@php $eyebrow = $content['eyebrow'] ?? null; $headline = $content['headline'] ?? ''; $sub = $content['subheadline'] ?? ''; $ctaLabel = $content['cta_label'] ?? null; $ctaUrl = $content['cta_url'] ?? '#'; $image = $content['image_url'] ?? null; $alignment = $content['alignment'] ?? 'center'; $background = $content['background'] ?? 'gradient'; // The template below references $safeCtaHref (HTML attr context, // line ~54) and $safeImageCssUrl (CSS url() context, line ~18). // Both were previously undefined — a tenant who configured a CTA // label or an image background would trigger a 500 (production // logs: "Undefined variable $safeCtaHref ..."). Compute the // sanitised values here so the view never echoes raw editor // input into either context. // // href: allow http/https external URLs, anchor links (#foo), // and same-app relative paths (/contact). Reject // protocol-relative `//evil/x`, `javascript:`, `data:`, // and anything else — fall back to '#' so a broken CTA // renders inert instead of crashing the page. // CSS: App\Support\UrlSafety::cssSafeUrl applies the strict // http/https allowlist + CSS-special-char strip. Empty // string when unsafe; the @elseif below short-circuits // on '!=== '' so an unsafe background falls back to the // solid var(--bg) branch instead of breaking the page. if (\App\Support\UrlSafety::isSafeExternalUrl($ctaUrl)) { $safeCtaHref = $ctaUrl; } elseif (is_string($ctaUrl) && $ctaUrl !== '' && ! str_starts_with($ctaUrl, '//') && (str_starts_with($ctaUrl, '/') || str_starts_with($ctaUrl, '#'))) { $safeCtaHref = $ctaUrl; } else { $safeCtaHref = '#'; } $safeImageCssUrl = \App\Support\UrlSafety::cssSafeUrl($image); @endphp {{-- Note: the inline style="" on this
below stays inline because its background varies per landing-page section record (gradient / per-record image URL / solid var(--bg)). Same applies to the inline
@if($eyebrow){{ $eyebrow }}@endif @if($headline)

{{ $headline }}

@endif @if($sub)

{!! nl2br(e($sub)) !!}

@endif @if($ctaLabel)

{{ __('marketing.public_hero_trust_line') }}

@endif @if($image && $background !== 'image')
@endif
{{-- The
above keeps its inline style="" because its padding and background are driven by the editor-chosen $background and $image values. Static rules (illustration spacing, image treatment) are extracted to the linked stylesheet below. --}}