| @@ -6,9 +6,17 @@ | ||
| 6 | 6 | use BitCode\BitForm\Core\Form\FormManager; |
| 7 | 7 | |
| 8 | 8 | final class FieldValueHandler |
| 9 | 9 | { |
| 10 | - public static function replaceFieldWithValue($stringToReplaceField, $fieldValues, $formID = null) | |
| 10 | + /** | |
| 11 | + * @param mixed $stringToReplaceField | |
| 12 | + * @param mixed $fieldValues | |
| 13 | + * @param mixed $formID | |
| 14 | + * @param bool $stripShortcodesFromValues | |
| 15 | + * | |
| 16 | + * @return string | |
| 17 | + */ | |
| 18 | + public static function replaceFieldWithValue($stringToReplaceField, $fieldValues, $formID = null, $stripShortcodesFromValues = false) | |
| 11 | 19 | { |
| 12 | 20 | if (empty($stringToReplaceField)) { |
| 13 | 21 | return $stringToReplaceField; |
| 14 | 22 | } |
| @@ -16,8 +24,12 @@ | ||
| 16 | 24 | $stringToReplaceField = wp_json_encode($stringToReplaceField); |
| 17 | 25 | } |
| 18 | 26 | $fieldValues = $formID ? self::sortValueBasedOnLayout($formID, $fieldValues) : $fieldValues; |
| 19 | 27 | |
| 28 | + // Must run on the raw template: after substitution an empty field and an empty template | |
| 29 | + // are the same empty string. | |
| 30 | + $stringToReplaceField = self::resolveConditionalBlocks($stringToReplaceField, $fieldValues, $formID); | |
| 31 | + | |
| 20 | 32 | if ($formID) { |
| 21 | 33 | $stringToReplaceField = self::replaceValueOfBf_all_data($stringToReplaceField, $fieldValues, $formID); |
| 22 | 34 | $stringToReplaceField = self::replaceRepeaterFieldValue($stringToReplaceField, $fieldValues, $formID); |
| 23 | 35 | } |
| @@ -36,9 +48,9 @@ | ||
| 36 | 48 | $fieldValue = null; |
| 37 | 49 | if (isset($fieldValues[$fieldName])) { |
| 38 | 50 | $targetFieldValue = isset($fieldValues[$fieldName]['value']) ? $fieldValues[$fieldName]['value'] : $fieldValues[$fieldName]; |
| 39 | 51 | if ('array' === gettype($targetFieldValue) || 'object' === gettype($targetFieldValue)) { |
| 40 | - foreach ((array) $targetFieldValue as $singleTargetVal) { | |
| 52 | + foreach (self::stripMetaSubfields((array) $targetFieldValue) as $singleTargetVal) { | |
| 41 | 53 | if (isset($fieldValue)) { |
| 42 | 54 | if (is_numeric($fieldValue) && is_numeric($singleTargetVal)) { |
| 43 | 55 | $fieldValue = $fieldValue + $singleTargetVal; |
| 44 | 56 | } else { |
| @@ -51,8 +63,12 @@ | ||
| 51 | 63 | // $fieldValue = wp_json_encode($targetFieldValue); |
| 52 | 64 | } else { |
| 53 | 65 | $fieldValue = strval($targetFieldValue); |
| 54 | 66 | } |
| 67 | + // Neutralize shortcodes in low-trust submitted values before they are merged into a | |
| 68 | + if ($stripShortcodesFromValues && is_string($fieldValue)) { | |
| 69 | + $fieldValue = strip_shortcodes($fieldValue); | |
| 70 | + } | |
| 55 | 71 | $stringToReplaceField = str_replace($value, $fieldValue, $stringToReplaceField); |
| 56 | 72 | } else { |
| 57 | 73 | $stringToReplaceField = str_replace($value, '', $stringToReplaceField); |
| 58 | 74 | } |
| @@ -198,8 +214,318 @@ | ||
| 198 | 214 | } |
| 199 | 215 | return false; |
| 200 | 216 | } |
| 201 | 217 | |
| 218 | + /** | |
| 219 | + * Whether a resolved value renders as nothing. | |
| 220 | + * | |
| 221 | + * Stricter than isEmpty(): whitespace-only is blank (some smart-tag resolvers return a | |
| 222 | + * single space), so is an all-blank array. `0` / `'0'` never are. | |
| 223 | + * | |
| 224 | + * @param mixed $val | |
| 225 | + * | |
| 226 | + * @return bool | |
| 227 | + */ | |
| 228 | + public static function isBlank($val) | |
| 229 | + { | |
| 230 | + if (null === $val || false === $val) { | |
| 231 | + return true; | |
| 232 | + } | |
| 233 | + if (is_object($val)) { | |
| 234 | + $val = (array) $val; | |
| 235 | + } | |
| 236 | + if (is_array($val)) { | |
| 237 | + foreach ($val as $key => $item) { | |
| 238 | + // Composite meta sub-values (_latitude, …) never render on their own. | |
| 239 | + if (is_string($key) && 0 === strpos($key, '_')) { | |
| 240 | + continue; | |
| 241 | + } | |
| 242 | + if (!self::isBlank($item)) { | |
| 243 | + return false; | |
| 244 | + } | |
| 245 | + } | |
| 246 | + return true; | |
| 247 | + } | |
| 248 | + if (!is_scalar($val)) { | |
| 249 | + return true; | |
| 250 | + } | |
| 251 | + | |
| 252 | + return '' === trim(str_replace("\xc2\xa0", '', (string) $val)); | |
| 253 | + } | |
| 254 | + | |
| 255 | + /** | |
| 256 | + * Resolve `${bf_if:…}` … `${bf_endif}` template blocks. | |
| 257 | + * | |
| 258 | + * Syntax, operators and traps: docs/template-conditional-blocks.md. | |
| 259 | + * | |
| 260 | + * @param string $content | |
| 261 | + * @param array $fieldValues | |
| 262 | + * @param mixed $formID needed to reach repeater rows; without it a child key reads blank | |
| 263 | + * | |
| 264 | + * @return string | |
| 265 | + */ | |
| 266 | + private static function resolveConditionalBlocks($content, $fieldValues, $formID = null) | |
| 267 | + { | |
| 268 | + if (false === strpos($content, '${bf_if') && false === strpos($content, '${bf_unless')) { | |
| 269 | + return self::stripConditionalBlockTags($content); | |
| 270 | + } | |
| 271 | + | |
| 272 | + $conditionValues = $fieldValues; | |
| 273 | + if ($formID) { | |
| 274 | + $formManager = FormManager::getInstance($formID); | |
| 275 | + // Repeater children have no top-level key; flatten the rows in, real values still win. | |
| 276 | + $conditionValues = array_merge(self::restructureRepeaterData($fieldValues, $formManager), $fieldValues); | |
| 277 | + } | |
| 278 | + | |
| 279 | + // Matches a block whose body holds no further opener, i.e. the innermost one. | |
| 280 | + $innerMost = '/\$\{bf_(if|if_any|if_all|unless):([^{}$]*)\}((?:(?!\$\{bf_(?:if|if_any|if_all|unless):)[\s\S])*?)\$\{bf_endif\}/'; | |
| 281 | + | |
| 282 | + // Bounded so a malformed template can never spin here. | |
| 283 | + for ($pass = 0; $pass < 200; $pass++) { | |
| 284 | + $resolved = preg_replace_callback($innerMost, function ($matches) use ($conditionValues) { | |
| 285 | + $branches = preg_split('/\$\{bf_else\}/', $matches[3], 2); | |
| 286 | + $truthy = isset($branches[0]) ? $branches[0] : ''; | |
| 287 | + $falsy = isset($branches[1]) ? $branches[1] : ''; | |
| 288 | + | |
| 289 | + return self::evaluateBlockCondition($matches[1], $matches[2], $conditionValues) ? $truthy : $falsy; | |
| 290 | + }, $content, -1, $replacedCount); | |
| 291 | + | |
| 292 | + if (null === $resolved) { | |
| 293 | + break; // preg failure (e.g. backtrack limit): leave the content untouched | |
| 294 | + } | |
| 295 | + $content = $resolved; | |
| 296 | + if (!$replacedCount) { | |
| 297 | + break; | |
| 298 | + } | |
| 299 | + } | |
| 300 | + | |
| 301 | + return self::stripConditionalBlockTags($content); | |
| 302 | + } | |
| 303 | + | |
| 304 | + /** | |
| 305 | + * @param string $type if|if_any|if_all|unless | |
| 306 | + * @param string $rawKeys comma separated conditions | |
| 307 | + * @param array $fieldValues | |
| 308 | + * | |
| 309 | + * @return bool | |
| 310 | + */ | |
| 311 | + private static function evaluateBlockCondition($type, $rawKeys, $fieldValues) | |
| 312 | + { | |
| 313 | + $conditions = array_filter(array_map('trim', explode(',', (string) $rawKeys)), function ($condition) { | |
| 314 | + return '' !== $condition; | |
| 315 | + }); | |
| 316 | + if (empty($conditions)) { | |
| 317 | + return false; | |
| 318 | + } | |
| 319 | + | |
| 320 | + $results = []; | |
| 321 | + foreach ($conditions as $condition) { | |
| 322 | + $results[] = self::conditionHolds($condition, $fieldValues); | |
| 323 | + } | |
| 324 | + | |
| 325 | + if ('if_all' === $type) { | |
| 326 | + return !in_array(false, $results, true); | |
| 327 | + } | |
| 328 | + if ('unless' === $type) { | |
| 329 | + return !in_array(true, $results, true); | |
| 330 | + } | |
| 331 | + | |
| 332 | + return in_array(true, $results, true); | |
| 333 | + } | |
| 334 | + | |
| 335 | + /** | |
| 336 | + * `key`, or `key operator value`. | |
| 337 | + * | |
| 338 | + * @param string $condition | |
| 339 | + * @param array $fieldValues | |
| 340 | + * | |
| 341 | + * @return bool | |
| 342 | + */ | |
| 343 | + private static function conditionHolds($condition, $fieldValues) | |
| 344 | + { | |
| 345 | + $operators = self::blockOperators(); | |
| 346 | + // Longest name first, or `not_equal` reads as `equal`. Field keys never contain a space. | |
| 347 | + $pattern = '/^(\S+)\s+(' . implode('|', $operators) . ')(?:\s+([\s\S]*))?$/'; | |
| 348 | + | |
| 349 | + if (!preg_match($pattern, trim($condition), $parts)) { | |
| 350 | + return !self::isBlank(self::conditionValue(trim($condition), $fieldValues)); | |
| 351 | + } | |
| 352 | + | |
| 353 | + $value = self::conditionValue($parts[1], $fieldValues); | |
| 354 | + $operator = $parts[2]; | |
| 355 | + $expected = isset($parts[3]) ? trim($parts[3]) : ''; | |
| 356 | + | |
| 357 | + if ('null' === $operator) { | |
| 358 | + return self::isBlank($value); | |
| 359 | + } | |
| 360 | + if ('not_null' === $operator) { | |
| 361 | + return !self::isBlank($value); | |
| 362 | + } | |
| 363 | + | |
| 364 | + // Multi-value fields and repeater children arrive as a list. | |
| 365 | + $candidates = is_array($value) || is_object($value) ? self::stripMetaSubfields((array) $value) : [$value]; | |
| 366 | + $negated = in_array($operator, ['not_equal', 'not_contain'], true); | |
| 367 | + foreach ($candidates as $candidate) { | |
| 368 | + if (is_array($candidate) || is_object($candidate)) { | |
| 369 | + continue; | |
| 370 | + } | |
| 371 | + // compareValue answers the positive form, so one match settles either case: it satisfies | |
| 372 | + // `contain` and rules out `not_contain`. | |
| 373 | + if (self::compareValue($operator, (string) $candidate, $expected)) { | |
| 374 | + return !$negated; | |
| 375 | + } | |
| 376 | + } | |
| 377 | + | |
| 378 | + return $negated; | |
| 379 | + } | |
| 380 | + | |
| 381 | + /** | |
| 382 | + * @return string[] operator names, longest first | |
| 383 | + */ | |
| 384 | + private static function blockOperators() | |
| 385 | + { | |
| 386 | + return [ | |
| 387 | + 'greater_or_equal', | |
| 388 | + 'less_or_equal', | |
| 389 | + 'not_contain', | |
| 390 | + 'start_with', | |
| 391 | + 'not_equal', | |
| 392 | + 'not_null', | |
| 393 | + 'end_with', | |
| 394 | + 'contain', | |
| 395 | + 'greater', | |
| 396 | + 'equal', | |
| 397 | + 'less', | |
| 398 | + 'null', | |
| 399 | + ]; | |
| 400 | + } | |
| 401 | + | |
| 402 | + /** | |
| 403 | + * @param string $key field key, or a `_bf_*` smart tag | |
| 404 | + * @param array $fieldValues | |
| 405 | + * | |
| 406 | + * @return mixed | |
| 407 | + */ | |
| 408 | + private static function conditionValue($key, $fieldValues) | |
| 409 | + { | |
| 410 | + if (0 === strpos($key, '_')) { | |
| 411 | + return SmartTags::getSmartTagValue($key, false, ''); | |
| 412 | + } | |
| 413 | + $value = isset($fieldValues[$key]) ? $fieldValues[$key] : null; | |
| 414 | + if (is_array($value) && isset($value['value'])) { | |
| 415 | + $value = $value['value']; | |
| 416 | + } | |
| 417 | + | |
| 418 | + return $value; | |
| 419 | + } | |
| 420 | + | |
| 421 | + /** | |
| 422 | + * @param string $operator | |
| 423 | + * @param string $value the submitted value | |
| 424 | + * @param string $expected the value written in the template | |
| 425 | + * | |
| 426 | + * @return bool | |
| 427 | + */ | |
| 428 | + private static function compareValue($operator, $value, $expected) | |
| 429 | + { | |
| 430 | + switch ($operator) { | |
| 431 | + case 'equal': | |
| 432 | + case 'not_equal': | |
| 433 | + return 0 === strcasecmp(trim($value), $expected); | |
| 434 | + case 'contain': | |
| 435 | + case 'not_contain': | |
| 436 | + return '' !== $expected && false !== stripos($value, $expected); | |
| 437 | + case 'start_with': | |
| 438 | + return '' !== $expected && 0 === stripos($value, $expected); | |
| 439 | + case 'end_with': | |
| 440 | + return '' !== $expected && 0 === strcasecmp($expected, (string) substr($value, -strlen($expected))); | |
| 441 | + case 'greater': | |
| 442 | + return self::isNumericPair($value, $expected) && (float) $value > (float) $expected; | |
| 443 | + case 'less': | |
| 444 | + return self::isNumericPair($value, $expected) && (float) $value < (float) $expected; | |
| 445 | + case 'greater_or_equal': | |
| 446 | + return self::isNumericPair($value, $expected) && (float) $value >= (float) $expected; | |
| 447 | + case 'less_or_equal': | |
| 448 | + return self::isNumericPair($value, $expected) && (float) $value <= (float) $expected; | |
| 449 | + default: | |
| 450 | + return false; | |
| 451 | + } | |
| 452 | + } | |
| 453 | + | |
| 454 | + /** | |
| 455 | + * @param string $value | |
| 456 | + * @param string $expected | |
| 457 | + * | |
| 458 | + * @return bool both sides compare as numbers | |
| 459 | + */ | |
| 460 | + private static function isNumericPair($value, $expected) | |
| 461 | + { | |
| 462 | + return is_numeric(trim($value)) && is_numeric($expected); | |
| 463 | + } | |
| 464 | + | |
| 465 | + /** | |
| 466 | + * Drop leftover block tags so an unbalanced template never leaks them into the output. | |
| 467 | + * | |
| 468 | + * @param string $content | |
| 469 | + * | |
| 470 | + * @return string | |
| 471 | + */ | |
| 472 | + private static function stripConditionalBlockTags($content) | |
| 473 | + { | |
| 474 | + return preg_replace('/\$\{bf_(?:if|if_any|if_all|unless):[^{}$]*\}|\$\{bf_(?:else|endif)\}/', '', $content); | |
| 475 | + } | |
| 476 | + | |
| 477 | + /** | |
| 478 | + * Values a field kept on an entry edit, posted as `<fieldKey>_old` instead of resubmitted. | |
| 479 | + * | |
| 480 | + * @param mixed $postData submitted data, keyed by field key | |
| 481 | + * @param string $fieldKey | |
| 482 | + * | |
| 483 | + * @return array retained values, empty when the field kept nothing | |
| 484 | + */ | |
| 485 | + public static function retainedOldValues($postData, $fieldKey) | |
| 486 | + { | |
| 487 | + if (!is_array($postData) || !isset($postData[$fieldKey . '_old'])) { | |
| 488 | + return []; | |
| 489 | + } | |
| 490 | + return self::flattenOldValues($postData[$fieldKey . '_old']); | |
| 491 | + } | |
| 492 | + | |
| 493 | + private static function flattenOldValues($value) | |
| 494 | + { | |
| 495 | + if (is_object($value)) { | |
| 496 | + $value = (array) $value; | |
| 497 | + } | |
| 498 | + if (!is_array($value)) { | |
| 499 | + if (!is_string($value) && !is_numeric($value)) { | |
| 500 | + return []; | |
| 501 | + } | |
| 502 | + $value = trim((string) $value); | |
| 503 | + if ('' === $value) { | |
| 504 | + return []; | |
| 505 | + } | |
| 506 | + // A repeater posts one JSON list per row, so a list can arrive nested. | |
| 507 | + $decoded = json_decode($value, true); | |
| 508 | + if (!is_array($decoded)) { | |
| 509 | + $retained = []; | |
| 510 | + foreach (explode(',', $value) as $item) { | |
| 511 | + $item = trim($item); | |
| 512 | + if ('' !== $item) { | |
| 513 | + $retained[] = $item; | |
| 514 | + } | |
| 515 | + } | |
| 516 | + return $retained; | |
| 517 | + } | |
| 518 | + $value = $decoded; | |
| 519 | + } | |
| 520 | + | |
| 521 | + $retained = []; | |
| 522 | + foreach ($value as $item) { | |
| 523 | + $retained = array_merge($retained, self::flattenOldValues($item)); | |
| 524 | + } | |
| 525 | + return $retained; | |
| 526 | + } | |
| 527 | + | |
| 202 | 528 | public static function formatFieldValueForMail($fields, $fieldValues = []) |
| 203 | 529 | { |
| 204 | 530 | $formattedFldValues = $fieldValues; |
| 205 | 531 | $file_upload_types = Helpers::$file_upload_types; |
| @@ -207,9 +533,9 @@ | ||
| 207 | 533 | foreach ($fields as $fldKey => $fldData) { |
| 208 | 534 | if (in_array($fldData->typ, $file_upload_types)) { |
| 209 | 535 | continue; |
| 210 | 536 | } |
| 211 | - if (array_key_exists($fldKey, $fieldValues)) { | |
| 537 | + if (is_array($fieldValues) && array_key_exists($fldKey, $fieldValues)) { | |
| 212 | 538 | $value = $fieldValues[$fldKey]; |
| 213 | 539 | // if (is_array($value)) { |
| 214 | 540 | // $formattedFldValues[$fldKey] = htmlspecialchars(implode(', ', $value)); |
| 215 | 541 | // } else { |
| @@ -317,8 +643,13 @@ | ||
| 317 | 643 | '/<img\s+[^>]*src=[\'"]([^\'"]*)[\'"][^>]*>/i', |
| 318 | 644 | function ($matches) use ($path, $allowedMimeTypes) { |
| 319 | 645 | $src = $matches[1]; |
| 320 | 646 | |
| 647 | + // Already-embedded inline images (cid:) must be left untouched. | |
| 648 | + if (0 === stripos($src, 'cid:')) { | |
| 649 | + return $matches[0]; | |
| 650 | + } | |
| 651 | + | |
| 321 | 652 | if (filter_var($src, FILTER_VALIDATE_URL)) { |
| 322 | 653 | return $matches[0]; |
| 323 | 654 | } |
| 324 | 655 | |
| @@ -364,13 +695,16 @@ | ||
| 364 | 695 | |
| 365 | 696 | public static function sortValueBasedOnLayout($formId, $fieldValues) |
| 366 | 697 | { |
| 367 | 698 | $formManager = FormManager::getInstance($formId); |
| 368 | - $layout = $formManager->getFormLayout(); | |
| 369 | 699 | $formLayout = $formManager->getFlatenFormLayout(); // returns all layouts (lg, md, sm) |
| 370 | - $fieldKeyOrderbasedOnLayout = array_map(function ($fld) { | |
| 371 | - return $fld->i; | |
| 372 | - }, $formLayout->lg); | |
| 700 | + // A form saved without a layout (or a minimal/legacy form_content) has no ->lg | |
| 701 | + $lgLayout = isset($formLayout->lg) ? (array) $formLayout->lg : []; | |
| 702 | + $fieldKeyOrderbasedOnLayout = array_filter(array_map(function ($fld) { | |
| 703 | + return isset($fld->i) ? $fld->i : null; | |
| 704 | + }, $lgLayout), function ($key) { | |
| 705 | + return !is_null($key); | |
| 706 | + }); | |
| 373 | 707 | $ordered = []; |
| 374 | 708 | |
| 375 | 709 | foreach ($fieldKeyOrderbasedOnLayout as $key) { |
| 376 | 710 | if (array_key_exists($key, $fieldValues)) { |
| @@ -397,18 +731,20 @@ | ||
| 397 | 731 | $formManager = FormManager::getInstance($formId); |
| 398 | 732 | $formFields = $formManager->getFields(); |
| 399 | 733 | $orderedFormFields = $formManager->getFieldsBasedOnLayout(); // ordered form fields based on layout(lg) order |
| 400 | 734 | foreach ($matchesArray as $match) { |
| 735 | + // Each tag binds from the untouched submitted values: reusing a filtered result would | |
| 736 | + // let the first tag in a template starve the second. | |
| 401 | 737 | switch ($match) { |
| 402 | 738 | case '${bf_all_data}': |
| 403 | - $fieldValues = self::bindFormData($orderedFormFields, $fieldValues, $formId); | |
| 404 | - $table = self::generateTable($fieldValues, $orderedFormFields); | |
| 739 | + $boundValues = self::bindFormData($orderedFormFields, $fieldValues, $formId); | |
| 740 | + $table = self::generateTable($boundValues, $orderedFormFields, $formId); | |
| 405 | 741 | $stringToReplaceField = str_replace('${bf_all_data}', $table, $stringToReplaceField); |
| 406 | 742 | break; |
| 407 | 743 | |
| 408 | 744 | case '${bf_all_data.onlyValues}': |
| 409 | - $fieldValues = self::bindFormData($orderedFormFields, $fieldValues, $formId, true); | |
| 410 | - $table = self::generateTable($fieldValues, $orderedFormFields); | |
| 745 | + $boundValues = self::bindFormData($orderedFormFields, $fieldValues, $formId, true); | |
| 746 | + $table = self::generateTable($boundValues, $orderedFormFields, $formId); | |
| 411 | 747 | $stringToReplaceField = str_replace('${bf_all_data.onlyValues}', $table, $stringToReplaceField); |
| 412 | 748 | break; |
| 413 | 749 | default: |
| 414 | 750 | Log::debug_log([ |
| @@ -511,10 +847,11 @@ | ||
| 511 | 847 | } |
| 512 | 848 | |
| 513 | 849 | // Skip processing for hidden or empty fields only when $isOnlyValues is true |
| 514 | 850 | if ($isOnlyValues) { |
| 515 | - // Check if the value is strictly an empty string or null, but allow 0 | |
| 516 | - if (!isset($formData[$key]) || '' === $formData[$key] || null === $formData[$key]) { | |
| 851 | + // Blank means empty string, null, or an array with nothing in it (unchecked | |
| 852 | + // checkbox group, file field with no upload). 0 is a real value. | |
| 853 | + if (!isset($formData[$key]) || self::isBlank($formData[$key])) { | |
| 517 | 854 | return $fieldNewData; |
| 518 | 855 | } |
| 519 | 856 | |
| 520 | 857 | if (isset($field['valid']['hide']) && $field['valid']['hide']) { |
| @@ -550,9 +887,9 @@ | ||
| 550 | 887 | return $fieldNewData; |
| 551 | 888 | }, []); |
| 552 | 889 | } |
| 553 | 890 | |
| 554 | - private static function generateTable($fieldValues, $formFields) | |
| 891 | + private static function generateTable($fieldValues, $formFields, $formId = null) | |
| 555 | 892 | { |
| 556 | 893 | if (empty($fieldValues)) { |
| 557 | 894 | Log::debug_log([ |
| 558 | 895 | 'status' => 'error', |
| @@ -578,10 +915,12 @@ | ||
| 578 | 915 | if (is_array($value)) { |
| 579 | 916 | if ('repeater' === $fieldType) { |
| 580 | 917 | $table .= "<table style='width: 100%; border-collapse: collapse;'>"; |
| 581 | 918 | |
| 919 | + $subKeys = self::repeaterColumnKeys($value, $fk, $formId); | |
| 920 | + | |
| 582 | 921 | $table .= '<tr>'; |
| 583 | - foreach (array_keys($value[0]) as $subKey) { | |
| 922 | + foreach ($subKeys as $subKey) { | |
| 584 | 923 | $subLabel = self::getLabel($formFields, $subKey) ?? $subKey; |
| 585 | 924 | $table .= "<th style='border: 1px solid #dddddd; padding: 8px; background-color: #f2f2f2;'>" . $subLabel . '</th>'; |
| 586 | 925 | } |
| 587 | 926 | $table .= '</tr>'; |
| @@ -586,10 +925,16 @@ | ||
| 586 | 925 | } |
| 587 | 926 | $table .= '</tr>'; |
| 588 | 927 | |
| 589 | 928 | foreach ($value as $row) { |
| 929 | + if (!is_array($row)) { | |
| 930 | + continue; | |
| 931 | + } | |
| 590 | 932 | $table .= '<tr>'; |
| 591 | - foreach ($row as $subKey => $subValue) { | |
| 933 | + // Walk the shared column list so a row missing a conditionally hidden | |
| 934 | + // sub-field still lines up with the header. | |
| 935 | + foreach ($subKeys as $subKey) { | |
| 936 | + $subValue = array_key_exists($subKey, $row) ? $row[$subKey] : ''; | |
| 592 | 937 | $subFieldType = self::getFldType($subKey, $formFields); |
| 593 | 938 | if (is_array($subValue)) { |
| 594 | 939 | if (self::isCompositeFieldType($subFieldType)) { |
| 595 | 940 | $subValue = self::joinCompositeFieldValue($subValue, $subFieldType); |
| @@ -634,12 +979,13 @@ | ||
| 634 | 979 | } |
| 635 | 980 | } elseif (self::isCompositeFieldType($fieldType)) { |
| 636 | 981 | $table .= self::joinCompositeFieldValue($value, $fieldType); |
| 637 | 982 | } elseif ('signature' === $fieldType) { |
| 638 | - if ('signature-failed.png' === $subValue) { | |
| 639 | - $table .= ''; | |
| 640 | - } else { | |
| 641 | - $table .= self::imgMarkup($value); | |
| 983 | + // A signature arrives here wrapped in a one-item list; the failed-capture | |
| 984 | + // placeholder renders nothing. | |
| 985 | + $signature = reset($value); | |
| 986 | + if (false !== $signature && 'signature-failed.png' !== $signature) { | |
| 987 | + $table .= self::imgMarkup($signature); | |
| 642 | 988 | } |
| 643 | 989 | } |
| 644 | 990 | } else { |
| 645 | 991 | $table .= $value; |
| @@ -664,16 +1010,32 @@ | ||
| 664 | 1010 | } |
| 665 | 1011 | |
| 666 | 1012 | private static function imgMarkup($filename) |
| 667 | 1013 | { |
| 668 | - return "<img src='{$filename}' alt='{$filename}' width='250'/>"; | |
| 1014 | + if (!is_scalar($filename)) { | |
| 1015 | + return ''; | |
| 1016 | + } | |
| 1017 | + $filename = (string) $filename; | |
| 1018 | + | |
| 1019 | + return "<img src='" . self::escFileHref($filename) . "' alt='" . esc_attr($filename) . "' width='250'/>"; | |
| 669 | 1020 | } |
| 670 | 1021 | |
| 671 | 1022 | private static function anchorMarkup($filename) |
| 672 | 1023 | { |
| 673 | - return "<a href='{$filename}' rel='noopener noreferrer' target='_blank' style='color:blue'>{$filename}</a>"; | |
| 1024 | + if (!is_scalar($filename)) { | |
| 1025 | + return ''; | |
| 1026 | + } | |
| 1027 | + $filename = (string) $filename; | |
| 1028 | + | |
| 1029 | + return "<a href='" . self::escFileHref($filename) . "' rel='noopener noreferrer' target='_blank' style='color:blue'>" . esc_html($filename) . '</a>'; | |
| 674 | 1030 | } |
| 675 | 1031 | |
| 1032 | + /** Escape a file reference for an href/src. Not esc_url(): it rewrites a bare file name to `http://<name>`. */ | |
| 1033 | + private static function escFileHref($value) | |
| 1034 | + { | |
| 1035 | + return esc_attr(wp_kses_bad_protocol($value, wp_allowed_protocols())); | |
| 1036 | + } | |
| 1037 | + | |
| 676 | 1038 | public static function replaceRepeaterFieldValue($stringToReplaceField, $fieldValues, $formID) |
| 677 | 1039 | { |
| 678 | 1040 | if (!is_string($stringToReplaceField) || empty($stringToReplaceField)) { |
| 679 | 1041 | return $stringToReplaceField; // Return as-is if nothing to replace |
| @@ -695,9 +1057,9 @@ | ||
| 695 | 1057 | foreach ($matches[1] as $fk) { |
| 696 | 1058 | $repeaterFieldKey = $fk; |
| 697 | 1059 | $fieldType = isset($formFields[$repeaterFieldKey]['type']) && !empty($formFields[$repeaterFieldKey]['type']) ? $formFields[$repeaterFieldKey]['type'] : null; |
| 698 | 1060 | if ('repeater' === $fieldType) { |
| 699 | - $repeaterMarkup = self::repeaterFieldTable($fieldValues[$repeaterFieldKey] ?? [], $formFields, $repeaterFieldKey); | |
| 1061 | + $repeaterMarkup = self::repeaterFieldTable($fieldValues[$repeaterFieldKey] ?? [], $formFields, $repeaterFieldKey, $formID); | |
| 700 | 1062 | $stringToReplaceField = str_replace('${' . $fk . '}', $repeaterMarkup, $stringToReplaceField); |
| 701 | 1063 | } else { |
| 702 | 1064 | if ('signature' === $fieldType) { |
| 703 | 1065 | $stringToReplaceField = self::replaceImgTagForRepeatedSignature($stringToReplaceField, $flatFieldData[$repeaterFieldKey], $repeaterFieldKey); |
| @@ -833,17 +1195,11 @@ | ||
| 833 | 1195 | * @param array|null $allFieldData |
| 834 | 1196 | * @param array|null $formFields |
| 835 | 1197 | * @return string |
| 836 | 1198 | */ |
| 837 | - public static function safeFlatString($data, $fldType, $fieldKey = null, $allFieldData = null, $formFields = null, $resolveFromParent = true): string | |
| 1199 | + public static function safeFlatString($data, $fldType, $fieldKey = null, $allFieldData = null, $formFields = null): string | |
| 838 | 1200 | { |
| 839 | 1201 | $newData = self::decodeIfJson($data); |
| 840 | - if ($resolveFromParent) { | |
| 841 | - $resolvedChildValues = self::extractRepeaterChildFieldValues($fieldKey, $allFieldData, $formFields); | |
| 842 | - if (is_array($resolvedChildValues)) { | |
| 843 | - $newData = $resolvedChildValues; | |
| 844 | - } | |
| 845 | - } | |
| 846 | 1202 | |
| 847 | 1203 | if (is_array($newData)) { |
| 848 | 1204 | if (self::isCompositeFieldType($fldType)) { |
| 849 | 1205 | return self::joinCompositeFieldValue($newData, $fldType); |
| @@ -861,9 +1217,9 @@ | ||
| 861 | 1217 | } else { |
| 862 | 1218 | return $itm; |
| 863 | 1219 | } |
| 864 | 1220 | }, $item)) . ']' |
| 865 | - : self::safeFlatString($item, $fldType, $fieldKey, $allFieldData, $formFields, false); | |
| 1221 | + : self::safeFlatString($item, $fldType, $fieldKey, $allFieldData, $formFields); | |
| 866 | 1222 | }, $newData)); |
| 867 | 1223 | } |
| 868 | 1224 | |
| 869 | 1225 | if (is_object($data)) { |
| @@ -923,8 +1279,29 @@ | ||
| 923 | 1279 | { |
| 924 | 1280 | return in_array($fieldType, ['name', 'address'], true); |
| 925 | 1281 | } |
| 926 | 1282 | |
| 1283 | + /** | |
| 1284 | + * Removes internal/meta subfields (keys prefixed with "_", e.g. the address | |
| 1285 | + * field's _latitude / _longitude) so they never leak into human-readable | |
| 1286 | + * output (entry views, emails, SmartTags, PDF, exports). | |
| 1287 | + * | |
| 1288 | + * @param mixed $value | |
| 1289 | + * @return mixed | |
| 1290 | + */ | |
| 1291 | + private static function stripMetaSubfields($value) | |
| 1292 | + { | |
| 1293 | + if (!is_array($value)) { | |
| 1294 | + return $value; | |
| 1295 | + } | |
| 1296 | + foreach (array_keys($value) as $key) { | |
| 1297 | + if (is_string($key) && '' !== $key && '_' === $key[0]) { | |
| 1298 | + unset($value[$key]); | |
| 1299 | + } | |
| 1300 | + } | |
| 1301 | + return $value; | |
| 1302 | + } | |
| 1303 | + | |
| 927 | 1304 | private static function joinCompositeFieldValue($value, $fieldType) |
| 928 | 1305 | { |
| 929 | 1306 | if (!is_array($value)) { |
| 930 | 1307 | return (string) $value; |
| @@ -929,8 +1306,10 @@ | ||
| 929 | 1306 | if (!is_array($value)) { |
| 930 | 1307 | return (string) $value; |
| 931 | 1308 | } |
| 932 | 1309 | |
| 1310 | + $value = self::stripMetaSubfields($value); | |
| 1311 | + | |
| 933 | 1312 | $parts = []; |
| 934 | 1313 | array_walk_recursive($value, function ($item) use (&$parts) { |
| 935 | 1314 | if (is_null($item)) { |
| 936 | 1315 | return; |
| @@ -946,48 +1325,8 @@ | ||
| 946 | 1325 | |
| 947 | 1326 | return implode('address' === $fieldType ? ', ' : ' ', $parts); |
| 948 | 1327 | } |
| 949 | 1328 | |
| 950 | - private static function extractRepeaterChildFieldValues($fieldKey, $allFieldData, $formFields) | |
| 951 | - { | |
| 952 | - if (empty($fieldKey) || !is_array($allFieldData) || !is_array($formFields) || !isset($formFields[$fieldKey])) { | |
| 953 | - return null; | |
| 954 | - } | |
| 955 | - | |
| 956 | - $fieldData = $formFields[$fieldKey]; | |
| 957 | - if (empty($fieldData['parentFieldKey']) || empty($fieldData['name'])) { | |
| 958 | - return null; | |
| 959 | - } | |
| 960 | - | |
| 961 | - $parentFieldKey = $fieldData['parentFieldKey']; | |
| 962 | - $parentFieldName = $formFields[$parentFieldKey]['name'] ?? null; | |
| 963 | - | |
| 964 | - if (!isset($allFieldData[$parentFieldKey]) || !is_array($allFieldData[$parentFieldKey])) { | |
| 965 | - return null; | |
| 966 | - } | |
| 967 | - | |
| 968 | - $childFieldName = $fieldData['name']; | |
| 969 | - $childFieldName = str_replace(['[', ']', $parentFieldName], '', $childFieldName); | |
| 970 | - | |
| 971 | - $childValues = []; | |
| 972 | - foreach ($allFieldData[$parentFieldKey] as $row) { | |
| 973 | - if (!is_array($row)) { | |
| 974 | - continue; | |
| 975 | - } | |
| 976 | - | |
| 977 | - if (array_key_exists($childFieldName, $row)) { | |
| 978 | - $childValues[] = $row[$childFieldName]; | |
| 979 | - continue; | |
| 980 | - } | |
| 981 | - | |
| 982 | - if (array_key_exists($fieldKey, $row)) { | |
| 983 | - $childValues[] = $row[$fieldKey]; | |
| 984 | - } | |
| 985 | - } | |
| 986 | - | |
| 987 | - return $childValues; | |
| 988 | - } | |
| 989 | - | |
| 990 | 1329 | /** |
| 991 | 1330 | * Return true is it's file type value by checking with extension |
| 992 | 1331 | * |
| 993 | 1332 | * @param string $filename |
| @@ -1022,10 +1361,54 @@ | ||
| 1022 | 1361 | return true; |
| 1023 | 1362 | } |
| 1024 | 1363 | } |
| 1025 | 1364 | |
| 1026 | - private static function repeaterFieldTable($repeaterFieldData, $formFields, $repeaterFieldKey) | |
| 1365 | + /** | |
| 1366 | + * Collect the column keys of a repeater table as the union of every row's keys, | |
| 1367 | + * not just the first row's. Conditional logic can hide a sub-field in one row and | |
| 1368 | + * show it in the next; keying off row 0 alone drops that column's header and | |
| 1369 | + * shifts every later row's cells. Ordering follows the repeater's own nested | |
| 1370 | + * layout when the form id is known, with any leftover keys appended. | |
| 1371 | + * | |
| 1372 | + * @param array $rows | |
| 1373 | + * @param string $repeaterFieldKey | |
| 1374 | + * @param int|string|null $formId | |
| 1375 | + * @return array | |
| 1376 | + */ | |
| 1377 | + private static function repeaterColumnKeys($rows, $repeaterFieldKey, $formId = null) | |
| 1027 | 1378 | { |
| 1379 | + $present = []; | |
| 1380 | + foreach ($rows as $row) { | |
| 1381 | + if (!is_array($row)) { | |
| 1382 | + continue; | |
| 1383 | + } | |
| 1384 | + foreach (array_keys($row) as $subKey) { | |
| 1385 | + $present[$subKey] = true; | |
| 1386 | + } | |
| 1387 | + } | |
| 1388 | + | |
| 1389 | + if (empty($present)) { | |
| 1390 | + return []; | |
| 1391 | + } | |
| 1392 | + | |
| 1393 | + $ordered = []; | |
| 1394 | + if ($formId) { | |
| 1395 | + $nestedLayout = FormManager::getInstance($formId)->getFormNestedLayout(); | |
| 1396 | + $repeaterLayout = isset($nestedLayout->{$repeaterFieldKey}->lg) ? $nestedLayout->{$repeaterFieldKey}->lg : []; | |
| 1397 | + foreach ((array) $repeaterLayout as $fld) { | |
| 1398 | + $subKey = isset($fld->i) ? $fld->i : null; | |
| 1399 | + if ($subKey && isset($present[$subKey])) { | |
| 1400 | + $ordered[] = $subKey; | |
| 1401 | + unset($present[$subKey]); | |
| 1402 | + } | |
| 1403 | + } | |
| 1404 | + } | |
| 1405 | + | |
| 1406 | + return array_merge($ordered, array_keys($present)); | |
| 1407 | + } | |
| 1408 | + | |
| 1409 | + private static function repeaterFieldTable($repeaterFieldData, $formFields, $repeaterFieldKey, $formId = null) | |
| 1410 | + { | |
| 1028 | 1411 | $repeaterFieldData = self::decodeIfJson($repeaterFieldData); |
| 1029 | 1412 | |
| 1030 | 1413 | if (!is_array($repeaterFieldData) || !isset($repeaterFieldData[0]) || !is_array($repeaterFieldData[0])) { |
| 1031 | 1414 | return ''; // Safely return empty if not a valid repeater structure |
| @@ -1036,9 +1419,9 @@ | ||
| 1036 | 1419 | // $table .= '</tr>'; |
| 1037 | 1420 | // $table .= '<td style="border: 1px solid #dddddd; text-align: left; padding: 8px;">'; |
| 1038 | 1421 | // $table .= '<table style="width: 100%; border-collapse: collapse;">'; |
| 1039 | 1422 | |
| 1040 | - $headers = array_keys($repeaterFieldData[0]); | |
| 1423 | + $headers = self::repeaterColumnKeys($repeaterFieldData, $repeaterFieldKey, $formId); | |
| 1041 | 1424 | $table .= '<tr>'; // open tr (for column header) |
| 1042 | 1425 | foreach ($headers as $fk) { |
| 1043 | 1426 | $table .= '<th style="border: 1px solid #dddddd; padding: 8px; ">' . self::getLabel($formFields, $fk) . '</th>'; |
| 1044 | 1427 | } |
| @@ -1044,10 +1427,17 @@ | ||
| 1044 | 1427 | } |
| 1045 | 1428 | $table .= '</tr>'; // close tr (for column header) |
| 1046 | 1429 | |
| 1047 | 1430 | foreach ($repeaterFieldData as $row) { |
| 1431 | + if (!is_array($row)) { | |
| 1432 | + continue; | |
| 1433 | + } | |
| 1048 | 1434 | $table .= '<tr>'; // open tr (for table data row) |
| 1049 | - foreach ($row as $k=>$value) { | |
| 1435 | + // Walk the column list, not the row's own keys, so a sub-field hidden by | |
| 1436 | + // conditional logic in this row renders an empty cell instead of shifting | |
| 1437 | + // every following cell one column to the left. | |
| 1438 | + foreach ($headers as $k) { | |
| 1439 | + $value = array_key_exists($k, $row) ? $row[$k] : ''; | |
| 1050 | 1440 | $fldTyp = self::getFldType($k, $formFields); |
| 1051 | 1441 | if (is_array($value)) { |
| 1052 | 1442 | if (in_array($fldTyp, ['advanced-file-up', 'file-up'])) { |
| 1053 | 1443 | $newValue = self::unorderedAnchorListMarkup($value); |
| @@ -1082,6 +1472,47 @@ | ||
| 1082 | 1472 | |
| 1083 | 1473 | private static function getLabel($formFields, $key) |
| 1084 | 1474 | { |
| 1085 | 1475 | return $formFields[$key]['label'] ?? $key; |
| 1476 | + } | |
| 1477 | + | |
| 1478 | + /** | |
| 1479 | + * Derive a composite child field's key name from its bracketed HTML name. | |
| 1480 | + * e.g. childFieldName "name[first_name]" with parent "name" => "first_name". | |
| 1481 | + * Falls back to the bracket contents when the parent name is empty. | |
| 1482 | + */ | |
| 1483 | + public static function deriveChildName($childFieldName, $parentFieldName) | |
| 1484 | + { | |
| 1485 | + $childFieldName = (string) $childFieldName; | |
| 1486 | + if (preg_match('/\[(.*?)\]/', $childFieldName, $matches)) { | |
| 1487 | + return $matches[1]; | |
| 1488 | + } | |
| 1489 | + | |
| 1490 | + return str_replace(['[', ']', (string) $parentFieldName], '', $childFieldName); | |
| 1491 | + } | |
| 1492 | + | |
| 1493 | + /** | |
| 1494 | + * Pull a child value out of a parent composite field's nested submitted value. | |
| 1495 | + * Looks up by the derived child name first, then by the child field key. | |
| 1496 | + * Returns null when no match is found. | |
| 1497 | + */ | |
| 1498 | + public static function extractChildValueFromParentValue($parentValue, $childName, $childKey) | |
| 1499 | + { | |
| 1500 | + if (is_object($parentValue)) { | |
| 1501 | + $parentValue = (array) $parentValue; | |
| 1502 | + } | |
| 1503 | + | |
| 1504 | + if (!is_array($parentValue)) { | |
| 1505 | + return null; | |
| 1506 | + } | |
| 1507 | + | |
| 1508 | + if (array_key_exists($childName, $parentValue)) { | |
| 1509 | + return $parentValue[$childName]; | |
| 1510 | + } | |
| 1511 | + | |
| 1512 | + if (array_key_exists($childKey, $parentValue)) { | |
| 1513 | + return $parentValue[$childKey]; | |
| 1514 | + } | |
| 1515 | + | |
| 1516 | + return null; | |
| 1086 | 1517 | } |
| 1087 | 1518 | } |
