← All changes
|
includes/abstracts/abstract-class-charitable-form.php
+46
-15
1.7.0.7
→
1.8.13
View file →
| @@ -3,12 +3,12 @@ | ||
| 3 | 3 | * A base class to be extended by specific form classes. |
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Form |
| 6 | 6 | * @author David Bisset |
| 7 | - * @copyright Copyright (c) 2022, WP Charitable LLC | |
| 7 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 8 | 8 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 9 | 9 | * @since 1.0.0 |
| 10 | - * @version 1.6.54 | |
| 10 | + * @version 1.8.12.4 | |
| 11 | 11 | */ |
| 12 | 12 | |
| 13 | 13 | // Exit if accessed directly. |
| 14 | 14 | if ( ! defined( 'ABSPATH' ) ) { |
| @@ -98,9 +98,9 @@ | ||
| 98 | 98 | charitable_get_deprecated()->doing_it_wrong( |
| 99 | 99 | __METHOD__, |
| 100 | 100 | sprintf( |
| 101 | 101 | /* translators: %s: class name */ |
| 102 | - __( 'None of the callbacks are required as of Charitable 1.5; use `Charitable_Public_Form_View` instead. Issue encountered in %s class.' ), | |
| 102 | + __( 'None of the callbacks are required as of Charitable 1.5; use `Charitable_Public_Form_View` instead. Issue encountered in %s class.', 'charitable' ), | |
| 103 | 103 | get_class( $this ) |
| 104 | 104 | ), |
| 105 | 105 | '1.5.0' |
| 106 | 106 | ); |
| @@ -202,9 +202,9 @@ | ||
| 202 | 202 | return apply_filters( |
| 203 | 203 | 'charitable_form_hidden_fields', |
| 204 | 204 | array( |
| 205 | 205 | $this->nonce_name => wp_create_nonce( $this->nonce_action ), |
| 206 | - '_wp_http_referer' => wp_unslash( $_SERVER['REQUEST_URI'] ), | |
| 206 | + '_wp_http_referer' => wp_unslash( $_SERVER['REQUEST_URI'] ), // phpcs:ignore | |
| 207 | 207 | 'charitable_action' => $this->form_action, |
| 208 | 208 | ), |
| 209 | 209 | $this |
| 210 | 210 | ); |
| @@ -234,10 +234,10 @@ | ||
| 234 | 234 | |
| 235 | 235 | if ( ! $validated ) { |
| 236 | 236 | charitable_get_notices()->add_error( __( 'Unable to submit form. Please try again.', 'charitable' ) ); |
| 237 | 237 | |
| 238 | - if ( defined( 'CHARITABLE_DEBUG' ) && CHARITABLE_DEBUG ) { | |
| 239 | - error_log( | |
| 238 | + if ( charitable_is_debug() ) { | |
| 239 | + error_log( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log | |
| 240 | 240 | sprintf( |
| 241 | 241 | /* translators: %1$s: nonce name; %2$s: nonce action; %3$s: submitted nonce */ |
| 242 | 242 | __( 'Nonce verification failed for nonce with name "%1$s" and action "%2$s". Submitted nonce is "%3$s".', 'charitable' ), |
| 243 | 243 | $this->nonce_name, |
| @@ -298,9 +298,10 @@ | ||
| 298 | 298 | |
| 299 | 299 | /** |
| 300 | 300 | * Check the passed fields to ensure that all required fields have been submitted. |
| 301 | 301 | * |
| 302 | - * @since 1.0.0 | |
| 302 | + * @since 1.0.0 | |
| 303 | + * @version 1.8.4.5 Added check for minimum password length. | |
| 303 | 304 | * |
| 304 | 305 | * @param array $fields Array of form fields. |
| 305 | 306 | * @param array $submitted Submitted values. |
| 306 | 307 | * @return boolean |
| @@ -327,11 +328,14 @@ | ||
| 327 | 328 | $exists = ! empty( $value ) || ( is_string( $value ) && strlen( $value ) ); |
| 328 | 329 | } |
| 329 | 330 | |
| 330 | 331 | /* If a value was not provided, check if it's in the $_FILES array. */ |
| 332 | + // phpcs:disable WordPress.Security.NonceVerification.Missing | |
| 331 | 333 | if ( ! $exists ) { |
| 334 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- $_FILES array, validated by isset and empty checks | |
| 332 | 335 | $exists = ( 'picture' == $field['type'] && isset( $_FILES[ $key ] ) && ! empty( $_FILES[ $key ]['name'] ) ); |
| 333 | 336 | } |
| 337 | + // phpcs:enable WordPress.Security.NonceVerification.Missing | |
| 334 | 338 | |
| 335 | 339 | $exists = apply_filters( 'charitable_required_field_exists', $exists, $key, $field, $submitted, $this ); |
| 336 | 340 | |
| 337 | 341 | if ( ! $exists ) { |
| @@ -339,10 +343,28 @@ | ||
| 339 | 343 | $label = isset( $field['label'] ) ? $field['label'] : $key; |
| 340 | 344 | |
| 341 | 345 | $missing[] = $label; |
| 342 | 346 | } |
| 343 | - }//end foreach | |
| 347 | + } // end foreach | |
| 344 | 348 | |
| 349 | + // If the user_pass field is required we need to confirm a minimum number of characters for security reasons. | |
| 350 | + if ( isset( $fields['user_pass'] ) && ! empty( $fields['user_pass']['required'] ) ) { | |
| 351 | + $min_length = apply_filters( 'charitable_minimum_password_length', 8 ); | |
| 352 | + | |
| 353 | + if ( isset( $submitted['user_pass'] ) && strlen( $submitted['user_pass'] ) < $min_length ) { | |
| 354 | + charitable_get_notices()->add_error( | |
| 355 | + sprintf( | |
| 356 | + '%s', | |
| 357 | + sprintf( | |
| 358 | + /* translators: %d is the minimum password length required. */ | |
| 359 | + __( 'Your password must be at least %d characters long.', 'charitable' ), | |
| 360 | + $min_length | |
| 361 | + ) | |
| 362 | + ) | |
| 363 | + ); | |
| 364 | + } | |
| 365 | + } | |
| 366 | + | |
| 345 | 367 | $missing = apply_filters( 'charitable_form_missing_fields', $missing, $this, $fields, $submitted ); |
| 346 | 368 | |
| 347 | 369 | if ( count( $missing ) ) { |
| 348 | 370 | |
| @@ -405,9 +427,9 @@ | ||
| 405 | 427 | * @return array |
| 406 | 428 | */ |
| 407 | 429 | public function get_submitted_values() { |
| 408 | 430 | if ( ! isset( $this->submitted ) ) { |
| 409 | - $submitted = $_POST; | |
| 431 | + $submitted = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 410 | 432 | $fields = $this->get_fields_by_data_type(); |
| 411 | 433 | $options = $this->get_valid_field_options(); |
| 412 | 434 | |
| 413 | 435 | /* Process the submitted data. This handles field sanitization. */ |
| @@ -455,11 +477,11 @@ | ||
| 455 | 477 | * @param array $overrides Override the wp_handle_upload() behavior. Optional. |
| 456 | 478 | * @return int|WP_Error ID of the attachment or a WP_Error object on failure. |
| 457 | 479 | */ |
| 458 | 480 | public function upload_post_attachment( $file_key, $post_id, $post_data = array(), $overrides = array() ) { |
| 459 | - require_once( ABSPATH . 'wp-admin/includes/image.php' ); | |
| 460 | - require_once( ABSPATH . 'wp-admin/includes/file.php' ); | |
| 461 | - require_once( ABSPATH . 'wp-admin/includes/media.php' ); | |
| 481 | + require_once ABSPATH . 'wp-admin/includes/image.php'; | |
| 482 | + require_once ABSPATH . 'wp-admin/includes/file.php'; | |
| 483 | + require_once ABSPATH . 'wp-admin/includes/media.php'; | |
| 462 | 484 | |
| 463 | 485 | $overrides = $this->get_file_overrides( $file_key, $overrides ); |
| 464 | 486 | |
| 465 | 487 | return media_handle_upload( $file_key, $post_id, $post_data, $overrides ); |
| @@ -468,8 +490,9 @@ | ||
| 468 | 490 | /** |
| 469 | 491 | * Upload a file. |
| 470 | 492 | * |
| 471 | 493 | * @since 1.0.0 |
| 494 | + * @version 1.8.9.1 | |
| 472 | 495 | * |
| 473 | 496 | * @param string $file_key Reference to a single element of `$_FILES`. Call the |
| 474 | 497 | * function once for each uploaded file. |
| 475 | 498 | * @param array $overrides Optional. An associative array of names=>values to |
| @@ -478,12 +501,19 @@ | ||
| 478 | 501 | * On failure, returns $overrides['upload_error_handler'](&$file, $message ) |
| 479 | 502 | * or array( 'error'=>$message ). |
| 480 | 503 | */ |
| 481 | 504 | public function upload_file( $file_key, $overrides = array() ) { |
| 482 | - require_once( ABSPATH . 'wp-admin/includes/file.php' ); | |
| 505 | + require_once ABSPATH . 'wp-admin/includes/file.php'; | |
| 483 | 506 | |
| 507 | + // phpcs:disable WordPress.Security.NonceVerification.Missing | |
| 508 | + if ( ! isset( $_FILES[ $file_key ] ) ) { | |
| 509 | + return new WP_Error( 'upload_error', __( 'No file was uploaded.', 'charitable' ) ); | |
| 510 | + } | |
| 511 | + | |
| 484 | 512 | $overrides = $this->get_file_overrides( $file_key, $overrides ); |
| 513 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- $_FILES array, sanitized by wp_handle_upload | |
| 485 | 514 | $file = wp_handle_upload( $_FILES[ $file_key ], $overrides ); |
| 515 | + // phpcs:enable WordPress.Security.NonceVerification.Missing | |
| 486 | 516 | |
| 487 | 517 | if ( isset( $file['error'] ) ) { |
| 488 | 518 | return new WP_Error( 'upload_error', $file['error'] ); |
| 489 | 519 | } |
| @@ -509,8 +539,9 @@ | ||
| 509 | 539 | 'png' => 'image/png', |
| 510 | 540 | 'bmp' => 'image/bmp', |
| 511 | 541 | 'tif|tiff' => 'image/tiff', |
| 512 | 542 | 'ico' => 'image/x-icon', |
| 543 | + 'webp' => 'image/webp', | |
| 513 | 544 | ); |
| 514 | 545 | |
| 515 | 546 | $defaults = array( |
| 516 | 547 | 'test_form' => false, |
| @@ -573,9 +604,9 @@ | ||
| 573 | 604 | foreach ( $this->get_merged_fields() as $key => $field ) { |
| 574 | 605 | /* The field has a specific set of options. */ |
| 575 | 606 | if ( isset( $field['options'] ) ) { |
| 576 | 607 | $options[ $key ] = array_keys( $field['options'] ); |
| 577 | - /* Checkbox fields without a value set should be either 1 or nothing. */ | |
| 608 | + /* Checkbox fields without a value set should be either 1 or nothing. */ | |
| 578 | 609 | } elseif ( isset( $field['type'] ) && 'checkbox' === $field['type'] ) { |
| 579 | 610 | $checked_value = isset( $field['value'] ) ? $field['value'] : 1; |
| 580 | 611 | $options[ $key ] = array( $checked_value ); |
| 581 | 612 | } |
| @@ -601,9 +632,9 @@ | ||
| 601 | 632 | '1.5.0', |
| 602 | 633 | 'Charitable_Public_Form_View::get_template_name()' |
| 603 | 634 | ); |
| 604 | 635 | |
| 605 | - return $form->view()->get_template_name( $field ); | |
| 636 | + return $this->view()->get_template_name( $field ); | |
| 606 | 637 | } |
| 607 | 638 | |
| 608 | 639 | /** |
| 609 | 640 | * Checks whether a template is valid. |