Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/maxi-blocks/build/index.min.asset.php
+++ b/maxi-blocks/build/index.min.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-dom-ready', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-url'), 'version' => '8309095d18d88d28cb0d');
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-dom-ready', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-url'), 'version' => 'f701a44cf2ae225c1f31');
--- a/maxi-blocks/core/admin/class-maxi-dashboard.php
+++ b/maxi-blocks/core/admin/class-maxi-dashboard.php
@@ -1350,6 +1350,56 @@
'</p>';
$content .= $this->generate_setting($description, 'hide_gutenberg_responsive_preview');
+ $description =
+ '<h4>' . __('Global header scripts and styles', 'maxi-blocks') . '</h4>';
+ $description .=
+ '<p>' .
+ __('Add code that loads on all front-end pages in the <head> tag. Wrap JavaScript in <script> tags and CSS in <style> tags. Useful for analytics, tracking codes, and custom CSS.', 'maxi-blocks') .
+ '</p>';
+ $content .= $this->generate_setting(
+ $description,
+ 'maxi_custom_js_header_option',
+ '',
+ 'textarea',
+ );
+
+ $description =
+ '<h4>' . __('Global footer scripts and styles', 'maxi-blocks') . '</h4>';
+ $description .=
+ '<p>' .
+ __('Add code that loads on all front-end pages before the closing </body> tag. Wrap JavaScript in <script> tags and CSS in <style> tags.', 'maxi-blocks') .
+ '</p>';
+ $content .= $this->generate_setting(
+ $description,
+ 'maxi_custom_js_footer_option',
+ '',
+ 'textarea',
+ );
+
+ $description =
+ '<h4>' . __('Admin (wp-admin) scripts and styles', 'maxi-blocks') . '</h4>';
+ $description .=
+ '<p>' .
+ __('Add code that loads on all wp-admin pages. Wrap JavaScript in <script> tags and CSS in <style> tags. Only visible to logged-in users with admin access.', 'maxi-blocks') .
+ '</p>';
+ $content .= $this->generate_setting(
+ $description,
+ 'maxi_custom_js_admin_option',
+ '',
+ 'textarea',
+ );
+
+ $description =
+ '<h4>' . __('Enable per-post/page custom scripts', 'maxi-blocks') . '</h4>';
+ $description .=
+ '<p>' .
+ __('Show a meta box on individual post and page edit screens to add custom header/footer scripts and styles for that post or page only. When disabled, any previously saved per-post/page scripts are also suppressed on the frontend.', 'maxi-blocks') .
+ '</p>';
+ $content .= $this->generate_setting(
+ $description,
+ 'maxi_enable_post_custom_scripts',
+ );
+
$content .= get_submit_button(__('Save changes', 'maxi-blocks'));
$this->add_hidden_api_fields();
@@ -2172,7 +2222,8 @@
str_replace('_', '-', $option) . '-visible-input';
if ($type === 'textarea') {
- $visible_input = "<textarea name="{$option}" id="{$option}" class="maxi-dashboard_main-content_accordion-item-input regular-text">{$input_value}</textarea>";
+ $escaped_value = esc_textarea($input_value);
+ $visible_input = "<textarea name="{$option}" id="{$option}" class="maxi-dashboard_main-content_accordion-item-input regular-text">{$escaped_value}</textarea>";
} else {
// Always keep the name attribute for all inputs
$visible_input = "<input name="{$option}" id="{$option}" class="maxi-dashboard_main-content_accordion-item-input regular-text {$visible_input_class}" type="{$type}" value="{$input_value}"/>";
@@ -2381,6 +2432,13 @@
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
];
+ $args_custom_js = [
+ 'type' => 'string',
+ 'sanitize_callback' => [
+ 'MaxiBlocks_Custom_Scripts',
+ 'sanitize_scripts_code',
+ ],
+ ];
// List of settings and corresponding arguments
$settings = [
@@ -2393,6 +2451,10 @@
'hide_tooltips' => $args,
'hide_fse_resizable_handles' => $args_true,
'hide_gutenberg_responsive_preview' => $args_true,
+ 'maxi_custom_js_header_option' => $args_custom_js,
+ 'maxi_custom_js_footer_option' => $args_custom_js,
+ 'maxi_custom_js_admin_option' => $args_custom_js,
+ 'maxi_enable_post_custom_scripts' => $args,
'google_api_key_option' => $args_api_key,
'openai_api_key_option' => $args_api_key,
'maxi_ai_model' => $args_ai_model,
--- a/maxi-blocks/core/class-maxi-api.php
+++ b/maxi-blocks/core/class-maxi-api.php
@@ -976,15 +976,15 @@
$new_style_card = [
'_maxi_blocks_style_card' => $data['sc_variables'],
'_maxi_blocks_style_card_preview' => $data['sc_variables'],
- '_maxi_blocks_style_card_styles' => $data['sc_styles'],
+ '_maxi_blocks_style_card_styles' => wp_strip_all_tags($data['sc_styles']),
'_maxi_blocks_style_card_styles_preview' =>
- $data['sc_styles'],
+ wp_strip_all_tags($data['sc_styles']),
];
} else {
$new_style_card['_maxi_blocks_style_card_preview'] =
$data['sc_variables'];
$new_style_card['_maxi_blocks_style_card_styles_preview'] =
- $data['sc_styles'];
+ wp_strip_all_tags($data['sc_styles']);
if (
$style_card !== '' &&
@@ -1007,7 +1007,7 @@
$data['sc_variables'];
if (array_key_exists('sc_styles', $data)) {
$new_style_card['_maxi_blocks_style_card_styles'] =
- $data['sc_styles'];
+ wp_strip_all_tags($data['sc_styles']);
}
} elseif ($data instanceof WP_REST_Request) {
if ($data->has_param('sc_variables')) {
@@ -1018,7 +1018,7 @@
if ($data->has_param('sc_styles')) {
$new_style_card[
'_maxi_blocks_style_card_styles'
- ] = $data->get_param('sc_styles');
+ ] = wp_strip_all_tags($data->get_param('sc_styles'));
}
}
}
--- a/maxi-blocks/core/class-maxi-blocks.php
+++ b/maxi-blocks/core/class-maxi-blocks.php
@@ -178,6 +178,7 @@
'bunny_fonts' => get_option('bunny_fonts'),
'apiRoot' => esc_url_raw(rest_url()),
'image_crop_nonce' => wp_create_nonce('maxi_image_crop'),
+ 'pluginUrl' => MAXI_PLUGIN_URL_PATH,
]);
// Inject MaxiBlocks settings directly to avoid API calls
--- a/maxi-blocks/core/class-maxi-custom-scripts.php
+++ b/maxi-blocks/core/class-maxi-custom-scripts.php
@@ -0,0 +1,489 @@
+<?php
+/**
+ * MaxiBlocks Custom Scripts Class
+ *
+ * @since 2.1.9
+ * @package MaxiBlocks
+ */
+
+if (!defined('ABSPATH')) {
+ exit();
+}
+
+if (!class_exists('MaxiBlocks_Custom_Scripts')):
+ class MaxiBlocks_Custom_Scripts
+ {
+ private static $instance;
+
+ public static function register()
+ {
+ if (null === self::$instance) {
+ self::$instance = new MaxiBlocks_Custom_Scripts();
+ }
+ }
+
+ public function __construct()
+ {
+ add_action('init', [$this, 'register_post_meta_fields']);
+ add_action('add_meta_boxes', [$this, 'register_meta_boxes']);
+ add_action('save_post', [$this, 'save_post_scripts_meta']);
+ add_action('enqueue_block_editor_assets', [$this, 'enqueue_block_editor_assets']);
+
+ add_action('wp_head', [$this, 'render_header_scripts'], 1);
+ add_action('wp_footer', [$this, 'render_footer_scripts'], 999);
+ add_action('admin_head', [$this, 'render_admin_scripts']);
+
+ add_filter('manage_post_posts_columns', [$this, 'add_custom_scripts_column']);
+ add_filter('manage_page_posts_columns', [$this, 'add_custom_scripts_column']);
+ add_action('manage_post_posts_custom_column', [$this, 'render_custom_scripts_column'], 10, 2);
+ add_action('manage_page_posts_custom_column', [$this, 'render_custom_scripts_column'], 10, 2);
+
+ add_action('quick_edit_custom_box', [$this, 'quick_edit_fields'], 10, 2);
+ add_action('admin_footer-edit.php', [$this, 'quick_edit_script']);
+ add_action('save_post', [$this, 'save_quick_edit_fields']);
+ }
+
+ public static function sanitize_scripts_code($value)
+ {
+ if (!is_string($value)) {
+ return '';
+ }
+
+ // This field is restricted to users with unfiltered_html or
+ // manage_options capability (see auth_callback and
+ // can_edit_custom_scripts). These users can already insert
+ // arbitrary HTML/JS in WordPress, so heavy HTML-level
+ // sanitisation (wp_kses) is unnecessary and would mangle
+ // legitimate JavaScript (e.g. comparison operators, template
+ // literals). We trim whitespace and ensure the value is a
+ // valid UTF-8 string.
+ return trim(wp_check_invalid_utf8($value, true));
+ }
+
+ private static function can_edit_custom_scripts()
+ {
+ return current_user_can('unfiltered_html') || current_user_can('manage_options');
+ }
+
+ public function register_post_meta_fields()
+ {
+ $args = [
+ 'type' => 'string',
+ 'single' => true,
+ 'show_in_rest' => true,
+ 'sanitize_callback' => [__CLASS__, 'sanitize_scripts_code'],
+ 'auth_callback' => function () {
+ return self::can_edit_custom_scripts();
+ },
+ ];
+
+ register_post_meta('post', '_maxi_custom_js_header', $args);
+ register_post_meta('post', '_maxi_custom_js_footer', $args);
+ register_post_meta('page', '_maxi_custom_js_header', $args);
+ register_post_meta('page', '_maxi_custom_js_footer', $args);
+ }
+
+ public function enqueue_block_editor_assets()
+ {
+ $screen = get_current_screen();
+ if (!$screen || !in_array($screen->post_type, ['post', 'page'], true)) {
+ return;
+ }
+
+ $script = <<<'JS'
+(function() {
+ if (!window.wp || !wp.data || !wp.data.select || !wp.data.dispatch) {
+ return;
+ }
+
+ var select = wp.data.select('core/editor');
+ var dispatch = wp.data.dispatch('core/editor');
+ if (!select || !dispatch || typeof dispatch.editPost !== 'function' || typeof select.getCurrentPostType !== 'function') {
+ return;
+ }
+
+ if (!select.getCurrentPostType()) {
+ return;
+ }
+
+ var timeout;
+ var observer = null;
+ var listenersBound = false;
+
+ var bindScriptFields = function() {
+ if (listenersBound) {
+ return true;
+ }
+
+ var headerField = document.querySelector('textarea[name="maxi_custom_js_header"]');
+ var footerField = document.querySelector('textarea[name="maxi_custom_js_footer"]');
+ if (!headerField || !footerField) {
+ return false;
+ }
+
+ var isSaving = function() {
+ var saving = select.isSavingPost && select.isSavingPost();
+ var autosaving = select.isAutosavingPost && select.isAutosavingPost();
+ return saving || autosaving;
+ };
+
+ var sync = function() {
+ if (isSaving()) {
+ return;
+ }
+ dispatch.editPost({
+ meta: {
+ _maxi_custom_js_header: headerField.value,
+ _maxi_custom_js_footer: footerField.value
+ }
+ });
+ };
+
+ var debouncedSync = function() {
+ if (isSaving()) {
+ return;
+ }
+ clearTimeout(timeout);
+ timeout = setTimeout(sync, 200);
+ };
+
+ headerField.addEventListener('input', debouncedSync);
+ footerField.addEventListener('input', debouncedSync);
+ listenersBound = true;
+ return true;
+ };
+
+ if (bindScriptFields()) {
+ return;
+ }
+
+ if (!document.body || typeof MutationObserver === 'undefined') {
+ return;
+ }
+
+ observer = new MutationObserver(function() {
+ if (bindScriptFields() && observer) {
+ observer.disconnect();
+ }
+ });
+
+ observer.observe(document.body, { childList: true, subtree: true });
+
+ setTimeout(function() {
+ if (observer && !listenersBound) {
+ observer.disconnect();
+ }
+ }, 30000);
+})();
+JS;
+
+ wp_add_inline_script('wp-edit-post', $script, 'after');
+ }
+
+ private function get_request_value($meta_key, $field_name)
+ {
+ if (
+ isset($_POST['meta']) &&
+ is_array($_POST['meta']) &&
+ array_key_exists($meta_key, $_POST['meta'])
+ ) {
+ return $_POST['meta'][$meta_key];
+ }
+
+ if (array_key_exists($field_name, $_POST)) {
+ return $_POST[$field_name];
+ }
+
+ return null;
+ }
+
+ public function save_post_scripts_meta($post_id)
+ {
+ if (defined('REST_REQUEST') && REST_REQUEST) {
+ return;
+ }
+
+ if (!isset($_POST['maxi_custom_scripts_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['maxi_custom_scripts_nonce'])), 'maxi_custom_scripts_meta_box')) {
+ return;
+ }
+
+ if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
+ return;
+ }
+
+ if (wp_is_post_revision($post_id) || wp_is_post_autosave($post_id)) {
+ return;
+ }
+
+ if (!current_user_can('edit_post', $post_id)) {
+ return;
+ }
+
+ if (!self::can_edit_custom_scripts()) {
+ return;
+ }
+
+ $header_raw = $this->get_request_value(
+ '_maxi_custom_js_header',
+ 'maxi_custom_js_header',
+ );
+ $footer_raw = $this->get_request_value(
+ '_maxi_custom_js_footer',
+ 'maxi_custom_js_footer',
+ );
+
+ if (null === $header_raw && null === $footer_raw) {
+ return;
+ }
+
+ $header_value = is_string($header_raw) ? (string) wp_unslash($header_raw) : '';
+ $footer_value = is_string($footer_raw) ? (string) wp_unslash($footer_raw) : '';
+
+ $header_script = self::sanitize_scripts_code($header_value);
+ $footer_script = self::sanitize_scripts_code($footer_value);
+
+ if ('' === trim($header_script)) {
+ delete_post_meta($post_id, '_maxi_custom_js_header');
+ } else {
+ update_post_meta($post_id, '_maxi_custom_js_header', $header_script);
+ }
+
+ if ('' === trim($footer_script)) {
+ delete_post_meta($post_id, '_maxi_custom_js_footer');
+ } else {
+ update_post_meta($post_id, '_maxi_custom_js_footer', $footer_script);
+ }
+ }
+
+ public function register_meta_boxes()
+ {
+ if (!get_option('maxi_enable_post_custom_scripts')) {
+ return;
+ }
+
+ add_meta_box(
+ 'maxi-custom-scripts',
+ __('MaxiBlocks custom scripts and styles', 'maxi-blocks'),
+ [$this, 'render_meta_box'],
+ ['post', 'page'],
+ 'normal',
+ 'default',
+ );
+ }
+
+ public function render_meta_box($post)
+ {
+ wp_nonce_field('maxi_custom_scripts_meta_box', 'maxi_custom_scripts_nonce');
+
+ $header_script = get_post_meta($post->ID, '_maxi_custom_js_header', true);
+ $footer_script = get_post_meta($post->ID, '_maxi_custom_js_footer', true);
+
+ echo '<p><strong>' . esc_html__('Header scripts and styles', 'maxi-blocks') . '</strong></p>';
+ echo '<p>' . esc_html__('Add code for this post/page only. Printed in the <head>. Wrap JavaScript in <script> tags and CSS in <style> tags.', 'maxi-blocks') . '</p>';
+ echo '<textarea name="maxi_custom_js_header" rows="6" style="width:100%;">' . esc_textarea($header_script) . '</textarea>';
+
+ echo '<p><strong>' . esc_html__('Footer scripts and styles', 'maxi-blocks') . '</strong></p>';
+ echo '<p>' . esc_html__('Add code for this post/page only. Printed before </body>. Wrap JavaScript in <script> tags and CSS in <style> tags.', 'maxi-blocks') . '</p>';
+ echo '<textarea name="maxi_custom_js_footer" rows="6" style="width:100%;">' . esc_textarea($footer_script) . '</textarea>';
+ }
+
+ public function render_header_scripts()
+ {
+ if (is_admin()) {
+ return;
+ }
+
+ $global_header_scripts = get_option('maxi_custom_js_header_option', '');
+ if (!empty($global_header_scripts)) {
+ echo "n<!-- MaxiBlocks custom header scripts -->n";
+ echo $global_header_scripts; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "n";
+ }
+
+ if (get_option('maxi_enable_post_custom_scripts') && is_singular(['post', 'page'])) {
+ $post_id = get_queried_object_id();
+ if (!$post_id) {
+ return;
+ }
+
+ $post_script = get_post_meta($post_id, '_maxi_custom_js_header', true);
+ if (!empty($post_script)) {
+ echo "n<!-- MaxiBlocks post/page header scripts -->n";
+ echo $post_script; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "n";
+ }
+ }
+ }
+
+ public function render_footer_scripts()
+ {
+ if (is_admin()) {
+ return;
+ }
+
+ $global_footer_scripts = get_option('maxi_custom_js_footer_option', '');
+ if (!empty($global_footer_scripts)) {
+ echo "n<!-- MaxiBlocks custom footer scripts -->n";
+ echo $global_footer_scripts; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "n";
+ }
+
+ if (get_option('maxi_enable_post_custom_scripts') && is_singular(['post', 'page'])) {
+ $post_id = get_queried_object_id();
+ if (!$post_id) {
+ return;
+ }
+
+ $post_script = get_post_meta($post_id, '_maxi_custom_js_footer', true);
+ if (!empty($post_script)) {
+ echo "n<!-- MaxiBlocks post/page footer scripts -->n";
+ echo $post_script; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "n";
+ }
+ }
+ }
+
+ public function render_admin_scripts()
+ {
+ if (!current_user_can('manage_options')) {
+ return;
+ }
+
+ $admin_scripts = get_option('maxi_custom_js_admin_option', '');
+ if (!empty($admin_scripts)) {
+ echo "n<!-- MaxiBlocks custom admin scripts -->n";
+ echo $admin_scripts; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo "n";
+ }
+ }
+
+ public function add_custom_scripts_column($columns)
+ {
+ $columns['maxi_custom_scripts'] = __('Maxi scripts/styles', 'maxi-blocks');
+ return $columns;
+ }
+
+ public function render_custom_scripts_column($column, $post_id)
+ {
+ if ('maxi_custom_scripts' !== $column) {
+ return;
+ }
+
+ $header = get_post_meta($post_id, '_maxi_custom_js_header', true);
+ $footer = get_post_meta($post_id, '_maxi_custom_js_footer', true);
+
+ $status = [];
+ if (!empty($header)) {
+ $status[] = __('Header', 'maxi-blocks');
+ }
+ if (!empty($footer)) {
+ $status[] = __('Footer', 'maxi-blocks');
+ }
+
+ echo '<span class="maxi-custom-scripts-status">' . esc_html(!empty($status) ? implode(' / ', $status) : __('None', 'maxi-blocks')) . '</span>';
+ echo '<div class="hidden" id="maxi-custom-scripts-inline-' . esc_attr((string) $post_id) . '">';
+ echo '<textarea class="maxi-inline-header">' . esc_textarea($header) . '</textarea>';
+ echo '<textarea class="maxi-inline-footer">' . esc_textarea($footer) . '</textarea>';
+ echo '</div>';
+ }
+
+ public function quick_edit_fields($column_name, $post_type)
+ {
+ if ('maxi_custom_scripts' !== $column_name || !in_array($post_type, ['post', 'page'], true)) {
+ return;
+ }
+
+ wp_nonce_field('maxi_quick_edit_scripts', 'maxi_quick_edit_scripts_nonce');
+
+ echo '<fieldset class="inline-edit-col-right">';
+ echo '<div class="inline-edit-col">';
+ echo '<label>';
+ echo '<span class="title">' . esc_html__('Header scripts and styles', 'maxi-blocks') . '</span>';
+ echo '<textarea name="maxi_quick_custom_js_header" rows="3"></textarea>';
+ echo '</label>';
+ echo '<label>';
+ echo '<span class="title">' . esc_html__('Footer scripts and styles', 'maxi-blocks') . '</span>';
+ echo '<textarea name="maxi_quick_custom_js_footer" rows="3"></textarea>';
+ echo '</label>';
+ echo '</div>';
+ echo '</fieldset>';
+ }
+
+ public function quick_edit_script()
+ {
+ $screen = get_current_screen();
+ if (!$screen || !in_array($screen->post_type, ['post', 'page'], true)) {
+ return;
+ }
+ ?>
+ <script>
+ (function() {
+ if (typeof window.jQuery === 'undefined' || typeof window.inlineEditPost === 'undefined' || typeof window.inlineEditPost.edit !== 'function') {
+ return;
+ }
+
+ (function($) {
+ const wpInlineEditFunction = inlineEditPost.edit;
+ inlineEditPost.edit = function(postId) {
+ wpInlineEditFunction.apply(this, arguments);
+ let id = 0;
+ if (typeof(postId) === 'object') {
+ id = parseInt(this.getId(postId), 10);
+ }
+
+ if (id > 0) {
+ const $editRow = $('#edit-' + id);
+ const $inlineData = $('#maxi-custom-scripts-inline-' + id);
+
+ if ($inlineData.length) {
+ $editRow.find('textarea[name="maxi_quick_custom_js_header"]').val($inlineData.find('.maxi-inline-header').val());
+ $editRow.find('textarea[name="maxi_quick_custom_js_footer"]').val($inlineData.find('.maxi-inline-footer').val());
+ }
+ }
+ };
+ })(window.jQuery);
+ })();
+ </script>
+ <?php
+ }
+
+ public function save_quick_edit_fields($post_id)
+ {
+ if (!isset($_POST['maxi_quick_edit_scripts_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['maxi_quick_edit_scripts_nonce'])), 'maxi_quick_edit_scripts')) {
+ return;
+ }
+
+ if (!current_user_can('edit_post', $post_id)) {
+ return;
+ }
+
+ if (!self::can_edit_custom_scripts()) {
+ return;
+ }
+
+ if (!isset($_POST['maxi_quick_custom_js_header']) || !isset($_POST['maxi_quick_custom_js_footer'])) {
+ return;
+ }
+
+ $header_raw = wp_unslash($_POST['maxi_quick_custom_js_header']);
+ $footer_raw = wp_unslash($_POST['maxi_quick_custom_js_footer']);
+ $header_value = is_string($header_raw) ? $header_raw : '';
+ $footer_value = is_string($footer_raw) ? $footer_raw : '';
+
+ $header_script = self::sanitize_scripts_code($header_value);
+ $footer_script = self::sanitize_scripts_code($footer_value);
+
+ if ('' === trim($header_script)) {
+ delete_post_meta($post_id, '_maxi_custom_js_header');
+ } else {
+ update_post_meta($post_id, '_maxi_custom_js_header', $header_script);
+ }
+
+ if ('' === trim($footer_script)) {
+ delete_post_meta($post_id, '_maxi_custom_js_footer');
+ } else {
+ update_post_meta($post_id, '_maxi_custom_js_footer', $footer_script);
+ }
+ }
+ }
+endif;
--- a/maxi-blocks/core/class-maxi-image-crop.php
+++ b/maxi-blocks/core/class-maxi-image-crop.php
@@ -125,7 +125,7 @@
{
check_ajax_referer('maxi_image_crop', 'nonce');
- if (!current_user_can('edit_posts')) {
+ if (!current_user_can('delete_others_posts')) {
wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'maxi-blocks'));
}
if (isset($_POST['old_media_src'])) {//phpcs:ignore
--- a/maxi-blocks/core/class-maxi-style-cards.php
+++ b/maxi-blocks/core/class-maxi-style-cards.php
@@ -196,7 +196,7 @@
if ($styles) {
wp_register_style('maxi-blocks-sc-styles', false, [], MAXI_PLUGIN_VERSION);
wp_enqueue_style('maxi-blocks-sc-styles');
- wp_add_inline_style('maxi-blocks-sc-styles', $styles);
+ wp_add_inline_style('maxi-blocks-sc-styles', wp_strip_all_tags($styles));
}
}
--- a/maxi-blocks/core/class-maxi-styles.php
+++ b/maxi-blocks/core/class-maxi-styles.php
@@ -162,6 +162,7 @@
'map',
'accordion',
'slider',
+ 'row-carousel',
'email-obfuscate'
];
@@ -210,8 +211,8 @@
$result_decoded = $result[$js_var];
- // TODO: This is a temporary solution to fix the issue with the bg_video, scroll_effects and slider meta
- if (in_array($js_var, ['bg_video', 'scroll_effects', 'slider'])) {
+ // TODO: This is a temporary solution to fix the issue with the bg_video, scroll_effects, slider and row_carousel meta
+ if (in_array($js_var, ['bg_video', 'scroll_effects', 'slider', 'row_carousel'])) {
$template_parts_meta = array_merge($template_parts_meta, [true]);
} elseif (is_array($result_decoded) && !empty($result_decoded)) {
$template_parts_meta = array_merge($template_parts_meta, $result_decoded);
@@ -1114,8 +1115,8 @@
$result_decoded = $result[$metaJs];
- // TODO: This is a temporary solution to fix the issue with the bg_video, scroll_effects and slider meta
- if (in_array($metaJs, ['bg_video', 'scroll_effects', 'slider'])) {
+ // TODO: This is a temporary solution to fix the issue with the bg_video, scroll_effects, slider and row_carousel meta
+ if (in_array($metaJs, ['bg_video', 'scroll_effects', 'slider', 'row_carousel'])) {
return [ true ];
}
@@ -1457,6 +1458,7 @@
'map',
'accordion',
'slider',
+ 'row-carousel',
'navigation',
'email-obfuscate',
];
@@ -1469,6 +1471,7 @@
'relations' => true,
'navigation' => true,
'email-obfuscate' => true,
+ 'row-carousel' => true,
];
$script_configs = [];
--- a/maxi-blocks/plugin.php
+++ b/maxi-blocks/plugin.php
@@ -6,7 +6,7 @@
* Description: A powerful page builder for WordPress Gutenberg with a vast library of free web templates, icons & patterns. Open source and free to build. Anything you create with MaxiBlocks is yours to keep. There's no lock-in, no domain restrictions or license keys to keep track of. All blocks and features are free to use. Save time, get advanced designs & more with the Pro cloud library upgrade.
* Author: MaxiBlocks
* Author URI: https://maxiblocks.com/go/plugin-author
- * Version: 2.1.9
+ * Version: 2.1.10
* Requires at least: 6.2.2
* Requires PHP: 8.0
* License: GPLv3 or later
@@ -264,6 +264,14 @@
}
//======================================================================
+// MaxiBlocks Custom Scripts
+//======================================================================
+require_once MAXI_PLUGIN_DIR_PATH . 'core/class-maxi-custom-scripts.php';
+if (class_exists('MaxiBlocks_Custom_Scripts')) {
+ MaxiBlocks_Custom_Scripts::register();
+}
+
+//======================================================================
// MaxiBlocks DB
//======================================================================
require_once MAXI_PLUGIN_DIR_PATH . 'core/class-maxi-db.php';
