PluginProbe
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder / 3.3.1
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder v3.3.1
3.3.1 V-3.3.0 3.2.2 3.2.1 3.2.0 3.1.4 3.1.3 3.1.2 3.1.1 3.1.0 V3.0.3 V3.0.2 -3.0.1 V_3.0.0 1.1.1 1.1.8 1.2 1.3 1.4 1.4.18 1.5.2 1.9 2.0 2.10.0 2.10.1 All 138 releases
← All changes | includes/Admin/AdminAjax.php +1593 -301 2.0 → 3.3.1 View file →
@@ -1,24 +1,39 @@
1 1 <?php
2 2
3 3 namespace BitCode\BitForm\Admin;
4 4
5 +if (!defined('ABSPATH')) {
6 + exit;
7 +}
8 +
5 9 use BitCode\BitForm\Admin\Form\FrontEndScriptGenerator;
6 10 use BitCode\BitForm\Admin\Form\Helpers;
7 11 use BitCode\BitForm\Admin\Form\Template\TemplateProvider;
8 -use BitCode\BitForm\Core\Database\DB;
12 +use BitCode\BitForm\Core\Database\FormEntryLogModel;
9 13 use BitCode\BitForm\Core\Database\FormEntryModel;
10 14 use BitCode\BitForm\Core\Database\FormModel;
11 15 use BitCode\BitForm\Core\Form\FormHandler;
12 16 use BitCode\BitForm\Core\Integration\IntegrationHandler;
13 17 use BitCode\BitForm\Core\Integration\Integrations;
14 -use BitCode\BitForm\Core\Migration\MigrateForms;
15 18 use BitCode\BitForm\Core\Util\IpTool;
19 +use BitCode\BitForm\Core\Util\MailConfig;
20 +use BitCode\BitForm\Core\Util\MetaBoxService;
21 +use BitCode\BitForm\Core\Util\Utilities;
22 +use BitCode\BitForm\Frontend\Form\FrontendFormManager;
23 +use BitCode\BitForm\GlobalHelper;
24 +use WP_Error;
16 25
17 -class AdminAjax {
18 - public function register() {
26 +class AdminAjax
27 +{
28 + public function register()
29 + {
19 30 add_action('wp_ajax_bitforms_integrations', [$this, 'integrations']);
20 - add_action('wp_ajax_integration', [$this, 'integration']);
31 + add_action('wp_ajax_bitforms_save_connected_integration_apps', [$this, 'saveConnectedIntegrationApps']);
32 + add_action('wp_ajax_bitforms_get_connected_integration_apps', [$this, 'getConnectedIntegrationApps']);
33 + add_action('wp_ajax_bitforms_delete_connected_app', [$this, 'deleteConnectedApp']);
34 + add_action('wp_ajax_bitforms_update_connected_app', [$this, 'updateConnectedApp']);
35 + add_action('wp_ajax_bitforms_integration_last_runs', [$this, 'integrationLastRuns']);
21 36 add_action('wp_ajax_bitforms_update_form', [$this, 'updateForm']);
22 37 add_action('wp_ajax_bitforms_templates', [$this, 'templates']);
23 38 add_action('wp_ajax_bitforms_create_new_form', [$this, 'createNewForm']);
24 39 add_action('wp_ajax_bitforms_save_css', [$this, 'saveCss']);
@@ -32,8 +47,9 @@
32 47 add_action('wp_ajax_bitforms_duplicate_aform', [$this, 'duplicateAForm']);
33 48 add_action('wp_ajax_bitforms_export_aform', [$this, 'exportAForm']);
34 49 add_action('wp_ajax_bitforms_import_aform', [$this, 'importAForm']);
35 50 add_action('wp_ajax_bitforms_get_form_entries', [$this, 'getFormEntry']);
51 + add_action('wp_ajax_bitforms_get_entries_for_report', [$this, 'getEntriesForReport']);
36 52 add_action('wp_ajax_bitforms_duplicate_form_entries', [$this, 'duplicateFormEntry']);
37 53 add_action('wp_ajax_bitforms_edit_form_entry', [$this, 'editFormEntry']);
38 54 add_action('wp_ajax_bitforms_update_form_entry', [$this, 'updateFormEntry']);
39 55 add_action('wp_ajax_bitforms_get_all_form', [$this, 'getAllForms']);
@@ -39,8 +55,9 @@
39 55 add_action('wp_ajax_bitforms_get_all_form', [$this, 'getAllForms']);
40 56 add_action('wp_ajax_bitforms_get_all_wp_pages', [$this, 'getAllWPPages']);
41 57 add_action('wp_ajax_bitforms_delete_success_messsage', [$this, 'deleteSuccessMessage']);
42 58 add_action('wp_ajax_bitforms_delete_integration', [$this, 'deleteAIntegration']);
59 + add_action('wp_ajax_bitforms_update_integration_status', [$this, 'updateIntegrationStatus']);
43 60 add_action('wp_ajax_bitforms_delete_workflow', [$this, 'deleteAWorkflow']);
44 61 add_action('wp_ajax_bitforms_delete_mailtemplate', [$this, 'deleteAMailTemplate']);
45 62 add_action('wp_ajax_bitforms_duplicate_mailtemplate', [$this, 'duplicateAMailTemplate']);
46 63 add_action('wp_ajax_bitforms_save_allForm_report_prefs', [$this, 'setAllFormsReport']);
@@ -45,9 +62,8 @@
45 62 add_action('wp_ajax_bitforms_duplicate_mailtemplate', [$this, 'duplicateAMailTemplate']);
46 63 add_action('wp_ajax_bitforms_save_allForm_report_prefs', [$this, 'setAllFormsReport']);
47 64 add_action('wp_ajax_bitforms_save_grecaptcha', [$this, 'savegReCaptcha']);
48 65 add_action('wp_ajax_bitforms_form_log_history', [$this, 'getLogHistory']);
49 - add_action('wp_ajax_bitforms_import_file_data', [$this, 'importFileData']);
50 66 add_action('wp_ajax_bitforms_filter_export_data', [$this, 'filterExportEntry']);
51 67 add_action('wp_ajax_bitforms_api_key', [$this, 'saveApiKey']);
52 68 add_action('wp_ajax_bitforms_form_helpers_state', [$this, 'builerHelperState']);
53 69 add_action('wp_ajax_bitforms_icn_save_setting', [$this, 'iconUpload']);
@@ -58,29 +74,122 @@
58 74 add_action('wp_ajax_bitforms_entry_status_update', [$this, 'updateEntryStatus']);
59 75 add_action('wp_ajax_bitforms_get_generel_settings', [$this, 'getGenerelSettings']);
60 76 add_action('wp_ajax_bitforms_save_generel_settings', [$this, 'saveGenerelSettings']);
61 77 add_action('wp_ajax_bitforms_get_form_entry_count', [$this, 'getFormEntryLabelAndCount']);
62 - add_action('wp_ajax_bitforms_save_payment_setting', [$this, 'savePaymentSettings']);
78 + add_action('wp_ajax_bitforms_save_global_messages', [$this, 'saveGlobalMessages']);
63 79
64 80 // form migrate code
65 81 add_action('wp_ajax_bitforms_get_migrated_form_contents', [$this, 'migrateFormContents']);
66 82 add_action('wp_ajax_bitforms_migrate_to_v2_complete', [$this, 'migrationComplete']);
67 - add_action('wp_ajax_bitforms_migrate_back_to_v1', [$this, 'migrationBackToV1']);
83 + // add_action('wp_ajax_bitforms_migrate_back_to_v1', [$this, 'migrationBackToV1']);
68 84
69 85 // PRO TO FREE (SMTP)
70 86 add_action('wp_ajax_bitforms_get_mail_config', [$this, 'getEmailConfig']);
71 87 add_action('wp_ajax_bitforms_mail_config', [$this, 'saveEmailConfig']);
72 88 add_action('wp_ajax_bitforms_test_email', [$this, 'testEmail']);
89 +
90 + // PODS INTEGRATION
91 + add_action('wp_ajax_bitforms_get_pod_field', [$this, 'getPodsField']);
92 + add_action('wp_ajax_bitforms_get_pod_type', [$this, 'getPodsType']);
93 +
94 + // ACF INTEGRATION
95 + add_action('wp_ajax_bitforms_get_acf_group_fields', [$this, 'getAcfGroupFields']);
96 + add_action('wp_ajax_bitforms_get_custom_field', [$this, 'getCustomField']);
97 +
98 + // common (get post type) for integration
99 + add_action('wp_ajax_bitforms_get_post_type', [$this, 'postTypeByUser']);
100 +
101 + // WP users and roles (lazy-loaded, not inlined on page load)
102 + add_action('wp_ajax_bitforms_get_wp_users', [$this, 'getWPUsers']);
103 + add_action('wp_ajax_bitforms_get_user_roles', [$this, 'getUserRoles']);
104 +
105 + // transient invalidation when users change
106 + add_action('user_register', [$this, 'clearUsersTransient']);
107 + add_action('deleted_user', [$this, 'clearUsersTransient']);
108 + add_action('profile_update', [$this, 'clearUsersTransient']);
109 +
110 + // Meta Box INTEGRATION
111 + add_action('wp_ajax_bitforms_get_metabox_fields', [$this, 'getMetaBoxFields']);
112 +
113 + // CHANGELOG VERSION OPTIONS
114 + add_action('wp_ajax_bitforms_changelog_version', [$this, 'setChangelogVersion']);
115 +
116 + // Notice Options
117 + add_action('wp_ajax_bitforms_handle_notice', [$this, 'handleNotice']);
118 +
119 + // conversational
120 + add_action('wp_ajax_bitforms_save_conversational_css', [$this, 'saveConversationalCSS']);
121 +
122 + // get form html markup
123 + add_action('wp_ajax_bitforms_get_form_html', [$this, 'getFormHtml']);
73 124 }
74 125
126 + private function verifyAdminPermission()
127 + {
128 + if (!current_user_can('manage_bitform') && !current_user_can('manage_options')) {
129 + wp_send_json_error(__('Insufficient permissions.', 'bit-form'), 403);
130 + }
131 + }
132 +
133 + public function getFormHtml()
134 + {
135 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
136 + $this->verifyAdminPermission();
137 + $formId = isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '';
138 +
139 + $FrontendFormManager = FrontendFormManager::getInstance($formId);
140 + if (!$FrontendFormManager->isExist()) {
141 + wp_send_json_error(__('Form is not exists.', 'bit-form'), 404);
142 + }
143 + $formContent = $FrontendFormManager->getFormContentWithValue();
144 + if (!is_object($formContent) || !isset($formContent->fields, $formContent->layout)) {
145 + wp_send_json_error(__('Form content is unavailable.', 'bit-form'), 404);
146 + }
147 + $fields = $formContent->fields;
148 + $layout = $formContent->layout;
149 + $file = count($FrontendFormManager->getUploadFields()) > 0 ? $FrontendFormManager->getUploadFields() : false;
150 + $html = $FrontendFormManager->formView($fields, $file);
151 +
152 + if (file_exists(BITFORMS_CONTENT_DIR . DIRECTORY_SEPARATOR . 'form-styles')) {
153 + $cssPath = BITFORMS_CONTENT_DIR . DIRECTORY_SEPARATOR . 'form-styles' . DIRECTORY_SEPARATOR . "bitform-{$formId}-formid" . '.css';
154 +
155 + if (file_exists($cssPath)) {
156 + $getCss = file_get_contents($cssPath);
157 + } else {
158 + $getCss = '';
159 + }
160 + }
161 +
162 + $data = [
163 + 'html' => $html,
164 + 'css' => $getCss,
165 + ];
166 +
167 + wp_send_json_success(
168 + $data,
169 + 200
170 + );
171 + } else {
172 + wp_send_json_error(
173 + __(
174 + 'Token expired',
175 + 'bit-form'
176 + ),
177 + 401
178 + );
179 + }
180 + }
181 +
75 182 /**
76 183 * Undocumented function
77 184 *
78 185 * @return void
79 186 */
80 - public function integrations() {
81 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
82 - $testIntegration = new Integrations();
187 + public function integrations()
188 + {
189 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
190 + $this->verifyAdminPermission();
191 + $testIntegration = Integrations::getInstance();
83 192 $allIntegrations = $testIntegration->getAllintegrations();
84 193 if ($allIntegrations) {
85 194 wp_send_json_success($allIntegrations, 200);
86 195 } else {
@@ -99,10 +208,208 @@
99 208 );
100 209 }
101 210 }
102 211
103 - public function templates() {
104 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
212 + /**
213 + * Undocumented function
214 + *
215 + * @return void
216 + */
217 + public function saveConnectedIntegrationApps()
218 + {
219 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
220 + $this->verifyAdminPermission();
221 + // $inputJSON = wp_unslash($_POST['data']);
222 + // $input = json_decode($inputJSON);
223 + GlobalHelper::requirePostMethod();
224 + try {
225 + $input = GlobalHelper::formatRequestData();
226 + } catch (\InvalidArgumentException $e) {
227 + wp_send_json_error($e->getMessage(), 400);
228 + }
229 + // wp_send_json_success($input, 200);
230 + $integrations = Integrations::getInstance();
231 + $status = $integrations->saveConnectedIntegrationApp($input);
232 +
233 + // if (isset($input->customCodes)) {
234 + // FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
235 + // }
236 + if (is_wp_error($status)) {
237 + wp_send_json_error($status->get_error_message(), 411);
238 + } else {
239 + wp_send_json_success($status, 200);
240 + }
241 + } else {
242 + wp_send_json_error(
243 + __(
244 + 'Token expired',
245 + 'bit-form'
246 + ),
247 + 401
248 + );
249 + }
250 + }
251 +
252 + /**
253 + * Undocumented function
254 + *
255 + * @return void
256 + */
257 + public function getConnectedIntegrationApps()
258 + {
259 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
260 + $this->verifyAdminPermission();
261 + GlobalHelper::requirePostMethod();
262 + try {
263 + $input = GlobalHelper::formatRequestData();
264 + } catch (\InvalidArgumentException $e) {
265 + wp_send_json_error($e->getMessage(), 400);
266 + }
267 +
268 + $integrationType = isset($input->integrationType) ? $input->integrationType : null;
269 + $testIntegration = Integrations::getInstance();
270 + $allIntegrations = $testIntegration->getConnectedIntegrationApp($integrationType);
271 + if ($allIntegrations) {
272 + wp_send_json_success($allIntegrations, 200);
273 + } else {
274 + wp_send_json_error(
275 + __('No Connected App Found', 'bit-form'),
276 + 404
277 + );
278 + }
279 + } else {
280 + wp_send_json_error(
281 + __(
282 + 'Token expired',
283 + 'bit-form'
284 + ),
285 + 401
286 + );
287 + }
288 + }
289 +
290 + public function deleteConnectedApp()
291 + {
292 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
293 + $this->verifyAdminPermission();
294 + // $inputJSON = wp_unslash($_POST['data']);
295 + // $input = json_decode($inputJSON);
296 + GlobalHelper::requirePostMethod();
297 + try {
298 + $input = GlobalHelper::formatRequestData();
299 + } catch (\InvalidArgumentException $e) {
300 + wp_send_json_error($e->getMessage(), 400);
301 + }
302 + // Nonce verified at handler entry (wp_verify_nonce 'bitforms_save', line 273).
303 + $requestedAppId = isset($_REQUEST['appId'])
304 + ? sanitize_text_field(wp_unslash($_REQUEST['appId']))
305 + : '';
306 + $appId = $requestedAppId
307 + ? $requestedAppId
308 + : sanitize_text_field(wp_unslash((string) ($input->appId ?? '')));
309 + $integrationHandler = Integrations::getInstance();
310 + $status = $integrationHandler->deleteConnectedApp($appId);
311 + if (is_wp_error($status)) {
312 + wp_send_json_error($status->get_error_message(), 411);
313 + } else {
314 + wp_send_json_success($status, 200);
315 + }
316 + } else {
317 + wp_send_json_error(
318 + __(
319 + 'Token expired',
320 + 'bit-form'
321 + ),
322 + 401
323 + );
324 + }
325 + }
326 +
327 + /**
328 + * Renames a connected account (category connected_integration_apps, form_id 0).
329 + * Only integration_name is writable; updateIntegration would overwrite the rest.
330 + *
331 + * @return void
332 + */
333 + public function updateConnectedApp()
334 + {
335 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
336 + $this->verifyAdminPermission();
337 + GlobalHelper::requirePostMethod();
338 + try {
339 + $input = GlobalHelper::formatRequestData();
340 + } catch (\InvalidArgumentException $e) {
341 + wp_send_json_error($e->getMessage(), 400);
342 + }
343 + $appId = !empty($input->appId) ? sanitize_text_field((string) $input->appId) : '';
344 + $name = isset($input->name) ? sanitize_text_field((string) $input->name) : '';
345 + if (empty($appId) || '' === trim($name)) {
346 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
347 + }
348 + $integrations = Integrations::getInstance();
349 + $status = $integrations->renameConnectedApp($appId, $name);
350 + if (is_wp_error($status)) {
351 + wp_send_json_error($status->get_error_message(), 411);
352 + } else {
353 + wp_send_json_success($status, 200);
354 + }
355 + } else {
356 + wp_send_json_error(
357 + __(
358 + 'Token expired',
359 + 'bit-form'
360 + ),
361 + 401
362 + );
363 + }
364 + }
365 +
366 + /**
367 + * Last execution per integration of a form, for the integrations list Last Run column.
368 + *
369 + * @return void
370 + */
371 + public function integrationLastRuns()
372 + {
373 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
374 + $this->verifyAdminPermission();
375 + GlobalHelper::requirePostMethod();
376 + try {
377 + $input = GlobalHelper::formatRequestData();
378 + } catch (\InvalidArgumentException $e) {
379 + wp_send_json_error($e->getMessage(), 400);
380 + }
381 + $formID = !empty($input->formID) ? absint($input->formID) : 0;
382 + if (empty($formID)) {
383 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
384 + }
385 + $logModel = new FormEntryLogModel();
386 + $rows = $logModel->getIntegrationLastRuns($formID);
387 + if (is_wp_error($rows)) {
388 + // result_empty means nothing has run yet, which is a success. Any other
389 + // error is a failed query — answering [] would paint every integration
390 + // as never executed. Message stays generic: no DB detail to the browser.
391 + if ('result_empty' !== $rows->get_error_code()) {
392 + wp_send_json_error(__('Could not load integration run history', 'bit-form'), 500);
393 + }
394 + $rows = [];
395 + }
396 + wp_send_json_success($rows, 200);
397 + } else {
398 + wp_send_json_error(
399 + __(
400 + 'Token expired',
401 + 'bit-form'
402 + ),
403 + 401
404 + );
405 + }
406 + }
407 +
408 + public function templates()
409 + {
410 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
411 + $this->verifyAdminPermission();
105 412 $templateProvider = new TemplateProvider();
106 413 $status = $templateProvider->getAllTemplates();
107 414 if (is_wp_error($status)) {
108 415 wp_send_json_error($status->get_error_message(), 411);
@@ -119,13 +426,22 @@
119 426 );
120 427 }
121 428 }
122 429
123 - public function builerHelperState() {
124 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
125 - $inputJSON = file_get_contents('php://input');
126 - $input = json_decode($inputJSON);
430 + public function builerHelperState()
431 + {
432 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
433 + $this->verifyAdminPermission();
434 + // $inputJSON = wp_unslash($_POST['data']);
435 + // $input = json_decode($inputJSON);
127 436
437 + GlobalHelper::requirePostMethod();
438 + try {
439 + $input = GlobalHelper::formatRequestData();
440 + } catch (\InvalidArgumentException $e) {
441 + wp_send_json_error($e->getMessage(), 400);
442 + }
443 +
128 444 $formID = $input->formID;
129 445 $formHandler = FormHandler::getInstance();
130 446 $results = $formHandler->admin->builerHelperState($formID);
131 447 if (is_wp_error($results)) {
@@ -143,14 +459,25 @@
143 459 );
144 460 }
145 461 }
146 462
147 - public function getTemplate() {
148 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
149 - $inputJSON = file_get_contents('php://input');
150 - $input = json_decode($inputJSON);
463 + public function getTemplate()
464 + {
465 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
466 + $this->verifyAdminPermission();
467 + // $inputJSON = wp_unslash($_POST['data']);
468 + // $input = json_decode($inputJSON);
469 + GlobalHelper::requirePostMethod();
470 + try {
471 + $input = GlobalHelper::formatRequestData();
472 + } catch (\InvalidArgumentException $e) {
473 + wp_send_json_error($e->getMessage(), 400);
474 + }
151 475 $formHandler = FormHandler::getInstance();
152 - $status = $formHandler->admin->getTemplate($_REQUEST, $input);
476 + $sanitized_request = [
477 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
478 + ];
479 + $status = $formHandler->admin->getTemplate($sanitized_request, $input);
153 480 if (is_wp_error($status)) {
154 481 wp_send_json_error($status->get_error_message(), 411);
155 482 } else {
156 483 wp_send_json_success($status, 200);
@@ -165,10 +492,12 @@
165 492 );
166 493 }
167 494 }
168 495
169 - public function getAllForms() {
170 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
496 + public function getAllForms()
497 + {
498 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
499 + $this->verifyAdminPermission();
171 500 $formHandler = FormHandler::getInstance();
172 501 $all_forms = $formHandler->admin->getAllForm();
173 502 if (is_wp_error($all_forms)) {
174 503 wp_send_json_error($all_forms->get_error_message(), 411);
@@ -185,14 +514,13 @@
185 514 );
186 515 }
187 516 }
188 517
189 - public function migrateFormContents() {
190 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
191 - update_site_option('bitforms_db_version', '2.0');
192 - DB::migrate();
193 - $migrateFormsHandler = new MigrateForms();
194 - $all_forms = $migrateFormsHandler->migrateToV2();
518 + public function migrateFormContents()
519 + {
520 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
521 + $this->verifyAdminPermission();
522 + $all_forms = get_transient('bitforms_v1_form_contents');
195 523 wp_send_json_success($all_forms, 200);
196 524 } else {
197 525 wp_send_json_error(
198 526 __(
@@ -203,9 +531,68 @@
203 531 );
204 532 }
205 533 }
206 534
207 - private function formatFormContentForUpdate($formContents) {
535 + public function setChangelogVersion()
536 + {
537 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
538 + $this->verifyAdminPermission();
539 + // $inputJSON = wp_unslash($_POST['data']);
540 + // $input = json_decode($inputJSON);
541 + GlobalHelper::requirePostMethod();
542 + try {
543 + $input = GlobalHelper::formatRequestData();
544 + } catch (\InvalidArgumentException $e) {
545 + wp_send_json_error($e->getMessage(), 400);
546 + }
547 +
548 + $version = isset($input->version) ? $input->version : '';
549 + update_option('bitforms_changelog_version', $version);
550 + wp_send_json_success($version, 200);
551 + } else {
552 + wp_send_json_error(
553 + __(
554 + 'Token expired',
555 + 'bit-form'
556 + ),
557 + 401
558 + );
559 + }
560 + }
561 +
562 + public function handleNotice()
563 + {
564 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
565 + $this->verifyAdminPermission();
566 + GlobalHelper::requirePostMethod();
567 + try {
568 + // $inputJSON = wp_unslash($_POST['data']);
569 + // $input = json_decode($inputJSON);
570 + $input = GlobalHelper::formatRequestData();
571 + $optionName = isset($input->optionName) ? $input->optionName : '';
572 + $optionValue = isset($input->optionValue) ? $input->optionValue : '';
573 + $allowedNoticeKeys = ['bitforms_hide_cashback', 'bitforms_hide_announcement'];
574 + if (!in_array($optionName, $allowedNoticeKeys, true)) {
575 + wp_send_json_error(__('Invalid option', 'bit-form'), 400);
576 + }
577 + update_option($optionName, (bool) $optionValue);
578 + wp_send_json_success([$optionName, (bool) $optionValue], 200);
579 + } catch (\Exception | \InvalidArgumentException $e) {
580 + wp_send_json_error($e->getMessage(), 400);
581 + }
582 + } else {
583 + wp_send_json_error(
584 + __(
585 + 'Token expired',
586 + 'bit-form'
587 + ),
588 + 401
589 + );
590 + }
591 + }
592 +
593 + private function formatFormContentForUpdate($formContents)
594 + {
208 595 $updatedFormContents = (object) [];
209 596 $updatedPaths = [
210 597 'id' => 'id',
211 598 'form_name' => 'form_name',
@@ -245,24 +632,31 @@
245 632
246 633 return $updatedFormContents;
247 634 }
248 635
249 - public function getEmailConfig() {
250 - \ignore_user_abort();
636 + public function getEmailConfig()
637 + {
638 + Utilities::ignoreUserAbort();
251 639
252 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
253 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action']);
640 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
641 + $this->verifyAdminPermission();
254 642 $ipTool = new IpTool();
255 643 $user_details = $ipTool->getUserDetail();
256 644 $integrationHandler = new IntegrationHandler(0, $user_details);
257 645 $user_details = $ipTool->getUserDetail();
258 646 $formIntegrations = $integrationHandler->getAllIntegration('mail', 'smtp');
647 + if (is_wp_error($formIntegrations)) {
648 + wp_send_json_error($formIntegrations->get_error_message(), 411);
649 + }
650 + if (isset($formIntegrations[0]->integration_details) && is_string($formIntegrations[0]->integration_details)) {
651 + $formIntegrations[0]->integration_details = wp_unslash($formIntegrations[0]->integration_details);
652 + }
259 653 wp_send_json_success($formIntegrations, 200);
260 654 } else {
261 655 wp_send_json_error(
262 656 __(
263 657 'Token expired',
264 - 'bitformpro'
658 + 'bit-form'
265 659 ),
266 660 401
267 661 );
268 662 }
@@ -267,17 +661,24 @@
267 661 );
268 662 }
269 663 }
270 664
271 - public function saveEmailConfig() {
272 - \ignore_user_abort();
273 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
665 + public function saveEmailConfig()
666 + {
667 + Utilities::ignoreUserAbort();
668 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
669 + $this->verifyAdminPermission();
670 + GlobalHelper::requirePostMethod();
274 671 $ipTool = new IpTool();
275 - $status = $_REQUEST['status'];
276 672 $user_details = $ipTool->getUserDetail();
277 673 $integrationHandler = new IntegrationHandler(0, $user_details);
278 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action'], $_REQUEST['status']);
279 - $integrationDetails = json_encode($_REQUEST);
674 + try {
675 + $formattedData = GlobalHelper::formatRequestData();
676 + } catch (\InvalidArgumentException $e) {
677 + wp_send_json_error($e->getMessage(), 400);
678 + }
679 + $status = isset($formattedData->status) ? $formattedData->status : null;
680 + $integrationDetails = json_encode($formattedData, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
280 681 $user_details = $ipTool->getUserDetail();
281 682 $integrationName = 'smtp';
282 683 $integrationType = 'smtp';
283 684 $formIntegrations = $integrationHandler->getAllIntegration('mail', 'smtp');
@@ -290,9 +691,9 @@
290 691 } else {
291 692 wp_send_json_error(
292 693 __(
293 694 'Token expired',
294 - 'bitformpro'
695 + 'bit-form'
295 696 ),
296 697 401
297 698 );
298 699 }
@@ -297,14 +698,24 @@
297 698 );
298 699 }
299 700 }
300 701
301 - public function testEmail() {
302 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
303 - $to = wp_unslash($_REQUEST['to']);
304 - $subject = wp_unslash($_REQUEST['subject']);
305 - $message = wp_unslash($_REQUEST['message']);
306 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action']);
702 + public function testEmail()
703 + {
704 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
705 + $this->verifyAdminPermission();
706 + GlobalHelper::requirePostMethod();
707 +
708 + try {
709 + $formattedData = GlobalHelper::formatRequestData();
710 + } catch (\InvalidArgumentException $e) {
711 + wp_send_json_error($e->getMessage(), 400);
712 + }
713 +
714 + $to = isset($formattedData->to) ? sanitize_email($formattedData->to) : '';
715 + $subject = isset($formattedData->subject) ? sanitize_text_field($formattedData->subject) : '';
716 + $message = isset($formattedData->message) ? sanitize_textarea_field($formattedData->message) : '';
717 +
307 718 if (!empty($to) && !empty($subject) && !empty($message)) {
308 719 try {
309 720 (new MailConfig())->sendMail();
310 721 add_action('wp_mail_failed', function ($error) {
@@ -313,9 +724,9 @@
313 724 wp_send_json_error($data, 400);
314 725 });
315 726 $result = wp_mail($to, $subject, $message);
316 727 wp_send_json_success($result, 200);
317 - } catch (Exception $e) {
728 + } catch (\Exception $e) {
318 729 wp_send_json_error($e->getMessage(), 400);
319 730 }
320 731 } else {
321 732 wp_send_json_error(
@@ -320,9 +731,9 @@
320 731 } else {
321 732 wp_send_json_error(
322 733 __(
323 734 'Some of the test fields are empty or an invalid email supplied',
324 - 'bitformpro'
735 + 'bit-form'
325 736 ),
326 737 401
327 738 );
328 739 }
@@ -329,9 +740,9 @@
329 740 } else {
330 741 wp_send_json_error(
331 742 __(
332 743 'Token expired',
333 - 'bitformpro'
744 + 'bit-form'
334 745 ),
335 746 401
336 747 );
337 748 }
@@ -336,10 +747,12 @@
336 747 );
337 748 }
338 749 }
339 750
340 - public function migrationComplete() {
341 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
751 + public function migrationComplete()
752 + {
753 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
754 + $this->verifyAdminPermission();
342 755 delete_transient('bitforms_v1_form_contents');
343 756 delete_option('bitforms_migrating_to_v2');
344 757 update_option('bitforms_migrated_to_v2', true);
345 758 wp_send_json_success(__('Migration Complete', 'bit-form'), 200);
@@ -353,13 +766,22 @@
353 766 );
354 767 }
355 768 }
356 769
357 - public function migrationBackToV1() {
358 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
359 - $migrateFormsHandler = new MigrateForms();
360 - $migrateFormsHandler->rollbackToV1();
361 - wp_send_json_success(__('Migration Back to V1', 'bit-form'), 200);
770 + public function importDataStore()
771 + {
772 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
773 + $this->verifyAdminPermission();
774 + // $inputJSON = wp_unslash($_POST['data']);
775 + // $input = json_decode($inputJSON);
776 + GlobalHelper::requirePostMethod();
777 + try {
778 + $input = GlobalHelper::formatRequestData();
779 + } catch (\InvalidArgumentException $e) {
780 + wp_send_json_error($e->getMessage(), 400);
781 + }
782 + echo wp_json_encode($input);
783 + die;
362 784 } else {
363 785 wp_send_json_error(
364 786 __(
365 787 'Token expired',
@@ -369,21 +791,28 @@
369 791 );
370 792 }
371 793 }
372 794
373 - public function importDataStore() {
374 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
375 - $inputJSON = file_get_contents('php://input');
376 - $input = json_decode($inputJSON);
377 - echo json_encode($input);
378 - die;
379 - // $formHandler = FormHandler::getInstance();
380 - // $status = $formHandler->admin->getFormEntryLabelAndCount($_REQUEST, $input);
381 - // if (is_wp_error($status)) {
382 - // wp_send_json_error($status->get_error_message(), 411);
383 - // } else {
384 - // wp_send_json_success($status, 200);
385 - // }
795 + public function getFormEntryLabelAndCount()
796 + {
797 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
798 + $this->verifyAdminPermission();
799 + // $inputJSON = wp_unslash($_POST['data']);
800 + // $input = json_decode($inputJSON);
801 + GlobalHelper::requirePostMethod();
802 + try {
803 + $input = GlobalHelper::formatRequestData();
804 + } catch (\InvalidArgumentException $e) {
805 + wp_send_json_error($e->getMessage(), 400);
806 + }
807 +
808 + $formHandler = FormHandler::getInstance();
809 + $status = $formHandler->admin->getFormEntryLabelAndCount($_REQUEST, $input);
810 + if (is_wp_error($status)) {
811 + wp_send_json_error($status->get_error_message(), 411);
812 + } else {
813 + wp_send_json_success($status, 200);
814 + }
386 815 } else {
387 816 wp_send_json_error(
388 817 __(
389 818 'Token expired',
@@ -393,14 +822,23 @@
393 822 );
394 823 }
395 824 }
396 825
397 - public function getFormEntryLabelAndCount() {
398 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
399 - $inputJSON = file_get_contents('php://input');
400 - $input = json_decode($inputJSON);
826 + public function getFormEntry()
827 + {
828 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
829 + $this->verifyAdminPermission();
830 + GlobalHelper::requirePostMethod();
831 + try {
832 + $input = GlobalHelper::formatRequestData();
833 + } catch (\InvalidArgumentException $e) {
834 + wp_send_json_error($e->getMessage(), 400);
835 + }
401 836 $formHandler = FormHandler::getInstance();
402 - $status = $formHandler->admin->getFormEntryLabelAndCount($_REQUEST, $input);
837 + $sanitized_request = [
838 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
839 + ];
840 + $status = $formHandler->admin->getFormEntry($sanitized_request, $input);
403 841 if (is_wp_error($status)) {
404 842 wp_send_json_error($status->get_error_message(), 411);
405 843 } else {
406 844 wp_send_json_success($status, 200);
@@ -405,24 +843,27 @@
405 843 } else {
406 844 wp_send_json_success($status, 200);
407 845 }
408 846 } else {
409 - wp_send_json_error(
410 - __(
411 - 'Token expired',
412 - 'bit-form'
413 - ),
414 - 401
415 - );
847 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
416 848 }
417 849 }
418 850
419 - public function getFormEntry() {
420 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
421 - $inputJSON = file_get_contents('php://input');
422 - $input = json_decode($inputJSON);
851 + public function getEntriesForReport()
852 + {
853 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
854 + $this->verifyAdminPermission();
855 + GlobalHelper::requirePostMethod();
856 + try {
857 + $input = GlobalHelper::formatRequestData();
858 + } catch (\InvalidArgumentException $e) {
859 + wp_send_json_error($e->getMessage(), 400);
860 + }
423 861 $formHandler = FormHandler::getInstance();
424 - $status = $formHandler->admin->getFormEntry($_REQUEST, $input);
862 + $sanitized_request = [
863 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
864 + ];
865 + $status = $formHandler->admin->getEntriesForReport($sanitized_request, $input);
425 866 if (is_wp_error($status)) {
426 867 wp_send_json_error($status->get_error_message(), 411);
427 868 } else {
428 869 wp_send_json_success($status, 200);
@@ -431,12 +872,18 @@
431 872 wp_send_json_error(__('Token expired', 'bit-form'), 401);
432 873 }
433 874 }
434 875
435 - public function filterExportEntry() {
436 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
437 - $inputJSON = file_get_contents('php://input');
438 - $input = json_decode($inputJSON);
876 + public function filterExportEntry()
877 + {
878 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
879 + $this->verifyAdminPermission();
880 + GlobalHelper::requirePostMethod();
881 + try {
882 + $input = GlobalHelper::formatRequestData();
883 + } catch (\InvalidArgumentException $e) {
884 + wp_send_json_error($e->getMessage(), 400);
885 + }
439 886 $formHandler = FormHandler::getInstance();
440 887 $status = $formHandler->admin->getExportEntry($input->data);
441 888 if (is_wp_error($status)) {
442 889 wp_send_json_error($status->get_error_message(), 411);
@@ -452,16 +899,24 @@
452 899 * Undocumented function
453 900 *
454 901 * @return void
455 902 */
456 - public function updateForm() {
457 - \ignore_user_abort();
458 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
459 - $inputJSON = file_get_contents('php://input');
460 - $input = json_decode($inputJSON);
903 + public function updateForm()
904 + {
905 + Utilities::ignoreUserAbort();
906 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
907 + $this->verifyAdminPermission();
908 + GlobalHelper::requirePostMethod();
909 + try {
910 + $input = GlobalHelper::formatRequestData();
911 + } catch (\InvalidArgumentException $e) {
912 + wp_send_json_error($e->getMessage(), 400);
913 + }
461 914 $formHandler = FormHandler::getInstance();
462 - $status = $formHandler->admin->updateForm($_REQUEST, $input);
463 - FrontEndScriptGenerator::customCodeFile($input->id, $input->customCodes);
915 + $status = $formHandler->admin->updateForm([], $input);
916 + if (isset($input->customCodes)) {
917 + FrontEndScriptGenerator::customCodeFile($input->id, $input->customCodes);
918 + }
464 919 if (is_wp_error($status)) {
465 920 wp_send_json_error($status->get_error_message(), 411);
466 921 } else {
467 922 wp_send_json_success($status, 200);
@@ -476,17 +931,28 @@
476 931 );
477 932 }
478 933 }
479 934
480 - public function saveCss() {
481 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
482 - $inputJSON = file_get_contents('php://input');
483 - $input = json_decode($inputJSON);
935 + public function saveCss()
936 + {
937 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
938 + $this->verifyAdminPermission();
939 + GlobalHelper::requirePostMethod();
940 + try {
941 + $input = GlobalHelper::formatRequestData();
942 + } catch (\InvalidArgumentException $e) {
943 + wp_send_json_error($e->getMessage(), 400);
944 + }
945 +
946 + $formId = isset($input->form_id) ? sanitize_text_field($input->form_id) : '';
947 + if (!filter_var($formId, FILTER_VALIDATE_INT)) {
948 + wp_send_json_error(__('Invalid form id', 'bit-form'), 400);
949 + }
484 950 if (isset($input->atomicCssText)) {
485 - $status = FrontEndScriptGenerator::saveCssFile("{$input->form_id}", $input->atomicCssText);
951 + $status = FrontEndScriptGenerator::saveCssFile($formId, $input->atomicCssText);
486 952 }
487 953 if (isset($input->atomicCssWithFormIdText)) {
488 - $status = FrontEndScriptGenerator::saveCssFile("{$input->form_id}-formid", $input->atomicCssWithFormIdText);
954 + $status = FrontEndScriptGenerator::saveCssFile("{$formId}-formid", $input->atomicCssWithFormIdText);
489 955 }
490 956 if (isset($input->atomicClassMap) || isset($input->atomicClassMap)) {
491 957 $formModel = new FormModel();
492 958 $atomicClsMap = [
@@ -496,9 +962,9 @@
496 962 $updateData['atomic_class_map'] = wp_json_encode($atomicClsMap);
497 963 $formModel->update(
498 964 $updateData,
499 965 [
500 - 'id' => $input->form_id,
966 + 'id' => $formId,
501 967 ]
502 968 );
503 969 }
504 970 if (is_wp_error($status)) {
@@ -516,15 +982,27 @@
516 982 );
517 983 }
518 984 }
519 985
520 - public function createNewForm() {
521 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
522 - $inputJSON = file_get_contents('php://input');
523 - $input = json_decode($inputJSON);
986 + public function createNewForm()
987 + {
988 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
989 + $this->verifyAdminPermission();
990 + GlobalHelper::requirePostMethod();
991 + try {
992 + $input = GlobalHelper::formatRequestData();
993 + } catch (\InvalidArgumentException $e) {
994 + wp_send_json_error($e->getMessage(), 400);
995 + }
524 996 $formHandler = FormHandler::getInstance();
525 - $status = $formHandler->admin->createNewForm($_REQUEST, $input);
526 - FrontEndScriptGenerator::customCodeFile($input->form_id, $input->customCodes);
997 + $sanitized_request = [
998 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
999 + ];
1000 + $status = $formHandler->admin->createNewForm($sanitized_request, $input);
1001 + $formId = sanitize_text_field($input->form_id);
1002 + if (isset($input->customCodes)) {
1003 + FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
1004 + }
527 1005 if (is_wp_error($status)) {
528 1006 wp_send_json_error($status->get_error_message(), 411);
529 1007 } else {
530 1008 wp_send_json_success($status, 200);
@@ -539,14 +1017,20 @@
539 1017 );
540 1018 }
541 1019 }
542 1020
543 - public function updateEntryStatus() {
544 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
545 - $inputJSON = file_get_contents('php://input');
546 - $input = json_decode($inputJSON);
547 - $formId = sanitize_text_field($input->formId);
548 - $entryId = sanitize_text_field($input->entryId);
1021 + public function updateEntryStatus()
1022 + {
1023 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1024 + $this->verifyAdminPermission();
1025 + GlobalHelper::requirePostMethod();
1026 + try {
1027 + $input = GlobalHelper::formatRequestData();
1028 + } catch (\InvalidArgumentException $e) {
1029 + wp_send_json_error($e->getMessage(), 400);
1030 + }
1031 + $formId = $input->formId;
1032 + $entryId = $input->entryId;
549 1033 $formEntryModel = new FormEntryModel();
550 1034 $updatedTime = current_time('mysql');
551 1035 $status = $formEntryModel->update(
552 1036 [
@@ -573,14 +1057,27 @@
573 1057 );
574 1058 }
575 1059 }
576 1060
577 - public function changeFormStatus() {
578 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
579 - $inputJSON = file_get_contents('php://input');
580 - $input = json_decode($inputJSON);
1061 + public function changeFormStatus()
1062 + {
1063 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1064 + $this->verifyAdminPermission();
1065 + // $inputJSON = wp_unslash($_POST['data']);
1066 + // $input = json_decode($inputJSON);
1067 +
1068 + GlobalHelper::requirePostMethod();
1069 + try {
1070 + $input = GlobalHelper::formatRequestData();
1071 + } catch (\InvalidArgumentException $e) {
1072 + wp_send_json_error($e->getMessage(), 400);
1073 + }
1074 +
581 1075 $formHandler = FormHandler::getInstance();
582 - $status = $formHandler->admin->changeFormStatus($_REQUEST, $input);
1076 + $sanitized_request = [
1077 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1078 + ];
1079 + $status = $formHandler->admin->changeFormStatus($sanitized_request, $input);
583 1080 if (is_wp_error($status)) {
584 1081 wp_send_json_error($status->get_error_message(), 411);
585 1082 } else {
586 1083 wp_send_json_success($status, 200);
@@ -595,14 +1092,23 @@
595 1092 );
596 1093 }
597 1094 }
598 1095
599 - public function changeBulkFormStatus() {
600 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
601 - $inputJSON = file_get_contents('php://input');
602 - $input = json_decode($inputJSON);
1096 + public function changeBulkFormStatus()
1097 + {
1098 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1099 + $this->verifyAdminPermission();
1100 + GlobalHelper::requirePostMethod();
1101 + try {
1102 + $input = GlobalHelper::formatRequestData();
1103 + } catch (\InvalidArgumentException $e) {
1104 + wp_send_json_error($e->getMessage(), 400);
1105 + }
603 1106 $formHandler = FormHandler::getInstance();
604 - $status = $formHandler->admin->changeBulkFormStatus($_REQUEST, $input);
1107 + $sanitized_request = [
1108 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1109 + ];
1110 + $status = $formHandler->admin->changeBulkFormStatus($sanitized_request, $input);
605 1111 if (is_wp_error($status)) {
606 1112 wp_send_json_error($status->get_error_message(), 411);
607 1113 } else {
608 1114 wp_send_json_success($status, 200);
@@ -617,14 +1123,23 @@
617 1123 );
618 1124 }
619 1125 }
620 1126
621 - public function getAForm() {
622 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
623 - $inputJSON = file_get_contents('php://input');
624 - $input = json_decode($inputJSON);
1127 + public function getAForm()
1128 + {
1129 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1130 + $this->verifyAdminPermission();
1131 + GlobalHelper::requirePostMethod();
1132 + try {
1133 + $input = GlobalHelper::formatRequestData();
1134 + } catch (\InvalidArgumentException $e) {
1135 + wp_send_json_error($e->getMessage(), 400);
1136 + }
625 1137 $formHandler = FormHandler::getInstance();
626 - $status = $formHandler->admin->getAForm($_REQUEST, $input);
1138 + $sanitized_request = [
1139 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1140 + ];
1141 + $status = $formHandler->admin->getAForm($sanitized_request, $input);
627 1142 if (is_wp_error($status)) {
628 1143 wp_send_json_error($status->get_error_message(), 411);
629 1144 } else {
630 1145 wp_send_json_success($status, 200);
@@ -639,15 +1154,24 @@
639 1154 );
640 1155 }
641 1156 }
642 1157
643 - public function duplicateAForm() {
644 - \ignore_user_abort();
645 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
646 - $inputJSON = file_get_contents('php://input');
647 - $input = json_decode($inputJSON);
1158 + public function duplicateAForm()
1159 + {
1160 + Utilities::ignoreUserAbort();
1161 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1162 + $this->verifyAdminPermission();
1163 + GlobalHelper::requirePostMethod();
1164 + try {
1165 + $input = GlobalHelper::formatRequestData();
1166 + } catch (\InvalidArgumentException $e) {
1167 + wp_send_json_error($e->getMessage(), 400);
1168 + }
648 1169 $formHandler = FormHandler::getInstance();
649 - $status = $formHandler->admin->duplicateAForm($_REQUEST, $input);
1170 + $sanitized_request = [
1171 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1172 + ];
1173 + $status = $formHandler->admin->duplicateAForm($sanitized_request, $input);
650 1174 if (is_wp_error($status)) {
651 1175 wp_send_json_error($status->get_error_message(), 411);
652 1176 } else {
653 1177 wp_send_json_success($status, 200);
@@ -662,13 +1186,19 @@
662 1186 );
663 1187 }
664 1188 }
665 1189
666 - public function importAForm() {
667 - \ignore_user_abort();
668 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
669 - $inputJSON = file_get_contents('php://input');
670 - $input = json_decode($inputJSON);
1190 + public function importAForm()
1191 + {
1192 + Utilities::ignoreUserAbort();
1193 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1194 + $this->verifyAdminPermission();
1195 + GlobalHelper::requirePostMethod();
1196 + try {
1197 + $input = GlobalHelper::formatRequestData();
1198 + } catch (\InvalidArgumentException $e) {
1199 + wp_send_json_error($e->getMessage(), 400);
1200 + }
671 1201 $formHandler = FormHandler::getInstance();
672 1202 $status = $formHandler->admin->importAForm($input);
673 1203 if (is_wp_error($status)) {
674 1204 wp_send_json_error($status->get_error_message(), 411);
@@ -686,9 +1216,9 @@
686 1216 }
687 1217 }
688 1218
689 1219 // public function exportAForm() {
690 - // if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1220 + // if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
691 1221 // $formHandler = FormHandler::getInstance();
692 1222 // $status = $formHandler->admin->exportAForm($_REQUEST);
693 1223 // if (is_wp_error($status)) {
694 1224 // wp_send_json_error($status->get_error_message(), 411);
@@ -702,14 +1232,23 @@
702 1232 // 401
703 1233 // );
704 1234 // }
705 1235 // }
706 - public function exportAForm() {
707 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
708 - $inputJSON = file_get_contents('php://input');
709 - $input = json_decode($inputJSON);
1236 + public function exportAForm()
1237 + {
1238 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1239 + $this->verifyAdminPermission();
1240 + GlobalHelper::requirePostMethod();
1241 + try {
1242 + $input = GlobalHelper::formatRequestData();
1243 + } catch (\InvalidArgumentException $e) {
1244 + wp_send_json_error($e->getMessage(), 400);
1245 + }
710 1246 $formHandler = FormHandler::getInstance();
711 - $status = $formHandler->admin->exportAForm($_REQUEST, $input);
1247 + $sanitized_request = [
1248 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1249 + ];
1250 + $status = $formHandler->admin->exportAForm($sanitized_request, $input);
712 1251 if (is_wp_error($status)) {
713 1252 wp_send_json_error($status->get_error_message(), 411);
714 1253 } else {
715 1254 wp_send_json_success($status);
@@ -724,14 +1263,24 @@
724 1263 );
725 1264 }
726 1265 }
727 1266
728 - public function deleteAForm() {
729 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
730 - $inputJSON = file_get_contents('php://input');
731 - $input = json_decode($inputJSON);
1267 + public function deleteAForm()
1268 + {
1269 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1270 + $this->verifyAdminPermission();
1271 + GlobalHelper::requirePostMethod();
1272 + try {
1273 + $input = GlobalHelper::formatRequestData();
1274 + } catch (\InvalidArgumentException $e) {
1275 + wp_send_json_error($e->getMessage(), 400);
1276 + }
732 1277 $formHandler = FormHandler::getInstance();
733 - $status = $formHandler->admin->deleteAForm($_REQUEST, $input);
1278 + $sanitized_request = [
1279 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1280 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1281 + ];
1282 + $status = $formHandler->admin->deleteAForm($sanitized_request, $input);
734 1283 if (is_wp_error($status)) {
735 1284 wp_send_json_error($status->get_error_message(), 411);
736 1285 } else {
737 1286 wp_send_json_success($status, 200);
@@ -746,14 +1295,26 @@
746 1295 );
747 1296 }
748 1297 }
749 1298
750 - public function deleteBlukForm() {
751 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
752 - $inputJSON = file_get_contents('php://input');
753 - $input = json_decode($inputJSON);
1299 + public function deleteBlukForm()
1300 + {
1301 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1302 + $this->verifyAdminPermission();
1303 + GlobalHelper::requirePostMethod();
1304 + try {
1305 + $input = GlobalHelper::formatRequestData();
1306 + } catch (\InvalidArgumentException $e) {
1307 + wp_send_json_error($e->getMessage(), 400);
1308 + }
754 1309 $formHandler = FormHandler::getInstance();
755 - $status = $formHandler->admin->deleteBlukForm($_REQUEST, $input);
1310 + $sanitized_request = [
1311 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1312 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1313 + ? array_map('absint', $_REQUEST['entries'])
1314 + : [],
1315 + ];
1316 + $status = $formHandler->admin->deleteBlukForm($sanitized_request, $input);
756 1317 if (is_wp_error($status)) {
757 1318 wp_send_json_error($status->get_error_message(), 411);
758 1319 } else {
759 1320 wp_send_json_success($status, 200);
@@ -768,14 +1329,26 @@
768 1329 );
769 1330 }
770 1331 }
771 1332
772 - public function deleteBlukFormEntries() {
773 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
774 - $inputJSON = file_get_contents('php://input');
775 - $input = json_decode($inputJSON);
1333 + public function deleteBlukFormEntries()
1334 + {
1335 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1336 + $this->verifyAdminPermission();
1337 + GlobalHelper::requirePostMethod();
1338 + try {
1339 + $input = GlobalHelper::formatRequestData();
1340 + } catch (\InvalidArgumentException $e) {
1341 + wp_send_json_error($e->getMessage(), 400);
1342 + }
776 1343 $formHandler = FormHandler::getInstance();
777 - $status = $formHandler->admin->deleteBlukFormEntries($_REQUEST, $input);
1344 + $sanitized_request = [
1345 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1346 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1347 + ? array_map('absint', $_REQUEST['entries'])
1348 + : [],
1349 + ];
1350 + $status = $formHandler->admin->deleteBlukFormEntries($sanitized_request, $input);
778 1351 if (is_wp_error($status)) {
779 1352 wp_send_json_error($status->get_error_message(), 411);
780 1353 } else {
781 1354 wp_send_json_success($status, 200);
@@ -790,14 +1363,26 @@
790 1363 );
791 1364 }
792 1365 }
793 1366
794 - public function duplicateFormEntry() {
795 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
796 - $inputJSON = file_get_contents('php://input');
797 - $input = json_decode($inputJSON);
1367 + public function duplicateFormEntry()
1368 + {
1369 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1370 + $this->verifyAdminPermission();
1371 + GlobalHelper::requirePostMethod();
1372 + try {
1373 + $input = GlobalHelper::formatRequestData();
1374 + } catch (\InvalidArgumentException $e) {
1375 + wp_send_json_error($e->getMessage(), 400);
1376 + }
798 1377 $formHandler = FormHandler::getInstance();
799 - $status = $formHandler->admin->duplicateFormEntry($_REQUEST, $input);
1378 + $sanitized_request = [
1379 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1380 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1381 + ? array_map('absint', $_REQUEST['entries'])
1382 + : [],
1383 + ];
1384 + $status = $formHandler->admin->duplicateFormEntry($sanitized_request, $input);
800 1385 if (is_wp_error($status)) {
801 1386 wp_send_json_error($status->get_error_message(), 411);
802 1387 } else {
803 1388 wp_send_json_success($status, 200);
@@ -812,14 +1397,26 @@
812 1397 );
813 1398 }
814 1399 }
815 1400
816 - public function editFormEntry() {
817 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
818 - $inputJSON = file_get_contents('php://input');
819 - $input = json_decode($inputJSON);
1401 + public function editFormEntry()
1402 + {
1403 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1404 + $this->verifyAdminPermission();
1405 + // $inputJSON = wp_unslash($_POST['data']);
1406 + // $input = json_decode($inputJSON);
1407 + GlobalHelper::requirePostMethod();
1408 + try {
1409 + $input = GlobalHelper::formatRequestData();
1410 + } catch (\InvalidArgumentException $e) {
1411 + wp_send_json_error($e->getMessage(), 400);
1412 + }
820 1413 $formHandler = FormHandler::getInstance();
821 - $status = $formHandler->admin->editFormEntry($_REQUEST, $input);
1414 + $sanitized_request = [
1415 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1416 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1417 + ];
1418 + $status = $formHandler->admin->editFormEntry($sanitized_request, $input);
822 1419 if (is_wp_error($status)) {
823 1420 wp_send_json_error($status->get_error_message(), 411);
824 1421 } else {
825 1422 wp_send_json_success($status, 200);
@@ -834,14 +1431,28 @@
834 1431 );
835 1432 }
836 1433 }
837 1434
838 - public function getLogHistory() {
839 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
840 - $inputJSON = file_get_contents('php://input');
841 - $input = json_decode($inputJSON);
1435 + public function getLogHistory()
1436 + {
1437 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1438 + $this->verifyAdminPermission();
1439 + // $inputJSON = wp_unslash($_POST['data']);
1440 + // $input = json_decode($inputJSON);
1441 +
1442 + GlobalHelper::requirePostMethod();
1443 + try {
1444 + $input = GlobalHelper::formatRequestData();
1445 + } catch (\InvalidArgumentException $e) {
1446 + wp_send_json_error($e->getMessage(), 400);
1447 + }
1448 +
842 1449 $formHandler = FormHandler::getInstance();
843 - $status = $formHandler->admin->getLogHistory($_REQUEST, $input);
1450 + $sanitized_request = [
1451 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1452 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1453 + ];
1454 + $status = $formHandler->admin->getLogHistory($sanitized_request, $input);
844 1455 if (is_wp_error($status)) {
845 1456 wp_send_json_error($status->get_error_message(), 411);
846 1457 } else {
847 1458 wp_send_json_success($status, 200);
@@ -856,13 +1467,19 @@
856 1467 );
857 1468 }
858 1469 }
859 1470
860 - public function updateFormEntry() {
861 - \ignore_user_abort();
862 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1471 + public function updateFormEntry()
1472 + {
1473 + Utilities::ignoreUserAbort();
1474 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1475 + $this->verifyAdminPermission();
863 1476 $formHandler = FormHandler::getInstance();
864 - $status = $formHandler->admin->updateFormEntry($_REQUEST, $_POST);
1477 + $sanitized_request = [
1478 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1479 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1480 + ];
1481 + $status = $formHandler->admin->updateFormEntry($sanitized_request, wp_unslash($_POST));
865 1482
866 1483 if (is_wp_error($status)) {
867 1484 wp_send_json_error($status->get_error_message(), 411);
868 1485 } else {
@@ -879,14 +1496,27 @@
879 1496 );
880 1497 }
881 1498 }
882 1499
883 - public function getAllWPPages() {
884 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
885 - $inputJSON = file_get_contents('php://input');
886 - $input = json_decode($inputJSON);
1500 + public function getAllWPPages()
1501 + {
1502 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1503 + $this->verifyAdminPermission();
1504 + // $inputJSON = wp_unslash($_POST['data']);
1505 + // $input = json_decode($inputJSON);
1506 +
1507 + GlobalHelper::requirePostMethod();
1508 + try {
1509 + $input = GlobalHelper::formatRequestData();
1510 + } catch (\InvalidArgumentException $e) {
1511 + wp_send_json_error($e->getMessage(), 400);
1512 + }
1513 +
887 1514 $formHandler = FormHandler::getInstance();
888 - $status = $formHandler->admin->getAllWPPages($_REQUEST, $input);
1515 + $sanitized_request = [
1516 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1517 + ];
1518 + $status = $formHandler->admin->getAllWPPages($sanitized_request, $input);
889 1519 if (is_wp_error($status)) {
890 1520 wp_send_json_error($status->get_error_message(), 411);
891 1521 } else {
892 1522 wp_send_json_success($status, 200);
@@ -901,14 +1531,26 @@
901 1531 );
902 1532 }
903 1533 }
904 1534
905 - public function deleteSuccessMessage() {
906 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
907 - $inputJSON = file_get_contents('php://input');
908 - $input = json_decode($inputJSON);
1535 + public function deleteSuccessMessage()
1536 + {
1537 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1538 + $this->verifyAdminPermission();
1539 + // $inputJSON = wp_unslash($_POST['data']);
1540 + // $input = json_decode($inputJSON);
1541 + GlobalHelper::requirePostMethod();
1542 + try {
1543 + $input = GlobalHelper::formatRequestData();
1544 + } catch (\InvalidArgumentException $e) {
1545 + wp_send_json_error($e->getMessage(), 400);
1546 + }
909 1547 $formHandler = FormHandler::getInstance();
910 - $status = $formHandler->admin->deleteSuccessMessage($_REQUEST, $input);
1548 + $sanitized_request = [
1549 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1550 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1551 + ];
1552 + $status = $formHandler->admin->deleteSuccessMessage($sanitized_request, $input);
911 1553 if (is_wp_error($status)) {
912 1554 wp_send_json_error($status->get_error_message(), 411);
913 1555 } else {
914 1556 wp_send_json_success($status, 200);
@@ -923,14 +1565,28 @@
923 1565 );
924 1566 }
925 1567 }
926 1568
927 - public function deleteAIntegration() {
928 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
929 - $inputJSON = file_get_contents('php://input');
930 - $input = json_decode($inputJSON);
1569 + public function deleteAIntegration()
1570 + {
1571 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1572 + $this->verifyAdminPermission();
1573 + // $inputJSON = wp_unslash($_POST['data']);
1574 + // $input = json_decode($inputJSON);
1575 +
1576 + GlobalHelper::requirePostMethod();
1577 + try {
1578 + $input = GlobalHelper::formatRequestData();
1579 + } catch (\InvalidArgumentException $e) {
1580 + wp_send_json_error($e->getMessage(), 400);
1581 + }
1582 +
931 1583 $formHandler = FormHandler::getInstance();
932 - $status = $formHandler->admin->deleteAIntegration($_REQUEST, $input);
1584 + $sanitized_request = [
1585 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1586 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1587 + ];
1588 + $status = $formHandler->admin->deleteAIntegration($sanitized_request, $input);
933 1589 if (is_wp_error($status)) {
934 1590 wp_send_json_error($status->get_error_message(), 411);
935 1591 } else {
936 1592 wp_send_json_success($status, 200);
@@ -945,14 +1601,56 @@
945 1601 );
946 1602 }
947 1603 }
948 1604
949 - public function deleteAWorkflow() {
950 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
951 - $inputJSON = file_get_contents('php://input');
952 - $input = json_decode($inputJSON);
1605 + public function updateIntegrationStatus()
1606 + {
1607 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1608 + $this->verifyAdminPermission();
1609 + GlobalHelper::requirePostMethod();
1610 + try {
1611 + $input = GlobalHelper::formatRequestData();
1612 + } catch (\InvalidArgumentException $e) {
1613 + wp_send_json_error($e->getMessage(), 400);
1614 + }
1615 + $formID = isset($input->formID) ? sanitize_text_field(wp_unslash($input->formID)) : '';
1616 + $integrationID = isset($input->id) ? absint($input->id) : 0;
1617 + $status = isset($input->status) ? absint($input->status) : 0;
1618 + if (empty($formID) || empty($integrationID)) {
1619 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
1620 + }
1621 + $integrationHandler = new IntegrationHandler($formID);
1622 + $result = $integrationHandler->updateIntegrationStatus($integrationID, $status);
1623 + if (is_wp_error($result) && 'result_empty' !== $result->get_error_code()) {
1624 + wp_send_json_error($result->get_error_message(), 411);
1625 + } else {
1626 + wp_send_json_success(['id' => $integrationID, 'status' => $status], 200);
1627 + }
1628 + } else {
1629 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
1630 + }
1631 + }
1632 +
1633 + public function deleteAWorkflow()
1634 + {
1635 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1636 + $this->verifyAdminPermission();
1637 + // $inputJSON = wp_unslash($_POST['data']);
1638 + // $input = json_decode($inputJSON);
1639 + GlobalHelper::requirePostMethod();
1640 +
1641 + try {
1642 + $input = GlobalHelper::formatRequestData();
1643 + } catch (\InvalidArgumentException $e) {
1644 + wp_send_json_error($e->getMessage(), 400);
1645 + }
1646 +
953 1647 $formHandler = FormHandler::getInstance();
954 - $status = $formHandler->admin->deleteAWorkflow($_REQUEST, $input);
1648 + $sanitized_request = [
1649 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1650 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1651 + ];
1652 + $status = $formHandler->admin->deleteAWorkflow($sanitized_request, $input);
955 1653 if (is_wp_error($status)) {
956 1654 wp_send_json_error($status->get_error_message(), 411);
957 1655 } else {
958 1656 wp_send_json_success($status, 200);
@@ -967,14 +1665,28 @@
967 1665 );
968 1666 }
969 1667 }
970 1668
971 - public function deleteAMailTemplate() {
972 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
973 - $inputJSON = file_get_contents('php://input');
974 - $input = json_decode($inputJSON);
1669 + public function deleteAMailTemplate()
1670 + {
1671 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1672 + $this->verifyAdminPermission();
1673 + // $inputJSON = wp_unslash($_POST['data']);
1674 + // $input = json_decode($inputJSON);
1675 + GlobalHelper::requirePostMethod();
1676 +
1677 + try {
1678 + $input = GlobalHelper::formatRequestData();
1679 + } catch (\InvalidArgumentException $e) {
1680 + wp_send_json_error($e->getMessage(), 400);
1681 + }
1682 +
975 1683 $formHandler = FormHandler::getInstance();
976 - $status = $formHandler->admin->deleteAMailTemplate($_REQUEST, $input);
1684 + $sanitized_request = [
1685 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1686 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1687 + ];
1688 + $status = $formHandler->admin->deleteAMailTemplate($sanitized_request, $input);
977 1689 if (is_wp_error($status)) {
978 1690 wp_send_json_error($status->get_error_message(), 411);
979 1691 } else {
980 1692 wp_send_json_success($status, 200);
@@ -989,14 +1701,27 @@
989 1701 );
990 1702 }
991 1703 }
992 1704
993 - public function duplicateAMailTemplate() {
994 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
995 - $inputJSON = file_get_contents('php://input');
996 - $input = json_decode($inputJSON);
1705 + public function duplicateAMailTemplate()
1706 + {
1707 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1708 + $this->verifyAdminPermission();
1709 + // $inputJSON = wp_unslash($_POST['data']);
1710 + // $input = json_decode($inputJSON);
1711 +
1712 + GlobalHelper::requirePostMethod();
1713 + try {
1714 + $input = GlobalHelper::formatRequestData();
1715 + } catch (\InvalidArgumentException $e) {
1716 + wp_send_json_error($e->getMessage(), 400);
1717 + }
997 1718 $formHandler = FormHandler::getInstance();
998 - $status = $formHandler->admin->duplicateAMailTemplate($_REQUEST, $input);
1719 + $sanitized_request = [
1720 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1721 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1722 + ];
1723 + $status = $formHandler->admin->duplicateAMailTemplate($sanitized_request, $input);
999 1724 if (is_wp_error($status)) {
1000 1725 wp_send_json_error($status->get_error_message(), 411);
1001 1726 } else {
1002 1727 wp_send_json_success($status, 200);
@@ -1011,14 +1736,28 @@
1011 1736 );
1012 1737 }
1013 1738 }
1014 1739
1015 - public function setAllFormsReport() {
1016 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1017 - $inputJSON = file_get_contents('php://input');
1018 - $input = json_decode($inputJSON);
1740 + public function setAllFormsReport()
1741 + {
1742 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1743 + $this->verifyAdminPermission();
1744 + // $inputJSON = wp_unslash($_POST['data']);
1745 + // $input = json_decode($inputJSON);
1746 +
1747 + GlobalHelper::requirePostMethod();
1748 +
1749 + try {
1750 + $input = GlobalHelper::formatRequestData();
1751 + } catch (\InvalidArgumentException $e) {
1752 + wp_send_json_error($e->getMessage(), 400);
1753 + }
1754 +
1019 1755 $formHandler = FormHandler::getInstance();
1020 - $status = $formHandler->admin->setAllFormsReport($_REQUEST, $input);
1756 + $sanitized_request = [
1757 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1758 + ];
1759 + $status = $formHandler->admin->setAllFormsReport($sanitized_request, $input);
1021 1760 if (is_wp_error($status)) {
1022 1761 wp_send_json_error($status->get_error_message(), 411);
1023 1762 } else {
1024 1763 wp_send_json_success($status, 200);
@@ -1033,14 +1772,25 @@
1033 1772 );
1034 1773 }
1035 1774 }
1036 1775
1037 - public function savegReCaptcha() {
1038 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1039 - $inputJSON = file_get_contents('php://input');
1040 - $input = json_decode($inputJSON);
1776 + public function savegReCaptcha()
1777 + {
1778 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1779 + $this->verifyAdminPermission();
1780 + GlobalHelper::requirePostMethod();
1781 +
1782 + try {
1783 + $input = GlobalHelper::formatRequestData();
1784 + } catch (\InvalidArgumentException $e) {
1785 + wp_send_json_error($e->getMessage(), 400);
1786 + }
1787 +
1041 1788 $formHandler = FormHandler::getInstance();
1042 - $status = $formHandler->admin->savegReCaptcha($_REQUEST, $input);
1789 + $sanitized_request = [
1790 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1791 + ];
1792 + $status = $formHandler->admin->savegReCaptcha($sanitized_request, $input);
1043 1793 if (is_wp_error($status)) {
1044 1794 wp_send_json_error($status->get_error_message(), 411);
1045 1795 } else {
1046 1796 wp_send_json_success($status, 200);
@@ -1055,20 +1805,34 @@
1055 1805 );
1056 1806 }
1057 1807 }
1058 1808
1059 - public function saveApiKey() {
1060 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1061 - $inputJSON = file_get_contents('php://input');
1062 - $input = json_decode($inputJSON);
1809 + public function saveApiKey()
1810 + {
1811 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1812 + $this->verifyAdminPermission();
1813 + // $inputJSON = wp_unslash($_POST['data']);
1814 + // $input = json_decode($inputJSON);
1815 +
1816 + GlobalHelper::requirePostMethod();
1817 + try {
1818 + $input = GlobalHelper::formatRequestData();
1819 + } catch (\InvalidArgumentException $e) {
1820 + wp_send_json_error($e->getMessage(), 400);
1821 + }
1822 +
1063 1823 if (empty($input->api_key)) {
1064 1824 $api_key = get_option('bitform_secret_api_key');
1065 1825 } elseif (!empty($input->api_key)) {
1066 - update_option('bitform_secret_api_key', $input->api_key);
1826 + update_option('bitform_secret_api_key', sanitize_text_field($input->api_key));
1067 1827 $api_key = $input->api_key;
1068 1828 }
1069 1829 if (!$api_key) {
1070 - $api_key = hash('sha1', base64_encode(12345));
1830 + // The generated key authenticates the whole bitform/v1 data API. It was
1831 + // previously a constant (sha1 of a fixed string), so every install that
1832 + // never set one explicitly shared the same secret. Existing stored keys
1833 + // are left untouched — only first-time generation changes.
1834 + $api_key = wp_generate_password(64, false, false);
1071 1835 update_option('bitform_secret_api_key', $api_key);
1072 1836 }
1073 1837 wp_send_json_success($api_key, 200);
1074 1838 } else {
@@ -1081,28 +1845,81 @@
1081 1845 );
1082 1846 }
1083 1847 }
1084 1848
1085 - public function iconUpload() {
1086 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1087 - $inputJSON = file_get_contents('php://input');
1088 - $input = json_decode($inputJSON);
1849 + private function checkExtensionWithURL($urlStr)
1850 + {
1851 + // Extension is mandatory (no optional group): the URL must end in a known image extension,
1852 + // otherwise any http(s) URL would pass and be fetched.
1853 + $pattern = '/^https?:\/\/.*\.(svg|png|jpg|jpeg|gif)$/i';
1854 +
1855 + return preg_match($pattern, $urlStr);
1856 + }
1857 +
1858 + public function iconUpload()
1859 + {
1860 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1861 + $this->verifyAdminPermission();
1862 + // $inputJSON = wp_unslash($_POST['data']);
1863 + // $input = json_decode($inputJSON);
1864 +
1865 + GlobalHelper::requirePostMethod();
1866 + try {
1867 + $input = GlobalHelper::formatRequestData();
1868 + } catch (\InvalidArgumentException $e) {
1869 + wp_send_json_error($e->getMessage(), 400);
1870 + }
1871 +
1872 + $sanitize_url = sanitize_url($input->src);
1873 +
1874 + if (!$this->checkExtensionWithURL($sanitize_url)) {
1875 + return new WP_Error(
1876 + 'type_error',
1877 + __('Invalid file type', 'bit-form')
1878 + );
1879 + }
1880 +
1089 1881 $uploadDirInfo = wp_upload_dir();
1090 1882 $wpUploadbaseDir = $uploadDirInfo['basedir'];
1091 1883 $icnDir = $wpUploadbaseDir . DIRECTORY_SEPARATOR . 'bitforms' . DIRECTORY_SEPARATOR . 'icons';
1884 +
1092 1885 if (!is_dir($icnDir)) {
1093 - mkdir($icnDir);
1886 + wp_mkdir_p($icnDir);
1094 1887 }
1095 1888
1096 - $imageUrlData = file_get_contents($input->src);
1889 + $response = wp_safe_remote_get($sanitize_url);
1890 + if (is_wp_error($response) || 200 !== (int) wp_remote_retrieve_response_code($response)) {
1891 + wp_send_json_error(__('Unable to fetch icon', 'bit-form'), 400);
1892 + }
1893 + $imageUrlData = wp_remote_retrieve_body($response);
1097 1894
1098 - $filename = basename($input->src);
1895 + $filename = sanitize_file_name($input->id . '-' . basename($sanitize_url));
1099 1896
1100 - $uploaded = file_put_contents($icnDir . '/' . $filename, $imageUrlData);
1897 + $validation = wp_check_filetype($filename);
1898 + $type = $validation['type'];
1899 + $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
1900 + $is_svg = 'svg' === $ext; // Check if the file is an SVG
1901 + if ($type && 0 === strpos($type, 'image/') || $is_svg) {
1902 + if ($is_svg) {
1903 + $imageUrlData = (new \BitCode\BitForm\enshrined\svgSanitize\Sanitizer())->sanitize($imageUrlData);
1904 + if (false === $imageUrlData) {
1905 + wp_send_json_error(__('Invalid file type', 'bit-form'), 400);
1906 + }
1907 + }
1908 + $uploaded = file_put_contents($icnDir . '/' . $filename, $imageUrlData);
1101 1909
1102 - if ($uploaded) {
1103 - $uploadedFile = BITFORMS_UPLOAD_BASE_URL . '/' . 'icons' . '/' . $filename;
1104 - wp_send_json_success($uploadedFile, 200);
1910 + if ($uploaded) {
1911 + $uploadedFile = BITFORMS_UPLOAD_BASE_URL . '/' . 'icons' . '/' . $filename;
1912 + wp_send_json_success($uploadedFile, 200);
1913 + }
1914 + } else {
1915 + wp_send_json_error(
1916 + __(
1917 + 'Invalid file type',
1918 + 'bit-form'
1919 + ),
1920 + 401
1921 + );
1105 1922 }
1106 1923 } else {
1107 1924 wp_send_json_error(
1108 1925 __(
@@ -1113,9 +1930,10 @@
1113 1930 );
1114 1931 }
1115 1932 }
1116 1933
1117 - private function getFiles() {
1934 + private function getFiles()
1935 + {
1118 1936 $uploadDirInfo = wp_upload_dir();
1119 1937 $wpUploadbaseDir = $uploadDirInfo['basedir'];
1120 1938 $icnDir = $wpUploadbaseDir . DIRECTORY_SEPARATOR . 'bitforms' . DIRECTORY_SEPARATOR . 'icons';
1121 1939 $files = [];
@@ -1133,10 +1951,12 @@
1133 1951 }
1134 1952 return $files;
1135 1953 }
1136 1954
1137 - public function getDownlodedIcons() {
1138 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1955 + public function getDownlodedIcons()
1956 + {
1957 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1958 + $this->verifyAdminPermission();
1139 1959 $files = $this->getFiles();
1140 1960 wp_send_json_success($files, 200);
1141 1961 } else {
1142 1962 wp_send_json_error(
@@ -1148,19 +1968,31 @@
1148 1968 );
1149 1969 }
1150 1970 }
1151 1971
1152 - public function iconRemove() {
1153 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1154 - $inputJSON = file_get_contents('php://input');
1155 - $input = json_decode($inputJSON);
1972 + public function iconRemove()
1973 + {
1974 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1975 + $this->verifyAdminPermission();
1976 + // $inputJSON = wp_unslash($_POST['data']);
1977 + // $input = json_decode($inputJSON);
1156 1978
1979 + GlobalHelper::requirePostMethod();
1980 +
1981 + try {
1982 + $input = GlobalHelper::formatRequestData();
1983 + } catch (\InvalidArgumentException $e) {
1984 + wp_send_json_error($e->getMessage(), 400);
1985 + }
1986 +
1157 1987 $uploadDirInfo = wp_upload_dir();
1158 1988
1159 1989 $wpUploadbaseDir = $uploadDirInfo['basedir'];
1160 1990 $icnDir = $wpUploadbaseDir . DIRECTORY_SEPARATOR . 'bitforms' . DIRECTORY_SEPARATOR . 'icons' . DIRECTORY_SEPARATOR;
1161 - if (file_exists($icnDir . $input->file)) {
1162 - unlink($icnDir . $input->file);
1991 + $sanitizeFileName = sanitize_file_name($input->file);
1992 + $filePath = $icnDir . $sanitizeFileName;
1993 + if (file_exists($filePath)) {
1994 + wp_delete_file($filePath);
1163 1995 wp_send_json_success($this->getFiles(), 200);
1164 1996 }
1165 1997 } else {
1166 1998 wp_send_json_error(
@@ -1172,18 +2004,40 @@
1172 2004 );
1173 2005 }
1174 2006 }
1175 2007
1176 - public function addCustomCode() {
1177 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1178 - $inputJSON = file_get_contents('php://input');
1179 - $input = json_decode($inputJSON);
1180 - FrontEndScriptGenerator::customCodeFile($input->form_id, $input->customCodes);
1181 - $status = ['message' => 'File Update Successfully..'];
1182 - if (is_wp_error($status)) {
1183 - wp_send_json_error($status->get_error_message(), 411);
2008 + public function addCustomCode()
2009 + {
2010 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2011 + $this->verifyAdminPermission();
2012 + // $inputJSON = wp_unslash($_POST['data']);
2013 + // $input = json_decode($inputJSON);
2014 +
2015 + GlobalHelper::requirePostMethod();
2016 +
2017 + try {
2018 + $input = GlobalHelper::formatRequestData();
2019 + } catch (\InvalidArgumentException $e) {
2020 + wp_send_json_error($e->getMessage(), 400);
2021 + }
2022 +
2023 + $formId = sanitize_text_field($input->form_id);
2024 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2025 + FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
2026 + $status = ['message' => 'File Update Successfully..'];
2027 + if (is_wp_error($status)) {
2028 + wp_send_json_error($status->get_error_message(), 411);
2029 + } else {
2030 + wp_send_json_success($status, 200);
2031 + }
1184 2032 } else {
1185 - wp_send_json_success($status, 200);
2033 + wp_send_json_error(
2034 + __(
2035 + 'Invalid form id',
2036 + 'bit-form'
2037 + ),
2038 + 401
2039 + );
1186 2040 }
1187 2041 } else {
1188 2042 wp_send_json_error(
1189 2043 __(
@@ -1194,17 +2048,40 @@
1194 2048 );
1195 2049 }
1196 2050 }
1197 2051
1198 - public function getCustomCode() {
1199 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1200 - $inputJSON = file_get_contents('php://input');
1201 - $input = json_decode($inputJSON);
1202 - $status = FrontEndScriptGenerator::getCustomCodes($input->form_id);
1203 - if (is_wp_error($status)) {
1204 - wp_send_json_error($status->get_error_message(), 411);
2052 + public function getCustomCode()
2053 + {
2054 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2055 + $this->verifyAdminPermission();
2056 + // $inputJSON = wp_unslash($_POST['data']);
2057 + // $input = json_decode($inputJSON);
2058 +
2059 + GlobalHelper::requirePostMethod();
2060 +
2061 + try {
2062 + $input = GlobalHelper::formatRequestData();
2063 + } catch (\InvalidArgumentException $e) {
2064 + wp_send_json_error($e->getMessage(), 400);
2065 + }
2066 +
2067 + $formId = sanitize_text_field($input->form_id);
2068 +
2069 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2070 + $status = FrontEndScriptGenerator::getCustomCodes($formId);
2071 + if (is_wp_error($status)) {
2072 + wp_send_json_error($status->get_error_message(), 411);
2073 + } else {
2074 + wp_send_json_success($status, 200);
2075 + }
1205 2076 } else {
1206 - wp_send_json_success($status, 200);
2077 + wp_send_json_error(
2078 + __(
2079 + 'Invalid form id',
2080 + 'bit-form'
2081 + ),
2082 + 401
2083 + );
1207 2084 }
1208 2085 } else {
1209 2086 wp_send_json_error(
1210 2087 __(
@@ -1215,11 +2092,13 @@
1215 2092 );
1216 2093 }
1217 2094 }
1218 2095
1219 - public function getGenerelSettings() {
1220 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1221 - $data = get_option('bitform_app_config');
2096 + public function getGenerelSettings()
2097 + {
2098 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2099 + $this->verifyAdminPermission();
2100 + $data = get_option('bitform_app_config', (object) ['cache_plugin' => true, 'delete_table' => 0]);
1222 2101
1223 2102 if (is_wp_error($data)) {
1224 2103 wp_send_json_error($data->get_error_message(), 411);
1225 2104 } else {
@@ -1230,9 +2109,10 @@
1230 2109 }
1231 2110 } else {
1232 2111 wp_send_json_error(
1233 2112 __(
1234 - 'Token expired'
2113 + 'Token expired',
2114 + 'bit-form'
1235 2115 ),
1236 2116 401
1237 2117 );
1238 2118 }
@@ -1237,26 +2117,36 @@
1237 2117 );
1238 2118 }
1239 2119 }
1240 2120
1241 - public function saveGenerelSettings() {
1242 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1243 - $inputJSON = file_get_contents('php://input');
1244 - $input = json_decode($inputJSON);
1245 - $status = update_option('bitform_app_config', $input->config);
2121 + public function saveGenerelSettings()
2122 + {
2123 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2124 + $this->verifyAdminPermission();
2125 + GlobalHelper::requirePostMethod();
2126 +
2127 + try {
2128 + $inputData = GlobalHelper::formatRequestData();
2129 + } catch (\InvalidArgumentException $e) {
2130 + wp_send_json_error($e->getMessage(), 400);
2131 + return;
2132 + }
2133 +
2134 + $status = update_option('bitform_app_config', $inputData->config);
1246 2135 if (is_wp_error($status)) {
1247 2136 wp_send_json_error($status->get_error_message(), 411);
1248 2137 } else {
1249 - if (Helpers::property_exists_nested($input, 'config->cache_plugin', true)) {
2138 + if (Helpers::property_exists_nested($inputData, 'config->cache_plugin', true)) {
1250 2139 $formHandler = FormHandler::getInstance();
1251 2140 $formHandler->admin->updateGeneratedScriptPageIds();
1252 2141 }
1253 - wp_send_json_success(__('Save successfully done'));
2142 + wp_send_json_success(__('Save successfully done', 'bit-form'));
1254 2143 }
1255 2144 } else {
1256 2145 wp_send_json_error(
1257 2146 __(
1258 - 'Token expired'
2147 + 'Token expired',
2148 + 'bit-form'
1259 2149 ),
1260 2150 401
1261 2151 );
1262 2152 }
@@ -1261,26 +2151,428 @@
1261 2151 );
1262 2152 }
1263 2153 }
1264 2154
1265 - public function savePaymentSettings() {
1266 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1267 - $inputJSON = file_get_contents('php://input');
1268 - $input = json_decode($inputJSON);
1269 - $formHandler = FormHandler::getInstance();
1270 - $status = $formHandler->admin->savePaymentSetting($_REQUEST, $input);
1271 - if (is_wp_error($status)) {
1272 - wp_send_json_error($status->get_error_message(), 411);
1273 - } else {
1274 - wp_send_json_success($status, 200);
1275 - }
1276 - } else {
1277 - wp_send_json_error(
1278 - __(
1279 - 'Token expired',
1280 - 'bit-form'
1281 - ),
1282 - 401
1283 - );
1284 - }
1285 - }
2155 + public function saveGlobalMessages()
2156 + {
2157 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2158 + $this->verifyAdminPermission();
2159 + // $inputJSON = wp_unslash($_POST['data']);
2160 + // $inputData = json_decode($inputJSON);
2161 +
2162 + GlobalHelper::requirePostMethod();
2163 +
2164 + try {
2165 + $inputData = GlobalHelper::formatRequestData();
2166 + } catch (\InvalidArgumentException $e) {
2167 + wp_send_json_error($e->getMessage(), 400);
2168 + return;
2169 + }
2170 +
2171 + $appSettings = get_option('bitform_app_settings', (object) []);
2172 +
2173 + $appSettings->globalMessages = $inputData;
2174 + $status = update_option('bitform_app_settings', $appSettings);
2175 + // delete_option('bitform_app_settings');
2176 + if (is_wp_error($status)) {
2177 + wp_send_json_error($status->get_error_message(), 411);
2178 + } else {
2179 + $formHandler = FormHandler::getInstance();
2180 + $formHandler->admin->replaceAllFormsErrorMessagesByGlobalMessages();
2181 + wp_send_json_success(__('Save successfully done', 'bit-form'));
2182 + }
2183 + } else {
2184 + wp_send_json_error(
2185 + __(
2186 + 'Token expired',
2187 + 'bit-form'
2188 + ),
2189 + 401
2190 + );
2191 + }
2192 + }
2193 +
2194 + public function getPodsField()
2195 + {
2196 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2197 + $this->verifyAdminPermission();
2198 + // $inputJSON = wp_unslash($_POST['data']);
2199 + // $input = json_decode($inputJSON);
2200 + GlobalHelper::requirePostMethod();
2201 + try {
2202 + $input = GlobalHelper::formatRequestData();
2203 + } catch (\InvalidArgumentException $e) {
2204 + wp_send_json_error($e->getMessage(), 400);
2205 + }
2206 + $podsAdminExists = is_plugin_active('pods/init.php');
2207 +
2208 + $podField = [];
2209 + if ($podsAdminExists) {
2210 + $pods = pods($input->pod_type);
2211 + $i = 0;
2212 + foreach ($pods->fields as $field) {
2213 + $i++;
2214 + $podField[$i]['key'] = $field['name'];
2215 + $podField[$i]['name'] = $field['label'];
2216 + $podField[$i]['is-repeatable'] = $field['repeatable'] ?? 0;
2217 + $podField[$i]['required'] = 1 === $field['options']['required'] ? true : false;
2218 + }
2219 + }
2220 +
2221 + if (is_wp_error($podField)) {
2222 + wp_send_json_error($podField, 411);
2223 + } else {
2224 + wp_send_json_success($podField, 200);
2225 + }
2226 + } else {
2227 + wp_send_json_error(
2228 + __(
2229 + 'Token expired',
2230 + 'bit-form'
2231 + ),
2232 + 401
2233 + );
2234 + }
2235 + }
2236 +
2237 + public function getPodsType()
2238 + {
2239 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2240 + $this->verifyAdminPermission();
2241 + $users = get_users(['fields' => ['ID', 'display_name']]);
2242 + $pods = [];
2243 + $podsAdminExists = is_plugin_active('pods/init.php');
2244 + if ($podsAdminExists) {
2245 + $allPods = pods_api()->load_pods();
2246 + foreach ($allPods as $key => $pod) {
2247 + $pods[$key]['name'] = $pod['name'];
2248 + $pods[$key]['label'] = $pod['label'];
2249 + }
2250 + }
2251 + $data = ['users' => $users, 'post_types' => $pods];
2252 + wp_send_json_success($data, 200);
2253 + } else {
2254 + wp_send_json_error(
2255 + __(
2256 + 'Token expired',
2257 + 'bit-form'
2258 + ),
2259 + 401
2260 + );
2261 + }
2262 + }
2263 +
2264 + public function postTypeByUser()
2265 + {
2266 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2267 + $this->verifyAdminPermission();
2268 + $users = get_users(
2269 + [
2270 + 'fields' => ['ID', 'display_name', 'user_login', 'user_email', 'user_nicename'],
2271 + ]
2272 + );
2273 +
2274 + $postTypes = $this->getPostTypes();
2275 +
2276 + $data = ['post_types' => $postTypes, 'users' => $users];
2277 + wp_send_json_success($data, 200);
2278 + } else {
2279 + wp_send_json_error(
2280 + __(
2281 + 'Token expired',
2282 + 'bit-form'
2283 + ),
2284 + 401
2285 + );
2286 + }
2287 + }
2288 +
2289 + public function getWPUsers()
2290 + {
2291 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2292 + $this->verifyAdminPermission();
2293 +
2294 + $users = get_transient('bitforms_admin_users_list');
2295 + if (false === $users) {
2296 + $rawUsers = get_users(['fields' => ['ID', 'user_nicename', 'user_email', 'display_name']]);
2297 + $userMail = [];
2298 + $userNames = [];
2299 + foreach ($rawUsers as $key => $value) {
2300 + $userMail[$key] = [
2301 + 'label' => !empty($value->display_name) ? $value->display_name : '',
2302 + 'value' => !empty($value->user_email) ? $value->user_email : '',
2303 + 'id' => $value->ID,
2304 + ];
2305 + $userNames[$value->ID] = [
2306 + 'name' => $value->display_name,
2307 + 'url' => admin_url('user-edit.php?user_id=' . absint($value->ID)),
2308 + ];
2309 + }
2310 + $users = ['userMail' => $userMail, 'user' => $userNames];
2311 + set_transient('bitforms_admin_users_list', $users, 10 * MINUTE_IN_SECONDS);
2312 + }
2313 +
2314 + wp_send_json_success($users, 200);
2315 + } else {
2316 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
2317 + }
2318 + }
2319 +
2320 + public function getUserRoles()
2321 + {
2322 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2323 + $this->verifyAdminPermission();
2324 + wp_send_json_success(['userRoles' => get_editable_roles()], 200);
2325 + } else {
2326 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
2327 + }
2328 + }
2329 +
2330 + public function clearUsersTransient(): void
2331 + {
2332 + delete_transient('bitforms_admin_users_list');
2333 + }
2334 +
2335 + private function getPostTypes()
2336 + {
2337 + $all_cpt = get_post_types([
2338 + 'public' => true,
2339 + 'exclude_from_search' => false,
2340 + '_builtin' => false,
2341 + 'capability_type' => 'post',
2342 +
2343 + ], 'objects');
2344 + $cpt = [];
2345 +
2346 + foreach ($all_cpt as $key => $post_type) {
2347 + $cpt[$key]['name'] = $post_type->name;
2348 + $cpt[$key]['label'] = $post_type->label;
2349 + }
2350 + $wp_post_types = get_post_types([
2351 + 'public' => true,
2352 + '_builtin' => true,
2353 + ]);
2354 +
2355 + $wp_all_post_types = [];
2356 +
2357 + foreach ($wp_post_types as $key => $post_type) {
2358 + if ('attachment' !== $post_type) {
2359 + $wp_all_post_types[$key]['name'] = $post_type;
2360 + $wp_all_post_types[$key]['label'] = ucwords($post_type);
2361 + }
2362 + }
2363 + return array_merge($wp_all_post_types, $cpt);
2364 + }
2365 +
2366 + public function getAcfGroupFields()
2367 + {
2368 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2369 + $this->verifyAdminPermission();
2370 + $acfFields = [];
2371 + $types = ['select', 'checkbox', 'radio'];
2372 +
2373 + $field_groups = get_posts(['post_type' => 'acf-field-group']);
2374 +
2375 + if ($field_groups) {
2376 + $groups = acf_get_field_groups();
2377 + foreach ($groups as $group) {
2378 + foreach (acf_get_fields($group['key']) as $acfField) {
2379 + if (in_array($acfField['type'], $types)) {
2380 + array_push($acfFields, [
2381 + 'key' => $acfField['key'],
2382 + 'name' => $acfField['label'],
2383 + 'choices' => $acfField['choices'],
2384 + 'group_title' => $group['title'],
2385 + 'location' => $group['location'],
2386 + ]);
2387 + }
2388 + }
2389 + }
2390 + }
2391 +
2392 + wp_send_json_success($acfFields, 200);
2393 + } else {
2394 + wp_send_json_error(
2395 + __(
2396 + 'Token expired',
2397 + 'bit-form'
2398 + ),
2399 + 401
2400 + );
2401 + }
2402 + }
2403 +
2404 + public function getCustomField()
2405 + {
2406 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2407 + $this->verifyAdminPermission();
2408 + // $inputJSON = wp_unslash($_POST['data']);
2409 + // $input = json_decode($inputJSON);
2410 +
2411 + GlobalHelper::requirePostMethod();
2412 +
2413 + try {
2414 + $input = GlobalHelper::formatRequestData();
2415 + } catch (\InvalidArgumentException $e) {
2416 + wp_send_json_error($e->getMessage(), 400);
2417 + }
2418 + $acfFields = [];
2419 + $acfFiles = [];
2420 +
2421 + $allowedFields = [
2422 + 'repeater',
2423 + 'text',
2424 + 'textarea',
2425 + 'password',
2426 + 'wysiwyg',
2427 + 'number',
2428 + 'radio',
2429 + 'color_picker',
2430 + 'oembed',
2431 + 'email',
2432 + 'url',
2433 + 'date_picker',
2434 + 'true_false',
2435 + 'date_time_picker',
2436 + 'time_picker',
2437 + 'message',
2438 + 'checkbox',
2439 + 'select',
2440 + 'post_object',
2441 + 'user',
2442 + 'file',
2443 + 'image',
2444 + 'gallery'
2445 + ];
2446 +
2447 + $field_groups = get_posts(['post_type' => 'acf-field-group']);
2448 +
2449 + if ($field_groups) {
2450 + $groups = acf_get_field_groups(['post_type' => $input->post_type]);
2451 +
2452 + foreach ($groups as $group) {
2453 + foreach (acf_get_fields($group['key']) as $acfField) {
2454 + if (in_array($acfField['type'], $allowedFields)) {
2455 + if ('repeater' === $acfField['type']) {
2456 + foreach ($acfField['sub_fields'] as $subField) {
2457 + if (in_array($subField['type'], $allowedFields)) {
2458 + array_push($acfFields, [
2459 + 'key' => $acfField['key'] . '.' . $subField['key'],
2460 + 'name' => $acfField['label'] . '-' . $subField['label'],
2461 + 'required' => $subField['required'],
2462 + ]);
2463 + }
2464 + }
2465 + } elseif (in_array($acfField['type'], ['file', 'image', 'gallery'])) {
2466 + array_push($acfFiles, [
2467 + 'key' => $acfField['key'],
2468 + 'name' => $acfField['label'],
2469 + 'required' => $acfField['required'],
2470 + ]);
2471 + } else {
2472 + array_push($acfFields, [
2473 + 'key' => $acfField['key'],
2474 + 'name' => $acfField['label'],
2475 + 'required' => $acfField['required'],
2476 + ]);
2477 + }
2478 + }
2479 + }
2480 + }
2481 + }
2482 +
2483 + wp_send_json_success(['acfFields' => $acfFields, 'acfFile' => $acfFiles], 200);
2484 + } else {
2485 + wp_send_json_error(
2486 + __(
2487 + 'Token expired',
2488 + 'bit-form'
2489 + ),
2490 + 401
2491 + );
2492 + }
2493 + }
2494 +
2495 + public function getMetaBoxFields()
2496 + {
2497 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2498 + $this->verifyAdminPermission();
2499 + if (!function_exists('rwmb_meta')) {
2500 + wp_send_json_error(__('Meta Box must be activated!', 'bit-form'));
2501 + }
2502 +
2503 + GlobalHelper::requirePostMethod();
2504 +
2505 + try {
2506 + $input = GlobalHelper::formatRequestData();
2507 + } catch (\InvalidArgumentException $e) {
2508 + wp_send_json_error($e->getMessage(), 400);
2509 + }
2510 +
2511 + $metaBoxFields = rwmb_get_object_fields($input->post_type);
2512 +
2513 + $metaBoxFields = MetaBoxService::getMetaBoxFields($input->post_type);
2514 +
2515 + wp_send_json_success(
2516 + [
2517 + 'metaboxFields' => array_values($metaBoxFields['text_fields']),
2518 + 'metaboxFile' => array_values($metaBoxFields['file_fields']),
2519 + ],
2520 + 200
2521 + );
2522 + } else {
2523 + wp_send_json_error(
2524 + __(
2525 + 'Token expired',
2526 + 'bit-form'
2527 + ),
2528 + 401
2529 + );
2530 + }
2531 + }
2532 +
2533 + public function saveConversationalCSS()
2534 + {
2535 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2536 + $this->verifyAdminPermission();
2537 + // $inputJSON = wp_unslash($_POST['data']);
2538 + // $requestsParams = json_decode($inputJSON);
2539 + GlobalHelper::requirePostMethod();
2540 + try {
2541 + $requestsParams = GlobalHelper::formatRequestData();
2542 + } catch (\InvalidArgumentException $e) {
2543 + wp_send_json_error($e->getMessage(), 400);
2544 + }
2545 + $formId = sanitize_text_field($requestsParams->formID);
2546 + $css = $requestsParams->css;
2547 +
2548 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2549 + $path = 'form-styles';
2550 + $fileName = "bitform-conversational-$formId.css";
2551 + FrontEndScriptGenerator::customCodeFileSaveOrDelete($css, $path, $fileName);
2552 + wp_send_json_success(
2553 + __(
2554 + 'Conversational CSS Saved Successfully!',
2555 + 'bit-form'
2556 + ),
2557 + 200
2558 + );
2559 + } else {
2560 + wp_send_json_error(
2561 + __(
2562 + 'Invalid form id',
2563 + 'bit-form'
2564 + ),
2565 + 401
2566 + );
2567 + }
2568 + } else {
2569 + wp_send_json_error(
2570 + __(
2571 + 'Token expired',
2572 + 'bit-form'
2573 + ),
2574 + 401
2575 + );
2576 + }
2577 + }
1286 2578 }