Changeset 55192 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

Timestamp:

02/02/2023 06:50:54 PM (22 months ago)

Author:

flixos90

Message:

Editor: Add support for custom CSS in global styles.

This changeset introduces functions wp_get_global_styles_custom_css() and wp_enqueue_global_styles_custom_css(), which allow accessing and enqueuing custom CSS added via global styles.

Custom CSS via global styles is handled separately from custom CSS via the Customizer. If a site uses both features, the custom CSS from both sources will be loaded. The global styles custom CSS is then loaded after the Customizer custom CSS, so if there are any conflicts between the rules, the global styles take precedence.

Similarly to e.g. [55185], the result is cached in a non-persistent cache, except when WP_DEBUG is on to avoid interrupting the theme developer's workflow.

Props glendaviesnz, oandregal, ntsekouras, mamaduka, davidbaumwald, hellofromtonya, flixos90.
Fixes #57536.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php (modified) (4 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

@@ -269 +269 @@
 
         $changes = $this->prepare_item_for_database( $request );
+        if ( is_wp_error( $changes ) ) {
+            return $changes;
+        }
+
         $result  = wp_update_post( wp_slash( (array) $changes ), true, false );
         if ( is_wp_error( $result ) ) {
@@ -291 +295 @@
      *
      * @since 5.9.0
+     * @since 6.2.0 Added validation of styles.css property.
      *
      * @param WP_REST_Request $request Request object.
-     * @return stdClass Changes to pass to wp_update_post.
+     * @return stdClass|WP_Error Prepared item on success. WP_Error on when the custom CSS is not valid.
      */
     protected function prepare_item_for_database( $request ) {
@@ -313 +318 @@
             $config = array();
             if ( isset( $request['styles'] ) ) {
+                if ( isset( $request['styles']['css'] ) ) {
+                    $css_validation_result = $this->validate_custom_css( $request['styles']['css'] );
+                    if ( is_wp_error( $css_validation_result ) ) {
+                        return $css_validation_result;
+                    }
+                }
                 $config['styles'] = $request['styles'];
             } elseif ( isset( $existing_config['styles'] ) ) {
@@ -658 +669 @@
         return $response;
     }
+
+    /**
+     * Validate style.css as valid CSS.
+     *
+     * Currently just checks for invalid markup.
+     *
+     * @since 6.2.0
+     *
+     * @param string $css CSS to validate.
+     * @return true|WP_Error True if the input was validated, otherwise WP_Error.
+     */
+    private function validate_custom_css( $css ) {
+        if ( preg_match( '#</?\w+#', $css ) ) {
+            return new WP_Error(
+                'rest_custom_css_illegal_markup',
+                __( 'Markup is not allowed in CSS.' ),
+                array( 'status' => 400 )
+            );
+        }
+        return true;
+    }
 }