add_help_tab( [ 'id' => 'totaltheme_custom_actions', 'title' => \esc_html__( 'Overview', 'total' ), 'content' => '

' . esc_html__( 'Here you can insert HTML code into any section of the theme. PHP code is not allowed for security reasons. If you wish to insert PHP code into a theme action you will want to use a child theme or shortcodes in the fields below.', 'total' ) . '

' ] ); } /** * Register a setting and its sanitization callback. */ public static function on_admin_init() { \register_setting( 'wpex_custom_actions', 'wpex_custom_actions', [ self::class, 'save_custom_actions' ] ); } /** * Save custom actions. */ public static function save_custom_actions( $actions ) { if ( ! \is_array( $actions ) || ! isset( $_POST['totaltheme-custom-actions-admin-nonce'] ) || ! wp_verify_nonce( \sanitize_text_field( \wp_unslash( $_POST['totaltheme-custom-actions-admin-nonce'] ) ), 'totaltheme-custom-actions-admin' ) || ! \current_user_can( self::get_user_capability() ) ) { return; } foreach ( $actions as $key => $val ) { if ( empty( $val['action'] ) || \ctype_space( $val['action'] ) ) { unset( $actions[ $key ] ); } else { // Sanitize action @todo don't allow javascript anymore? //$actions[ $key ]['action'] = wp_kses_post( $val['action'] ); // Priority must be a number. if ( ! empty( $val['priority'] ) ) { $actions[ $key ]['priority'] = \intval( $val['priority'] ); } } } return $actions; } /** * Panel scripts. */ public static function enqueue_scripts(): void { \wp_enqueue_script( 'totaltheme-admin-custom-actions', \totaltheme_get_js_file( 'admin/custom-actions' ), [ 'jquery' ], \WPEX_THEME_VERSION, [ 'strategy' => 'defer', ] ); } /** * Panel styles. */ public static function enqueue_styles(): void { \wp_enqueue_style( 'totaltheme-admin-custom-actions', \totaltheme_get_css_file( 'admin/custom-actions' ), [], \WPEX_THEME_VERSION, 'all' ); } /** * Settings page. */ public static function render_admin_page(): void { if ( ! \current_user_can( self::get_user_capability() ) ) { return; } ?>

[ 'label' => 'WordPress', 'hooks' => [ 'wp_head', 'wp_body_open', 'wp_footer', ], ], 'html' => [ 'label' => 'HTML', 'hooks' => [ 'wpex_hook_after_body_tag' ] ] ]; // Theme hooks. $theme_hooks = \wpex_theme_hooks(); // Combine hooks. $hooks = ( $wp_hooks + $theme_hooks ); // Loop through sections. foreach ( $hooks as $section ) : ?>

<?php echo \esc_textarea( $action ); ?>

$val ) { if ( ! empty( $val['action'] ) ) { $priority = isset( $val['priority'] ) ? \intval( $val['priority'] ) : 10; \add_action( $key, [ self::class, 'execute_action' ], $priority ); } } } /** * Used to execute an action. */ public static function execute_action(): void { $hook = \current_filter(); $actions = self::get_custom_actions(); $output = $actions[ $hook ]['action'] ?? ''; if ( $output && is_string( $output ) && empty( $actions[ $hook ]['php'] ) ) { // @todo can we add some sanitization but still allow scripts? //$output = preg_replace('#(.*?)#is', '', $output ); // remove script tags //$output = wp_kses_post( $output ); echo totaltheme_replace_vars( \do_shortcode( \do_blocks( $output ) ) ); } } /** * Returns user capability for this admin page. */ private static function get_user_capability(): string { return (string) \apply_filters( 'totaltheme/custom_actions/user_capability', 'edit_theme_options' ); } /** * Hook action. */ protected static function get_hook_action( string $hook = '' ): string { $action = self::get_custom_actions()[ $hook ]['action'] ?? ''; if ( ! $action && ( 'wpex_hook_outer_wrap_before' === $hook || 'wpex_hook_outer_wrap_after' === $hook ) ) { $hook = \str_replace( 'wpex_hook_outer', 'wpex_outer', $hook ); $action = self::get_custom_actions()[ $hook ]['action'] ?? ''; } return (string) $action; } }