty( $old_syntax_value ) ) {
$old_syntax_value = [];
} elseif ( ! is_array( $old_syntax_value ) ) {
- $old_syntax_value = maybe_unserialize( $old_syntax_value );
+ $old_syntax_value = pods_maybe_safely_unserialize( $old_syntax_value );
if ( ! is_array( $old_syntax_value ) ) {
$old_syntax_value = [];
diff --git a/src/Pods/Data/Map_Field_Values.php b/src/Pods/Data/Map_Field_Values.php
index 06c79b8622..9d3912bd0a 100644
--- a/src/Pods/Data/Map_Field_Values.php
+++ b/src/Pods/Data/Map_Field_Values.php
@@ -397,10 +397,6 @@ public function context_info( $field, $traverse, $field_data, $obj ) {
$raw = isset( $traverse[2] ) && 'raw' === $traverse[2];
- if ( 'user' === $context_type && 'user_pass' === $context_var ) {
- return '';
- }
-
$value = pods_v( $context_var, $context_type );
// Maybe return the raw value.
diff --git a/src/Pods/Permissions.php b/src/Pods/Permissions.php
index c93456011c..01e37008e8 100644
--- a/src/Pods/Permissions.php
+++ b/src/Pods/Permissions.php
@@ -166,7 +166,7 @@ public function get_restricted_roles( $object ) {
$roles_allowed = pods_v( 'roles_allowed', $object, '' );
if ( '' !== $roles_allowed ) {
- $roles_allowed = maybe_unserialize( $roles_allowed );
+ $roles_allowed = pods_maybe_safely_unserialize( $roles_allowed );
if ( ! is_array( $roles_allowed ) ) {
$roles_allowed = explode( ',', $roles_allowed );
@@ -245,7 +245,7 @@ public function get_restricted_capabilities( $object ) {
$capability_allowed = pods_v( 'capability_allowed', $object, '' );
if ( '' !== $capability_allowed ) {
- $capability_allowed = maybe_unserialize( $capability_allowed );
+ $capability_allowed = pods_maybe_safely_unserialize( $capability_allowed );
if ( ! is_array( $capability_allowed ) ) {
$capability_allowed = explode( ',', $capability_allowed );
diff --git a/src/Pods/Tools/Repair.php b/src/Pods/Tools/Repair.php
index 0fe579c2c9..c113810d81 100644
--- a/src/Pods/Tools/Repair.php
+++ b/src/Pods/Tools/Repair.php
@@ -16,6 +16,158 @@
*/
class Repair extends Base {
+ /**
+ * Repair Pod configurations.
+ *
+ * @since 3.1.0
+ *
+ * @param string $mode The repair mode (preview, upgrade, or full).
+ *
+ * @return array The results with information about the repair done.
+ */
+ public function repair_pods( $mode ) {
+ $this->setup();
+
+ $this->errors = [];
+
+ $is_preview_mode = 'preview' === $mode;
+
+ $results = [];
+
+ $results[ __( 'Check for duplicate Pods in the database', 'pods' ) ] = $this->maybe_resolve_pod_conflicts( $mode );
+
+ // Check if changes were made to the Pod.
+ $changes_made = [] !== array_filter( $results );
+
+ if ( ! $is_preview_mode && $changes_made ) {
+ $this->api->cache_flush_pods();
+ }
+
+ $tool_heading = __( 'Repair results', 'pods' );
+
+ $results['message_html'] = $this->get_message_html( $tool_heading, $results, $mode );
+
+ return $results;
+ }
+
+ /**
+ * Maybe resolve pod conflicts.
+ *
+ * @since 3.1.0
+ *
+ * @param string $mode The repair mode (preview, upgrade, or full).
+ *
+ * @return string[] The label, name, and ID for each pod resolved.
+ */
+ protected function maybe_resolve_pod_conflicts( $mode ) {
+ $this->setup();
+
+ // Find any pod that has the same name as another pod.
+ global $wpdb;
+
+ $sql = "
+ SELECT DISTINCT
+ `primary`.`ID` AS `primary_id`,
+ `primary`.`post_name` AS `primary_name`,
+ `duplicate`.`ID` AS `duplicate_id`,
+ `duplicate`.`post_name` AS `duplicate_name`
+ FROM `{$wpdb->posts}` AS `primary`
+ LEFT JOIN `{$wpdb->posts}` AS `duplicate`
+ ON `duplicate`.`post_name` = `primary`.`post_name`
+ WHERE
+ `primary`.`post_type` = %s
+ AND `duplicate`.`ID` != `primary`.`ID`
+ AND `duplicate`.`post_type` = `primary`.`post_type`
+ ORDER BY `primary`.`ID`
+ ";
+
+ $duplicate_pods = $wpdb->get_results(
+ $wpdb->prepare(
+ $sql,
+ [
+ '_pods_pod',
+ ]
+ )
+ );
+
+ $pods_to_resolve = [];
+
+ $duplicate_ids = [];
+
+ foreach ( $duplicate_pods as $duplicate_pod ) {
+ // Skip if we have already referenced a primary pod.
+ if (
+ isset( $duplicate_ids[ $duplicate_pod->duplicate_id ] )
+ && $duplicate_ids[ $duplicate_pod->duplicate_id ] === $duplicate_pod->primary_id
+ ) {
+ continue;
+ }
+
+ $duplicate_ids[ $duplicate_pod->primary_id ] = $duplicate_pod->duplicate_id;
+
+ if ( ! isset( $pods_to_resolve[ $duplicate_pod->primary_name ] ) ) {
+ $pods_to_resolve[ $duplicate_pod->primary_name ] = [];
+ }
+
+ try {
+ $pod = $this->api->load_pod( [ 'id' => $duplicate_pod->duplicate_id ] );
+
+ if ( $pod ) {
+ $pods_to_resolve[ $duplicate_pod->primary_name ][] = $pod;
+ } else {
+ throw new Exception( __( 'Failed to load duplicate pod to resolve.', 'pods' ) );
+ }
+ } catch ( Throwable $exception ) {
+ $this->errors[] = ucwords( str_replace( '_', ' ', __FUNCTION__ ) ) . ' > ' . $exception->getMessage() . ' (' . $duplicate_pod->duplicate_name . ' - #' . $duplicate_pod->duplicate_id . ' - Primary: ' . $duplicate_pod->primary_name . ' - #' . $duplicate_pod->primary_id . ')';
+ }
+ }
+
+ $resolved_pods = [];
+
+ foreach ( $pods_to_resolve as $primary_pod_name => $pods ) {
+ foreach ( $pods as $pod ) {
+ /** @var Pod $pod */
+ try {
+ if ( 'preview' !== $mode ) {
+ // Prevent renaming the original pod data by using a temp one first, then renaming that.
+ wp_update_post( [
+ 'ID' => $pod->get_id(),
+ 'post_name' => '_temp_' . $primary_pod_name . '_' . $pod->get_id(),
+ ] );
+
+ // Flush the pod cache.
+ $this->api->cache_flush_pods();
+
+ // Save the pod with the new name.
+ $this->api->save_pod( [
+ 'id' => $pod->get_id(),
+ 'old_name' => '_temp_' . $primary_pod_name . '_' . $pod->get_id(),
+ 'name' => $primary_pod_name . '_' . $pod->get_id(),
+ 'label' => $pod->get_label() . ' (' . $pod->get_id() . ')',
+ ], false );
+
+ $pod->flush();
+ }
+
+ $resolved_pods[] = sprintf(
+ '%1$s (%2$s: %3$s | %4$s: %5$s | %6$s: %7$d)',
+ $pod->get_label(),
+ __( 'Old Name', 'pods' ),
+ $primary_pod_name,
+ __( 'New Name', 'pods' ),
+ $primary_pod_name . '_' . $pod->get_id(),
+ __( 'ID', 'pods' ),
+ $pod->get_id()
+ );
+ } catch ( Throwable $exception ) {
+ $this->errors[] = ucwords( str_replace( '_', ' ', __FUNCTION__ ) ) . ' > ' . $exception->getMessage() . ' (' . $pod->get_name() . ' - #' . $pod->get_id() . ')';
+ }
+ }
+ }
+
+ return $resolved_pods;
+ }
+
/**
* Repair Groups and Fields for a Pod.
*
diff --git a/src/Pods/Whatsit.php b/src/Pods/Whatsit.php
index d85b225d88..0ceabc402a 100644
--- a/src/Pods/Whatsit.php
+++ b/src/Pods/Whatsit.php
@@ -122,7 +122,7 @@ public function __construct( array $args = [] ) {
* @return Whatsit|array|null
*/
public static function from_serialized( $serialized, $to_args = false ) {
- $object = maybe_unserialize( $serialized );
+ $object = pods_maybe_safely_unserialize( $serialized );
if ( $object instanceof self ) {
if ( $to_args ) {
diff --git a/src/Pods/Whatsit/Block_Field.php b/src/Pods/Whatsit/Block_Field.php
index fd0cf7a42f..0e7c3ea0aa 100644
--- a/src/Pods/Whatsit/Block_Field.php
+++ b/src/Pods/Whatsit/Block_Field.php
@@ -92,6 +92,16 @@ protected function get_block_arg_mapping() {
'type' => 'string',
],
],
+ 'html' => [
+ 'type' => 'html',
+ 'fieldOptions' => [
+ 'className' => 'text__container',
+ 'type' => 'text',
+ ],
+ 'attributeOptions' => [
+ 'type' => 'string',
+ ],
+ ],
];
}
@@ -148,6 +158,10 @@ public function get_block_args() {
$block_args['fieldOptions']['help'] = $this->get_arg( 'description' );
+ if ( 'html' === $type ) {
+ $block_args['fieldOptions']['html_content'] = $this->get_arg( 'html_content' );
+ }
+
if ( 'boolean' !== $type ) {
$block_args['fieldOptions']['label'] = $this->get_arg( 'label' );
diff --git a/src/Pods/Whatsit/Storage/Post_Type.php b/src/Pods/Whatsit/Storage/Post_Type.php
index 8d35f3d64a..1ce25c9dc9 100644
--- a/src/Pods/Whatsit/Storage/Post_Type.php
+++ b/src/Pods/Whatsit/Storage/Post_Type.php
@@ -724,7 +724,7 @@ public function get_args( Whatsit $object ) {
continue;
}
- $meta_value = array_map( 'maybe_unserialize', $meta_value );
+ $meta_value = array_map( 'pods_maybe_safely_unserialize', $meta_value );
if ( 1 === count( $meta_value ) ) {
$meta_value = reset( $meta_value );
diff --git a/tests/codeception/wpunit/Pods/API/ProcessFormTest.php b/tests/codeception/wpunit/Pods/API/ProcessFormTest.php
index 23737671c5..46dbfc16a0 100644
--- a/tests/codeception/wpunit/Pods/API/ProcessFormTest.php
+++ b/tests/codeception/wpunit/Pods/API/ProcessFormTest.php
@@ -88,12 +88,30 @@ class ProcessFormTest extends Pods_UnitTestCase {
*/
protected $field_conditional_hide_id;
+ protected $test_blocks;
+
public function setUp(): void {
parent::setUp();
$this->api = pods_api();
$this->populate();
+
+ $this->test_blocks = '
+Test block here with bold text
+
+
+
+
+
+
+
+
+
+
+';
}
/**
@@ -453,6 +471,55 @@ public function test_process_form_returns_valid_id() {
$pod = pods( $this->pod );
$params = $this->create_base_form_params( $pod, [
+ 'post_content',
+ $this->field,
+ $this->field2,
+ $this->field_hidden,
+ $this->field_conditional_show,
+ $this->field_conditional_hide,
+ ] );
+
+ // Set some data that will be saved.
+ $params[ 'pods_field_post_content' ] = '[pods]test[/pods] some text here ' . $this->test_blocks;
+
+ $params[ 'pods_field_' . $this->field ] = 'some value for the field: ' . $this->field;
+ $params[ 'pods_field_' . $this->field2 ] = 'some value for the field: ' . $this->field2;
+ $params[ 'pods_field_' . $this->field_hidden ] = 'some value for the field: ' . $this->field_hidden;
+ $params[ 'pods_field_' . $this->field_conditional_show ] = 'some value for the field: ' . $this->field_conditional_show;
+ $params[ 'pods_field_' . $this->field_conditional_hide ] = 'some value for the field: ' . $this->field_conditional_hide;
+
+ $id = $this->api->process_form( $params );
+
+ $this->assertIsInt( $id );
+ $this->assertGreaterThan( 0, $id );
+
+ $pod->fetch( $id );
+
+ $this->assertEquals( ' some text here ' . $this->test_blocks, $pod->field( 'post_content' ) );
+ $this->assertEquals( $params[ 'pods_field_' . $this->field ], $pod->field( $this->field ) );
+ $this->assertEquals( $params[ 'pods_field_' . $this->field2 ], $pod->field( $this->field2 ) );
+ $this->assertEquals( $params[ 'pods_field_' . $this->field_hidden ], $pod->field( $this->field_hidden ) );
+ $this->assertEquals( '', $pod->field( $this->field_conditional_show ) ); // This field would be hidden and won't save.
+ $this->assertEquals( $params[ 'pods_field_' . $this->field_conditional_hide ], $pod->field( $this->field_conditional_hide ) );
+ }
+
+ public function test_process_form_returns_valid_id_and_restricts_post_content_submitted() {
+ $user_id = wp_insert_user( [
+ 'user_login' => 'testsubscriber',
+ 'user_email' => 'testsubscriber@test.local',
+ 'user_pass' => 'hayyyyyy',
+ 'role' => 'subscriber',
+ ] );
+
+ $this->assertIsInt( $user_id );
+
+ wp_set_current_user( $user_id );
+
+ /** @var Pods $pod */
+ $pod = pods( $this->pod );
+
+ $params = $this->create_base_form_params( $pod, [
+ 'post_content',
$this->field,
$this->field2,
$this->field_hidden,
@@ -461,6 +528,8 @@ public function test_process_form_returns_valid_id() {
] );
// Set some data that will be saved.
+ $params[ 'pods_field_post_content' ] = '[pods]test[/pods]' . $this->test_blocks;
+
$params[ 'pods_field_' . $this->field ] = 'some value for the field: ' . $this->field;
$params[ 'pods_field_' . $this->field2 ] = 'some value for the field: ' . $this->field2;
$params[ 'pods_field_' . $this->field_hidden ] = 'some value for the field: ' . $this->field_hidden;
@@ -474,6 +543,7 @@ public function test_process_form_returns_valid_id() {
$pod->fetch( $id );
+ $this->assertEquals( 'Test block here with bold text
', $pod->field( 'post_content' ) );
$this->assertEquals( $params[ 'pods_field_' . $this->field ], $pod->field( $this->field ) );
$this->assertEquals( $params[ 'pods_field_' . $this->field2 ], $pod->field( $this->field2 ) );
$this->assertEquals( $params[ 'pods_field_' . $this->field_hidden ], $pod->field( $this->field_hidden ) );
diff --git a/tests/codeception/wpunit/Pods/AdminTest.php b/tests/codeception/wpunit/Pods/AdminTest.php
index ba978f6966..b1d7b06d81 100644
--- a/tests/codeception/wpunit/Pods/AdminTest.php
+++ b/tests/codeception/wpunit/Pods/AdminTest.php
@@ -215,6 +215,7 @@ public function provider_global_config_checks() {
'admin-ui',
'connections',
'advanced',
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -243,6 +244,7 @@ public function provider_global_config_checks() {
'admin-ui',
'connections',
'advanced',
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -268,6 +270,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -293,6 +296,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -321,6 +325,7 @@ public function provider_global_config_checks() {
'admin-ui',
'connections',
'advanced',
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -349,6 +354,7 @@ public function provider_global_config_checks() {
'admin-ui',
'connections',
'advanced',
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -374,6 +380,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -399,6 +406,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -423,6 +431,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'rest-api',
],
],
@@ -446,6 +455,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'rest-api',
],
],
@@ -469,6 +479,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
],
],
@@ -492,6 +503,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
],
],
@@ -515,6 +527,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -539,6 +552,7 @@ public function provider_global_config_checks() {
'config' => [
'pod' => [
'groups' => [
+ 'access-rights',
'pods-pfat',
'rest-api',
],
@@ -564,6 +578,7 @@ public function provider_global_config_checks() {
'groups' => [
'labels',
'admin-ui',
+ 'access-rights',
],
],
'group' => [
@@ -588,6 +603,7 @@ public function provider_global_config_checks() {
'labels',
'admin-ui',
'advanced',
+ 'access-rights',
],
],
'group' => [
diff --git a/tests/codeception/wpunit/Pods/PodsTest.php b/tests/codeception/wpunit/Pods/PodsTest.php
index 32efce2e88..0046045b96 100644
--- a/tests/codeception/wpunit/Pods/PodsTest.php
+++ b/tests/codeception/wpunit/Pods/PodsTest.php
@@ -12,17 +12,91 @@
class PodsTest extends Pods_UnitTestCase {
/**
- * The pods system under test
- * @var \Pods
+ * @var string
*/
- private $pod;
+ protected $pod_name = 'test_pods';
+ /**
+ * @var int
+ */
+ protected $pod_id = 0;
+
+ /**
+ * @var Pods
+ */
+ protected $pod;
+
+ /**
+ * @var string
+ */
+ protected $non_public_pod_name = 'test_pods_non_public';
+
+ /**
+ * @var int
+ */
+ protected $non_public_pod_id = 0;
+
+ /**
+ * @var Pods
+ */
+ protected $non_public_pod;
+
+ /**
+ *
+ */
public function setUp(): void {
- $this->pod = pods();
+ parent::setUp();
+
+ $api = pods_api();
+
+ $this->pod_id = $api->save_pod( array(
+ 'type' => 'pod',
+ 'name' => $this->pod_name,
+ ) );
+
+ $params = array(
+ 'pod_id' => $this->pod_id,
+ 'name' => 'number1',
+ 'type' => 'number',
+ );
+
+ $api->save_field( $params );
+
+ $this->pod = pods( $this->pod_name );
+
+ $this->non_public_pod_id = $api->save_pod( array(
+ 'type' => 'post_type',
+ 'storage' => 'meta',
+ 'name' => $this->non_public_pod_name,
+ 'public' => 0,
+ ) );
+
+ $params = array(
+ 'pod_id' => $this->non_public_pod_id,
+ 'name' => 'number2',
+ 'type' => 'number',
+ );
+
+ $api->save_field( $params );
+
+ $this->non_public_pod = pods( $this->non_public_pod_name );
}
+ /**
+ *
+ */
public function tearDown(): void {
- unset( $this->pod );
+ $this->pod_id = null;
+ $this->pod = null;
+ $this->non_public_pod_id = null;
+ $this->non_public_pod = null;
+
+ pods_update_setting( 'session_auto_start', null );
+ pods_update_setting( 'show_access_restricted_messages', null );
+ pods_update_setting( 'show_access_admin_notices', null );
+ remove_all_filters( 'pods_session_id' );
+
+ parent::tearDown();
}
/**
@@ -66,15 +140,29 @@ public function test_method_exists() {
*/
public function test_method_exists_valid() {
$this->assertTrue( method_exists( $this->pod, 'valid' ), 'Method valid does not exist' );
+ $this->assertTrue( method_exists( $this->pod, 'is_valid' ), 'Method valid does not exist' );
+ }
+
+ public function test_method_valid() {
+ $this->assertTrue( $this->pod->valid() );
+ $this->assertTrue( $this->pod->is_valid() );
}
- /**
- * Test for invalid pod
- * @covers Pods::valid
- * @depends test_method_exists_valid
- */
public function test_method_valid_invalid() {
- $this->assertFalse( $this->pod->valid() );
+ $this->assertFalse( pods()->valid() );
+ $this->assertFalse( pods()->is_valid() );
+ }
+
+ public function test_method_valid_invalid_with_non_existent_pod() {
+ $pod = pods( 'truly_not_a_pod', null, false );
+
+ $this->assertInstanceOf( Pods::class, $pod );
+ $this->assertFalse( $pod->valid() );
+ $this->assertFalse( $pod->is_valid() );
+ }
+
+ public function test_method_valid_invalid_with_non_existent_pod_with_strict_mode() {
+ $this->assertFalse( pods( 'truly_not_a_pod', null, true ) );
}
/**
@@ -338,4 +426,217 @@ public function test_we_can_call_a_non_pod_taxonomy() {
$this->assertTrue( $pod->valid() );
$this->assertEquals( 'taxonomy', $pod->pod_data['type'] );
}
+
+ public function test_pods_form() {
+ // test shortcode
+ $output = $this->pod->form( [ 'check_access' => false ] );
+
+ $this->assertContains( 'Anonymous form submissions are not enabled for this site', $output );
+ }
+
+ public function test_pods_form_with_anon_enabled() {
+ pods_update_setting( 'session_auto_start', '1' );
+
+ // test shortcode
+ $output = $this->pod->form( [ 'check_access' => false ] );
+
+ $this->assertContains( 'Anonymous form submissions are not compatible with sessions on this site', $output );
+ }
+
+ public function test_pods_form_with_anon_enabled_and_compatible() {
+ pods_update_setting( 'session_auto_start', '1' );
+
+ add_filter( 'pods_session_id', static function() { return 'testsession'; } );
+
+ // test shortcode
+ $output = $this->pod->form( [ 'check_access' => false ] );
+
+ $this->assertContains( 'pod->form( [ 'check_access' => false ] );
+
+ $this->assertContains( ' 'testsubscriber',
+ 'user_email' => 'testsubscriber@test.local',
+ 'user_pass' => 'hayyyyyy',
+ 'role' => 'subscriber',
+ ] );
+
+ wp_set_current_user( $new_user_id );
+
+ // test shortcode
+ $output = $this->non_public_pod->form();
+
+ $this->assertContains( '$/', $Line['text']))
+ {
+ $Block['closed'] = true;
+ }
+
+ return $Block;
+ }
+ }
+
+ protected function blockCommentContinue($Line, array $Block)
+ {
+ if (isset($Block['closed']))
+ {
+ return;
+ }
+
+ $Block['markup'] .= "\n" . $Line['body'];
+
+ if (preg_match('/-->$/', $Line['text']))
+ {
+ $Block['closed'] = true;
+ }
+
+ return $Block;
+ }
+
+ #
+ # Fenced Code
+
+ protected function blockFencedCode($Line)
+ {
+ if (preg_match('/^['.$Line['text'][0].']{3,}[ ]*([^`]+)?[ ]*$/', $Line['text'], $matches))
+ {
+ $Element = array(
+ 'name' => 'code',
+ 'text' => '',
+ );
+
+ if (isset($matches[1]))
+ {
+ /**
+ * https://www.w3.org/TR/2011/WD-html5-20110525/elements.html#classes
+ * Every HTML element may have a class attribute specified.
+ * The attribute, if specified, must have a value that is a set
+ * of space-separated tokens representing the various classes
+ * that the element belongs to.
+ * [...]
+ * The space characters, for the purposes of this specification,
+ * are U+0020 SPACE, U+0009 CHARACTER TABULATION (tab),
+ * U+000A LINE FEED (LF), U+000C FORM FEED (FF), and
+ * U+000D CARRIAGE RETURN (CR).
+ *
+ @license MIT
+ Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
+ @see https://github.com/BrianHenryIE/strauss
+*/
+ $language = substr($matches[1], 0, strcspn($matches[1], " \t\n\f\r"));
+
+ $class = 'language-'.$language;
+
+ $Element['attributes'] = array(
+ 'class' => $class,
+ );
+ }
+
+ $Block = array(
+ 'char' => $Line['text'][0],
+ 'element' => array(
+ 'name' => 'pre',
+ 'handler' => 'element',
+ 'text' => $Element,
+ ),
+ );
+
+ return $Block;
+ }
+ }
+
+ protected function blockFencedCodeContinue($Line, $Block)
+ {
+ if (isset($Block['complete']))
+ {
+ return;
+ }
+
+ if (isset($Block['interrupted']))
+ {
+ $Block['element']['text']['text'] .= "\n";
+
+ unset($Block['interrupted']);
+ }
+
+ if (preg_match('/^'.$Block['char'].'{3,}[ ]*$/', $Line['text']))
+ {
+ $Block['element']['text']['text'] = substr($Block['element']['text']['text'], 1);
+
+ $Block['complete'] = true;
+
+ return $Block;
+ }
+
+ $Block['element']['text']['text'] .= "\n".$Line['body'];
+
+ return $Block;
+ }
+
+ protected function blockFencedCodeComplete($Block)
+ {
+ $text = $Block['element']['text']['text'];
+
+ $Block['element']['text']['text'] = $text;
+
+ return $Block;
+ }
+
+ #
+ # Header
+
+ protected function blockHeader($Line)
+ {
+ if (isset($Line['text'][1]))
+ {
+ $level = 1;
+
+ while (isset($Line['text'][$level]) and $Line['text'][$level] === '#')
+ {
+ $level ++;
+ }
+
+ if ($level > 6)
+ {
+ return;
+ }
+
+ $text = trim($Line['text'], '# ');
+
+ $Block = array(
+ 'element' => array(
+ 'name' => 'h' . min(6, $level),
+ 'text' => $text,
+ 'handler' => 'line',
+ ),
+ );
+
+ return $Block;
+ }
+ }
+
+ #
+ # List
+
+ protected function blockList($Line)
+ {
+ list($name, $pattern) = $Line['text'][0] <= '-' ? array('ul', '[*+-]') : array('ol', '[0-9]+[.]');
+
+ if (preg_match('/^('.$pattern.'[ ]+)(.*)/', $Line['text'], $matches))
+ {
+ $Block = array(
+ 'indent' => $Line['indent'],
+ 'pattern' => $pattern,
+ 'element' => array(
+ 'name' => $name,
+ 'handler' => 'elements',
+ ),
+ );
+
+ if($name === 'ol')
+ {
+ $listStart = stristr($matches[0], '.', true);
+
+ if($listStart !== '1')
+ {
+ $Block['element']['attributes'] = array('start' => $listStart);
+ }
+ }
+
+ $Block['li'] = array(
+ 'name' => 'li',
+ 'handler' => 'li',
+ 'text' => array(
+ $matches[2],
+ ),
+ );
+
+ $Block['element']['text'] []= & $Block['li'];
+
+ return $Block;
+ }
+ }
+
+ protected function blockListContinue($Line, array $Block)
+ {
+ if ($Block['indent'] === $Line['indent'] and preg_match('/^'.$Block['pattern'].'(?:[ ]+(.*)|$)/', $Line['text'], $matches))
+ {
+ if (isset($Block['interrupted']))
+ {
+ $Block['li']['text'] []= '';
+
+ $Block['loose'] = true;
+
+ unset($Block['interrupted']);
+ }
+
+ unset($Block['li']);
+
+ $text = isset($matches[1]) ? $matches[1] : '';
+
+ $Block['li'] = array(
+ 'name' => 'li',
+ 'handler' => 'li',
+ 'text' => array(
+ $text,
+ ),
+ );
+
+ $Block['element']['text'] []= & $Block['li'];
+
+ return $Block;
+ }
+
+ if ($Line['text'][0] === '[' and $this->blockReference($Line))
+ {
+ return $Block;
+ }
+
+ if ( ! isset($Block['interrupted']))
+ {
+ $text = preg_replace('/^[ ]{0,4}/', '', $Line['body']);
+
+ $Block['li']['text'] []= $text;
+
+ return $Block;
+ }
+
+ if ($Line['indent'] > 0)
+ {
+ $Block['li']['text'] []= '';
+
+ $text = preg_replace('/^[ ]{0,4}/', '', $Line['body']);
+
+ $Block['li']['text'] []= $text;
+
+ unset($Block['interrupted']);
+
+ return $Block;
+ }
+ }
+
+ protected function blockListComplete(array $Block)
+ {
+ if (isset($Block['loose']))
+ {
+ foreach ($Block['element']['text'] as &$li)
+ {
+ if (end($li['text']) !== '')
+ {
+ $li['text'] []= '';
+ }
+ }
+ }
+
+ return $Block;
+ }
+
+ #
+ # Quote
+
+ protected function blockQuote($Line)
+ {
+ if (preg_match('/^>[ ]?(.*)/', $Line['text'], $matches))
+ {
+ $Block = array(
+ 'element' => array(
+ 'name' => 'blockquote',
+ 'handler' => 'lines',
+ 'text' => (array) $matches[1],
+ ),
+ );
+
+ return $Block;
+ }
+ }
+
+ protected function blockQuoteContinue($Line, array $Block)
+ {
+ if ($Line['text'][0] === '>' and preg_match('/^>[ ]?(.*)/', $Line['text'], $matches))
+ {
+ if (isset($Block['interrupted']))
+ {
+ $Block['element']['text'] []= '';
+
+ unset($Block['interrupted']);
+ }
+
+ $Block['element']['text'] []= $matches[1];
+
+ return $Block;
+ }
+
+ if ( ! isset($Block['interrupted']))
+ {
+ $Block['element']['text'] []= $Line['text'];
+
+ return $Block;
+ }
+ }
+
+ #
+ # Rule
+
+ protected function blockRule($Line)
+ {
+ if (preg_match('/^(['.$Line['text'][0].'])([ ]*\1){2,}[ ]*$/', $Line['text']))
+ {
+ $Block = array(
+ 'element' => array(
+ 'name' => 'hr'
+ ),
+ );
+
+ return $Block;
+ }
+ }
+
+ #
+ # Setext
+
+ protected function blockSetextHeader($Line, array $Block = null)
+ {
+ if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted']))
+ {
+ return;
+ }
+
+ if (chop($Line['text'], $Line['text'][0]) === '')
+ {
+ $Block['element']['name'] = $Line['text'][0] === '=' ? 'h1' : 'h2';
+
+ return $Block;
+ }
+ }
+
+ #
+ # Markup
+
+ protected function blockMarkup($Line)
+ {
+ if ($this->markupEscaped or $this->safeMode)
+ {
+ return;
+ }
+
+ if (preg_match('/^<(\w[\w-]*)(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*(\/)?>/', $Line['text'], $matches))
+ {
+ $element = strtolower($matches[1]);
+
+ if (in_array($element, $this->textLevelElements))
+ {
+ return;
+ }
+
+ $Block = array(
+ 'name' => $matches[1],
+ 'depth' => 0,
+ 'markup' => $Line['text'],
+ );
+
+ $length = strlen($matches[0]);
+
+ $remainder = substr($Line['text'], $length);
+
+ if (trim($remainder) === '')
+ {
+ if (isset($matches[2]) or in_array($matches[1], $this->voidElements))
+ {
+ $Block['closed'] = true;
+
+ $Block['void'] = true;
+ }
+ }
+ else
+ {
+ if (isset($matches[2]) or in_array($matches[1], $this->voidElements))
+ {
+ return;
+ }
+
+ if (preg_match('/<\/'.$matches[1].'>[ ]*$/i', $remainder))
+ {
+ $Block['closed'] = true;
+ }
+ }
+
+ return $Block;
+ }
+ }
+
+ protected function blockMarkupContinue($Line, array $Block)
+ {
+ if (isset($Block['closed']))
+ {
+ return;
+ }
+
+ if (preg_match('/^<'.$Block['name'].'(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*>/i', $Line['text'])) # open
+ {
+ $Block['depth'] ++;
+ }
+
+ if (preg_match('/(.*?)<\/'.$Block['name'].'>[ ]*$/i', $Line['text'], $matches)) # close
+ {
+ if ($Block['depth'] > 0)
+ {
+ $Block['depth'] --;
+ }
+ else
+ {
+ $Block['closed'] = true;
+ }
+ }
+
+ if (isset($Block['interrupted']))
+ {
+ $Block['markup'] .= "\n";
+
+ unset($Block['interrupted']);
+ }
+
+ $Block['markup'] .= "\n".$Line['body'];
+
+ return $Block;
+ }
+
+ #
+ # Reference
+
+ protected function blockReference($Line)
+ {
+ if (preg_match('/^\[(.+?)\]:[ ]*?(?:[ ]+["\'(](.+)["\')])?[ ]*$/', $Line['text'], $matches))
+ {
+ $id = strtolower($matches[1]);
+
+ $Data = array(
+ 'url' => $matches[2],
+ 'title' => null,
+ );
+
+ if (isset($matches[3]))
+ {
+ $Data['title'] = $matches[3];
+ }
+
+ $this->DefinitionData['Reference'][$id] = $Data;
+
+ $Block = array(
+ 'hidden' => true,
+ );
+
+ return $Block;
+ }
+ }
+
+ #
+ # Table
+
+ protected function blockTable($Line, array $Block = null)
+ {
+ if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted']))
+ {
+ return;
+ }
+
+ if (strpos($Block['element']['text'], '|') !== false and chop($Line['text'], ' -:|') === '')
+ {
+ $alignments = array();
+
+ $divider = $Line['text'];
+
+ $divider = trim($divider);
+ $divider = trim($divider, '|');
+
+ $dividerCells = explode('|', $divider);
+
+ foreach ($dividerCells as $dividerCell)
+ {
+ $dividerCell = trim($dividerCell);
+
+ if ($dividerCell === '')
+ {
+ continue;
+ }
+
+ $alignment = null;
+
+ if ($dividerCell[0] === ':')
+ {
+ $alignment = 'left';
+ }
+
+ if (substr($dividerCell, - 1) === ':')
+ {
+ $alignment = $alignment === 'left' ? 'center' : 'right';
+ }
+
+ $alignments []= $alignment;
+ }
+
+ # ~
+
+ $HeaderElements = array();
+
+ $header = $Block['element']['text'];
+
+ $header = trim($header);
+ $header = trim($header, '|');
+
+ $headerCells = explode('|', $header);
+
+ foreach ($headerCells as $index => $headerCell)
+ {
+ $headerCell = trim($headerCell);
+
+ $HeaderElement = array(
+ 'name' => 'th',
+ 'text' => $headerCell,
+ 'handler' => 'line',
+ );
+
+ if (isset($alignments[$index]))
+ {
+ $alignment = $alignments[$index];
+
+ $HeaderElement['attributes'] = array(
+ 'style' => 'text-align: '.$alignment.';',
+ );
+ }
+
+ $HeaderElements []= $HeaderElement;
+ }
+
+ # ~
+
+ $Block = array(
+ 'alignments' => $alignments,
+ 'identified' => true,
+ 'element' => array(
+ 'name' => 'table',
+ 'handler' => 'elements',
+ ),
+ );
+
+ $Block['element']['text'] []= array(
+ 'name' => 'thead',
+ 'handler' => 'elements',
+ );
+
+ $Block['element']['text'] []= array(
+ 'name' => 'tbody',
+ 'handler' => 'elements',
+ 'text' => array(),
+ );
+
+ $Block['element']['text'][0]['text'] []= array(
+ 'name' => 'tr',
+ 'handler' => 'elements',
+ 'text' => $HeaderElements,
+ );
+
+ return $Block;
+ }
+ }
+
+ protected function blockTableContinue($Line, array $Block)
+ {
+ if (isset($Block['interrupted']))
+ {
+ return;
+ }
+
+ if ($Line['text'][0] === '|' or strpos($Line['text'], '|'))
+ {
+ $Elements = array();
+
+ $row = $Line['text'];
+
+ $row = trim($row);
+ $row = trim($row, '|');
+
+ preg_match_all('/(?:(\\\\[|])|[^|`]|`[^`]+`|`)+/', $row, $matches);
+
+ foreach ($matches[0] as $index => $cell)
+ {
+ $cell = trim($cell);
+
+ $Element = array(
+ 'name' => 'td',
+ 'handler' => 'line',
+ 'text' => $cell,
+ );
+
+ if (isset($Block['alignments'][$index]))
+ {
+ $Element['attributes'] = array(
+ 'style' => 'text-align: '.$Block['alignments'][$index].';',
+ );
+ }
+
+ $Elements []= $Element;
+ }
+
+ $Element = array(
+ 'name' => 'tr',
+ 'handler' => 'elements',
+ 'text' => $Elements,
+ );
+
+ $Block['element']['text'][1]['text'] []= $Element;
+
+ return $Block;
+ }
+ }
+
+ #
+ # ~
+ #
+
+ protected function paragraph($Line)
+ {
+ $Block = array(
+ 'element' => array(
+ 'name' => 'p',
+ 'text' => $Line['text'],
+ 'handler' => 'line',
+ ),
+ );
+
+ return $Block;
+ }
+
+ #
+ # Inline Elements
+ #
+
+ protected $InlineTypes = array(
+ '"' => array('SpecialCharacter'),
+ '!' => array('Image'),
+ '&' => array('SpecialCharacter'),
+ '*' => array('Emphasis'),
+ ':' => array('Url'),
+ '<' => array('UrlTag', 'EmailTag', 'Markup', 'SpecialCharacter'),
+ '>' => array('SpecialCharacter'),
+ '[' => array('Link'),
+ '_' => array('Emphasis'),
+ '`' => array('Code'),
+ '~' => array('Strikethrough'),
+ '\\' => array('EscapeSequence'),
+ );
+
+ # ~
+
+ protected $inlineMarkerList = '!"*_&[:<>`~\\';
+
+ #
+ # ~
+ #
+
+ public function line($text, $nonNestables=array())
+ {
+ $markup = '';
+
+ # $excerpt is based on the first occurrence of a marker
+
+ while ($excerpt = strpbrk($text, $this->inlineMarkerList))
+ {
+ $marker = $excerpt[0];
+
+ $markerPosition = strpos($text, $marker);
+
+ $Excerpt = array('text' => $excerpt, 'context' => $text);
+
+ foreach ($this->InlineTypes[$marker] as $inlineType)
+ {
+ # check to see if the current inline type is nestable in the current context
+
+ if ( ! empty($nonNestables) and in_array($inlineType, $nonNestables))
+ {
+ continue;
+ }
+
+ $Inline = $this->{'inline'.$inlineType}($Excerpt);
+
+ if ( ! isset($Inline))
+ {
+ continue;
+ }
+
+ # makes sure that the inline belongs to "our" marker
+
+ if (isset($Inline['position']) and $Inline['position'] > $markerPosition)
+ {
+ continue;
+ }
+
+ # sets a default inline position
+
+ if ( ! isset($Inline['position']))
+ {
+ $Inline['position'] = $markerPosition;
+ }
+
+ # cause the new element to 'inherit' our non nestables
+
+ foreach ($nonNestables as $non_nestable)
+ {
+ $Inline['element']['nonNestables'][] = $non_nestable;
+ }
+
+ # the text that comes before the inline
+ $unmarkedText = substr($text, 0, $Inline['position']);
+
+ # compile the unmarked text
+ $markup .= $this->unmarkedText($unmarkedText);
+
+ # compile the inline
+ $markup .= isset($Inline['markup']) ? $Inline['markup'] : $this->element($Inline['element']);
+
+ # remove the examined text
+ $text = substr($text, $Inline['position'] + $Inline['extent']);
+
+ continue 2;
+ }
+
+ # the marker does not belong to an inline
+
+ $unmarkedText = substr($text, 0, $markerPosition + 1);
+
+ $markup .= $this->unmarkedText($unmarkedText);
+
+ $text = substr($text, $markerPosition + 1);
+ }
+
+ $markup .= $this->unmarkedText($text);
+
+ return $markup;
+ }
+
+ #
+ # ~
+ #
+
+ protected function inlineCode($Excerpt)
+ {
+ $marker = $Excerpt['text'][0];
+
+ if (preg_match('/^('.$marker.'+)[ ]*(.+?)[ ]*(? strlen($matches[0]),
+ 'element' => array(
+ 'name' => 'code',
+ 'text' => $text,
+ ),
+ );
+ }
+ }
+
+ protected function inlineEmailTag($Excerpt)
+ {
+ if (strpos($Excerpt['text'], '>') !== false and preg_match('/^<((mailto:)?\S+?@\S+?)>/i', $Excerpt['text'], $matches))
+ {
+ $url = $matches[1];
+
+ if ( ! isset($matches[2]))
+ {
+ $url = 'mailto:' . $url;
+ }
+
+ return array(
+ 'extent' => strlen($matches[0]),
+ 'element' => array(
+ 'name' => 'a',
+ 'text' => $matches[1],
+ 'attributes' => array(
+ 'href' => $url,
+ ),
+ ),
+ );
+ }
+ }
+
+ protected function inlineEmphasis($Excerpt)
+ {
+ if ( ! isset($Excerpt['text'][1]))
+ {
+ return;
+ }
+
+ $marker = $Excerpt['text'][0];
+
+ if ($Excerpt['text'][1] === $marker and preg_match($this->StrongRegex[$marker], $Excerpt['text'], $matches))
+ {
+ $emphasis = 'strong';
+ }
+ elseif (preg_match($this->EmRegex[$marker], $Excerpt['text'], $matches))
+ {
+ $emphasis = 'em';
+ }
+ else
+ {
+ return;
+ }
+
+ return array(
+ 'extent' => strlen($matches[0]),
+ 'element' => array(
+ 'name' => $emphasis,
+ 'handler' => 'line',
+ 'text' => $matches[1],
+ ),
+ );
+ }
+
+ protected function inlineEscapeSequence($Excerpt)
+ {
+ if (isset($Excerpt['text'][1]) and in_array($Excerpt['text'][1], $this->specialCharacters))
+ {
+ return array(
+ 'markup' => $Excerpt['text'][1],
+ 'extent' => 2,
+ );
+ }
+ }
+
+ protected function inlineImage($Excerpt)
+ {
+ if ( ! isset($Excerpt['text'][1]) or $Excerpt['text'][1] !== '[')
+ {
+ return;
+ }
+
+ $Excerpt['text']= substr($Excerpt['text'], 1);
+
+ $Link = $this->inlineLink($Excerpt);
+
+ if ($Link === null)
+ {
+ return;
+ }
+
+ $Inline = array(
+ 'extent' => $Link['extent'] + 1,
+ 'element' => array(
+ 'name' => 'img',
+ 'attributes' => array(
+ 'src' => $Link['element']['attributes']['href'],
+ 'alt' => $Link['element']['text'],
+ ),
+ ),
+ );
+
+ $Inline['element']['attributes'] += $Link['element']['attributes'];
+
+ unset($Inline['element']['attributes']['href']);
+
+ return $Inline;
+ }
+
+ protected function inlineLink($Excerpt)
+ {
+ $Element = array(
+ 'name' => 'a',
+ 'handler' => 'line',
+ 'nonNestables' => array('Url', 'Link'),
+ 'text' => null,
+ 'attributes' => array(
+ 'href' => null,
+ 'title' => null,
+ ),
+ );
+
+ $extent = 0;
+
+ $remainder = $Excerpt['text'];
+
+ if (preg_match('/\[((?:[^][]++|(?R))*+)\]/', $remainder, $matches))
+ {
+ $Element['text'] = $matches[1];
+
+ $extent += strlen($matches[0]);
+
+ $remainder = substr($remainder, $extent);
+ }
+ else
+ {
+ return;
+ }
+
+ if (preg_match('/^[(]\s*+((?:[^ ()]++|[(][^ )]+[)])++)(?:[ ]+("[^"]*"|\'[^\']*\'))?\s*[)]/', $remainder, $matches))
+ {
+ $Element['attributes']['href'] = $matches[1];
+
+ if (isset($matches[2]))
+ {
+ $Element['attributes']['title'] = substr($matches[2], 1, - 1);
+ }
+
+ $extent += strlen($matches[0]);
+ }
+ else
+ {
+ if (preg_match('/^\s*\[(.*?)\]/', $remainder, $matches))
+ {
+ $definition = strlen($matches[1]) ? $matches[1] : $Element['text'];
+ $definition = strtolower($definition);
+
+ $extent += strlen($matches[0]);
+ }
+ else
+ {
+ $definition = strtolower($Element['text']);
+ }
+
+ if ( ! isset($this->DefinitionData['Reference'][$definition]))
+ {
+ return;
+ }
+
+ $Definition = $this->DefinitionData['Reference'][$definition];
+
+ $Element['attributes']['href'] = $Definition['url'];
+ $Element['attributes']['title'] = $Definition['title'];
+ }
+
+ return array(
+ 'extent' => $extent,
+ 'element' => $Element,
+ );
+ }
+
+ protected function inlineMarkup($Excerpt)
+ {
+ if ($this->markupEscaped or $this->safeMode or strpos($Excerpt['text'], '>') === false)
+ {
+ return;
+ }
+
+ if ($Excerpt['text'][1] === '/' and preg_match('/^<\/\w[\w-]*[ ]*>/s', $Excerpt['text'], $matches))
+ {
+ return array(
+ 'markup' => $matches[0],
+ 'extent' => strlen($matches[0]),
+ );
+ }
+
+ if ($Excerpt['text'][1] === '!' and preg_match('/^/s', $Excerpt['text'], $matches))
+ {
+ return array(
+ 'markup' => $matches[0],
+ 'extent' => strlen($matches[0]),
+ );
+ }
+
+ if ($Excerpt['text'][1] !== ' ' and preg_match('/^<\w[\w-]*(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*\/?>/s', $Excerpt['text'], $matches))
+ {
+ return array(
+ 'markup' => $matches[0],
+ 'extent' => strlen($matches[0]),
+ );
+ }
+ }
+
+ protected function inlineSpecialCharacter($Excerpt)
+ {
+ if ($Excerpt['text'][0] === '&' and ! preg_match('/^&#?\w+;/', $Excerpt['text']))
+ {
+ return array(
+ 'markup' => '&',
+ 'extent' => 1,
+ );
+ }
+
+ $SpecialCharacter = array('>' => 'gt', '<' => 'lt', '"' => 'quot');
+
+ if (isset($SpecialCharacter[$Excerpt['text'][0]]))
+ {
+ return array(
+ 'markup' => '&'.$SpecialCharacter[$Excerpt['text'][0]].';',
+ 'extent' => 1,
+ );
+ }
+ }
+
+ protected function inlineStrikethrough($Excerpt)
+ {
+ if ( ! isset($Excerpt['text'][1]))
+ {
+ return;
+ }
+
+ if ($Excerpt['text'][1] === '~' and preg_match('/^~~(?=\S)(.+?)(?<=\S)~~/', $Excerpt['text'], $matches))
+ {
+ return array(
+ 'extent' => strlen($matches[0]),
+ 'element' => array(
+ 'name' => 'del',
+ 'text' => $matches[1],
+ 'handler' => 'line',
+ ),
+ );
+ }
+ }
+
+ protected function inlineUrl($Excerpt)
+ {
+ if ($this->urlsLinked !== true or ! isset($Excerpt['text'][2]) or $Excerpt['text'][2] !== '/')
+ {
+ return;
+ }
+
+ if (preg_match('/\bhttps?:[\/]{2}[^\s<]+\b\/*/ui', $Excerpt['context'], $matches, PREG_OFFSET_CAPTURE))
+ {
+ $url = $matches[0][0];
+
+ $Inline = array(
+ 'extent' => strlen($matches[0][0]),
+ 'position' => $matches[0][1],
+ 'element' => array(
+ 'name' => 'a',
+ 'text' => $url,
+ 'attributes' => array(
+ 'href' => $url,
+ ),
+ ),
+ );
+
+ return $Inline;
+ }
+ }
+
+ protected function inlineUrlTag($Excerpt)
+ {
+ if (strpos($Excerpt['text'], '>') !== false and preg_match('/^<(\w+:\/{2}[^ >]+)>/i', $Excerpt['text'], $matches))
+ {
+ $url = $matches[1];
+
+ return array(
+ 'extent' => strlen($matches[0]),
+ 'element' => array(
+ 'name' => 'a',
+ 'text' => $url,
+ 'attributes' => array(
+ 'href' => $url,
+ ),
+ ),
+ );
+ }
+ }
+
+ # ~
+
+ protected function unmarkedText($text)
+ {
+ if ($this->breaksEnabled)
+ {
+ $text = preg_replace('/[ ]*\n/', "
\n", $text);
+ }
+ else
+ {
+ $text = preg_replace('/(?:[ ][ ]+|[ ]*\\\\)\n/', "
\n", $text);
+ $text = str_replace(" \n", "\n", $text);
+ }
+
+ return $text;
+ }
+
+ #
+ # Handlers
+ #
+
+ protected function element(array $Element)
+ {
+ if ($this->safeMode)
+ {
+ $Element = $this->sanitiseElement($Element);
+ }
+
+ $markup = '<'.$Element['name'];
+
+ if (isset($Element['attributes']))
+ {
+ foreach ($Element['attributes'] as $name => $value)
+ {
+ if ($value === null)
+ {
+ continue;
+ }
+
+ $markup .= ' '.$name.'="'.self::escape($value).'"';
+ }
+ }
+
+ $permitRawHtml = false;
+
+ if (isset($Element['text']))
+ {
+ $text = $Element['text'];
+ }
+ // very strongly consider an alternative if you're writing an
+ // extension
+ elseif (isset($Element['rawHtml']))
+ {
+ $text = $Element['rawHtml'];
+ $allowRawHtmlInSafeMode = isset($Element['allowRawHtmlInSafeMode']) && $Element['allowRawHtmlInSafeMode'];
+ $permitRawHtml = !$this->safeMode || $allowRawHtmlInSafeMode;
+ }
+
+ if (isset($text))
+ {
+ $markup .= '>';
+
+ if (!isset($Element['nonNestables']))
+ {
+ $Element['nonNestables'] = array();
+ }
+
+ if (isset($Element['handler']))
+ {
+ $markup .= $this->{$Element['handler']}($text, $Element['nonNestables']);
+ }
+ elseif (!$permitRawHtml)
+ {
+ $markup .= self::escape($text, true);
+ }
+ else
+ {
+ $markup .= $text;
+ }
+
+ $markup .= '';
+ }
+ else
+ {
+ $markup .= ' />';
+ }
+
+ return $markup;
+ }
+
+ protected function elements(array $Elements)
+ {
+ $markup = '';
+
+ foreach ($Elements as $Element)
+ {
+ $markup .= "\n" . $this->element($Element);
+ }
+
+ $markup .= "\n";
+
+ return $markup;
+ }
+
+ # ~
+
+ protected function li($lines)
+ {
+ $markup = $this->lines($lines);
+
+ $trimmedMarkup = trim($markup);
+
+ if ( ! in_array('', $lines) and substr($trimmedMarkup, 0, 3) === '')
+ {
+ $markup = $trimmedMarkup;
+ $markup = substr($markup, 3);
+
+ $position = strpos($markup, "
");
+
+ $markup = substr_replace($markup, '', $position, 4);
+ }
+
+ return $markup;
+ }
+
+ #
+ # Deprecated Methods
+ #
+
+ function parse($text)
+ {
+ $markup = $this->text($text);
+
+ return $markup;
+ }
+
+ protected function sanitiseElement(array $Element)
+ {
+ static $goodAttribute = '/^[a-zA-Z0-9][a-zA-Z0-9-_]*+$/';
+ static $safeUrlNameToAtt = array(
+ 'a' => 'href',
+ 'img' => 'src',
+ );
+
+ if (isset($safeUrlNameToAtt[$Element['name']]))
+ {
+ $Element = $this->filterUnsafeUrlInAttribute($Element, $safeUrlNameToAtt[$Element['name']]);
+ }
+
+ if ( ! empty($Element['attributes']))
+ {
+ foreach ($Element['attributes'] as $att => $val)
+ {
+ # filter out badly parsed attribute
+ if ( ! preg_match($goodAttribute, $att))
+ {
+ unset($Element['attributes'][$att]);
+ }
+ # dump onevent attribute
+ elseif (self::striAtStart($att, 'on'))
+ {
+ unset($Element['attributes'][$att]);
+ }
+ }
+ }
+
+ return $Element;
+ }
+
+ protected function filterUnsafeUrlInAttribute(array $Element, $attribute)
+ {
+ foreach ($this->safeLinksWhitelist as $scheme)
+ {
+ if (self::striAtStart($Element['attributes'][$attribute], $scheme))
+ {
+ return $Element;
+ }
+ }
+
+ $Element['attributes'][$attribute] = str_replace(':', '%3A', $Element['attributes'][$attribute]);
+
+ return $Element;
+ }
+
+ #
+ # Static Methods
+ #
+
+ protected static function escape($text, $allowQuotes = false)
+ {
+ return htmlspecialchars($text, $allowQuotes ? ENT_NOQUOTES : ENT_QUOTES, 'UTF-8');
+ }
+
+ protected static function striAtStart($string, $needle)
+ {
+ $len = strlen($needle);
+
+ if ($len > strlen($string))
+ {
+ return false;
+ }
+ else
+ {
+ return strtolower(substr($string, 0, $len)) === strtolower($needle);
+ }
+ }
+
+ static function instance($name = 'default')
+ {
+ if (isset(self::$instances[$name]))
+ {
+ return self::$instances[$name];
+ }
+
+ $instance = new static();
+
+ self::$instances[$name] = $instance;
+
+ return $instance;
+ }
+
+ private static $instances = array();
+
+ #
+ # Fields
+ #
+
+ protected $DefinitionData;
+
+ #
+ # Read-Only
+
+ protected $specialCharacters = array(
+ '\\', '`', '*', '_', '{', '}', '[', ']', '(', ')', '>', '#', '+', '-', '.', '!', '|',
+ );
+
+ protected $StrongRegex = array(
+ '*' => '/^[*]{2}((?:\\\\\*|[^*]|[*][^*]*[*])+?)[*]{2}(?![*])/s',
+ '_' => '/^__((?:\\\\_|[^_]|_[^_]*_)+?)__(?!_)/us',
+ );
+
+ protected $EmRegex = array(
+ '*' => '/^[*]((?:\\\\\*|[^*]|[*][*][^*]+?[*][*])+?)[*](?![*])/s',
+ '_' => '/^_((?:\\\\_|[^_]|__[^_]*__)+?)_(?!_)\b/us',
+ );
+
+ protected $regexHtmlAttribute = '[a-zA-Z_:][\w:.-]*(?:\s*=\s*(?:[^"\'=<>`\s]+|"[^"]*"|\'[^\']*\'))?';
+
+ protected $voidElements = array(
+ 'area', 'base', 'br', 'col', 'command', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source',
+ );
+
+ protected $textLevelElements = array(
+ 'a', 'br', 'bdo', 'abbr', 'blink', 'nextid', 'acronym', 'basefont',
+ 'b', 'em', 'big', 'cite', 'small', 'spacer', 'listing',
+ 'i', 'rp', 'del', 'code', 'strike', 'marquee',
+ 'q', 'rt', 'ins', 'font', 'strong',
+ 's', 'tt', 'kbd', 'mark',
+ 'u', 'xm', 'sub', 'nobr',
+ 'sup', 'ruby',
+ 'var', 'span',
+ 'wbr', 'time',
+ );
+}
diff --git a/vendor/vendor-prefixed/erusev/parsedown/README.md b/vendor/vendor-prefixed/erusev/parsedown/README.md
new file mode 100644
index 0000000000..b5d9ed2ee3
--- /dev/null
+++ b/vendor/vendor-prefixed/erusev/parsedown/README.md
@@ -0,0 +1,86 @@
+> I also make [Caret](https://caret.io?ref=parsedown) - a Markdown editor for Mac and PC.
+
+## Parsedown
+
+[](https://travis-ci.org/erusev/parsedown)
+
+
+Better Markdown Parser in PHP
+
+[Demo](http://parsedown.org/demo) |
+[Benchmarks](http://parsedown.org/speed) |
+[Tests](http://parsedown.org/tests/) |
+[Documentation](https://github.com/erusev/parsedown/wiki/)
+
+### Features
+
+* One File
+* No Dependencies
+* Super Fast
+* Extensible
+* [GitHub flavored](https://help.github.com/articles/github-flavored-markdown)
+* Tested in 5.3 to 7.1 and in HHVM
+* [Markdown Extra extension](https://github.com/erusev/parsedown-extra)
+
+### Installation
+
+Include `Parsedown.php` or install [the composer package](https://packagist.org/packages/erusev/parsedown).
+
+### Example
+
+``` php
+$Parsedown = new Parsedown();
+
+echo $Parsedown->text('Hello _Parsedown_!'); # prints: Hello Parsedown!
+```
+
+More examples in [the wiki](https://github.com/erusev/parsedown/wiki/) and in [this video tutorial](http://youtu.be/wYZBY8DEikI).
+
+### Security
+
+Parsedown is capable of escaping user-input within the HTML that it generates. Additionally Parsedown will apply sanitisation to additional scripting vectors (such as scripting link destinations) that are introduced by the markdown syntax itself.
+
+To tell Parsedown that it is processing untrusted user-input, use the following:
+```php
+$parsedown = new Parsedown;
+$parsedown->setSafeMode(true);
+```
+
+If instead, you wish to allow HTML within untrusted user-input, but still want output to be free from XSS it is recommended that you make use of a HTML sanitiser that allows HTML tags to be whitelisted, like [HTML Purifier](http://htmlpurifier.org/).
+
+In both cases you should strongly consider employing defence-in-depth measures, like [deploying a Content-Security-Policy](https://scotthelme.co.uk/content-security-policy-an-introduction/) (a browser security feature) so that your page is likely to be safe even if an attacker finds a vulnerability in one of the first lines of defence above.
+
+#### Security of Parsedown Extensions
+
+Safe mode does not necessarily yield safe results when using extensions to Parsedown. Extensions should be evaluated on their own to determine their specific safety against XSS.
+
+### Escaping HTML
+> ⚠️ **WARNING:** This method isn't safe from XSS!
+
+If you wish to escape HTML **in trusted input**, you can use the following:
+```php
+$parsedown = new Parsedown;
+$parsedown->setMarkupEscaped(true);
+```
+
+Beware that this still allows users to insert unsafe scripting vectors, such as links like `[xss](javascript:alert%281%29)`.
+
+### Questions
+
+**How does Parsedown work?**
+
+It tries to read Markdown like a human. First, it looks at the lines. It’s interested in how the lines start. This helps it recognise blocks. It knows, for example, that if a line starts with a `-` then perhaps it belongs to a list. Once it recognises the blocks, it continues to the content. As it reads, it watches out for special characters. This helps it recognise inline elements (or inlines).
+
+We call this approach "line based". We believe that Parsedown is the first Markdown parser to use it. Since the release of Parsedown, other developers have used the same approach to develop other Markdown parsers in PHP and in other languages.
+
+**Is it compliant with CommonMark?**
+
+It passes most of the CommonMark tests. Most of the tests that don't pass deal with cases that are quite uncommon. Still, as CommonMark matures, compliance should improve.
+
+**Who uses it?**
+
+[Laravel Framework](https://laravel.com/), [Bolt CMS](http://bolt.cm/), [Grav CMS](http://getgrav.org/), [Herbie CMS](http://www.getherbie.org/), [Kirby CMS](http://getkirby.com/), [October CMS](http://octobercms.com/), [Pico CMS](http://picocms.org), [Statamic CMS](http://www.statamic.com/), [phpDocumentor](http://www.phpdoc.org/), [RaspberryPi.org](http://www.raspberrypi.org/), [Symfony demo](https://github.com/symfony/symfony-demo) and [more](https://packagist.org/packages/erusev/parsedown/dependents).
+
+**How can I help?**
+
+Use it, star it, share it and if you feel generous, [donate](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2).
diff --git a/vendor/vendor-prefixed/erusev/parsedown/composer.json b/vendor/vendor-prefixed/erusev/parsedown/composer.json
new file mode 100644
index 0000000000..f8b40f8ce8
--- /dev/null
+++ b/vendor/vendor-prefixed/erusev/parsedown/composer.json
@@ -0,0 +1,33 @@
+{
+ "name": "erusev/parsedown",
+ "description": "Parser for Markdown.",
+ "keywords": ["markdown", "parser"],
+ "homepage": "http://parsedown.org",
+ "type": "library",
+ "license": "MIT",
+ "authors": [
+ {
+ "name": "Emanuil Rusev",
+ "email": "hello@erusev.com",
+ "homepage": "http://erusev.com"
+ }
+ ],
+ "require": {
+ "php": ">=5.3.0",
+ "ext-mbstring": "*"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "^4.8.35"
+ },
+ "autoload": {
+ "psr-0": {"Parsedown": ""}
+ },
+ "autoload-dev": {
+ "psr-0": {
+ "TestParsedown": "test/",
+ "ParsedownTest": "test/",
+ "CommonMarkTest": "test/",
+ "CommonMarkTestWeak": "test/"
+ }
+ }
+}
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/App.php b/vendor/vendor-prefixed/lucatume/di52/src/App.php
index a93e7fed2b..0c57ed1615 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/App.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/App.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -93,13 +93,14 @@ public static function offsetSet($offset, $value)
/**
* Binds an interface a class or a string slug to an implementation and will always return the same instance.
*
- * @param string $id A class or interface fully qualified name or a string slug.
- * @param mixed $implementation The implementation that should be bound to the alias(es); can be a
- * class name, an object or a closure.
- * @param array|null $afterBuildMethods An array of methods that should be called on the built
- * implementation after resolving it.
+ * @param string|class-string $id A class or interface fully qualified name or a string slug.
+ * @param mixed $implementation The implementation that should be bound to the alias(es); can
+ * be a class name, an object or a closure.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the built
+ * implementation after resolving it.
*
* @return void This method does not return any value.
+ *
* @throws ContainerException If there's any issue reflecting on the class, interface or the implementation.
*/
public static function singleton($id, $implementation = null, array $afterBuildMethods = null)
@@ -128,11 +129,12 @@ public static function getVar($key, $default = null)
/**
* Finds an entry of the container by its identifier and returns it.
*
- * @param string $offset Identifier of the entry to look for.
+ * @template T
*
- * @return mixed The entry for an id.
+ * @param string|class-string $offset Identifier of the entry to look for.
*
- * @return mixed The value for the offset.
+ * @return T|mixed The value for the offset.
+ * @phpstan-return ($offset is class-string ? T : mixed)
*
* @throws ContainerException Error while retrieving the entry.
* @throws NotFoundException No entry was found for **this** identifier.
@@ -145,9 +147,12 @@ public static function offsetGet($offset)
/**
* Finds an entry of the container by its identifier and returns it.
*
- * @param string $id A fully qualified class or interface name or an already built object.
+ * @template T
+ *
+ * @param string|class-string $id A fully qualified class or interface name or an already built object.
*
- * @return mixed The entry for an id.
+ * @return T|mixed The entry for an id.
+ * @phpstan-return ($id is class-string ? T : mixed)
*
* @throws ContainerException Error while retrieving the entry.
*/
@@ -163,9 +168,13 @@ public static function get($id)
* If the implementation has been bound as singleton using the `singleton` method
* or the ArrayAccess API then the implementation will be resolved just on the first request.
*
- * @param string $id A fully qualified class or interface name or an already built object.
+ * @template T
+ *
+ * @param string|class-string $id A fully qualified class or interface name or an already built object.
+ *
+ * @return T|mixed
+ * @phpstan-return ($id is class-string ? T : mixed)
*
- * @return mixed
* @throws ContainerException If the target of the make is not bound and is not a valid,
* concrete, class name or there's any issue making the target.
*/
@@ -181,7 +190,7 @@ public static function make($id)
* `$container[$id]` returning true does not mean that `$container[$id]` will not throw an exception.
* It does however mean that `$container[$id]` will not throw a `NotFoundExceptionInterface`.
*
- * @param string $offset An offset to check for.
+ * @param string|class-string $offset An offset to check for.
*
* @return boolean true on success or false on failure.
*/
@@ -197,7 +206,7 @@ public static function offsetExists($offset)
* `has($id)` returning true does not mean that `get($id)` will not throw an exception.
* It does however mean that `get($id)` will not throw a `NotFoundExceptionInterface`.
*
- * @param string $id Identifier of the entry to look for.
+ * @param string|class-string $id Identifier of the entry to look for.
*
* @return bool Whether the container contains a binding for an id or not.
*/
@@ -275,7 +284,7 @@ public static function hasTag($tag)
* If a provider overloads the `boot` method that method will be called when the `boot` method is called on the
* container itself.
*
- * @param string $serviceProviderClass The fully-qualified Service Provider class name.
+ * @param class-string $serviceProviderClass The fully-qualified Service Provider class name.
* @param string ...$alias A list of aliases the provider should be registered with.
* @return void This method does not return any value.
* @throws ContainerException If the Service Provider is not correctly configured or there's an issue
@@ -296,13 +305,14 @@ public static function register($serviceProviderClass, ...$alias)
*
* Existing implementations are replaced.
*
- * @param string $id A class or interface fully qualified name or a string slug.
- * @param mixed $implementation The implementation that should be bound to the alias(es); can be a
- * class name, an object or a closure.
- * @param array|null $afterBuildMethods An array of methods that should be called on the built
- * implementation after resolving it.
+ * @param string|class-string $id A class or interface fully qualified name or a string slug.
+ * @param mixed $implementation The implementation that should be bound to the alias(es); can
+ * be a class name, an object or a closure.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the built
+ * implementation after resolving it.
*
* @return void The method does not return any value.
+ *
* @throws ContainerException If there's an issue while trying to bind the implementation.
*/
public static function bind($id, $implementation = null, array $afterBuildMethods = null)
@@ -328,15 +338,14 @@ public static function boot()
/**
* Binds a class, interface or string slug to a chain of implementations decorating a base
* object; the chain will be lazily resolved only on the first call.
- *
* The base decorated object must be the last element of the array.
*
- * @param string $id The class, interface or slug the decorator chain should
- * be bound to.
- * @param array $decorators An array of implementations that decorate an object.
- * @param array|null $afterBuildMethods An array of methods that should be called on the
- * instance after it has been built; the methods should not
- * require any argument.
+ * @param string|class-string $id The class, interface or slug the decorator chain
+ * should be bound to.
+ * @param array $decorators An array of implementations that decorate an object.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the
+ * instance after it has been built; the methods should
+ * not require any argument.
*
* @return void This method does not return any value.
* @throws ContainerException
@@ -347,17 +356,17 @@ public static function singletonDecorators($id, $decorators, array $afterBuildMe
}
/**
- * Binds a class, interface or string slug to to a chain of implementations decorating a
+ * Binds a class, interface or string slug to a chain of implementations decorating a
* base object.
*
* The base decorated object must be the last element of the array.
*
- * @param string $id The class, interface or slug the decorator chain should
- * be bound to.
- * @param array $decorators An array of implementations that decorate an object.
- * @param array|null $afterBuildMethods An array of methods that should be called on the
- * instance after it has been built; the methods should not
- * require any argument.
+ * @param string|class-string $id The class, interface or slug the decorator chain
+ * should be bound to.
+ * @param array $decorators An array of implementations that decorate an object.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the
+ * instance after it has been built; the methods should
+ * not require any argument.
*
* @return void This method does not return any value.
* @throws ContainerException If there's any issue binding the decorators.
@@ -382,7 +391,7 @@ public static function offsetUnset($offset)
/**
* Starts the `when->needs->give` chain for a contextual binding.
*
- * @param string $class The fully qualified name of the requesting class.
+ * @param string|class-string $class The fully qualified name of the requesting class.
*
* Example:
*
@@ -390,8 +399,8 @@ public static function offsetUnset($offset)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // But if the requesting class is `Worker` return another implementation
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
* @return Container The container instance, to continue the when/needs/give chain.
*/
@@ -409,10 +418,10 @@ public static function when($class)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // But if the requesting class is `Worker` return another implementation.
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
- * @param string $id The class or interface needed by the class.
+ * @param string|class-string $id The class or interface needed by the class.
*
* @return Container The container instance, to continue the when/needs/give chain.
*/
@@ -430,8 +439,8 @@ public static function needs($id)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // but if the requesting class is `Worker` return another implementation
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
* @param mixed $implementation The implementation specified
*
@@ -447,13 +456,12 @@ public static function give($implementation)
* Returns a lambda function suitable to use as a callback; when called the function will build the implementation
* bound to `$id` and return the value of a call to `$method` method with the call arguments.
*
- * @param string|object $id A fully-qualified class name, a bound slug or an object o call the
- * callback on.
- * @param string $method The method that should be called on the resolved implementation with the
- * specified array arguments.
+ * @param string|class-string|object $id A fully-qualified class name, a bound slug or an object o call the
+ * callback on.
+ * @param string $method The method that should be called on the resolved implementation
+ * with the specified array arguments.
*
* @return callable The callback function.
- *
* @throws ContainerException If the id is not a bound implementation or valid class name.
*/
public static function callback($id, $method)
@@ -464,15 +472,14 @@ public static function callback($id, $method)
/**
* Returns a callable object that will build an instance of the specified class using the
* specified arguments when called.
- *
* The callable will be a closure on PHP 5.3+ or a lambda function on PHP 5.2.
*
- * @param string|mixed $id The fully qualified name of a class or an interface.
- * @param array $buildArgs An array of arguments that should be used to build the instance;
- * note that any argument will be resolved using the container itself
- * and bindings will apply.
- * @param array|null $afterBuildMethods An array of methods that should be called on the built
- * implementation after resolving it.
+ * @param string|class-string|mixed $id The fully qualified name of a class or an interface.
+ * @param array $buildArgs An array of arguments that should be used to build the
+ * instance; note that any argument will be resolved using
+ * the container itself and bindings will apply.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the built
+ * implementation after resolving it.
*
* @return callable A callable function that will return an instance of the specified class when
* called.
@@ -497,7 +504,7 @@ public static function protect($value)
/**
* Returns the Service Provider instance registered.
*
- * @param string $providerId The Service Provider clas to return the instance for.
+ * @param string|class-string $providerId The Service Provider class to return the instance for.
*
* @return ServiceProvider The service provider instance.
*
@@ -512,10 +519,10 @@ public static function getProvider($providerId)
/**
* Returns whether a binding exists in the container or not.
*
- * `isBound($id)` returning `true` means the a call to `bind($id, $implementaion)` or `singleton($id,
+ * `isBound($id)` returning `true` means the call to `bind($id, $implementaion)` or `singleton($id,
* $implementation)` (or equivalent ArrayAccess methods) was explicitly made.
*
- * @param string $id The id to check for bindings in the container.
+ * @param string|class-string $id The id to check for bindings in the container.
*
* @return bool Whether an explicit binding for the id exists in the container or not.
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/BuilderInterface.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/BuilderInterface.php
index f1304ef33a..d1b4c7e6f5 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/BuilderInterface.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/BuilderInterface.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/CallableBuilder.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/CallableBuilder.php
index 6b640b6ec3..bebc36fc89 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/CallableBuilder.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/CallableBuilder.php
@@ -5,7 +5,7 @@
* @package Pods\Prefixed\lucatume\DI52\Builders
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClassBuilder.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClassBuilder.php
index 9732de8b4c..ed6294afcf 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClassBuilder.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClassBuilder.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -13,6 +13,7 @@
use Pods\Prefixed\lucatume\DI52\ContainerException;
use Pods\Prefixed\lucatume\DI52\NotFoundException;
+use ReflectionException;
use ReflectionMethod;
/**
@@ -41,7 +42,7 @@ class ClassBuilder implements BuilderInterface, ReinitializableBuilderInterface
/**
* The fully-qualified class name the builder should build instances of.
*
- * @var string
+ * @var class-string
*/
protected $className;
/**
@@ -69,12 +70,12 @@ class ClassBuilder implements BuilderInterface, ReinitializableBuilderInterface
/**
* ClassBuilder constructor.
*
- * @param string $id The identifier associated with this builder.
- * @param Resolver $resolver A reference to the resolver currently using the builder.
- * @param string $className The fully-qualified class name to build instances for.
- * @param array|null $afterBuildMethods An optional set of methods to call on the built object.
- * @param mixed ...$buildArgs An optional set of build arguments that should be provided to the
- * class constructor method.
+ * @param string|class-string $id The identifier associated with this builder.
+ * @param Resolver $resolver A reference to the resolver currently using the builder.
+ * @param string $className The fully-qualified class name to build instances for.
+ * @param array|null $afterBuildMethods An optional set of methods to call on the built object.
+ * @param mixed ...$buildArgs An optional set of build arguments that should be provided to
+ * the class constructor method.
*
* @throws NotFoundException If the class does not exist.
*/
@@ -82,7 +83,7 @@ public function __construct($id, Resolver $resolver, $className, array $afterBui
{
if (!class_exists($className)) {
throw new NotFoundException(
- "nothing is bound to the '{$className}' id and it's not an existing or instantiable class."
+ "nothing is bound to the '$className' id and it's not an existing or instantiable class."
);
}
@@ -103,6 +104,8 @@ public function __construct($id, Resolver $resolver, $className, array $afterBui
* Builds and returns an instance of the class.
*
* @return object An instance of the class.
+ *
+ * @throws ContainerException
*/
public function build()
{
@@ -149,7 +152,8 @@ protected function resolveConstructorParameters()
/**
* Returns a set of resolved constructor parameters.
*
- * @param string $className The fully-qualified class name to get the resolved constructor parameters yet.
+ * @param class-string $className The fully-qualified class name to get the resolved constructor parameters yet.
+ *
* @return array A set of resolved constructor parameters.
*
* @throws ContainerException If the resolution of any constructor parameters is problematic.
@@ -162,7 +166,7 @@ protected function getResolvedConstructorParameters($className)
try {
$constructorReflection = new ReflectionMethod($className, '__construct');
- } catch (\ReflectionException $e) {
+ } catch (ReflectionException $e) {
static::$constructorParametersCache[$className] = [];
// No constructor method, no args.
return [];
@@ -189,6 +193,8 @@ protected function getResolvedConstructorParameters($className)
* @param mixed $arg The argument id or value to resolve.
*
* @return mixed The resolved build argument.
+ *
+ * @throws NotFoundException
*/
protected function resolveBuildArg($arg)
{
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClosureBuilder.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClosureBuilder.php
index a22adf3e7d..87cd9a2889 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClosureBuilder.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ClosureBuilder.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Factory.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Factory.php
index 2fe8671c37..84c8d98ec6 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Factory.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Factory.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -49,13 +49,12 @@ public function __construct(Container $container, Resolver $resolver)
/**
* Returns the correct builder for a value.
*
- * @param string|mixed $id The string id to provide a builder for, or a value.
- * @param mixed $implementation The implementation to build the builder for.
- * @param array|null $afterBuildMethods A list of methods that should be called on the built instance
- * after
- * it's been built.
- * @param mixed ...$buildArgs A set of arguments to pass that should be used to build the
- * instance, if any.
+ * @param string|class-string|mixed $id The string id to provide a builder for, or a value.
+ * @param mixed $implementation The implementation to build the builder for.
+ * @param string[]|null $afterBuildMethods A list of methods that should be called on the built
+ * instance after it's been built.
+ * @param mixed ...$buildArgs A set of arguments to pass that should be used to build
+ * the instance, if any.
*
* @return BuilderInterface A builder instance.
*
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Parameter.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Parameter.php
index cc8298cd75..74f4feb5f5 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Parameter.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Parameter.php
@@ -5,7 +5,7 @@
* @package Pods\Prefixed\lucatume\DI52\Builders
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -210,7 +210,7 @@ private function isClass()
}
try {
- if (function_exists('enum_exists') && enum_exists($this->type)) {
+ if (function_exists('enum_exists') && enum_exists((string) $this->type)) {
return false;
}
} catch (ParseError $e) {
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ReinitializableBuilderInterface.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ReinitializableBuilderInterface.php
index 83ce4e5110..3fd5f2d32b 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ReinitializableBuilderInterface.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ReinitializableBuilderInterface.php
@@ -5,7 +5,7 @@
* @package Pods\Prefixed\lucatume\DI52\Builders
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Resolver.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Resolver.php
index 27c115dfe8..ea2d6b90f4 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/Resolver.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/Resolver.php
@@ -5,7 +5,7 @@
* @package Pods\Prefixed\lucatume\DI52\Builders
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -68,8 +68,8 @@ public function __construct($resolveUnboundAsSingletons = false)
/**
* Binds an implementation for an id, or class name, as prototype (build new each time).
*
- * @param string $id The id to register the implementation for.
- * @param BuilderInterface $implementation The builder that will provide the implementation for the id.
+ * @param string|class-string $id The id to register the implementation for.
+ * @param BuilderInterface $implementation The builder that will provide the implementation for the id.
*
* @return void This method does not return any value.
*/
@@ -82,9 +82,9 @@ public function bind($id, BuilderInterface $implementation)
/**
* Registers an implementation for an id, or class name, as singleton (build at most once).
*
- * @param string $id The id to register the implementation for.
- * @param BuilderInterface $implementation The builder that will provide the implementation for
- * the id.
+ * @param string|class-string $id The id to register the implementation for.
+ * @param BuilderInterface $implementation The builder that will provide the implementation for
+ * the id.
*
* @return void This method does not return any value.
*/
@@ -109,7 +109,7 @@ public function isBound($id)
/**
* Removes the relation between an id and a bound implementation from the resolver.
*
- * @param string $id The id to unregister the implementation for.
+ * @param string|class-string $id The id to unregister the implementation for.
*
* @return void This method does not return any value.
*/
@@ -121,7 +121,7 @@ public function unbind($id)
/**
* Returns whether a specific id is bound as singleton (build at most once), or not.
*
- * @param string $id The id to check.
+ * @param string|class-string $id The id to check.
*
* @return bool Whether a specific id is bound as singleton (build at most once), or not.
*/
@@ -133,8 +133,8 @@ public function isSingleton($id)
/**
* Transform the canonical class to the class part of a when-needs-give specification, if required.
*
- * @param string $id The ID to resolve the when-needs-give case for.
- * @param string $paramClass The class of the parameter to solve the when-needs-give case for.
+ * @param string|class-string $id The ID to resolve the when-needs-give case for.
+ * @param string $paramClass The class of the parameter to solve the when-needs-give case for.
*
* @return BuilderInterface|string Either the builder for the when-needs-give replacement, or the input parameter
* class if not found.
@@ -149,10 +149,10 @@ public function whenNeedsGive($id, $paramClass)
/**
* Sets an entry in the when->needs->give chain.
*
- * @param string $whenClass The "when" part of the chain, a class name or id.
- * @param string $needsClass The "needs" part of the chain, a class name or id.
- * @param BuilderInterface $builder The Builder instance that should be returned when a class needs the
- * specified id.
+ * @param string|class-string $whenClass The "when" part of the chain, a class name or id.
+ * @param string|class-string $needsClass The "needs" part of the chain, a class name or id.
+ * @param BuilderInterface $builder The Builder instance that should be returned when a class needs the
+ * specified id.
*
* @return void This method does not return any value.
*/
@@ -164,11 +164,12 @@ public function setWhenNeedsGive($whenClass, $needsClass, BuilderInterface $buil
/**
* Resolves an ide to an implementation with the input arguments.
*
- * @param string|mixed $id The id, class name or built value to resolve.
- * @param array|null $afterBuildMethods A list of methods that should run on the built
+ * @param string|class-string|mixed $id The id, class name or built value to resolve.
+ * @param string[]|null $afterBuildMethods A list of methods that should run on the built
* instance.
- * @param mixed ...$buildArgs A set of build arguments that will be passed to
+ * @param mixed ...$buildArgs A set of build arguments that will be passed to
* the implementation constructor.
+ *
* @return BuilderInterface|ReinitializableBuilderInterface|mixed The builder, set up to use the specified set of
* build arguments.
* @throws NotFoundException If the id is a string that does not resolve to an existing, concrete, class.
@@ -188,11 +189,15 @@ public function resolveWithArgs($id, array $afterBuildMethods = null, ...$buildA
/**
* Resolves an id or input value to a value or object instance.
*
- * @param string|mixed $id Either the id of a bound implementation, a class name or an object
- * to resolve.
- * @param array|null $buildLine The build line to append the resolution leafs to, or `null` to use the
- * current one.
- * @return mixed The resolved value or instance.
+ * @template T
+ *
+ * @param string|class-string|mixed $id Either the id of a bound implementation, a class name or an
+ * object to resolve.
+ * @param string[]|null $buildLine The build line to append the resolution leafs to, or `null` to
+ * use the current one.
+ *
+ * @return T|mixed The resolved value or instance.
+ * @phpstan-return ($id is class-string ? T : mixed)
*
* @throws NotFoundException If the id is a string that is not bound and is not an existing, concrete, class.
*/
@@ -222,7 +227,7 @@ public function resolve($id, array $buildLine = null)
/**
* Builds, with auto-wiring, an instance of a not bound class.
*
- * @param string $id The class name to build an instance of.
+ * @param string|class-string $id The class name to build an instance of.
*
* @return object The built class instance.
*
@@ -243,7 +248,7 @@ private function resolveUnbound($id)
/**
* Resolves a bound implementation to a value or object.
*
- * @param string $id The id to resolve the implementation for.
+ * @param string|class-string $id The id to resolve the implementation for.
*
* @return mixed The resolved instance.
*/
@@ -259,15 +264,14 @@ private function resolveBound($id)
/**
* Clones the builder assigned to an id and re-initializes it.
- *
* The clone operation leverages the already resolved dependencies of a builder to create an up-to-date instance.
*
- * @param string $id The id to clone the builder of.
- * @param array|null $afterBuildMethods A set of methods to run on the built instance.
- * @param mixed ...$buildArgs An optional set of arguments that will be passed to the instance
- * constructor.
- * @return BuilderInterface A new instance of the builder currently related to the id.
+ * @param string|class-string $id The id to clone the builder of.
+ * @param string[]|null $afterBuildMethods A set of methods to run on the built instance.
+ * @param mixed ...$buildArgs An optional set of arguments that will be passed to the instance
+ * constructor.
*
+ * @return BuilderInterface A new instance of the builder currently related to the id.
* @throws NotFoundException If trying to clone the builder for a non existing id or an id that does not map to a
* concrete class name.
*/
@@ -295,7 +299,7 @@ private function cloneBuilder($id, array $afterBuildMethods = null, ...$buildArg
*/
public function addToBuildLine($type, $parameterName)
{
- $this->buildLine[] = trim("{$type} \${$parameterName}");
+ $this->buildLine[] = trim("$type \$$parameterName");
}
/**
@@ -304,7 +308,7 @@ public function addToBuildLine($type, $parameterName)
* The build line will return a straight path from the current resolution root to the leaf
* currently being resolved. Used for error logging and formatting.
*
- * @return array A set of consecutive items the resolver is currently trying to build.
+ * @return string[] A set of consecutive items the resolver is currently trying to build.
*/
public function getBuildLine()
{
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ValueBuilder.php b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ValueBuilder.php
index 587a9f96b5..9004ef3aab 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Builders/ValueBuilder.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Builders/ValueBuilder.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/Container.php b/vendor/vendor-prefixed/lucatume/di52/src/Container.php
index a5ea04f022..235854b64b 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/Container.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/Container.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
@@ -51,7 +51,7 @@ class Container implements ArrayAccess, ContainerInterface
/**
* A list of bound and resolved singletons.
*
- * @var array
+ * @var array
*/
protected $singletons = [];
/**
@@ -186,11 +186,12 @@ public function getVar($key, $default = null)
/**
* Finds an entry of the container by its identifier and returns it.
*
- * @param string $offset Identifier of the entry to look for.
+ * @template T
*
- * @return mixed The entry for an id.
+ * @param string|class-string $offset Identifier of the entry to look for.
*
- * @return mixed The value for the offset.
+ * @return T|mixed The value for the offset.
+ * @phpstan-return ($offset is class-string ? T : mixed)
*
* @throws ContainerException Error while retrieving the entry.
* @throws NotFoundException No entry was found for **this** identifier.
@@ -204,9 +205,12 @@ public function offsetGet($offset)
/**
* Finds an entry of the container by its identifier and returns it.
*
- * @param string $id A fully qualified class or interface name or an already built object.
+ * @template T
+ *
+ * @param string|class-string $id A fully qualified class or interface name or an already built object.
*
- * @return mixed The entry for an id.
+ * @return T|mixed The entry for an id.
+ * @phpstan-return ($id is class-string ? T : mixed)
*
* @throws ContainerException Error while retrieving the entry.
*/
@@ -252,9 +256,13 @@ private function castThrown($thrown, $id)
* If the implementation has been bound as singleton using the `singleton` method
* or the ArrayAccess API then the implementation will be resolved just on the first request.
*
- * @param string $id A fully qualified class or interface name or an already built object.
+ * @template T
+ *
+ * @param string|class-string $id A fully qualified class or interface name or an already built object.
+ *
+ * @return T|mixed
+ * @phpstan-return ($id is class-string ? T : mixed)
*
- * @return mixed
* @throws ContainerException If the target of the make is not bound and is not a valid,
* concrete, class name or there's any issue making the target.
*/
@@ -270,7 +278,7 @@ public function make($id)
* `$container[$id]` returning true does not mean that `$container[$id]` will not throw an exception.
* It does however mean that `$container[$id]` will not throw a `NotFoundExceptionInterface`.
*
- * @param string $offset An offset to check for.
+ * @param string|class-string $offset An offset to check for.
*
* @return boolean true on success or false on failure.
*/
@@ -287,7 +295,7 @@ public function offsetExists($offset)
* `has($id)` returning true does not mean that `get($id)` will not throw an exception.
* It does however mean that `get($id)` will not throw a `NotFoundExceptionInterface`.
*
- * @param string $id Identifier of the entry to look for.
+ * @param string|class-string $id Identifier of the entry to look for.
*
* @return bool Whether the container contains a binding for an id or not.
*/
@@ -367,7 +375,7 @@ public function hasTag($tag)
/**
* A wrapper around the `class_exists` function to capture and handle possible fatal errors on PHP 7.0+.
*
- * @param string $class The class name to check.
+ * @param string|class-string $class The class name to check.
*
* @return bool Whether the class exists or not.
*
@@ -401,7 +409,7 @@ protected function classIsInstantiable($class)
/**
* Checks a class, interface or trait exists.
*
- * @param string $class The class, interface or trait to check.
+ * @param string|class-string $class The class, interface or trait to check.
*
* @return bool Whether the class, interface or trait exists or not.
* @throws ReflectionException If the class should be checked for concreteness and it does not exist.
@@ -436,7 +444,7 @@ protected function checkClassIsInstantiatable($class)
* If a provider overloads the `boot` method that method will be called when the `boot` method is called on the
* container itself.
*
- * @param string $serviceProviderClass The fully-qualified Service Provider class name.
+ * @param class-string $serviceProviderClass The fully-qualified Service Provider class name.
* @param string ...$alias A list of aliases the provider should be registered with.
* @return void This method does not return any value.
* @throws ContainerException If the Service Provider is not correctly configured or there's an issue
@@ -512,13 +520,14 @@ private function getDeferredProviderMakeClosure(ServiceProvider $provider, $id)
*
* Existing implementations are replaced.
*
- * @param string $id A class or interface fully qualified name or a string slug.
- * @param mixed $implementation The implementation that should be bound to the alias(es); can be a
- * class name, an object or a closure.
- * @param array|null $afterBuildMethods An array of methods that should be called on the built
- * implementation after resolving it.
+ * @param string|class-string $id A class or interface fully qualified name or a string slug.
+ * @param mixed $implementation The implementation that should be bound to the alias(es); can
+ * be a class name, an object or a closure.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the built
+ * implementation after resolving it.
*
* @return void The method does not return any value.
+ *
* @throws ContainerException If there's an issue while trying to bind the implementation.
*/
public function bind($id, $implementation = null, array $afterBuildMethods = null)
@@ -555,15 +564,14 @@ public function boot()
/**
* Binds a class, interface or string slug to a chain of implementations decorating a base
* object; the chain will be lazily resolved only on the first call.
- *
* The base decorated object must be the last element of the array.
*
- * @param string $id The class, interface or slug the decorator chain should
- * be bound to.
- * @param array $decorators An array of implementations that decorate an object.
- * @param array|null $afterBuildMethods An array of methods that should be called on the
- * instance after it has been built; the methods should not
- * require any argument.
+ * @param string|class-string $id The class, interface or slug the decorator chain
+ * should be bound to.
+ * @param array $decorators An array of implementations that decorate an object.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the
+ * instance after it has been built; the methods should
+ * not require any argument.
*
* @return void This method does not return any value.
* @throws ContainerException
@@ -603,17 +611,17 @@ private function getDecoratorBuilder(array $decorators, $id, array $afterBuildMe
}
/**
- * Binds a class, interface or string slug to to a chain of implementations decorating a
+ * Binds a class, interface or string slug to a chain of implementations decorating a
* base object.
*
* The base decorated object must be the last element of the array.
*
- * @param string $id The class, interface or slug the decorator chain should
- * be bound to.
- * @param array $decorators An array of implementations that decorate an object.
- * @param array|null $afterBuildMethods An array of methods that should be called on the
- * instance after it has been built; the methods should not
- * require any argument.
+ * @param string|class-string $id The class, interface or slug the decorator chain
+ * should be bound to.
+ * @param array $decorators An array of implementations that decorate an object.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the
+ * instance after it has been built; the methods should
+ * not require any argument.
*
* @return void This method does not return any value.
* @throws ContainerException If there's any issue binding the decorators.
@@ -643,7 +651,7 @@ public function offsetUnset($offset)
/**
* Starts the `when->needs->give` chain for a contextual binding.
*
- * @param string $class The fully qualified name of the requesting class.
+ * @param string|class-string $class The fully qualified name of the requesting class.
*
* Example:
*
@@ -651,8 +659,8 @@ public function offsetUnset($offset)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // But if the requesting class is `Worker` return another implementation
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
* @return Container The container instance, to continue the when/needs/give chain.
*/
@@ -672,10 +680,10 @@ public function when($class)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // But if the requesting class is `Worker` return another implementation.
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
- * @param string $id The class or interface needed by the class.
+ * @param string|class-string $id The class or interface needed by the class.
*
* @return Container The container instance, to continue the when/needs/give chain.
*/
@@ -695,8 +703,8 @@ public function needs($id)
* $container->singleton('LoggerInterface', 'FilesystemLogger');
* // but if the requesting class is `Worker` return another implementation
* $container->when('Worker')
- * ->needs('LoggerInterface)
- * ->give('RemoteLogger);
+ * ->needs('LoggerInterface')
+ * ->give('RemoteLogger');
*
* @param mixed $implementation The implementation specified
*
@@ -715,13 +723,12 @@ public function give($implementation)
* Returns a lambda function suitable to use as a callback; when called the function will build the implementation
* bound to `$id` and return the value of a call to `$method` method with the call arguments.
*
- * @param string|object $id A fully-qualified class name, a bound slug or an object o call the
- * callback on.
- * @param string $method The method that should be called on the resolved implementation with the
- * specified array arguments.
- *
- * @return callable The callback function.
+ * @param string|class-string|object $id A fully-qualified class name, a bound slug or an object o call the
+ * callback on.
+ * @param string $method The method that should be called on the resolved implementation
+ * with the specified array arguments.
*
+ * @return callable|Closure The callback function.
* @throws ContainerException If the id is not a bound implementation or valid class name.
*/
public function callback($id, $method)
@@ -763,8 +770,8 @@ public function callback($id, $method)
/**
* Whether a method of an id, possibly not a class, is static or not.
*
- * @param object|string $object A class name, instance or something that does not map to a class.
- * @param string $method The method to check.
+ * @param object|string|class-string $object A class name, instance or something that does not map to a class.
+ * @param string $method The method to check.
*
* @return bool Whether a method of an id or class is static or not.
*/
@@ -786,17 +793,16 @@ protected function isStaticMethod($object, $method)
/**
* Returns a callable object that will build an instance of the specified class using the
* specified arguments when called.
- *
* The callable will be a closure on PHP 5.3+ or a lambda function on PHP 5.2.
*
- * @param string|mixed $id The fully qualified name of a class or an interface.
- * @param array $buildArgs An array of arguments that should be used to build the instance;
- * note that any argument will be resolved using the container itself
- * and bindings will apply.
- * @param array|null $afterBuildMethods An array of methods that should be called on the built
- * implementation after resolving it.
+ * @param string|class-string|mixed $id The fully qualified name of a class or an interface.
+ * @param array $buildArgs An array of arguments that should be used to build the
+ * instance; note that any argument will be resolved using
+ * the container itself and bindings will apply.
+ * @param string[]|null $afterBuildMethods An array of methods that should be called on the built
+ * implementation after resolving it.
*
- * @return callable A callable function that will return an instance of the specified class when
+ * @return callable|Closure A callable function that will return an instance of the specified class when
* called.
*/
public function instance($id, array $buildArgs = [], array $afterBuildMethods = null)
@@ -825,7 +831,7 @@ public function protect($value)
/**
* Returns the Service Provider instance registered.
*
- * @param string $providerId The Service Provider clas to return the instance for.
+ * @param string|class-string $providerId The Service Provider clas to return the instance for.
*
* @return ServiceProvider The service provider instance.
*
@@ -835,13 +841,13 @@ public function protect($value)
public function getProvider($providerId)
{
if (!$this->resolver->isBound($providerId)) {
- throw new NotFoundException("Service provider '{$providerId}' is not registered in the container.");
+ throw new NotFoundException("Service provider '$providerId' is not registered in the container.");
}
$provider = $this->get($providerId);
if (! $provider instanceof ServiceProvider) {
- throw new NotFoundException("Bound implementation for '{$providerId}' is not Service Provider.");
+ throw new NotFoundException("Bound implementation for '$providerId' is not Service Provider.");
}
return $provider;
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/ContainerException.php b/vendor/vendor-prefixed/lucatume/di52/src/ContainerException.php
index bd3c48cea8..56aac109c1 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/ContainerException.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/ContainerException.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/NestedParseError.php b/vendor/vendor-prefixed/lucatume/di52/src/NestedParseError.php
index 7915611a29..0638c8f8bc 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/NestedParseError.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/NestedParseError.php
@@ -6,7 +6,7 @@
* @package Pods\Prefixed\lucatume\DI52;
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/NotFoundException.php b/vendor/vendor-prefixed/lucatume/di52/src/NotFoundException.php
index d376e826a7..3841d84716 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/NotFoundException.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/NotFoundException.php
@@ -5,7 +5,7 @@
* @package lucatume\DI52
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/lucatume/di52/src/ServiceProvider.php b/vendor/vendor-prefixed/lucatume/di52/src/ServiceProvider.php
index 3ef63fe1d6..d756550eb2 100644
--- a/vendor/vendor-prefixed/lucatume/di52/src/ServiceProvider.php
+++ b/vendor/vendor-prefixed/lucatume/di52/src/ServiceProvider.php
@@ -3,7 +3,7 @@
* The base service provider class.
*
* @license GPL-3.0
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/mustangostang/spyc/Spyc.php b/vendor/vendor-prefixed/mustangostang/spyc/Spyc.php
index 67c593a539..b22d96c080 100644
--- a/vendor/vendor-prefixed/mustangostang/spyc/Spyc.php
+++ b/vendor/vendor-prefixed/mustangostang/spyc/Spyc.php
@@ -9,7 +9,7 @@
* @license http://www.opensource.org/licenses/mit-license.php MIT License
* @package Pods__Prefixed__Spyc
*
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/psr/container/src/ContainerExceptionInterface.php b/vendor/vendor-prefixed/psr/container/src/ContainerExceptionInterface.php
index d7055da352..1b421e9686 100644
--- a/vendor/vendor-prefixed/psr/container/src/ContainerExceptionInterface.php
+++ b/vendor/vendor-prefixed/psr/container/src/ContainerExceptionInterface.php
@@ -2,7 +2,7 @@
/**
* @license MIT
*
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/psr/container/src/ContainerInterface.php b/vendor/vendor-prefixed/psr/container/src/ContainerInterface.php
index da0afb91fa..593ed77762 100644
--- a/vendor/vendor-prefixed/psr/container/src/ContainerInterface.php
+++ b/vendor/vendor-prefixed/psr/container/src/ContainerInterface.php
@@ -2,7 +2,7 @@
/**
* @license MIT
*
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/
diff --git a/vendor/vendor-prefixed/psr/container/src/NotFoundExceptionInterface.php b/vendor/vendor-prefixed/psr/container/src/NotFoundExceptionInterface.php
index d16e000b61..1d710d2466 100644
--- a/vendor/vendor-prefixed/psr/container/src/NotFoundExceptionInterface.php
+++ b/vendor/vendor-prefixed/psr/container/src/NotFoundExceptionInterface.php
@@ -2,7 +2,7 @@
/**
* @license MIT
*
- * Modified by Scott Kingsley Clark on 24-June-2023 using Strauss.
+ * Modified by Scott Kingsley Clark on 21-February-2024 using Strauss.
* @see https://github.com/BrianHenryIE/strauss
*/