← All changes | includes/blocks/form-builder/query.php +54 -19 2.9.1 → 2.14.0 View file →

		@@ -1,7 +1,11 @@
1	1	<?php
2	2	namespace ABlocks\Blocks\FormBuilder;
3	3
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
	7	+
4	8	use ABlocks\Blocks\FormBuilder\EmailVerification;
5	9	use SplTempFileObject;
6	10	/**
7	11	* @class Query
		@@ -81,12 +85,12 @@
81	85	$count_query .= ' where ' . implode( ' and ', $conditions );
82	86	}
83	87
84	88	if ( empty( $args ) && empty( $conditions ) ) {
85		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	89	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
86	90	$num_of_entries = $wpdb->get_var( $count_query );
87	91	} else {
88		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	92	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
89	93	$num_of_entries = $wpdb->get_var( $wpdb->prepare( $count_query, ...$args ) );
90	94	}
91	95
92	96	// order by
		@@ -102,9 +106,9 @@
102	106	$query .= " order by {$order_by} {$order}";
103	107
104	108	// export entries in csv format
105	109	if ( $do_export_csv ) {
106		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	110	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
107	111	$entries_to_export = $wpdb->get_results( $wpdb->prepare( $query, ...$args ), ARRAY_A ) ?? [];
108	112
109	113	// make a temporary file object
110	114	$save_entries_as_csv = new SplTempFileObject();
		@@ -174,9 +178,9 @@
174	178	group by form_type
175	179	order by form_type asc
176	180	";
177	181	$data = [];
178		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	182	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
179	183	foreach ( $wpdb->get_results( $wpdb->prepare( $query, ...$args ), ARRAY_A ) ?? [] as $item ) {
180	184	if ( $item['is_in_trash'] === 'yes' ) {
181	185	$item['status'] = 'trash';
182	186	}
		@@ -186,11 +190,11 @@
186	190	return [
187	191	'total_entries' => $num_of_entries,
188	192	'current_page' => $current_page,
189	193	'per_page' => $entry_per_page,
190		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	194	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
191	195	'available_dates' => $wpdb->get_results( $get_available_date_query, ARRAY_A ) ?? [],
192		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	196	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
193	197	'available_forms' => $wpdb->get_results( $get_available_forms_query, ARRAY_A ) ?? [],
194	198	'data' => $data,
195	199	];
196	200	}
		@@ -203,9 +207,9 @@
203	207	$fields = [];
204	208	if ( ( $block_data['innerBlocks'][0]['blockName'] ?? '' ) === 'ablocks/form-multi-step' ) {
205	209
206	210	foreach ( $block_data['innerBlocks'][0]['innerBlocks'] ?? [] as $block ) {
207		- foreach ( $block['innerBlocks'] as ['attributes' => $attr] ) {
	211	+ foreach ( $block['innerBlocks'] as [ 'blockName' => $block_name, 'attributes' => $attr ] ) {
208	212	$name = $attr['name'] ?? false;
209	213	$input_type = $attr['inputType'] ?? false;
210	214	$label = $attr['label'] ?? $attr['placeholder'] ?? false;
211	215	$radio_arr = $attr['radioArr'] ?? false;
		@@ -219,11 +223,17 @@
219	223
220	224	if ( is_array( $radio_arr ) ) {
221	225	$fields[ $name ]['radioArr'] = $radio_arr;
222	226	}
	227	+ } elseif ( $block_name === 'ablocks/form-hidden' ) {
	228	+ $name = strtolower( sanitize_text_field( $attr['hiddenname'] ?? '' ) );
	229	+ $fields[ $name ] = [
	230	+ 'inputType' => 'textarea', // sanitize value
	231	+ 'label' => ucfirst( preg_replace( '/[_-]/m', ' ', $name ) ), // sanitize value
	232	+ ];
223	233	}
224		- }
225		- }
	234	+ }//end foreach
	235	+ }//end foreach
226	236	} elseif (
227	237	isset( $block_data['innerBlocks'] )
228	238	) {
229	239	$fields = [];
		@@ -242,10 +252,16 @@
242	252
243	253	if ( is_array( $radio_arr ) ) {
244	254	$fields[ $name ]['radioArr'] = $radio_arr;
245	255	}
	256	+ } elseif ( $input_element_data['blockName'] === 'ablocks/form-hidden' ) {
	257	+ $name = strtolower( sanitize_text_field( $input_element_data['attributes']['hiddenname'] ?? '' ) );
	258	+ $fields[ $name ] = [
	259	+ 'inputType' => 'textarea', // sanitize value
	260	+ 'label' => ucfirst( preg_replace( '/[_-]/m', ' ', $name ) ), // sanitize value
	261	+ ];
246	262	}
247		- }
	263	+ }//end foreach
248	264	}//end if
249	265	return $fields;
250	266	}
251	267
		@@ -286,9 +302,9 @@
286	302	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
287	303	$table_meta = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_meta';
288	304
289	305	$query = "SELECT * FROM {$table_entries} WHERE id = %d";
290		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	306	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
291	307	$entry = $wpdb->get_row( $wpdb->prepare( $query, $id ), ARRAY_A );
292	308	if ( $entry ) {
293	309	// mark this entry as reas
294	310	if ( count( self::update_status_of_entries( [ $id ] ) ) > 0 ) {
		@@ -293,8 +309,9 @@
293	309	// mark this entry as reas
294	310	if ( count( self::update_status_of_entries( [ $id ] ) ) > 0 ) {
295	311	$entry['status'] = 'read';
296	312	}
	313	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
297	314	$meta = $wpdb->get_results(
298	315	$wpdb->prepare(
299	316	// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
300	317	"SELECT meta_key, meta_value FROM $table_meta WHERE entry_id = %d ",
		@@ -311,9 +328,14 @@
311	328
312	329	if (
313	330	isset( $fields[ $field['meta_key'] ]['radioArr'] )
314	331	) {
315		- $field['meta_value'] = explode( ',', $field['meta_value'] );
	332	+ $decoded_value = json_decode( $field['meta_value'], true );
	333	+ if ( json_last_error() === JSON_ERROR_NONE && is_array( $decoded_value ) ) {
	334	+ $field['meta_value'] = array_values( $decoded_value );
	335	+ } else {
	336	+ $field['meta_value'] = [];
	337	+ }
316	338	} elseif (
317	339	! isset( $fields[ $field['meta_key'] ]['radioArr'] ) &&
318	340	( $fields[ $field['meta_key'] ]['inputType'] ?? '' ) === 'checkbox'
319	341	) {
		@@ -319,21 +341,21 @@
319	341	) {
320	342	$field['meta_value'] = strtolower( $field['meta_value'] ) === 'on' ? true : false;
321	343	}
322	344
323		- $entry['meta'][] = array_merge(
	345	+ $entry['meta'][] = apply_filters( 'ablocks/form_builder/meta_output', array_merge(
324	346	$fields[ $field['meta_key'] ],
325	347	$field
326		- );
	348	+ ) );
327	349
328	350	} else {
329		- $entry['meta'][] = array_merge(
	351	+ $entry['meta'][] = apply_filters( 'ablocks/form_builder/meta_output', array_merge(
330	352	$field,
331	353	[
332	354	'inputType' => 'text',
333	355	'label' => ucfirst( preg_replace( '/[_-]/m', ' ', $field['meta_key'] ) ),
334	356	]
335		- );
	357	+ ) );
336	358	}//end if
337	359	}//end foreach
338	360
339	361	foreach ( array_diff( array_keys( $fields ), $found ) as $key ) {
		@@ -352,9 +374,9 @@
352	374	} else {
353	375	$fields[ $key ]['meta_value'] = null;
354	376	}
355	377
356		- $entry['meta'][] = $fields[ $key ];
	378	+ $entry['meta'][] = apply_filters( 'ablocks/form_builder/meta_output', $fields[ $key ] );
357	379	}//end foreach
358	380
359	381	return $entry;
360	382	}//end if
		@@ -366,8 +388,9 @@
366	388	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
367	389	$table_meta = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_meta';
368	390
369	391	// Check if the entry exists
	392	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
370	393	$is_entry_exists = (int) $wpdb->get_var(
371	394	$wpdb->prepare( "SELECT COUNT(*) FROM {$table_entries} WHERE id = %d", $id )// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
372	395	) > 0;
373	396
		@@ -375,8 +398,9 @@
375	398	return false;
376	399	}
377	400
378	401	// Get all meta keys for this entry
	402	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
379	403	$get_meta_keys = $wpdb->get_results(
380	404	$wpdb->prepare(
381	405	// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
382	406	"SELECT meta_key FROM {$table_meta} WHERE entry_id = %d ",
		@@ -395,8 +419,9 @@
395	419	$meta_key = $key['meta_key'];
396	420
397	421	// Check if the input data has this meta key
398	422	if ( array_key_exists( $meta_key, $data ) ) {
	423	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
399	424	$is_updated = $wpdb->update(
400	425	$table_meta,
401	426	[ 'meta_value' => sanitize_text_field( $data[ $meta_key ] ) ],
402	427	[
		@@ -424,9 +449,12 @@
424	449	$total_deleted = [];
425	450	if ( ! empty( $entry_id_array ) ) {
426	451	foreach ( $entry_id_array as $entry_id ) {
427	452
	453	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
428	454	if ( $wpdb->delete( $table_entries, [ 'id' => $entry_id ], [ '%d' ] ) ) {
	455	+
	456	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
429	457	$wpdb->delete( $table_meta, [ 'entry_id' => $entry_id ], [ '%d' ] );
430	458	$total_deleted[] = $entry_id;
431	459	}
432	460	}
		@@ -440,8 +468,9 @@
440	468	$total = [];
441	469	if ( ! empty( $entry_id_array ) ) {
442	470	foreach ( $entry_id_array as $entry_id ) {
443	471
	472	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
444	473	if ( $wpdb->update( $table_entries, [ 'status' => $status ], [ 'id' => $entry_id ] ) ) {
445	474	self::update_trash_status_of_entries( $entry_id, 'no' );
446	475	$total[] = $entry_id;
447	476	}
		@@ -454,8 +483,9 @@
454	483	global $wpdb;
455	484	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
456	485
457	486	// Retrieve the current status
	487	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
458	488	$status = $wpdb->get_var(
459	489	$wpdb->prepare( "SELECT status FROM {$table_entries} WHERE id = %d", $id )// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
460	490	);
461	491
		@@ -463,8 +493,9 @@
463	493	$total = [];
464	494
465	495	if ( $id > 0 ) {
466	496	// Update the trash status
	497	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
467	498	$is_updated = $wpdb->update(
468	499	$table_entries,
469	500	[ 'is_in_trash' => sanitize_text_field( $send_to_trash ) ],
470	501	[ 'id' => $id ],
		@@ -496,8 +527,9 @@
496	527	global $wpdb;
497	528	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
498	529	$table_meta = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_meta';
499	530	$token = wp_generate_password( 22, false );
	531	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
500	532	$wpdb->insert($table_entries,
501	533	[
502	534	'form_type' => $form_type,
503	535	'post_id' => $post_id,
		@@ -513,13 +545,14 @@
513	545	$entry_id = $wpdb->insert_id;
514	546
515	547	if ( $entry_id ) {
516	548	foreach ( $meta_data as $input_id => $attr ) {
	549	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
517	550	$wpdb->insert($table_meta,
518	551	[
519	552	'entry_id' => $entry_id,
520	553	'meta_key' => $input_id,
521		- 'meta_value' => $attr['value'],
	554	+ 'meta_value' => is_array( $attr['value'] ) ? json_encode( $attr['value'] ) : $attr['value'],
522	555	]
523	556	);
524	557	}
525	558	}
		@@ -528,8 +561,9 @@
528	561
529	562	public static function get_token_by_email( string $email ) {
530	563	global $wpdb;
531	564	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
	565	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
532	566	$entry = $wpdb->get_row(
533	567	$wpdb->prepare(
534	568	// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
535	569	"SELECT email_verification_token FROM {$table_entries} WHERE user_email = %s",
		@@ -545,8 +579,9 @@
545	579	global $wpdb;
546	580	$table_entries = $wpdb->prefix . ABLOCKS_PLUGIN_SLUG . '_form_entries';
547	581
548	582	$query = "select count(user_email) from {$table_entries} where form_type = %s and user_email = %s";
549		- return $wpdb->get_var( $wpdb->prepare( $query, $form_type, $email ) ) > 0;// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	583	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	584	+ return $wpdb->get_var( $wpdb->prepare( $query, $form_type, $email ) ) > 0;
550	585	}
551	586
552	587	}