| @@ -1,36 +1,53 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- View file, its variables are local to the include scope, not true globals. | |
| 2 | 3 | |
| 4 | +defined('ABSPATH') || die('Restricted Access'); | |
| 5 | + | |
| 6 | +// Prepare list display | |
| 3 | 7 | use AcyMailing\Helpers\CaptchaHelper; |
| 8 | +use AcyMailing\Helpers\SecurityHelper; | |
| 4 | 9 | |
| 5 | -$listsContent = ''; | |
| 6 | -if (!empty($visibleLists)) { | |
| 7 | - $listsContent .= '<table class="acym_lists">'; | |
| 8 | - foreach ($visibleLists as $myListId) { | |
| 9 | - $check = ''; | |
| 10 | - if (in_array($myListId, $checkedLists)) { | |
| 11 | - $check = 'checked="checked"'; | |
| 10 | +if (!function_exists('acymailing_displayWidgetLists')) { | |
| 11 | + function acymailing_displayWidgetLists($allLists, $visibleLists, $checkedLists, $formName) | |
| 12 | + { | |
| 13 | + if (empty($visibleLists)) { | |
| 14 | + return; | |
| 12 | 15 | } |
| 16 | + ?> | |
| 13 | 17 | |
| 14 | - $listsContent .= ' | |
| 15 | - <tr> | |
| 16 | - <td> | |
| 17 | - <input type="checkbox" class="acym_checkbox" name="subscription[]" id="acylist_'.$myListId.'_'.$formName.'" '.$check.' value="'.$myListId.'"/> | |
| 18 | - <label for="acylist_'.$myListId.'_'.$formName.'">'.(!empty($allLists[$myListId]->display_name) ? $allLists[$myListId]->display_name | |
| 19 | - : $allLists[$myListId]->name).'</label> | |
| 20 | - </td> | |
| 21 | - </tr>'; | |
| 18 | + <div class="acym_lists__group" role="group" aria-label="<?php echo esc_attr(acym_translation('ACYM_NEWSLETTERS')); ?>"> | |
| 19 | + <table class="acym_lists" role="presentation"> | |
| 20 | + <?php foreach ($visibleLists as $myListId) { ?> | |
| 21 | + <tr> | |
| 22 | + <td> | |
| 23 | + <input type="checkbox" | |
| 24 | + class="acym_checkbox" | |
| 25 | + name="subscription[]" | |
| 26 | + id="acylist_<?php echo esc_attr($myListId.'_'.$formName); ?>" | |
| 27 | + <?php checked(in_array($myListId, $checkedLists)); ?> | |
| 28 | + value="<?php echo esc_attr($myListId); ?>" /> | |
| 29 | + <label for="acylist_<?php echo esc_attr($myListId.'_'.$formName); ?>"> | |
| 30 | + <?php echo esc_html(!empty($allLists[$myListId]->display_name) ? $allLists[$myListId]->display_name : $allLists[$myListId]->name); ?> | |
| 31 | + </label> | |
| 32 | + </td> | |
| 33 | + </tr> | |
| 34 | + <?php } ?> | |
| 35 | + </table> | |
| 36 | + </div> | |
| 37 | + <?php | |
| 22 | 38 | } |
| 23 | - $listsContent .= '</table>'; | |
| 24 | 39 | } |
| 25 | -if ($listPosition == 'before') echo $listsContent; | |
| 40 | +if ($listPosition === 'before') { | |
| 41 | + acymailing_displayWidgetLists($allLists, $visibleLists, $checkedLists, $formName); | |
| 42 | +} | |
| 26 | 43 | ?> |
| 27 | 44 | |
| 28 | -<table class="acym_form"> | |
| 45 | +<table class="acym_form" role="presentation"> | |
| 29 | 46 | <tr> |
| 30 | 47 | <?php |
| 31 | 48 | foreach ($fields as $field) { |
| 32 | - $field->option = json_decode($field->option); | |
| 49 | + $field->option = !empty($field->option) ? json_decode($field->option) : new stdClass(); | |
| 33 | 50 | $fieldDB = empty($field->option->fieldDB) ? '' : json_decode($field->option->fieldDB); |
| 34 | 51 | $field->value = empty($field->value) ? '' : json_decode($field->value); |
| 35 | 52 | $valuesArray = []; |
| 36 | 53 | if (!empty($field->value)) { |
| @@ -47,61 +64,92 @@ | ||
| 47 | 64 | foreach ($fromDB as $value) { |
| 48 | 65 | $valuesArray[$value->value] = $value->title; |
| 49 | 66 | } |
| 50 | 67 | } |
| 51 | - $size = empty($field->option->size) ? '' : 'width:'.$field->option->size.'px'; | |
| 52 | 68 | |
| 53 | - echo '<td class="onefield acyfield_'.$field->id.' acyfield_'.$field->type.'">'; | |
| 54 | - echo $fieldClass->displayField($field, $field->default_value, $size, $valuesArray, $displayOutside, true, $identifiedUser); | |
| 69 | + echo '<td class="onefield acyfield_'.esc_attr($field->id).' acyfield_'.esc_attr($field->type).'">'; | |
| 70 | + $fieldClass->displayField($field, $field->default_value, $valuesArray, $displayOutside, true, $identifiedUser); | |
| 55 | 71 | echo '</td>'; |
| 56 | - if (!$displayInline) echo '</tr><tr>'; | |
| 72 | + if (!$displayInline) { | |
| 73 | + echo '</tr><tr>'; | |
| 74 | + } | |
| 57 | 75 | |
| 58 | 76 | if ($field->id == 2 && $config->get('email_confirmation')) { |
| 59 | - echo $fieldClass->setEmailConfirmationField($displayOutside, $size, 'td', $displayInline); | |
| 77 | + $fieldClass->setEmailConfirmationField($displayOutside, $field, 'td', $displayInline); | |
| 60 | 78 | } |
| 61 | 79 | } |
| 62 | 80 | |
| 63 | - if ($listPosition != 'before') { | |
| 64 | - echo '<td>'.$listsContent.'</td>'; | |
| 65 | - if (!$displayInline) echo '</tr><tr>'; | |
| 81 | + if ($listPosition !== 'before') { | |
| 82 | + echo '<td>'; | |
| 83 | + acymailing_displayWidgetLists($allLists, $visibleLists, $checkedLists, $formName); | |
| 84 | + echo '</td>'; | |
| 85 | + if (!$displayInline) { | |
| 86 | + echo '</tr><tr>'; | |
| 87 | + } | |
| 66 | 88 | } |
| 67 | 89 | |
| 68 | 90 | if (empty($identifiedUser->id) && $config->get('captcha', 'none') !== 'none' && acym_level(ACYM_ESSENTIAL)) { |
| 69 | 91 | echo '<td class="captchakeymodule" '.($displayOutside && !$displayInline ? 'colspan="2"' : '').'>'; |
| 70 | 92 | $captcha = new CaptchaHelper(); |
| 71 | - echo $captcha->display($formName); | |
| 93 | + $captcha->display($formName); | |
| 72 | 94 | echo '</td>'; |
| 73 | - if (!$displayInline) echo '</tr><tr>'; | |
| 95 | + if (!$displayInline) { | |
| 96 | + echo '</tr><tr>'; | |
| 97 | + } | |
| 74 | 98 | } |
| 75 | 99 | |
| 76 | 100 | if (!empty($termslink)) { |
| 77 | 101 | echo '<td class="acyterms" '.($displayOutside && !$displayInline ? 'colspan="2"' : '').'>'; |
| 78 | - echo '<input id="mailingdata_terms_'.$formName.'" class="checkbox" type="checkbox" name="terms" title="'.acym_translation('ACYM_TERMS_CONDITIONS').'"/> '.$termslink; | |
| 102 | + echo '<label for="mailingdata_terms_'.esc_attr($formName).'">'; | |
| 103 | + echo '<input id="mailingdata_terms_'.esc_attr($formName).'" class="checkbox" type="checkbox" name="terms" aria-required="true" title="'.esc_attr( | |
| 104 | + acym_translation('ACYM_TERMS_CONDITIONS') | |
| 105 | + ).'"/> '; | |
| 106 | + echo wp_kses( | |
| 107 | + $termslink, | |
| 108 | + SecurityHelper::ALLOWED_HTML_TERMS | |
| 109 | + ); | |
| 110 | + echo '</label>'; | |
| 79 | 111 | echo '</td>'; |
| 80 | - if (!$displayInline) echo '</tr><tr>'; | |
| 112 | + if (!$displayInline) { | |
| 113 | + echo '</tr><tr>'; | |
| 114 | + } | |
| 81 | 115 | } |
| 116 | + | |
| 117 | + if (!empty($showTrackingConsent)) { | |
| 118 | + $trackingChecked = (int)($identifiedUser->tracking ?? 0) === 1; | |
| 119 | + echo '<td class="acytracking" '.($displayOutside && !$displayInline ? 'colspan="2"' : '').'>'; | |
| 120 | + echo '<label for="mailingdata_tracking_'.esc_attr($formName).'">'; | |
| 121 | + echo '<input type="hidden" name="user[tracking]" value="0"/>'; | |
| 122 | + echo '<input id="mailingdata_tracking_'.esc_attr($formName).'" class="checkbox" type="checkbox" name="user[tracking]" value="1" '.checked($trackingChecked, true, false).'/> '.esc_html( | |
| 123 | + acym_translation('ACYM_TRACKING_CONSENT') | |
| 124 | + ); | |
| 125 | + echo '</label>'; | |
| 126 | + echo '</td>'; | |
| 127 | + if (!$displayInline) { | |
| 128 | + echo '</tr><tr>'; | |
| 129 | + } | |
| 130 | + } | |
| 82 | 131 | ?> |
| 83 | 132 | |
| 84 | 133 | <td <?php if ($displayOutside && !$displayInline) echo 'colspan="2"'; ?> class="acysubbuttons"> |
| 85 | - <noscript> | |
| 86 | - <?php echo acym_translation('ACYM_NO_JAVASCRIPT'); ?> | |
| 87 | - </noscript> | |
| 134 | + <noscript><?php echo esc_html(acym_translation('ACYM_NO_JAVASCRIPT')); ?></noscript> | |
| 88 | 135 | <?php |
| 89 | - $onclickSubscribe = 'try{ return submitAcymForm("subscribe","'.$formName.'", "acymSubmitSubForm"); }catch(err){alert("The form could not be submitted "+err);return false;}'; | |
| 90 | - $onclickUnsubscribe = 'try{ return submitAcymForm("unsubscribe","'.$formName.'", "acymSubmitSubForm"); }catch(err){alert("The form could not be submitted "+err);return false;}'; | |
| 136 | + $onclickSubscribe = 'try{ return submitAcymForm("subscribe","'.$formName.'"); }catch(err){alert("The form could not be submitted "+err);return false;}'; | |
| 137 | + $onclickUnsubscribe = 'try{ return submitAcymForm("unsubscribe","'.$formName.'"); }catch(err){alert("The form could not be submitted "+err);return false;}'; | |
| 138 | + if ($disableButtons) { | |
| 139 | + $onclickSubscribe = 'return false;'; | |
| 140 | + $onclickUnsubscribe = 'return false;'; | |
| 141 | + } | |
| 91 | 142 | ?> |
| 92 | - <input type="button" | |
| 93 | - class="btn btn-primary button subbutton" | |
| 94 | - value="<?php echo acym_translation($subscribeText, true); ?>" | |
| 95 | - name="Submit" | |
| 96 | - onclick="<?php echo $disableButtons ? 'return true' : acym_escape($onclickSubscribe); ?>" /> | |
| 143 | + <button type="submit" | |
| 144 | + class="btn btn-primary button subbutton" | |
| 145 | + onclick="<?php echo esc_attr($onclickSubscribe); ?>"><?php echo esc_html(acym_translation($subscribeText)); ?> | |
| 146 | + </button> | |
| 97 | 147 | <?php if ($unsubButton === '2' || ($unsubButton === '1' && !empty($countUnsub))) { ?> |
| 98 | - <span style="display: none;"></span> | |
| 99 | - <input type="button" | |
| 100 | - class="btn button unsubbutton" | |
| 101 | - value="<?php echo acym_translation($unsubscribeText, true); ?>" | |
| 102 | - name="Submit" | |
| 103 | - onclick="<?php echo $disableButtons ? 'return true' : acym_escape($onclickUnsubscribe); ?>" /> | |
| 148 | + <button type="submit" | |
| 149 | + class="btn button unsubbutton" | |
| 150 | + onclick="<?php echo esc_attr($onclickUnsubscribe); ?>"><?php echo esc_html(acym_translation($unsubscribeText)); ?> | |
| 151 | + </button> | |
| 104 | 152 | <?php } ?> |
| 105 | 153 | </td> |
| 106 | 154 | </tr> |
| 107 | 155 | </table> |