widget.php
Widget rendering, asset loading and request verification.
Table of Contents
Functions
- creationell_captcha_register_assets() : void
- Registers the widget script and — for Argon2id — its worker registration.
- creationell_captcha_safe_inline_css() : string
- Macht eine gespeicherte CSS-Zeichenkette sicher für die Ausgabe in einem `<style>`-Element.
- creationell_captcha_build_widget_markup() : string
- Builds the ALTCHA widget markup as a plain string. Enqueues the widget script as a side effect.
- creationell_captcha_render_widget() : void
- Renders the ALTCHA widget markup and enqueues its assets.
- creationell_captcha_verify_payload() : bool
- Verifies a raw base64 ALTCHA payload string.
- creationell_captcha_verify_request() : bool
- Reads and verifies the ALTCHA payload from the current POST request.
- creationell_captcha_widget() : void
- Public template tag — renders the ALTCHA widget.
- creationell_captcha_get_widget_markup() : string
- Returns the ALTCHA widget markup as a string.
- creationell_captcha_widget_shortcode() : string
- Shortcode handler for [creationell_captcha].
Functions
creationell_captcha_register_assets()
Registers the widget script and — for Argon2id — its worker registration.
creationell_captcha_register_assets() : void
creationell_captcha_safe_inline_css()
Macht eine gespeicherte CSS-Zeichenkette sicher für die Ausgabe in einem `<style>`-Element.
creationell_captcha_safe_inline_css(string $css) : string
Gemeinsame Ausgabe-Härtung für beide Stellen, an denen Nutzer-CSS in einen
<style>-Block geschrieben wird: das Widget (widget_custom_css) und die
Under-Attack-Interstitial-Seite (underattack_custom_css).
Warum an der AUSGABE und nicht (nur) im Schreibpfad: Der Sanitizer räumt
widget_custom_css/underattack_custom_css zwar per wp_strip_all_tags() auf,
aber mindestens drei Schreibwege erreichen ihn nie — wp option patch, fremde
update_option()-Aufrufe außerhalb des Admin-Kontexts und die eigenen
CLI-Befehle reset/load-defaults (W2 der Befunddatei). Was in der Option
steht, ist also nicht garantiert sanitisiert; die Ausgabe muss unabhängig
davon sicher sein.
Parameters
- $css : string
-
Rohes CSS aus den Einstellungen.
Return values
string —CSS, das den umgebenden <style>-Block nicht verlassen kann.
creationell_captcha_build_widget_markup()
Builds the ALTCHA widget markup as a plain string. Enqueues the widget script as a side effect.
creationell_captcha_build_widget_markup() : string
Safe to call from inside an ob_start callback because it does not use
output-buffering itself — unlike the legacy creationell_captcha_get_widget_markup
wrapper that this function now powers.
Reads eight widget-customization settings (display, type, auto_trigger, theme, hide_branding, primary_color, custom_css, strings_override) and maps them to the corresponding v3 attributes. Boolean attributes are emitted as empty-string values per HTML5 convention.
Return values
stringcreationell_captcha_render_widget()
Renders the ALTCHA widget markup and enqueues its assets.
creationell_captcha_render_widget() : void
creationell_captcha_verify_payload()
Verifies a raw base64 ALTCHA payload string.
creationell_captcha_verify_payload(string $raw) : bool
Shared by the POST-based request helper and the third-party form integrations, which read the payload from their plugin's submission data.
Parameters
- $raw : string
-
The raw
altchapayload.
Return values
boolcreationell_captcha_verify_request()
Reads and verifies the ALTCHA payload from the current POST request.
creationell_captcha_verify_request() : bool
The ALTCHA payload itself is the anti-bot token — no separate WordPress nonce applies here.
Return values
boolcreationell_captcha_widget()
Public template tag — renders the ALTCHA widget.
creationell_captcha_widget() : void
For use in theme templates or custom-form markup; the call must sit inside the
creationell_captcha_get_widget_markup()
Returns the ALTCHA widget markup as a string.
creationell_captcha_get_widget_markup() : string
Used by the shortcode and by the third-party form integrations, which embed the widget into another plugin's form markup. Implementation routes through the underlying string builder rather than ob_start so the function is safe to call from inside other output-buffer callbacks (e.g. Modul 12's auto-inject buffer).
Return values
string —The widget markup.
creationell_captcha_widget_shortcode()
Shortcode handler for [creationell_captcha].
creationell_captcha_widget_shortcode() : string
Place the shortcode inside a
Return values
string —The widget markup.