cartflows / admin-legacy-core / inc / meta-ops.php

meta-ops.php in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 3.0.1, at admin-legacy-core/inc/meta-ops.php

279 lines 10.3 KB

Raw Download Zip

1	<?php
2	/**
3	* CartFlows Step Meta Helper.
4	*
5	* @package CartFlows
6	*/
7
8	namespace CartflowsAdmin\AdminLegacyCore\Inc;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	/**
16	* Class StepMeta.
17	*/
18	class MetaOps {
19
20	/**
21	* Save Meta fields - Common Function.
22	*
23	* @param int $post_id post id.
24	* @param array $post_meta options to store.
25	* @param string $action action to check nonce.
26	*
27	* @return void
28	*/
29	public static function save_meta_fields( $post_id, $post_meta, $action = '' ) {
30
31	if ( ! check_ajax_referer( $action, 'security', false ) ) {
32	$response_data = array( 'message' => __( 'Nonce validation failed', 'cartflows' ) );
33	wp_send_json_error( $response_data );
34	}
35
36	if ( ! ( $post_id && is_array( $post_meta ) ) ) {
37	return;
38	}
39
40	$allowed_html = array(
41	'a' => array(
42	'href' => array(),
43	),
44	'br' => array(),
45	'strong' => array(),
46	'p' => array(),
47	'span' => array(),
48	);
49
50	foreach ( $post_meta as $key => $data ) {
51
52	if ( ! isset( $_POST[ $key ] ) ) {
53	continue;
54	}
55
56	$meta_value = false;
57
58	// Sanitize values.
59	$sanitize_filter = ( isset( $data['sanitize'] ) ) ? $data['sanitize'] : 'FILTER_DEFAULT';
60
61	switch ( $sanitize_filter ) {
62	case 'FILTER_SANITIZE_STRING':
63	$meta_value = isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : '';
64	break;
65
66	case 'FILTER_SANITIZE_URL':
67	$meta_value = filter_input( INPUT_POST, $key, FILTER_SANITIZE_URL );
68	break;
69
70	case 'FILTER_SANITIZE_NUMBER_INT':
71	$meta_value = filter_input( INPUT_POST, $key, FILTER_SANITIZE_NUMBER_INT );
72	break;
73
74	case 'FILTER_CARTFLOWS_ARRAY':
75	if ( isset( $_POST[ $key ] ) && is_array( $_POST[ $key ] ) ) {
76	$meta_value = array_map( 'sanitize_text_field', wp_unslash( $_POST[ $key ] ) );
77	}
78	break;
79
80	case 'FILTER_SANITIZE_COLOR':
81	// Sanitizes a hex color with #.
82	$meta_value = sanitize_hex_color( $_POST[ $key ] );
83	break;
84
85	case 'FILTER_SANITIZE_FONT_FAMILY':
86	// FILTER_FLAG_NO_ENCODE_QUOTES - Do not encode the single and double quotes.
87	$meta_value = isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : '';
88	break;
89
90	case 'FILTER_WP_KSES':
91	// It allow only tags that are defined in $allowed_html variable.
92	$meta_value = wp_kses( $_POST[ $key ], $allowed_html );
93	break;
94
95	case 'FILTER_SCRIPT':
96	// Custom JS/CSS sinks are output raw on the front end. Restrict authoring to
97	// users with `unfiltered_html` so per-plugin caps cannot grant script write
98	// access to lower roles (e.g. Editors via the role manager).
99	if ( ! current_user_can( 'unfiltered_html' ) ) {
100	continue 2;
101	}
102	// Reason for ignoring phpcs rule: Here we are saving the custom JS/CSS script. Encoding it before saving to db. No escaping function working here.
103	// We first decode any existing HTML entities to prevent double-encoding on multiple saves, then encode once.
104	$meta_value = htmlentities( html_entity_decode( wp_unslash( $_POST[ $key ] ), ENT_QUOTES, 'UTF-8' ), ENT_QUOTES, 'UTF-8' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
105	break;
106
107	case 'FILTER_WP_KSES_POST':
108	// wp_kses_post() allow only the same tags that are allowed in WP Posts.
109	$meta_value = wp_kses_post( $_POST[ $key ] );
110	break;
111
112	case 'FILTER_CARTFLOWS_CHECKOUT_PRODUCTS':
113	if ( isset( $_POST[ $key ] ) && is_array( $_POST[ $key ] ) ) {
114	$i = 0;
115	$q = 0;
116
117	$post_data = wc_clean( $_POST[ $key ] );
118
119	foreach ( $post_data as $p_index => $p_data ) {
120	if ( ! array_key_exists( 'product', $p_data ) ) {
121	continue;
122	}
123	foreach ( $p_data as $i_key => $i_value ) {
124
125	if ( is_array( $i_value ) ) {
126	foreach ( $i_value as $q_key => $q_value ) {
127	$meta_value[ $i ][ $i_key ][ $q ] = array_map( 'sanitize_text_field', $q_value );
128
129	$q++;
130	}
131	} else {
132	$meta_value[ $i ][ $i_key ] = sanitize_text_field( $i_value );
133	}
134	}
135
136	$i++;
137	}
138	}
139	break;
140
141	case 'FILTER_CARTFLOWS_CHECKOUT_FIELDS':
142	$count = 10;
143	$ordered_fields = array();
144	$billing_shipping_fields = array();
145
146	if ( isset( $_POST[ $key ] ) && is_array( $_POST[ $key ] ) ) {
147	// Ignoring sanitization rule as we are here to sanitize user input.
148	$post_data = $_POST[ $key ]; //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
149
150	if ( 'wcf_field_order_billing' == $key \|\| 'wcf_field_order_shipping' == $key ) {
151
152	$type_of_fields = ltrim( $key, 'wcf_field_order_' );
153	$billing_shipping_fields = \Cartflows_Helper::get_checkout_fields( $type_of_fields, $post_id );
154
155	foreach ( $post_data as $field_key_name => $value ) {
156
157	if ( isset( $billing_shipping_fields[ $field_key_name ] ) ) {
158
159	$is_custom_field = isset( $billing_shipping_fields[ $field_key_name ]['custom'] ) ? $billing_shipping_fields[ $field_key_name ]['custom'] : false;
160
161	$ordered_fields[ $field_key_name ] = $billing_shipping_fields[ $field_key_name ];
162
163	$ordered_fields[ $field_key_name ]['priority'] = $count;
164	$count += 10;
165	$placeholder_text = ! empty( $value['placeholder'] ) ? wc_clean( stripslashes( $value['placeholder'] ) ) : '';
166
167	$ordered_fields[ $field_key_name ]['width'] = intval( $value['width'] );
168	$ordered_fields[ $field_key_name ]['label'] = wp_kses_post( trim( stripslashes( $value['label'] ) ) );
169	$ordered_fields[ $field_key_name ]['placeholder'] = $placeholder_text;
170	$ordered_fields[ $field_key_name ]['default'] = wp_kses_post( trim( stripslashes( $value['default'] ) ) );
171	$ordered_fields[ $field_key_name ]['required'] = 'yes' === $value['required'] ? true : false;
172	$ordered_fields[ $field_key_name ]['optimized'] = 'yes' === $value['optimized'] ? true : false;
173	$ordered_fields[ $field_key_name ]['enabled'] = 'yes' === $value['enabled'] ? true : false;
174	$ordered_fields[ $field_key_name ]['options'] = '';
175
176	if ( isset( $value['options'] ) && $value['options'] ) {
177	$options = explode( '\|', $value['options'] );
178	$options = AdminHelper::sanitize_array_values( $options );
179	$ordered_fields[ $field_key_name ]['options'] = array_combine( array_keys( $options ), $options );
180
181	}
182
183	if ( ! empty( $value['custom_attributes'] ) ) {
184	$ordered_fields[ $field_key_name ]['custom_attributes'] = wc_clean( $value['custom_attributes'] );
185	}
186
187	if ( true === $is_custom_field ) {
188
189	$ordered_fields[ $field_key_name ]['show_in_email'] = isset( $value['show_in_email'] ) && 'yes' === $value['show_in_email'] ? true : false;
190	}
191	}
192	}
193
194	$meta_value = $ordered_fields;
195	}
196	}
197
198	break;
199
200	case 'FILTER_CARTFLOWS_OPTIN_FIELDS':
201	$count = 10;
202	$ordered_fields = array();
203	$billing_shipping_fields = array();
204
205	if ( isset( $_POST[ $key ] ) && is_array( $_POST[ $key ] ) ) {
206	// Ignoring sanitization rule as we are here to sanitize user input.
207	$post_data = $_POST[ $key ]; //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
208
209	if ( 'wcf-optin-fields-billing' === $key ) {
210
211	$type_of_fields = 'billing';
212	$billing_shipping_fields = \Cartflows_Helper::get_optin_fields( $type_of_fields, $post_id );
213
214	foreach ( $post_data as $field_key_name => $value ) {
215	if ( isset( $billing_shipping_fields[ $field_key_name ] ) ) {
216
217	$is_custom_field = isset( $billing_shipping_fields[ $field_key_name ]['custom'] ) ? $billing_shipping_fields[ $field_key_name ]['custom'] : false;
218
219	$ordered_fields[ $field_key_name ] = $billing_shipping_fields[ $field_key_name ];
220	$placeholder_text = ! empty( $value['placeholder'] ) ? wc_clean( stripslashes( $value['placeholder'] ) ) : '';
221	$ordered_fields[ $field_key_name ]['priority'] = $count;
222	$count += 10;
223
224	$ordered_fields[ $field_key_name ]['width'] = intval( $value['width'] );
225	$ordered_fields[ $field_key_name ]['label'] = wp_kses_post( trim( stripslashes( $value['label'] ) ) );
226	$ordered_fields[ $field_key_name ]['placeholder'] = $placeholder_text;
227	$ordered_fields[ $field_key_name ]['default'] = wp_kses_post( trim( stripslashes( $value['default'] ) ) );
228	$ordered_fields[ $field_key_name ]['required'] = 'yes' === $value['required'] ? true : false;
229	$ordered_fields[ $field_key_name ]['enabled'] = 'yes' === $value['enabled'] ? true : false;
230	$ordered_fields[ $field_key_name ]['options'] = '';
231
232	if ( isset( $value['options'] ) && $value['options'] ) {
233
234	$options = explode( '\|', $value['options'] );
235	$options = AdminHelper::sanitize_array_values( $options );
236	$ordered_fields[ $field_key_name ]['options'] = array_combine( array_keys( $options ), $options );
237
238	}
239
240	if ( ! empty( $value['custom_attributes'] ) ) {
241	$ordered_fields[ $field_key_name ]['custom_attributes'] = wc_clean( $value['custom_attributes'] );
242	}
243
244	if ( true === $is_custom_field ) {
245
246	$ordered_fields[ $field_key_name ]['show_in_email'] = isset( $value['show_in_email'] ) && 'yes' === $value['show_in_email'] ? true : false;
247	}
248	}
249	}
250
251	$meta_value = $ordered_fields;
252	}
253	}
254	break;
255
256	default:
257	if ( 'FILTER_DEFAULT' === $sanitize_filter ) {
258	$meta_value = isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : '';
259	} else {
260	$meta_value = apply_filters( 'cartflows_admin_save_meta_field_values', $meta_value, $post_id, $key, $sanitize_filter, $action );
261	}
262
263	break;
264	}
265
266	if ( is_null( $meta_value ) ) {
267	continue;
268	}
269
270	if ( false !== $meta_value ) {
271	update_post_meta( $post_id, $key, $meta_value );
272	} else {
273	// To delete the wcf-checkout-products if empty.
274	delete_post_meta( $post_id, $key );
275	}
276	}
277	}
278	}
279