diff --git a/includes/class-wp-job-manager-post-types.php b/includes/class-wp-job-manager-post-types.php index 9a18f5509..65d844bf2 100644 --- a/includes/class-wp-job-manager-post-types.php +++ b/includes/class-wp-job-manager-post-types.php @@ -420,6 +420,52 @@ public function admin_head() { } } + /** + * Filter the post content of job listings. + * + * @since 1.33.0 + * @param string $post_content Post content to filter. + */ + public static function output_kses_post( $post_content ) { + echo wp_kses( $post_content, self::kses_allowed_html() ); + } + + /** + * Returns the expanded set of tags allowed in job listing content. + * + * @since 1.33.0 + * @return string + */ + private static function kses_allowed_html() { + /** + * Change the allowed tags in job listing content. + * + * @since 1.33.0 + * + * @param array $allowed_html Tags allowed in job listing posts. + */ + return apply_filters( + 'job_manager_kses_allowed_html', + array_replace_recursive( // phpcs:ignore PHPCompatibility.FunctionUse.NewFunctions.array_replace_recursiveFound + wp_kses_allowed_html( 'post' ), + array( + 'iframe' => array( + 'src' => true, + 'width' => true, + 'height' => true, + 'frameborder' => true, + 'marginwidth' => true, + 'marginheight' => true, + 'scrolling' => true, + 'title' => true, + 'allow' => true, + 'allowfullscreen' => true, + ), + ) + ) + ); + } + /** * Sanitize job type meta box input data from WP admin. * @@ -824,7 +870,7 @@ public static function get_permalink_structure() { update_option( self::PERMALINK_OPTION_NAME, wp_json_encode( $permalink_settings ) ); } - $permalinks = wp_parse_args( + $permalinks = wp_parse_args( $permalink_settings, array( 'job_base' => '', diff --git a/tests/php/tests/includes/test_class.wp-job-manager-post-types.php b/tests/php/tests/includes/test_class.wp-job-manager-post-types.php index 322a6cffb..32b5cbc43 100644 --- a/tests/php/tests/includes/test_class.wp-job-manager-post-types.php +++ b/tests/php/tests/includes/test_class.wp-job-manager-post-types.php @@ -15,6 +15,44 @@ public function tearDown() { add_filter( 'job_manager_geolocation_enabled', '__return_true' ); } + /** + * @since 1.33.0 + * @covers WP_Job_Manager_Post_Types::output_kses_post + */ + public function test_output_kses_post_simple() { + $job_id = $this->factory->job_listing->create( array( + 'post_content' => '

This is a simple job listing

', + ) ); + + $test_content = wpjm_get_the_job_description( $job_id ); + + ob_start(); + WP_Job_Manager_Post_Types::output_kses_post( $test_content ); + $actual_content = ob_get_clean(); + + $this->assertEquals( $test_content, $actual_content, 'No HTML should have been removed from this test.' ); + } + + /** + * @since 1.33.0 + * @covers WP_Job_Manager_Post_Types::output_kses_post + */ + public function test_output_kses_post_allow_embeds() { + $job_id = $this->factory->job_listing->create( array( + 'post_content' => '

This is a simple job listing

https://www.youtube.com/watch?v=S_GVbuddri8

', + ) ); + + $test_content = wpjm_get_the_job_description( $job_id ); + + ob_start(); + WP_Job_Manager_Post_Types::output_kses_post( $test_content ); + $actual_content = ob_get_clean(); + + $this->assertFalse( strpos( $actual_content, '

https://www.youtube.com/watch?v=S_GVbuddri8

' ), 'The YouTube link should have been expanded to an iframe' ); + $this->assertGreaterThan( 0, strpos( $actual_content, '