Douglas "BearlyDoug" Hazard

@andrrrewk, respectfully, I’m a senior-level WordPress developer (and have four plugins released). Please trust me when I say I need help, it’s a very legitimate request and I’ve outlined the steps to be able to re-produce the issue. This is most definitely an issue within the plugin’s validation system.

• This reply was modified 5 months, 4 weeks ago by Douglas "BearlyDoug" Hazard.

@talextech, please understand that I *love* the fact that y’all don’t support Gutenberg (I’m very anti-Gutenberg, as well, and my own plugins reflect that to an almost fanatical level). I just want to be able to have that toggle available within the plugin settings interface. It’s not entirely 100% compliant with WP Plugin development guidelines, but it’s juuuuuuuust close enough to pass muster (IMHO. I’m not going to pretend to speak for them, haha!)

Thanks!

@talextech, give me a *little* credit, please…. if there *were* a way to dismiss this error message, do you think I’d be here posting about it (especially if I’m capable enough of doing my own plugin and finding a way to TEMPORARILY hide the warning box)?

There’s a reason why I asked that this specifically be configured within the SETTINGS panel of this plugin. 🙂

• This reply was modified 8 months, 2 weeks ago by Douglas "BearlyDoug" Hazard.

Thank you, @fierevere! I appreciate you weighing in on this. 🙂

I need to note that my fix above does not address the (VERY VALID) external JavaScript/remote image concern others have noted, though I have scrubbed that “feature” from the version of the plugin I’m using.

The JS issue is absolutely an issue that must be addressed. I am hopeful that the WordPress plugin team will get that addressed for us, once and for all.

REPLACE the entire contents of widget/logic.php with the following:

<?php
if (!defined('ABSPATH')) exit; // Exit if accessed directly

/**
 * Evaluate widget logic safely.
 * Supports basic && and || operations with a whitelist of WP conditional functions,
 * and allows extension via filter hook for custom functions.
 *
 * @param string|bool $logic The widget logic string or boolean.
 * @return bool True if widget should display, false otherwise.
 */
function widget_logic_check_logic($logic)
{
	$logic = trim((string) $logic);

	// Allow external override (must return true/false)
	$logic = apply_filters('widget_logic_eval_override', $logic);

	if (is_bool($logic)) {
		return $logic;
	}

	if ($logic === '') {
		return true;
	}

	// Split by OR (||) operators
	$or_parts = preg_split('/\s*\|\|\s*/', $logic);
	foreach ($or_parts as $or_part) {
		// Split by AND (&&) operators
		$and_parts = preg_split('/\s*&&\s*/', $or_part);
		$and_result = true;
		foreach ($and_parts as $and_part) {
			$and_part = trim($and_part);
			if (!evaluate_condition($and_part)) {
				$and_result = false;
				break;
			}
		}
		if ($and_result) {
			return true;
		}
	}

	return false;
}

/**
 * Evaluate a single condition string.
 *
 * @param string $condition Single condition like is_home() or current_user_can('edit_posts').
 * @return bool
 */
function evaluate_condition($condition)
{
	// Match function name and optional args: functionName() or functionName('arg')
	if (!preg_match('/^([a-zA-Z_][a-zA-Z0-9_]*)\s*(\(.*\))?$/', $condition, $matches)) {
		return false;
	}

	$func = $matches[1];
	$args = isset($matches[2]) ? $matches[2] : '';

	// Whitelist allowed functions — filterable so themes/plugins can add more
	$allowed_funcs = array(
		'is_home',
		'is_front_page',
		'is_single',
		'is_page',
		'is_category',
		'is_tag',
		'is_archive',
		'is_author',
		'is_search',
		'is_404',
		'is_user_logged_in',
		'current_user_can',
		'is_active_sidebar',
	);

	$allowed_funcs = apply_filters('widget_logic_allowed_functions', $allowed_funcs);

	if (!in_array($func, $allowed_funcs, true)) {
		return false;
	}

	if ($args === '') {
		return function_exists($func) ? $func() : false;
	}

	// Process args string to array
	$args = trim($args, '() ');
	if ($args === '') {
		return function_exists($func) ? $func() : false;
	}

	// Split arguments respecting commas
	$argList = preg_split('/\s*,\s*/', $args);

	// Trim quotes and whitespace from each arg
	$argList = array_map(function ($arg) {
		return trim($arg, "'\" ");
	}, $argList);

	if (!function_exists($func)) {
		return false;
	}

	return call_user_func_array($func, $argList);
}

/**
 * Custom error handler for widget logic errors.
 *
 * @param int    $errno
 * @param string $errstr
 * @return bool
 */
function widget_logic_error_handler($errno, $errstr)
{
	global $wl_options;

	$show_errors = !empty($wl_options['widget_logic-options-show_errors']) && current_user_can('manage_options');

	if ($show_errors) {
		echo 'Invalid Widget Logic: ' . esc_html($errstr);
	}

	return true;
}

/**
 * Retrieve widget logic string for a widget ID.
 *
 * @param string $widget_id
 * @return string
 */
function widget_logic_by_id($widget_id)
{
	global $wl_options;

	if (preg_match('/^(.+)-(\d+)$/', $widget_id, $m)) {
		$widget_class = $m[1];
		$widget_i     = $m[2];

		$info = get_option('widget_' . $widget_class);
		if (empty($info[$widget_i])) {
			return '';
		}

		$info = $info[$widget_i];
	} else {
		$info = (array) get_option('widget_' . $widget_id, array());
	}

	if (isset($info['widget_logic'])) {
		$logic = $info['widget_logic'];
	} elseif (isset($wl_options[$widget_id])) {
		$logic = stripslashes($wl_options[$widget_id]);
		widget_logic_save($widget_id, $logic);

		unset($wl_options[$widget_id]);
		update_option('widget_logic', $wl_options);
	} else {
		$logic = '';
	}

	return $logic;
}

/**
 * Save widget logic string for a widget ID.
 *
 * @param string $widget_id
 * @param string $logic
 * @return void
 */
function widget_logic_save($widget_id, $logic)
{
	global $wl_options;

	if (preg_match('/^(.+)-(\d+)$/', $widget_id, $m)) {
		$widget_class = $m[1];
		$widget_i     = $m[2];

		$info = get_option('widget_' . $widget_class);
		if (!is_array($info[$widget_i])) {
			$info[$widget_i] = array();
		}

		$info[$widget_i]['widget_logic'] = $logic;
		update_option('widget_' . $widget_class, $info);
	} elseif (
		isset($_POST['widget_logic_nonce'])
		&& wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['widget_logic_nonce'])), 'widget_logic_save')
	) {
		$info = (array) get_option('widget_' . $widget_id, array());
		$info['widget_logic'] = $logic;
		update_option('widget_' . $widget_id, $info);
	}
}

I gotta tip my hat in a sign of MAJOR respect to @room34. Absolutely awesome to work with. And definitely super knowledgeable.

Thank you, S!