Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
94.12% covered (success)
94.12%
16 / 17
0.00% covered (danger)
0.00%
0 / 1
 CRAP
0.00% covered (danger)
0.00%
0 / 1
Javascript
93.75% covered (success)
93.75%
15 / 16
0.00% covered (danger)
0.00%
0 / 1
 2.00
0.00% covered (danger)
0.00%
0 / 1
 render
93.75% covered (success)
93.75%
15 / 16
0.00% covered (danger)
0.00%
0 / 1
 2.00
1<?php
2/**
3 * JavaScript BeyondWords player renderer.
4 *
5 * @package BeyondWords\Player\Renderer
6 * @since   6.0.0
7 * @since   7.0.0 Refactored to BeyondWords namespace with snake_case methods.
8 */
9
10declare( strict_types = 1 );
11
12namespace BeyondWords\Player\Renderer;
13
14defined( 'ABSPATH' ) || exit;
15
16/**
17 * Renders the BeyondWords player as a SDK script tag with an inline init call.
18 *
19 * @since 7.0.0 Refactored to BeyondWords namespace with snake_case methods.
20 */
21class Javascript extends Base {
22
23    /**
24     * Render the JavaScript player HTML.
25     *
26     * @param \WP_Post $post    Post object.
27     * @param string   $context Rendering context: 'auto' or 'shortcode'.
28     */
29    public static function render( \WP_Post $post, string $context = 'shortcode' ): string {
30        if ( \BeyondWords\Settings\Fields::PLAYER_UI_DISABLED === get_option( \BeyondWords\Settings\Fields::OPTION_PLAYER_UI ) ) {
31            return '';
32        }
33
34        $params = \BeyondWords\Player\ConfigBuilder::build( $post );
35
36        // The HEX flags escape ', ", <, >, & inside string values so attacker- or
37        // filter-controlled params can't break out of the quoted onload attribute.
38        $json_params = wp_json_encode(
39            $params,
40            JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP
41        );
42        $json_params = sprintf( '{target:this, ...%s}', $json_params );
43
44        $onload = sprintf( 'new BeyondWords.Player(%s);', $json_params );
45        $onload = apply_filters( 'beyondwords_player_script_onload', $onload, $params );
46
47        return sprintf(
48            // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
49            '<script data-beyondwords-player-context="%s" async defer src="%s" onload=\'%s\'></script>',
50            esc_attr( $context ),
51            esc_url( \BeyondWords\Core\Urls::get_js_sdk_url() ),
52            esc_attr( $onload )
53        );
54    }
55}