← All changes | includes/admin/forms/class-charitable-admin-donation-form.php +42 -15 1.7.0.7 → 1.8.13 View file →

		@@ -3,9 +3,9 @@
3	3	* Admin donation form model class.
4	4	*
5	5	* @package Charitable/Classes/Charitable_Admin_Donation_Form
6	6	* @author David Bisset
7		- * @copyright Copyright (c) 2022, WP Charitable LLC
	7	+ * @copyright Copyright (c) 2023, WP Charitable LLC
8	8	* @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
9	9	* @since 1.5.0
10	10	* @version 1.6.55
11	11	*/
		@@ -130,9 +130,9 @@
130	130
131	131	$fields['meta_fields']['fields']['time'] = array(
132	132	'type' => 'hidden',
133	133	'priority' => 2,
134		- 'value' => date( 'H:i:s', strtotime( $this->get_donation()->post_date_gmt ) ),
	134	+ 'value' => date( 'H:i:s', strtotime( $this->get_donation()->post_date_gmt ) ), // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
135	135	);
136	136	} else {
137	137	$fields['donor_id'] = array(
138	138	'type' => 'select',
		@@ -239,9 +239,9 @@
239	239	* @return array
240	240	*/
241	241	public function get_user_fields() {
242	242	$fields = $this->get_section_fields( 'user' );
243		- $loading_icon = charitable()->get_path( 'assets', false ) . '/images/charitable-loading.gif';
	243	+ $loading_icon = charitable()->get_path( 'assets', false ) . 'images/charitable-loading.gif';
244	244	$fields['overlay'] = array(
245	245	'type' => 'content',
246	246	'priority' => 1,
247	247	'content' => '<div class="charitable-overlay" style="display: none;"><img src="' . $loading_icon . '" width=60 height=60 alt="' . __( 'Loading icon', 'charitable' ) . '" /></div>',
		@@ -254,9 +254,10 @@
254	254
255	255	/**
256	256	* Return the fields for the meta section.
257	257	*
258		- * @since 1.6.28
	258	+ * @since 1.6.28
	259	+ * @since 1.8.1.8 Added the `charitable_admin_donation_form_meta_fields` filter.
259	260	*
260	261	* @return array
261	262	*/
262	263	public function get_meta_fields() {
		@@ -279,9 +280,9 @@
279	280	}
280	281
281	282	uasort( $fields, 'charitable_priority_sort' );
282	283
283		- return $fields;
	284	+ return apply_filters( 'charitable_admin_donation_form_meta_fields', $fields, $this );
284	285	}
285	286
286	287	/**
287	288	* Get the value submitted for a particular field.
		@@ -337,12 +338,16 @@
337	338	if ( ! $this->valid ) {
338	339	charitable_get_admin_notices()->fill_notices_from_frontend();
339	340	}
340	341
341		- $campaign_donations = array_key_exists( 'campaign_donations', $_POST ) ? $_POST['campaign_donations'] : array();
342		- $_POST['campaign_donations'] = array_filter( $campaign_donations, array( $this, 'filter_campaign_donation' ) );
	342	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
	343	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Array data, sanitized in filter_campaign_donation
	344	+ $campaign_donations = array_key_exists( 'campaign_donations', $_POST ) ? wp_unslash( $_POST['campaign_donations'] ) : array();
	345	+ $campaign_donations = array_filter( $campaign_donations, array( $this, 'filter_campaign_donation' ) );
	346	+ $_POST['campaign_donations'] = $campaign_donations;
343	347
344		- if ( empty( $_POST['campaign_donations'] ) ) {
	348	+ if ( empty( $campaign_donations ) ) {
	349	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
345	350	charitable_get_admin_notices()->add_error( __( 'You must provide both a campaign and amount.', 'charitable' ) );
346	351
347	352	$this->valid = false;
348	353	}
		@@ -567,8 +572,9 @@
567	572	*/
568	573	protected function sanitize_submitted_log_note( $values ) {
569	574	if ( ! $values['log_note'] ) {
570	575	$values['log_note'] = sprintf(
	576	+ /* translators: %1$s: User profile URL, %2$s: User display name */
571	577	__( 'Donation updated manually by <a href="%1$s">%2$s</a>.', 'charitable' ),
572	578	admin_url( 'user-edit.php?user_id=' . wp_get_current_user()->ID ),
573	579	wp_get_current_user()->display_name
574	580	);
		@@ -616,9 +622,10 @@
616	622
617	623	/**
618	624	* Sanitize the date.
619	625	*
620		- * @since 1.5.0
	626	+ * @since 1.5.0
	627	+ * @version 1.8.8.5
621	628	*
622	629	* @param array $values The submitted values.
623	630	* @return array
624	631	*/
		@@ -631,15 +638,28 @@
631	638	/* The date has already been sanitized in Charitable_Date_Processor::sanitize_datepicker */
632	639	$values['date_gmt'] = $date . ' ' . $time;
633	640
634	641	/* If the date matches today's date and it's a new donation, save the time too. */
635		- if ( date( 'Y-m-d 00:00:00' ) == $values['date_gmt'] && $is_new ) {
636		- $values['date_gmt'] = date( 'Y-m-d H:i:s' );
	642	+ if ( date( 'Y-m-d 00:00:00' ) == $values['date_gmt'] && $is_new ) { // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
	643	+ $values['date_gmt'] = date( 'Y-m-d H:i:s' ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
637	644	}
638	645
639		- /* If the donation date has been changed, the time is always set to 00:00:00 */
	646	+ /* If the donation date has been changed, preserve the original time from the donation log */
640	647	if ( $values['date_gmt'] !== $donation->post_date_gmt && ! $is_new ) {
641		- $values['date_gmt'] = $date . ' 00:00:00';
	648	+ // Get the original donation time from the donation log
	649	+ $donation_log = get_post_meta( $donation->ID, '_donation_log', true );
	650	+ $original_time = '00:00:00'; // Default fallback
	651	+
	652	+ if ( is_array( $donation_log ) && ! empty( $donation_log ) ) {
	653	+ // Get the first log entry which contains the original creation time
	654	+ $first_log_entry = $donation_log[0];
	655	+ if ( isset( $first_log_entry['time'] ) ) {
	656	+ // Convert the original timestamp to GMT time format
	657	+ $original_time = gmdate( 'H:i:s', $first_log_entry['time'] );
	658	+ }
	659	+ }
	660	+
	661	+ $values['date_gmt'] = $date . ' ' . $original_time;
642	662	}
643	663
644	664	return $values;
645	665	}
		@@ -646,9 +666,10 @@
646	666
647	667	/**
648	668	* Get a key=>value array of all existing donors.
649	669	*
650		- * @since 1.5.0
	670	+ * @since 1.5.0
	671	+ * @version 1.8.8
651	672	*
652	673	* @return array
653	674	*/
654	675	protected function get_all_donors() {
		@@ -674,8 +695,11 @@
674	695
675	696	$donor_list[ $donor->donor_id ] = $name;
676	697	}
677	698
	699	+ // Apply a filter here to allow for the donor list to be modified.
	700	+ $donor_list = apply_filters( 'charitable_admin_donation_form_donor_list', $donor_list );
	701	+
678	702	$list = array(
679	703	'new' => __( 'Add a New Donor', 'charitable' ),
680	704	'existing' => array(
681	705	'label' => __( 'Existing Donors', 'charitable' ),
		@@ -689,8 +713,9 @@
689	713	/**
690	714	* Set a field's initial value.
691	715	*
692	716	* @since 1.5.0
	717	+ * @version 1.8.9.1
693	718	*
694	719	* @param array $field Field definition.
695	720	* @param string $key The key of the field.
696	721	* @return array
		@@ -695,10 +720,12 @@
695	720	* @param string $key The key of the field.
696	721	* @return array
697	722	*/
698	723	protected function maybe_set_field_value( $field, $key ) {
	724	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
699	725	if ( array_key_exists( $key, $_POST ) ) {
700		- $field['value'] = $_POST[ $key ];
	726	+ $field['value'] = sanitize_text_field( wp_unslash( $_POST[ $key ] ) );
	727	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
701	728	return $field;
702	729	}
703	730
704	731	/* Checkboxes don't need a value set. */