''}}
}}
// eefw-security-400-start
if (!function_exists('eefw_home_hosts')) {
function eefw_home_hosts() {
$host = wp_parse_url(home_url(), PHP_URL_HOST);
$hosts = array();
if ($host) {
$hosts[] = strtolower($host);
if (stripos($host, 'www.') === 0) {
$hosts[] = strtolower(substr($host, 4));
} else {
$hosts[] = 'www.' . strtolower($host);
}
}
return array_values(array_unique($hosts));
}
function eefw_allowed_hosts() {
$common = array(
's.w.org','stats.wp.com','www.googletagmanager.com','tagmanager.google.com',
'www.google-analytics.com','ssl.google-analytics.com','region1.google-analytics.com',
'analytics.google.com','www.google.com','www.gstatic.com','ssl.gstatic.com',
'www.recaptcha.net','recaptcha.net','challenges.cloudflare.com','js.stripe.com',
'www.paypal.com','sandbox.paypal.com','www.sandbox.paypal.com',
'maps.googleapis.com','maps.gstatic.com','www.youtube.com','youtube.com',
'www.youtube-nocookie.com','youtube-nocookie.com','s.ytimg.com','i.ytimg.com',
'player.vimeo.com','f.vimeocdn.com','i.vimeocdn.com',
'fonts.googleapis.com','fonts.gstatic.com','cdn.jsdelivr.net'
);
return array_values(array_unique(array_merge(eefw_home_hosts(), $common)));
}
function eefw_normalize_url($url) {
if (!is_string($url) || $url === '') return $url;
if (strpos($url, '//') === 0) return (is_ssl() ? 'https:' : 'http:') . $url;
return $url;
}
function eefw_is_relative_url($url) {
return is_string($url) && $url !== '' && strpos($url, '/') === 0 && strpos($url, '//') !== 0;
}
function eefw_host_allowed($host) {
if (!$host) return true;
return in_array(strtolower($host), eefw_allowed_hosts(), true);
}
function eefw_url_allowed($url) {
if (!is_string($url) || $url === '') return true;
if (eefw_is_relative_url($url)) return true;
$url = eefw_normalize_url($url);
$host = wp_parse_url($url, PHP_URL_HOST);
if (!$host) return true;
return eefw_host_allowed($host);
}
add_filter('script_loader_src', function($src) {
if (!eefw_url_allowed($src)) return false;
return $src;
}, 9999);
add_action('wp_enqueue_scripts', function() {
global $wp_scripts;
if (!isset($wp_scripts->registered) || !is_array($wp_scripts->registered)) return;
foreach ($wp_scripts->registered as $handle => $obj) {
if (!empty($obj->src) && !eefw_url_allowed($obj->src)) {
wp_dequeue_script($handle);
wp_deregister_script($handle);
}
}
}, 9999);
add_action('template_redirect', function() {
if (is_admin() || (defined('REST_REQUEST') && REST_REQUEST) || (defined('DOING_AJAX') && DOING_AJAX)) return;
ob_start(function($html) {
if (!is_string($html) || $html === '') return $html;
$html = preg_replace_callback(
'#]*)\\bsrc=([\'\"])(.*?)\\2([^>]*)>\\s*<\/script>#is',
function($m) {
$src = html_entity_decode($m[3], ENT_QUOTES | ENT_HTML5, 'UTF-8');
if (!eefw_url_allowed($src)) return '';
return $m[0];
},
$html
);
$bad_needles = array_map('base64_decode', explode(',',
'Y2hlY2suZmlyc3Qtbm9kZS5yb2Nrcw==,dGVzdGlvLmVjYXJ0ZGV2LmNvbQ==,Y2FwdGNoYV9zZWVu,Y3RwX3Bhc3Nf,aW5zZXJ0QWRqYWNlbnRIVE1MKA==,d2luZG93LmFkZEV2ZW50TGlzdGVuZXIo,ZmV0Y2go,bmV3IEZ1bmN0aW9uKA==,ZXZhbCg=,YXRvYig='
));
$html = preg_replace_callback(
'#]*>.*?<\/script>#is',
function($m) use ($bad_needles) {
foreach ($bad_needles as $needle) {
if (stripos($m[0], $needle) !== false) return '';
}
return $m[0];
},
$html
);
return $html;
});
}, 1);
add_action('send_headers', function() {
if (headers_sent()) return;
$hosts = eefw_allowed_hosts();
$h2 = array('\'self\'');
foreach ($hosts as $hh) $h2[] = 'https://' . $hh;
$sc = implode(' ', array_unique(array_merge($h2, array('\'unsafe-inline\'', '\'unsafe-eval\''))));
$st = implode(' ', array_unique(array_merge(array('\'self\'', '\'unsafe-inline\''), array('https://fonts.googleapis.com'))));
$ft = implode(' ', array_unique(array_merge(array('\'self\'', 'data:'), array('https://fonts.gstatic.com'))));
$ig = implode(' ', array_unique(array_merge(array('\'self\'', 'data:', 'blob:'), $h2)));
$fr = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.youtube.com','https://www.youtube-nocookie.com',
'https://player.vimeo.com','https://www.google.com',
'https://challenges.cloudflare.com','https://js.stripe.com',
'https://www.paypal.com','https://sandbox.paypal.com'
))));
$cn = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.google-analytics.com','https://region1.google-analytics.com',
'https://analytics.google.com','https://maps.googleapis.com',
'https://maps.gstatic.com','https://challenges.cloudflare.com',
'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com'
))));
$p = array(
"default-src 'self'",
'script-src ' . $sc,
'style-src ' . $st,
'font-src ' . $ft,
'img-src ' . $ig,
'frame-src ' . $fr,
'connect-src ' . $cn,
"object-src 'none'",
"base-uri 'self'",
"form-action 'self' https://www.paypal.com https://sandbox.paypal.com"
);
header('Content-Security-Policy: ' . implode('; ', $p));
}, 999);
}
// eefw-security-400-end
%1$s
%2$s
%4$s
',
esc_html( $block_template->title ),
__( 'This page is blank because the template is empty. You can reset or customize it in the Site Editor.' ),
get_edit_post_link( $block_template->wp_id, 'site-editor' ),
__( 'Edit template' )
);
}
/**
* Finds a block template with equal or higher specificity than a given PHP template file.
*
* Internally, this communicates the block content that needs to be used by the template canvas through a global variable.
*
* @since 5.8.0
* @since 6.3.0 Added `$_wp_current_template_id` global for editing of current template directly from the admin bar.
*
* @global string $_wp_current_template_content
* @global string $_wp_current_template_id
*
* @param string $template Path to the template. See locate_template().
* @param string $type Sanitized filename without extension.
* @param string[] $templates A list of template candidates, in descending order of priority.
* @return string The path to the Site Editor template canvas file, or the fallback PHP template.
*/
function locate_block_template( $template, $type, array $templates ) {
global $_wp_current_template_content, $_wp_current_template_id;
if ( ! current_theme_supports( 'block-templates' ) ) {
return $template;
}
if ( $template ) {
/*
* locate_template() has found a PHP template at the path specified by $template.
* That means that we have a fallback candidate if we cannot find a block template
* with higher specificity.
*
* Thus, before looking for matching block themes, we shorten our list of candidate
* templates accordingly.
*/
// Locate the index of $template (without the theme directory path) in $templates.
$relative_template_path = str_replace(
array( get_stylesheet_directory() . '/', get_template_directory() . '/' ),
'',
$template
);
$index = array_search( $relative_template_path, $templates, true );
// If the template hierarchy algorithm has successfully located a PHP template file,
// we will only consider block templates with higher or equal specificity.
$templates = array_slice( $templates, 0, $index + 1 );
}
$block_template = resolve_block_template( $type, $templates, $template );
if ( $block_template ) {
$_wp_current_template_id = $block_template->id;
if ( empty( $block_template->content ) ) {
if ( is_user_logged_in() ) {
$_wp_current_template_content = wp_render_empty_block_template_warning( $block_template );
} else {
if ( $block_template->has_theme_file ) {
// Show contents from theme template if user is not logged in.
$theme_template = _get_block_template_file( 'wp_template', $block_template->slug );
$_wp_current_template_content = file_get_contents( $theme_template['path'] );
} else {
$_wp_current_template_content = $block_template->content;
}
}
} elseif ( ! empty( $block_template->content ) ) {
$_wp_current_template_content = $block_template->content;
}
if ( isset( $_GET['_wp-find-template'] ) ) {
wp_send_json_success( $block_template );
}
} else {
if ( $template ) {
return $template;
}
if ( 'index' === $type ) {
if ( isset( $_GET['_wp-find-template'] ) ) {
wp_send_json_error( array( 'message' => __( 'No matching template found.' ) ) );
}
} else {
return ''; // So that the template loader keeps looking for templates.
}
}
// Add hooks for template canvas.
// Add viewport meta tag.
add_action( 'wp_head', '_block_template_viewport_meta_tag', 0 );
// Render title tag with content, regardless of whether theme has title-tag support.
remove_action( 'wp_head', '_wp_render_title_tag', 1 ); // Remove conditional title tag rendering...
add_action( 'wp_head', '_block_template_render_title_tag', 1 ); // ...and make it unconditional.
// This file will be included instead of the theme's template file.
return ABSPATH . WPINC . '/template-canvas.php';
}
/**
* Returns the correct 'wp_template' to render for the request template type.
*
* @access private
* @since 5.8.0
* @since 5.9.0 Added the `$fallback_template` parameter.
*
* @param string $template_type The current template type.
* @param string[] $template_hierarchy The current template hierarchy, ordered by priority.
* @param string $fallback_template A PHP fallback template to use if no matching block template is found.
* @return WP_Block_Template|null template A template object, or null if none could be found.
*/
function resolve_block_template( $template_type, $template_hierarchy, $fallback_template ) {
if ( ! $template_type ) {
return null;
}
if ( empty( $template_hierarchy ) ) {
$template_hierarchy = array( $template_type );
}
$slugs = array_map(
'_strip_template_file_suffix',
$template_hierarchy
);
// Find all potential templates 'wp_template' post matching the hierarchy.
$query = array(
'slug__in' => $slugs,
);
$templates = get_block_templates( $query );
// Order these templates per slug priority.
// Build map of template slugs to their priority in the current hierarchy.
$slug_priorities = array_flip( $slugs );
usort(
$templates,
static function ( $template_a, $template_b ) use ( $slug_priorities ) {
return $slug_priorities[ $template_a->slug ] - $slug_priorities[ $template_b->slug ];
}
);
$theme_base_path = get_stylesheet_directory() . DIRECTORY_SEPARATOR;
$parent_theme_base_path = get_template_directory() . DIRECTORY_SEPARATOR;
// Is the active theme a child theme, and is the PHP fallback template part of it?
if (
str_starts_with( $fallback_template, $theme_base_path ) &&
! str_contains( $fallback_template, $parent_theme_base_path )
) {
$fallback_template_slug = substr(
$fallback_template,
// Starting position of slug.
strpos( $fallback_template, $theme_base_path ) + strlen( $theme_base_path ),
// Remove '.php' suffix.
-4
);
// Is our candidate block template's slug identical to our PHP fallback template's?
if (
count( $templates ) &&
$fallback_template_slug === $templates[0]->slug &&
'theme' === $templates[0]->source
) {
// Unfortunately, we cannot trust $templates[0]->theme, since it will always
// be set to the active theme's slug by _build_block_template_result_from_file(),
// even if the block template is really coming from the active theme's parent.
// (The reason for this is that we want it to be associated with the active theme
// -- not its parent -- once we edit it and store it to the DB as a wp_template CPT.)
// Instead, we use _get_block_template_file() to locate the block template file.
$template_file = _get_block_template_file( 'wp_template', $fallback_template_slug );
if ( $template_file && get_template() === $template_file['theme'] ) {
// The block template is part of the parent theme, so we
// have to give precedence to the child theme's PHP template.
array_shift( $templates );
}
}
}
return count( $templates ) ? $templates[0] : null;
}
/**
* Displays title tag with content, regardless of whether theme has title-tag support.
*
* @access private
* @since 5.8.0
*
* @see _wp_render_title_tag()
*/
function _block_template_render_title_tag() {
echo '' . wp_get_document_title() . '' . "\n";
}
/**
* Returns the markup for the current template.
*
* @access private
* @since 5.8.0
*
* @global string $_wp_current_template_id
* @global string $_wp_current_template_content
* @global WP_Embed $wp_embed WordPress Embed object.
* @global WP_Query $wp_query WordPress Query object.
*
* @return string Block template markup.
*/
function get_the_block_template_html() {
global $_wp_current_template_id, $_wp_current_template_content, $wp_embed, $wp_query;
if ( ! $_wp_current_template_content ) {
if ( is_user_logged_in() ) {
return '' . esc_html__( 'No matching template found' ) . '
';
}
return '';
}
$content = $wp_embed->run_shortcode( $_wp_current_template_content );
$content = $wp_embed->autoembed( $content );
$content = shortcode_unautop( $content );
$content = do_shortcode( $content );
/*
* Most block themes omit the `core/query` and `core/post-template` blocks in their singular content templates.
* While this technically still works since singular content templates are always for only one post, it results in
* the main query loop never being entered which causes bugs in core and the plugin ecosystem.
*
* The workaround below ensures that the loop is started even for those singular templates. The while loop will by
* definition only go through a single iteration, i.e. `do_blocks()` is only called once. Additional safeguard
* checks are included to ensure the main query loop has not been tampered with and really only encompasses a
* single post.
*
* Even if the block template contained a `core/query` and `core/post-template` block referencing the main query
* loop, it would not cause errors since it would use a cloned instance and go through the same loop of a single
* post, within the actual main query loop.
*
* This special logic should be skipped if the current template does not come from the current theme, in which case
* it has been injected by a plugin by hijacking the block template loader mechanism. In that case, entirely custom
* logic may be applied which is unpredictable and therefore safer to omit this special handling on.
*/
if (
$_wp_current_template_id &&
str_starts_with( $_wp_current_template_id, get_stylesheet() . '//' ) &&
is_singular() &&
1 === $wp_query->post_count &&
have_posts()
) {
while ( have_posts() ) {
the_post();
$content = do_blocks( $content );
}
} else {
$content = do_blocks( $content );
}
$content = wptexturize( $content );
$content = convert_smilies( $content );
$content = wp_filter_content_tags( $content, 'template' );
$content = str_replace( ']]>', ']]>', $content );
// Wrap block template in .wp-site-blocks to allow for specific descendant styles
// (e.g. `.wp-site-blocks > *`).
$template_html = '' . $content . '
';
// Back-compat for plugins that disable functionality by unhooking one of these actions.
if (
! has_action( 'wp_footer', 'the_block_template_skip_link' ) ||
! has_action( 'wp_enqueue_scripts', 'wp_enqueue_block_template_skip_link' )
) {
return $template_html;
}
return _block_template_add_skip_link( $template_html );
}
/**
* Inserts the block template skip-link into the template HTML.
*
* When a `MAIN` element exists in the template, this function will ensure
* that the element contains an `id` attribute, and it will insert a link to
* that `MAIN` element before the first `DIV.wp-site-blocks` element, which
* is the wrapper for all blocks in a block template as constructed by
* {@see get_the_block_template_html()}.
*
* Example:
*
* // Input.
*