plugin.php

<?php

/*
Plugin Name: External Content Block
Plugin URI: https://github.com/roldan/external-content-block
Description: A Gutenberg block to load and display external content from a URL.
Version: 1.0
Author: Matías Roldán
Author URI: https://github.com/roldan
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
 */

// Prevent direct access
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

function register_external_content_block_scripts() {
    wp_enqueue_script(
        'external-content-block/url-block',
        plugins_url( 'js/url-block.js', __FILE__ ),
        array( 'wp-blocks', 'wp-element', 'wp-components', 'wp-i18n' ),
        '1.0.0',
        true
    );
}
add_action( 'enqueue_block_editor_assets', 'register_external_content_block_scripts' );

function register_external_content_block_render_callback() {
    register_block_type(
        'external-content-block/url-block',
        array(
            'render_callback' => 'render_url_block',
            'attributes'      => array(
                'url'         => array(
                    'type' => 'string',
                ),
                'sanitize_html' => array(
                    'type'    => 'boolean',
                    'default' => true,
                ),
                'timeout'     => array(
                    'type'    => 'number',
                    'default' => 5,
                ),
                'cache_ttl'   => array(
                    'type'    => 'number',
                    'default' => 0,
                ),
            ),
        )
    );
}
add_action( 'init', 'register_external_content_block_render_callback' );

/**
 * Render the URL block with external content
 *
 * @param array $attributes Block attributes.
 * @return string Rendered content or error message.
 */
function render_url_block( $attributes ) {
    // Validate URL exists
    if ( empty( $attributes['url'] ) ) {
        return '<p class="external-content-block-error">Error: URL is required</p>';
    }

    // Sanitize and validate URL
    $url = esc_url_raw( $attributes['url'] );
    if ( ! filter_var( $url, FILTER_VALIDATE_URL ) ) {
        return '<p class="external-content-block-error">Error: Invalid URL format</p>';
    }

    // Get attributes with defaults
    $sanitize_html = isset( $attributes['sanitize_html'] ) ? (bool) $attributes['sanitize_html'] : true;
    $timeout       = isset( $attributes['timeout'] ) ? absint( $attributes['timeout'] ) : 5;
    $cache_ttl     = isset( $attributes['cache_ttl'] ) ? absint( $attributes['cache_ttl'] ) : 0;

    // Generate cache key
    $cache_key = 'external_content_' . md5( $url . $sanitize_html );

    // Try to get from cache if cache is enabled
    if ( $cache_ttl > 0 ) {
        $cached_content = get_transient( $cache_key );
        if ( false !== $cached_content ) {
            return $cached_content;
        }
    }

    // Prepare request arguments
    $args = array(
        'timeout'     => $timeout,
        'sslverify'   => true,
        'redirection' => 5,
    );

    // Make the request
    $response = wp_remote_get( $url, $args );

    // Check for errors
    if ( is_wp_error( $response ) ) {
        $error_message = $response->get_error_message();
        return '<p class="external-content-block-error">Error loading content: ' . esc_html( $error_message ) . '</p>';
    }

    // Check response code
    $response_code = wp_remote_retrieve_response_code( $response );
    if ( 200 !== $response_code ) {
        return '<p class="external-content-block-error">Error: HTTP ' . esc_html( $response_code ) . ' - Unable to load content from URL</p>';
    }

    // Get response body
    $body = wp_remote_retrieve_body( $response );

    // Sanitize content if requested
    if ( $sanitize_html ) {
        // Strict sanitization - only safe HTML tags allowed (wp_kses_post)
        $body = wp_kses_post( $body );
    } else {
        // No sanitization - output content exactly as received
        // WARNING: This allows raw HTML, scripts, and other potentially unsafe content
        // Use only if you trust the source URL
        $body = $body;
    }

    // Cache the content if cache is enabled
    if ( $cache_ttl > 0 ) {
        set_transient( $cache_key, $body, $cache_ttl );
    }

    // Wrap content in a container for styling
    return '<div class="external-content-block">' . $body . '</div>';
}