FileXXXXXXXXXXX

dvadf

File manager - Edit - /home/centroca/public_html/wp/wp-content/plugins/nextgen-gallery/src/DynamicStylesheets/Controller.php

Back
<?php namespace Imagely\NGG\DynamicStylesheets; use Imagely\NGG\Display\View; use Imagely\NGG\Util\Sanitization; /** * Controller for dynamic stylesheets. / class Controller { /* * Handle dynamic stylesheet generation. * * @param bool $return_output Whether to return the output or print it. * @return string\|void The generated CSS if $return_output is true. */ public function index_action( $return_output = false ) { header( 'Content-Type: text/css; charset=' . get_option( 'blog_charset' ), true ); if ( \C_NextGEN_Bootstrap::get_pro_api_version() < 4.0 ) { $manager = Manager::get_instance( 'all' ); $manager->register( 'nextgen_pro_film', 'photocrati-nextgen_pro_film#nextgen_pro_film_dyncss' ); $manager->register( 'nextgen_pro_grid_album', 'photocrati-nextgen_pro_albums#nextgen_pro_grid_album_dyncss' ); $manager->register( 'nextgen_pro_list_album', 'photocrati-nextgen_pro_albums#nextgen_pro_list_album_dyncss' ); $manager->register( 'nextgen_pro_blog', 'photocrati-nextgen_pro_blog_gallery#nextgen_pro_blog_dyncss' ); $manager->register( 'nextgen_pro_thumbnail_grid', 'photocrati-nextgen_pro_thumbnail_grid#nextgen_pro_thumbnail_grid_dyncss' ); } // Nonce verification is not necessary: this is not form data, but generated by NextGEN as part of its displayed // gallery customization for style. // // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized // Force scalar + unslash + strip; reject arrays/objects to prevent type-juggling into template lookup/decode. $raw_data = isset( $_REQUEST['data'] ) && is_scalar( $_REQUEST['data'] ) ? (string) wp_unslash( $_REQUEST['data'] ) : null; $raw_name = isset( $_REQUEST['name'] ) && is_scalar( $_REQUEST['name'] ) ? (string) wp_unslash( $_REQUEST['name'] ) : null; $data = null !== $raw_data ? Sanitization::recursive_stripslashes( $raw_data ) : null; // sanitize_key restricts template name to [a-z0-9_-], blocks path traversal / unexpected chars in array key lookup. $name = null !== $raw_name ? sanitize_key( Sanitization::recursive_stripslashes( $raw_name ) ) : null; // phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized if ( isset( $data ) && isset( $name ) && '' !== $name ) { $manager = Manager::get_instance( 'all' ); // Whitelist: only render if name maps to a registered template; prevents undefined-offset + arbitrary template key lookup. $template = $manager->get_css_template( $name ); if ( false === $template \|\| null === $template ) { return; } if ( \C_NextGEN_Bootstrap::get_pro_api_version() < 4.0 ) { $view = new \C_MVC_View( $template, $manager->decode( $data ) ); } else { $view = new View( $template, $manager->decode( $data ) ); } return $view->render( $return_output ); } } }

dvadf

dvadf