WordPress 4.3
[autoinstalls/wordpress.git] / wp-admin / includes / class-wp-press-this.php
1 <?php
2 /**
3  * Press This class and display functionality
4  *
5  * @package WordPress
6  * @subpackage Press_This
7  * @since 4.2.0
8  */
9
10 /**
11  * Press This class.
12  *
13  * @since 4.2.0
14  */
15 class WP_Press_This {
16
17         // Used to trigger the bookmarklet update notice.
18         public $version = 8;
19
20         private $images = array();
21
22         private $embeds = array();
23
24         private $domain = '';
25
26         /**
27          * Constructor.
28          *
29          * @since 4.2.0
30          * @access public
31          */
32         public function __construct() {}
33
34         /**
35          * App and site settings data, including i18n strings for the client-side.
36          *
37          * @since 4.2.0
38          * @access public
39          *
40          * @return array Site settings.
41          */
42         public function site_settings() {
43                 return array(
44                         /**
45                          * Filter whether or not Press This should redirect the user in the parent window upon save.
46                          *
47                          * @since 4.2.0
48                          *
49                          * @param bool false Whether to redirect in parent window or not. Default false.
50                          */
51                         'redirInParent' => apply_filters( 'press_this_redirect_in_parent', false ),
52                 );
53         }
54
55         /**
56          * Get the source's images and save them locally, for posterity, unless we can't.
57          *
58          * @since 4.2.0
59          * @access public
60          *
61          * @param int    $post_id Post ID.
62          * @param string $content Optional. Current expected markup for Press This. Expects slashed. Default empty.
63          * @return string New markup with old image URLs replaced with the local attachment ones if swapped.
64          */
65         public function side_load_images( $post_id, $content = '' ) {
66                 $content = wp_unslash( $content );
67
68                 if ( preg_match_all( '/<img [^>]+>/', $content, $matches ) && current_user_can( 'upload_files' ) ) {
69                         foreach ( (array) $matches[0] as $image ) {
70                                 // This is inserted from our JS so HTML attributes should always be in double quotes.
71                                 if ( ! preg_match( '/src="([^"]+)"/', $image, $url_matches ) ) {
72                                         continue;
73                                 }
74
75                                 $image_src = $url_matches[1];
76
77                                 // Don't try to sideload a file without a file extension, leads to WP upload error.
78                                 if ( ! preg_match( '/[^\?]+\.(?:jpe?g|jpe|gif|png)(?:\?|$)/i', $image_src ) ) {
79                                         continue;
80                                 }
81
82                                 // Sideload image, which gives us a new image src.
83                                 $new_src = media_sideload_image( $image_src, $post_id, null, 'src' );
84
85                                 if ( ! is_wp_error( $new_src ) ) {
86                                         // Replace the POSTED content <img> with correct uploaded ones.
87                                         // Need to do it in two steps so we don't replace links to the original image if any.
88                                         $new_image = str_replace( $image_src, $new_src, $image );
89                                         $content = str_replace( $image, $new_image, $content );
90                                 }
91                         }
92                 }
93
94                 // Edxpected slashed
95                 return wp_slash( $content );
96         }
97
98         /**
99          * AJAX handler for saving the post as draft or published.
100          *
101          * @since 4.2.0
102          * @access public
103          */
104         public function save_post() {
105                 if ( empty( $_POST['post_ID'] ) || ! $post_id = (int) $_POST['post_ID'] ) {
106                         wp_send_json_error( array( 'errorMessage' => __( 'Missing post ID.' ) ) );
107                 }
108
109                 if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'update-post_' . $post_id ) ||
110                         ! current_user_can( 'edit_post', $post_id ) ) {
111
112                         wp_send_json_error( array( 'errorMessage' => __( 'Invalid post.' ) ) );
113                 }
114
115                 $post = array(
116                         'ID'            => $post_id,
117                         'post_title'    => ( ! empty( $_POST['post_title'] ) ) ? sanitize_text_field( trim( $_POST['post_title'] ) ) : '',
118                         'post_content'  => ( ! empty( $_POST['post_content'] ) ) ? trim( $_POST['post_content'] ) : '',
119                         'post_type'     => 'post',
120                         'post_status'   => 'draft',
121                         'post_format'   => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '',
122                         'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
123                         'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
124                 );
125
126                 if ( ! empty( $_POST['post_status'] ) && 'publish' === $_POST['post_status'] ) {
127                         if ( current_user_can( 'publish_posts' ) ) {
128                                 $post['post_status'] = 'publish';
129                         } else {
130                                 $post['post_status'] = 'pending';
131                         }
132                 }
133
134                 $post['post_content'] = $this->side_load_images( $post_id, $post['post_content'] );
135
136                 $updated = wp_update_post( $post, true );
137
138                 if ( is_wp_error( $updated ) ) {
139                         wp_send_json_error( array( 'errorMessage' => $updated->get_error_message() ) );
140                 } else {
141                         if ( isset( $post['post_format'] ) ) {
142                                 if ( current_theme_supports( 'post-formats', $post['post_format'] ) ) {
143                                         set_post_format( $post_id, $post['post_format'] );
144                                 } elseif ( $post['post_format'] ) {
145                                         set_post_format( $post_id, false );
146                                 }
147                         }
148
149                         $forceRedirect = false;
150
151                         if ( 'publish' === get_post_status( $post_id ) ) {
152                                 $redirect = get_post_permalink( $post_id );
153                         } elseif ( isset( $_POST['pt-force-redirect'] ) && $_POST['pt-force-redirect'] === 'true' ) {
154                                 $forceRedirect = true;
155                                 $redirect = get_edit_post_link( $post_id, 'js' );
156                         } else {
157                                 $redirect = false;
158                         }
159
160                         /**
161                          * Filter the URL to redirect to when Press This saves.
162                          *
163                          * @since 4.2.0
164                          *
165                          * @param string $url     Redirect URL. If `$status` is 'publish', this will be the post permalink.
166                          *                        Otherwise, the default is false resulting in no redirect.
167                          * @param int    $post_id Post ID.
168                          * @param string $status  Post status.
169                          */
170                         $redirect = apply_filters( 'press_this_save_redirect', $redirect, $post_id, $post['post_status'] );
171
172                         if ( $redirect ) {
173                                 wp_send_json_success( array( 'redirect' => $redirect, 'force' => $forceRedirect ) );
174                         } else {
175                                 wp_send_json_success( array( 'postSaved' => true ) );
176                         }
177                 }
178         }
179
180         /**
181          * AJAX handler for adding a new category.
182          *
183          * @since 4.2.0
184          * @access public
185          */
186         public function add_category() {
187                 if ( false === wp_verify_nonce( $_POST['new_cat_nonce'], 'add-category' ) ) {
188                         wp_send_json_error();
189                 }
190
191                 $taxonomy = get_taxonomy( 'category' );
192
193                 if ( ! current_user_can( $taxonomy->cap->edit_terms ) || empty( $_POST['name'] ) ) {
194                         wp_send_json_error();
195                 }
196
197                 $parent = isset( $_POST['parent'] ) && (int) $_POST['parent'] > 0 ? (int) $_POST['parent'] : 0;
198                 $names = explode( ',', $_POST['name'] );
199                 $added = $data = array();
200
201                 foreach ( $names as $cat_name ) {
202                         $cat_name = trim( $cat_name );
203                         $cat_nicename = sanitize_title( $cat_name );
204
205                         if ( empty( $cat_nicename ) ) {
206                                 continue;
207                         }
208
209                         // @todo Find a more performant way to check existence, maybe get_term() with a separate parent check.
210                         if ( term_exists( $cat_name, $taxonomy->name, $parent ) ) {
211                                 if ( count( $names ) === 1 ) {
212                                         wp_send_json_error( array( 'errorMessage' => __( 'This category already exists.' ) ) );
213                                 } else {
214                                         continue;
215                                 }
216                         }
217
218                         $cat_id = wp_insert_term( $cat_name, $taxonomy->name, array( 'parent' => $parent ) );
219
220                         if ( is_wp_error( $cat_id ) ) {
221                                 continue;
222                         } elseif ( is_array( $cat_id ) ) {
223                                 $cat_id = $cat_id['term_id'];
224                         }
225
226                         $added[] = $cat_id;
227                 }
228
229                 if ( empty( $added ) ) {
230                         wp_send_json_error( array( 'errorMessage' => __( 'This category cannot be added. Please change the name and try again.' ) ) );
231                 }
232
233                 foreach ( $added as $new_cat_id ) {
234                         $new_cat = get_category( $new_cat_id );
235
236                         if ( is_wp_error( $new_cat ) ) {
237                                 wp_send_json_error( array( 'errorMessage' => __( 'Error while adding the category. Please try again later.' ) ) );
238                         }
239
240                         $data[] = array(
241                                 'term_id' => $new_cat->term_id,
242                                 'name' => $new_cat->name,
243                                 'parent' => $new_cat->parent,
244                         );
245                 }
246                 wp_send_json_success( $data );
247         }
248
249         /**
250          * Downloads the source's HTML via server-side call for the given URL.
251          *
252          * @since 4.2.0
253          * @access public
254          *
255          * @param string $url URL to scan.
256          * @return string Source's HTML sanitized markup
257          */
258         public function fetch_source_html( $url ) {
259                 global $wp_version;
260
261                 if ( empty( $url ) ) {
262                         return new WP_Error( 'invalid-url', __( 'A valid URL was not provided.' ) );
263                 }
264
265                 $remote_url = wp_safe_remote_get( $url, array(
266                         'timeout' => 30,
267                         // Use an explicit user-agent for Press This
268                         'user-agent' => 'Press This (WordPress/' . $wp_version . '); ' . get_bloginfo( 'url' )
269                 ) );
270
271                 if ( is_wp_error( $remote_url ) ) {
272                         return $remote_url;
273                 }
274
275                 $useful_html_elements = array(
276                         'img' => array(
277                                 'src'      => true,
278                                 'width'    => true,
279                                 'height'   => true,
280                         ),
281                         'iframe' => array(
282                                 'src'      => true,
283                         ),
284                         'link' => array(
285                                 'rel'      => true,
286                                 'itemprop' => true,
287                                 'href'     => true,
288                         ),
289                         'meta' => array(
290                                 'property' => true,
291                                 'name'     => true,
292                                 'content'  => true,
293                         )
294                 );
295
296                 $source_content = wp_remote_retrieve_body( $remote_url );
297                 $source_content = wp_kses( $source_content, $useful_html_elements );
298
299                 return $source_content;
300         }
301
302         /**
303          * Utility method to limit an array to 50 values.
304          *
305          * @ignore
306          * @since 4.2.0
307          *
308          * @param array $value Array to limit.
309          * @return array Original array if fewer than 50 values, limited array, empty array otherwise.
310          */
311         private function _limit_array( $value ) {
312                 if ( is_array( $value ) ) {
313                         if ( count( $value ) > 50 ) {
314                                 return array_slice( $value, 0, 50 );
315                         }
316
317                         return $value;
318                 }
319
320                 return array();
321         }
322
323         /**
324          * Utility method to limit the length of a given string to 5,000 characters.
325          *
326          * @ignore
327          * @since 4.2.0
328          *
329          * @param string $value String to limit.
330          * @return bool|int|string If boolean or integer, that value. If a string, the original value
331          *                         if fewer than 5,000 characters, a truncated version, otherwise an
332          *                         empty string.
333          */
334         private function _limit_string( $value ) {
335                 $return = '';
336
337                 if ( is_numeric( $value ) || is_bool( $value ) ) {
338                         $return = $value;
339                 } else if ( is_string( $value ) ) {
340                         if ( mb_strlen( $value ) > 5000 ) {
341                                 $return = mb_substr( $value, 0, 5000 );
342                         } else {
343                                 $return = $value;
344                         }
345
346                         $return = html_entity_decode( $return, ENT_QUOTES, 'UTF-8' );
347                         $return = sanitize_text_field( trim( $return ) );
348                 }
349
350                 return $return;
351         }
352
353         /**
354          * Utility method to limit a given URL to 2,048 characters.
355          *
356          * @ignore
357          * @since 4.2.0
358          *
359          * @param string $url URL to check for length and validity.
360          * @return string Escaped URL if of valid length (< 2048) and makeup. Empty string otherwise.
361          */
362         private function _limit_url( $url ) {
363                 if ( ! is_string( $url ) ) {
364                         return '';
365                 }
366
367                 // HTTP 1.1 allows 8000 chars but the "de-facto" standard supported in all current browsers is 2048.
368                 if ( strlen( $url ) > 2048 ) {
369                         return ''; // Return empty rather than a truncated/invalid URL
370                 }
371
372                 // Does not look like an URL.
373                 if ( ! preg_match( '/^([!#$&-;=?-\[\]_a-z~]|%[0-9a-fA-F]{2})+$/', $url ) ) {
374                         return '';
375                 }
376
377                 // If the URL is root-relative, prepend the protocol and domain name
378                 if ( $url && $this->domain && preg_match( '%^/[^/]+%', $url ) ) {
379                         $url = $this->domain . $url;
380                 }
381
382                 // Not absolute or protocol-relative URL.
383                 if ( ! preg_match( '%^(?:https?:)?//[^/]+%', $url ) ) {
384                         return '';
385                 }
386
387                 return esc_url_raw( $url, array( 'http', 'https' ) );
388         }
389
390         /**
391          * Utility method to limit image source URLs.
392          *
393          * Excluded URLs include share-this type buttons, loaders, spinners, spacers, WP interface images,
394          * tiny buttons or thumbs, mathtag.com or quantserve.com images, or the WP stats gif.
395          *
396          * @ignore
397          * @since 4.2.0
398          *
399          * @param string $src Image source URL.
400          * @return string If not matched an excluded URL type, the original URL, empty string otherwise.
401          */
402         private function _limit_img( $src ) {
403                 $src = $this->_limit_url( $src );
404
405                 if ( preg_match( '/\/ad[sx]{1}?\//', $src ) ) {
406                         // Ads
407                         return '';
408                 } else if ( preg_match( '/(\/share-?this[^\.]+?\.[a-z0-9]{3,4})(\?.*)?$/', $src ) ) {
409                         // Share-this type button
410                         return '';
411                 } else if ( preg_match( '/\/(spinner|loading|spacer|blank|rss)\.(gif|jpg|png)/', $src ) ) {
412                         // Loaders, spinners, spacers
413                         return '';
414                 } else if ( preg_match( '/\/([^\.\/]+[-_]{1})?(spinner|loading|spacer|blank)s?([-_]{1}[^\.\/]+)?\.[a-z0-9]{3,4}/', $src ) ) {
415                         // Fancy loaders, spinners, spacers
416                         return '';
417                 } else if ( preg_match( '/([^\.\/]+[-_]{1})?thumb[^.]*\.(gif|jpg|png)$/', $src ) ) {
418                         // Thumbnails, too small, usually irrelevant to context
419                         return '';
420                 } else if ( preg_match( '/\/wp-includes\//', $src ) ) {
421                         // Classic WP interface images
422                         return '';
423                 } else if ( preg_match( '/[^\d]{1}\d{1,2}x\d+\.(gif|jpg|png)$/', $src ) ) {
424                         // Most often tiny buttons/thumbs (< 100px wide)
425                         return '';
426                 } else if ( preg_match( '/\/pixel\.(mathtag|quantserve)\.com/', $src ) ) {
427                         // See mathtag.com and https://www.quantcast.com/how-we-do-it/iab-standard-measurement/how-we-collect-data/
428                         return '';
429                 } else if ( preg_match( '/\/[gb]\.gif(\?.+)?$/', $src ) ) {
430                         // Classic WP stats gif
431                         return '';
432                 }
433
434                 return $src;
435         }
436
437         /**
438          * Limit embed source URLs to specific providers.
439          *
440          * Not all core oEmbed providers are supported. Supported providers include YouTube, Vimeo,
441          * Vine, Daily Motion, SoundCloud, and Twitter.
442          *
443          * @ignore
444          * @since 4.2.0
445          *
446          * @param string $src Embed source URL.
447          * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
448          */
449         private function _limit_embed( $src ) {
450                 $src = $this->_limit_url( $src );
451
452                 if ( empty( $src ) )
453                         return '';
454
455                 if ( preg_match( '/\/\/(m|www)\.youtube\.com\/(embed|v)\/([^\?]+)\?.+$/', $src, $src_matches ) ) {
456                         // Embedded Youtube videos (www or mobile)
457                         $src = 'https://www.youtube.com/watch?v=' . $src_matches[3];
458                 } else if ( preg_match( '/\/\/player\.vimeo\.com\/video\/([\d]+)([\?\/]{1}.*)?$/', $src, $src_matches ) ) {
459                         // Embedded Vimeo iframe videos
460                         $src = 'https://vimeo.com/' . (int) $src_matches[1];
461                 } else if ( preg_match( '/\/\/vimeo\.com\/moogaloop\.swf\?clip_id=([\d]+)$/', $src, $src_matches ) ) {
462                         // Embedded Vimeo Flash videos
463                         $src = 'https://vimeo.com/' . (int) $src_matches[1];
464                 } else if ( preg_match( '/\/\/vine\.co\/v\/([^\/]+)\/embed/', $src, $src_matches ) ) {
465                         // Embedded Vine videos
466                         $src = 'https://vine.co/v/' . $src_matches[1];
467                 } else if ( preg_match( '/\/\/(www\.)?dailymotion\.com\/embed\/video\/([^\/\?]+)([\/\?]{1}.+)?/', $src, $src_matches ) ) {
468                         // Embedded Daily Motion videos
469                         $src = 'https://www.dailymotion.com/video/' . $src_matches[2];
470                 } else {
471                         require_once( ABSPATH . WPINC . '/class-oembed.php' );
472                         $oembed = _wp_oembed_get_object();
473
474                         if ( ! $oembed->get_provider( $src, array( 'discover' => false ) ) ) {
475                                 $src = '';
476                         }
477                 }
478
479                 return $src;
480         }
481
482         /**
483          * Process a meta data entry from the source.
484          *
485          * @ignore
486          * @since 4.2.0
487          *
488          * @param string $meta_name  Meta key name.
489          * @param mixed  $meta_value Meta value.
490          * @param array  $data       Associative array of source data.
491          * @return array Processed data array.
492          */
493         private function _process_meta_entry( $meta_name, $meta_value, $data ) {
494                 if ( preg_match( '/:?(title|description|keywords|site_name)$/', $meta_name ) ) {
495                         $data['_meta'][ $meta_name ] = $meta_value;
496                 } else {
497                         switch ( $meta_name ) {
498                                 case 'og:url':
499                                 case 'og:video':
500                                 case 'og:video:secure_url':
501                                         $meta_value = $this->_limit_embed( $meta_value );
502
503                                         if ( ! isset( $data['_embeds'] ) ) {
504                                                 $data['_embeds'] = array();
505                                         }
506
507                                         if ( ! empty( $meta_value ) && ! in_array( $meta_value, $data['_embeds'] ) ) {
508                                                 $data['_embeds'][] = $meta_value;
509                                         }
510
511                                         break;
512                                 case 'og:image':
513                                 case 'og:image:secure_url':
514                                 case 'twitter:image0:src':
515                                 case 'twitter:image0':
516                                 case 'twitter:image:src':
517                                 case 'twitter:image':
518                                         $meta_value = $this->_limit_img( $meta_value );
519
520                                         if ( ! isset( $data['_images'] ) ) {
521                                                 $data['_images'] = array();
522                                         }
523
524                                         if ( ! empty( $meta_value ) && ! in_array( $meta_value, $data['_images'] ) ) {
525                                                 $data['_images'][] = $meta_value;
526                                         }
527
528                                         break;
529                         }
530                 }
531
532                 return $data;
533         }
534
535         /**
536          * Fetches and parses _meta, _images, and _links data from the source.
537          *
538          * @since 4.2.0
539          * @access public
540          *
541          * @param string $url  URL to scan.
542          * @param array  $data Optional. Existing data array if you have one. Default empty array.
543          * @return array New data array.
544          */
545         public function source_data_fetch_fallback( $url, $data = array() ) {
546                 if ( empty( $url ) ) {
547                         return array();
548                 }
549
550                 // Download source page to tmp file.
551                 $source_content = $this->fetch_source_html( $url );
552                 if ( is_wp_error( $source_content ) ) {
553                         return array( 'errors' => $source_content->get_error_messages() );
554                 }
555
556                 // Fetch and gather <meta> data first, so discovered media is offered 1st to user.
557                 if ( empty( $data['_meta'] ) ) {
558                         $data['_meta'] = array();
559                 }
560
561                 if ( preg_match_all( '/<meta [^>]+>/', $source_content, $matches ) ) {
562                         $items = $this->_limit_array( $matches[0] );
563
564                         foreach ( $items as $value ) {
565                                 if ( preg_match( '/(property|name)="([^"]+)"[^>]+content="([^"]+)"/', $value, $new_matches ) ) {
566                                         $meta_name  = $this->_limit_string( $new_matches[2] );
567                                         $meta_value = $this->_limit_string( $new_matches[3] );
568
569                                         // Sanity check. $key is usually things like 'title', 'description', 'keywords', etc.
570                                         if ( strlen( $meta_name ) > 100 ) {
571                                                 continue;
572                                         }
573
574                                         $data = $this->_process_meta_entry( $meta_name, $meta_value, $data );
575                                 }
576                         }
577                 }
578
579                 // Fetch and gather <img> data.
580                 if ( empty( $data['_images'] ) ) {
581                         $data['_images'] = array();
582                 }
583
584                 if ( preg_match_all( '/<img [^>]+>/', $source_content, $matches ) ) {
585                         $items = $this->_limit_array( $matches[0] );
586
587                         foreach ( $items as $value ) {
588                                 if ( ( preg_match( '/width=(\'|")(\d+)\\1/i', $value, $new_matches ) && $new_matches[2] < 256 ) ||
589                                         ( preg_match( '/height=(\'|")(\d+)\\1/i', $value, $new_matches ) && $new_matches[2] < 128 ) ) {
590
591                                         continue;
592                                 }
593
594                                 if ( preg_match( '/src=(\'|")([^\'"]+)\\1/i', $value, $new_matches ) ) {
595                                         $src = $this->_limit_img( $new_matches[2] );
596                                         if ( ! empty( $src ) && ! in_array( $src, $data['_images'] ) ) {
597                                                 $data['_images'][] = $src;
598                                         }
599                                 }
600                         }
601                 }
602
603                 // Fetch and gather <iframe> data.
604                 if ( empty( $data['_embeds'] ) ) {
605                         $data['_embeds'] = array();
606                 }
607
608                 if ( preg_match_all( '/<iframe [^>]+>/', $source_content, $matches ) ) {
609                         $items = $this->_limit_array( $matches[0] );
610
611                         foreach ( $items as $value ) {
612                                 if ( preg_match( '/src=(\'|")([^\'"]+)\\1/', $value, $new_matches ) ) {
613                                         $src = $this->_limit_embed( $new_matches[2] );
614
615                                         if ( ! empty( $src ) && ! in_array( $src, $data['_embeds'] ) ) {
616                                                 $data['_embeds'][] = $src;
617                                         }
618                                 }
619                         }
620                 }
621
622                 // Fetch and gather <link> data.
623                 if ( empty( $data['_links'] ) ) {
624                         $data['_links'] = array();
625                 }
626
627                 if ( preg_match_all( '/<link [^>]+>/', $source_content, $matches ) ) {
628                         $items = $this->_limit_array( $matches[0] );
629
630                         foreach ( $items as $value ) {
631                                 if ( preg_match( '/rel=["\'](canonical|shortlink|icon)["\']/i', $value, $matches_rel ) && preg_match( '/href=[\'"]([^\'" ]+)[\'"]/i', $value, $matches_url ) ) {
632                                         $rel = $matches_rel[1];
633                                         $url = $this->_limit_url( $matches_url[1] );
634
635                                         if ( ! empty( $url ) && empty( $data['_links'][ $rel ] ) ) {
636                                                 $data['_links'][ $rel ] = $url;
637                                         }
638                                 }
639                         }
640                 }
641
642                 return $data;
643         }
644
645         /**
646          * Handles backward-compat with the legacy version of Press This by supporting its query string params.
647          *
648          * @since 4.2.0
649          * @access public
650          *
651          * @return array
652          */
653         public function merge_or_fetch_data() {
654                 // Get data from $_POST and $_GET, as appropriate ($_POST > $_GET), to remain backward compatible.
655                 $data = array();
656
657                 // Only instantiate the keys we want. Sanity check and sanitize each one.
658                 foreach ( array( 'u', 's', 't', 'v' ) as $key ) {
659                         if ( ! empty( $_POST[ $key ] ) ) {
660                                 $value = wp_unslash( $_POST[ $key ] );
661                         } else if ( ! empty( $_GET[ $key ] ) ) {
662                                 $value = wp_unslash( $_GET[ $key ] );
663                         } else {
664                                 continue;
665                         }
666
667                         if ( 'u' === $key ) {
668                                 $value = $this->_limit_url( $value );
669
670                                 if ( preg_match( '%^(?:https?:)?//[^/]+%i', $value, $domain_match ) ) {
671                                         $this->domain = $domain_match[0];
672                                 }
673                         } else {
674                                 $value = $this->_limit_string( $value );
675                         }
676
677                         if ( ! empty( $value ) ) {
678                                 $data[ $key ] = $value;
679                         }
680                 }
681
682                 /**
683                  * Filter whether to enable in-source media discovery in Press This.
684                  *
685                  * @since 4.2.0
686                  *
687                  * @param bool $enable Whether to enable media discovery.
688                  */
689                 if ( apply_filters( 'enable_press_this_media_discovery', true ) ) {
690                         /*
691                          * If no title, _images, _embed, and _meta was passed via $_POST, fetch data from source as fallback,
692                          * making PT fully backward compatible with the older bookmarklet.
693                          */
694                         if ( empty( $_POST ) && ! empty( $data['u'] ) ) {
695                                 $data = $this->source_data_fetch_fallback( $data['u'], $data );
696                         } else {
697                                 foreach ( array( '_images', '_embeds' ) as $type ) {
698                                         if ( empty( $_POST[ $type ] ) ) {
699                                                 continue;
700                                         }
701
702                                         $data[ $type ] = array();
703                                         $items = $this->_limit_array( $_POST[ $type ] );
704
705                                         foreach ( $items as $key => $value ) {
706                                                 if ( $type === '_images' ) {
707                                                         $value = $this->_limit_img( wp_unslash( $value ) );
708                                                 } else {
709                                                         $value = $this->_limit_embed( wp_unslash( $value ) );
710                                                 }
711
712                                                 if ( ! empty( $value ) ) {
713                                                         $data[ $type ][] = $value;
714                                                 }
715                                         }
716                                 }
717
718                                 foreach ( array( '_meta', '_links' ) as $type ) {
719                                         if ( empty( $_POST[ $type ] ) ) {
720                                                 continue;
721                                         }
722
723                                         $data[ $type ] = array();
724                                         $items = $this->_limit_array( $_POST[ $type ] );
725
726                                         foreach ( $items as $key => $value ) {
727                                                 // Sanity check. These are associative arrays, $key is usually things like 'title', 'description', 'keywords', etc.
728                                                 if ( empty( $key ) || strlen( $key ) > 100 ) {
729                                                         continue;
730                                                 }
731
732                                                 if ( $type === '_meta' ) {
733                                                         $value = $this->_limit_string( wp_unslash( $value ) );
734
735                                                         if ( ! empty( $value ) ) {
736                                                                 $data = $this->_process_meta_entry( $key, $value, $data );
737                                                         }
738                                                 } else {
739                                                         if ( in_array( $key, array( 'canonical', 'shortlink', 'icon' ), true ) ) {
740                                                                 $data[ $type ][ $key ] = $this->_limit_url( wp_unslash( $value ) );
741                                                         }
742                                                 }
743                                         }
744                                 }
745                         }
746
747                         // Support passing a single image src as `i`
748                         if ( ! empty( $_REQUEST['i'] ) && ( $img_src = $this->_limit_img( wp_unslash( $_REQUEST['i'] ) ) ) ) {
749                                 if ( empty( $data['_images'] ) ) {
750                                         $data['_images'] = array( $img_src );
751                                 } elseif ( ! in_array( $img_src, $data['_images'], true ) ) {
752                                         array_unshift( $data['_images'], $img_src );
753                                 }
754                         }
755                 }
756
757                 /**
758                  * Filter the Press This data array.
759                  *
760                  * @since 4.2.0
761                  *
762                  * @param array $data Press This Data array.
763                  */
764                 return apply_filters( 'press_this_data', $data );
765         }
766
767         /**
768          * Adds another stylesheet inside TinyMCE.
769          *
770          * @since 4.2.0
771          * @access public
772          *
773          * @param string $styles URL to editor stylesheet.
774          * @return string Possibly modified stylesheets list.
775          */
776         public function add_editor_style( $styles ) {
777                 if ( ! empty( $styles ) ) {
778                         $styles .= ',';
779                 }
780
781                 $press_this = admin_url( 'css/press-this-editor.css' );
782                 if ( is_rtl() ) {
783                         $press_this = str_replace( '.css', '-rtl.css', $press_this );
784                 }
785
786                 $open_sans_font_url = '';
787
788                 /* translators: If there are characters in your language that are not supported
789                  * by Open Sans, translate this to 'off'. Do not translate into your own language.
790                  */
791                 if ( 'off' !== _x( 'on', 'Open Sans font: on or off' ) ) {
792                         $subsets = 'latin,latin-ext';
793
794                         /* translators: To add an additional Open Sans character subset specific to your language,
795                          * translate this to 'greek', 'cyrillic' or 'vietnamese'. Do not translate into your own language.
796                          */
797                         $subset = _x( 'no-subset', 'Open Sans font: add new subset (greek, cyrillic, vietnamese)' );
798
799                         if ( 'cyrillic' == $subset ) {
800                                 $subsets .= ',cyrillic,cyrillic-ext';
801                         } elseif ( 'greek' == $subset ) {
802                                 $subsets .= ',greek,greek-ext';
803                         } elseif ( 'vietnamese' == $subset ) {
804                                 $subsets .= ',vietnamese';
805                         }
806
807                         $query_args = array(
808                                 'family' => urlencode( 'Open Sans:400italic,700italic,400,600,700' ),
809                                 'subset' => urlencode( $subsets ),
810                         );
811
812                         $open_sans_font_url = ',' . add_query_arg( $query_args, 'https://fonts.googleapis.com/css' );
813                 }
814
815                 return $styles . $press_this . $open_sans_font_url;
816         }
817
818         /**
819          * Outputs the post format selection HTML.
820          *
821          * @since 4.2.0
822          * @access public
823          *
824          * @param WP_Post $post Post object.
825          */
826         public function post_formats_html( $post ) {
827                 if ( current_theme_supports( 'post-formats' ) && post_type_supports( $post->post_type, 'post-formats' ) ) {
828                         $post_formats = get_theme_support( 'post-formats' );
829
830                         if ( is_array( $post_formats[0] ) ) {
831                                 $post_format = get_post_format( $post->ID );
832
833                                 if ( ! $post_format ) {
834                                         $post_format = '0';
835                                 }
836
837                                 // Add in the current one if it isn't there yet, in case the current theme doesn't support it.
838                                 if ( $post_format && ! in_array( $post_format, $post_formats[0] ) ) {
839                                         $post_formats[0][] = $post_format;
840                                 }
841
842                                 ?>
843                                 <div id="post-formats-select">
844                                 <fieldset><legend class="screen-reader-text"><?php _e( 'Post Formats' ); ?></legend>
845                                         <input type="radio" name="post_format" class="post-format" id="post-format-0" value="0" <?php checked( $post_format, '0' ); ?> />
846                                         <label for="post-format-0" class="post-format-icon post-format-standard"><?php echo get_post_format_string( 'standard' ); ?></label>
847                                         <?php
848
849                                         foreach ( $post_formats[0] as $format ) {
850                                                 $attr_format = esc_attr( $format );
851                                                 ?>
852                                                 <br />
853                                                 <input type="radio" name="post_format" class="post-format" id="post-format-<?php echo $attr_format; ?>" value="<?php echo $attr_format; ?>" <?php checked( $post_format, $format ); ?> />
854                                                 <label for="post-format-<?php echo $attr_format ?>" class="post-format-icon post-format-<?php echo $attr_format; ?>"><?php echo esc_html( get_post_format_string( $format ) ); ?></label>
855                                                 <?php
856                                          }
857
858                                          ?>
859                                 </fieldset>
860                                 </div>
861                                 <?php
862                         }
863                 }
864         }
865
866         /**
867          * Outputs the categories HTML.
868          *
869          * @since 4.2.0
870          * @access public
871          *
872          * @param WP_Post $post Post object.
873          */
874         public function categories_html( $post ) {
875                 $taxonomy = get_taxonomy( 'category' );
876
877                 if ( current_user_can( $taxonomy->cap->edit_terms ) ) {
878                         ?>
879                         <button type="button" class="add-cat-toggle button-subtle" aria-expanded="false">
880                                 <span class="dashicons dashicons-plus"></span><span class="screen-reader-text"><?php _e( 'Toggle add category' ); ?></span>
881                         </button>
882                         <div class="add-category is-hidden">
883                                 <label class="screen-reader-text" for="new-category"><?php echo $taxonomy->labels->add_new_item; ?></label>
884                                 <input type="text" id="new-category" class="add-category-name" placeholder="<?php echo esc_attr( $taxonomy->labels->new_item_name ); ?>" value="" aria-required="true">
885                                 <label class="screen-reader-text" for="new-category-parent"><?php echo $taxonomy->labels->parent_item_colon; ?></label>
886                                 <div class="postform-wrapper">
887                                         <?php
888                                         wp_dropdown_categories( array(
889                                                 'taxonomy'         => 'category',
890                                                 'hide_empty'       => 0,
891                                                 'name'             => 'new-category-parent',
892                                                 'orderby'          => 'name',
893                                                 'hierarchical'     => 1,
894                                                 'show_option_none' => '&mdash; ' . $taxonomy->labels->parent_item . ' &mdash;'
895                                         ) );
896                                         ?>
897                                 </div>
898                                 <button type="button" class="add-cat-submit"><?php _e( 'Add' ); ?></button>
899                         </div>
900                         <?php
901
902                 }
903                 ?>
904                 <div class="categories-search-wrapper">
905                         <input id="categories-search" type="search" class="categories-search" placeholder="<?php esc_attr_e( 'Search categories by name' ) ?>">
906                         <label for="categories-search">
907                                 <span class="dashicons dashicons-search"></span><span class="screen-reader-text"><?php _e( 'Search categories' ); ?></span>
908                         </label>
909                 </div>
910                 <div aria-label="<?php esc_attr_e( 'Categories' ); ?>">
911                         <ul class="categories-select">
912                                 <?php wp_terms_checklist( $post->ID, array( 'taxonomy' => 'category', 'list_only' => true ) ); ?>
913                         </ul>
914                 </div>
915                 <?php
916         }
917
918         /**
919          * Outputs the tags HTML.
920          *
921          * @since 4.2.0
922          * @access public
923          *
924          * @param WP_Post $post Post object.
925          */
926         public function tags_html( $post ) {
927                 $taxonomy              = get_taxonomy( 'post_tag' );
928                 $user_can_assign_terms = current_user_can( $taxonomy->cap->assign_terms );
929                 $esc_tags              = get_terms_to_edit( $post->ID, 'post_tag' );
930
931                 if ( ! $esc_tags || is_wp_error( $esc_tags ) ) {
932                         $esc_tags = '';
933                 }
934
935                 ?>
936                 <div class="tagsdiv" id="post_tag">
937                         <div class="jaxtag">
938                         <input type="hidden" name="tax_input[post_tag]" class="the-tags" value="<?php echo $esc_tags; // escaped in get_terms_to_edit() ?>">
939                         <?php
940
941                         if ( $user_can_assign_terms ) {
942                                 ?>
943                                 <div class="ajaxtag hide-if-no-js">
944                                         <label class="screen-reader-text" for="new-tag-post_tag"><?php _e( 'Tags' ); ?></label>
945                                         <p>
946                                                 <input type="text" id="new-tag-post_tag" name="newtag[post_tag]" class="newtag form-input-tip" size="16" autocomplete="off" value="" aria-describedby="new-tag-desc" />
947                                                 <button type="button" class="tagadd"><?php _e( 'Add' ); ?></button>
948                                         </p>
949                                 </div>
950                                 <p class="howto" id="new-tag-desc">
951                                         <?php echo $taxonomy->labels->separate_items_with_commas; ?>
952                                 </p>
953                                 <?php
954                         }
955
956                         ?>
957                         </div>
958                         <div class="tagchecklist"></div>
959                 </div>
960                 <?php
961
962                 if ( $user_can_assign_terms ) {
963                         ?>
964                         <button type="button" class="button-reset button-link tagcloud-link" id="link-post_tag"><?php echo $taxonomy->labels->choose_from_most_used; ?></button>
965                         <?php
966                 }
967         }
968
969         /**
970          * Get a list of embeds with no duplicates.
971          *
972          * @since 4.2.0
973          * @access public
974          *
975          * @param array $data The site's data.
976          * @return array Embeds selected to be available.
977          */
978         public function get_embeds( $data ) {
979                 $selected_embeds = array();
980
981                 // Make sure to add the Pressed page if it's a valid oembed itself
982                 if ( ! empty ( $data['u'] ) && $this->_limit_embed( $data['u'] ) ) {
983                         $data['_embeds'][] = $data['u'];
984                 }
985
986                 if ( ! empty( $data['_embeds'] ) ) {
987                         foreach( $data['_embeds'] as $src ) {
988                                 $prot_relative_src = preg_replace( '/^https?:/', '', $src );
989
990                                 if ( in_array( $prot_relative_src, $this->embeds ) ) {
991                                         continue;
992                                 }
993
994                                 $selected_embeds[] = $src;
995                                 $this->embeds[] = $prot_relative_src;
996                         }
997                 }
998
999                 return $selected_embeds;
1000         }
1001
1002         /**
1003          * Get a list of images with no duplicates.
1004          *
1005          * @since 4.2.0
1006          * @access public
1007          *
1008          * @param array $data The site's data.
1009          * @return array
1010          */
1011         public function get_images( $data ) {
1012                 $selected_images = array();
1013
1014                 if ( ! empty( $data['_images'] ) ) {
1015                         foreach( $data['_images'] as $src ) {
1016                                 if ( false !== strpos( $src, 'gravatar.com' ) ) {
1017                                         $src = preg_replace( '%http://[\d]+\.gravatar\.com/%', 'https://secure.gravatar.com/', $src );
1018                                 }
1019
1020                                 $prot_relative_src = preg_replace( '/^https?:/', '', $src );
1021
1022                                 if ( in_array( $prot_relative_src, $this->images ) ||
1023                                         ( false !== strpos( $src, 'avatar' ) && count( $this->images ) > 15 ) ) {
1024                                         // Skip: already selected or some type of avatar and we've already gathered more than 15 images.
1025                                         continue;
1026                                 }
1027
1028                                 $selected_images[] = $src;
1029                                 $this->images[] = $prot_relative_src;
1030                         }
1031                 }
1032
1033                 return $selected_images;
1034         }
1035
1036         /**
1037          * Gets the source page's canonical link, based on passed location and meta data.
1038          *
1039          * @since 4.2.0
1040          * @access public
1041          *
1042          * @param array $data The site's data.
1043          * @return string Discovered canonical URL, or empty
1044          */
1045         public function get_canonical_link( $data ) {
1046                 $link = '';
1047
1048                 if ( ! empty( $data['_links']['canonical'] ) ) {
1049                         $link = $data['_links']['canonical'];
1050                 } elseif ( ! empty( $data['u'] ) ) {
1051                         $link = $data['u'];
1052                 } elseif ( ! empty( $data['_meta'] ) ) {
1053                         if ( ! empty( $data['_meta']['twitter:url'] ) ) {
1054                                 $link = $data['_meta']['twitter:url'];
1055                         } else if ( ! empty( $data['_meta']['og:url'] ) ) {
1056                                 $link = $data['_meta']['og:url'];
1057                         }
1058                 }
1059
1060                 if ( empty( $link ) && ! empty( $data['_links']['shortlink'] ) ) {
1061                         $link = $data['_links']['shortlink'];
1062                 }
1063
1064                 return $link;
1065         }
1066
1067         /**
1068          * Gets the source page's site name, based on passed meta data.
1069          *
1070          * @since 4.2.0
1071          * @access public
1072          *
1073          * @param array $data The site's data.
1074          * @return string Discovered site name, or empty
1075          */
1076         public function get_source_site_name( $data ) {
1077                 $name = '';
1078
1079                 if ( ! empty( $data['_meta'] ) ) {
1080                         if ( ! empty( $data['_meta']['og:site_name'] ) ) {
1081                                 $name = $data['_meta']['og:site_name'];
1082                         } else if ( ! empty( $data['_meta']['application-name'] ) ) {
1083                                 $name = $data['_meta']['application-name'];
1084                         }
1085                 }
1086
1087                 return $name;
1088         }
1089
1090         /**
1091          * Gets the source page's title, based on passed title and meta data.
1092          *
1093          * @since 4.2.0
1094          * @access public
1095          *
1096          * @param array $data The site's data.
1097          * @return string Discovered page title, or empty
1098          */
1099         public function get_suggested_title( $data ) {
1100                 $title = '';
1101
1102                 if ( ! empty( $data['t'] ) ) {
1103                         $title = $data['t'];
1104                 } elseif ( ! empty( $data['_meta'] ) ) {
1105                         if ( ! empty( $data['_meta']['twitter:title'] ) ) {
1106                                 $title = $data['_meta']['twitter:title'];
1107                         } else if ( ! empty( $data['_meta']['og:title'] ) ) {
1108                                 $title = $data['_meta']['og:title'];
1109                         } else if ( ! empty( $data['_meta']['title'] ) ) {
1110                                 $title = $data['_meta']['title'];
1111                         }
1112                 }
1113
1114                 return $title;
1115         }
1116
1117         /**
1118          * Gets the source page's suggested content, based on passed data (description, selection, etc).
1119          *
1120          * Features a blockquoted excerpt, as well as content attribution, if any.
1121          *
1122          * @since 4.2.0
1123          * @access public
1124          *
1125          * @param array $data The site's data.
1126          * @return string Discovered content, or empty
1127          */
1128         public function get_suggested_content( $data ) {
1129                 $content = $text = '';
1130
1131                 if ( ! empty( $data['s'] ) ) {
1132                         $text = $data['s'];
1133                 } else if ( ! empty( $data['_meta'] ) ) {
1134                         if ( ! empty( $data['_meta']['twitter:description'] ) ) {
1135                                 $text = $data['_meta']['twitter:description'];
1136                         } else if ( ! empty( $data['_meta']['og:description'] ) ) {
1137                                 $text = $data['_meta']['og:description'];
1138                         } else if ( ! empty( $data['_meta']['description'] ) ) {
1139                                 $text = $data['_meta']['description'];
1140                         }
1141
1142                         // If there is an ellipsis at the end, the description is very likely auto-generated. Better to ignore it.
1143                         if ( $text && substr( $text, -3 ) === '...' ) {
1144                                 $text = '';
1145                         }
1146                 }
1147
1148                 $default_html = array( 'quote' => '', 'link' => '', 'embed' => '' );
1149
1150                 if ( ! empty( $data['u'] ) && $this->_limit_embed( $data['u'] ) ) {
1151                         $default_html['embed'] = '<p>[embed]' . $data['u'] . '[/embed]</p>';
1152
1153                         if ( ! empty( $data['s'] ) ) {
1154                                 // If the user has selected some text, do quote it.
1155                                 $default_html['quote'] = '<blockquote>%1$s</blockquote>';
1156                         }
1157                 } else {
1158                         $default_html['quote'] = '<blockquote>%1$s</blockquote>';
1159                         $default_html['link'] = '<p>' . _x( 'Source:', 'Used in Press This to indicate where the content comes from.' ) .
1160                                 ' <em><a href="%1$s">%2$s</a></em></p>';
1161                 }
1162
1163                 /**
1164                  * Filter the default HTML for the Press This editor.
1165                  *
1166                  * @since 4.2.0
1167                  *
1168                  * @param array $default_html Associative array with two keys: 'quote' where %1$s is replaced with the site description
1169                  *                            or the selected content, and 'link' there %1$s is link href, %2$s is link text.
1170                  */
1171                 $default_html = apply_filters( 'press_this_suggested_html', $default_html, $data );
1172
1173                 if ( ! empty( $default_html['embed'] ) ) {
1174                         $content .= $default_html['embed'];
1175                 }
1176
1177                 // Wrap suggested content in the specified HTML.
1178                 if ( ! empty( $default_html['quote'] ) && $text ) {
1179                         $content .= sprintf( $default_html['quote'], $text );
1180                 }
1181
1182                 // Add source attribution if there is one available.
1183                 if ( ! empty( $default_html['link'] ) ) {
1184                         $title = $this->get_suggested_title( $data );
1185                         $url = $this->get_canonical_link( $data );
1186
1187                         if ( ! $title ) {
1188                                 $title = $this->get_source_site_name( $data );
1189                         }
1190
1191                         if ( $url && $title ) {
1192                                 $content .= sprintf( $default_html['link'], $url, $title );
1193                         }
1194                 }
1195
1196                 return $content;
1197         }
1198
1199         /**
1200          * Serves the app's base HTML, which in turns calls the load script.
1201          *
1202          * @since 4.2.0
1203          * @access public
1204          *
1205          * @global WP_Locale $wp_locale
1206          * @global string    $wp_version
1207          * @global bool      $is_IE
1208          */
1209         public function html() {
1210                 global $wp_locale, $wp_version;
1211
1212                 // Get data, new (POST) and old (GET).
1213                 $data = $this->merge_or_fetch_data();
1214
1215                 $post_title = $this->get_suggested_title( $data );
1216
1217                 $post_content = $this->get_suggested_content( $data );
1218
1219                 // Get site settings array/data.
1220                 $site_settings = $this->site_settings();
1221
1222                 // Pass the images and embeds
1223                 $images = $this->get_images( $data );
1224                 $embeds = $this->get_embeds( $data );
1225
1226                 $site_data = array(
1227                         'v' => ! empty( $data['v'] ) ? $data['v'] : '',
1228                         'u' => ! empty( $data['u'] ) ? $data['u'] : '',
1229                         'hasData' => ! empty( $data ),
1230                 );
1231
1232                 if ( ! empty( $images ) ) {
1233                         $site_data['_images'] = $images;
1234                 }
1235
1236                 if ( ! empty( $embeds ) ) {
1237                         $site_data['_embeds'] = $embeds;
1238                 }
1239
1240                 // Add press-this-editor.css and remove theme's editor-style.css, if any.
1241                 remove_editor_styles();
1242
1243                 add_filter( 'mce_css', array( $this, 'add_editor_style' ) );
1244
1245                 if ( ! empty( $GLOBALS['is_IE'] ) ) {
1246                         @header( 'X-UA-Compatible: IE=edge' );
1247                 }
1248
1249                 @header( 'Content-Type: ' . get_option( 'html_type' ) . '; charset=' . get_option( 'blog_charset' ) );
1250
1251 ?>
1252 <!DOCTYPE html>
1253 <!--[if IE 7]>         <html class="lt-ie9 lt-ie8" <?php language_attributes(); ?>> <![endif]-->
1254 <!--[if IE 8]>         <html class="lt-ie9" <?php language_attributes(); ?>> <![endif]-->
1255 <!--[if gt IE 8]><!--> <html <?php language_attributes(); ?>> <!--<![endif]-->
1256 <head>
1257         <meta http-equiv="Content-Type" content="<?php echo esc_attr( get_bloginfo( 'html_type' ) ); ?>; charset=<?php echo esc_attr( get_option( 'blog_charset' ) ); ?>" />
1258         <meta name="viewport" content="width=device-width">
1259         <title><?php esc_html_e( 'Press This!' ) ?></title>
1260
1261         <script>
1262                 window.wpPressThisData   = <?php echo wp_json_encode( $site_data ); ?>;
1263                 window.wpPressThisConfig = <?php echo wp_json_encode( $site_settings ); ?>;
1264         </script>
1265
1266         <script type="text/javascript">
1267                 var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
1268                         pagenow = 'press-this',
1269                         typenow = 'post',
1270                         adminpage = 'press-this-php',
1271                         thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
1272                         decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
1273                         isRtl = <?php echo (int) is_rtl(); ?>;
1274         </script>
1275
1276         <?php
1277                 /*
1278                  * $post->ID is needed for the embed shortcode so we can show oEmbed previews in the editor.
1279                  * Maybe find a way without it.
1280                  */
1281                 $post = get_default_post_to_edit( 'post', true );
1282                 $post_ID = (int) $post->ID;
1283
1284                 wp_enqueue_media( array( 'post' => $post_ID ) );
1285                 wp_enqueue_style( 'press-this' );
1286                 wp_enqueue_script( 'press-this' );
1287                 wp_enqueue_script( 'json2' );
1288                 wp_enqueue_script( 'editor' );
1289
1290                 $supports_formats = false;
1291                 $post_format      = 0;
1292
1293                 if ( current_theme_supports( 'post-formats' ) && post_type_supports( $post->post_type, 'post-formats' ) ) {
1294                         $supports_formats = true;
1295
1296                         if ( ! ( $post_format = get_post_format( $post_ID ) ) ) {
1297                                 $post_format = 0;
1298                         }
1299                 }
1300
1301                 /** This action is documented in wp-admin/admin-header.php */
1302                 do_action( 'admin_enqueue_scripts', 'press-this.php' );
1303
1304                 /** This action is documented in wp-admin/admin-header.php */
1305                 do_action( 'admin_print_styles-press-this.php' );
1306
1307                 /** This action is documented in wp-admin/admin-header.php */
1308                 do_action( 'admin_print_styles' );
1309
1310                 /** This action is documented in wp-admin/admin-header.php */
1311                 do_action( 'admin_print_scripts-press-this.php' );
1312
1313                 /** This action is documented in wp-admin/admin-header.php */
1314                 do_action( 'admin_print_scripts' );
1315
1316                 /** This action is documented in wp-admin/admin-header.php */
1317                 do_action( 'admin_head-press-this.php' );
1318
1319                 /** This action is documented in wp-admin/admin-header.php */
1320                 do_action( 'admin_head' );
1321         ?>
1322 </head>
1323 <?php
1324
1325         $admin_body_class  = 'press-this';
1326         $admin_body_class .= ( is_rtl() ) ? ' rtl' : '';
1327         $admin_body_class .= ' branch-' . str_replace( array( '.', ',' ), '-', floatval( $wp_version ) );
1328         $admin_body_class .= ' version-' . str_replace( '.', '-', preg_replace( '/^([.0-9]+).*/', '$1', $wp_version ) );
1329         $admin_body_class .= ' admin-color-' . sanitize_html_class( get_user_option( 'admin_color' ), 'fresh' );
1330         $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
1331
1332         /** This filter is documented in wp-admin/admin-header.php */
1333         $admin_body_classes = apply_filters( 'admin_body_class', '' );
1334
1335 ?>
1336 <body class="wp-admin wp-core-ui <?php echo $admin_body_classes . ' ' . $admin_body_class; ?>">
1337         <div id="adminbar" class="adminbar">
1338                 <h1 id="current-site" class="current-site">
1339                         <a class="current-site-link" href="<?php echo esc_url( home_url( '/' ) ); ?>" target="_blank" rel="home">
1340                                 <span class="dashicons dashicons-wordpress"></span>
1341                                 <span class="current-site-name"><?php bloginfo( 'name' ); ?></span>
1342                         </a>
1343                 </h1>
1344                 <button type="button" class="options button-subtle closed">
1345                         <span class="dashicons dashicons-tag on-closed"></span>
1346                         <span class="screen-reader-text on-closed"><?php _e( 'Show post options' ); ?></span>
1347                         <span aria-hidden="true" class="on-open"><?php _e( 'Done' ); ?></span>
1348                         <span class="screen-reader-text on-open"><?php _e( 'Hide post options' ); ?></span>
1349                 </button>
1350         </div>
1351
1352         <div id="scanbar" class="scan">
1353                 <form method="GET">
1354                         <label for="url-scan" class="screen-reader-text"><?php _e( 'Scan site for content' ); ?></label>
1355                         <input type="url" name="u" id="url-scan" class="scan-url" value="" placeholder="<?php esc_attr_e( 'Enter a URL to scan' ) ?>" />
1356                         <input type="submit" name="url-scan-submit" id="url-scan-submit" class="scan-submit" value="<?php esc_attr_e( 'Scan' ) ?>" />
1357                 </form>
1358         </div>
1359
1360         <form id="pressthis-form" method="post" action="post.php" autocomplete="off">
1361                 <input type="hidden" name="post_ID" id="post_ID" value="<?php echo $post_ID; ?>" />
1362                 <input type="hidden" name="action" value="press-this-save-post" />
1363                 <input type="hidden" name="post_status" id="post_status" value="draft" />
1364                 <input type="hidden" name="wp-preview" id="wp-preview" value="" />
1365                 <input type="hidden" name="post_title" id="post_title" value="" />
1366                 <input type="hidden" name="pt-force-redirect" id="pt-force-redirect" value="" />
1367                 <?php
1368
1369                 wp_nonce_field( 'update-post_' . $post_ID, '_wpnonce', false );
1370                 wp_nonce_field( 'add-category', '_ajax_nonce-add-category', false );
1371
1372                 ?>
1373
1374         <div class="wrapper">
1375                 <div class="editor-wrapper">
1376                         <div class="alerts" role="alert" aria-live="assertive" aria-relevant="all" aria-atomic="true">
1377                                 <?php
1378
1379                                 if ( isset( $data['v'] ) && $this->version > $data['v'] ) {
1380                                         ?>
1381                                         <p class="alert is-notice">
1382                                                 <?php printf( __( 'You should upgrade <a href="%s" target="_blank">your bookmarklet</a> to the latest version!' ), admin_url( 'tools.php' ) ); ?>
1383                                         </p>
1384                                         <?php
1385                                 }
1386
1387                                 ?>
1388                         </div>
1389
1390                         <div id="app-container" class="editor">
1391                                 <span id="title-container-label" class="post-title-placeholder" aria-hidden="true"><?php _e( 'Post title' ); ?></span>
1392                                 <h2 id="title-container" class="post-title" contenteditable="true" spellcheck="true" aria-label="<?php esc_attr_e( 'Post title' ); ?>" tabindex="0"><?php echo esc_html( $post_title ); ?></h2>
1393
1394                                 <div class="media-list-container">
1395                                         <div class="media-list-inner-container">
1396                                                 <h2 class="screen-reader-text"><?php _e( 'Suggested media' ); ?></h2>
1397                                                 <ul class="media-list"></ul>
1398                                         </div>
1399                                 </div>
1400
1401                                 <?php
1402                                 wp_editor( $post_content, 'pressthis', array(
1403                                         'drag_drop_upload' => true,
1404                                         'editor_height'    => 600,
1405                                         'media_buttons'    => false,
1406                                         'textarea_name'    => 'post_content',
1407                                         'teeny'            => true,
1408                                         'tinymce'          => array(
1409                                                 'resize'                => false,
1410                                                 'wordpress_adv_hidden'  => false,
1411                                                 'add_unload_trigger'    => false,
1412                                                 'statusbar'             => false,
1413                                                 'autoresize_min_height' => 600,
1414                                                 'wp_autoresize_on'      => true,
1415                                                 'plugins'               => 'lists,media,paste,tabfocus,fullscreen,wordpress,wpautoresize,wpeditimage,wpgallery,wplink,wptextpattern,wpview',
1416                                                 'toolbar1'              => 'bold,italic,bullist,numlist,blockquote,link,unlink',
1417                                                 'toolbar2'              => 'undo,redo',
1418                                         ),
1419                                         'quicktags' => array(
1420                                                 'buttons' => 'strong,em,link,block,del,ins,img,ul,ol,li,code,more',
1421                                         ),
1422                                 ) );
1423
1424                                 ?>
1425                         </div>
1426                 </div>
1427
1428                 <div class="options-panel-back is-hidden" tabindex="-1"></div>
1429                 <div class="options-panel is-off-screen is-hidden" tabindex="-1">
1430                         <div class="post-options">
1431
1432                                 <?php if ( $supports_formats ) : ?>
1433                                         <button type="button" class="button-reset post-option">
1434                                                 <span class="dashicons dashicons-admin-post"></span>
1435                                                 <span class="post-option-title"><?php _ex( 'Format', 'post format' ); ?></span>
1436                                                 <span class="post-option-contents" id="post-option-post-format"><?php echo esc_html( get_post_format_string( $post_format ) ); ?></span>
1437                                                 <span class="dashicons post-option-forward"></span>
1438                                         </button>
1439                                 <?php endif; ?>
1440
1441                                 <button type="button" class="button-reset post-option">
1442                                         <span class="dashicons dashicons-category"></span>
1443                                         <span class="post-option-title"><?php _e( 'Categories' ); ?></span>
1444                                         <span class="dashicons post-option-forward"></span>
1445                                 </button>
1446
1447                                 <button type="button" class="button-reset post-option">
1448                                         <span class="dashicons dashicons-tag"></span>
1449                                         <span class="post-option-title"><?php _e( 'Tags' ); ?></span>
1450                                         <span class="dashicons post-option-forward"></span>
1451                                 </button>
1452                         </div>
1453
1454                         <?php if ( $supports_formats ) : ?>
1455                                 <div class="setting-modal is-off-screen is-hidden">
1456                                         <button type="button" class="button-reset modal-close">
1457                                                 <span class="dashicons post-option-back"></span>
1458                                                 <span class="setting-title" aria-hidden="true"><?php _ex( 'Format', 'post format' ); ?></span>
1459                                                 <span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
1460                                         </button>
1461                                         <?php $this->post_formats_html( $post ); ?>
1462                                 </div>
1463                         <?php endif; ?>
1464
1465                         <div class="setting-modal is-off-screen is-hidden">
1466                                 <button type="button" class="button-reset modal-close">
1467                                         <span class="dashicons post-option-back"></span>
1468                                         <span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
1469                                         <span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
1470                                 </button>
1471                                 <?php $this->categories_html( $post ); ?>
1472                         </div>
1473
1474                         <div class="setting-modal tags is-off-screen is-hidden">
1475                                 <button type="button" class="button-reset modal-close">
1476                                         <span class="dashicons post-option-back"></span>
1477                                         <span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
1478                                         <span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
1479                                 </button>
1480                                 <?php $this->tags_html( $post ); ?>
1481                         </div>
1482                 </div><!-- .options-panel -->
1483         </div><!-- .wrapper -->
1484
1485         <div class="press-this-actions">
1486                 <div class="pressthis-media-buttons">
1487                         <button type="button" class="insert-media button-subtle" data-editor="pressthis">
1488                                 <span class="dashicons dashicons-admin-media"></span>
1489                                 <span class="screen-reader-text"><?php _e( 'Add Media' ); ?></span>
1490                         </button>
1491                 </div>
1492                 <div class="post-actions">
1493                         <span class="spinner">&nbsp;</span>
1494                         <div class="split-button">
1495                                 <div class="split-button-head">
1496                                         <button type="button" class="publish-button split-button-primary" aria-live="polite">
1497                                                 <span class="publish"><?php echo ( current_user_can( 'publish_posts' ) ) ? __( 'Publish' ) : __( 'Submit for Review' ); ?></span>
1498                                                 <span class="saving-draft"><?php _e( 'Saving...' ); ?></span>
1499                                         </button><button type="button" class="split-button-toggle" aria-haspopup="true" aria-expanded="false">
1500                                                 <i class="dashicons dashicons-arrow-down-alt2"></i>
1501                                                 <span class="screen-reader-text"><?php _e('More actions'); ?></span>
1502                                         </button>
1503                                 </div>
1504                                 <ul class="split-button-body">
1505                                         <li><button type="button" class="button-subtle draft-button split-button-option"><?php _e( 'Save Draft' ); ?></button></li>
1506                                         <li><button type="button" class="button-subtle standard-editor-button split-button-option"><?php _e( 'Standard Editor' ); ?></button></li>
1507                                         <li><button type="button" class="button-subtle preview-button split-button-option"><?php _e( 'Preview' ); ?></button></li>
1508                                 </ul>
1509                         </div>
1510                 </div>
1511         </div>
1512         </form>
1513
1514         <?php
1515         /** This action is documented in wp-admin/admin-footer.php */
1516         do_action( 'admin_footer' );
1517
1518         /** This action is documented in wp-admin/admin-footer.php */
1519         do_action( 'admin_print_footer_scripts' );
1520
1521         /** This action is documented in wp-admin/admin-footer.php */
1522         do_action( 'admin_footer-press-this.php' );
1523         ?>
1524 </body>
1525 </html>
1526 <?php
1527                 die();
1528         }
1529 }
1530
1531 /**
1532  *
1533  * @global WP_Press_This $wp_press_this
1534  */
1535 $GLOBALS['wp_press_this'] = new WP_Press_This;