File: /var/www/html/wp-content/plugins/page-list/inc/shortcode-pagelist-ext.php
<?php
if ( ! defined( 'ABSPATH' ) ) { exit; }
if ( !function_exists('pagelist_unqprfx_ext_shortcode') ) {
function pagelist_unqprfx_ext_shortcode( $atts ) {
global $post, $pagelist_unq_settings;
$return = '';
extract( shortcode_atts( array(
'show_image' => 1,
'show_first_image' => 0,
'show_title' => 1,
'show_content' => 1,
'more_tag' => 1,
'limit_content' => 250,
'image_width' => '150',
'image_height' => '150',
'child_of' => '',
'sort_order' => 'ASC',
'sort_column' => 'menu_order, post_title',
'hierarchical' => 1,
'exclude' => '0',
'include' => '0',
'meta_key' => '',
'meta_value' => '',
'authors' => '',
'parent' => -1,
'exclude_tree' => '',
'number' => '',
'offset' => 0,
'post_type' => 'page',
'class' => '',
'strip_tags' => 1,
'strip_shortcodes' => 1,
'show_child_count' => 0,
'child_count_template' => 'Subpages: %child_count%',
'show_meta_key' => '',
'meta_template' => '%meta%'
), $atts ) );
// Sanitize and validate image_width
$image_width = absint($image_width);
if ($image_width === 0) {
$image_width = 150; // Set a default value if invalid input is provided
}
// Sanitize and validate image_height
$image_height = absint($image_height);
if ($image_height === 0) {
$image_height = 150; // Set a default value if invalid input is provided
}
if ( $child_of == '' ) { // show subpages if child_of is empty
$child_of = isset($post->ID) ? $post->ID : 0;
}
// --- Security hardening (Wordfence ticket 454582) ---
// post_status is no longer accepted from the shortcode: only published
// content is ever listed. This removes the unauthorized-disclosure
// vector for private/draft pages entirely.
$post_status = 'publish';
// Restrict post_type to public post types; fall back to 'page' otherwise.
$pagelist_ext_allowed_types = get_post_types( array( 'public' => true ) );
if ( ! is_array( $pagelist_ext_allowed_types ) || ! in_array( $post_type, $pagelist_ext_allowed_types, true ) ) {
$post_type = 'page';
}
// Restrict show_meta_key to prevent disclosure of arbitrary or protected
// post meta. Users who cannot edit posts may only read meta keys that are
// registered as publicly visible (show_in_rest) and are not protected.
if ( $show_meta_key !== '' && ! current_user_can( 'edit_posts' ) ) {
$pagelist_ext_registered_meta = get_registered_meta_keys( 'post' );
if ( is_protected_meta( $show_meta_key, 'post' )
|| ! isset( $pagelist_ext_registered_meta[ $show_meta_key ] )
|| empty( $pagelist_ext_registered_meta[ $show_meta_key ]['show_in_rest'] ) ) {
$show_meta_key = '';
}
}
$page_list_ext_args = array(
'show_image' => $show_image,
'show_first_image' => $show_first_image,
'show_title' => $show_title,
'show_content' => $show_content,
'more_tag' => $more_tag,
'limit_content' => $limit_content,
'image_width' => $image_width,
'image_height' => $image_height,
'sort_order' => $sort_order,
'sort_column' => $sort_column,
'hierarchical' => $hierarchical,
'exclude' => pagelist_unqprfx_norm_params($exclude),
'include' => pagelist_unqprfx_norm_params($include),
'meta_key' => $meta_key,
'meta_value' => $meta_value,
'authors' => $authors,
'child_of' => pagelist_unqprfx_norm_params($child_of),
'parent' => pagelist_unqprfx_norm_params($parent),
'exclude_tree' => pagelist_unqprfx_norm_params($exclude_tree),
'number' => '', // $number - own counter
'offset' => 0, // $offset - own offset
'post_type' => $post_type,
'post_status' => $post_status,
'class' => $class,
'strip_tags' => $strip_tags,
'strip_shortcodes' => $strip_shortcodes,
'show_child_count' => $show_child_count,
'child_count_template' => $child_count_template,
'show_meta_key' => $show_meta_key,
'meta_template' => $meta_template
);
$page_list_ext_args_all = array(
'show_image' => $show_image,
'show_first_image' => $show_first_image,
'show_title' => $show_title,
'show_content' => $show_content,
'more_tag' => $more_tag,
'limit_content' => $limit_content,
'image_width' => $image_width,
'image_height' => $image_height,
'sort_order' => $sort_order,
'sort_column' => $sort_column,
'hierarchical' => $hierarchical,
'exclude' => pagelist_unqprfx_norm_params($exclude),
'include' => pagelist_unqprfx_norm_params($include),
'meta_key' => $meta_key,
'meta_value' => $meta_value,
'authors' => $authors,
'child_of' => 0, // for showing all pages
'parent' => pagelist_unqprfx_norm_params($parent),
'exclude_tree' => pagelist_unqprfx_norm_params($exclude_tree),
'number' => '', // $number - own counter
'offset' => 0, // $offset - own offset
'post_type' => $post_type,
'post_status' => $post_status,
'class' => $class,
'strip_tags' => $strip_tags,
'strip_shortcodes' => $strip_shortcodes,
'show_child_count' => $show_child_count,
'child_count_template' => $child_count_template,
'show_meta_key' => $show_meta_key,
'meta_template' => $meta_template
);
$list_pages = get_pages( $page_list_ext_args );
if ( count( $list_pages ) == 0 && $post_status === 'publish' ) { // if there is no subpages
// Only fall back to a site-wide query for public content to avoid
// disclosing unrelated private/draft pages (Wordfence ticket 454582).
$list_pages = get_pages( $page_list_ext_args_all ); // we are showing all pages
}
$list_pages_html = '';
$count = 0;
$offset_count = 0;
if ( $list_pages !== false && count( $list_pages ) > 0 ) {
foreach($list_pages as $page){
$count++;
$offset_count++;
if ( !empty( $offset ) && is_numeric( $offset ) && $offset_count <= $offset ) {
$count = 0; // number counter to zero if offset is not finished
}
if ( ( !empty( $offset ) && is_numeric( $offset ) && $offset_count > $offset ) || ( empty( $offset ) ) || ( !empty( $offset ) && !is_numeric( $offset ) ) ) {
if ( ( !empty( $number ) && is_numeric( $number ) && $count <= $number ) || ( empty( $number ) ) || ( !empty( $number ) && !is_numeric( $number ) ) ) {
$link = get_permalink( $page->ID );
$list_pages_html .= '<div class="page-list-ext-item">';
if ( $show_image == 1 ) {
if ( get_the_post_thumbnail( $page->ID ) ) { // if there is a featured image
$list_pages_html .= '<div class="page-list-ext-image"><a href="'.$link.'" title="'.esc_attr($page->post_title).'">';
//$list_pages_html .= get_the_post_thumbnail($page->ID, array($image_width,$image_height)); // doesn't work good with image size
$image = wp_get_attachment_image_src( get_post_thumbnail_id( $page->ID ), array($image_width,$image_height) ); // get featured img; 'large'
$img_url = $image[0]; // get the src of the featured image
$list_pages_html .= '<img src="'.esc_url($img_url).'" width="'.esc_attr($image_width).'" alt="'.esc_attr($page->post_title).'" />'; // not using height="'.$image_height.'" because images could be not square shaped and they will be stretched
$list_pages_html .= '</a></div> ';
} else {
if ( $show_first_image == 1 ) {
$img_scr = pagelist_unqprfx_get_first_image( $page->post_content );
if ( !empty( $img_scr ) ) {
$list_pages_html .= '<div class="page-list-ext-image"><a href="'.$link.'" title="'.esc_attr($page->post_title).'">';
$list_pages_html .= '<img src="'.esc_url($img_scr).'" width="'.esc_attr($image_width).'" alt="'.esc_attr($page->post_title).'" />'; // not using height="'.$image_height.'" because images could be not square shaped and they will be stretched
$list_pages_html .= '</a></div> ';
}
}
}
}
if ( $show_title == 1 ) {
$list_pages_html .= '<h3 class="page-list-ext-title"><a href="'.$link.'" title="'.esc_attr($page->post_title).'">'.esc_html($page->post_title).'</a></h3>';
}
if ( $show_content == 1 ) {
//$content = apply_filters('the_content', $page->post_content);
//$content = str_replace(']]>', ']]>', $content); // both used in default the_content() function
if ( !empty( $page->post_excerpt ) ) {
$text_content = $page->post_excerpt;
} else {
$text_content = $page->post_content;
}
if ( post_password_required($page) ) {
$content = '<!-- password protected -->';
} else {
$content = pagelist_unqprfx_parse_content( $text_content, $limit_content, $strip_tags, $strip_shortcodes, $more_tag );
$content = do_shortcode( $content );
if ( $show_title == 0 ) { // make content as a link if there is no title
$content = '<a href="'.$link.'">'.$content.'</a>';
}
}
$list_pages_html .= '<div class="page-list-ext-item-content">'.$content.'</div>';
}
if ( $show_child_count == 1 ) {
$count_subpages = count(get_pages("child_of=".$page->ID));
if ( $count_subpages > 0 ) { // hide empty
$child_count_pos = strpos($child_count_template, '%child_count%'); // check if we have %child_count% marker in template
if ($child_count_pos === false) { // %child_count% not found in template
$child_count_template_html = esc_html($child_count_template).' '.$count_subpages;
$list_pages_html .= '<div class="page-list-ext-child-count">'.$child_count_template_html.'</div>';
} else { // %child_count% found in template
$child_count_template_html = str_replace('%child_count%', $count_subpages, esc_html($child_count_template));
$list_pages_html .= '<div class="page-list-ext-child-count">'.$child_count_template_html.'</div>';
}
}
}
if ( $show_meta_key != '' ) {
$post_meta = do_shortcode(get_post_meta($page->ID, $show_meta_key, true));
if ( !empty($post_meta) ) { // hide empty
$meta_pos = strpos($meta_template, '%meta%'); // check if we have %meta% marker in template
if ($meta_pos === false) { // %meta% not found in template
$meta_template_html = esc_html($meta_template).' '.esc_html($post_meta);
$list_pages_html .= '<div class="page-list-ext-meta">'.$meta_template_html.'</div>';
} else { // %meta% found in template
$meta_template_html = str_replace('%meta%', esc_html($post_meta), esc_html($meta_template));
$list_pages_html .= '<div class="page-list-ext-meta">'.$meta_template_html.'</div>';
}
}
}
$list_pages_html .= '</div>'."\n";
}
}
}
}
$return .= $pagelist_unq_settings['powered_by'];
if ($list_pages_html) {
$return .= '<div class="page-list page-list-ext '.esc_attr($class).'">'."\n".$list_pages_html."\n".'</div>';
} else {
$return .= '<!-- no pages to show -->'; // this line will not work, because we show all pages if there is no pages to show
}
return $return;
}
add_shortcode( 'pagelist_ext', 'pagelist_unqprfx_ext_shortcode' );
add_shortcode( 'pagelistext', 'pagelist_unqprfx_ext_shortcode' );
}