the template for one row * 2. Fill bindings placeholder * 3. Embed slots … (shell plus content) * 4. Expand components (from the component library) * * The benefit: one rendering implementation, written in JS, inherently portable — and none of Gutenberg's * problem of a JS editor and a PHP front end drifting apart. */ class Renderer { /** * Trusted content: emitted verbatim, without kses. * * `post.content` is the output of the `the_content` filter — which WordPress core prints verbatim in every * theme (`the_content()` never runs kses). Who may write raw HTML into post content is already governed by * the `unfiltered_html` capability; running kses again at the output stage is **governing the wrong * layer**, at the cost of forms, embeds and iframes in post content being silently stripped. * * A case in point: Woo's `[woocommerce_my_account]` renders a login form, and kses removed the `

` * and all five ``s, leaving a few ``s — the page rendered as usual with no error, looking * merely like "the form was not finished". * * Fields the theme adds through `aumframe/raw_expressions` still go through kses: those values come * from more varied sources than core post content, so that line of defence stays. */ const TRUSTED_EXPRESSIONS = ['post.content']; /** @var string[]|null Per-request cache: fill_bindings consults it for every binding, and without caching * the filter would run hundreds of times */ private static $raw_cache = null; /** * Which expressions may emit raw HTML. * * Only `post.content` is built in. The theme adds its own rich-text fields through * `aumframe/raw_expressions` (which is what the content-model manager does) — otherwise binding a rich-text * custom field shows escaped `<p>` on the front end while the admin editor plainly shows formatted * text. * * Expressions added this way still pass through wp_kses_post; this is not unconditional permission. */ private static function raw_expressions(): array { if (self::$raw_cache === null) { $list = apply_filters('aumframe/raw_expressions', self::TRUSTED_EXPRESSIONS); self::$raw_cache = is_array($list) ? array_map('strval', $list) : self::TRUSTED_EXPRESSIONS; } return self::$raw_cache; } /** * How this binding is emitted: trusted = verbatim, kses = filtered HTML, '' = escaped. * * The row alias is ignored during comparison. The allow-list says `post.content`, while a loop's row * alias is the author's choice (a Repeater's `as`; this site alone has post, bike, series, row and other) * — matching the whole string exactly means `bike.content` does not match, rich text is escaped into a * literal `<p>`, and nothing is reported: the page renders as usual, with body copy showing as a * pile of tag source. * * This is not only Woo's prices; the content-model manager's rich-text fields take the same path — any of * them inside a loop with a renamed alias is affected. So it is fixed here rather than enumerated by every * caller. * * Security is not relaxed: the value still passes through wp_kses_post, and an alias cannot conjure * anything new — a row context could only ever reach the same set of post fields. */ private static function raw_mode(string $expr): string { if (self::matches_list($expr, self::TRUSTED_EXPRESSIONS)) { return 'trusted'; // Emitted verbatim } if (self::matches_list($expr, self::raw_expressions())) { return 'kses'; // HTML, but filtered } return ''; // Escaped } /** Ignore the leading row alias when comparing; the reasoning is above raw_mode. */ private static function matches_list(string $expr, array $list): bool { if (in_array($expr, $list, true)) { return true; } $tail = strstr($expr, '.'); // "bike.content" -> ".content" if ($tail === false) { return false; } foreach ($list as $allowed) { if (strstr($allowed, '.') === $tail) { return true; } } return false; } /** * Render the template matched by the current request, including the shell. */ public static function template(): string { $tpl = Router::match(); if (!$tpl) { return ''; } $ctx = DataContext::current(); $queries = self::queries_of($tpl); $content = self::render_baked((string) $tpl['baked_html'], $queries, $ctx); $shell = Router::shell(); if (!$shell) { return self::add_responsive_images($content); } $shell_html = self::render_baked( (string) $shell['baked_html'], self::queries_of($shell), $ctx ); /* * The responsive-images pass has to run after the whole page is assembled and cannot live * inside `render_baked()`. * * The shell and the page content render separately, and the content renders before the shell — so * inside, each would keep its own counter and "the first few images are not lazy-loaded" would apply to * the page content's first few, while what actually comes first in document order is the shell's logo. * Only the assembled page carries the real document order. */ return self::add_responsive_images( self::fill_slots($shell_html, ['content' => $content]) ); } /** The three fill-in steps. */ /** * @param array $opts `keepHidden` — when a condition fails, do not delete that branch; wrap it in a * `display:contents` marker and leave it in the DOM. * Used only by the editor canvas: the author has to be able to select a block that is * currently hidden, or a badge that "only appears when there is a discount" could never * be edited. The front end does not pass it, and its behaviour is unchanged. */ public static function render_baked(string $html, array $queries, array $ctx, array $opts = []): string { /* * Makes `query..count` resolvable — a number like "16 documents" no longer has to be typed by hand. * * It lives here rather than in `DataContext::current()`: queries belong to the template, not the * request. Within one request the shell and the page each have their own query table. */ if (!isset($ctx['query'])) { $ctx['query'] = new QueryBag($queries, $ctx); } $html = self::expand_components($html); $html = self::expand_loops($html, $queries, $ctx); $html = self::expand_conditions($html, $ctx, $opts); $html = self::fill_bindings($html, $ctx); return self::expand_shortcodes($html); } /** * Expand shortcode nodes. * * Last of the steps: a shortcode inside a loop has to expand once per row (one form per card is a * legitimate need), so the loops must finish copying the template first. * * The content is written by the editor's author (which requires edit_theme_options), at the same trust * level as the custom-CSS escape hatch and Embed's raw HTML — anyone who can reach the editor can already * edit theme files. */ private static function expand_shortcodes(string $html): string { if (strpos($html, '/', static function ($m) { $code = base64_decode($m[1], true); if ($code === false || $code === '') { return ''; } return do_shortcode(self::drop_unhandled($code)); }, $html ); } private static function drop_unhandled(string $code): string { if (strpos($code, '[') === false) { return $code; } return (string) preg_replace_callback( '/\[((?:aum|arb)[a-z0-9_]*)(\s[^\]]*)?\]/i', static function ($m) { if (shortcode_exists($m[1])) { return $m[0]; } if (current_user_can('edit_posts')) { return '' . sprintf( /* translators: %s: the shortcode tag nobody handled, e.g. aumviso_faq. */ esc_html__('[%s] — nothing on this site handles this shortcode, so it is not shown.', 'aumframe'), esc_html($m[1]) ) . ''; } return ''; }, $code ); } private static function queries_of(array $tpl): array { $scene = json_decode((string) $tpl['scene'], true); return is_array($scene) && !empty($scene['queries']) ? $scene['queries'] : []; } // ---------------------------------------------------------------- Loops /** * Expand a Repeater. * * Hand-written scanning rather than a regex: a regex cannot handle nested loops, and nesting was always * going to appear (posts inside terms). This starts at the outermost level and recurses inward, carrying * the context down with it. */ private static function expand_loops(string $html, array $queries, array $ctx): string { $out = ''; $cursor = 0; while (true) { $start = strpos($html, '', $start); if ($head_end === false) { return $out . substr($html, $cursor); } $query_id = substr($html, $start + 12, $head_end - ($start + 12)); $body_start = $head_end + 3; $body_end = self::find_loop_close($html, $body_start); if ($body_end === null) { return $out . substr($html, $cursor); } $out .= substr($html, $cursor, $start - $cursor); $row_template = substr($html, $body_start, $body_end - $body_start); $out .= self::expand_one_loop($row_template, $query_id, $queries, $ctx); $cursor = $body_end + strlen(''); } } /** Find the matching , skipping nested loops. */ private static function find_loop_close(string $html, int $from): ?int { $depth = 0; $cursor = $from; while (true) { $next_open = strpos($html, '', $cursor); if ($next_close === false) { return null; } if ($next_open !== false && $next_open < $next_close) { $depth++; $cursor = $next_open + 12; continue; } if ($depth === 0) { return $next_close; } $depth--; $cursor = $next_close + strlen(''); } } private static function expand_one_loop(string $row_template, string $query_id, array $queries, array $ctx): string { $config = $queries[$query_id] ?? null; if (!$config) { return ''; // The query is undefined: emit nothing, rather than leaking the template placeholder to the front end } $alias = $config['as'] ?? 'post'; // The current context is passed along: a source=field loop reads its repeater out of it $rows = DataContext::run_query($config, $ctx); $out = ''; $index = 0; foreach ($rows as $row) { $index++; /* * The row's position in the loop, as a bindable field. * * Numbered lists — the steps of a procedure, a ranked table, "01 / 02 / 03" section * markers inside a repeater — had no way to get their number: the layout could only * write one literal, which every row then printed. The symptom is four steps all * labelled `01`, and nothing reports it because the binding that *is* there resolves * perfectly. * * Only filled in when the row does not already have a field called `index` — * a repeater whose own field happens to be named that keeps its value. */ if (is_array($row) && !array_key_exists('index', $row)) { $row['index'] = (string) $index; } $row_ctx = array_merge($ctx, [$alias => $row]); // Expand inner loops first (carrying this row's context), then fill this row's bindings $expanded = self::expand_loops($row_template, $queries, $row_ctx); $expanded = self::expand_conditions($expanded, $row_ctx); $expanded = self::uniquify_ids($expanded, $index); // Filled means final: the attribute-binding markers are removed so nothing touches this row // again. See seal_row(). $out .= self::seal_row(self::fill_bindings($expanded, $row_ctx)); } return $out; } /** * Remove the attribute-binding markers once a row is filled. * * This is the fix for a real incident, not fastidiousness. * * A text binding, `…`, is replaced wholesale and is gone once filled. * An attribute binding is not: `data-af-bind-src="post.thumbnail.url"` is only read, and stays on the tag * afterwards. So once the loop has filled each row, the page-level fill_bindings **scans the same tags * again**. * * That was assumed harmless on the grounds that "there is no post in that context, resolution must fail, * and a failure returns the value unchanged". **That reasoning only holds on archive and search * templates.** On a page or singular template the page-level context does contain `post` (the page * itself), so resolution succeeds and overwrites every src, alt and href the rows had just been given with * the page's own values. * * The real consequence (the ebike homepage): six bike cards and three news items with **every link * pointing at the homepage**, every image replaced by the same fallback, and every alt reading the page * title. While the /bikes/ archive was entirely fine — "works on this page, wrong on that one", the hardest * kind to trace. * * The fix is "filled means final": a row has already received the values that belong to it and must not be * touched by any later scan. */ private static function seal_row(string $html): string { return (string) preg_replace('/\s+data-af-bind-(?:src|alt|href)="[^"]*"/i', '', $html); } /* ---------------------------------------------------------------- Responsive images */ /** * Add `srcset`, `sizes` and lazy loading to every `` in the output. * * Why it is required. * * An image address in a layout comes from one of two places: hard-coded at bake time (`@mediaurl:` * resolves to the original) or bound at runtime. Neither carries a `srcset` — so a phone downloads a * 4000px original while WordPress **has long since generated the 1024 / 768 / 300 versions and put them on * disk**; we simply were not handing them out. * * The gap is invisible day to day: delivering a site ourselves, we pre-compress images to their display * width and the page is fast. But the moment the buyer swaps an image that workaround is gone — what * they pick from the media library is the original. "The day it was delivered was the day it looked best" * is exactly the shape to avoid. * * Done here, on the finished output, rather than at bake time: srcset depends on which sizes the site * actually generated, which is a fact about the target site and varies between them. Baking it in * would weld the source site's size table into the output. */ private static function add_responsive_images(string $html): string { if (!function_exists('wp_get_attachment_image_srcset')) { return $html; } /* * The first few are not lazy-loaded. * * Lazy-loading the first screen's image (the LCP hero especially) is a **known performance * regression** — the browser waits for layout before it starts downloading. And the shell's logo comes * before the hero, so "the first one" is not "the most important one"; letting the first N through is * the only workable rule. */ $eager = (int) apply_filters('aumframe/eager_images', 3); $seen = 0; return (string) preg_replace_callback('/]*>/i', function ($m) use (&$seen, $eager) { $tag = $m[0]; $seen++; $add = ''; if (stripos($tag, ' srcset=') === false && preg_match('/\ssrc="([^"]+)"/i', $tag, $s)) { [$id, $size] = self::attachment_of_url($s[1]); if ($id) { $srcset = wp_get_attachment_image_srcset($id, $size); if ($srcset) { $add .= ' srcset="' . esc_attr($srcset) . '"'; if (stripos($tag, ' sizes=') === false) { /* * `sizes` can only be a generic value. * * A genuinely correct `sizes` would have to know how wide this image is in the * layout (33vw in a three-column grid, not 100vw), which is only known at compile * time. WordPress's own default (`(max-width:Npx) 100vw, Npx`) is **one step too * large** in a multi-column grid — but one step too large is far better than * downloading the original. An author can override it on the node, and an existing * one is left alone here. */ $sizes = wp_get_attachment_image_sizes($id, $size); if ($sizes) { $add .= ' sizes="' . esc_attr($sizes) . '"'; } } } } } if (stripos($tag, ' loading=') === false) { $add .= $seen > $eager ? ' loading="lazy"' : ' fetchpriority="high"'; } if (stripos($tag, ' decoding=') === false) { $add .= ' decoding="async"'; } if ($add === '') { return $tag; } // It can end in `>` or `/>` — a plain rtrim('>') leaves the self-closing slash // behind return (string) preg_replace('/\s*\/?>$/', $add . '>', $tag, 1); }, $html); } /** * Look an attachment up from an image address and identify which size it is. * * `photo-1024x682.jpg` → the attachment is `photo.jpg` at size `[1024, 682]`. * Without normalising to the original, `attachment_url_to_postid()` finds nothing for a suffixed address — * and bound addresses almost always carry a suffix * (`wp_get_attachment_image_url($id,'large')`). * * Cached per request: the same address appears many times on one page, especially after loops expand. */ private static function attachment_of_url(string $url): array { static $cache = []; if (isset($cache[$url])) { return $cache[$url]; } $size = 'full'; $base = preg_replace_callback( '/-(\d+)x(\d+)(\.[a-z0-9]+)$/i', function ($m) use (&$size) { $size = [(int) $m[1], (int) $m[2]]; return $m[3]; }, $url ); $id = attachment_url_to_postid($base); return $cache[$url] = [(int) $id, $size]; } // ---------------------------------------------------------------- Conditions /** * Expand conditional nodes: … * * This has to run after loops expand and be evaluated against each row's own context — ten cards in a * loop, some with an image and some without, is ten separate decisions rather than one. * * Hand-written scanning rather than a regex, as with loops: conditions nest (an optional badge inside an * optional block), and a regex cannot match balanced pairs. */ private static function expand_conditions(string $html, array $ctx, array $opts = []): string { if (strpos($html, ''; while (true) { $start = strpos($html, $open, $cursor); if ($start === false) { return $out . substr($html, $cursor); } $head_end = strpos($html, '-->', $start); if ($head_end === false) { return $out . substr($html, $cursor); } $payload = substr($html, $start + strlen($open), $head_end - ($start + strlen($open))); $body_start = $head_end + 3; $body_end = self::find_close($html, $body_start, $open, $close); if ($body_end === null) { return $out . substr($html, $cursor); } $out .= substr($html, $cursor, $start - $cursor); $body = substr($html, $body_start, $body_end - $body_start); $spec = json_decode((string) base64_decode($payload, true), true); if (self::condition_passes(is_array($spec) ? $spec : [], $ctx)) { // Inner conditions are evaluated recursively against the same context $out .= self::expand_conditions($body, $ctx, $opts); } elseif (!empty($opts['keepHidden'])) { /* * The editor canvas: keep it and mark it, never delete. * * A `display:contents` wrapper produces no box, so the layout is identical to not wrapping at * all — while deleting would leave the author unable to select that block, and a section that * "only appears in certain circumstances" could never be edited again. The canvas uses that * attribute to dim it. */ $out .= '

' . self::expand_conditions($body, $ctx, $opts) . '

'; } $cursor = $body_end + strlen($close); } } /** * Rename anchor ids per row inside a loop. * * An id must be unique in HTML, and a loop copies the same output N times. * A "Q&A" component inside a loop gives four questions four identical `id="faq-a"` values — click any of * them and `getElementById` only ever finds the first, so "I clicked the third question and the first * answer opened". That is not a content problem but a gap in the loop mechanism itself. * * Only anchors and their triggers that pair up within this row are renamed (`id` and * `data-af-toggle`); a toggle pointing outside the row (the header's mobile menu, say) is not in this HTML * and is naturally unaffected. */ private static function uniquify_ids(string $html, int $index): string { if (strpos($html, 'data-af-toggle="') === false && strpos($html, ' id="') === false) { return $html; } // Collect the anchor names appearing in this row first preg_match_all('/\sid="([^"]+)"/', $html, $ids); $names = array_unique($ids[1] ?? []); if (!$names) { return $html; } foreach ($names as $name) { $new = $name . '-' . $index; $html = str_replace( [' id="' . $name . '"', 'data-af-toggle="' . $name . '"'], [' id="' . $new . '"', 'data-af-toggle="' . $new . '"'], $html ); } return $html; } /** Find the matching end marker, skipping nested ones. */ private static function find_close(string $html, int $from, string $open, string $close): ?int { $depth = 0; $cursor = $from; while (true) { $next_open = strpos($html, $open, $cursor); $next_close = strpos($html, $close, $cursor); if ($next_close === false) { return null; } if ($next_open !== false && $next_open < $next_close) { $depth++; $cursor = $next_open + strlen($open); continue; } if ($depth === 0) { return $next_close; } $depth--; $cursor = $next_close + strlen($close); } } /** * Evaluate one condition. * * An unresolvable path is empty — not an error, and not a pass. A promo badge bound to * post.meta.discount should disappear on a post without that meta, rather than rendering the whole block * because "the field does not exist". */ private static function condition_passes(array $spec, array $ctx): bool { /* * resolve_raw rather than resolve here: `resolve()` only emits scalars and turns every array into null, * so a condition like "does this repeater have rows" always evaluated as empty — and the is_array * branch below was dead code that could never run until this changed. */ $value = self::resolve_raw((string) ($spec['expr'] ?? ''), $ctx); if (is_array($value)) { $value = $value ? '1' : ''; } $value = $value === null ? '' : (string) $value; $target = (string) ($spec['value'] ?? ''); switch ($spec['op'] ?? 'notEmpty') { case 'empty': return $value === ''; case 'equals': return $value === $target; case 'notEquals': return $value !== $target; case 'contains': return $target !== '' && strpos($value, $target) !== false; case 'notEmpty': default: return $value !== ''; } } // ---------------------------------------------------------------- Bindings private static function fill_bindings(string $html, array $ctx): string { // Text bindings: bake-time placeholder $html = preg_replace_callback( '/(.*?)/s', function ($m) use ($ctx) { $value = self::resolve($m[1], $ctx); /* * Unresolvable is not the same as empty. * * null means the path does not exist in this context at all (typically: one archive template * serving both /bikes/ and /series/city/, where a heading bound to term.name has no term on the * former). There the author's bake-time text is kept rather than being cleared — otherwise the * same template loses a whole block on a different URL, with no error at all, which is the root * of "works on this page, blank on that one". * * An empty string is a different matter: the field exists and its content genuinely is empty, * so it renders as empty. */ if ($value === null) { return $m[2]; } switch (self::raw_mode($m[1])) { case 'trusted': return (string) $value; case 'kses': return wp_kses_post((string) $value); default: return esc_html((string) $value); } }, $html ); // Attribute bindings:

// `