Files
comic-easel/functions/library.php
T
coraislovely-code 2647482d1d Escape remaining public output contexts
Co-authored-by: gpt-5.6-sol <noreply@openai.com>
2026-07-29 09:13:08 -04:00

187 lines
5.3 KiB
PHP

<?php
if (!defined('ABSPATH')) exit;
/**
* A post title prepared for an HTML attribute.
*/
function ceo_title_for_attribute($post = 0) {
return esc_attr(get_the_title($post));
}
/**
* A post title prepared for normal HTML content.
*
* Titles are filterable, and some existing sites add harmless inline markup. KSES preserves
* that markup while removing scripts and event handlers.
*/
function ceo_title_for_html($post = 0) {
return wp_kses_post(get_the_title($post));
}
/*
* Get a sidebar and create a generic dynamic sidebar for it, else find the sidebar-*.php in the theme/childtheme
*/
function ceo_get_sidebar($location = '') {
global $post;
if (!empty($location)) do_action($location.'-top');
if (file_exists(get_stylesheet_directory().'/sidebar-'.$location.'.php')) {
get_sidebar($location);
} elseif (is_active_sidebar('ceo-sidebar-'.$location)) { ?>
<div id="sidebar-<?php echo $location; ?>" class="sidebar">
<?php dynamic_sidebar('ceo-sidebar-'.$location); ?>
</div>
<?php }
if (!empty($location)) do_action($location.'-bottom');
}
/**
* Protect global $post and $wp_query.
* @param object $use_this_post If provided, after saving the current post, set up this post for template tag use.
*/
function ceo_protect($use_this_post = null) {
global $post, $wp_query, $__post, $__wp_query;
if (!empty($post)) {
$__post = $post;
}
if (!empty($wp_query)) {
$__wp_query = $wp_query;
}
if (!is_null($use_this_post)) {
$post = $use_this_post;
setup_postdata($post);
}
}
/**
* Temporarily restore the global $post variable and set it up for use.
*/
function ceo_restore() {
global $post, $__post;
$post = $__post;
setup_postdata($post);
}
/**
* Restore global $post and $wp_query.
*/
function ceo_unprotect() {
global $post, $wp_query, $__post, $__wp_query;
if (!empty($__post)) {
$post = $__post;
}
if (!empty($__wp_query)) {
$wp_query = $__wp_query;
}
$__post = $__wp_query = null;
}
function ceo_in_comic_category() {
global $post;
if ($post->post_type == 'comic') return true;
return false;
}
function ceo_is_comic() {
global $post;
if (!is_404() && ($post->post_type == 'comic')) return true;
return false;
}
function ceo_is_chapter($chapter = '') {
global $post;
if (!empty($post) && $post->post_type == 'comic') {
$chapters = array();
$terms = wp_get_object_terms( $post->ID, 'chapters');
foreach ($terms as $term) {
$chapters[] = $term->slug;
}
if (!empty($chapters) && in_array($chapter, $chapters)) return true;
}
return false;
}
function ceo_test_is_chapter_in_story($story_id = 0) {
global $post;
if (!empty($post) && !empty($story_id) && ($post->post_type == 'comic')) {
$children_array = array();
$children = get_term_children($story_id, 'chapters');
foreach ($children as $child) {
$children_array[] = $child->term_id;
}
if (!empty($children_array)) {
// get current child ID
$terms = wp_get_object_terms($post->ID, 'chapters');
foreach ($terms as $term) {
if (in_array($term->term_id, $children_array)) return true;
}
}
}
return false;
}
/**
* This function makes it so that orderby 'menu_order' is accepted and not ignored by WordPress
*/
function ceo_apply_orderby_filter($orderby, $args) {
if ( $args['orderby'] == 'menu_order' ) {
return 't.menu_order';
} else
return $orderby;
}
add_filter('get_terms_orderby', 'ceo_apply_orderby_filter', 10, 2);
function ceo_get_referer() {
$ref = '';
if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
$ref = $_REQUEST['_wp_http_referer'];
else if ( ! empty( $_SERVER['HTTP_REFERER'] ) )
$ref = $_SERVER['HTTP_REFERER'];
return $ref;
}
/**
* Escape a stored comic meta value for output as HTML text.
*
* These meta values exist in the database in two shapes: entity-encoded when written through
* the Comic Easel meta boxes, which escape on save, and raw when written through WordPress's
* own Custom Fields panel, which does not. Decoding first normalises both, so the escape
* below applies exactly once.
*
* htmlspecialchars() rather than esc_html(), and deliberately so: esc_html() passes
* $double_encode = false, which means it declines to re-encode text that already looks like
* an entity. A value an author typed as the literal characters "&lt;b&gt;" is stored as
* "&amp;lt;b&amp;gt;", and esc_html() would hand back "&lt;b&gt;" -- one level short. Repeat
* that on each save and the author's literal text decays into a live tag.
*
* ENT_SUBSTITUTE matters as much: from PHP 8.1 the default flag set is
* ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, and passing ENT_QUOTES alone REPLACES that
* default rather than adding to it. Without ENT_SUBSTITUTE a single invalid UTF-8 byte makes
* htmlspecialchars() return an empty string, silently blanking the whole value. The charset
* fallback is for the same reason -- an empty or unrecognised blog_charset does likewise.
*/
function ceo_escape_stored_text($value) {
$charset = get_option('blog_charset');
if (empty($charset)) $charset = 'UTF-8';
$decoded = html_entity_decode((string)$value, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401);
return htmlspecialchars($decoded, ENT_QUOTES | ENT_SUBSTITUTE, $charset);
}
function ceo_content_warning() {
return apply_filters('ceo-content-warning', __('Warning, Mature Content.','comiceasel'));
}
function ceo_content_warning_in_head() {
?>
<script>
var contentwarningtext = "<?php echo esc_js(ceo_content_warning()); ?>";
</script>
<?php
}