Update SaveOptionApiController.php

microweber · Mar 14, 2022 · 955471c · 955471c
1 parent 46e100a
commit 955471c
Showing 1 changed file with 19 additions and 7 deletions.
diff --git a/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php b/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
@@ -6,18 +6,30 @@
 
 class SaveOptionApiController
 {
-    public function saveOption(Request $request) {
+    public $whitelistedGroupKeys = [
+        'website' => [
+            'website_head',
+            'website_footer'
+        ]
+    ];
+
+    public function saveOption(Request $request)
+    {
 
         $cleanFromXss = true;
         $option = $request->all();
 
-        // Allow for this keys
+        // Allow for this keys and groups
         if (isset($option['option_key'])) {
-            if ($option['option_key'] == 'website_head') {
-                $cleanFromXss = false;
-            }
-            if ($option['option_key'] == 'website_footer') {
-                $cleanFromXss = false;
+            foreach ($this->whitelistedGroupKeys as $group => $keys) {
+                if ($option['option_group'] == $group) {
+                    foreach ($keys as $key) {
+                        if ($option['option_key'] == $key) {
+                            $cleanFromXss = false;
+                            break;
+                        }
+                    }
+                }
             }
         }