PluginProbe
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder / 3.3.1
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder v3.3.1
3.3.1 V-3.3.0 3.2.2 3.2.1 3.2.0 3.1.4 3.1.3 3.1.2 3.1.1 3.1.0 V3.0.3 V3.0.2 -3.0.1 V_3.0.0 1.1.1 1.1.8 1.2 1.3 1.4 1.4.18 1.5.2 1.9 2.0 2.10.0 2.10.1 All 138 releases
← All changes | includes/Admin/AdminAjax.php +1187 -341 2.10.0 → 3.3.1 View file →
@@ -1,20 +1,28 @@
1 1 <?php
2 2
3 3 namespace BitCode\BitForm\Admin;
4 4
5 +if (!defined('ABSPATH')) {
6 + exit;
7 +}
8 +
5 9 use BitCode\BitForm\Admin\Form\FrontEndScriptGenerator;
6 10 use BitCode\BitForm\Admin\Form\Helpers;
7 11 use BitCode\BitForm\Admin\Form\Template\TemplateProvider;
8 -use BitCode\BitForm\Core\Database\DB;
12 +use BitCode\BitForm\Core\Database\FormEntryLogModel;
9 13 use BitCode\BitForm\Core\Database\FormEntryModel;
10 14 use BitCode\BitForm\Core\Database\FormModel;
11 15 use BitCode\BitForm\Core\Form\FormHandler;
12 16 use BitCode\BitForm\Core\Integration\IntegrationHandler;
13 17 use BitCode\BitForm\Core\Integration\Integrations;
14 -use BitCode\BitForm\Core\Migration\MigrateForms;
15 18 use BitCode\BitForm\Core\Util\IpTool;
16 19 use BitCode\BitForm\Core\Util\MailConfig;
20 +use BitCode\BitForm\Core\Util\MetaBoxService;
21 +use BitCode\BitForm\Core\Util\Utilities;
22 +use BitCode\BitForm\Frontend\Form\FrontendFormManager;
23 +use BitCode\BitForm\GlobalHelper;
24 +use WP_Error;
17 25
18 26 class AdminAjax
19 27 {
20 28 public function register()
@@ -19,9 +27,13 @@
19 27 {
20 28 public function register()
21 29 {
22 30 add_action('wp_ajax_bitforms_integrations', [$this, 'integrations']);
23 - add_action('wp_ajax_integration', [$this, 'integration']);
31 + add_action('wp_ajax_bitforms_save_connected_integration_apps', [$this, 'saveConnectedIntegrationApps']);
32 + add_action('wp_ajax_bitforms_get_connected_integration_apps', [$this, 'getConnectedIntegrationApps']);
33 + add_action('wp_ajax_bitforms_delete_connected_app', [$this, 'deleteConnectedApp']);
34 + add_action('wp_ajax_bitforms_update_connected_app', [$this, 'updateConnectedApp']);
35 + add_action('wp_ajax_bitforms_integration_last_runs', [$this, 'integrationLastRuns']);
24 36 add_action('wp_ajax_bitforms_update_form', [$this, 'updateForm']);
25 37 add_action('wp_ajax_bitforms_templates', [$this, 'templates']);
26 38 add_action('wp_ajax_bitforms_create_new_form', [$this, 'createNewForm']);
27 39 add_action('wp_ajax_bitforms_save_css', [$this, 'saveCss']);
@@ -43,8 +55,9 @@
43 55 add_action('wp_ajax_bitforms_get_all_form', [$this, 'getAllForms']);
44 56 add_action('wp_ajax_bitforms_get_all_wp_pages', [$this, 'getAllWPPages']);
45 57 add_action('wp_ajax_bitforms_delete_success_messsage', [$this, 'deleteSuccessMessage']);
46 58 add_action('wp_ajax_bitforms_delete_integration', [$this, 'deleteAIntegration']);
59 + add_action('wp_ajax_bitforms_update_integration_status', [$this, 'updateIntegrationStatus']);
47 60 add_action('wp_ajax_bitforms_delete_workflow', [$this, 'deleteAWorkflow']);
48 61 add_action('wp_ajax_bitforms_delete_mailtemplate', [$this, 'deleteAMailTemplate']);
49 62 add_action('wp_ajax_bitforms_duplicate_mailtemplate', [$this, 'duplicateAMailTemplate']);
50 63 add_action('wp_ajax_bitforms_save_allForm_report_prefs', [$this, 'setAllFormsReport']);
@@ -49,9 +62,8 @@
49 62 add_action('wp_ajax_bitforms_duplicate_mailtemplate', [$this, 'duplicateAMailTemplate']);
50 63 add_action('wp_ajax_bitforms_save_allForm_report_prefs', [$this, 'setAllFormsReport']);
51 64 add_action('wp_ajax_bitforms_save_grecaptcha', [$this, 'savegReCaptcha']);
52 65 add_action('wp_ajax_bitforms_form_log_history', [$this, 'getLogHistory']);
53 - add_action('wp_ajax_bitforms_import_file_data', [$this, 'importFileData']);
54 66 add_action('wp_ajax_bitforms_filter_export_data', [$this, 'filterExportEntry']);
55 67 add_action('wp_ajax_bitforms_api_key', [$this, 'saveApiKey']);
56 68 add_action('wp_ajax_bitforms_form_helpers_state', [$this, 'builerHelperState']);
57 69 add_action('wp_ajax_bitforms_icn_save_setting', [$this, 'iconUpload']);
@@ -62,14 +74,14 @@
62 74 add_action('wp_ajax_bitforms_entry_status_update', [$this, 'updateEntryStatus']);
63 75 add_action('wp_ajax_bitforms_get_generel_settings', [$this, 'getGenerelSettings']);
64 76 add_action('wp_ajax_bitforms_save_generel_settings', [$this, 'saveGenerelSettings']);
65 77 add_action('wp_ajax_bitforms_get_form_entry_count', [$this, 'getFormEntryLabelAndCount']);
66 - add_action('wp_ajax_bitforms_save_payment_setting', [$this, 'savePaymentSettings']);
78 + add_action('wp_ajax_bitforms_save_global_messages', [$this, 'saveGlobalMessages']);
67 79
68 80 // form migrate code
69 81 add_action('wp_ajax_bitforms_get_migrated_form_contents', [$this, 'migrateFormContents']);
70 82 add_action('wp_ajax_bitforms_migrate_to_v2_complete', [$this, 'migrationComplete']);
71 - add_action('wp_ajax_bitforms_migrate_back_to_v1', [$this, 'migrationBackToV1']);
83 + // add_action('wp_ajax_bitforms_migrate_back_to_v1', [$this, 'migrationBackToV1']);
72 84
73 85 // PRO TO FREE (SMTP)
74 86 add_action('wp_ajax_bitforms_get_mail_config', [$this, 'getEmailConfig']);
75 87 add_action('wp_ajax_bitforms_mail_config', [$this, 'saveEmailConfig']);
@@ -85,20 +97,89 @@
85 97
86 98 // common (get post type) for integration
87 99 add_action('wp_ajax_bitforms_get_post_type', [$this, 'postTypeByUser']);
88 100
101 + // WP users and roles (lazy-loaded, not inlined on page load)
102 + add_action('wp_ajax_bitforms_get_wp_users', [$this, 'getWPUsers']);
103 + add_action('wp_ajax_bitforms_get_user_roles', [$this, 'getUserRoles']);
104 +
105 + // transient invalidation when users change
106 + add_action('user_register', [$this, 'clearUsersTransient']);
107 + add_action('deleted_user', [$this, 'clearUsersTransient']);
108 + add_action('profile_update', [$this, 'clearUsersTransient']);
109 +
89 110 // Meta Box INTEGRATION
90 - add_action('wp_ajax_bitforms_get_metabox_fields', [$this, 'getMetaboxFields']);
111 + add_action('wp_ajax_bitforms_get_metabox_fields', [$this, 'getMetaBoxFields']);
91 112
92 113 // CHANGELOG VERSION OPTIONS
93 114 add_action('wp_ajax_bitforms_changelog_version', [$this, 'setChangelogVersion']);
94 115
116 + // Notice Options
117 + add_action('wp_ajax_bitforms_handle_notice', [$this, 'handleNotice']);
118 +
95 119 // conversational
96 120 add_action('wp_ajax_bitforms_save_conversational_css', [$this, 'saveConversationalCSS']);
97 121
98 - // PDF
122 + // get form html markup
123 + add_action('wp_ajax_bitforms_get_form_html', [$this, 'getFormHtml']);
99 124 }
100 125
126 + private function verifyAdminPermission()
127 + {
128 + if (!current_user_can('manage_bitform') && !current_user_can('manage_options')) {
129 + wp_send_json_error(__('Insufficient permissions.', 'bit-form'), 403);
130 + }
131 + }
132 +
133 + public function getFormHtml()
134 + {
135 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
136 + $this->verifyAdminPermission();
137 + $formId = isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '';
138 +
139 + $FrontendFormManager = FrontendFormManager::getInstance($formId);
140 + if (!$FrontendFormManager->isExist()) {
141 + wp_send_json_error(__('Form is not exists.', 'bit-form'), 404);
142 + }
143 + $formContent = $FrontendFormManager->getFormContentWithValue();
144 + if (!is_object($formContent) || !isset($formContent->fields, $formContent->layout)) {
145 + wp_send_json_error(__('Form content is unavailable.', 'bit-form'), 404);
146 + }
147 + $fields = $formContent->fields;
148 + $layout = $formContent->layout;
149 + $file = count($FrontendFormManager->getUploadFields()) > 0 ? $FrontendFormManager->getUploadFields() : false;
150 + $html = $FrontendFormManager->formView($fields, $file);
151 +
152 + if (file_exists(BITFORMS_CONTENT_DIR . DIRECTORY_SEPARATOR . 'form-styles')) {
153 + $cssPath = BITFORMS_CONTENT_DIR . DIRECTORY_SEPARATOR . 'form-styles' . DIRECTORY_SEPARATOR . "bitform-{$formId}-formid" . '.css';
154 +
155 + if (file_exists($cssPath)) {
156 + $getCss = file_get_contents($cssPath);
157 + } else {
158 + $getCss = '';
159 + }
160 + }
161 +
162 + $data = [
163 + 'html' => $html,
164 + 'css' => $getCss,
165 + ];
166 +
167 + wp_send_json_success(
168 + $data,
169 + 200
170 + );
171 + } else {
172 + wp_send_json_error(
173 + __(
174 + 'Token expired',
175 + 'bit-form'
176 + ),
177 + 401
178 + );
179 + }
180 + }
181 +
101 182 /**
102 183 * Undocumented function
103 184 *
104 185 * @return void
@@ -104,10 +185,11 @@
104 185 * @return void
105 186 */
106 187 public function integrations()
107 188 {
108 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
109 - $testIntegration = new Integrations();
189 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
190 + $this->verifyAdminPermission();
191 + $testIntegration = Integrations::getInstance();
110 192 $allIntegrations = $testIntegration->getAllintegrations();
111 193 if ($allIntegrations) {
112 194 wp_send_json_success($allIntegrations, 200);
113 195 } else {
@@ -126,11 +208,208 @@
126 208 );
127 209 }
128 210 }
129 211
212 + /**
213 + * Undocumented function
214 + *
215 + * @return void
216 + */
217 + public function saveConnectedIntegrationApps()
218 + {
219 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
220 + $this->verifyAdminPermission();
221 + // $inputJSON = wp_unslash($_POST['data']);
222 + // $input = json_decode($inputJSON);
223 + GlobalHelper::requirePostMethod();
224 + try {
225 + $input = GlobalHelper::formatRequestData();
226 + } catch (\InvalidArgumentException $e) {
227 + wp_send_json_error($e->getMessage(), 400);
228 + }
229 + // wp_send_json_success($input, 200);
230 + $integrations = Integrations::getInstance();
231 + $status = $integrations->saveConnectedIntegrationApp($input);
232 +
233 + // if (isset($input->customCodes)) {
234 + // FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
235 + // }
236 + if (is_wp_error($status)) {
237 + wp_send_json_error($status->get_error_message(), 411);
238 + } else {
239 + wp_send_json_success($status, 200);
240 + }
241 + } else {
242 + wp_send_json_error(
243 + __(
244 + 'Token expired',
245 + 'bit-form'
246 + ),
247 + 401
248 + );
249 + }
250 + }
251 +
252 + /**
253 + * Undocumented function
254 + *
255 + * @return void
256 + */
257 + public function getConnectedIntegrationApps()
258 + {
259 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
260 + $this->verifyAdminPermission();
261 + GlobalHelper::requirePostMethod();
262 + try {
263 + $input = GlobalHelper::formatRequestData();
264 + } catch (\InvalidArgumentException $e) {
265 + wp_send_json_error($e->getMessage(), 400);
266 + }
267 +
268 + $integrationType = isset($input->integrationType) ? $input->integrationType : null;
269 + $testIntegration = Integrations::getInstance();
270 + $allIntegrations = $testIntegration->getConnectedIntegrationApp($integrationType);
271 + if ($allIntegrations) {
272 + wp_send_json_success($allIntegrations, 200);
273 + } else {
274 + wp_send_json_error(
275 + __('No Connected App Found', 'bit-form'),
276 + 404
277 + );
278 + }
279 + } else {
280 + wp_send_json_error(
281 + __(
282 + 'Token expired',
283 + 'bit-form'
284 + ),
285 + 401
286 + );
287 + }
288 + }
289 +
290 + public function deleteConnectedApp()
291 + {
292 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
293 + $this->verifyAdminPermission();
294 + // $inputJSON = wp_unslash($_POST['data']);
295 + // $input = json_decode($inputJSON);
296 + GlobalHelper::requirePostMethod();
297 + try {
298 + $input = GlobalHelper::formatRequestData();
299 + } catch (\InvalidArgumentException $e) {
300 + wp_send_json_error($e->getMessage(), 400);
301 + }
302 + // Nonce verified at handler entry (wp_verify_nonce 'bitforms_save', line 273).
303 + $requestedAppId = isset($_REQUEST['appId'])
304 + ? sanitize_text_field(wp_unslash($_REQUEST['appId']))
305 + : '';
306 + $appId = $requestedAppId
307 + ? $requestedAppId
308 + : sanitize_text_field(wp_unslash((string) ($input->appId ?? '')));
309 + $integrationHandler = Integrations::getInstance();
310 + $status = $integrationHandler->deleteConnectedApp($appId);
311 + if (is_wp_error($status)) {
312 + wp_send_json_error($status->get_error_message(), 411);
313 + } else {
314 + wp_send_json_success($status, 200);
315 + }
316 + } else {
317 + wp_send_json_error(
318 + __(
319 + 'Token expired',
320 + 'bit-form'
321 + ),
322 + 401
323 + );
324 + }
325 + }
326 +
327 + /**
328 + * Renames a connected account (category connected_integration_apps, form_id 0).
329 + * Only integration_name is writable; updateIntegration would overwrite the rest.
330 + *
331 + * @return void
332 + */
333 + public function updateConnectedApp()
334 + {
335 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
336 + $this->verifyAdminPermission();
337 + GlobalHelper::requirePostMethod();
338 + try {
339 + $input = GlobalHelper::formatRequestData();
340 + } catch (\InvalidArgumentException $e) {
341 + wp_send_json_error($e->getMessage(), 400);
342 + }
343 + $appId = !empty($input->appId) ? sanitize_text_field((string) $input->appId) : '';
344 + $name = isset($input->name) ? sanitize_text_field((string) $input->name) : '';
345 + if (empty($appId) || '' === trim($name)) {
346 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
347 + }
348 + $integrations = Integrations::getInstance();
349 + $status = $integrations->renameConnectedApp($appId, $name);
350 + if (is_wp_error($status)) {
351 + wp_send_json_error($status->get_error_message(), 411);
352 + } else {
353 + wp_send_json_success($status, 200);
354 + }
355 + } else {
356 + wp_send_json_error(
357 + __(
358 + 'Token expired',
359 + 'bit-form'
360 + ),
361 + 401
362 + );
363 + }
364 + }
365 +
366 + /**
367 + * Last execution per integration of a form, for the integrations list Last Run column.
368 + *
369 + * @return void
370 + */
371 + public function integrationLastRuns()
372 + {
373 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
374 + $this->verifyAdminPermission();
375 + GlobalHelper::requirePostMethod();
376 + try {
377 + $input = GlobalHelper::formatRequestData();
378 + } catch (\InvalidArgumentException $e) {
379 + wp_send_json_error($e->getMessage(), 400);
380 + }
381 + $formID = !empty($input->formID) ? absint($input->formID) : 0;
382 + if (empty($formID)) {
383 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
384 + }
385 + $logModel = new FormEntryLogModel();
386 + $rows = $logModel->getIntegrationLastRuns($formID);
387 + if (is_wp_error($rows)) {
388 + // result_empty means nothing has run yet, which is a success. Any other
389 + // error is a failed query — answering [] would paint every integration
390 + // as never executed. Message stays generic: no DB detail to the browser.
391 + if ('result_empty' !== $rows->get_error_code()) {
392 + wp_send_json_error(__('Could not load integration run history', 'bit-form'), 500);
393 + }
394 + $rows = [];
395 + }
396 + wp_send_json_success($rows, 200);
397 + } else {
398 + wp_send_json_error(
399 + __(
400 + 'Token expired',
401 + 'bit-form'
402 + ),
403 + 401
404 + );
405 + }
406 + }
407 +
130 408 public function templates()
131 409 {
132 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
410 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
411 + $this->verifyAdminPermission();
133 412 $templateProvider = new TemplateProvider();
134 413 $status = $templateProvider->getAllTemplates();
135 414 if (is_wp_error($status)) {
136 415 wp_send_json_error($status->get_error_message(), 411);
@@ -149,12 +428,20 @@
149 428 }
150 429
151 430 public function builerHelperState()
152 431 {
153 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
154 - $inputJSON = file_get_contents('php://input');
155 - $input = json_decode($inputJSON);
432 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
433 + $this->verifyAdminPermission();
434 + // $inputJSON = wp_unslash($_POST['data']);
435 + // $input = json_decode($inputJSON);
156 436
437 + GlobalHelper::requirePostMethod();
438 + try {
439 + $input = GlobalHelper::formatRequestData();
440 + } catch (\InvalidArgumentException $e) {
441 + wp_send_json_error($e->getMessage(), 400);
442 + }
443 +
157 444 $formID = $input->formID;
158 445 $formHandler = FormHandler::getInstance();
159 446 $results = $formHandler->admin->builerHelperState($formID);
160 447 if (is_wp_error($results)) {
@@ -174,13 +461,23 @@
174 461 }
175 462
176 463 public function getTemplate()
177 464 {
178 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
179 - $inputJSON = file_get_contents('php://input');
180 - $input = json_decode($inputJSON);
465 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
466 + $this->verifyAdminPermission();
467 + // $inputJSON = wp_unslash($_POST['data']);
468 + // $input = json_decode($inputJSON);
469 + GlobalHelper::requirePostMethod();
470 + try {
471 + $input = GlobalHelper::formatRequestData();
472 + } catch (\InvalidArgumentException $e) {
473 + wp_send_json_error($e->getMessage(), 400);
474 + }
181 475 $formHandler = FormHandler::getInstance();
182 - $status = $formHandler->admin->getTemplate($_REQUEST, $input);
476 + $sanitized_request = [
477 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
478 + ];
479 + $status = $formHandler->admin->getTemplate($sanitized_request, $input);
183 480 if (is_wp_error($status)) {
184 481 wp_send_json_error($status->get_error_message(), 411);
185 482 } else {
186 483 wp_send_json_success($status, 200);
@@ -197,9 +494,10 @@
197 494 }
198 495
199 496 public function getAllForms()
200 497 {
201 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
498 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
499 + $this->verifyAdminPermission();
202 500 $formHandler = FormHandler::getInstance();
203 501 $all_forms = $formHandler->admin->getAllForm();
204 502 if (is_wp_error($all_forms)) {
205 503 wp_send_json_error($all_forms->get_error_message(), 411);
@@ -218,13 +516,11 @@
218 516 }
219 517
220 518 public function migrateFormContents()
221 519 {
222 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
223 - update_site_option('bitforms_db_version', '2.0');
224 - DB::migrate();
225 - $migrateFormsHandler = new MigrateForms();
226 - $all_forms = $migrateFormsHandler->migrateToV2();
520 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
521 + $this->verifyAdminPermission();
522 + $all_forms = get_transient('bitforms_v1_form_contents');
227 523 wp_send_json_success($all_forms, 200);
228 524 } else {
229 525 wp_send_json_error(
230 526 __(
@@ -237,11 +533,19 @@
237 533 }
238 534
239 535 public function setChangelogVersion()
240 536 {
241 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
242 - $inputJSON = file_get_contents('php://input');
243 - $input = json_decode($inputJSON);
537 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
538 + $this->verifyAdminPermission();
539 + // $inputJSON = wp_unslash($_POST['data']);
540 + // $input = json_decode($inputJSON);
541 + GlobalHelper::requirePostMethod();
542 + try {
543 + $input = GlobalHelper::formatRequestData();
544 + } catch (\InvalidArgumentException $e) {
545 + wp_send_json_error($e->getMessage(), 400);
546 + }
547 +
244 548 $version = isset($input->version) ? $input->version : '';
245 549 update_option('bitforms_changelog_version', $version);
246 550 wp_send_json_success($version, 200);
247 551 } else {
@@ -254,8 +558,39 @@
254 558 );
255 559 }
256 560 }
257 561
562 + public function handleNotice()
563 + {
564 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
565 + $this->verifyAdminPermission();
566 + GlobalHelper::requirePostMethod();
567 + try {
568 + // $inputJSON = wp_unslash($_POST['data']);
569 + // $input = json_decode($inputJSON);
570 + $input = GlobalHelper::formatRequestData();
571 + $optionName = isset($input->optionName) ? $input->optionName : '';
572 + $optionValue = isset($input->optionValue) ? $input->optionValue : '';
573 + $allowedNoticeKeys = ['bitforms_hide_cashback', 'bitforms_hide_announcement'];
574 + if (!in_array($optionName, $allowedNoticeKeys, true)) {
575 + wp_send_json_error(__('Invalid option', 'bit-form'), 400);
576 + }
577 + update_option($optionName, (bool) $optionValue);
578 + wp_send_json_success([$optionName, (bool) $optionValue], 200);
579 + } catch (\Exception | \InvalidArgumentException $e) {
580 + wp_send_json_error($e->getMessage(), 400);
581 + }
582 + } else {
583 + wp_send_json_error(
584 + __(
585 + 'Token expired',
586 + 'bit-form'
587 + ),
588 + 401
589 + );
590 + }
591 + }
592 +
258 593 private function formatFormContentForUpdate($formContents)
259 594 {
260 595 $updatedFormContents = (object) [];
261 596 $updatedPaths = [
@@ -299,17 +634,23 @@
299 634 }
300 635
301 636 public function getEmailConfig()
302 637 {
303 - \ignore_user_abort();
638 + Utilities::ignoreUserAbort();
304 639
305 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
306 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action']);
640 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
641 + $this->verifyAdminPermission();
307 642 $ipTool = new IpTool();
308 643 $user_details = $ipTool->getUserDetail();
309 644 $integrationHandler = new IntegrationHandler(0, $user_details);
310 645 $user_details = $ipTool->getUserDetail();
311 646 $formIntegrations = $integrationHandler->getAllIntegration('mail', 'smtp');
647 + if (is_wp_error($formIntegrations)) {
648 + wp_send_json_error($formIntegrations->get_error_message(), 411);
649 + }
650 + if (isset($formIntegrations[0]->integration_details) && is_string($formIntegrations[0]->integration_details)) {
651 + $formIntegrations[0]->integration_details = wp_unslash($formIntegrations[0]->integration_details);
652 + }
312 653 wp_send_json_success($formIntegrations, 200);
313 654 } else {
314 655 wp_send_json_error(
315 656 __(
@@ -322,16 +663,22 @@
322 663 }
323 664
324 665 public function saveEmailConfig()
325 666 {
326 - \ignore_user_abort();
327 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
667 + Utilities::ignoreUserAbort();
668 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
669 + $this->verifyAdminPermission();
670 + GlobalHelper::requirePostMethod();
328 671 $ipTool = new IpTool();
329 - $status = $_REQUEST['status'];
330 672 $user_details = $ipTool->getUserDetail();
331 673 $integrationHandler = new IntegrationHandler(0, $user_details);
332 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action'], $_REQUEST['status']);
333 - $integrationDetails = wp_json_encode($_REQUEST);
674 + try {
675 + $formattedData = GlobalHelper::formatRequestData();
676 + } catch (\InvalidArgumentException $e) {
677 + wp_send_json_error($e->getMessage(), 400);
678 + }
679 + $status = isset($formattedData->status) ? $formattedData->status : null;
680 + $integrationDetails = json_encode($formattedData, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
334 681 $user_details = $ipTool->getUserDetail();
335 682 $integrationName = 'smtp';
336 683 $integrationType = 'smtp';
337 684 $formIntegrations = $integrationHandler->getAllIntegration('mail', 'smtp');
@@ -353,13 +700,22 @@
353 700 }
354 701
355 702 public function testEmail()
356 703 {
357 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
358 - $to = wp_unslash($_REQUEST['to']);
359 - $subject = wp_unslash($_REQUEST['subject']);
360 - $message = wp_unslash($_REQUEST['message']);
361 - unset($_REQUEST['_ajax_nonce'], $_REQUEST['action']);
704 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
705 + $this->verifyAdminPermission();
706 + GlobalHelper::requirePostMethod();
707 +
708 + try {
709 + $formattedData = GlobalHelper::formatRequestData();
710 + } catch (\InvalidArgumentException $e) {
711 + wp_send_json_error($e->getMessage(), 400);
712 + }
713 +
714 + $to = isset($formattedData->to) ? sanitize_email($formattedData->to) : '';
715 + $subject = isset($formattedData->subject) ? sanitize_text_field($formattedData->subject) : '';
716 + $message = isset($formattedData->message) ? sanitize_textarea_field($formattedData->message) : '';
717 +
362 718 if (!empty($to) && !empty($subject) && !empty($message)) {
363 719 try {
364 720 (new MailConfig())->sendMail();
365 721 add_action('wp_mail_failed', function ($error) {
@@ -393,9 +749,10 @@
393 749 }
394 750
395 751 public function migrationComplete()
396 752 {
397 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
753 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
754 + $this->verifyAdminPermission();
398 755 delete_transient('bitforms_v1_form_contents');
399 756 delete_option('bitforms_migrating_to_v2');
400 757 update_option('bitforms_migrated_to_v2', true);
401 758 wp_send_json_success(__('Migration Complete', 'bit-form'), 200);
@@ -409,39 +766,22 @@
409 766 );
410 767 }
411 768 }
412 769
413 - public function migrationBackToV1()
414 - {
415 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
416 - $migrateFormsHandler = new MigrateForms();
417 - $migrateFormsHandler->rollbackToV1();
418 - wp_send_json_success(__('Migration Back to V1', 'bit-form'), 200);
419 - } else {
420 - wp_send_json_error(
421 - __(
422 - 'Token expired',
423 - 'bit-form'
424 - ),
425 - 401
426 - );
427 - }
428 - }
429 -
430 770 public function importDataStore()
431 771 {
432 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
433 - $inputJSON = file_get_contents('php://input');
434 - $input = json_decode($inputJSON);
772 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
773 + $this->verifyAdminPermission();
774 + // $inputJSON = wp_unslash($_POST['data']);
775 + // $input = json_decode($inputJSON);
776 + GlobalHelper::requirePostMethod();
777 + try {
778 + $input = GlobalHelper::formatRequestData();
779 + } catch (\InvalidArgumentException $e) {
780 + wp_send_json_error($e->getMessage(), 400);
781 + }
435 782 echo wp_json_encode($input);
436 783 die;
437 - // $formHandler = FormHandler::getInstance();
438 - // $status = $formHandler->admin->getFormEntryLabelAndCount($_REQUEST, $input);
439 - // if (is_wp_error($status)) {
440 - // wp_send_json_error($status->get_error_message(), 411);
441 - // } else {
442 - // wp_send_json_success($status, 200);
443 - // }
444 784 } else {
445 785 wp_send_json_error(
446 786 __(
447 787 'Token expired',
@@ -453,11 +793,19 @@
453 793 }
454 794
455 795 public function getFormEntryLabelAndCount()
456 796 {
457 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
458 - $inputJSON = file_get_contents('php://input');
459 - $input = json_decode($inputJSON);
797 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
798 + $this->verifyAdminPermission();
799 + // $inputJSON = wp_unslash($_POST['data']);
800 + // $input = json_decode($inputJSON);
801 + GlobalHelper::requirePostMethod();
802 + try {
803 + $input = GlobalHelper::formatRequestData();
804 + } catch (\InvalidArgumentException $e) {
805 + wp_send_json_error($e->getMessage(), 400);
806 + }
807 +
460 808 $formHandler = FormHandler::getInstance();
461 809 $status = $formHandler->admin->getFormEntryLabelAndCount($_REQUEST, $input);
462 810 if (is_wp_error($status)) {
463 811 wp_send_json_error($status->get_error_message(), 411);
@@ -476,13 +824,21 @@
476 824 }
477 825
478 826 public function getFormEntry()
479 827 {
480 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
481 - $inputJSON = file_get_contents('php://input');
482 - $input = json_decode($inputJSON);
828 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
829 + $this->verifyAdminPermission();
830 + GlobalHelper::requirePostMethod();
831 + try {
832 + $input = GlobalHelper::formatRequestData();
833 + } catch (\InvalidArgumentException $e) {
834 + wp_send_json_error($e->getMessage(), 400);
835 + }
483 836 $formHandler = FormHandler::getInstance();
484 - $status = $formHandler->admin->getFormEntry($_REQUEST, $input);
837 + $sanitized_request = [
838 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
839 + ];
840 + $status = $formHandler->admin->getFormEntry($sanitized_request, $input);
485 841 if (is_wp_error($status)) {
486 842 wp_send_json_error($status->get_error_message(), 411);
487 843 } else {
488 844 wp_send_json_success($status, 200);
@@ -493,13 +849,21 @@
493 849 }
494 850
495 851 public function getEntriesForReport()
496 852 {
497 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
498 - $inputJSON = file_get_contents('php://input');
499 - $input = json_decode($inputJSON);
853 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
854 + $this->verifyAdminPermission();
855 + GlobalHelper::requirePostMethod();
856 + try {
857 + $input = GlobalHelper::formatRequestData();
858 + } catch (\InvalidArgumentException $e) {
859 + wp_send_json_error($e->getMessage(), 400);
860 + }
500 861 $formHandler = FormHandler::getInstance();
501 - $status = $formHandler->admin->getEntriesForReport($_REQUEST, $input);
862 + $sanitized_request = [
863 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
864 + ];
865 + $status = $formHandler->admin->getEntriesForReport($sanitized_request, $input);
502 866 if (is_wp_error($status)) {
503 867 wp_send_json_error($status->get_error_message(), 411);
504 868 } else {
505 869 wp_send_json_success($status, 200);
@@ -510,11 +874,16 @@
510 874 }
511 875
512 876 public function filterExportEntry()
513 877 {
514 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
515 - $inputJSON = file_get_contents('php://input');
516 - $input = json_decode($inputJSON);
878 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
879 + $this->verifyAdminPermission();
880 + GlobalHelper::requirePostMethod();
881 + try {
882 + $input = GlobalHelper::formatRequestData();
883 + } catch (\InvalidArgumentException $e) {
884 + wp_send_json_error($e->getMessage(), 400);
885 + }
517 886 $formHandler = FormHandler::getInstance();
518 887 $status = $formHandler->admin->getExportEntry($input->data);
519 888 if (is_wp_error($status)) {
520 889 wp_send_json_error($status->get_error_message(), 411);
@@ -532,15 +901,19 @@
532 901 * @return void
533 902 */
534 903 public function updateForm()
535 904 {
536 - \ignore_user_abort();
537 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
538 - $inputJSON = file_get_contents('php://input');
539 - $input = json_decode($inputJSON);
540 - // wp_send_json_success($input, 200);
905 + Utilities::ignoreUserAbort();
906 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
907 + $this->verifyAdminPermission();
908 + GlobalHelper::requirePostMethod();
909 + try {
910 + $input = GlobalHelper::formatRequestData();
911 + } catch (\InvalidArgumentException $e) {
912 + wp_send_json_error($e->getMessage(), 400);
913 + }
541 914 $formHandler = FormHandler::getInstance();
542 - $status = $formHandler->admin->updateForm($_REQUEST, $input);
915 + $status = $formHandler->admin->updateForm([], $input);
543 916 if (isset($input->customCodes)) {
544 917 FrontEndScriptGenerator::customCodeFile($input->id, $input->customCodes);
545 918 }
546 919 if (is_wp_error($status)) {
@@ -560,16 +933,26 @@
560 933 }
561 934
562 935 public function saveCss()
563 936 {
564 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
565 - $inputJSON = file_get_contents('php://input');
566 - $input = json_decode($inputJSON);
937 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
938 + $this->verifyAdminPermission();
939 + GlobalHelper::requirePostMethod();
940 + try {
941 + $input = GlobalHelper::formatRequestData();
942 + } catch (\InvalidArgumentException $e) {
943 + wp_send_json_error($e->getMessage(), 400);
944 + }
945 +
946 + $formId = isset($input->form_id) ? sanitize_text_field($input->form_id) : '';
947 + if (!filter_var($formId, FILTER_VALIDATE_INT)) {
948 + wp_send_json_error(__('Invalid form id', 'bit-form'), 400);
949 + }
567 950 if (isset($input->atomicCssText)) {
568 - $status = FrontEndScriptGenerator::saveCssFile("{$input->form_id}", $input->atomicCssText);
951 + $status = FrontEndScriptGenerator::saveCssFile($formId, $input->atomicCssText);
569 952 }
570 953 if (isset($input->atomicCssWithFormIdText)) {
571 - $status = FrontEndScriptGenerator::saveCssFile("{$input->form_id}-formid", $input->atomicCssWithFormIdText);
954 + $status = FrontEndScriptGenerator::saveCssFile("{$formId}-formid", $input->atomicCssWithFormIdText);
572 955 }
573 956 if (isset($input->atomicClassMap) || isset($input->atomicClassMap)) {
574 957 $formModel = new FormModel();
575 958 $atomicClsMap = [
@@ -579,9 +962,9 @@
579 962 $updateData['atomic_class_map'] = wp_json_encode($atomicClsMap);
580 963 $formModel->update(
581 964 $updateData,
582 965 [
583 - 'id' => $input->form_id,
966 + 'id' => $formId,
584 967 ]
585 968 );
586 969 }
587 970 if (is_wp_error($status)) {
@@ -601,16 +984,24 @@
601 984 }
602 985
603 986 public function createNewForm()
604 987 {
605 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
606 - $inputJSON = file_get_contents('php://input');
607 - $input = json_decode($inputJSON);
608 - // wp_send_json_success($input, 200);
988 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
989 + $this->verifyAdminPermission();
990 + GlobalHelper::requirePostMethod();
991 + try {
992 + $input = GlobalHelper::formatRequestData();
993 + } catch (\InvalidArgumentException $e) {
994 + wp_send_json_error($e->getMessage(), 400);
995 + }
609 996 $formHandler = FormHandler::getInstance();
610 - $status = $formHandler->admin->createNewForm($_REQUEST, $input);
997 + $sanitized_request = [
998 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
999 + ];
1000 + $status = $formHandler->admin->createNewForm($sanitized_request, $input);
1001 + $formId = sanitize_text_field($input->form_id);
611 1002 if (isset($input->customCodes)) {
612 - FrontEndScriptGenerator::customCodeFile($input->form_id, $input->customCodes);
1003 + FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
613 1004 }
614 1005 if (is_wp_error($status)) {
615 1006 wp_send_json_error($status->get_error_message(), 411);
616 1007 } else {
@@ -628,13 +1019,18 @@
628 1019 }
629 1020
630 1021 public function updateEntryStatus()
631 1022 {
632 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
633 - $inputJSON = file_get_contents('php://input');
634 - $input = json_decode($inputJSON);
635 - $formId = sanitize_text_field($input->formId);
636 - $entryId = sanitize_text_field($input->entryId);
1023 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1024 + $this->verifyAdminPermission();
1025 + GlobalHelper::requirePostMethod();
1026 + try {
1027 + $input = GlobalHelper::formatRequestData();
1028 + } catch (\InvalidArgumentException $e) {
1029 + wp_send_json_error($e->getMessage(), 400);
1030 + }
1031 + $formId = $input->formId;
1032 + $entryId = $input->entryId;
637 1033 $formEntryModel = new FormEntryModel();
638 1034 $updatedTime = current_time('mysql');
639 1035 $status = $formEntryModel->update(
640 1036 [
@@ -663,13 +1059,25 @@
663 1059 }
664 1060
665 1061 public function changeFormStatus()
666 1062 {
667 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
668 - $inputJSON = file_get_contents('php://input');
669 - $input = json_decode($inputJSON);
1063 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1064 + $this->verifyAdminPermission();
1065 + // $inputJSON = wp_unslash($_POST['data']);
1066 + // $input = json_decode($inputJSON);
1067 +
1068 + GlobalHelper::requirePostMethod();
1069 + try {
1070 + $input = GlobalHelper::formatRequestData();
1071 + } catch (\InvalidArgumentException $e) {
1072 + wp_send_json_error($e->getMessage(), 400);
1073 + }
1074 +
670 1075 $formHandler = FormHandler::getInstance();
671 - $status = $formHandler->admin->changeFormStatus($_REQUEST, $input);
1076 + $sanitized_request = [
1077 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1078 + ];
1079 + $status = $formHandler->admin->changeFormStatus($sanitized_request, $input);
672 1080 if (is_wp_error($status)) {
673 1081 wp_send_json_error($status->get_error_message(), 411);
674 1082 } else {
675 1083 wp_send_json_success($status, 200);
@@ -686,13 +1094,21 @@
686 1094 }
687 1095
688 1096 public function changeBulkFormStatus()
689 1097 {
690 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
691 - $inputJSON = file_get_contents('php://input');
692 - $input = json_decode($inputJSON);
1098 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1099 + $this->verifyAdminPermission();
1100 + GlobalHelper::requirePostMethod();
1101 + try {
1102 + $input = GlobalHelper::formatRequestData();
1103 + } catch (\InvalidArgumentException $e) {
1104 + wp_send_json_error($e->getMessage(), 400);
1105 + }
693 1106 $formHandler = FormHandler::getInstance();
694 - $status = $formHandler->admin->changeBulkFormStatus($_REQUEST, $input);
1107 + $sanitized_request = [
1108 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1109 + ];
1110 + $status = $formHandler->admin->changeBulkFormStatus($sanitized_request, $input);
695 1111 if (is_wp_error($status)) {
696 1112 wp_send_json_error($status->get_error_message(), 411);
697 1113 } else {
698 1114 wp_send_json_success($status, 200);
@@ -709,13 +1125,21 @@
709 1125 }
710 1126
711 1127 public function getAForm()
712 1128 {
713 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
714 - $inputJSON = file_get_contents('php://input');
715 - $input = json_decode($inputJSON);
1129 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1130 + $this->verifyAdminPermission();
1131 + GlobalHelper::requirePostMethod();
1132 + try {
1133 + $input = GlobalHelper::formatRequestData();
1134 + } catch (\InvalidArgumentException $e) {
1135 + wp_send_json_error($e->getMessage(), 400);
1136 + }
716 1137 $formHandler = FormHandler::getInstance();
717 - $status = $formHandler->admin->getAForm($_REQUEST, $input);
1138 + $sanitized_request = [
1139 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1140 + ];
1141 + $status = $formHandler->admin->getAForm($sanitized_request, $input);
718 1142 if (is_wp_error($status)) {
719 1143 wp_send_json_error($status->get_error_message(), 411);
720 1144 } else {
721 1145 wp_send_json_success($status, 200);
@@ -732,14 +1156,22 @@
732 1156 }
733 1157
734 1158 public function duplicateAForm()
735 1159 {
736 - \ignore_user_abort();
737 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
738 - $inputJSON = file_get_contents('php://input');
739 - $input = json_decode($inputJSON);
1160 + Utilities::ignoreUserAbort();
1161 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1162 + $this->verifyAdminPermission();
1163 + GlobalHelper::requirePostMethod();
1164 + try {
1165 + $input = GlobalHelper::formatRequestData();
1166 + } catch (\InvalidArgumentException $e) {
1167 + wp_send_json_error($e->getMessage(), 400);
1168 + }
740 1169 $formHandler = FormHandler::getInstance();
741 - $status = $formHandler->admin->duplicateAForm($_REQUEST, $input);
1170 + $sanitized_request = [
1171 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1172 + ];
1173 + $status = $formHandler->admin->duplicateAForm($sanitized_request, $input);
742 1174 if (is_wp_error($status)) {
743 1175 wp_send_json_error($status->get_error_message(), 411);
744 1176 } else {
745 1177 wp_send_json_success($status, 200);
@@ -756,12 +1188,17 @@
756 1188 }
757 1189
758 1190 public function importAForm()
759 1191 {
760 - \ignore_user_abort();
761 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
762 - $inputJSON = file_get_contents('php://input');
763 - $input = json_decode($inputJSON);
1192 + Utilities::ignoreUserAbort();
1193 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1194 + $this->verifyAdminPermission();
1195 + GlobalHelper::requirePostMethod();
1196 + try {
1197 + $input = GlobalHelper::formatRequestData();
1198 + } catch (\InvalidArgumentException $e) {
1199 + wp_send_json_error($e->getMessage(), 400);
1200 + }
764 1201 $formHandler = FormHandler::getInstance();
765 1202 $status = $formHandler->admin->importAForm($input);
766 1203 if (is_wp_error($status)) {
767 1204 wp_send_json_error($status->get_error_message(), 411);
@@ -779,9 +1216,9 @@
779 1216 }
780 1217 }
781 1218
782 1219 // public function exportAForm() {
783 - // if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1220 + // if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
784 1221 // $formHandler = FormHandler::getInstance();
785 1222 // $status = $formHandler->admin->exportAForm($_REQUEST);
786 1223 // if (is_wp_error($status)) {
787 1224 // wp_send_json_error($status->get_error_message(), 411);
@@ -797,13 +1234,21 @@
797 1234 // }
798 1235 // }
799 1236 public function exportAForm()
800 1237 {
801 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
802 - $inputJSON = file_get_contents('php://input');
803 - $input = json_decode($inputJSON);
1238 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1239 + $this->verifyAdminPermission();
1240 + GlobalHelper::requirePostMethod();
1241 + try {
1242 + $input = GlobalHelper::formatRequestData();
1243 + } catch (\InvalidArgumentException $e) {
1244 + wp_send_json_error($e->getMessage(), 400);
1245 + }
804 1246 $formHandler = FormHandler::getInstance();
805 - $status = $formHandler->admin->exportAForm($_REQUEST, $input);
1247 + $sanitized_request = [
1248 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1249 + ];
1250 + $status = $formHandler->admin->exportAForm($sanitized_request, $input);
806 1251 if (is_wp_error($status)) {
807 1252 wp_send_json_error($status->get_error_message(), 411);
808 1253 } else {
809 1254 wp_send_json_success($status);
@@ -820,13 +1265,22 @@
820 1265 }
821 1266
822 1267 public function deleteAForm()
823 1268 {
824 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
825 - $inputJSON = file_get_contents('php://input');
826 - $input = json_decode($inputJSON);
1269 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1270 + $this->verifyAdminPermission();
1271 + GlobalHelper::requirePostMethod();
1272 + try {
1273 + $input = GlobalHelper::formatRequestData();
1274 + } catch (\InvalidArgumentException $e) {
1275 + wp_send_json_error($e->getMessage(), 400);
1276 + }
827 1277 $formHandler = FormHandler::getInstance();
828 - $status = $formHandler->admin->deleteAForm($_REQUEST, $input);
1278 + $sanitized_request = [
1279 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1280 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1281 + ];
1282 + $status = $formHandler->admin->deleteAForm($sanitized_request, $input);
829 1283 if (is_wp_error($status)) {
830 1284 wp_send_json_error($status->get_error_message(), 411);
831 1285 } else {
832 1286 wp_send_json_success($status, 200);
@@ -843,13 +1297,24 @@
843 1297 }
844 1298
845 1299 public function deleteBlukForm()
846 1300 {
847 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
848 - $inputJSON = file_get_contents('php://input');
849 - $input = json_decode($inputJSON);
1301 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1302 + $this->verifyAdminPermission();
1303 + GlobalHelper::requirePostMethod();
1304 + try {
1305 + $input = GlobalHelper::formatRequestData();
1306 + } catch (\InvalidArgumentException $e) {
1307 + wp_send_json_error($e->getMessage(), 400);
1308 + }
850 1309 $formHandler = FormHandler::getInstance();
851 - $status = $formHandler->admin->deleteBlukForm($_REQUEST, $input);
1310 + $sanitized_request = [
1311 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1312 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1313 + ? array_map('absint', $_REQUEST['entries'])
1314 + : [],
1315 + ];
1316 + $status = $formHandler->admin->deleteBlukForm($sanitized_request, $input);
852 1317 if (is_wp_error($status)) {
853 1318 wp_send_json_error($status->get_error_message(), 411);
854 1319 } else {
855 1320 wp_send_json_success($status, 200);
@@ -866,13 +1331,24 @@
866 1331 }
867 1332
868 1333 public function deleteBlukFormEntries()
869 1334 {
870 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
871 - $inputJSON = file_get_contents('php://input');
872 - $input = json_decode($inputJSON);
1335 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1336 + $this->verifyAdminPermission();
1337 + GlobalHelper::requirePostMethod();
1338 + try {
1339 + $input = GlobalHelper::formatRequestData();
1340 + } catch (\InvalidArgumentException $e) {
1341 + wp_send_json_error($e->getMessage(), 400);
1342 + }
873 1343 $formHandler = FormHandler::getInstance();
874 - $status = $formHandler->admin->deleteBlukFormEntries($_REQUEST, $input);
1344 + $sanitized_request = [
1345 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1346 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1347 + ? array_map('absint', $_REQUEST['entries'])
1348 + : [],
1349 + ];
1350 + $status = $formHandler->admin->deleteBlukFormEntries($sanitized_request, $input);
875 1351 if (is_wp_error($status)) {
876 1352 wp_send_json_error($status->get_error_message(), 411);
877 1353 } else {
878 1354 wp_send_json_success($status, 200);
@@ -889,13 +1365,24 @@
889 1365 }
890 1366
891 1367 public function duplicateFormEntry()
892 1368 {
893 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
894 - $inputJSON = file_get_contents('php://input');
895 - $input = json_decode($inputJSON);
1369 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1370 + $this->verifyAdminPermission();
1371 + GlobalHelper::requirePostMethod();
1372 + try {
1373 + $input = GlobalHelper::formatRequestData();
1374 + } catch (\InvalidArgumentException $e) {
1375 + wp_send_json_error($e->getMessage(), 400);
1376 + }
896 1377 $formHandler = FormHandler::getInstance();
897 - $status = $formHandler->admin->duplicateFormEntry($_REQUEST, $input);
1378 + $sanitized_request = [
1379 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1380 + 'entries' => isset($_REQUEST['entries']) && is_array($_REQUEST['entries'])
1381 + ? array_map('absint', $_REQUEST['entries'])
1382 + : [],
1383 + ];
1384 + $status = $formHandler->admin->duplicateFormEntry($sanitized_request, $input);
898 1385 if (is_wp_error($status)) {
899 1386 wp_send_json_error($status->get_error_message(), 411);
900 1387 } else {
901 1388 wp_send_json_success($status, 200);
@@ -912,13 +1399,24 @@
912 1399 }
913 1400
914 1401 public function editFormEntry()
915 1402 {
916 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
917 - $inputJSON = file_get_contents('php://input');
918 - $input = json_decode($inputJSON);
1403 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1404 + $this->verifyAdminPermission();
1405 + // $inputJSON = wp_unslash($_POST['data']);
1406 + // $input = json_decode($inputJSON);
1407 + GlobalHelper::requirePostMethod();
1408 + try {
1409 + $input = GlobalHelper::formatRequestData();
1410 + } catch (\InvalidArgumentException $e) {
1411 + wp_send_json_error($e->getMessage(), 400);
1412 + }
919 1413 $formHandler = FormHandler::getInstance();
920 - $status = $formHandler->admin->editFormEntry($_REQUEST, $input);
1414 + $sanitized_request = [
1415 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1416 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1417 + ];
1418 + $status = $formHandler->admin->editFormEntry($sanitized_request, $input);
921 1419 if (is_wp_error($status)) {
922 1420 wp_send_json_error($status->get_error_message(), 411);
923 1421 } else {
924 1422 wp_send_json_success($status, 200);
@@ -935,13 +1433,26 @@
935 1433 }
936 1434
937 1435 public function getLogHistory()
938 1436 {
939 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
940 - $inputJSON = file_get_contents('php://input');
941 - $input = json_decode($inputJSON);
1437 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1438 + $this->verifyAdminPermission();
1439 + // $inputJSON = wp_unslash($_POST['data']);
1440 + // $input = json_decode($inputJSON);
1441 +
1442 + GlobalHelper::requirePostMethod();
1443 + try {
1444 + $input = GlobalHelper::formatRequestData();
1445 + } catch (\InvalidArgumentException $e) {
1446 + wp_send_json_error($e->getMessage(), 400);
1447 + }
1448 +
942 1449 $formHandler = FormHandler::getInstance();
943 - $status = $formHandler->admin->getLogHistory($_REQUEST, $input);
1450 + $sanitized_request = [
1451 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1452 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1453 + ];
1454 + $status = $formHandler->admin->getLogHistory($sanitized_request, $input);
944 1455 if (is_wp_error($status)) {
945 1456 wp_send_json_error($status->get_error_message(), 411);
946 1457 } else {
947 1458 wp_send_json_success($status, 200);
@@ -958,12 +1469,17 @@
958 1469 }
959 1470
960 1471 public function updateFormEntry()
961 1472 {
962 - \ignore_user_abort();
963 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1473 + Utilities::ignoreUserAbort();
1474 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1475 + $this->verifyAdminPermission();
964 1476 $formHandler = FormHandler::getInstance();
965 - $status = $formHandler->admin->updateFormEntry($_REQUEST, $_POST);
1477 + $sanitized_request = [
1478 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1479 + 'entryID' => isset($_REQUEST['entryID']) ? absint($_REQUEST['entryID']) : 0,
1480 + ];
1481 + $status = $formHandler->admin->updateFormEntry($sanitized_request, wp_unslash($_POST));
966 1482
967 1483 if (is_wp_error($status)) {
968 1484 wp_send_json_error($status->get_error_message(), 411);
969 1485 } else {
@@ -982,13 +1498,25 @@
982 1498 }
983 1499
984 1500 public function getAllWPPages()
985 1501 {
986 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
987 - $inputJSON = file_get_contents('php://input');
988 - $input = json_decode($inputJSON);
1502 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1503 + $this->verifyAdminPermission();
1504 + // $inputJSON = wp_unslash($_POST['data']);
1505 + // $input = json_decode($inputJSON);
1506 +
1507 + GlobalHelper::requirePostMethod();
1508 + try {
1509 + $input = GlobalHelper::formatRequestData();
1510 + } catch (\InvalidArgumentException $e) {
1511 + wp_send_json_error($e->getMessage(), 400);
1512 + }
1513 +
989 1514 $formHandler = FormHandler::getInstance();
990 - $status = $formHandler->admin->getAllWPPages($_REQUEST, $input);
1515 + $sanitized_request = [
1516 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1517 + ];
1518 + $status = $formHandler->admin->getAllWPPages($sanitized_request, $input);
991 1519 if (is_wp_error($status)) {
992 1520 wp_send_json_error($status->get_error_message(), 411);
993 1521 } else {
994 1522 wp_send_json_success($status, 200);
@@ -1005,13 +1533,24 @@
1005 1533 }
1006 1534
1007 1535 public function deleteSuccessMessage()
1008 1536 {
1009 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1010 - $inputJSON = file_get_contents('php://input');
1011 - $input = json_decode($inputJSON);
1537 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1538 + $this->verifyAdminPermission();
1539 + // $inputJSON = wp_unslash($_POST['data']);
1540 + // $input = json_decode($inputJSON);
1541 + GlobalHelper::requirePostMethod();
1542 + try {
1543 + $input = GlobalHelper::formatRequestData();
1544 + } catch (\InvalidArgumentException $e) {
1545 + wp_send_json_error($e->getMessage(), 400);
1546 + }
1012 1547 $formHandler = FormHandler::getInstance();
1013 - $status = $formHandler->admin->deleteSuccessMessage($_REQUEST, $input);
1548 + $sanitized_request = [
1549 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1550 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1551 + ];
1552 + $status = $formHandler->admin->deleteSuccessMessage($sanitized_request, $input);
1014 1553 if (is_wp_error($status)) {
1015 1554 wp_send_json_error($status->get_error_message(), 411);
1016 1555 } else {
1017 1556 wp_send_json_success($status, 200);
@@ -1028,13 +1567,26 @@
1028 1567 }
1029 1568
1030 1569 public function deleteAIntegration()
1031 1570 {
1032 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1033 - $inputJSON = file_get_contents('php://input');
1034 - $input = json_decode($inputJSON);
1571 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1572 + $this->verifyAdminPermission();
1573 + // $inputJSON = wp_unslash($_POST['data']);
1574 + // $input = json_decode($inputJSON);
1575 +
1576 + GlobalHelper::requirePostMethod();
1577 + try {
1578 + $input = GlobalHelper::formatRequestData();
1579 + } catch (\InvalidArgumentException $e) {
1580 + wp_send_json_error($e->getMessage(), 400);
1581 + }
1582 +
1035 1583 $formHandler = FormHandler::getInstance();
1036 - $status = $formHandler->admin->deleteAIntegration($_REQUEST, $input);
1584 + $sanitized_request = [
1585 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1586 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1587 + ];
1588 + $status = $formHandler->admin->deleteAIntegration($sanitized_request, $input);
1037 1589 if (is_wp_error($status)) {
1038 1590 wp_send_json_error($status->get_error_message(), 411);
1039 1591 } else {
1040 1592 wp_send_json_success($status, 200);
@@ -1049,15 +1601,56 @@
1049 1601 );
1050 1602 }
1051 1603 }
1052 1604
1605 + public function updateIntegrationStatus()
1606 + {
1607 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1608 + $this->verifyAdminPermission();
1609 + GlobalHelper::requirePostMethod();
1610 + try {
1611 + $input = GlobalHelper::formatRequestData();
1612 + } catch (\InvalidArgumentException $e) {
1613 + wp_send_json_error($e->getMessage(), 400);
1614 + }
1615 + $formID = isset($input->formID) ? sanitize_text_field(wp_unslash($input->formID)) : '';
1616 + $integrationID = isset($input->id) ? absint($input->id) : 0;
1617 + $status = isset($input->status) ? absint($input->status) : 0;
1618 + if (empty($formID) || empty($integrationID)) {
1619 + wp_send_json_error(__('Invalid request', 'bit-form'), 400);
1620 + }
1621 + $integrationHandler = new IntegrationHandler($formID);
1622 + $result = $integrationHandler->updateIntegrationStatus($integrationID, $status);
1623 + if (is_wp_error($result) && 'result_empty' !== $result->get_error_code()) {
1624 + wp_send_json_error($result->get_error_message(), 411);
1625 + } else {
1626 + wp_send_json_success(['id' => $integrationID, 'status' => $status], 200);
1627 + }
1628 + } else {
1629 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
1630 + }
1631 + }
1632 +
1053 1633 public function deleteAWorkflow()
1054 1634 {
1055 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1056 - $inputJSON = file_get_contents('php://input');
1057 - $input = json_decode($inputJSON);
1635 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1636 + $this->verifyAdminPermission();
1637 + // $inputJSON = wp_unslash($_POST['data']);
1638 + // $input = json_decode($inputJSON);
1639 + GlobalHelper::requirePostMethod();
1640 +
1641 + try {
1642 + $input = GlobalHelper::formatRequestData();
1643 + } catch (\InvalidArgumentException $e) {
1644 + wp_send_json_error($e->getMessage(), 400);
1645 + }
1646 +
1058 1647 $formHandler = FormHandler::getInstance();
1059 - $status = $formHandler->admin->deleteAWorkflow($_REQUEST, $input);
1648 + $sanitized_request = [
1649 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1650 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1651 + ];
1652 + $status = $formHandler->admin->deleteAWorkflow($sanitized_request, $input);
1060 1653 if (is_wp_error($status)) {
1061 1654 wp_send_json_error($status->get_error_message(), 411);
1062 1655 } else {
1063 1656 wp_send_json_success($status, 200);
@@ -1074,13 +1667,26 @@
1074 1667 }
1075 1668
1076 1669 public function deleteAMailTemplate()
1077 1670 {
1078 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1079 - $inputJSON = file_get_contents('php://input');
1080 - $input = json_decode($inputJSON);
1671 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1672 + $this->verifyAdminPermission();
1673 + // $inputJSON = wp_unslash($_POST['data']);
1674 + // $input = json_decode($inputJSON);
1675 + GlobalHelper::requirePostMethod();
1676 +
1677 + try {
1678 + $input = GlobalHelper::formatRequestData();
1679 + } catch (\InvalidArgumentException $e) {
1680 + wp_send_json_error($e->getMessage(), 400);
1681 + }
1682 +
1081 1683 $formHandler = FormHandler::getInstance();
1082 - $status = $formHandler->admin->deleteAMailTemplate($_REQUEST, $input);
1684 + $sanitized_request = [
1685 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1686 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1687 + ];
1688 + $status = $formHandler->admin->deleteAMailTemplate($sanitized_request, $input);
1083 1689 if (is_wp_error($status)) {
1084 1690 wp_send_json_error($status->get_error_message(), 411);
1085 1691 } else {
1086 1692 wp_send_json_success($status, 200);
@@ -1097,13 +1703,25 @@
1097 1703 }
1098 1704
1099 1705 public function duplicateAMailTemplate()
1100 1706 {
1101 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1102 - $inputJSON = file_get_contents('php://input');
1103 - $input = json_decode($inputJSON);
1707 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1708 + $this->verifyAdminPermission();
1709 + // $inputJSON = wp_unslash($_POST['data']);
1710 + // $input = json_decode($inputJSON);
1711 +
1712 + GlobalHelper::requirePostMethod();
1713 + try {
1714 + $input = GlobalHelper::formatRequestData();
1715 + } catch (\InvalidArgumentException $e) {
1716 + wp_send_json_error($e->getMessage(), 400);
1717 + }
1104 1718 $formHandler = FormHandler::getInstance();
1105 - $status = $formHandler->admin->duplicateAMailTemplate($_REQUEST, $input);
1719 + $sanitized_request = [
1720 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1721 + 'id' => isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0,
1722 + ];
1723 + $status = $formHandler->admin->duplicateAMailTemplate($sanitized_request, $input);
1106 1724 if (is_wp_error($status)) {
1107 1725 wp_send_json_error($status->get_error_message(), 411);
1108 1726 } else {
1109 1727 wp_send_json_success($status, 200);
@@ -1120,13 +1738,26 @@
1120 1738 }
1121 1739
1122 1740 public function setAllFormsReport()
1123 1741 {
1124 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1125 - $inputJSON = file_get_contents('php://input');
1126 - $input = json_decode($inputJSON);
1742 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1743 + $this->verifyAdminPermission();
1744 + // $inputJSON = wp_unslash($_POST['data']);
1745 + // $input = json_decode($inputJSON);
1746 +
1747 + GlobalHelper::requirePostMethod();
1748 +
1749 + try {
1750 + $input = GlobalHelper::formatRequestData();
1751 + } catch (\InvalidArgumentException $e) {
1752 + wp_send_json_error($e->getMessage(), 400);
1753 + }
1754 +
1127 1755 $formHandler = FormHandler::getInstance();
1128 - $status = $formHandler->admin->setAllFormsReport($_REQUEST, $input);
1756 + $sanitized_request = [
1757 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1758 + ];
1759 + $status = $formHandler->admin->setAllFormsReport($sanitized_request, $input);
1129 1760 if (is_wp_error($status)) {
1130 1761 wp_send_json_error($status->get_error_message(), 411);
1131 1762 } else {
1132 1763 wp_send_json_success($status, 200);
@@ -1143,13 +1774,23 @@
1143 1774 }
1144 1775
1145 1776 public function savegReCaptcha()
1146 1777 {
1147 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1148 - $inputJSON = file_get_contents('php://input');
1149 - $input = json_decode($inputJSON);
1778 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1779 + $this->verifyAdminPermission();
1780 + GlobalHelper::requirePostMethod();
1781 +
1782 + try {
1783 + $input = GlobalHelper::formatRequestData();
1784 + } catch (\InvalidArgumentException $e) {
1785 + wp_send_json_error($e->getMessage(), 400);
1786 + }
1787 +
1150 1788 $formHandler = FormHandler::getInstance();
1151 - $status = $formHandler->admin->savegReCaptcha($_REQUEST, $input);
1789 + $sanitized_request = [
1790 + 'formID' => isset($_REQUEST['formID']) ? sanitize_text_field(wp_unslash($_REQUEST['formID'])) : '',
1791 + ];
1792 + $status = $formHandler->admin->savegReCaptcha($sanitized_request, $input);
1152 1793 if (is_wp_error($status)) {
1153 1794 wp_send_json_error($status->get_error_message(), 411);
1154 1795 } else {
1155 1796 wp_send_json_success($status, 200);
@@ -1166,19 +1807,32 @@
1166 1807 }
1167 1808
1168 1809 public function saveApiKey()
1169 1810 {
1170 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1171 - $inputJSON = file_get_contents('php://input');
1172 - $input = json_decode($inputJSON);
1811 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1812 + $this->verifyAdminPermission();
1813 + // $inputJSON = wp_unslash($_POST['data']);
1814 + // $input = json_decode($inputJSON);
1815 +
1816 + GlobalHelper::requirePostMethod();
1817 + try {
1818 + $input = GlobalHelper::formatRequestData();
1819 + } catch (\InvalidArgumentException $e) {
1820 + wp_send_json_error($e->getMessage(), 400);
1821 + }
1822 +
1173 1823 if (empty($input->api_key)) {
1174 1824 $api_key = get_option('bitform_secret_api_key');
1175 1825 } elseif (!empty($input->api_key)) {
1176 - update_option('bitform_secret_api_key', $input->api_key);
1826 + update_option('bitform_secret_api_key', sanitize_text_field($input->api_key));
1177 1827 $api_key = $input->api_key;
1178 1828 }
1179 1829 if (!$api_key) {
1180 - $api_key = hash('sha1', base64_encode(12345));
1830 + // The generated key authenticates the whole bitform/v1 data API. It was
1831 + // previously a constant (sha1 of a fixed string), so every install that
1832 + // never set one explicitly shared the same secret. Existing stored keys
1833 + // are left untouched — only first-time generation changes.
1834 + $api_key = wp_generate_password(64, false, false);
1181 1835 update_option('bitform_secret_api_key', $api_key);
1182 1836 }
1183 1837 wp_send_json_success($api_key, 200);
1184 1838 } else {
@@ -1191,29 +1845,81 @@
1191 1845 );
1192 1846 }
1193 1847 }
1194 1848
1849 + private function checkExtensionWithURL($urlStr)
1850 + {
1851 + // Extension is mandatory (no optional group): the URL must end in a known image extension,
1852 + // otherwise any http(s) URL would pass and be fetched.
1853 + $pattern = '/^https?:\/\/.*\.(svg|png|jpg|jpeg|gif)$/i';
1854 +
1855 + return preg_match($pattern, $urlStr);
1856 + }
1857 +
1195 1858 public function iconUpload()
1196 1859 {
1197 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1198 - $inputJSON = file_get_contents('php://input');
1199 - $input = json_decode($inputJSON);
1860 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1861 + $this->verifyAdminPermission();
1862 + // $inputJSON = wp_unslash($_POST['data']);
1863 + // $input = json_decode($inputJSON);
1864 +
1865 + GlobalHelper::requirePostMethod();
1866 + try {
1867 + $input = GlobalHelper::formatRequestData();
1868 + } catch (\InvalidArgumentException $e) {
1869 + wp_send_json_error($e->getMessage(), 400);
1870 + }
1871 +
1872 + $sanitize_url = sanitize_url($input->src);
1873 +
1874 + if (!$this->checkExtensionWithURL($sanitize_url)) {
1875 + return new WP_Error(
1876 + 'type_error',
1877 + __('Invalid file type', 'bit-form')
1878 + );
1879 + }
1880 +
1200 1881 $uploadDirInfo = wp_upload_dir();
1201 1882 $wpUploadbaseDir = $uploadDirInfo['basedir'];
1202 1883 $icnDir = $wpUploadbaseDir . DIRECTORY_SEPARATOR . 'bitforms' . DIRECTORY_SEPARATOR . 'icons';
1884 +
1203 1885 if (!is_dir($icnDir)) {
1204 - mkdir($icnDir);
1886 + wp_mkdir_p($icnDir);
1205 1887 }
1206 1888
1207 - $imageUrlData = file_get_contents($input->src);
1889 + $response = wp_safe_remote_get($sanitize_url);
1890 + if (is_wp_error($response) || 200 !== (int) wp_remote_retrieve_response_code($response)) {
1891 + wp_send_json_error(__('Unable to fetch icon', 'bit-form'), 400);
1892 + }
1893 + $imageUrlData = wp_remote_retrieve_body($response);
1208 1894
1209 - $filename = $input->id . '-' . basename($input->src);
1895 + $filename = sanitize_file_name($input->id . '-' . basename($sanitize_url));
1210 1896
1211 - $uploaded = file_put_contents($icnDir . '/' . $filename, $imageUrlData);
1897 + $validation = wp_check_filetype($filename);
1898 + $type = $validation['type'];
1899 + $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
1900 + $is_svg = 'svg' === $ext; // Check if the file is an SVG
1901 + if ($type && 0 === strpos($type, 'image/') || $is_svg) {
1902 + if ($is_svg) {
1903 + $imageUrlData = (new \BitCode\BitForm\enshrined\svgSanitize\Sanitizer())->sanitize($imageUrlData);
1904 + if (false === $imageUrlData) {
1905 + wp_send_json_error(__('Invalid file type', 'bit-form'), 400);
1906 + }
1907 + }
1908 + $uploaded = file_put_contents($icnDir . '/' . $filename, $imageUrlData);
1212 1909
1213 - if ($uploaded) {
1214 - $uploadedFile = BITFORMS_UPLOAD_BASE_URL . '/' . 'icons' . '/' . $filename;
1215 - wp_send_json_success($uploadedFile, 200);
1910 + if ($uploaded) {
1911 + $uploadedFile = BITFORMS_UPLOAD_BASE_URL . '/' . 'icons' . '/' . $filename;
1912 + wp_send_json_success($uploadedFile, 200);
1913 + }
1914 + } else {
1915 + wp_send_json_error(
1916 + __(
1917 + 'Invalid file type',
1918 + 'bit-form'
1919 + ),
1920 + 401
1921 + );
1216 1922 }
1217 1923 } else {
1218 1924 wp_send_json_error(
1219 1925 __(
@@ -1247,9 +1953,10 @@
1247 1953 }
1248 1954
1249 1955 public function getDownlodedIcons()
1250 1956 {
1251 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1957 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1958 + $this->verifyAdminPermission();
1252 1959 $files = $this->getFiles();
1253 1960 wp_send_json_success($files, 200);
1254 1961 } else {
1255 1962 wp_send_json_error(
@@ -1263,18 +1970,29 @@
1263 1970 }
1264 1971
1265 1972 public function iconRemove()
1266 1973 {
1267 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1268 - $inputJSON = file_get_contents('php://input');
1269 - $input = json_decode($inputJSON);
1974 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
1975 + $this->verifyAdminPermission();
1976 + // $inputJSON = wp_unslash($_POST['data']);
1977 + // $input = json_decode($inputJSON);
1270 1978
1979 + GlobalHelper::requirePostMethod();
1980 +
1981 + try {
1982 + $input = GlobalHelper::formatRequestData();
1983 + } catch (\InvalidArgumentException $e) {
1984 + wp_send_json_error($e->getMessage(), 400);
1985 + }
1986 +
1271 1987 $uploadDirInfo = wp_upload_dir();
1272 1988
1273 1989 $wpUploadbaseDir = $uploadDirInfo['basedir'];
1274 1990 $icnDir = $wpUploadbaseDir . DIRECTORY_SEPARATOR . 'bitforms' . DIRECTORY_SEPARATOR . 'icons' . DIRECTORY_SEPARATOR;
1275 - if (file_exists($icnDir . $input->file)) {
1276 - unlink($icnDir . $input->file);
1991 + $sanitizeFileName = sanitize_file_name($input->file);
1992 + $filePath = $icnDir . $sanitizeFileName;
1993 + if (file_exists($filePath)) {
1994 + wp_delete_file($filePath);
1277 1995 wp_send_json_success($this->getFiles(), 200);
1278 1996 }
1279 1997 } else {
1280 1998 wp_send_json_error(
@@ -1288,17 +2006,38 @@
1288 2006 }
1289 2007
1290 2008 public function addCustomCode()
1291 2009 {
1292 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1293 - $inputJSON = file_get_contents('php://input');
1294 - $input = json_decode($inputJSON);
1295 - FrontEndScriptGenerator::customCodeFile($input->form_id, $input->customCodes);
1296 - $status = ['message' => 'File Update Successfully..'];
1297 - if (is_wp_error($status)) {
1298 - wp_send_json_error($status->get_error_message(), 411);
2010 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2011 + $this->verifyAdminPermission();
2012 + // $inputJSON = wp_unslash($_POST['data']);
2013 + // $input = json_decode($inputJSON);
2014 +
2015 + GlobalHelper::requirePostMethod();
2016 +
2017 + try {
2018 + $input = GlobalHelper::formatRequestData();
2019 + } catch (\InvalidArgumentException $e) {
2020 + wp_send_json_error($e->getMessage(), 400);
2021 + }
2022 +
2023 + $formId = sanitize_text_field($input->form_id);
2024 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2025 + FrontEndScriptGenerator::customCodeFile($formId, $input->customCodes);
2026 + $status = ['message' => 'File Update Successfully..'];
2027 + if (is_wp_error($status)) {
2028 + wp_send_json_error($status->get_error_message(), 411);
2029 + } else {
2030 + wp_send_json_success($status, 200);
2031 + }
1299 2032 } else {
1300 - wp_send_json_success($status, 200);
2033 + wp_send_json_error(
2034 + __(
2035 + 'Invalid form id',
2036 + 'bit-form'
2037 + ),
2038 + 401
2039 + );
1301 2040 }
1302 2041 } else {
1303 2042 wp_send_json_error(
1304 2043 __(
@@ -1311,16 +2050,38 @@
1311 2050 }
1312 2051
1313 2052 public function getCustomCode()
1314 2053 {
1315 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1316 - $inputJSON = file_get_contents('php://input');
1317 - $input = json_decode($inputJSON);
1318 - $status = FrontEndScriptGenerator::getCustomCodes($input->form_id);
1319 - if (is_wp_error($status)) {
1320 - wp_send_json_error($status->get_error_message(), 411);
2054 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2055 + $this->verifyAdminPermission();
2056 + // $inputJSON = wp_unslash($_POST['data']);
2057 + // $input = json_decode($inputJSON);
2058 +
2059 + GlobalHelper::requirePostMethod();
2060 +
2061 + try {
2062 + $input = GlobalHelper::formatRequestData();
2063 + } catch (\InvalidArgumentException $e) {
2064 + wp_send_json_error($e->getMessage(), 400);
2065 + }
2066 +
2067 + $formId = sanitize_text_field($input->form_id);
2068 +
2069 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2070 + $status = FrontEndScriptGenerator::getCustomCodes($formId);
2071 + if (is_wp_error($status)) {
2072 + wp_send_json_error($status->get_error_message(), 411);
2073 + } else {
2074 + wp_send_json_success($status, 200);
2075 + }
1321 2076 } else {
1322 - wp_send_json_success($status, 200);
2077 + wp_send_json_error(
2078 + __(
2079 + 'Invalid form id',
2080 + 'bit-form'
2081 + ),
2082 + 401
2083 + );
1323 2084 }
1324 2085 } else {
1325 2086 wp_send_json_error(
1326 2087 __(
@@ -1333,10 +2094,11 @@
1333 2094 }
1334 2095
1335 2096 public function getGenerelSettings()
1336 2097 {
1337 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1338 - $data = get_option('bitform_app_config');
2098 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2099 + $this->verifyAdminPermission();
2100 + $data = get_option('bitform_app_config', (object) ['cache_plugin' => true, 'delete_table' => 0]);
1339 2101
1340 2102 if (is_wp_error($data)) {
1341 2103 wp_send_json_error($data->get_error_message(), 411);
1342 2104 } else {
@@ -1347,9 +2109,10 @@
1347 2109 }
1348 2110 } else {
1349 2111 wp_send_json_error(
1350 2112 __(
1351 - 'Token expired'
2113 + 'Token expired',
2114 + 'bit-form'
1352 2115 ),
1353 2116 401
1354 2117 );
1355 2118 }
@@ -1356,25 +2119,34 @@
1356 2119 }
1357 2120
1358 2121 public function saveGenerelSettings()
1359 2122 {
1360 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1361 - $inputJSON = file_get_contents('php://input');
1362 - $input = json_decode($inputJSON);
1363 - $status = update_option('bitform_app_config', $input->config);
2123 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2124 + $this->verifyAdminPermission();
2125 + GlobalHelper::requirePostMethod();
2126 +
2127 + try {
2128 + $inputData = GlobalHelper::formatRequestData();
2129 + } catch (\InvalidArgumentException $e) {
2130 + wp_send_json_error($e->getMessage(), 400);
2131 + return;
2132 + }
2133 +
2134 + $status = update_option('bitform_app_config', $inputData->config);
1364 2135 if (is_wp_error($status)) {
1365 2136 wp_send_json_error($status->get_error_message(), 411);
1366 2137 } else {
1367 - if (Helpers::property_exists_nested($input, 'config->cache_plugin', true)) {
2138 + if (Helpers::property_exists_nested($inputData, 'config->cache_plugin', true)) {
1368 2139 $formHandler = FormHandler::getInstance();
1369 2140 $formHandler->admin->updateGeneratedScriptPageIds();
1370 2141 }
1371 - wp_send_json_success(__('Save successfully done'));
2142 + wp_send_json_success(__('Save successfully done', 'bit-form'));
1372 2143 }
1373 2144 } else {
1374 2145 wp_send_json_error(
1375 2146 __(
1376 - 'Token expired'
2147 + 'Token expired',
2148 + 'bit-form'
1377 2149 ),
1378 2150 401
1379 2151 );
1380 2152 }
@@ -1379,19 +2151,35 @@
1379 2151 );
1380 2152 }
1381 2153 }
1382 2154
1383 - public function savePaymentSettings()
2155 + public function saveGlobalMessages()
1384 2156 {
1385 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1386 - $inputJSON = file_get_contents('php://input');
1387 - $input = json_decode($inputJSON);
1388 - $formHandler = FormHandler::getInstance();
1389 - $status = $formHandler->admin->savePaymentSetting($_REQUEST, $input);
2157 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2158 + $this->verifyAdminPermission();
2159 + // $inputJSON = wp_unslash($_POST['data']);
2160 + // $inputData = json_decode($inputJSON);
2161 +
2162 + GlobalHelper::requirePostMethod();
2163 +
2164 + try {
2165 + $inputData = GlobalHelper::formatRequestData();
2166 + } catch (\InvalidArgumentException $e) {
2167 + wp_send_json_error($e->getMessage(), 400);
2168 + return;
2169 + }
2170 +
2171 + $appSettings = get_option('bitform_app_settings', (object) []);
2172 +
2173 + $appSettings->globalMessages = $inputData;
2174 + $status = update_option('bitform_app_settings', $appSettings);
2175 + // delete_option('bitform_app_settings');
1390 2176 if (is_wp_error($status)) {
1391 2177 wp_send_json_error($status->get_error_message(), 411);
1392 2178 } else {
1393 - wp_send_json_success($status, 200);
2179 + $formHandler = FormHandler::getInstance();
2180 + $formHandler->admin->replaceAllFormsErrorMessagesByGlobalMessages();
2181 + wp_send_json_success(__('Save successfully done', 'bit-form'));
1394 2182 }
1395 2183 } else {
1396 2184 wp_send_json_error(
1397 2185 __(
@@ -1404,11 +2192,18 @@
1404 2192 }
1405 2193
1406 2194 public function getPodsField()
1407 2195 {
1408 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1409 - $inputJSON = file_get_contents('php://input');
1410 - $input = json_decode($inputJSON);
2196 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2197 + $this->verifyAdminPermission();
2198 + // $inputJSON = wp_unslash($_POST['data']);
2199 + // $input = json_decode($inputJSON);
2200 + GlobalHelper::requirePostMethod();
2201 + try {
2202 + $input = GlobalHelper::formatRequestData();
2203 + } catch (\InvalidArgumentException $e) {
2204 + wp_send_json_error($e->getMessage(), 400);
2205 + }
1411 2206 $podsAdminExists = is_plugin_active('pods/init.php');
1412 2207
1413 2208 $podField = [];
1414 2209 if ($podsAdminExists) {
@@ -1417,8 +2212,9 @@
1417 2212 foreach ($pods->fields as $field) {
1418 2213 $i++;
1419 2214 $podField[$i]['key'] = $field['name'];
1420 2215 $podField[$i]['name'] = $field['label'];
2216 + $podField[$i]['is-repeatable'] = $field['repeatable'] ?? 0;
1421 2217 $podField[$i]['required'] = 1 === $field['options']['required'] ? true : false;
1422 2218 }
1423 2219 }
1424 2220
@@ -1439,9 +2235,10 @@
1439 2235 }
1440 2236
1441 2237 public function getPodsType()
1442 2238 {
1443 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
2239 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2240 + $this->verifyAdminPermission();
1444 2241 $users = get_users(['fields' => ['ID', 'display_name']]);
1445 2242 $pods = [];
1446 2243 $podsAdminExists = is_plugin_active('pods/init.php');
1447 2244 if ($podsAdminExists) {
@@ -1465,9 +2262,10 @@
1465 2262 }
1466 2263
1467 2264 public function postTypeByUser()
1468 2265 {
1469 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
2266 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2267 + $this->verifyAdminPermission();
1470 2268 $users = get_users(
1471 2269 [
1472 2270 'fields' => ['ID', 'display_name', 'user_login', 'user_email', 'user_nicename'],
1473 2271 ]
@@ -1480,9 +2278,9 @@
1480 2278 } else {
1481 2279 wp_send_json_error(
1482 2280 __(
1483 2281 'Token expired',
1484 - 'bitformpro'
2282 + 'bit-form'
1485 2283 ),
1486 2284 401
1487 2285 );
1488 2286 }
@@ -1487,8 +2285,54 @@
1487 2285 );
1488 2286 }
1489 2287 }
1490 2288
2289 + public function getWPUsers()
2290 + {
2291 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2292 + $this->verifyAdminPermission();
2293 +
2294 + $users = get_transient('bitforms_admin_users_list');
2295 + if (false === $users) {
2296 + $rawUsers = get_users(['fields' => ['ID', 'user_nicename', 'user_email', 'display_name']]);
2297 + $userMail = [];
2298 + $userNames = [];
2299 + foreach ($rawUsers as $key => $value) {
2300 + $userMail[$key] = [
2301 + 'label' => !empty($value->display_name) ? $value->display_name : '',
2302 + 'value' => !empty($value->user_email) ? $value->user_email : '',
2303 + 'id' => $value->ID,
2304 + ];
2305 + $userNames[$value->ID] = [
2306 + 'name' => $value->display_name,
2307 + 'url' => admin_url('user-edit.php?user_id=' . absint($value->ID)),
2308 + ];
2309 + }
2310 + $users = ['userMail' => $userMail, 'user' => $userNames];
2311 + set_transient('bitforms_admin_users_list', $users, 10 * MINUTE_IN_SECONDS);
2312 + }
2313 +
2314 + wp_send_json_success($users, 200);
2315 + } else {
2316 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
2317 + }
2318 + }
2319 +
2320 + public function getUserRoles()
2321 + {
2322 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2323 + $this->verifyAdminPermission();
2324 + wp_send_json_success(['userRoles' => get_editable_roles()], 200);
2325 + } else {
2326 + wp_send_json_error(__('Token expired', 'bit-form'), 401);
2327 + }
2328 + }
2329 +
2330 + public function clearUsersTransient(): void
2331 + {
2332 + delete_transient('bitforms_admin_users_list');
2333 + }
2334 +
1491 2335 private function getPostTypes()
1492 2336 {
1493 2337 $all_cpt = get_post_types([
1494 2338 'public' => true,
@@ -1520,9 +2364,10 @@
1520 2364 }
1521 2365
1522 2366 public function getAcfGroupFields()
1523 2367 {
1524 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
2368 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2369 + $this->verifyAdminPermission();
1525 2370 $acfFields = [];
1526 2371 $types = ['select', 'checkbox', 'radio'];
1527 2372
1528 2373 $field_groups = get_posts(['post_type' => 'acf-field-group']);
@@ -1557,15 +2402,25 @@
1557 2402 }
1558 2403
1559 2404 public function getCustomField()
1560 2405 {
1561 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1562 - $inputJSON = file_get_contents('php://input');
1563 - $input = json_decode($inputJSON);
2406 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2407 + $this->verifyAdminPermission();
2408 + // $inputJSON = wp_unslash($_POST['data']);
2409 + // $input = json_decode($inputJSON);
2410 +
2411 + GlobalHelper::requirePostMethod();
2412 +
2413 + try {
2414 + $input = GlobalHelper::formatRequestData();
2415 + } catch (\InvalidArgumentException $e) {
2416 + wp_send_json_error($e->getMessage(), 400);
2417 + }
1564 2418 $acfFields = [];
1565 - $acfFile = [];
2419 + $acfFiles = [];
1566 2420
1567 - $filterTypes = [
2421 + $allowedFields = [
2422 + 'repeater',
1568 2423 'text',
1569 2424 'textarea',
1570 2425 'password',
1571 2426 'wysiwyg',
@@ -1583,50 +2438,50 @@
1583 2438 'checkbox',
1584 2439 'select',
1585 2440 'post_object',
1586 2441 'user',
2442 + 'file',
2443 + 'image',
2444 + 'gallery'
1587 2445 ];
1588 - $filterFile = ['file', 'image', 'gallery'];
1589 2446
1590 2447 $field_groups = get_posts(['post_type' => 'acf-field-group']);
2448 +
1591 2449 if ($field_groups) {
1592 2450 $groups = acf_get_field_groups(['post_type' => $input->post_type]);
1593 2451
1594 2452 foreach ($groups as $group) {
1595 2453 foreach (acf_get_fields($group['key']) as $acfField) {
1596 - if (in_array($acfField['type'], $filterTypes)) {
1597 - array_push($acfFields, [
1598 - 'key' => $acfField['key'],
1599 - 'name' => $acfField['label'],
1600 - 'required' => $acfField['required'],
1601 - ]);
1602 - } elseif (in_array($acfField['type'], $filterFile)) {
1603 - array_push($acfFile, [
1604 - 'key' => $acfField['key'],
1605 - 'name' => $acfField['label'],
1606 - 'required' => $acfField['required'],
1607 - ]);
1608 - } elseif (in_array($acfField['type'], ['group'])) {
1609 - foreach ($acfField['sub_fields'] as $subField) {
1610 - if (in_array($subField['type'], $filterTypes)) {
1611 - array_push($acfFields, [
1612 - 'key' => $subField['key'],
1613 - 'name' => $subField['label'],
1614 - 'required' => $subField['required'],
1615 - ]);
1616 - } elseif (in_array($subField['type'], $filterFile)) {
1617 - array_push($acfFile, [
1618 - 'key' => $subField['key'],
1619 - 'name' => $subField['label'],
1620 - 'required' => $subField['required'],
1621 - ]);
2454 + if (in_array($acfField['type'], $allowedFields)) {
2455 + if ('repeater' === $acfField['type']) {
2456 + foreach ($acfField['sub_fields'] as $subField) {
2457 + if (in_array($subField['type'], $allowedFields)) {
2458 + array_push($acfFields, [
2459 + 'key' => $acfField['key'] . '.' . $subField['key'],
2460 + 'name' => $acfField['label'] . '-' . $subField['label'],
2461 + 'required' => $subField['required'],
2462 + ]);
2463 + }
1622 2464 }
2465 + } elseif (in_array($acfField['type'], ['file', 'image', 'gallery'])) {
2466 + array_push($acfFiles, [
2467 + 'key' => $acfField['key'],
2468 + 'name' => $acfField['label'],
2469 + 'required' => $acfField['required'],
2470 + ]);
2471 + } else {
2472 + array_push($acfFields, [
2473 + 'key' => $acfField['key'],
2474 + 'name' => $acfField['label'],
2475 + 'required' => $acfField['required'],
2476 + ]);
1623 2477 }
1624 2478 }
1625 2479 }
1626 2480 }
1627 2481 }
1628 - wp_send_json_success(['acfFields' => $acfFields, 'acfFile' => $acfFile], 200);
2482 +
2483 + wp_send_json_success(['acfFields' => $acfFields, 'acfFile' => $acfFiles], 200);
1629 2484 } else {
1630 2485 wp_send_json_error(
1631 2486 __(
1632 2487 'Token expired',
@@ -1636,64 +2491,32 @@
1636 2491 );
1637 2492 }
1638 2493 }
1639 2494
1640 - public function getMetaboxFields()
2495 + public function getMetaBoxFields()
1641 2496 {
1642 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1643 - $inputJSON = file_get_contents('php://input');
1644 - $input = json_decode($inputJSON);
2497 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2498 + $this->verifyAdminPermission();
2499 + if (!function_exists('rwmb_meta')) {
2500 + wp_send_json_error(__('Meta Box must be activated!', 'bit-form'));
2501 + }
1645 2502
1646 - $metaboxFields = [];
1647 - $metaboxFile = [];
2503 + GlobalHelper::requirePostMethod();
1648 2504
1649 - $filterTypes = [
1650 - 'file_input',
1651 - 'group',
1652 - 'tab',
1653 - 'osm',
1654 - 'heading',
1655 - 'key_value',
1656 - 'map',
1657 - 'custom_html',
1658 - 'background',
1659 - 'fieldset_text',
1660 - 'taxonomy',
1661 - 'taxonomy_advanced',
1662 - ];
2505 + try {
2506 + $input = GlobalHelper::formatRequestData();
2507 + } catch (\InvalidArgumentException $e) {
2508 + wp_send_json_error($e->getMessage(), 400);
2509 + }
1663 2510
1664 - $fileTypes = [
1665 - 'image',
1666 - 'image_upload',
1667 - 'file_advanced',
1668 - 'file_upload',
1669 - 'single_image',
1670 - 'file',
1671 - 'image_advanced',
1672 - 'video',
1673 - ];
2511 + $metaBoxFields = rwmb_get_object_fields($input->post_type);
1674 2512
1675 - if (function_exists('rwmb_meta')) {
1676 - $fields = rwmb_get_object_fields($input->post_type);
1677 - foreach ($fields as $index => $field) {
1678 - if (!in_array($field['type'], $fileTypes)) {
1679 - if (!in_array($field['type'], $filterTypes)) {
1680 - $metaboxFields[$index]['name'] = $field['name'];
1681 - }
2513 + $metaBoxFields = MetaBoxService::getMetaBoxFields($input->post_type);
1682 2514
1683 - $metaboxFields[$index]['key'] = $field['id'];
1684 - $metaboxFields[$index]['required'] = $field['required'];
1685 - } else {
1686 - $metaboxFile[$index]['name'] = $field['name'];
1687 - $metaboxFile[$index]['key'] = $field['id'];
1688 - $metaboxFile[$index]['required'] = $field['required'];
1689 - }
1690 - }
1691 - }
1692 2515 wp_send_json_success(
1693 2516 [
1694 - 'metaboxFields' => array_values($metaboxFields),
1695 - 'metaboxFile' => array_values($metaboxFile),
2517 + 'metaboxFields' => array_values($metaBoxFields['text_fields']),
2518 + 'metaboxFile' => array_values($metaBoxFields['file_fields']),
1696 2519 ],
1697 2520 200
1698 2521 );
1699 2522 } else {
@@ -1699,9 +2522,9 @@
1699 2522 } else {
1700 2523 wp_send_json_error(
1701 2524 __(
1702 2525 'Token expired',
1703 - 'bitformpro'
2526 + 'bit-form'
1704 2527 ),
1705 2528 401
1706 2529 );
1707 2530 }
@@ -1708,23 +2531,46 @@
1708 2531 }
1709 2532
1710 2533 public function saveConversationalCSS()
1711 2534 {
1712 - if (wp_verify_nonce(sanitize_text_field($_REQUEST['_ajax_nonce']), 'bitforms_save')) {
1713 - $inputJSON = file_get_contents('php://input');
1714 - $requestsParams = json_decode($inputJSON);
1715 - $formId = $requestsParams->formID;
2535 + if (isset($_REQUEST['_ajax_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_ajax_nonce'])), 'bitforms_save')) {
2536 + $this->verifyAdminPermission();
2537 + // $inputJSON = wp_unslash($_POST['data']);
2538 + // $requestsParams = json_decode($inputJSON);
2539 + GlobalHelper::requirePostMethod();
2540 + try {
2541 + $requestsParams = GlobalHelper::formatRequestData();
2542 + } catch (\InvalidArgumentException $e) {
2543 + wp_send_json_error($e->getMessage(), 400);
2544 + }
2545 + $formId = sanitize_text_field($requestsParams->formID);
1716 2546 $css = $requestsParams->css;
1717 2547
1718 - $path = 'form-styles';
1719 - $fileName = "bitform-conversational-$formId.css";
1720 - FrontEndScriptGenerator::customCodeFileSaveOrDelete($css, $path, $fileName);
1721 - wp_send_json_success(__('Conversational CSS Saved Successfully!', 'bitform'), 200);
2548 + if (filter_var($formId, FILTER_VALIDATE_INT)) {
2549 + $path = 'form-styles';
2550 + $fileName = "bitform-conversational-$formId.css";
2551 + FrontEndScriptGenerator::customCodeFileSaveOrDelete($css, $path, $fileName);
2552 + wp_send_json_success(
2553 + __(
2554 + 'Conversational CSS Saved Successfully!',
2555 + 'bit-form'
2556 + ),
2557 + 200
2558 + );
2559 + } else {
2560 + wp_send_json_error(
2561 + __(
2562 + 'Invalid form id',
2563 + 'bit-form'
2564 + ),
2565 + 401
2566 + );
2567 + }
1722 2568 } else {
1723 2569 wp_send_json_error(
1724 2570 __(
1725 2571 'Token expired',
1726 - 'bitform'
2572 + 'bit-form'
1727 2573 ),
1728 2574 401
1729 2575 );
1730 2576 }