← All changes | back/Core/wordpress/form.php +124 -76 10.2.2 → 11.1.0 View file →

		@@ -1,6 +1,8 @@
1	1	<?php
2	2
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
3	5	use AcyMailing\Classes\FieldClass;
4	6	use AcyMailing\Classes\ListClass;
5	7	use AcyMailing\Classes\UserClass;
6	8	use AcyMailing\Core\AcymParameter;
		@@ -6,14 +8,17 @@
6	8	use AcyMailing\Core\AcymParameter;
7	9	use AcyMailing\FrontControllers\FrontusersController;
8	10	use AcyMailing\FrontControllers\ArchiveController;
9	11
10		-function acym_formToken()
	12	+function acym_formToken(): void
11	13	{
12		- return '<input type="hidden" name="_wpnonce" value="'.wp_create_nonce('acymnonce').'">';
	14	+ echo '<input type="hidden" name="_wpnonce" value="'.esc_attr(wp_create_nonce('acymnonce')).'">';
13	15	}
14	16
15		-function acym_checkToken()
	17	+/**
	18	+ * Check token with all the possibilities
	19	+ */
	20	+function acym_checkToken(): void
16	21	{
17	22	$token = acym_getVar('cmd', '_wpnonce');
18	23	if (!wp_verify_nonce($token, 'acymnonce')) {
19	24	die('Invalid Token');
		@@ -19,9 +24,9 @@
19	24	die('Invalid Token');
20	25	}
21	26	}
22	27
23		-function acym_getFormToken()
	28	+function acym_getFormToken(): string
24	29	{
25	30	$token = acym_getVar('cmd', '_wpnonce', '');
26	31	if (empty($token)) {
27	32	$token = wp_create_nonce('acymnonce');
		@@ -40,9 +45,9 @@
40	45	{
41	46	return acym_getVar('cmd', 'noheader') == '1';
42	47	}
43	48
44		-function acym_setNoTemplate(bool $status = true)
	49	+function acym_setNoTemplate(bool $status = true): void
45	50	{
46	51	if ($status) {
47	52	acym_setVar('noheader', '1');
48	53	} else {
		@@ -49,28 +54,27 @@
49	54	unset($_REQUEST['noheader']);
50	55	}
51	56	}
52	57
53		-
54		-function acym_formOptions(bool $token = true, string $task = '', string $currentStep = '', string $currentCtrl = '', bool $addPage = true)
	58	+function acym_formOptions(bool $token = true, string $task = '', string $currentStep = '', string $currentCtrl = '', bool $addPage = true): void
55	59	{
56	60	if (!empty($currentStep)) {
57		- echo '<input type="hidden" name="step" value="'.acym_escape($currentStep).'"/>';
	61	+ echo '<input type="hidden" name="step" value="'.esc_attr($currentStep).'"/>';
58	62	}
59	63	echo '<input type="hidden" name="nextstep" value=""/>';
60		- echo '<input type="hidden" name="task" value="'.acym_escape($task).'"/>';
	64	+ echo '<input type="hidden" name="task" value="'.esc_attr($task).'"/>';
61	65	if ($addPage) {
62		- echo '<input type="hidden" name="page" value="'.acym_escape(acym_getVar('cmd', 'page', '')).'"/>';
	66	+ echo '<input type="hidden" name="page" value="'.esc_attr(acym_getVar('cmd', 'page', '')).'"/>';
63	67	}
64		- echo '<input type="hidden" name="ctrl" value="'.acym_escape(empty($currentCtrl) ? acym_getVar('cmd', 'ctrl', '') : $currentCtrl).'"/>';
	68	+ echo '<input type="hidden" name="ctrl" value="'.esc_attr(empty($currentCtrl) ? acym_getVar('cmd', 'ctrl', '') : $currentCtrl).'"/>';
65	69	if ($token) {
66		- echo acym_formToken();
	70	+ acym_formToken();
67	71	}
68	72	echo '<button type="submit" class="is-hidden" id="formSubmit"></button>';
69	73	}
70	74
71	75	global $acymMetaData;
72		-function acym_addMetadata($meta, $data, $name = 'name')
	76	+function acym_addMetadata($meta, $data, string $name = 'name'): void
73	77	{
74	78	global $acymMetaData;
75	79
76	80	$tag = new stdClass();
		@@ -83,9 +87,9 @@
83	87
84	88	add_action('wp_head', 'acym_head_wp');
85	89	add_action('admin_head', 'acym_head_wp');
86	90	add_action('acym_head', 'acym_head_wp');
87		-function acym_head_wp()
	91	+function acym_head_wp(): void
88	92	{
89	93	global $acymMetaData;
90	94
91	95	if (!empty($acymMetaData)) {
		@@ -90,11 +94,11 @@
90	94
91	95	if (!empty($acymMetaData)) {
92	96	foreach ($acymMetaData as $metadata) {
93	97	if (empty($metadata->data)) {
94		- echo '<meta '.$metadata->name.'="'.acym_escape($metadata->meta).'"/>';
	98	+ echo '<meta '.esc_attr($metadata->name).'="'.esc_attr($metadata->meta).'"/>';
95	99	} else {
96		- echo '<meta '.$metadata->name.'="'.acym_escape($metadata->meta).'" content="'.acym_escape($metadata->data).'"/>';
	100	+ echo '<meta '.esc_attr($metadata->name).'="'.esc_attr($metadata->meta).'" content="'.esc_attr($metadata->data).'"/>';
97	101	}
98	102	}
99	103	}
100	104
		@@ -100,28 +104,34 @@
100	104
101	105	$acymMetaData = [];
102	106	}
103	107
104		-function acym_includeHeaders()
	108	+function acym_includeHeaders(): void
105	109	{
106	110	do_action('acym_head');
107	111	}
108	112
109		-function acym_getOptionRegacyPosition()
	113	+function acym_getOptionRegacyPosition(): void
110	114	{
111	115	}
112	116
113		-function acym_renderForm(AcymParameter $params, $args = [])
	117	+function acym_renderForm(AcymParameter $params, array $args = []): void
114	118	{
115	119	acym_initModule($params);
116	120
117		- $return = !empty($args['before_widget']) ? $args['before_widget'] : '';
	121	+ if (!empty($args['before_widget'])) {
	122	+ echo wp_kses_post($args['before_widget']);
	123	+ }
118	124
119	125	$title = apply_filters('widget_title', $params->get('title'));
120	126	if (!empty($title)) {
121		- if (!empty($args['before_title'])) $return .= $args['before_title'];
122		- $return .= $title;
123		- if (!empty($args['after_title'])) $return .= $args['after_title'];
	127	+ if (!empty($args['before_title'])) {
	128	+ echo wp_kses_post($args['before_title']);
	129	+ }
	130	+ echo esc_html($title);
	131	+ if (!empty($args['after_title'])) {
	132	+ echo wp_kses_post($args['after_title']);
	133	+ }
124	134	}
125	135
126	136	$identifiedUser = null;
127	137	$currentUserEmail = acym_currentUserEmail();
		@@ -136,8 +146,9 @@
136	146	acym_arrayToInteger($visibleLists);
137	147	acym_arrayToInteger($hiddenLists);
138	148	acym_arrayToInteger($allFields);
139	149
	150	+ // We need the email address
140	151	if (!in_array(2, $allFields)) {
141	152	$allFields[] = 2;
142	153	}
143	154
		@@ -158,13 +169,15 @@
158	169	if (empty($visibleLists) && empty($hiddenLists)) {
159	170	$hiddenLists = array_keys($allLists);
160	171	}
161	172
	173	+ // Make sure we don't display a list that's in "automatically subscribe to"
162	174	if (!empty($visibleLists) && !empty($hiddenLists)) {
163	175	$visibleLists = array_diff($visibleLists, $hiddenLists);
164	176	}
165	177
166	178	if (empty($identifiedUser->id)) {
	179	+ //Check lists based on the option
167	180	$checkedLists = $params->get('listschecked', []);
168	181	if (!is_array($checkedLists)) {
169	182	if (strtolower($checkedLists) == 'all') {
170	183	$checkedLists = $visibleLists;
		@@ -191,11 +204,11 @@
191	204	}
192	205	}
193	206	acym_arrayToInteger($checkedLists);
194	207
195		-
196	208	$config = acym_config();
197	209
	210	+ // Texts
198	211	$subscribeText = $params->get('subtext', 'ACYM_SUBSCRIBE');
199	212	if (!empty($identifiedUser->id)) $subscribeText = $params->get('subtextlogged', 'ACYM_SUBSCRIBE');
200	213	$unsubscribeText = $params->get('unsubtext', 'ACYM_UNSUBSCRIBE');
201	214	$unsubButton = $params->get('unsub', '0');
		@@ -201,25 +214,44 @@
201	214	$unsubButton = $params->get('unsub', '0');
202	215
203	216	$disableButtons = !empty($args['disableButtons']) || acym_isAdmin();
204	217
	218	+ // Formatting
205	219	$listPosition = $params->get('listposition', 'before');
206	220	$displayOutside = $params->get('textmode') == '0';
207	221
	222	+ $showTrackingConsent = $params->get('trackingconsent', '0') == '1';
	223	+
	224	+ // Display success message
208	225	$successMode = $params->get('successmode', 'replace');
209	226
	227	+ // Redirections
210	228	$redirectURL = $params->get('redirect', '');
211	229	$unsubRedirectURL = $params->get('unsubredirect', '');
212	230	$ajax = empty($redirectURL) && empty($unsubRedirectURL) && $successMode != 'standard' ? '1' : '0';
213	231
	232	+ // Customization
214	233	$formClass = $params->get('formclass', '');
215	234	$alignment = $params->get('alignment', 'none');
216		- $style = $alignment == 'none' ? '' : 'style="text-align: '.$alignment.'"';
217	235
218		- $displayInAPopup = 0;
219		- $termsURL = acym_getArticleURL($params->get('termscontent', 0), $displayInAPopup, 'ACYM_TERMS_CONDITIONS');
220		- $privacyURL = acym_getArticleURL($params->get('privacypolicy', 0), $displayInAPopup, 'ACYM_PRIVACY_POLICY');
	236	+ // Articles
	237	+ $termsURL = acym_getArticleURL($params->get('termscontent', 0), false, 'ACYM_TERMS_CONDITIONS');
	238	+ $privacyURL = acym_getArticleURL($params->get('privacypolicy', 0), false, 'ACYM_PRIVACY_POLICY');
221	239
	240	+ if (empty($termsURL)) {
	241	+ $termsURL = $params->get('termscontentURL') ?? '';
	242	+ if (!empty($termsURL)) {
	243	+ $termsURL = '<a href="'.esc_url($termsURL).'" target="_blank">'.esc_html(acym_translation('ACYM_TERMS_CONDITIONS')).'</a>';
	244	+ }
	245	+ }
	246	+
	247	+ if (empty($privacyURL)) {
	248	+ $privacyURL = $params->get('privacypolicyURL') ?? '';
	249	+ if (!empty($privacyURL)) {
	250	+ $privacyURL = '<a href="'.esc_url($privacyURL).'" target="_blank">'.esc_html(acym_translation('ACYM_PRIVACY_POLICY')).'</a>';
	251	+ }
	252	+ }
	253	+
222	254	if (empty($termsURL) && empty($privacyURL)) {
223	255	$termslink = '';
224	256	} elseif (empty($privacyURL)) {
225	257	$termslink = acym_translationSprintf('ACYM_I_AGREE_TERMS', $termsURL);
		@@ -231,27 +263,15 @@
231	263
232	264	$formName = acym_getModuleFormName();
233	265	$formAction = htmlspecialchars_decode(acym_frontendLink('frontusers'));
234	266
235		- $js = "window.addEventListener('DOMContentLoaded', (event) => {";
236		- $js .= "\n"."acymModule['excludeValues".$formName."'] = [];";
237		- $fieldsToDisplay = [];
238		- foreach ($fields as $field) {
239		- $fieldsToDisplay[$field->id] = $field->name;
240		- $js .= "\n".'acymModule["excludeValues'.$formName.'"]["'.$field->id.'"] = "'.acym_translation($field->name, true).'";';
241		- }
242		- $js .= " });";
243		- $return .= '<script type="text/javascript">
244		- '.$js.'
245		- </script>';
246		-
247	267	$buttonStyle = '';
248		- if (!empty($params->get('button_background_color', ''))) $buttonStyle .= 'background-color: '.$params->get('button_background_color', '').';';
249		- if (!empty($params->get('button_text_color', ''))) $buttonStyle .= 'color: '.$params->get('button_text_color', '').';';
250		- if (strlen($params->get('button_border_size', '')) > 0) $buttonStyle .= 'border-width: '.$params->get('button_border_size', '').'px;';
251		- if (!empty($params->get('button_border_type', ''))) $buttonStyle .= 'border-style: '.$params->get('button_border_type', '').';';
252		- if (!empty($params->get('button_border_color', ''))) $buttonStyle .= 'border-color: '.$params->get('button_border_color', '').';';
253		- if (strlen($params->get('button_border_radius', '')) > 0) $buttonStyle .= 'border-radius: '.$params->get('button_border_radius', '').'px;';
	268	+ if (!empty($params->get('button_background_color', ''))) $buttonStyle .= 'background-color: '.esc_attr($params->get('button_background_color', '')).';';
	269	+ if (!empty($params->get('button_text_color', ''))) $buttonStyle .= 'color: '.esc_attr($params->get('button_text_color', '')).';';
	270	+ if (strlen($params->get('button_border_size', '')) > 0) $buttonStyle .= 'border-width: '.esc_attr($params->get('button_border_size', '')).'px;';
	271	+ if (!empty($params->get('button_border_type', ''))) $buttonStyle .= 'border-style: '.esc_attr($params->get('button_border_type', '')).';';
	272	+ if (!empty($params->get('button_border_color', ''))) $buttonStyle .= 'border-color: '.esc_attr($params->get('button_border_color', '')).';';
	273	+ if (strlen($params->get('button_border_radius', '')) > 0) $buttonStyle .= 'border-radius: '.esc_attr($params->get('button_border_radius', '')).'px;';
254	274
255	275	if (!empty($buttonStyle)) {
256	276	acym_addStyle(true, '#acym_module_'.$formName.' .acysubbuttons .subbutton {'.$buttonStyle.'}');
257	277	}
		@@ -263,28 +283,39 @@
263	283	if (!empty($globalStyle)) {
264	284	acym_addStyle(true, '#acym_module_'.$formName.', #acym_module_'.$formName.' td {'.$globalStyle.'}');
265	285	}
266	286
267		- ob_start();
	287	+ // Exclude default values from fields, if the user didn't fill them in
268	288	?>
269		- <div class="acym_module <?php echo acym_escape($formClass); ?>" id="acym_module_<?php echo $formName; ?>">
270		- <div class="acym_fulldiv" id="acym_fulldiv_<?php echo $formName; ?>" <?php echo $style; ?>>
	289	+ <script type="text/javascript">
	290	+ window.addEventListener('DOMContentLoaded', (event) => {
	291	+ window.acymModule[<?php echo json_encode('excludeValues'.$formName); ?>] = [];
	292	+ <?php
	293	+ foreach ($fields as $field) {
	294	+ echo 'window.acymModule["excludeValues'.esc_attr($formName).'"]["'.esc_attr($field->id).'"] = '.json_encode(acym_translation($field->name)).';';
	295	+ }
	296	+ ?>
	297	+ });
	298	+ </script>
	299	+ <div class="acym_module <?php echo esc_attr($formClass); ?>" id="acym_module_<?php echo esc_attr($formName); ?>">
	300	+ <div class="acym_fulldiv" id="acym_fulldiv_<?php echo esc_attr($formName); ?>" <?php echo $alignment === 'none' ? '' : 'style="text-align: '.esc_attr($alignment).'"'; ?>>
271	301	<form enctype="multipart/form-data"
272		- id="<?php echo acym_escape($formName); ?>"
273		- name="<?php echo acym_escape($formName); ?>"
274		- method="POST"
275		- action="<?php echo acym_escape($formAction); ?>"
276		- onsubmit="return submitAcymForm('subscribe','<?php echo $formName; ?>', 'acymSubmitSubForm')">
	302	+ id="<?php echo esc_attr($formName); ?>"
	303	+ name="<?php echo esc_attr($formName); ?>"
	304	+ method="POST"
	305	+ aria-label="<?php echo esc_attr(acym_translation('ACYM_SUBSCRIPTION')); ?>"
	306	+ action="<?php echo esc_attr($formAction); ?>"
	307	+ onsubmit="return submitAcymForm('subscribe','<?php echo esc_attr($formName); ?>')">
277	308	<div class="acym_module_form">
278	309	<?php
279	310	$introText = $params->get('introtext', '');
280	311	if (!empty($introText)) {
281		- echo '<div class="acym_introtext">'.$introText.'</div>';
	312	+ echo '<div class="acym_introtext">'.esc_html($introText).'</div>';
282	313	}
283		- if ($params->get('mode', 'tableless') == 'tableless') {
	314	+ if ($params->get('mode', 'tableless') === 'tableless') {
284	315	include ACYM_FOLDER.'widgets'.DS.'subscriptionform'.DS.'tmpl'.DS.'tableless.php';
285	316	} else {
286		- $displayInline = $params->get('mode', 'tableless') != 'vertical';
	317	+ $displayInline = $params->get('mode', 'tableless') !== 'vertical';
287	318	include ACYM_FOLDER.'widgets'.DS.'subscriptionform'.DS.'tmpl'.DS.'default.php';
288	319	}
289	320	?>
290	321	</div>
		@@ -290,26 +321,26 @@
290	321	</div>
291	322
292	323	<input type="hidden" name="ctrl" value="frontusers" />
293	324	<input type="hidden" name="task" value="notask" />
294		- <input type="hidden" name="option" value="<?php echo acym_escape(ACYM_COMPONENT); ?>" />
	325	+ <input type="hidden" name="option" value="<?php echo esc_attr(ACYM_COMPONENT); ?>" />
295	326
296	327	<?php
297		- if (!empty($redirectURL)) echo '<input type="hidden" name="redirect" value="'.acym_escape($redirectURL).'"/>';
298		- if (!empty($unsubRedirectURL)) echo '<input type="hidden" name="redirectunsub" value="'.acym_escape($unsubRedirectURL).'"/>';
	328	+ if (!empty($redirectURL)) echo '<input type="hidden" name="redirect" value="'.esc_url($redirectURL).'"/>';
	329	+ if (!empty($unsubRedirectURL)) echo '<input type="hidden" name="redirectunsub" value="'.esc_url($unsubRedirectURL).'"/>';
299	330	?>
300		- <input type="hidden" name="ajax" value="<?php echo acym_escape($ajax); ?>" />
301		- <input type="hidden" name="successmode" value="<?php echo acym_escape($successMode); ?>" />
302		- <input type="hidden" name="acy_source" value="<?php echo acym_escape($params->get('source', '')); ?>" />
303		- <input type="hidden" name="hiddenlists" value="<?php echo implode(',', $hiddenLists); ?>" />
304		- <input type="hidden" name="acyformname" value="<?php echo acym_escape($formName); ?>" />
	331	+ <input type="hidden" name="ajax" value="<?php echo esc_attr($ajax); ?>" />
	332	+ <input type="hidden" name="successmode" value="<?php echo esc_attr($successMode); ?>" />
	333	+ <input type="hidden" name="acy_source" value="<?php echo esc_attr($params->get('source', '')); ?>" />
	334	+ <input type="hidden" name="hiddenlists" value="<?php echo esc_attr(implode(',', $hiddenLists)); ?>" />
	335	+ <input type="hidden" name="acyformname" value="<?php echo esc_attr($formName); ?>" />
305	336	<input type="hidden" name="acysubmode" value="widget_acym" />
306		- <input type="hidden" name="confirmation_message" value="<?php echo acym_escape($params->get('confirmation_message', '')); ?>" />
	337	+ <input type="hidden" name="confirmation_message" value="<?php echo esc_attr($params->get('confirmation_message', '')); ?>" />
307	338
308	339	<?php
309	340	$postText = $params->get('posttext', '');
310	341	if (!empty($postText)) {
311		- echo '<div class="acym_posttext">'.$postText.'</div>';
	342	+ echo '<div class="acym_posttext">'.esc_html($postText).'</div>';
312	343	}
313	344	?>
314	345	</form>
315	346	</div>
		@@ -314,16 +345,14 @@
314	345	</form>
315	346	</div>
316	347	</div>
317	348	<?php
318		- $return .= ob_get_clean();
319		-
320		- if (!empty($args['after_widget'])) $return .= $args['after_widget'];
321		-
322		- return $return;
	349	+ if (!empty($args['after_widget'])) {
	350	+ echo wp_kses_post($args['after_widget']);
	351	+ }
323	352	}
324	353
325		-function acym_renderFormProfile(AcymParameter $params, $args = [])
	354	+function acym_renderFormProfile(AcymParameter $params, array $args = []): string
326	355	{
327	356	acym_initModule($params);
328	357
329	358	if (!is_array($params->get('listsdropdown', '0'))) {
		@@ -344,9 +373,11 @@
344	373	'source' => $params->get('source', ''),
345	374	];
346	375
347	376	$title = apply_filters('widget_title', $instance['title']);
348		- if (!empty($title)) $title = '<span class="gamma widget-title">'.$title.'</span>';
	377	+ if (!empty($title)) {
	378	+ $title = '<span class="gamma widget-title">'.esc_html($title).'</span>';
	379	+ }
349	380	$return = $title;
350	381
351	382	ob_start();
352	383	acym_setVar('page', ACYM_COMPONENT.'_front');
		@@ -366,9 +397,9 @@
366	397
367	398	return $return;
368	399	}
369	400
370		-function acym_renderFormArchive(AcymParameter $params, $args = [])
	401	+function acym_renderFormArchive(AcymParameter $params, array $args = []): string
371	402	{
372	403	acym_initModule($params);
373	404
374	405	if (!is_array($params->get('popup', '1'))) {
		@@ -390,9 +421,11 @@
390	421	'displayUserListOnly' => $displayUserListOnly,
391	422	];
392	423
393	424	$title = apply_filters('widget_title', $instance['title']);
394		- if (!empty($title)) $title = '<span class="gamma widget-title">'.$title.'</span>';
	425	+ if (!empty($title)) {
	426	+ $title = '<span class="gamma widget-title">'.esc_html($title).'</span>';
	427	+ }
395	428	$return = $title;
396	429	ob_start();
397	430	acym_setVar('page', 'front');
398	431	$searchs = acym_getVar('array', 'acym_search', []);
		@@ -414,5 +447,20 @@
414	447
415	448	$return .= ob_get_clean();
416	449
417	450	return $return;
	451	+}
	452	+
	453	+function acym_checked(bool $checked, bool $current = true, bool $display = true): string
	454	+{
	455	+ return checked($checked, $current, $display);
	456	+}
	457	+
	458	+function acym_selected(bool $selected, bool $current = true, bool $display = true): string
	459	+{
	460	+ return selected($selected, $current, $display);
	461	+}
	462	+
	463	+function acym_disabled(bool $disabled, bool $current = true, bool $display = true): string
	464	+{
	465	+ return disabled($disabled, $current, $display);
418	466	}