$html] or a plain HTML string (error states).
* @var array $cssAssets
*/
/*
* Pass the email payload and renderer through WordPress's script loader instead
* of emitting a hardcoded inline ` breakout from the inline script context.
$fcEmailData = wp_json_encode(
['rendered' => $renderedBody],
JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
);
wp_add_inline_script('fluentcrm_dompurify', 'window.fluentCrmEmail = ' . $fcEmailData . ';', 'before');
// Renderer: sanitize the email body and mount it inside a closed shadow root so
// its styles stay isolated from (and can't leak into) the surrounding page.
// Runs after DOMPurify loads (default 'after' position).
$fcViewOnBrowserScript = <<<'JS'
(function () {
var data = window.fluentCrmEmail;
if (!data || !data.rendered) {
return;
}
var host = document.getElementById('fluent_email_body');
if (!host || typeof host.attachShadow !== 'function' || typeof window.DOMPurify === 'undefined') {
return;
}
var clean = window.DOMPurify.sanitize(data.rendered, { ADD_TAGS: ['style'], ADD_ATTR: ['target'] });
var shadow = host.attachShadow({ mode: 'closed' });
var wrapper = document.createElement('div');
wrapper.innerHTML = clean;
shadow.appendChild(wrapper);
})();
JS;
wp_add_inline_script('fluentcrm_dompurify', $fcViewOnBrowserScript);
?>
>
<?php echo esc_attr($email_heading); ?>