From 1c312b385078f20b4230b5bee5a2988418a9ac2b Mon Sep 17 00:00:00 2001 From: Mike Letellier Date: Fri, 29 Aug 2025 11:44:59 -0300 Subject: [PATCH 1/5] issue 5929 alternative fix --- classes/helpers/FrmStylesHelper.php | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/classes/helpers/FrmStylesHelper.php b/classes/helpers/FrmStylesHelper.php index f22d0734db..d170d3a66d 100644 --- a/classes/helpers/FrmStylesHelper.php +++ b/classes/helpers/FrmStylesHelper.php @@ -443,13 +443,36 @@ public static function output_vars( $settings, $defaults = array(), $vars = arra if ( ! isset( $defaults[ $var ] ) ) { $defaults[ $var ] = ''; } - $show = empty( $defaults ) || ( $settings[ $var ] !== '' && $settings[ $var ] !== $defaults[ $var ] ); - if ( $show && self::css_value_is_valid( $settings[ $var ] ) ) { - echo '--' . esc_html( self::clean_var_name( str_replace( '_', '-', $var ) ) ) . ':' . self::css_var_prepare_value( $settings, $var ) . ';'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped + + $prepared_value = ''; + if ( self::should_add_css_var( $settings, $defaults, $var, $prepared_value ) ) { + echo '--' . esc_html( self::clean_var_name( str_replace( '_', '-', $var ) ) ) . ':' . $prepared_value . ';'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped } } } + /** + * @since x.x + * + * @param array $settings + * @param array $defaults + * @param string $var + * @param string $prepared_value + * @return bool + */ + private static function should_add_css_var( $settings, $defaults, $var, &$prepared_value ) { + $prepared_value = self::css_var_prepare_value( $settings, $var ); + if ( $prepared_value === '' ) { + return false; + } + + if ( $defaults && $defaults[ $var ] === $prepared_value ) { + return false; + } + + return self::css_value_is_valid( $prepared_value ); + } + /** * Prevent invalid CSS keys from getting added to the generated CSS. * From fdc034c08bc7071aa25fcab7f163db6e45716856 Mon Sep 17 00:00:00 2001 From: Mike Letellier Date: Fri, 29 Aug 2025 11:48:44 -0300 Subject: [PATCH 2/5] Add comments --- classes/helpers/FrmStylesHelper.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/classes/helpers/FrmStylesHelper.php b/classes/helpers/FrmStylesHelper.php index d170d3a66d..5ea963155b 100644 --- a/classes/helpers/FrmStylesHelper.php +++ b/classes/helpers/FrmStylesHelper.php @@ -454,11 +454,11 @@ public static function output_vars( $settings, $defaults = array(), $vars = arra /** * @since x.x * - * @param array $settings - * @param array $defaults - * @param string $var - * @param string $prepared_value - * @return bool + * @param array $settings Array of setting values. + * @param array $defaults Array of default values. + * @param string $var The setting key name. + * @param string $prepared_value The value from calling css_var_prepare_value. This is set by reference so it can be used after this function is called. + * @return bool True if the CSS value should be printed. */ private static function should_add_css_var( $settings, $defaults, $var, &$prepared_value ) { $prepared_value = self::css_var_prepare_value( $settings, $var ); From 49d24480f0e43fd2ae8bcb3ebd43adbb3c681bbe Mon Sep 17 00:00:00 2001 From: Mike Letellier Date: Fri, 29 Aug 2025 11:52:06 -0300 Subject: [PATCH 3/5] Add another comment --- classes/helpers/FrmStylesHelper.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/classes/helpers/FrmStylesHelper.php b/classes/helpers/FrmStylesHelper.php index 5ea963155b..702d6914c0 100644 --- a/classes/helpers/FrmStylesHelper.php +++ b/classes/helpers/FrmStylesHelper.php @@ -452,6 +452,8 @@ public static function output_vars( $settings, $defaults = array(), $vars = arra } /** + * Check if a CSS variable setting is not blank, doesn't match the default, and doesn't include invalid substrings. + * * @since x.x * * @param array $settings Array of setting values. From 78396fde4d501d9a3a662c47364e96ef14a8db98 Mon Sep 17 00:00:00 2001 From: Mike Letellier Date: Fri, 29 Aug 2025 12:18:35 -0300 Subject: [PATCH 4/5] Add some extra checks --- classes/helpers/FrmStylesHelper.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/classes/helpers/FrmStylesHelper.php b/classes/helpers/FrmStylesHelper.php index 702d6914c0..a69795016a 100644 --- a/classes/helpers/FrmStylesHelper.php +++ b/classes/helpers/FrmStylesHelper.php @@ -551,6 +551,10 @@ private static function clean_var_name( $var_name ) { private static function css_var_prepare_value( $settings, $key ) { $value = $settings[ $key ]; + if ( ! is_string( $value ) && ! is_numeric( $value ) ) { + return ''; + } + switch ( $key ) { case 'font': return safecss_filter_attr( $value ); @@ -581,7 +585,7 @@ private static function css_var_prepare_value( $settings, $key ) { break; }//end switch - return esc_html( $settings[ $key ] ); + return esc_html( $value ); } /** From 72dc84575f1efa0fe6aebba54947db7908e0ca51 Mon Sep 17 00:00:00 2001 From: Mike Letellier Date: Fri, 29 Aug 2025 12:20:34 -0300 Subject: [PATCH 5/5] Move code around --- classes/helpers/FrmStylesHelper.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/classes/helpers/FrmStylesHelper.php b/classes/helpers/FrmStylesHelper.php index a69795016a..e7c28652a7 100644 --- a/classes/helpers/FrmStylesHelper.php +++ b/classes/helpers/FrmStylesHelper.php @@ -495,7 +495,7 @@ private static function css_key_is_valid( $key ) { * * @since 6.20 * - * @param mixed $var + * @param string $var * @return bool */ private static function css_value_is_valid( $var ) { @@ -503,10 +503,6 @@ private static function css_value_is_valid( $var ) { return true; } - if ( ! is_string( $var ) ) { - return false; - } - // None of these substrings should be present in any CSS value. $invalid_substrings = array( 'function(',