← All changes | front/FrontViews/Frontusers/tmpl/profile.php +90 -44 10.1.4 → 11.1.0 View file →

		@@ -1,31 +1,57 @@
1	1	<?php
	2	+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- View file, its variables are local to the include scope, not true globals.
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
	5	+use AcyMailing\Helpers\SecurityHelper;
	6	+
2	7	$formName = acym_getModuleFormName();
	8	+$allowedIntroTags = array_merge(SecurityHelper::ALLOWED_HTML_INTRO, [
	9	+ 'a' => [
	10	+ 'href' => true,
	11	+ 'target' => true,
	12	+ 'title' => true,
	13	+ 'class' => true,
	14	+ 'rel' => true,
	15	+ 'aria-label' => true,
	16	+ ],
	17	+]);
3	18	?>
4		-<div id="acym_fulldiv_<?php echo $formName; ?>" class="acym_front_page <?php echo empty($data['suffix']) ? '' : $data['suffix']; ?>">
	19	+<div id="acym_fulldiv_<?php echo esc_attr($formName); ?>" class="acym_front_page <?php echo empty($data['suffix']) ? '' : esc_attr($data['suffix']); ?>">
5	20	<?php
6	21	if (!empty($data['show_page_heading'])) {
7		- echo '<h1 class="contentheading'.$data['suffix'].'">'.$data['page_heading'].'</h1>';
	22	+ echo '<h1 class="contentheading'.esc_attr($data['suffix']).'">'.esc_html($data['page_heading']).'</h1>';
8	23	}
9	24
10	25	if (!empty($data['introtext'])) {
11		- echo '<span class="acym_introtext">'.$data['introtext'].'</span>';
	26	+ echo '<span class="acym_introtext">'.wp_kses(
	27	+ $data['introtext'],
	28	+ $allowedIntroTags
	29	+ ).'</span>';
12	30	}
13	31	?>
14	32
15	33	<form enctype="multipart/form-data"
16		- action="<?php echo acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : '')); ?>"
	34	+ action="<?php echo esc_url(acym_frontendLink('frontusers'.(acym_isNoTemplate() ? '&'.acym_noTemplate() : ''))); ?>"
17	35	method="post"
18		- name="<?php echo $formName; ?>"
19		- id="<?php echo $formName; ?>"
	36	+ name="<?php echo esc_attr($formName); ?>"
	37	+ id="<?php echo esc_attr($formName); ?>"
20	38	onsubmit="this.querySelector('input[type=submit]').click(); return false;" novalidate>
21	39	<fieldset class="adminform acy_user_info">
22		- <legend><span><?php echo acym_translation('ACYM_USER_INFORMATION'); ?></span></legend>
	40	+ <legend>
	41	+ <span>
	42	+ <?php
	43	+ echo wp_kses(
	44	+ acym_translation('ACYM_USER_INFORMATION'),
	45	+ SecurityHelper::ALLOWED_HTML_INTRO
	46	+ );
	47	+ ?>
	48	+ </span>
	49	+ </legend>
23	50	<div id="acyuserinfo">
24	51	<?php
25		-
26	52	foreach ($data['fields'] as $field) {
27		- $field->option = json_decode($field->option);
	53	+ $field->option = !empty($field->option) ? json_decode($field->option) : new stdClass();
28	54	$fieldDB = empty($field->option->fieldDB) ? '' : json_decode($field->option->fieldDB);
29	55	$field->value = empty($field->value) ? '' : json_decode($field->value);
30	56	$valuesArray = [];
31	57	if (!empty($field->value)) {
		@@ -44,16 +70,15 @@
44	70	foreach ($fromDB as $value) {
45	71	$valuesArray[$value->value] = $value->title;
46	72	}
47	73	}
48		- $size = empty($field->option->size) ? '' : 'width:'.$field->option->size.'px';
49		- echo '<span class="onefield fieldacy'.$field->id.'" id="field_'.$field->id.'">';
	74	+ echo '<span class="onefield fieldacy'.esc_attr($field->id).'" id="field_'.esc_attr($field->id).'">';
50	75
51		- echo $data['fieldClass']->displayField($field, $field->default_value, $size, $valuesArray, true, true, $data['user']);
	76	+ $data['fieldClass']->displayField($field, $field->default_value, $valuesArray, true, true, $data['user']);
52	77	echo '</span>';
53	78
54	79	if ($field->id == 2 && $this->config->get('email_confirmation')) {
55		- echo $data['fieldClass']->setEmailConfirmationField(true, $size, 'span', false);
	80	+ $data['fieldClass']->setEmailConfirmationField(true, $field, 'span', false);
56	81	}
57	82	}
58	83	?>
59	84	</div>
		@@ -58,14 +83,28 @@
58	83	?>
59	84	</div>
60	85
61	86	<?php
	87	+ if ($this->config->get('user_tracking_control', 0)) {
	88	+ $trackingChecked = isset($data['user']->tracking) ? (int)$data['user']->tracking === 1 : !$this->config->get('dont_track_by_default', 0);
	89	+ echo '<div class="onefield fieldacytracking" id="field_tracking_'.esc_attr($formName).'">';
	90	+ echo '<label for="mailingdata_tracking_'.esc_attr($formName).'">';
	91	+ echo '<input type="hidden" name="user[tracking]" value="0"/>';
	92	+ echo '<input id="mailingdata_tracking_'.esc_attr(
	93	+ $formName
	94	+ ).'" class="checkbox" type="checkbox" name="user[tracking]" value="1" '.checked($trackingChecked, true, false).'/> '.esc_html(
	95	+ acym_translation('ACYM_ALLOW_TRACKING')
	96	+ );
	97	+ echo '</label>';
	98	+ echo '</div>';
	99	+ }
	100	+
62	101	$exportButton = $this->config->get('gdpr_export', 0);
63	102	$deleteButton = $this->config->get('gdpr_delete', 0);
64	103	if (!empty($data['user']->id) && !(empty($exportButton) && empty($deleteButton))) {
65	104	?>
66	105	<div id="acyuseractions">
67		- <table>
	106	+ <table role="presentation">
68	107	<tr>
69	108	<?php
70	109	if ($exportButton == 1) {
71	110	?>
		@@ -71,10 +110,10 @@
71	110	?>
72	111	<td id="acybutton_subscriber_download_data" <?php if ($deleteButton == 1) {
73	112	echo 'style="padding-right: 10px;"';
74	113	} ?>>
75		- <button class="btn button" onclick="this.form.task.value='exportdata'; this.form.submit(); return false;">
76		- <?php echo acym_translation('ACYM_EXPORT_MY_DATA'); ?>
	114	+ <button class="btn btn-secondary button" onclick="this.form.task.value='exportdata'; this.form.submit(); return false;">
	115	+ <?php echo esc_html(acym_translation('ACYM_EXPORT_MY_DATA')); ?>
77	116	</button>
78	117	</td>
79	118	<?php
80	119	}
		@@ -80,11 +119,11 @@
80	119	}
81	120	if ($deleteButton == 1) {
82	121	?>
83	122	<td id="acybutton_subscriber_delete_data">
84		- <button class="btn button"
	123	+ <button class="btn btn-secondary button"
85	124	onclick="if(confirm(ACYM_JS_TXT.ACYM_ARE_YOU_SURE + '\n' + ACYM_JS_TXT.ACYM_DELETE_MY_DATA_CONFIRM)){ this.form.task.value = 'gdprDelete'; this.form.submit(); } return false;">
86		- <?php echo acym_translation('ACYM_DELETE_MY_DATA'); ?>
	125	+ <?php echo esc_html(acym_translation('ACYM_DELETE_MY_DATA')); ?>
87	126	</button>
88	127	</td>
89	128	<?php
90	129	}
		@@ -94,13 +133,12 @@
94	133	</div>
95	134	<?php } ?>
96	135	</fieldset>
97	136	<?php
98		-
99	137	if ($data['displayLists']) {
100	138	?>
101	139	<fieldset class="adminform acy_subscription_list margin-bottom-1">
102		- <legend><span><?php echo acym_translation('ACYM_SUBSCRIPTION'); ?></span></legend>
	140	+ <legend><span><?php echo esc_html(acym_translation('ACYM_SUBSCRIPTION')); ?></span></legend>
103	141
104	142	<div id="acyusersubscription">
105	143	<?php
106	144	if (empty($data['dropdown'])) {
		@@ -119,17 +157,19 @@
119	157	$row->status = -1;
120	158	}
121	159
122	160	echo '<div class="acym_list">
123		- <div class="acystatus">'.acym_radio(
124		- $values,
125		- 'data[listsub]['.$row->id.'][status]',
126		- $row->status,
127		- [],
128		- ['id' => 'status'.$k++],
129		- true
130		- ).'</div>
131		- <div class="list_name">'.(!empty($row->display_name) ? $row->display_name : $row->name).'</div>
	161	+ <div class="acystatus">';
	162	+ acym_radio(
	163	+ $values,
	164	+ 'data[listsub]['.$row->id.'][status]',
	165	+ $row->status,
	166	+ [],
	167	+ ['id' => 'status'.$k++],
	168	+ true
	169	+ );
	170	+ echo '</div>
	171	+ <div class="list_name">'.esc_html(!empty($row->display_name) ? $row->display_name : $row->name).'</div>
132	172	</div>';
133	173	}
134	174	} else {
135	175	$selectedIndex = '';
		@@ -145,14 +185,14 @@
145	185	if ($row->status == 1) {
146	186	$value = 1;
147	187	$selectedIndex = $k;
148	188	}
149		- echo '<input type="hidden" class="listsub-dropdown" name="data[listsub]['.$row->id.'][status]" value="'.$value.'">';
	189	+ echo '<input type="hidden" class="listsub-dropdown" name="data[listsub]['.esc_attr($row->id).'][status]" value="'.esc_attr($value).'">';
150	190
151	191	$k++;
152	192	}
153	193
154		- echo acym_select($dropdownOpts, 'data[listsubdropdown]', $selectedIndex, null, 'value', 'text');
	194	+ acym_select($dropdownOpts, 'data[listsubdropdown]', $selectedIndex, null, 'value', 'text', null, false, true);
155	195	}
156	196	?>
157	197	</div>
158	198	</fieldset>
		@@ -160,18 +200,19 @@
160	200	}
161	201
162	202	if (empty($data['user']->id) && $data['config']->get('captcha', 'none') !== 'none' && !empty($data['captchaHelper'])) {
163	203	echo '<div id="trcaptcha" class="acy_onefield">';
164		- echo $data['captchaHelper']->display($formName);
	204	+ $data['captchaHelper']->display($formName);
165	205	echo '</div>';
166	206	}
167	207
168	208	if (!empty($data['source'])) {
169		- echo '<input type="hidden" name="acy_source" value="'.acym_escape($data['source']).'" />';
	209	+ echo '<input type="hidden" name="acy_source" value="'.esc_attr($data['source']).'" />';
170	210	}
171	211
	212	+ // CMS specific things
172	213	if (!empty($data['Itemid'])) {
173		- echo '<input type="hidden" name="Itemid" value="'.acym_escape($data['Itemid']).'" />';
	214	+ echo '<input type="hidden" name="Itemid" value="'.esc_attr($data['Itemid']).'" />';
174	215	}
175	216
176	217	if (acym_isNoTemplate()) {
177	218	echo '<input type="hidden" name="tmpl" value="component"/>';
		@@ -176,31 +217,36 @@
176	217	if (acym_isNoTemplate()) {
177	218	echo '<input type="hidden" name="tmpl" value="component"/>';
178	219	}
179	220
	221	+ // Form params
180	222	acym_formOptions(true, 'savechanges', '', 'frontusers');
181	223
182	224	if (isset($data['disableButtons']) && $data['disableButtons']) {
183		- $actionClick = 'return true';
	225	+ $actionClick = 'return false;';
184	226	} else {
185	227	$actionClick = 'return submitAcymForm(\'savechanges\',\''.$formName.'\', \'acym_checkChangeForm\');';
186	228	}
187	229	?>
188	230
189		- <input type="hidden" name="hiddenlists" value="<?php echo implode(',', $data['hiddenlists']); ?>" />
190		- <input type="hidden" name="user[id]" value="<?php echo acym_escape($data['user']->id); ?>" />
191		- <input type="hidden" name="userId" value="<?php echo acym_escape($data['user']->id); ?>" />
192		- <input type="hidden" name="userKey" value="<?php echo acym_escape($data['user']->key); ?>" />
	231	+ <input type="hidden" name="hiddenlists" value="<?php echo esc_attr(implode(',', $data['hiddenlists'])); ?>" />
	232	+ <input type="hidden" name="user[id]" value="<?php echo esc_attr($data['user']->id); ?>" />
	233	+ <input type="hidden" name="userId" value="<?php echo esc_attr($data['user']->id); ?>" />
	234	+ <input type="hidden" name="userKey" value="<?php echo esc_attr($data['user']->key ?? ''); ?>" />
193	235	<input type="hidden" name="ajax" value="1" />
194	236	<input type="hidden" name="acyprofile" value="1" />
195	237
196	238	<p class="acymodifybutton">
197		- <input class="btn btn-primary"
198		- type="submit"
199		- onclick="<?php echo $actionClick; ?>"
200		- value="<?php echo acym_escape(acym_translation(empty($data['user']->id) ? 'ACYM_SUBSCRIBE' : 'ACYM_SAVE_CHANGES')); ?>" />
	239	+ <button class="btn btn-primary"
	240	+ type="submit"
	241	+ onclick="<?php echo esc_attr($actionClick); ?>">
	242	+ <?php echo esc_html(acym_translation(empty($data['user']->id) ? 'ACYM_SUBSCRIBE' : 'ACYM_SAVE_CHANGES')); ?>
	243	+ </button>
201	244	</p>
202	245	</form>
203	246	<?php if (!empty($data['posttext'])) {
204		- echo '<span class="acym_posttext">'.$data['posttext'].'</span>';
	247	+ echo '<span class="acym_posttext">'.wp_kses(
	248	+ $data['posttext'],
	249	+ $allowedIntroTags
	250	+ ).'</span>';
205	251	} ?>
206	252	</div>