WP_Theme_JSON::remove_insecure_properties() WordPress Method
The WP_Theme_JSON::remove_insecure_properties() method is used to remove any security-sensitive data from a WP_Theme object before it is converted to JSON. This is important because otherwise a malicious user could potentially exploit a security flaw in the theme to gain access to sensitive information.
WP_Theme_JSON::remove_insecure_properties( array $theme_json ) #
Removes insecure data from theme.json.
Parameters
- $theme_json
(array)(Required)Structure to sanitize.
Return
(array) Sanitized structure.
Source
File: wp-includes/class-wp-theme-json.php
public static function remove_insecure_properties( $theme_json ) {
$sanitized = array();
$theme_json = WP_Theme_JSON_Schema::migrate( $theme_json );
$valid_block_names = array_keys( static::get_blocks_metadata() );
$valid_element_names = array_keys( static::ELEMENTS );
$theme_json = static::sanitize( $theme_json, $valid_block_names, $valid_element_names );
$blocks_metadata = static::get_blocks_metadata();
$style_nodes = static::get_style_nodes( $theme_json, $blocks_metadata );
foreach ( $style_nodes as $metadata ) {
$input = _wp_array_get( $theme_json, $metadata['path'], array() );
if ( empty( $input ) ) {
continue;
}
$output = static::remove_insecure_styles( $input );
if ( ! empty( $output ) ) {
_wp_array_set( $sanitized, $metadata['path'], $output );
}
}
$setting_nodes = static::get_setting_nodes( $theme_json );
foreach ( $setting_nodes as $metadata ) {
$input = _wp_array_get( $theme_json, $metadata['path'], array() );
if ( empty( $input ) ) {
continue;
}
$output = static::remove_insecure_settings( $input );
if ( ! empty( $output ) ) {
_wp_array_set( $sanitized, $metadata['path'], $output );
}
}
if ( empty( $sanitized['styles'] ) ) {
unset( $theme_json['styles'] );
} else {
$theme_json['styles'] = $sanitized['styles'];
}
if ( empty( $sanitized['settings'] ) ) {
unset( $theme_json['settings'] );
} else {
$theme_json['settings'] = $sanitized['settings'];
}
return $theme_json;
}
Expand full source codeCollapse full source codeView on TracView on GitHub
Changelog
| Version | Description |
|---|---|
| 5.9.0 | Introduced. |