rest_authorization_required_code() ) ); } $post_id = intval( $request->get_param( 'post_id' ) ); if ( $post_id > 0 && ! self::can_edit_post( $post_id ) ) { return new \WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this post.', 'advanced-animation' ), array( 'status' => rest_authorization_required_code() ) ); } return true; } /** * Sanitize CSS for safe use with wp_add_inline_style(). * * Removes style/PHP breakout sequences and legacy executable CSS without * treating CSS value syntax as HTML. In particular, wp_strip_all_tags() * must not be used here because it corrupts valid registered-property * declarations such as `syntax: ""`, which Tailwind uses for * gradients, transforms, and other custom-property-backed utilities. * * Full CSS sanitization is intentionally limited so legitimate author CSS * continues to work. This method is specifically the final safety boundary * for CSS that WordPress will place inside a style element. * * @param string $css Raw CSS. * @return string */ public static function sanitize_css( string $css ): string { // Remove control bytes that can obscure a style closing tag while // preserving whitespace that is meaningful to CSS. $css = (string) preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $css ); // Neutralize raw-text element and PHP breakouts without stripping valid // CSS type tokens such as . $css = (string) preg_replace( '#<\s*/?\s*(?:style|script)\b#i', '', $css ); $css = (string) preg_replace( '/<\?(?:php|=)?|\?>/i', '', $css ); $css = str_ireplace( array( '', 'expression(', 'javascript:', 'vbscript:', 'behavior:', '-moz-binding', ), '', $css ); return $css; } }