$atts Shortcode attributes.
* @return string HTML output.
*/
public function render( array $atts = [] ): string {
// Feature gate check
if ( ! webcal_feature_available( 'frontend_submission' ) ) {
return '';
}
// Setting check
$raw_opt = get_option( 'webcal_frontend_submission', 'no' );
if ( ! is_scalar( $raw_opt ) || (string) $raw_opt !== 'yes' ) {
return '';
}
// Allowed HTML for all return paths. Every interpolated value is also
// escaped at its own point of use (esc_url, esc_html__); wp_kses() is
// a defensive boundary on the returned markup so the shortcode contract
// is verifiably safe even if a future edit forgets an inner escape.
$allowed = [
'p' => [ 'class' => [] ],
'a' => [ 'href' => [] ],
'div' => [ 'class' => [] ],
];
// Login check
if ( ! is_user_logged_in() ) {
$login_url = wp_login_url( get_permalink() ?: '' );
$login_link = ''
. esc_html__( 'log in', 'agenticdaisy-calendar' )
. '';
return wp_kses(
''
. sprintf(
/* translators: %s: HTML tag wrapping the text "log in" */
esc_html__( 'Please %s to submit an event.', 'agenticdaisy-calendar' ),
$login_link
)
. '
',
$allowed
);
}
// Permission check
if ( ! current_user_can( 'webcal_can_submit' ) ) {
return wp_kses(
''
. esc_html__( 'You do not have permission to submit events.', 'agenticdaisy-calendar' )
. '
',
$allowed
);
}
// Enqueue frontend assets
wp_enqueue_script( 'webcal-frontend' );
wp_enqueue_style( 'webcal-frontend' );
return wp_kses( '', $allowed );
}
}