← All changes | includes/forms/class-charitable-registration-form.php +57 -22 1.6.8 → 1.8.13 View file →

		@@ -1,17 +1,20 @@
1	1	<?php
2	2	/**
3	3	* Class that manages the display and processing of the registration form.
4	4	*
5		- * @package Charitable/Classes/Charitable_Registration_Form
6		- * @version 1.5.1
7		- * @author Eric Daams
8		- * @copyright Copyright (c) 2019, Studio 164a
9		- * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
	5	+ * @package Charitable/Classes/Charitable_Registration_Form
	6	+ * @author David Bisset
	7	+ * @copyright Copyright (c) 2023, WP Charitable LLC
	8	+ * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
	9	+ * @since 1.0.0
	10	+ * @version 1.6.51
10	11	*/
11	12
12	13	// Exit if accessed directly.
13		-if ( ! defined( 'ABSPATH' ) ) { exit; }
	14	+if ( ! defined( 'ABSPATH' ) ) {
	15	+ exit;
	16	+}
14	17
15	18	if ( ! class_exists( 'Charitable_Registration_Form' ) ) :
16	19
17	20	/**
		@@ -95,12 +98,14 @@
95	98	/**
96	99	* Profile fields to be displayed.
97	100	*
98	101	* @since 1.0.0
	102	+ * @version 1.8.9.1
99	103	*
100	104	* @return array
101	105	*/
102	106	public function get_fields() {
	107	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
103	108	$fields = array(
104	109	'user_email' => array(
105	110	'label' => __( 'Email', 'charitable' ),
106	111	'type' => 'email',
		@@ -105,9 +110,9 @@
105	110	'label' => __( 'Email', 'charitable' ),
106	111	'type' => 'email',
107	112	'required' => true,
108	113	'priority' => 4,
109		- 'value' => isset( $_POST['user_email'] ) ? $_POST['user_email'] : '',
	114	+ 'value' => isset( $_POST['user_email'] ) ? sanitize_text_field( wp_unslash( $_POST['user_email'] ) ) : '',
110	115	),
111	116	'user_login' => array(
112	117	'label' => __( 'Username', 'charitable' ),
113	118	'type' => 'text',
		@@ -112,9 +117,9 @@
112	117	'label' => __( 'Username', 'charitable' ),
113	118	'type' => 'text',
114	119	'priority' => 6,
115	120	'required' => true,
116		- 'value' => isset( $_POST['user_login'] ) ? $_POST['user_login'] : '',
	121	+ 'value' => isset( $_POST['user_login'] ) ? sanitize_text_field( wp_unslash( $_POST['user_login'] ) ) : '',
117	122	),
118	123	'user_pass' => array(
119	124	'label' => __( 'Password', 'charitable' ),
120	125	'type' => 'password',
		@@ -119,11 +124,12 @@
119	124	'label' => __( 'Password', 'charitable' ),
120	125	'type' => 'password',
121	126	'priority' => 8,
122	127	'required' => true,
123		- 'value' => isset( $_POST['user_pass'] ) ? $_POST['user_pass'] : '',
	128	+ 'value' => isset( $_POST['user_pass'] ) ? sanitize_text_field( wp_unslash( $_POST['user_pass'] ) ) : '',
124	129	),
125	130	);
	131	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
126	132
127	133	$fields = $this->maybe_add_terms_conditions_fields( $fields );
128	134
129	135	/**
		@@ -143,8 +149,9 @@
143	149	/**
144	150	* Maybe add terms and conditions fields to the form.
145	151	*
146	152	* @since 1.6.2
	153	+ * @version 1.8.9.1
147	154	*
148	155	* @param array $fields The registered form fields.
149	156	* @return array
150	157	*/
		@@ -157,14 +164,17 @@
157	164	);
158	165	}
159	166
160	167	if ( charitable_is_contact_consent_activated() ) {
	168	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
	169	+ $checked = isset( $_POST['contact_consent'] ) && ! empty( sanitize_text_field( wp_unslash( $_POST['contact_consent'] ) ) );
	170	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
161	171	$fields['contact_consent'] = array(
162	172	'type' => 'checkbox',
163	173	'label' => charitable_get_option( 'contact_consent_label', __( 'Yes, I am happy for you to contact me via email or phone.', 'charitable' ) ),
164	174	'priority' => 22,
165	175	'required' => false,
166		- 'checked' => array_key_exists( 'contact_consent', $_POST ) && $_POST['contact_consent'],
	176	+ 'checked' => $checked,
167	177	);
168	178	}
169	179
170	180	if ( charitable_is_terms_and_conditions_activated() ) {
		@@ -207,8 +217,9 @@
207	217	/**
208	218	* Update registration after form submission.
209	219	*
210	220	* @since 1.0.0
	221	+ * @version 1.8.1.15
211	222	*
212	223	* @return void
213	224	*/
214	225	public static function save_registration() {
		@@ -214,9 +225,9 @@
214	225	public static function save_registration() {
215	226	$form = new Charitable_Registration_Form();
216	227
217	228	if ( ! $form->validate_nonce() || ! $form->validate_honeypot() ) {
218		- charitable_get_notices()->add_error( __( 'There was an error with processing your form submission. Please reload the page and try again.', 'charitable' ) );
	229	+ charitable_get_notices()->add_error( __( 'Unfortunately, we were unable to verify your form submission. Please reload the page and try again.', 'charitable' ) );
219	230	return;
220	231	}
221	232
222	233	$fields = $form->get_fields();
		@@ -225,20 +236,27 @@
225	236	if ( ! $valid ) {
226	237	return;
227	238	}
228	239
229		- $submitted = apply_filters( 'charitable_registration_values', $_POST, $fields, $form );
	240	+ $submitted = apply_filters( 'charitable_registration_values', $form->get_submitted_values(), $fields, $form );
230	241
231	242	if ( ! isset( $submitted['user_email'] ) || ! is_email( $submitted['user_email'] ) ) {
232		- charitable_get_notices()->add_error( sprintf(
233		- /* translators: %s: submitted email address */
234		- __( '%s is not a valid email address.', 'charitable' ),
235		- $submitted['user_email']
236		- ) );
	243	+ charitable_get_notices()->add_error(
	244	+ sprintf(
	245	+ /* translators: %s: submitted email address */
	246	+ __( '%s is not a valid email address.', 'charitable' ),
	247	+ $submitted['user_email']
	248	+ )
	249	+ );
237	250
238	251	return false;
239	252	}
240	253
	254	+ // Remove any ID fields that may have been submitted.
	255	+ if ( array_key_exists( 'ID', $submitted ) ) {
	256	+ unset( $submitted['ID'] );
	257	+ }
	258	+
241	259	$user = new Charitable_User();
242	260	$user_id = $user->update_profile( $submitted, array_keys( $fields ) );
243	261
244	262	/**
		@@ -252,9 +270,15 @@
252	270	if ( charitable_get_option( array( 'emails_email_verification', 'send_after_registration' ), 1 ) ) {
253	271
254	272	/* If the confirmation link is generated correctly and the email is sent, set a notice. */
255	273	if ( Charitable_User_Management::get_instance()->send_verification_email( $user ) ) {
256		- charitable_get_notices()->add_success( __( 'Thank you for registering. We have sent you an email to confirm your email address.', 'charitable' ) );
	274	+ $message = sprintf(
	275	+ /* translators: %s: email verification link */
	276	+ __( 'We have sent you an email to confirm your email address. Haven\'t received the email? <a href="%s">Click here to send it again.</a>', 'charitable' ),
	277	+ esc_url_raw( charitable_get_email_verification_link( $user, false, true ) )
	278	+ );
	279	+
	280	+ charitable_get_notices()->add_success( $message );
257	281	charitable_get_session()->add_notices();
258	282	}
259	283	}
260	284
		@@ -266,8 +290,9 @@
266	290	/**
267	291	* Return the link to the login page, or false if we are not going to display it.
268	292	*
269	293	* @since 1.4.2
	294	+ * @version 1.8.9.1
270	295	*
271	296	* @return false|string
272	297	*/
273	298	public function get_login_link() {
		@@ -280,13 +305,17 @@
280	305	if ( charitable_get_permalink( 'registration_page' ) === $login_link ) {
281	306	return false;
282	307	}
283	308
	309	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
284	310	if ( isset( $_GET['redirect_to'] ) ) {
285		- $login_link = add_query_arg( 'redirect_to', $_GET['redirect_to'], $login_link );
	311	+ $redirect_to = sanitize_text_field( wp_unslash( $_GET['redirect_to'] ) );
	312	+ $login_link = add_query_arg( 'redirect_to', $redirect_to, $login_link );
286	313	}
	314	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
287	315
288		- return sprintf( '<a href="%1$s">%2$s</a>',
	316	+ return sprintf(
	317	+ '<a href="%1$s">%2$s</a>',
289	318	esc_url( $login_link ),
290	319	$this->shortcode_args['login_link_text']
291	320	);
292	321	}
		@@ -294,8 +323,9 @@
294	323	/**
295	324	* Get the redirect URL.
296	325	*
297	326	* @since 1.5.0
	327	+ * @version 1.8.9.1
298	328	*
299	329	* @return string|false
300	330	*/
301	331	protected function get_redirect_url() {
		@@ -300,13 +330,18 @@
300	330	*/
301	331	protected function get_redirect_url() {
302	332	$redirect = false;
303	333
304		- if ( isset( $_GET['redirect_to'] ) && strlen( $_GET['redirect_to'] ) ) {
305		- $redirect = $_GET['redirect_to'];
	334	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
	335	+ if ( isset( $_GET['redirect_to'] ) ) {
	336	+ $redirect_to = sanitize_text_field( wp_unslash( $_GET['redirect_to'] ) );
	337	+ if ( strlen( $redirect_to ) ) {
	338	+ $redirect = $redirect_to;
	339	+ }
306	340	} elseif ( isset( $this->shortcode_args['redirect'] ) && strlen( $this->shortcode_args['redirect'] ) ) {
307	341	$redirect = $this->shortcode_args['redirect'];
308	342	}
	343	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
309	344
310	345	return $redirect;
311	346	}
312	347	}