Toggle Show/Hide

Adds a [toggle] shortcode which displays a clickable title that shows/hides a block of content, or an expandable "read more" block.

Description

Adds a [toggle] shortcode which displays a clickable title that shows/hides a block of content (Style 1), or an expandable "read more" block (Style 2).

Usage:

[toggle title="Click here to show/hide"]Content goes here.[/toggle]

[toggle style="2"]Visible summary text.<!--readmore-->The rest of the content.[/toggle]

See the Instructions tab on the plugin's settings page for the full list of per-shortcode attributes.

Installation

• Download the latest release of the plugin from GitHub.
• Upload the entire zip file using the Plugins upload function in your ClassicPress admin panel.
• Activate the plugin.
• Configure the toggle's appearance via the configuration page in the admin control panel (azurecurve menu).

Frequently Asked Questions

Can I translate this plugin?

Yes, the .pot file is in the plugin's languages folder; if you do translate this plugin, please send the .po and .mo files to translations@azurecurve.co.uk for inclusion in the next version (full credit will be given).

Is this plugin compatible with both WordPress and ClassicPress?

This plugin is developed for ClassicPress, but will likely work on WordPress.

Changelog

Version 2.0.0

• Rebuilt to match the current azurecurve plugin architecture (namespaced code, settings split across includes files, tabbed admin UI, admin-post save handler).
• Security: fixed a CSS-injection vulnerability where shortcode attributes (and saved settings) such as title_color, border, title_font_size etc. were concatenated directly into style="..." attributes and only escaped as a whole string, which does not stop a value like red;position:fixed;... from injecting arbitrary extra CSS declarations. Every such value is now validated against a strict allow-list for what it's actually supposed to contain (colours, lengths, font names, etc.), both when settings are saved and at shortcode render time.
• Security: fixed a more serious issue in the same area - the title_tag shortcode attribute was inserted as the literal HTML tag name with no validation at all, so a value such as h3 onmouseover=alert(1) was output completely unescaped, injecting an arbitrary HTML attribute (including event handlers). title_tag is now restricted to a fixed list of real tag names.
• Security: fixed an unescaped admin-option-to-`