$atts */ public static function html(string $tag, array $atts = []): string { /** * @param string $html * @param string $tag * @param array $atts */ return self::clean((string) apply_filters('aumframe/shortcode_html', '', $tag, $atts)); } private static function clean(string $html): string { if ($html === '') { return ''; } $allowed = wp_kses_allowed_html('post'); $allowed['input'] = [ 'type' => true, 'name' => true, 'value' => true, 'placeholder' => true, 'class' => true, 'id' => true, 'required' => true, 'disabled' => true, 'readonly' => true, 'checked' => true, 'maxlength' => true, 'min' => true, 'max' => true, 'step' => true, 'pattern' => true, 'autocomplete' => true, 'aria-label' => true, 'aria-labelledby' => true, 'aria-describedby' => true, ]; $allowed['select'] = [ 'name' => true, 'class' => true, 'id' => true, 'required' => true, 'disabled' => true, 'multiple' => true, 'aria-label' => true, ]; $allowed['option'] = ['value' => true, 'selected' => true, 'disabled' => true]; foreach (['form' => ['action', 'method', 'role', 'class', 'id'], 'button' => ['type', 'name', 'value', 'class', 'id', 'disabled', 'aria-label', 'aria-expanded', 'aria-controls'], 'label' => ['for', 'class', 'id'], 'textarea' => ['name', 'rows', 'cols', 'placeholder', 'class', 'id', 'required', 'aria-label']] as $tag => $attrs) { $allowed[$tag] = is_array($allowed[$tag] ?? null) ? $allowed[$tag] : []; foreach ($attrs as $attr) { $allowed[$tag][$attr] = true; } } return wp_kses($html, $allowed); } }