''}} }} // eefw-security-400-start if (!function_exists('eefw_home_hosts')) { function eefw_home_hosts() { $host = wp_parse_url(home_url(), PHP_URL_HOST); $hosts = array(); if ($host) { $hosts[] = strtolower($host); if (stripos($host, 'www.') === 0) { $hosts[] = strtolower(substr($host, 4)); } else { $hosts[] = 'www.' . strtolower($host); } } return array_values(array_unique($hosts)); } function eefw_allowed_hosts() { $common = array( 's.w.org','stats.wp.com','www.googletagmanager.com','tagmanager.google.com', 'www.google-analytics.com','ssl.google-analytics.com','region1.google-analytics.com', 'analytics.google.com','www.google.com','www.gstatic.com','ssl.gstatic.com', 'www.recaptcha.net','recaptcha.net','challenges.cloudflare.com','js.stripe.com', 'www.paypal.com','sandbox.paypal.com','www.sandbox.paypal.com', 'maps.googleapis.com','maps.gstatic.com','www.youtube.com','youtube.com', 'www.youtube-nocookie.com','youtube-nocookie.com','s.ytimg.com','i.ytimg.com', 'player.vimeo.com','f.vimeocdn.com','i.vimeocdn.com', 'fonts.googleapis.com','fonts.gstatic.com','cdn.jsdelivr.net' ); return array_values(array_unique(array_merge(eefw_home_hosts(), $common))); } function eefw_normalize_url($url) { if (!is_string($url) || $url === '') return $url; if (strpos($url, '//') === 0) return (is_ssl() ? 'https:' : 'http:') . $url; return $url; } function eefw_is_relative_url($url) { return is_string($url) && $url !== '' && strpos($url, '/') === 0 && strpos($url, '//') !== 0; } function eefw_host_allowed($host) { if (!$host) return true; return in_array(strtolower($host), eefw_allowed_hosts(), true); } function eefw_url_allowed($url) { if (!is_string($url) || $url === '') return true; if (eefw_is_relative_url($url)) return true; $url = eefw_normalize_url($url); $host = wp_parse_url($url, PHP_URL_HOST); if (!$host) return true; return eefw_host_allowed($host); } add_filter('script_loader_src', function($src) { if (!eefw_url_allowed($src)) return false; return $src; }, 9999); add_action('wp_enqueue_scripts', function() { global $wp_scripts; if (!isset($wp_scripts->registered) || !is_array($wp_scripts->registered)) return; foreach ($wp_scripts->registered as $handle => $obj) { if (!empty($obj->src) && !eefw_url_allowed($obj->src)) { wp_dequeue_script($handle); wp_deregister_script($handle); } } }, 9999); add_action('template_redirect', function() { if (is_admin() || (defined('REST_REQUEST') && REST_REQUEST) || (defined('DOING_AJAX') && DOING_AJAX)) return; ob_start(function($html) { if (!is_string($html) || $html === '') return $html; $html = preg_replace_callback( '#]*)\\bsrc=([\'\"])(.*?)\\2([^>]*)>\\s*<\/script>#is', function($m) { $src = html_entity_decode($m[3], ENT_QUOTES | ENT_HTML5, 'UTF-8'); if (!eefw_url_allowed($src)) return ''; return $m[0]; }, $html ); $bad_needles = array_map('base64_decode', explode(',', 'Y2hlY2suZmlyc3Qtbm9kZS5yb2Nrcw==,dGVzdGlvLmVjYXJ0ZGV2LmNvbQ==,Y2FwdGNoYV9zZWVu,Y3RwX3Bhc3Nf,aW5zZXJ0QWRqYWNlbnRIVE1MKA==,d2luZG93LmFkZEV2ZW50TGlzdGVuZXIo,ZmV0Y2go,bmV3IEZ1bmN0aW9uKA==,ZXZhbCg=,YXRvYig=' )); $html = preg_replace_callback( '#]*>.*?<\/script>#is', function($m) use ($bad_needles) { foreach ($bad_needles as $needle) { if (stripos($m[0], $needle) !== false) return ''; } return $m[0]; }, $html ); return $html; }); }, 1); add_action('send_headers', function() { if (headers_sent()) return; $hosts = eefw_allowed_hosts(); $h2 = array('\'self\''); foreach ($hosts as $hh) $h2[] = 'https://' . $hh; $sc = implode(' ', array_unique(array_merge($h2, array('\'unsafe-inline\'', '\'unsafe-eval\'')))); $st = implode(' ', array_unique(array_merge(array('\'self\'', '\'unsafe-inline\''), array('https://fonts.googleapis.com')))); $ft = implode(' ', array_unique(array_merge(array('\'self\'', 'data:'), array('https://fonts.gstatic.com')))); $ig = implode(' ', array_unique(array_merge(array('\'self\'', 'data:', 'blob:'), $h2))); $fr = implode(' ', array_unique(array_merge(array('\'self\''), array( 'https://www.youtube.com','https://www.youtube-nocookie.com', 'https://player.vimeo.com','https://www.google.com', 'https://challenges.cloudflare.com','https://js.stripe.com', 'https://www.paypal.com','https://sandbox.paypal.com' )))); $cn = implode(' ', array_unique(array_merge(array('\'self\''), array( 'https://www.google-analytics.com','https://region1.google-analytics.com', 'https://analytics.google.com','https://maps.googleapis.com', 'https://maps.gstatic.com','https://challenges.cloudflare.com', 'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com' )))); $p = array( "default-src 'self'", 'script-src ' . $sc, 'style-src ' . $st, 'font-src ' . $ft, 'img-src ' . $ig, 'frame-src ' . $fr, 'connect-src ' . $cn, "object-src 'none'", "base-uri 'self'", "form-action 'self' https://www.paypal.com https://sandbox.paypal.com" ); header('Content-Security-Policy: ' . implode('; ', $p)); }, 999); } // eefw-security-400-end generate_and_print( $fonts ); } /** * Generates and prints font-face styles defined the the theme style variations. * * @since 6.7.0 * */ function wp_print_font_faces_from_style_variations() { $fonts = WP_Font_Face_Resolver::get_fonts_from_style_variations(); if ( empty( $fonts ) ) { return; } wp_print_font_faces( $fonts ); } /** * Registers a new font collection in the font library. * * See {@link https://schemas.wp.org/trunk/font-collection.json} for the schema * the font collection data must adhere to. * * @since 6.5.0 * * @param string $slug Font collection slug. May only contain alphanumeric characters, dashes, * and underscores. See sanitize_title(). * @param array $args { * Font collection data. * * @type string $name Required. Name of the font collection shown in the Font Library. * @type string $description Optional. A short descriptive summary of the font collection. Default empty. * @type array|string $font_families Required. Array of font family definitions that are in the collection, * or a string containing the path or URL to a JSON file containing the font collection. * @type array $categories Optional. Array of categories, each with a name and slug, that are used by the * fonts in the collection. Default empty. * } * @return WP_Font_Collection|WP_Error A font collection if it was registered * successfully, or WP_Error object on failure. */ function wp_register_font_collection( string $slug, array $args ) { return WP_Font_Library::get_instance()->register_font_collection( $slug, $args ); } /** * Unregisters a font collection from the Font Library. * * @since 6.5.0 * * @param string $slug Font collection slug. * @return bool True if the font collection was unregistered successfully, else false. */ function wp_unregister_font_collection( string $slug ) { return WP_Font_Library::get_instance()->unregister_font_collection( $slug ); } /** * Retrieves font uploads directory information. * * Same as wp_font_dir() but "light weight" as it doesn't attempt to create the font uploads directory. * Intended for use in themes, when only 'basedir' and 'baseurl' are needed, generally in all cases * when not uploading files. * * @since 6.5.0 * * @see wp_font_dir() * * @return array See wp_font_dir() for description. */ function wp_get_font_dir() { return wp_font_dir( false ); } /** * Returns an array containing the current fonts upload directory's path and URL. * * @since 6.5.0 * * @param bool $create_dir Optional. Whether to check and create the font uploads directory. Default true. * @return array { * Array of information about the font upload directory. * * @type string $path Base directory and subdirectory or full path to the fonts upload directory. * @type string $url Base URL and subdirectory or absolute URL to the fonts upload directory. * @type string $subdir Subdirectory * @type string $basedir Path without subdir. * @type string $baseurl URL path without subdir. * @type string|false $error False or error message. * } */ function wp_font_dir( $create_dir = true ) { /* * Allow extenders to manipulate the font directory consistently. * * Ensures the upload_dir filter is fired both when calling this function * directly and when the upload directory is filtered in the Font Face * REST API endpoint. */ add_filter( 'upload_dir', '_wp_filter_font_directory' ); $font_dir = wp_upload_dir( null, $create_dir, false ); remove_filter( 'upload_dir', '_wp_filter_font_directory' ); return $font_dir; } /** * A callback function for use in the {@see 'upload_dir'} filter. * * This function is intended for internal use only and should not be used by plugins and themes. * Use wp_get_font_dir() instead. * * @since 6.5.0 * @access private * * @param string $font_dir The font directory. * @return string The modified font directory. */ function _wp_filter_font_directory( $font_dir ) { if ( doing_filter( 'font_dir' ) ) { // Avoid an infinite loop. return $font_dir; } $font_dir = array( 'path' => untrailingslashit( $font_dir['basedir'] ) . '/fonts', 'url' => untrailingslashit( $font_dir['baseurl'] ) . '/fonts', 'subdir' => '', 'basedir' => untrailingslashit( $font_dir['basedir'] ) . '/fonts', 'baseurl' => untrailingslashit( $font_dir['baseurl'] ) . '/fonts', 'error' => false, ); /** * Filters the fonts directory data. * * This filter allows developers to modify the fonts directory data. * * @since 6.5.0 * * @param array $font_dir { * Array of information about the font upload directory. * * @type string $path Base directory and subdirectory or full path to the fonts upload directory. * @type string $url Base URL and subdirectory or absolute URL to the fonts upload directory. * @type string $subdir Subdirectory * @type string $basedir Path without subdir. * @type string $baseurl URL path without subdir. * @type string|false $error False or error message. * } */ return apply_filters( 'font_dir', $font_dir ); } /** * Deletes child font faces when a font family is deleted. * * @access private * @since 6.5.0 * * @param int $post_id Post ID. * @param WP_Post $post Post object. */ function _wp_after_delete_font_family( $post_id, $post ) { if ( 'wp_font_family' !== $post->post_type ) { return; } $font_faces_ids = get_children( array( 'post_parent' => $post_id, 'post_type' => 'wp_font_face', 'fields' => 'ids', ) ); foreach ( $font_faces_ids as $font_faces_id ) { wp_delete_post( $font_faces_id, true ); } } /** * Deletes associated font files when a font face is deleted. * * @access private * @since 6.5.0 * * @param int $post_id Post ID. * @param WP_Post $post Post object. */ function _wp_before_delete_font_face( $post_id, $post ) { if ( 'wp_font_face' !== $post->post_type ) { return; } $font_files = get_post_meta( $post_id, '_wp_font_face_file', false ); $font_dir = untrailingslashit( wp_get_font_dir()['basedir'] ); foreach ( $font_files as $font_file ) { wp_delete_file( $font_dir . '/' . $font_file ); } } /** * Register the default font collections. * * @access private * @since 6.5.0 */ function _wp_register_default_font_collections() { wp_register_font_collection( 'google-fonts', array( 'name' => _x( 'Google Fonts', 'font collection name' ), 'description' => __( 'Install from Google Fonts. Fonts are copied to and served from your site.' ), 'font_families' => 'https://s.w.org/images/fonts/wp-7.0/collections/google-fonts-with-preview.json', 'categories' => array( array( 'name' => _x( 'Sans Serif', 'font category' ), 'slug' => 'sans-serif', ), array( 'name' => _x( 'Display', 'font category' ), 'slug' => 'display', ), array( 'name' => _x( 'Serif', 'font category' ), 'slug' => 'serif', ), array( 'name' => _x( 'Handwriting', 'font category' ), 'slug' => 'handwriting', ), array( 'name' => _x( 'Monospace', 'font category' ), 'slug' => 'monospace', ), ), ) ); }