Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Global Styles: Fix block spacing values being stripped for users without unfiltered_html capability #3742

Closed
wants to merge 12 commits into from
Closed

Global Styles: Fix block spacing values being stripped for users without unfiltered_html capability #3742

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
b0f4e16
Global Styles: Fix block spacing values being stripped for uses witho…
andrewserong Dec 13, 2022
95b1159
Update tests/phpunit/tests/theme/wpThemeJson.php
andrewserong Dec 13, 2022
b874edb
Update tests/phpunit/tests/theme/wpThemeJson.php
andrewserong Dec 13, 2022
76663b2
Remove accidental inclusion of kses_init_filters
andrewserong Dec 13, 2022
1df41be
Small tweaks based on feedback
andrewserong Dec 13, 2022
b7f4a5d
Add support for contentSize and wideSize settings values
andrewserong Jan 3, 2023
002720b
Update doc comment to reflect that the value is now an array of arrays
andrewserong Jan 3, 2023
d694183
Fix indent linting issue
andrewserong Jan 3, 2023
352cb94
Update isset check for null to reflect earlier feedback
andrewserong Jan 3, 2023
60efc3d
Update code comment
andrewserong Jan 9, 2023
c05ca99
Encapsulate and simplify redundant code
hellofromtonya Jan 23, 2023
69d2ab0
Merge branch 'trunk' into fix/global-spacing-stripped-block-spacing-v…
peterwilsoncc Feb 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions src/wp-includes/class-wp-theme-json.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,35 @@ class WP_Theme_JSON {
'box-shadow' => array( 'shadow' ),
);

/**
* Indirect metadata for style properties that are not directly output.
*
* Each element maps from a CSS property name to an array of
* paths to the value in theme.json & block attributes.
*
* Indirect properties are not output directly by `compute_style_properties`,
* but are used elsewhere in the processing of global styles. The indirect
* property is used to validate whether or not a style value is allowed.
*
* @since 6.1.2
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peterwilsoncc is this planned for 6.1.2? Or is this for 6.2?

* @var array
*/
const INDIRECT_PROPERTIES_METADATA = array(
'gap' => array(
array( 'spacing', 'blockGap' ),
),
'column-gap' => array(
array( 'spacing', 'blockGap', 'left' ),
),
'row-gap' => array(
array( 'spacing', 'blockGap', 'top' ),
),
'max-width' => array(
array( 'layout', 'contentSize' ),
array( 'layout', 'wideSize' ),
),
);

/**
* Protected style properties.
*
Expand Down Expand Up @@ -2736,6 +2765,20 @@ protected static function remove_insecure_settings( $input ) {
}
}
}

// Ensure indirect properties not included in any `PRESETS_METADATA` value are allowed.
foreach ( static::INDIRECT_PROPERTIES_METADATA as $property => $paths ) {
foreach ( $paths as $path ) {
$value = _wp_array_get( $input, $path, array() );
hellofromtonya marked this conversation as resolved.
Show resolved Hide resolved
if (
null !== $value &&
! is_array( $value ) &&
hellofromtonya marked this conversation as resolved.
Show resolved Hide resolved
static::is_safe_css_declaration( $property, $value )
) {
_wp_array_set( $output, $path, $value );
}
}
}
return $output;
}

Expand Down Expand Up @@ -2764,6 +2807,21 @@ protected static function remove_insecure_styles( $input ) {
}
}
}

// Ensure indirect properties not handled by `compute_style_properties` are allowed.
foreach ( static::INDIRECT_PROPERTIES_METADATA as $property => $paths ) {
foreach ( $paths as $path ) {
$value = _wp_array_get( $input, $path, array() );
if (
null !== $value &&
! is_array( $value ) &&
static::is_safe_css_declaration( $property, $value )
) {
_wp_array_set( $output, $path, $value );
}
}
}
hellofromtonya marked this conversation as resolved.
Show resolved Hide resolved

return $output;
}

Expand Down
61 changes: 61 additions & 0 deletions tests/phpunit/tests/theme/wpThemeJson.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2384,6 +2384,67 @@ public function test_remove_insecure_properties_applies_safe_styles() {
$this->assertEqualSetsWithIndex( $expected, $actual );
}

/**
* @ticket 57321
andrewserong marked this conversation as resolved.
Show resolved Hide resolved
*
* @covers WP_Theme_JSON::remove_insecure_properties
peterwilsoncc marked this conversation as resolved.
Show resolved Hide resolved
*/
public function test_remove_insecure_properties_should_allow_indirect_properties() {
$actual = WP_Theme_JSON::remove_insecure_properties(
array(
'version' => WP_Theme_JSON::LATEST_SCHEMA,
'styles' => array(
'spacing' => array(
'blockGap' => '3em',
),
'blocks' => array(
'core/social-links' => array(
'spacing' => array(
'blockGap' => array(
'left' => '2em',
'top' => '1em',
),
),
),
),
),
'settings' => array(
'layout' => array(
'contentSize' => '800px',
'wideSize' => '1000px',
),
),
)
);

$expected = array(
'version' => WP_Theme_JSON::LATEST_SCHEMA,
'styles' => array(
'spacing' => array(
'blockGap' => '3em',
),
'blocks' => array(
'core/social-links' => array(
'spacing' => array(
'blockGap' => array(
'left' => '2em',
'top' => '1em',
),
),
),
),
),
'settings' => array(
'layout' => array(
'contentSize' => '800px',
'wideSize' => '1000px',
),
),
);

$this->assertSameSetsWithIndex( $expected, $actual );
}

/**
* @ticket 56467
*/
Expand Down