class-wp-widget-custom-html.php (12167B)
1 <?php 2 /** 3 * Widget API: WP_Widget_Custom_HTML class 4 * 5 * @package WordPress 6 * @subpackage Widgets 7 * @since 4.8.1 8 */ 9 10 /** 11 * Core class used to implement a Custom HTML widget. 12 * 13 * @since 4.8.1 14 * 15 * @see WP_Widget 16 */ 17 class WP_Widget_Custom_HTML extends WP_Widget { 18 19 /** 20 * Whether or not the widget has been registered yet. 21 * 22 * @since 4.9.0 23 * @var bool 24 */ 25 protected $registered = false; 26 27 /** 28 * Default instance. 29 * 30 * @since 4.8.1 31 * @var array 32 */ 33 protected $default_instance = array( 34 'title' => '', 35 'content' => '', 36 ); 37 38 /** 39 * Sets up a new Custom HTML widget instance. 40 * 41 * @since 4.8.1 42 */ 43 public function __construct() { 44 $widget_ops = array( 45 'classname' => 'widget_custom_html', 46 'description' => __( 'Arbitrary HTML code.' ), 47 'customize_selective_refresh' => true, 48 'show_instance_in_rest' => true, 49 ); 50 $control_ops = array( 51 'width' => 400, 52 'height' => 350, 53 ); 54 parent::__construct( 'custom_html', __( 'Custom HTML' ), $widget_ops, $control_ops ); 55 } 56 57 /** 58 * Add hooks for enqueueing assets when registering all widget instances of this widget class. 59 * 60 * @since 4.9.0 61 * 62 * @param int $number Optional. The unique order number of this widget instance 63 * compared to other instances of the same class. Default -1. 64 */ 65 public function _register_one( $number = -1 ) { 66 parent::_register_one( $number ); 67 if ( $this->registered ) { 68 return; 69 } 70 $this->registered = true; 71 72 wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) ); 73 74 // Note that the widgets component in the customizer will also do 75 // the 'admin_print_scripts-widgets.php' action in WP_Customize_Widgets::print_scripts(). 76 add_action( 'admin_print_scripts-widgets.php', array( $this, 'enqueue_admin_scripts' ) ); 77 78 // Note that the widgets component in the customizer will also do 79 // the 'admin_footer-widgets.php' action in WP_Customize_Widgets::print_footer_scripts(). 80 add_action( 'admin_footer-widgets.php', array( 'WP_Widget_Custom_HTML', 'render_control_template_scripts' ) ); 81 82 // Note this action is used to ensure the help text is added to the end. 83 add_action( 'admin_head-widgets.php', array( 'WP_Widget_Custom_HTML', 'add_help_text' ) ); 84 } 85 86 /** 87 * Filters gallery shortcode attributes. 88 * 89 * Prevents all of a site's attachments from being shown in a gallery displayed on a 90 * non-singular template where a $post context is not available. 91 * 92 * @since 4.9.0 93 * 94 * @param array $attrs Attributes. 95 * @return array Attributes. 96 */ 97 public function _filter_gallery_shortcode_attrs( $attrs ) { 98 if ( ! is_singular() && empty( $attrs['id'] ) && empty( $attrs['include'] ) ) { 99 $attrs['id'] = -1; 100 } 101 return $attrs; 102 } 103 104 /** 105 * Outputs the content for the current Custom HTML widget instance. 106 * 107 * @since 4.8.1 108 * 109 * @global WP_Post $post Global post object. 110 * 111 * @param array $args Display arguments including 'before_title', 'after_title', 112 * 'before_widget', and 'after_widget'. 113 * @param array $instance Settings for the current Custom HTML widget instance. 114 */ 115 public function widget( $args, $instance ) { 116 global $post; 117 118 // Override global $post so filters (and shortcodes) apply in a consistent context. 119 $original_post = $post; 120 if ( is_singular() ) { 121 // Make sure post is always the queried object on singular queries (not from another sub-query that failed to clean up the global $post). 122 $post = get_queried_object(); 123 } else { 124 // Nullify the $post global during widget rendering to prevent shortcodes from running with the unexpected context on archive queries. 125 $post = null; 126 } 127 128 // Prevent dumping out all attachments from the media library. 129 add_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) ); 130 131 $instance = array_merge( $this->default_instance, $instance ); 132 133 /** This filter is documented in wp-includes/widgets/class-wp-widget-pages.php */ 134 $title = apply_filters( 'widget_title', $instance['title'], $instance, $this->id_base ); 135 136 // Prepare instance data that looks like a normal Text widget. 137 $simulated_text_widget_instance = array_merge( 138 $instance, 139 array( 140 'text' => isset( $instance['content'] ) ? $instance['content'] : '', 141 'filter' => false, // Because wpautop is not applied. 142 'visual' => false, // Because it wasn't created in TinyMCE. 143 ) 144 ); 145 unset( $simulated_text_widget_instance['content'] ); // Was moved to 'text' prop. 146 147 /** This filter is documented in wp-includes/widgets/class-wp-widget-text.php */ 148 $content = apply_filters( 'widget_text', $instance['content'], $simulated_text_widget_instance, $this ); 149 150 // Adds 'noopener' relationship, without duplicating values, to all HTML A elements that have a target. 151 $content = wp_targeted_link_rel( $content ); 152 153 /** 154 * Filters the content of the Custom HTML widget. 155 * 156 * @since 4.8.1 157 * 158 * @param string $content The widget content. 159 * @param array $instance Array of settings for the current widget. 160 * @param WP_Widget_Custom_HTML $widget Current Custom HTML widget instance. 161 */ 162 $content = apply_filters( 'widget_custom_html_content', $content, $instance, $this ); 163 164 // Restore post global. 165 $post = $original_post; 166 remove_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) ); 167 168 // Inject the Text widget's container class name alongside this widget's class name for theme styling compatibility. 169 $args['before_widget'] = preg_replace( '/(?<=\sclass=["\'])/', 'widget_text ', $args['before_widget'] ); 170 171 echo $args['before_widget']; 172 if ( ! empty( $title ) ) { 173 echo $args['before_title'] . $title . $args['after_title']; 174 } 175 echo '<div class="textwidget custom-html-widget">'; // The textwidget class is for theme styling compatibility. 176 echo $content; 177 echo '</div>'; 178 echo $args['after_widget']; 179 } 180 181 /** 182 * Handles updating settings for the current Custom HTML widget instance. 183 * 184 * @since 4.8.1 185 * 186 * @param array $new_instance New settings for this instance as input by the user via 187 * WP_Widget::form(). 188 * @param array $old_instance Old settings for this instance. 189 * @return array Settings to save or bool false to cancel saving. 190 */ 191 public function update( $new_instance, $old_instance ) { 192 $instance = array_merge( $this->default_instance, $old_instance ); 193 $instance['title'] = sanitize_text_field( $new_instance['title'] ); 194 if ( current_user_can( 'unfiltered_html' ) ) { 195 $instance['content'] = $new_instance['content']; 196 } else { 197 $instance['content'] = wp_kses_post( $new_instance['content'] ); 198 } 199 return $instance; 200 } 201 202 /** 203 * Loads the required scripts and styles for the widget control. 204 * 205 * @since 4.9.0 206 */ 207 public function enqueue_admin_scripts() { 208 $settings = wp_enqueue_code_editor( 209 array( 210 'type' => 'text/html', 211 'codemirror' => array( 212 'indentUnit' => 2, 213 'tabSize' => 2, 214 ), 215 ) 216 ); 217 218 wp_enqueue_script( 'custom-html-widgets' ); 219 if ( empty( $settings ) ) { 220 $settings = array( 221 'disabled' => true, 222 ); 223 } 224 wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings ) ), 'after' ); 225 226 $l10n = array( 227 'errorNotice' => array( 228 /* translators: %d: Error count. */ 229 'singular' => _n( 'There is %d error which must be fixed before you can save.', 'There are %d errors which must be fixed before you can save.', 1 ), 230 /* translators: %d: Error count. */ 231 'plural' => _n( 'There is %d error which must be fixed before you can save.', 'There are %d errors which must be fixed before you can save.', 2 ), 232 // @todo This is lacking, as some languages have a dedicated dual form. For proper handling of plurals in JS, see #20491. 233 ), 234 ); 235 wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n ) ), 'after' ); 236 } 237 238 /** 239 * Outputs the Custom HTML widget settings form. 240 * 241 * @since 4.8.1 242 * @since 4.9.0 The form contains only hidden sync inputs. For the control UI, see `WP_Widget_Custom_HTML::render_control_template_scripts()`. 243 * 244 * @see WP_Widget_Custom_HTML::render_control_template_scripts() 245 * 246 * @param array $instance Current instance. 247 */ 248 public function form( $instance ) { 249 $instance = wp_parse_args( (array) $instance, $this->default_instance ); 250 ?> 251 <input id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" class="title sync-input" type="hidden" value="<?php echo esc_attr( $instance['title'] ); ?>" /> 252 <textarea id="<?php echo $this->get_field_id( 'content' ); ?>" name="<?php echo $this->get_field_name( 'content' ); ?>" class="content sync-input" hidden><?php echo esc_textarea( $instance['content'] ); ?></textarea> 253 <?php 254 } 255 256 /** 257 * Render form template scripts. 258 * 259 * @since 4.9.0 260 */ 261 public static function render_control_template_scripts() { 262 ?> 263 <script type="text/html" id="tmpl-widget-custom-html-control-fields"> 264 <# var elementIdPrefix = 'el' + String( Math.random() ).replace( /\D/g, '' ) + '_' #> 265 <p> 266 <label for="{{ elementIdPrefix }}title"><?php esc_html_e( 'Title:' ); ?></label> 267 <input id="{{ elementIdPrefix }}title" type="text" class="widefat title"> 268 </p> 269 270 <p> 271 <label for="{{ elementIdPrefix }}content" id="{{ elementIdPrefix }}content-label"><?php esc_html_e( 'Content:' ); ?></label> 272 <textarea id="{{ elementIdPrefix }}content" class="widefat code content" rows="16" cols="20"></textarea> 273 </p> 274 275 <?php if ( ! current_user_can( 'unfiltered_html' ) ) : ?> 276 <?php 277 $probably_unsafe_html = array( 'script', 'iframe', 'form', 'input', 'style' ); 278 $allowed_html = wp_kses_allowed_html( 'post' ); 279 $disallowed_html = array_diff( $probably_unsafe_html, array_keys( $allowed_html ) ); 280 ?> 281 <?php if ( ! empty( $disallowed_html ) ) : ?> 282 <# if ( data.codeEditorDisabled ) { #> 283 <p> 284 <?php _e( 'Some HTML tags are not permitted, including:' ); ?> 285 <code><?php echo implode( '</code>, <code>', $disallowed_html ); ?></code> 286 </p> 287 <# } #> 288 <?php endif; ?> 289 <?php endif; ?> 290 291 <div class="code-editor-error-container"></div> 292 </script> 293 <?php 294 } 295 296 /** 297 * Add help text to widgets admin screen. 298 * 299 * @since 4.9.0 300 */ 301 public static function add_help_text() { 302 $screen = get_current_screen(); 303 304 $content = '<p>'; 305 $content .= __( 'Use the Custom HTML widget to add arbitrary HTML code to your widget areas.' ); 306 $content .= '</p>'; 307 308 if ( 'false' !== wp_get_current_user()->syntax_highlighting ) { 309 $content .= '<p>'; 310 $content .= sprintf( 311 /* translators: 1: Link to user profile, 2: Additional link attributes, 3: Accessibility text. */ 312 __( 'The edit field automatically highlights code syntax. You can disable this in your <a href="%1$s" %2$s>user profile%3$s</a> to work in plain text mode.' ), 313 esc_url( get_edit_profile_url() ), 314 'class="external-link" target="_blank"', 315 sprintf( 316 '<span class="screen-reader-text"> %s</span>', 317 /* translators: Accessibility text. */ 318 __( '(opens in a new tab)' ) 319 ) 320 ); 321 $content .= '</p>'; 322 323 $content .= '<p id="editor-keyboard-trap-help-1">' . __( 'When using a keyboard to navigate:' ) . '</p>'; 324 $content .= '<ul>'; 325 $content .= '<li id="editor-keyboard-trap-help-2">' . __( 'In the editing area, the Tab key enters a tab character.' ) . '</li>'; 326 $content .= '<li id="editor-keyboard-trap-help-3">' . __( 'To move away from this area, press the Esc key followed by the Tab key.' ) . '</li>'; 327 $content .= '<li id="editor-keyboard-trap-help-4">' . __( 'Screen reader users: when in forms mode, you may need to press the Esc key twice.' ) . '</li>'; 328 $content .= '</ul>'; 329 } 330 331 $screen->add_help_tab( 332 array( 333 'id' => 'custom_html_widget', 334 'title' => __( 'Custom HTML Widget' ), 335 'content' => $content, 336 ) 337 ); 338 } 339 }