← All changes | back/Controllers/Fields/Edition.php +26 -15 10.0.1 → 11.1.0 View file →

		@@ -6,9 +6,9 @@
6	6	use AcyMailing\Types\OperatorType;
7	7
8	8	trait Edition
9	9	{
10		- public function edit()
	10	+ public function edit(): void
11	11	{
12	12	acym_setVar('layout', 'edit');
13	13	$fieldId = acym_getVar('int', 'fieldId');
14	14	$fieldClass = new FieldClass();
		@@ -18,8 +18,9 @@
18	18	$field = new \stdClass();
19	19	$field->id = 0;
20	20	$field->name = '';
21	21	$field->active = 1;
	22	+ $field->core = 0;
22	23	$field->type = 'text';
23	24	$field->value = '';
24	25	$field->option = '';
25	26	$field->default_value = '';
		@@ -67,9 +68,9 @@
67	68	}
68	69	}
69	70
70	71	if (!empty($fieldId)) {
71		- $this->breadcrumb[acym_escape(acym_translation($field->name))] = acym_completeLink('fields&task=edit&fieldId='.$fieldId);
	72	+ $this->breadcrumb[acym_translation($field->name)] = acym_completeLink('fields&task=edit&fieldId='.$fieldId);
72	73	} else {
73	74	$this->breadcrumb[acym_translation('ACYM_NEW_CUSTOM_FIELD')] = acym_completeLink('fields&task=edit');
74	75	}
75	76
		@@ -103,47 +104,49 @@
103	104	];
104	105
105	106	$this->prepareMultilingualOption($data);
106	107
107		- return parent::display($data);
	108	+ parent::display($data);
108	109	}
109	110
110		- public function ajaxGetTables()
	111	+ public function ajaxGetTables(): void
111	112	{
112	113	$database = acym_getVar('string', 'database');
113		- $allTables = acym_loadResultArray('SHOW TABLES FROM `'.$database.'`');
	114	+ $allTables = acym_loadResultArray('SHOW TABLES FROM `'.acym_secureDBColumn($database).'`');
114	115
115	116	acym_sendAjaxResponse('', ['tables' => $allTables]);
116	117	}
117	118
118		- public function ajaxGetColumns()
	119	+ public function ajaxGetColumns(): void
119	120	{
120	121	$table = acym_getVar('string', 'table');
121	122	$database = acym_getVar('string', 'database');
122	123
123		- $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.$table.'` FROM `'.$database.'`');
	124	+ $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.acym_secureDBColumn($table).'` FROM `'.acym_secureDBColumn($database).'`');
124	125	array_unshift($columns, 'ACYM_CHOOSE_COLUMN');
125	126
126	127	acym_sendAjaxResponse('', ['columns' => $columns]);
127	128	}
128	129
129		- public function apply()
	130	+ public function apply(): void
130	131	{
131	132	$this->saveField();
132	133	$this->edit();
133	134	}
134	135
135		- public function save()
	136	+ public function save(): void
136	137	{
137	138	$this->saveField();
138	139	$this->listing();
139	140	}
140	141
141		- protected function saveField()
	142	+ protected function saveField(): void
142	143	{
	144	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	145	+
143	146	$fieldClass = new FieldClass();
144	147	$newField = $this->setFieldToSave();
145		- $fieldId = $fieldClass->save($newField);
	148	+ $fieldId = empty($newField->name) ? null : $fieldClass->save($newField);
146	149	if (!empty($fieldId)) {
147	150	acym_setVar('fieldId', $fieldId);
148	151	acym_enqueueMessage(acym_translation('ACYM_SUCCESSFULLY_SAVED'));
149	152	} else {
		@@ -150,9 +153,9 @@
150	153	acym_enqueueMessage(acym_translation('ACYM_ERROR_SAVING'), 'error');
151	154	}
152	155	}
153	156
154		- private function setFieldToSave()
	157	+ private function setFieldToSave(): object
155	158	{
156	159	$fieldClass = new FieldClass();
157	160	$languageFieldId = $fieldClass->getLanguageFieldId();
158	161	$field = acym_getVar('array', 'field');
		@@ -160,10 +163,12 @@
160	163	$fieldId = acym_getVar('int', 'fieldId');
161	164	if (in_array($fieldId, [2, $languageFieldId])) {
162	165	$field['required'] = 1;
163	166	}
	167	+
	168	+ $newField = new \stdClass();
164	169	if (empty($field['name'])) {
165		- return false;
	170	+ return $newField;
166	171	}
167	172
168	173	if (in_array($fieldId, [1, 2])) {
169	174	$field['type'] = 'text';
		@@ -189,9 +194,16 @@
189	194	$i++;
190	195	}
191	196	}
192	197
193		- $field['name'] = strip_tags($field['name'], '<i><b><strong>');
	198	+ $field['name'] = wp_kses(
	199	+ $field['name'],
	200	+ [
	201	+ 'i' => [],
	202	+ 'b' => [],
	203	+ 'strong' => [],
	204	+ ]
	205	+ );
194	206	$field['namekey'] = empty($field['namekey']) ? $fieldClass->generateNamekey($field['name']) : $field['namekey'];
195	207	$field['option']['format'] = $field['type'] === 'date' && empty($field['option']['format']) ? '%d%m%y' : strtolower($field['option']['format']);
196	208	$field['option']['rows'] = ($field['type'] == 'textarea' && empty($field['option']['rows'])) ? '5' : $field['option']['rows'];
197	209	$field['option']['columns'] = ($field['type'] == 'textarea' && empty($field['option']['columns'])) ? '30' : $field['option']['columns'];
		@@ -202,9 +214,8 @@
202	214	$field['option']['format'] = preg_replace('/[^a-z\%]/', '', $field['option']['format']);
203	215	$field['option']['format'] = preg_replace('/\%[^ymd]/', '', $field['option']['format']);
204	216	}
205	217
206		- $newField = new \stdClass();
207	218	$newField->name = $field['name'];
208	219	$newField->active = $field['active'];
209	220	$newField->namekey = $field['namekey'];
210	221	$newField->type = $field['type'];