<h2>File Contents: /home/planet5/public_html/wp-includes/customize/class-wp-customize-custom-css-setting.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-includes/customize/class-wp-customize-custom-css-setting.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php
/**
 * Customize API: WP_Customize_Custom_CSS_Setting class
 *
 * This handles validation, sanitization and saving of the value.
 *
 * @package WordPress
 * @subpackage Customize
 * @since 4.7.0
 */

/**
 * Custom Setting to handle WP Custom CSS.
 *
 * @since 4.7.0
 *
 * @see WP_Customize_Setting
 */
final class WP_Customize_Custom_CSS_Setting extends WP_Customize_Setting {

	/**
	 * The setting type.
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $type = &#039;custom_css&#039;;

	/**
	 * Setting Transport
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $transport = &#039;postMessage&#039;;

	/**
	 * Capability required to edit this setting.
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $capability = &#039;edit_css&#039;;

	/**
	 * Stylesheet
	 *
	 * @since 4.7.0
	 * @var string
	 */
	public $stylesheet = &#039;&#039;;

	/**
	 * WP_Customize_Custom_CSS_Setting constructor.
	 *
	 * @since 4.7.0
	 *
	 * @throws Exception If the setting ID does not match the pattern `custom_css[$stylesheet]`.
	 *
	 * @param WP_Customize_Manager $manager Customizer bootstrap instance.
	 * @param string               $id      A specific ID of the setting.
	 *                                      Can be a theme mod or option name.
	 * @param array                $args    Setting arguments.
	 */
	public function __construct( $manager, $id, $args = array() ) {
		parent::__construct( $manager, $id, $args );
		if ( &#039;custom_css&#039; !== $this-&gt;id_data[&#039;base&#039;] ) {
			throw new Exception( &#039;Expected custom_css id_base.&#039; );
		}
		if ( 1 !== count( $this-&gt;id_data[&#039;keys&#039;] ) || empty( $this-&gt;id_data[&#039;keys&#039;][0] ) ) {
			throw new Exception( &#039;Expected single stylesheet key.&#039; );
		}
		$this-&gt;stylesheet = $this-&gt;id_data[&#039;keys&#039;][0];
	}

	/**
	 * Add filter to preview post value.
	 *
	 * @since 4.7.9
	 *
	 * @return bool False when preview short-circuits due no change needing to be previewed.
	 */
	public function preview() {
		if ( $this-&gt;is_previewed ) {
			return false;
		}
		$this-&gt;is_previewed = true;
		add_filter( &#039;wp_get_custom_css&#039;, array( $this, &#039;filter_previewed_wp_get_custom_css&#039; ), 9, 2 );
		return true;
	}

	/**
	 * Filters `wp_get_custom_css` for applying the customized value.
	 *
	 * This is used in the preview when `wp_get_custom_css()` is called for rendering the styles.
	 *
	 * @since 4.7.0
	 *
	 * @see wp_get_custom_css()
	 *
	 * @param string $css        Original CSS.
	 * @param string $stylesheet Current stylesheet.
	 * @return string CSS.
	 */
	public function filter_previewed_wp_get_custom_css( $css, $stylesheet ) {
		if ( $stylesheet === $this-&gt;stylesheet ) {
			$customized_value = $this-&gt;post_value( null );
			if ( ! is_null( $customized_value ) ) {
				$css = $customized_value;
			}
		}
		return $css;
	}

	/**
	 * Fetch the value of the setting. Will return the previewed value when `preview()` is called.
	 *
	 * @since 4.7.0
	 *
	 * @see WP_Customize_Setting::value()
	 *
	 * @return string
	 */
	public function value() {
		if ( $this-&gt;is_previewed ) {
			$post_value = $this-&gt;post_value( null );
			if ( null !== $post_value ) {
				return $post_value;
			}
		}
		$id_base = $this-&gt;id_data[&#039;base&#039;];
		$value   = &#039;&#039;;
		$post    = wp_get_custom_css_post( $this-&gt;stylesheet );
		if ( $post ) {
			$value = $post-&gt;post_content;
		}
		if ( empty( $value ) ) {
			$value = $this-&gt;default;
		}

		/** This filter is documented in wp-includes/class-wp-customize-setting.php */
		$value = apply_filters( &quot;customize_value_{$id_base}&quot;, $value, $this );

		return $value;
	}

	/**
	 * Validate a received value for being valid CSS.
	 *
	 * Checks for imbalanced braces, brackets, and comments.
	 * Notifications are rendered when the customizer state is saved.
	 *
	 * @since 4.7.0
	 * @since 4.9.0 Checking for balanced characters has been moved client-side via linting in code editor.
	 * @since 5.9.0 Renamed `$css` to `$value` for PHP 8 named parameter support.
	 * @since 7.0.0 Only restricts contents which risk prematurely closing the STYLE element,
	 *              either through a STYLE end tag or a prefix of one which might become a
	 *              full end tag when combined with the contents of other styles.
	 *
	 * @see WP_REST_Global_Styles_Controller::validate_custom_css()
	 *
	 * @param string $value CSS to validate.
	 * @return true|WP_Error True if the input was validated, otherwise WP_Error.
	 */
	public function validate( $value ) {
		// Restores the more descriptive, specific name for use within this method.
		$css = $value;

		$validity = new WP_Error();

		$length = strlen( $css );
		for (
			$at = strcspn( $css, &#039;&lt;&#039; );
			$at &lt; $length;
			$at += strcspn( $css, &#039;&lt;&#039;, ++$at )
		) {
			$remaining_strlen = $length - $at;
			/**
			 * Custom CSS text is expected to render inside an HTML STYLE element.
			 * A STYLE closing tag must not appear within the CSS text because it
			 * would close the element prematurely.
			 *
			 * The text must also *not* end with a partial closing tag (e.g., `&lt;`,
			 * `&lt;/`, … `&lt;/style`) because subsequent styles which are concatenated
			 * could complete it, forming a valid `&lt;/style&gt;` tag.
			 *
			 * Example:
			 *
			 *     $style_a = &#039;p { font-weight: bold; &lt;/sty&#039;;
			 *     $style_b = &#039;le&gt; gotcha!&#039;;
			 *     $combined = &quot;{$style_a}{$style_b}&quot;;
			 *
			 *     $style_a = &#039;p { font-weight: bold; &lt;/style&#039;;
			 *     $style_b = &#039;p &gt; b { color: red; }&#039;;
			 *     $combined = &quot;{$style_a}\n{$style_b}&quot;;
			 *
			 * Note how in the second example, both of the style contents are benign
			 * when analyzed on their own. The first style was likely the result of
			 * improper truncation, while the second is perfectly sound. It was only
			 * through concatenation that these two styles combined to form content
			 * that would have broken out of the containing STYLE element, thus
			 * corrupting the page and potentially introducing security issues.
			 *
			 * @see https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state
			 */
			$possible_style_close_tag = 0 === substr_compare(
				$css,
				&#039;&lt;/style&#039;,
				$at,
				min( 7, $remaining_strlen ),
				true
			);
			if ( $possible_style_close_tag ) {
				if ( $remaining_strlen &lt; 8 ) {
					$validity-&gt;add(
						&#039;illegal_markup&#039;,
						sprintf(
							/* translators: %s is the CSS that was provided. */
							__( &#039;The CSS must not end in &quot;%s&quot;.&#039; ),
							esc_html( substr( $css, $at ) )
						)
					);
					break;
				}

				if ( 1 === strspn( $css, &quot; \t\f\r\n/&gt;&quot;, $at + 7, 1 ) ) {
					$validity-&gt;add(
						&#039;illegal_markup&#039;,
						sprintf(
							/* translators: %s is the CSS that was provided. */
							__( &#039;The CSS must not contain &quot;%s&quot;.&#039; ),
							esc_html( substr( $css, $at, 8 ) )
						)
					);
					break;
				}
			}
		}

		if ( ! $validity-&gt;has_errors() ) {
			$validity = parent::validate( $css );
		}
		return $validity;
	}

	/**
	 * Store the CSS setting value in the custom_css custom post type for the stylesheet.
	 *
	 * @since 4.7.0
	 * @since 5.9.0 Renamed `$css` to `$value` for PHP 8 named parameter support.
	 *
	 * @param string $value CSS to update.
	 * @return int|false The post ID or false if the value could not be saved.
	 */
	public function update( $value ) {
		// Restores the more descriptive, specific name for use within this method.
		$css = $value;

		if ( empty( $css ) ) {
			$css = &#039;&#039;;
		}

		$r = wp_update_custom_css_post(
			$css,
			array(
				&#039;stylesheet&#039; =&gt; $this-&gt;stylesheet,
			)
		);

		if ( is_wp_error( $r ) ) {
			return false;
		}

		$post_id = $r-&gt;ID;

		// Cache post ID in theme mod for performance to avoid additional DB query.
		if ( $this-&gt;manager-&gt;get_stylesheet() === $this-&gt;stylesheet ) {
			set_theme_mod( &#039;custom_css_post_id&#039;, $post_id );
		}

		return $post_id;
	}
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-includes%2Fcustomize'>⬅ Back to Directory</a>