Changeset 59802 for trunk/src/wp-includes/class-wp-theme-json.php

Timestamp:

02/10/2025 10:27:49 PM (2 months ago)

Author:

peterwilsoncc

Message:

Global Styles: Improve sanitization of block variation styles.

Fixes an issue where block style variations containing inner block type and element styles would have those inner styles stripped when the user attempting to save Global Styles does not have the unfiltered_html capability.

Props aaronrobertshaw, mukesh27, andrewserong.
Fixes #62372.

File:

• trunk/src/wp-includes/class-wp-theme-json.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-theme-json.php

@@ -3553 +3553 @@
                     $variation_output = static::remove_insecure_styles( $variation_input );
 
-                    // Process a variation's elements and element pseudo selector styles.
+                    if ( isset( $variation_input['blocks'] ) ) {
+                        $variation_output['blocks'] = static::remove_insecure_inner_block_styles( $variation_input['blocks'] );
+                    }
+
                     if ( isset( $variation_input['elements'] ) ) {
-                        foreach ( $valid_element_names as $element_name ) {
-                            $element_input = $variation_input['elements'][ $element_name ] ?? null;
-                            if ( $element_input ) {
-                                $element_output = static::remove_insecure_styles( $element_input );
-
-                                if ( isset( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $element_name ] ) ) {
-                                    foreach ( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $element_name ] as $pseudo_selector ) {
-                                        if ( isset( $element_input[ $pseudo_selector ] ) ) {
-                                            $element_output[ $pseudo_selector ] = static::remove_insecure_styles( $element_input[ $pseudo_selector ] );
-                                        }
-                                    }
-                                }
-
-                                if ( ! empty( $element_output ) ) {
-                                    _wp_array_set( $variation_output, array( 'elements', $element_name ), $element_output );
-                                }
-                            }
-                        }
+                        $variation_output['elements'] = static::remove_insecure_element_styles( $variation_input['elements'] );
                     }
 
@@ -3608 +3594 @@
 
         return $theme_json;
+    }
+
+    /**
+     * Remove insecure element styles within a variation or block.
+     *
+     * @since 6.8.0
+     *
+     * @param array $elements The elements to process.
+     * @return array The sanitized elements styles.
+     */
+    protected static function remove_insecure_element_styles( $elements ) {
+        $sanitized           = array();
+        $valid_element_names = array_keys( static::ELEMENTS );
+
+        foreach ( $valid_element_names as $element_name ) {
+            $element_input = $elements[ $element_name ] ?? null;
+            if ( $element_input ) {
+                $element_output = static::remove_insecure_styles( $element_input );
+
+                if ( isset( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $element_name ] ) ) {
+                    foreach ( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $element_name ] as $pseudo_selector ) {
+                        if ( isset( $element_input[ $pseudo_selector ] ) ) {
+                            $element_output[ $pseudo_selector ] = static::remove_insecure_styles( $element_input[ $pseudo_selector ] );
+                        }
+                    }
+                }
+
+                $sanitized[ $element_name ] = $element_output;
+            }
+        }
+        return $sanitized;
+    }
+
+    /**
+     * Remove insecure styles from inner blocks and their elements.
+     *
+     * @since 6.8.0
+     *
+     * @param array $blocks The block styles to process.
+     * @return array Sanitized block type styles.
+     */
+    protected static function remove_insecure_inner_block_styles( $blocks ) {
+        $sanitized = array();
+        foreach ( $blocks as $block_type => $block_input ) {
+            $block_output = static::remove_insecure_styles( $block_input );
+
+            if ( isset( $block_input['elements'] ) ) {
+                $block_output['elements'] = static::remove_insecure_element_styles( $block_input['elements'] );
+            }
+
+            $sanitized[ $block_type ] = $block_output;
+        }
+        return $sanitized;
     }