<?php
/**
 * Custom Header and Footer Code Slot
 *
 * @package    AdX-Ad-Inserter
 * @subpackage Views/Slots
 */

defined( 'ABSPATH' ) || exit;

/**
 * Print custom header code.
 *
 * @return void
 */
function adxbyms_render_custom_header_slot() {
	$header_code = get_option( 'adxbyms_header_code', '' );
	if ( empty( $header_code ) ) {
		return;
	}

	// Fix: remove WP added slashes.
	$header_code = wp_unslash( $header_code );

	// Always escape output using wp_kses() for security (WordPress.org requirement).
	// Even users with unfiltered_html capability must have output escaped.
	$allowed_html = array(
		'script'   => array(
			'src'            => true,
			'async'          => true,
			'defer'          => true,
			'type'           => true,
			'id'             => true,
			'class'          => true,
			'crossorigin'    => true,
			'integrity'      => true,
			'referrerpolicy' => true,
			'nonce'          => true,
		),
		'style'    => array(
			'type'  => true,
			'id'    => true,
			'class' => true,
			'media' => true,
		),
		'link'     => array(
			'rel'            => true,
			'href'           => true,
			'type'           => true,
			'media'          => true,
			'crossorigin'    => true,
			'integrity'      => true,
			'referrerpolicy' => true,
		),
		'noscript' => array(),
		'meta'     => array(
			'name'     => true,
			'content'  => true,
			'property' => true,
			'charset'  => true,
		),
		'div'      => array(
			'id'    => true,
			'class' => true,
			'style' => true,
		),
	);

	echo wp_kses( $header_code, $allowed_html );
}

/**
 * Print custom footer code.
 *
 * @return void
 */
function adxbyms_render_custom_footer_slot() {
	$footer_code = get_option( 'adxbyms_footer_code', '' );
	if ( empty( $footer_code ) ) {
		return;
	}

	// Fix: remove WP added slashes.
	$footer_code = wp_unslash( $footer_code );

	// Always escape output using wp_kses() for security (WordPress.org requirement).
	// Even users with unfiltered_html capability must have output escaped.
	$allowed_html = array(
		'script'   => array(
			'src'            => true,
			'async'          => true,
			'defer'          => true,
			'type'           => true,
			'id'             => true,
			'class'          => true,
			'crossorigin'    => true,
			'integrity'      => true,
			'referrerpolicy' => true,
			'nonce'          => true,
		),
		'style'    => array(
			'type'  => true,
			'id'    => true,
			'class' => true,
			'media' => true,
		),
		'link'     => array(
			'rel'            => true,
			'href'           => true,
			'type'           => true,
			'media'          => true,
			'crossorigin'    => true,
			'integrity'      => true,
			'referrerpolicy' => true,
		),
		'noscript' => array(),
		'meta'     => array(
			'name'     => true,
			'content'  => true,
			'property' => true,
			'charset'  => true,
		),
		'div'      => array(
			'id'    => true,
			'class' => true,
			'style' => true,
		),
	);

	echo wp_kses( $footer_code, $allowed_html );
}