From b40cde6d90a7ca49ce01a28dd1dc4de5f4d1ce03 Mon Sep 17 00:00:00 2001
From: Mike Ward <29747332+MikeWard0321@users.noreply.github.com>
Date: Fri, 14 Aug 2026 01:13:36 -0400
Subject: [PATCH] Guard ExcludedEncodeContentSC filter entry points against
 non-string input

changeContentBeforeEncoderModify() and changeContentAfterEncoderModify() are
registered directly as WordPress filter callbacks by ShortCodesService, so they
receive whatever value the filter carries, which is not always a string.

Both then pass that value to preg_match_all() and preg_replace_callback()
without checking it. On PHP 8.1+ a null value emits "Passing null to parameter
#N ($subject) of type string is deprecated"; on PHP 9 the same call becomes a
TypeError.

EncodeContentSC, the sibling class attached to the same filters by the same
ShortCodesService methods, already guards both of its entry points with exactly
this check. This applies the same guard to ExcludedEncodeContentSC so the two
classes behave consistently on the hooks they share.
---
 .../Shortcodes/ExcludedEncodeContentSC.php                | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php b/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php
index 37e496455..e19184a80 100644
--- a/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php
+++ b/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php
@@ -76,6 +76,10 @@ public function callback($_atts, $content, $_tag)
      */
     public function changeContentBeforeEncoderModify($content)
     {
+        if ( ! is_string($content) ) {
+            return $content;
+        }
+
         if ($this->isShortcodeInsideHtmlAttribute($content)) {
             return $content;
         }
@@ -101,6 +105,10 @@ public function changeContentBeforeEncoderModify($content)
      */
     public function changeContentAfterEncoderModify($content)
     {
+        if ( ! is_string($content) ) {
+            return $content;
+        }
+
         global $apbct;
 
         if ( ! $apbct->settings['data__email_decoder_buffer'] ) {