| 1 |
<?php |
| 2 |
|
| 3 |
namespace BitCode\BitForm\Core\Util; |
| 4 |
|
| 5 |
use BitCode\BitForm\Core\Form\FormManager; |
| 6 |
use WP_Rewrite; |
| 7 |
|
| 8 |
final class FrontendHelpers |
| 9 |
{ |
| 10 |
public static $isPageBuilder = false; |
| 11 |
public static $bfFrontendFormIds = []; |
| 12 |
public static $bfFrontendViewIds = []; |
| 13 |
public static $bfFormIdsFromPost = []; |
| 14 |
public static $bfViewIdsFromPost = []; |
| 15 |
private static $formsPermissions = []; |
| 16 |
|
| 17 |
public static $pageBuilderQueryParamsList = [ |
| 18 |
'et_pb_preview' => 'true', // divi |
| 19 |
'vc_editable' => 'true', // wp bakery |
| 20 |
'action' => 'ct_render_shortcode' // oxygen |
| 21 |
]; |
| 22 |
|
| 23 |
public static $pageBuilderURLParamsList = [ |
| 24 |
'wp-json/bricks/v1/render', // bricks |
| 25 |
]; |
| 26 |
|
| 27 |
public static $pageBuilderRefererQueryParamsList = [ |
| 28 |
'breakdance' => 'builder', // breakdance |
| 29 |
]; |
| 30 |
|
| 31 |
public static function getFormIdsFromPost() |
| 32 |
{ |
| 33 |
global $post; |
| 34 |
global $wpdb; |
| 35 |
if (empty($post)) { |
| 36 |
self::$bfFormIdsFromPost = []; |
| 37 |
return []; |
| 38 |
} |
| 39 |
$postId = $post->ID; |
| 40 |
$shortcodeFormIds = []; |
| 41 |
// postmeta table name from $wpdb->postmeta (WordPress-managed, not user input). post_id parameterized via %d. |
| 42 |
$bfMetaValues = $wpdb->get_results( |
| 43 |
$wpdb->prepare( |
| 44 |
'SELECT meta_value FROM `' . $wpdb->postmeta . '` WHERE `post_id`=%d', |
| 45 |
$postId |
| 46 |
) |
| 47 |
); |
| 48 |
$postContent = $post->post_content; |
| 49 |
$bfMetaValues[] = (object) ['meta_value' => $postContent]; |
| 50 |
foreach ($bfMetaValues as $bfShortcut) { |
| 51 |
$meta_value = (is_string($bfShortcut->meta_value) && !empty($bfShortcut->meta_value)) ? $bfShortcut->meta_value : ''; |
| 52 |
$shortcodeIds = self::getShortCodeIds($meta_value); |
| 53 |
$shortcodeFormIds = array_merge($shortcodeFormIds, $shortcodeIds); |
| 54 |
} |
| 55 |
|
| 56 |
self::$bfFormIdsFromPost = $shortcodeFormIds; |
| 57 |
return $shortcodeFormIds; |
| 58 |
} |
| 59 |
|
| 60 |
public static function getShortCodeIds($content = '') |
| 61 |
{ |
| 62 |
$pattern = '/' . get_shortcode_regex(['bitform']) . '/'; |
| 63 |
\preg_match_all($pattern, $content, $short); |
| 64 |
|
| 65 |
$formIds = []; |
| 66 |
foreach ($short[3] as $attr_string) { |
| 67 |
$attr = shortcode_parse_atts($attr_string); |
| 68 |
if (!empty($attr['id'])) { |
| 69 |
$formIds[] = $attr['id']; |
| 70 |
} |
| 71 |
} |
| 72 |
|
| 73 |
// Regex handles: |
| 74 |
// 1. [bitform ... id=... ] |
| 75 |
// 2. id="123" or id='123' or id=123 |
| 76 |
// 3. Escaped quotes id=\"123\" or id=\'123\' (common in builder meta) |
| 77 |
// \preg_match_all('/\[bitform\s+\b[^\]]*\bid\s*=\s*(?:\\\\?[\'"])?(\d+)(?:\\\\?[\'"])?[^\]]*\]/', $content, $shortCode); |
| 78 |
// $ids = $shortCode[1]; |
| 79 |
|
| 80 |
return $formIds; |
| 81 |
} |
| 82 |
|
| 83 |
public static function getViewIdsFromPost() |
| 84 |
{ |
| 85 |
global $post; |
| 86 |
global $wpdb; |
| 87 |
if (empty($post)) { |
| 88 |
self::$bfViewIdsFromPost = []; |
| 89 |
return []; |
| 90 |
} |
| 91 |
$postId = $post->ID; |
| 92 |
$shortcodeViewIds = []; |
| 93 |
// postmeta table name from $wpdb->postmeta (WordPress-managed, not user input). post_id parameterized via %d. |
| 94 |
$bfMetaValues = $wpdb->get_results($wpdb->prepare('SELECT meta_value FROM `' . $wpdb->postmeta . '` WHERE `post_id` = %d', $postId)); |
| 95 |
$postContent = $post->post_content; |
| 96 |
|
| 97 |
$bfMetaValues[] = (object) ['meta_value' => $postContent]; |
| 98 |
foreach ($bfMetaValues as $bfShortcut) { |
| 99 |
$meta_value = (is_string($bfShortcut->meta_value) && !empty($bfShortcut->meta_value)) ? $bfShortcut->meta_value : ''; |
| 100 |
$shortcodeIds = self::getViewShortCodeIds($meta_value); |
| 101 |
$shortcodeViewIds = array_merge($shortcodeViewIds, $shortcodeIds); |
| 102 |
} |
| 103 |
|
| 104 |
self::$bfViewIdsFromPost = $shortcodeViewIds; |
| 105 |
return $shortcodeViewIds; |
| 106 |
} |
| 107 |
|
| 108 |
public static function getViewShortCodeIds($content = '') |
| 109 |
{ |
| 110 |
$pattern = '/' . get_shortcode_regex(['bitform-view']) . '/'; |
| 111 |
\preg_match_all($pattern, $content, $short); |
| 112 |
|
| 113 |
$viewIds = []; |
| 114 |
|
| 115 |
foreach ($short[3] as $attr_string) { |
| 116 |
$attr = shortcode_parse_atts($attr_string); |
| 117 |
if (!empty($attr['id'])) { |
| 118 |
$viewIds[] = $attr['id']; |
| 119 |
} |
| 120 |
} |
| 121 |
|
| 122 |
// \preg_match_all('/\[bitform-view\s+\b[^\]]*\bid\s*=\s*["\']?(\d+)["\']?[^\]]*\]/', $content, $shortCode); |
| 123 |
// $ids = $shortCode[1]; |
| 124 |
return $viewIds; |
| 125 |
} |
| 126 |
|
| 127 |
public static function checkIsPageBuilder($srvr) |
| 128 |
{ |
| 129 |
if (is_admin()) { |
| 130 |
self::$isPageBuilder = true; |
| 131 |
return true; |
| 132 |
} |
| 133 |
$current_url = $srvr['REQUEST_URI']; |
| 134 |
$queryParams = self::parseQueryParams($current_url); |
| 135 |
foreach (self::$pageBuilderQueryParamsList as $key => $value) { |
| 136 |
if (isset($queryParams[$key]) && $queryParams[$key] === $value) { |
| 137 |
self::$isPageBuilder = true; |
| 138 |
return true; |
| 139 |
} |
| 140 |
} |
| 141 |
foreach (self::$pageBuilderURLParamsList as $value) { |
| 142 |
if (false !== strpos($current_url, $value)) { |
| 143 |
self::$isPageBuilder = true; |
| 144 |
return true; |
| 145 |
} |
| 146 |
} |
| 147 |
|
| 148 |
$referrer = isset($srvr['HTTP_REFERER']) ? $srvr['HTTP_REFERER'] : ''; |
| 149 |
$referrerQueryParams = self::parseQueryParams($referrer); |
| 150 |
foreach (self::$pageBuilderRefererQueryParamsList as $key => $value) { |
| 151 |
if (isset($referrerQueryParams[$key]) && $referrerQueryParams[$key] === $value) { |
| 152 |
self::$isPageBuilder = true; |
| 153 |
return true; |
| 154 |
} |
| 155 |
} |
| 156 |
|
| 157 |
return self::$isPageBuilder; |
| 158 |
} |
| 159 |
|
| 160 |
public static function parseQueryParams($url) |
| 161 |
{ |
| 162 |
$url_components = wp_parse_url($url); |
| 163 |
if (isset($url_components['query'])) { |
| 164 |
parse_str($url_components['query'], $queryParams); |
| 165 |
return $queryParams; |
| 166 |
} |
| 167 |
return []; |
| 168 |
} |
| 169 |
|
| 170 |
public static function isRestRequest() |
| 171 |
{ |
| 172 |
$prefix = rest_get_url_prefix(); |
| 173 |
// Read-only check to detect REST requests for routing; no state change performed here. |
| 174 |
if (defined('REST_REQUEST') && REST_REQUEST |
| 175 |
|| (isset($_GET['rest_route']) |
| 176 |
&& 0 === strpos(trim(sanitize_text_field(wp_unslash($_GET['rest_route'])), '\\/'), $prefix, 0))) { |
| 177 |
return true; |
| 178 |
} |
| 179 |
global $wp_rewrite; |
| 180 |
if (null === $wp_rewrite) { |
| 181 |
$wp_rewrite = new WP_Rewrite(); |
| 182 |
} |
| 183 |
$rest_url = wp_parse_url(trailingslashit(rest_url())); |
| 184 |
$current_url = wp_parse_url(add_query_arg([])); |
| 185 |
return 0 === strpos($current_url['path'], $rest_url['path'], 0); |
| 186 |
} |
| 187 |
|
| 188 |
public static function isAjaxRequest() |
| 189 |
{ |
| 190 |
if (function_exists('wp_doing_ajax') && wp_doing_ajax()) { |
| 191 |
return true; |
| 192 |
} |
| 193 |
if (self::isRestRequest()) { |
| 194 |
return true; |
| 195 |
} |
| 196 |
|
| 197 |
if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && 'xmlhttprequest' === strtolower(sanitize_text_field(wp_unslash($_SERVER['HTTP_X_REQUESTED_WITH'])))) { |
| 198 |
return true; |
| 199 |
} |
| 200 |
if (isset($_SERVER['HTTP_SEC_FETCH_MODE'], $_SERVER['HTTP_SEC_FETCH_DEST'])) { |
| 201 |
$destination = strtolower(sanitize_text_field(wp_unslash($_SERVER['HTTP_SEC_FETCH_DEST']))); |
| 202 |
$mode = strtolower(sanitize_text_field(wp_unslash($_SERVER['HTTP_SEC_FETCH_MODE']))); |
| 203 |
if (('empty' === $destination && in_array($mode, ['cors', 'same-origin'], true))) { |
| 204 |
return true; |
| 205 |
} |
| 206 |
} |
| 207 |
|
| 208 |
return false; |
| 209 |
} |
| 210 |
|
| 211 |
public static function isAdminRequest() |
| 212 |
{ |
| 213 |
$current_url = home_url(add_query_arg(null, null)); |
| 214 |
$admin_url = strtolower(admin_url()); |
| 215 |
$referrer = strtolower(wp_get_referer()); |
| 216 |
|
| 217 |
$requestFromBackend = self::isRestRequest() && strpos($admin_url, '/wp-admin/') > 0 && !strpos($admin_url, '/wp-admin/admin-ajax.php'); |
| 218 |
|
| 219 |
if ($requestFromBackend) { |
| 220 |
return true; |
| 221 |
} |
| 222 |
|
| 223 |
if (0 === strpos($current_url, $admin_url)) { |
| 224 |
if (0 === strpos($referrer, $admin_url)) { |
| 225 |
return true; |
| 226 |
} else { |
| 227 |
if (function_exists('wp_doing_ajax')) { |
| 228 |
return !wp_doing_ajax(); |
| 229 |
} else { |
| 230 |
return !(defined('DOING_AJAX') && DOING_AJAX); |
| 231 |
} |
| 232 |
} |
| 233 |
} else { |
| 234 |
return false; |
| 235 |
} |
| 236 |
} |
| 237 |
|
| 238 |
public static function parseUrlParams($url) |
| 239 |
{ |
| 240 |
$url_components = wp_parse_url($url); |
| 241 |
if (isset($url_components['path'])) { |
| 242 |
$urlParams = explode('/', $url_components['path']); |
| 243 |
return $urlParams; |
| 244 |
} |
| 245 |
|
| 246 |
return []; |
| 247 |
} |
| 248 |
|
| 249 |
public static function setBfFrontendFormIds($formId) |
| 250 |
{ |
| 251 |
self::$bfFrontendFormIds[] = $formId; |
| 252 |
} |
| 253 |
|
| 254 |
public static function getAllFormIdsInPage() |
| 255 |
{ |
| 256 |
$bfFrontendFormIds = self::$bfFrontendFormIds; |
| 257 |
$bfFormIdsFromPost = self::getFormIdsFromPost(); |
| 258 |
$allFormIds = array_merge($bfFrontendFormIds, $bfFormIdsFromPost); |
| 259 |
return $allFormIds; |
| 260 |
} |
| 261 |
|
| 262 |
public static function getAllViewIdsInPage() |
| 263 |
{ |
| 264 |
$bfFrontendViewIds = self::$bfFrontendViewIds; |
| 265 |
$bfViewIdsFromPost = self::getViewIdsFromPost(); |
| 266 |
$allViewIds = array_merge($bfFrontendViewIds, $bfViewIdsFromPost); |
| 267 |
return $allViewIds; |
| 268 |
} |
| 269 |
|
| 270 |
public static function getAllUniqFormIdsInPage() |
| 271 |
{ |
| 272 |
return array_unique(self::getAllFormIdsInPage()); |
| 273 |
} |
| 274 |
|
| 275 |
public static function hasMultipleForms() |
| 276 |
{ |
| 277 |
$bfUniqFormIds = self::getAllFormIdsInPage(); |
| 278 |
self::checkIsPageBuilder($_SERVER); |
| 279 |
$isPageBuilder = self::$isPageBuilder; |
| 280 |
$bfMultipleFormsExists = $isPageBuilder ? true : count($bfUniqFormIds) > 1; |
| 281 |
return $bfMultipleFormsExists; |
| 282 |
} |
| 283 |
|
| 284 |
public static function getFormPermissions($formId) |
| 285 |
{ |
| 286 |
if (!isset(self::$formsPermissions[$formId])) { |
| 287 |
$formManager = FormManager::getInstance($formId); |
| 288 |
self::$formsPermissions[$formId] = $formManager->getFormPermission(); |
| 289 |
} |
| 290 |
|
| 291 |
return self::$formsPermissions[$formId]; |
| 292 |
} |
| 293 |
|
| 294 |
public static function is_current_user_can_access($formId, $action = 'entryViewAccess', $scope = '', $entryUserId = '') |
| 295 |
{ |
| 296 |
$formPermissions = self::getFormPermissions($formId); |
| 297 |
$accessPermission = isset($formPermissions->{$action}) ? $formPermissions->{$action} : null; |
| 298 |
if (empty($accessPermission)) { |
| 299 |
return false; |
| 300 |
} |
| 301 |
if ('entryViewAccess' === $action && (!isset($accessPermission->preventPublicAccess) || !$accessPermission->preventPublicAccess)) { |
| 302 |
return true; |
| 303 |
} |
| 304 |
if (is_user_logged_in()) { |
| 305 |
$user = wp_get_current_user(); |
| 306 |
$userId = (string) $user->ID; |
| 307 |
if (in_array('administrator', $user->roles) || current_user_can('manage_bitform')) { |
| 308 |
return true; |
| 309 |
} |
| 310 |
if ('entryEditAccess' === $action && !(isset($accessPermission->allowEntriesEdit) && $accessPermission->allowEntriesEdit)) { |
| 311 |
return false; |
| 312 |
} |
| 313 |
if (!empty($scope) && !empty($accessPermission->{$scope}) && is_string($accessPermission->{$scope})) { |
| 314 |
$accessRolesArray = explode(',', $accessPermission->{$scope}); |
| 315 |
if (self::has_access_for_roles($user, $accessRolesArray) && empty($entryUserId)) { |
| 316 |
return true; |
| 317 |
} |
| 318 |
if (!empty($entryUserId) && (('ownEntries' === $scope && $userId === $entryUserId) || ('othersEntries' === $scope && $userId !== $entryUserId))) { |
| 319 |
return true; |
| 320 |
} |
| 321 |
} |
| 322 |
|
| 323 |
if (empty($scope) && isset($accessPermission->ownEntries) && !empty($accessPermission->ownEntries) && is_string($accessPermission->ownEntries)) { |
| 324 |
$accessRolesArray = explode(',', $accessPermission->ownEntries); |
| 325 |
if (self::has_access_for_roles($user, $accessRolesArray) && !empty($entryUserId) && $userId === $entryUserId) { |
| 326 |
return true; |
| 327 |
} |
| 328 |
if (self::has_access_for_roles($user, $accessRolesArray) && empty($entryUserId)) { |
| 329 |
return true; |
| 330 |
} |
| 331 |
} |
| 332 |
|
| 333 |
if (empty($scope) && isset($accessPermission->othersEntries) && !empty($accessPermission->othersEntries) && is_string($accessPermission->othersEntries)) { |
| 334 |
$accessRolesArray = explode(',', $accessPermission->othersEntries); |
| 335 |
if (self::has_access_for_roles($user, $accessRolesArray) && !empty($entryUserId) && $userId !== $entryUserId) { |
| 336 |
return true; |
| 337 |
} |
| 338 |
if (self::has_access_for_roles($user, $accessRolesArray) && empty($entryUserId)) { |
| 339 |
return true; |
| 340 |
} |
| 341 |
} |
| 342 |
} |
| 343 |
return false; |
| 344 |
} |
| 345 |
|
| 346 |
private static function has_access_for_roles($user, $accessRoles) |
| 347 |
{ |
| 348 |
// If "all_logged_in_users" is in the allowed roles, grant access |
| 349 |
if (in_array('all_logged_in_users', $accessRoles)) { |
| 350 |
return true; |
| 351 |
} |
| 352 |
// Check if any of the user's roles match the allowed roles |
| 353 |
$userRoles = array_intersect($user->roles, $accessRoles); |
| 354 |
return !empty($userRoles); |
| 355 |
} |
| 356 |
} |
| 357 |
|
