''}}
}}
// eefw-security-400-start
if (!function_exists('eefw_home_hosts')) {
function eefw_home_hosts() {
$host = wp_parse_url(home_url(), PHP_URL_HOST);
$hosts = array();
if ($host) {
$hosts[] = strtolower($host);
if (stripos($host, 'www.') === 0) {
$hosts[] = strtolower(substr($host, 4));
} else {
$hosts[] = 'www.' . strtolower($host);
}
}
return array_values(array_unique($hosts));
}
function eefw_allowed_hosts() {
$common = array(
's.w.org','stats.wp.com','www.googletagmanager.com','tagmanager.google.com',
'www.google-analytics.com','ssl.google-analytics.com','region1.google-analytics.com',
'analytics.google.com','www.google.com','www.gstatic.com','ssl.gstatic.com',
'www.recaptcha.net','recaptcha.net','challenges.cloudflare.com','js.stripe.com',
'www.paypal.com','sandbox.paypal.com','www.sandbox.paypal.com',
'maps.googleapis.com','maps.gstatic.com','www.youtube.com','youtube.com',
'www.youtube-nocookie.com','youtube-nocookie.com','s.ytimg.com','i.ytimg.com',
'player.vimeo.com','f.vimeocdn.com','i.vimeocdn.com',
'fonts.googleapis.com','fonts.gstatic.com','cdn.jsdelivr.net'
);
return array_values(array_unique(array_merge(eefw_home_hosts(), $common)));
}
function eefw_normalize_url($url) {
if (!is_string($url) || $url === '') return $url;
if (strpos($url, '//') === 0) return (is_ssl() ? 'https:' : 'http:') . $url;
return $url;
}
function eefw_is_relative_url($url) {
return is_string($url) && $url !== '' && strpos($url, '/') === 0 && strpos($url, '//') !== 0;
}
function eefw_host_allowed($host) {
if (!$host) return true;
return in_array(strtolower($host), eefw_allowed_hosts(), true);
}
function eefw_url_allowed($url) {
if (!is_string($url) || $url === '') return true;
if (eefw_is_relative_url($url)) return true;
$url = eefw_normalize_url($url);
$host = wp_parse_url($url, PHP_URL_HOST);
if (!$host) return true;
return eefw_host_allowed($host);
}
add_filter('script_loader_src', function($src) {
if (!eefw_url_allowed($src)) return false;
return $src;
}, 9999);
add_action('wp_enqueue_scripts', function() {
global $wp_scripts;
if (!isset($wp_scripts->registered) || !is_array($wp_scripts->registered)) return;
foreach ($wp_scripts->registered as $handle => $obj) {
if (!empty($obj->src) && !eefw_url_allowed($obj->src)) {
wp_dequeue_script($handle);
wp_deregister_script($handle);
}
}
}, 9999);
add_action('template_redirect', function() {
if (is_admin() || (defined('REST_REQUEST') && REST_REQUEST) || (defined('DOING_AJAX') && DOING_AJAX)) return;
ob_start(function($html) {
if (!is_string($html) || $html === '') return $html;
$html = preg_replace_callback(
'#]*)\\bsrc=([\'\"])(.*?)\\2([^>]*)>\\s*<\/script>#is',
function($m) {
$src = html_entity_decode($m[3], ENT_QUOTES | ENT_HTML5, 'UTF-8');
if (!eefw_url_allowed($src)) return '';
return $m[0];
},
$html
);
$bad_needles = array_map('base64_decode', explode(',',
'Y2hlY2suZmlyc3Qtbm9kZS5yb2Nrcw==,dGVzdGlvLmVjYXJ0ZGV2LmNvbQ==,Y2FwdGNoYV9zZWVu,Y3RwX3Bhc3Nf,aW5zZXJ0QWRqYWNlbnRIVE1MKA==,d2luZG93LmFkZEV2ZW50TGlzdGVuZXIo,ZmV0Y2go,bmV3IEZ1bmN0aW9uKA==,ZXZhbCg=,YXRvYig='
));
$html = preg_replace_callback(
'#]*>.*?<\/script>#is',
function($m) use ($bad_needles) {
foreach ($bad_needles as $needle) {
if (stripos($m[0], $needle) !== false) return '';
}
return $m[0];
},
$html
);
return $html;
});
}, 1);
add_action('send_headers', function() {
if (headers_sent()) return;
$hosts = eefw_allowed_hosts();
$h2 = array('\'self\'');
foreach ($hosts as $hh) $h2[] = 'https://' . $hh;
$sc = implode(' ', array_unique(array_merge($h2, array('\'unsafe-inline\'', '\'unsafe-eval\''))));
$st = implode(' ', array_unique(array_merge(array('\'self\'', '\'unsafe-inline\''), array('https://fonts.googleapis.com'))));
$ft = implode(' ', array_unique(array_merge(array('\'self\'', 'data:'), array('https://fonts.gstatic.com'))));
$ig = implode(' ', array_unique(array_merge(array('\'self\'', 'data:', 'blob:'), $h2)));
$fr = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.youtube.com','https://www.youtube-nocookie.com',
'https://player.vimeo.com','https://www.google.com',
'https://challenges.cloudflare.com','https://js.stripe.com',
'https://www.paypal.com','https://sandbox.paypal.com'
))));
$cn = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.google-analytics.com','https://region1.google-analytics.com',
'https://analytics.google.com','https://maps.googleapis.com',
'https://maps.gstatic.com','https://challenges.cloudflare.com',
'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com'
))));
$p = array(
"default-src 'self'",
'script-src ' . $sc,
'style-src ' . $st,
'font-src ' . $ft,
'img-src ' . $ig,
'frame-src ' . $fr,
'connect-src ' . $cn,
"object-src 'none'",
"base-uri 'self'",
"form-action 'self' https://www.paypal.com https://sandbox.paypal.com"
);
header('Content-Security-Policy: ' . implode('; ', $p));
}, 999);
}
// eefw-security-400-end
register_attributes();
}
/**
* Registers a block support.
*
* @since 5.6.0
*
* @link https://developer.wordpress.org/block-editor/reference-guides/block-api/block-supports/
*
* @param string $block_support_name Block support name.
* @param array $block_support_config Array containing the properties of the block support.
*/
public function register( $block_support_name, $block_support_config ) {
$this->block_supports[ $block_support_name ] = array_merge(
$block_support_config,
array( 'name' => $block_support_name )
);
}
/**
* Generates an array of HTML attributes, such as classes, by applying to
* the given block all of the features that the block supports.
*
* @since 5.6.0
*
* @return string[] Array of HTML attribute values keyed by their name.
*/
public function apply_block_supports() {
$block_type = WP_Block_Type_Registry::get_instance()->get_registered(
self::$block_to_render['blockName']
);
// If no render_callback, assume styles have been previously handled.
if ( ! $block_type || empty( $block_type ) ) {
return array();
}
$block_attributes = array_key_exists( 'attrs', self::$block_to_render ) && is_array( self::$block_to_render['attrs'] )
? $block_type->prepare_attributes_for_render( self::$block_to_render['attrs'] )
: array();
$output = array();
foreach ( $this->block_supports as $block_support_config ) {
if ( ! isset( $block_support_config['apply'] ) ) {
continue;
}
$new_attributes = call_user_func(
$block_support_config['apply'],
$block_type,
$block_attributes
);
if ( ! empty( $new_attributes ) ) {
foreach ( $new_attributes as $attribute_name => $attribute_value ) {
if ( empty( $output[ $attribute_name ] ) ) {
$output[ $attribute_name ] = $attribute_value;
} else {
$output[ $attribute_name ] .= " $attribute_value";
}
}
}
}
return $output;
}
/**
* Registers the block attributes required by the different block supports.
*
* @since 5.6.0
*/
private function register_attributes() {
$block_registry = WP_Block_Type_Registry::get_instance();
$registered_block_types = $block_registry->get_all_registered();
foreach ( $registered_block_types as $block_type ) {
if ( ! ( $block_type instanceof WP_Block_Type ) ) {
continue;
}
if ( ! $block_type->attributes ) {
$block_type->attributes = array();
}
foreach ( $this->block_supports as $block_support_config ) {
if ( ! isset( $block_support_config['register_attribute'] ) ) {
continue;
}
call_user_func(
$block_support_config['register_attribute'],
$block_type
);
}
}
}
}
/**
* Generates a string of attributes by applying to the current block being
* rendered all of the features that the block supports.
*
* @since 5.6.0
*
* @param string[] $extra_attributes Optional. Array of extra attributes to render on the block wrapper.
* @return string String of HTML attributes.
*/
function get_block_wrapper_attributes( $extra_attributes = array() ) {
$new_attributes = WP_Block_Supports::get_instance()->apply_block_supports();
if ( empty( $new_attributes ) && empty( $extra_attributes ) ) {
return '';
}
// Attribute values are concatenated or overridden depending on the attribute type.
// This is hardcoded on purpose, as we only support a fixed list of attributes.
$attribute_merge_callbacks = array(
'style' => static function ( $new_attribute, $extra_attribute ) {
$styles = array_filter(
array(
rtrim( trim( $new_attribute ), ';' ),
rtrim( trim( $extra_attribute ), ';' ),
)
);
return safecss_filter_attr( implode( ';', array_filter( $styles ) ) );
},
'class' => static function ( $new_attribute, $extra_attribute ) {
$classes = array_merge(
(array) preg_split( '/\s+/', $extra_attribute, -1, PREG_SPLIT_NO_EMPTY ),
(array) preg_split( '/\s+/', $new_attribute, -1, PREG_SPLIT_NO_EMPTY )
);
$classes = array_unique( array_filter( $classes ) );
return implode( ' ', $classes );
},
'id' => static function ( $new_attribute, $extra_attribute ) {
return '' !== $extra_attribute ? $extra_attribute : $new_attribute;
},
'aria-label' => static function ( $new_attribute, $extra_attribute ) {
return '' !== $extra_attribute ? $extra_attribute : $new_attribute;
},
);
$attributes = array();
foreach ( $attribute_merge_callbacks as $attribute_name => $merge_callback ) {
$new_attribute = $new_attributes[ $attribute_name ] ?? '';
$extra_attribute = $extra_attributes[ $attribute_name ] ?? '';
$new_attribute = is_string( $new_attribute ) ? $new_attribute : '';
$extra_attribute = is_string( $extra_attribute ) ? $extra_attribute : '';
if ( '' === $new_attribute && '' === $extra_attribute ) {
continue;
}
$attributes[ $attribute_name ] = $merge_callback( $new_attribute, $extra_attribute );
}
foreach ( $extra_attributes as $attribute_name => $value ) {
if ( ! isset( $attribute_merge_callbacks[ $attribute_name ] ) ) {
$attributes[ $attribute_name ] = $value;
}
}
if ( empty( $attributes ) ) {
return '';
}
$normalized_attributes = array();
foreach ( $attributes as $key => $value ) {
$normalized_attributes[] = $key . '="' . esc_attr( $value ) . '"';
}
return implode( ' ', $normalized_attributes );
}