PluginProbe
Contact Forms by Cimatti / 1.9.2
Contact Forms by Cimatti v1.9.2
2.3.6 2.3.5 2.3.0 2.2.32 2.2.4 2.2.0 2.1.2 2.1.1 trunk 1.0 1.1 1.2 1.2.1 1.3 1.3.1 1.3.2 1.3.3 1.3.4 1.3.5 1.3.6 1.3.7 1.3.8 1.3.9 1.4.0 1.4.1 All 62 releases
← All changes | accua-forms.php +1117 -3595 2.1.21.9.2 View file →
@@ -1,13 +1,11 @@
1 1 <?php
2 -if ( ! defined( 'ABSPATH' ) ) exit;
3 -
4 2 add_action('admin_menu', 'accua_forms_menu', -95);
5 3 function accua_forms_menu(){
6 - $dashboard_admin_page=add_menu_page('Contact Forms by Cimatti', 'Contact Forms', 'manage_options', 'accua_forms', 'accua_forms_dashboard_page', 'data:image/svg+xml;base64,' . base64_encode('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 44.46 44.46"><path fill="#15caff" d="m23.97,28.72c1.85,0,2.93-.11,2.93-.11,1.49-.15,2.75.95,2.8,2.44l.01.14c.05,1.5-1.11,2.96-2.58,3.25,0,0-2.53.5-5.25.5-7.24,0-10.11-3.84-10.11-12.98,0-8.6,3.01-12.44,10.26-12.44,2.82,0,5.11.47,5.11.47,1.47.3,2.63,1.78,2.57,3.27l-.01.15c-.05,1.5-1.31,2.6-2.8,2.45,0,0-1.13-.12-2.98-.12-4.67,0-5.54,1.6-5.54,6.22,0,5.2.92,6.76,5.59,6.76M33.36,1.93c-1.06-1.06-3.15-1.93-4.65-1.93H15.75c-1.5,0-3.59.87-4.65,1.93L1.93,11.1C.87,12.16,0,14.25,0,15.75v12.97c0,1.5.87,3.59,1.93,4.65l9.17,9.17c1.06,1.06,3.15,1.93,4.65,1.93h12.97c1.5,0,3.59-.87,4.65-1.93l9.17-9.17c1.06-1.06,1.93-3.15,1.93-4.65V15.75c0-1.5-.87-3.59-1.93-4.65z"/></svg>'), '90.90300');
4 + $dashboard_admin_page=add_menu_page('Wordpress Contact Forms by Cimatti', 'Contact Forms', 'manage_options', 'accua_forms', 'accua_forms_dashboard_page', ACCUA_FORMS_DIR_URL.'img/cimatti-icon-10.png', '90.90300');
7 5 add_action('load-'.$dashboard_admin_page, 'accua_forms_dashboard_page_head');
8 6
9 - add_submenu_page('accua_forms', 'Contact Forms by Cimatti', 'Dashboard', 'manage_options', "accua_forms", 'accua_forms_dashboard_page');
7 + add_submenu_page('accua_forms', 'Wordpress Contact Forms by Cimatti', 'Dashboard', 'manage_options', "accua_forms", 'accua_forms_dashboard_page');
10 8
11 9 $form_edit_page = add_submenu_page('accua_forms', 'Forms', 'Forms', 'manage_options', "accua_forms_list", 'accua_forms_list_page');
12 10 add_action('admin_head-'.$form_edit_page, 'accua_forms_edit_page_head');
13 11 add_action( 'admin_print_styles-'.$form_edit_page, 'accua_forms_edit_page_head_styles');
@@ -18,9 +16,8 @@
18 16 add_action( 'admin_print_styles-'.$form_add_page, 'accua_forms_edit_page_head_styles');
19 17 add_action( 'admin_print_scripts-'.$form_add_page, 'accua_forms_edit_page_head_scripts');
20 18
21 19 $form_submissions_page = add_submenu_page('accua_forms', __('Forms submissions', 'contact-forms') , __('Submissions', 'contact-forms'), 'manage_options', "accua_forms_submissions_list", '__accua_forms_submissions_list_page');
22 - add_action('load-'.$form_submissions_page, 'accua_forms_submissions_list_page_load');
23 20 add_action('admin_head-'.$form_submissions_page, 'accua_forms_submissions_list_page_head');
24 21 add_action( 'admin_print_styles-'.$form_submissions_page, 'accua_forms_edit_page_head_styles');
25 22
26 23 $form_fields_page = add_submenu_page('accua_forms', __( 'Form fields', 'contact-forms'), __('Fields', 'contact-forms'), 'manage_options', "accua_forms_fields", 'accua_forms_fields_page');
@@ -33,8 +30,9 @@
33 30
34 31 wp_enqueue_script('jquery-form');
35 32 wp_enqueue_script('jquery-color');
36 33 wp_enqueue_script('jquery-ui-core');
34 + wp_enqueue_script('jquery-ui-tabs');
37 35 wp_enqueue_script('jquery-ui-sortable');
38 36 wp_enqueue_script('jquery-ui-draggable');
39 37 wp_enqueue_script('jquery-ui-droppable');
40 38 wp_enqueue_script('jquery-ui-selectable');
@@ -73,9 +71,8 @@
73 71 FROM `{$wpdb->prefix}cformssubmissions`
74 72 GROUP BY `year`, `month`
75 73 ORDER BY `year` DESC, `month` DESC";
76 74
77 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- No user input in query
78 75 $results = $wpdb->get_results($query);
79 76
80 77 if ($results) {
81 78 ?>
@@ -102,24 +99,13 @@
102 99 array( 'label' => __( 'Unique submissions', 'contact-forms'), 'data' => array()),
103 100 array( 'label' => __( 'Total submissions', 'contact-forms'), 'data' => array()),
104 101 );
105 102 foreach ($results as $result){
106 - $month = esc_html( $months[$result->month] );
107 - $year = esc_html( $result->year );
108 - $unique_submissions = esc_html( $result->unique_submissions );
109 - $submissions = esc_html( $result->submissions );
110 - $alternate_class = ( $alternate = ! $alternate ) ? 'alternate' : '';
111 - $month_style = in_array( 'month', $hidden, true ) ? " style='display:none;'" : '';
112 - $unique_style = in_array( 'unique_submissions', $hidden, true ) ? " style='display:none;'" : '';
113 - $sub_style = in_array( 'submissions', $hidden, true ) ? " style='display:none;'" : '';
114 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- All variables pre-escaped above
115 - echo "<tr class='iedit " . esc_attr( $alternate_class ) . "'>\n";
116 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $month, $year pre-escaped with esc_html()
117 - echo "<td class='column-month'" . $month_style . ">" . $month . " " . $year . "</td>\n";
118 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $unique_submissions pre-escaped with esc_html()
119 - echo "<td class='column-unique_submissions'" . $unique_style . ">" . $unique_submissions . "</td>\n";
120 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $submissions pre-escaped with esc_html()
121 - echo "<td class='column-submissions'" . $sub_style . ">" . $submissions . "</td>\n";
103 + $month = $months[$result->month];
104 + echo "<tr class='iedit ".(($alternate = !$alternate)?'alternate':'')."'>\n";
105 + echo "<td class='column-month'".(in_array('month', $hidden)?" style='display:none;'":'').">$month {$result->year}</td>\n";
106 + echo "<td class='column-unique_submissions'".(in_array('unique_submissions', $hidden)?" style='display:none;'":'').">{$result->unique_submissions}</td>\n";
107 + echo "<td class='column-submissions'".(in_array('submissions', $hidden)?" style='display:none;'":'').">{$result->submissions}</td>\n";
122 108 echo "</tr>\n";
123 109 $time = mktime(0, 0, 0, $result->month, 1, $result->year) * 1000;
124 110 $data[0]['data'][] = array($time, (int)$result->unique_submissions);
125 111 $data[1]['data'][] = array($time, (int)$result->submissions);
@@ -140,9 +126,8 @@
140 126 </tbody>
141 127 </table>
142 128 <script type="text/javascript">
143 129 jQuery(function($){
144 - <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON encoded data for JavaScript ?>
145 130 var data = <?php print _accua_forms_json_encode($data); ?> ;
146 131 var options = {
147 132 xaxis: {
148 133 //autoscaleMargin: 0.005,
@@ -167,9 +152,9 @@
167 152
168 153 function accua_forms_edit_page_head_styles() {
169 154 //wp_admin_css( 'widgets' );
170 155 wp_enqueue_style( 'wp-pointer' ); //for tooltips
171 - wp_enqueue_style( 'accua-forms-admin', plugins_url('assets/css/admin.css', ACCUA_FORMS_FILE), array(), ACCUA_FORMS_CSS_VERSION); //
156 + wp_enqueue_style( 'accua-forms-admin', plugins_url('accua-forms-admin.css', ACCUA_FORMS_FILE), array(), ACCUA_FORMS_CSS_VERSION); //
172 157 }
173 158
174 159 function accua_forms_edit_page_head_scripts() {
175 160 //wp_enqueue_script('admin-widgets');
@@ -175,129 +160,20 @@
175 160 //wp_enqueue_script('admin-widgets');
176 161 /*wp_enqueue_script('jquery-ui-sortable');
177 162 wp_enqueue_script('jquery-ui-draggable');
178 163 wp_enqueue_script('jquery-ui-droppable');*/
179 - wp_enqueue_script( 'wp-pointer', '', array(), ACCUA_FORMS_JS_VERSION, true ); // for tooltips
180 - wp_enqueue_style('wp-color-picker');
181 - wp_enqueue_script('wp-color-picker', '', array(), ACCUA_FORMS_JS_VERSION, true );
164 + wp_enqueue_script( 'wp-pointer' ); //for tooltips
165 + wp_enqueue_script('accua-jqColorPicker', plugins_url('/js/jqColorPicker.min.js', ACCUA_FORMS_FILE ), array( 'jquery' ), ACCUA_FORMS_JS_VERSION);
182 166
183 - wp_enqueue_script( 'accua-form-fields', plugins_url( 'assets/js/admin/form-fields.js' , ACCUA_FORMS_FILE ), array( 'jquery-ui-sortable', 'jquery-ui-draggable', 'jquery-ui-droppable' ), ACCUA_FORMS_JS_VERSION, true );
184 - wp_enqueue_script( 'accua-form-settings', plugins_url('assets/js/admin/form-settings.js', ACCUA_FORMS_FILE), array('jquery', 'wp-color-picker'), ACCUA_FORMS_JS_VERSION, true );
167 + wp_enqueue_script( 'accua-form-fields', plugins_url( 'form-fields.js' , ACCUA_FORMS_FILE ), array( 'jquery-ui-sortable', 'jquery-ui-draggable', 'jquery-ui-droppable' ), ACCUA_FORMS_JS_VERSION);
168 + wp_enqueue_script( 'accua-form-settings', plugins_url('form-settings.js', ACCUA_FORMS_FILE), array('jquery'), ACCUA_FORMS_JS_VERSION);
185 169 }
186 170
187 171 function accua_forms_settings_page_head_scripts() {
188 - wp_enqueue_style('wp-color-picker');
189 - wp_enqueue_script('wp-color-picker');
190 -
191 - // Enqueue settings page JavaScript
192 - wp_enqueue_script('accua_tabs_component', plugins_url('assets/js/admin/accua-tabs.js', ACCUA_FORMS_FILE), array('jquery'), ACCUA_FORMS_JS_VERSION, true);
193 - wp_enqueue_script('accua-forms-settings-page', plugins_url('assets/js/admin/settings-page.js', ACCUA_FORMS_FILE), array('jquery', 'accua_tabs_component'), ACCUA_FORMS_JS_VERSION, true);
194 -
195 - // Theme Helper tab scripts
196 - wp_enqueue_script(
197 - 'accua-forms-theme-helper',
198 - plugins_url('assets/js/admin/theme-helper.js', ACCUA_FORMS_FILE),
199 - array('jquery'),
200 - ACCUA_FORMS_JS_VERSION,
201 - true
202 - );
203 - wp_localize_script('accua-forms-theme-helper', 'accuaThemeHelper', array(
204 - 'ajaxUrl' => admin_url('admin-ajax.php'),
205 - 'nonce' => wp_create_nonce('accua_theme_helper'),
206 - 'pluginCssUrl' => plugins_url('assets/css/frontend.css', ACCUA_FORMS_FILE),
207 - 'i18n' => array(
208 - 'scanning' => __('Scanning...', 'contact-forms'),
209 - 'noConflicts' => __('No CSS conflicts detected!', 'contact-forms'),
210 - 'conflictsFound' => __('CSS conflicts found:', 'contact-forms'),
211 - 'scanComplete' => __('Scan complete', 'contact-forms'),
212 - 'scanError' => __('Error scanning URL', 'contact-forms'),
213 - 'enterUrl' => __('Enter a URL to scan', 'contact-forms'),
214 - 'fetchingCss' => __('Fetching CSS from URL...', 'contact-forms'),
215 - ),
216 - 'monitoredClasses' => accua_forms_get_monitored_css_classes(),
217 - 'criticalProperties' => array(
218 - 'padding', 'padding-top', 'padding-right', 'padding-bottom', 'padding-left',
219 - 'margin', 'margin-top', 'margin-right', 'margin-bottom', 'margin-left',
220 - 'display', 'position', 'visibility', 'overflow',
221 - 'width', 'height', 'min-width', 'min-height', 'max-width', 'max-height',
222 - 'flex', 'flex-direction', 'flex-wrap', 'align-items', 'justify-content',
223 - 'border', 'border-width', 'border-style',
224 - 'float', 'clear', 'z-index', 'opacity',
225 - ),
226 - ));
227 -
228 - // Localize script with AJAX URL, nonce, and translations
229 - wp_localize_script('accua-forms-settings-page', 'accuaFormsSettings', array(
230 - 'ajaxUrl' => admin_url('admin-ajax.php'),
231 - 'nonce' => wp_create_nonce('accua_forms_restore_default'),
232 - 'dangerNonce' => wp_create_nonce('accua_forms_danger_zone'),
233 - 'siteDomain' => wp_parse_url( home_url(), PHP_URL_HOST ),
234 - 'i18n' => array(
235 - 'confirmRestore' => __('Are you sure you want to restore the default value for this message? This will overwrite your current content.', 'contact-forms'),
236 - 'restoring' => __('Restoring...', 'contact-forms'),
237 - 'restored' => __('Restored!', 'contact-forms'),
238 - 'error' => __('Error restoring default', 'contact-forms'),
239 - 'restoreDefault' => __('Restore default', 'contact-forms'),
240 - 'anonymizing' => __('Anonymizing...', 'contact-forms'),
241 - 'loading' => __('Loading...', 'contact-forms'),
242 - 'deleting' => __('Deleting...', 'contact-forms'),
243 - 'noSubmissionsFound' => __('No submissions found matching the specified period.', 'contact-forms'),
244 - /* translators: %d: total number of submissions that will be anonymized */
245 - 'previewHeading' => __('The following %d submissions will be anonymized:', 'contact-forms'),
246 - 'formColumn' => __('Form', 'contact-forms'),
247 - 'submissionsColumn' => __('Submissions', 'contact-forms'),
248 - 'totalLabel' => __('Total', 'contact-forms'),
249 - 'confirmAnonymize' => __('Confirm anonymization', 'contact-forms'),
250 - 'cancel' => __('Cancel', 'contact-forms'),
251 - 'confirmDeletePrompt' => sprintf(
252 - /* translators: %s: site domain */
253 - __( 'This will permanently delete ALL Contact Forms data (settings, forms, submissions, uploaded files). This cannot be undone. Type "%s" to confirm:', 'contact-forms' ),
254 - wp_parse_url( home_url(), PHP_URL_HOST )
255 - ),
256 - ),
257 - ));
172 + wp_enqueue_script('accua-jqColorPicker', plugins_url('/js/jqColorPicker.min.js', ACCUA_FORMS_FILE ), array( 'jquery' ), ACCUA_FORMS_JS_VERSION);
258 173 }
259 174
260 -/**
261 - * Enqueue deactivation modal script on the Plugins page.
262 - */
263 -add_action( 'admin_enqueue_scripts', 'accua_forms_enqueue_deactivation_modal' );
264 -function accua_forms_enqueue_deactivation_modal( $hook ) {
265 - if ( $hook !== 'plugins.php' ) {
266 - return;
267 - }
268 -
269 - wp_enqueue_script(
270 - 'accua-forms-deactivation-modal',
271 - plugins_url( 'assets/js/admin/deactivation-modal.js', ACCUA_FORMS_FILE ),
272 - array( 'jquery' ),
273 - ACCUA_FORMS_JS_VERSION,
274 - true
275 - );
276 -
277 - wp_localize_script( 'accua-forms-deactivation-modal', 'accuaFormsDeactivation', array(
278 - 'ajaxUrl' => admin_url( 'admin-ajax.php' ),
279 - 'nonce' => wp_create_nonce( 'accua_forms_deactivation_cleanup' ),
280 - 'pluginBasename' => plugin_basename( ACCUA_FORMS_FILE ),
281 - 'i18n' => array(
282 - 'title' => __( 'What would you like to do with your Contact Forms data?', 'contact-forms' ),
283 - 'description' => __( 'You are about to deactivate Contact Forms. Choose what to do with your existing data:', 'contact-forms' ),
284 - 'deleteAll' => __( 'Delete all data', 'contact-forms' ),
285 - 'deleteAllDesc' => __( 'Permanently remove all forms, submissions, settings, and uploaded files. This cannot be undone.', 'contact-forms' ),
286 - 'anonymizeAll' => __( 'Anonymize all submissions', 'contact-forms' ),
287 - 'anonymizeAllDesc'=> __( 'Replace personal data with placeholders and set IPs to 0.0.0.0. Forms and settings will be kept. This cannot be undone.', 'contact-forms' ),
288 - 'skip' => __( 'Just deactivate', 'contact-forms' ),
289 - 'skipDesc' => __( 'Keep all data. You can reactivate the plugin later.', 'contact-forms' ),
290 - 'confirmDelete' => __( 'Are you sure? This will permanently delete ALL forms, submissions, settings, and uploaded files. This cannot be undone.', 'contact-forms' ),
291 - 'confirmAnonymize'=> __( 'Are you sure? This will anonymize ALL submissions, replacing personal data with placeholders. This cannot be undone.', 'contact-forms' ),
292 - 'processing' => __( 'Processing…', 'contact-forms' ),
293 - 'cancel' => __( 'Cancel', 'contact-forms' ),
294 - ),
295 - ) );
296 -}
297 -
298 175 function accua_forms_edit_page_head() {
299 -// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- Detection only, actual action processing in _accua_forms_form_edit_action() has nonce check
300 176 if (isset($_POST['accua-form-edit-action']) || (!isset($_GET['fid']))) {
301 177 _accua_forms_form_edit_action();
302 178 require_once('accua-forms-list-page.php');
303 179 accua_forms_list_page_table(true);
@@ -332,24 +208,22 @@
332 208 if (empty($post['sidebars'])) {
333 209 die('-1');
334 210 }
335 211
336 - // Save to draft instead of directly to database
337 - foreach ($post['sidebars'] as $sidebar_id => $order) {
338 - if (strpos($sidebar_id, 'cimatti-accua-fields-form-area-') !== 0){
212 + $forms_data = get_option('accua_forms_saved_forms', array());
213 +
214 + foreach ($post['sidebars'] as $fid => $order) {
215 + if (strpos($fid, 'cimatti-accua-fields-form-area-') !== 0){
339 216 die('-1');
340 217 }
341 - $fid = substr($sidebar_id, 31);
218 + $fid = substr($fid, 31);
342 219
343 - // Get draft data for this form
344 - $draft_data = _accua_forms_get_draft_data($fid);
345 -
346 - if (empty($draft_data['fields'])) {
220 + if (empty($forms_data[$fid]['fields'])) {
347 221 die('-1');
348 222 }
349 223
350 - $old_fields = $draft_data['fields'];
351 - unset($draft_data['fields']);
224 + $old_fields = $forms_data[$fid]['fields'];
225 + unset($forms_data[$fid]['fields']);
352 226 $new_fields = array();
353 227
354 228 $order = explode(',', $order);
355 229
@@ -363,19 +237,18 @@
363 237
364 238 if($old_fields){
365 239 $new_fields += $old_fields;
366 240 }
367 - $draft_data['fields'] = $new_fields;
241 + $forms_data[$fid]['fields'] = $new_fields;
242 + }
368 243
369 - // Save to draft (not to live database)
370 - _accua_forms_save_draft($fid, $draft_data);
371 - }
244 + update_option('accua_forms_saved_forms', $forms_data);
372 245
373 246 die('1');
374 247 }
375 248
376 249 add_action( 'wp_ajax_accua-save-form-field', 'accua_forms_save_form_field');
377 -/* azione dove vengono salvati i campi dei un form - saves to draft */
250 +/* azione dove vengono salvati i campi dei un form */
378 251 function accua_forms_save_form_field() {
379 252 if (!current_user_can('manage_options')){
380 253 wp_die( -1, 403 );
381 254 }
@@ -384,17 +257,15 @@
384 257 $post = stripslashes_deep($_POST);
385 258
386 259 //update_option('accua_forms_save_form_field_post', $post);
387 260
261 + $forms_data = get_option('accua_forms_saved_forms', array());
388 262 $fid = $post['form-id'];
389 263 if (accua_forms_validate_form_id($fid) !== '') {
390 264 die('-1');
391 265 }
392 -
393 - // Get draft data instead of live data
394 - $draft_data = _accua_forms_get_draft_data($fid);
395 - if (empty($draft_data['fields'])) {
396 - $draft_data['fields'] = array();
266 + if (empty($forms_data[$fid]['fields'])) {
267 + $forms_data[$fid]['fields'] = array();
397 268 }
398 269
399 270 $avail_fields = get_option('accua_forms_avail_fields', array());
400 271 @ $wid = (string) $post['widget-id'];
@@ -415,15 +286,15 @@
415 286 }
416 287 $required = !empty($post["form-field-{$wid}-required"]);
417 288 $widget_number = empty($post['multi_number']) ? (empty($post['widget_number']) ? '' : (int)$post['widget_number']) : (int)$post['multi_number'];
418 289
419 - if (isset($draft_data['fields'][$wid])) {
420 - $old_istance_data = $draft_data['fields'][$wid];
290 + if (isset($forms_data[$fid]['fields'][$wid])) {
291 + $old_istance_data = $forms_data[$fid]['fields'][$wid];
421 292 } else {
422 293 $old_istance_data = array();
423 294 }
424 295
425 - $draft_data['fields'][$wid] = array (
296 + $forms_data[$fid]['fields'][$wid] = array (
426 297 'version' => 2,
427 298 'istance_id' => $wid,
428 299 'widget_number' => $widget_number,
429 300 'ref' => $ref,
@@ -434,9 +305,9 @@
434 305 @ $label = (string) $post["form-field-{$wid}-label"];
435 306 if (!current_user_can('unfiltered_html')) {
436 307 $label = wp_kses($label, 'post');
437 308 }
438 - $draft_data['fields'][$wid]['label'] = $label;
309 + $forms_data[$fid]['fields'][$wid]['label'] = $label;
439 310 }
440 311
441 312 $is_file = false;
442 313 $is_date = false;
@@ -442,9 +313,9 @@
442 313 $is_date = false;
443 314 if (isset($avail_fields[$wid]['type'])) {
444 315 if ($avail_fields[$wid]['type'] == 'file') {
445 316 $is_file = true;
446 - } elseif ($avail_fields[$wid]['type'] == 'date') {
317 + } else if ($avail_fields[$wid]['type'] == 'date') {
447 318 $is_date = true;
448 319 }
449 320 }
450 321
@@ -451,101 +322,36 @@
451 322 if (!empty($post["form-field-{$wid}-override-default-value"])) {
452 323 @ $default_value = (string) $post["form-field-{$wid}-default-value"];
453 324 if ($is_date) {
454 325 $default_value = accua_forms_filter_date($default_value);
455 - } elseif (!current_user_can('unfiltered_html')) {
326 + } else if (!current_user_can('unfiltered_html')) {
456 327 //This is filtered in any case because field type can change
457 328 $default_value = wp_kses($default_value, 'post');
458 329 }
459 - $draft_data['fields'][$wid]['default_value'] = $default_value;
330 + $forms_data[$fid]['fields'][$wid]['default_value'] = $default_value;
460 331 }
461 332
462 333 if (!empty($post["form-field-{$wid}-override-allowed-values"])) {
463 334 @ $allowed_values = (string) $post["form-field-{$wid}-allowed-values"];
464 335 if ($is_file){
465 - $draft_data['fields'][$wid]['allowed_extensions'] = accua_forms_filter_extensions($allowed_values);
336 + $forms_data[$fid]['fields'][$wid]['allowed_extensions'] = accua_forms_filter_extensions($allowed_values);
466 337 } else {
467 - $draft_data['fields'][$wid]['allowed_values'] = $allowed_values;
338 + $forms_data[$fid]['fields'][$wid]['allowed_values'] = $allowed_values;
468 339 }
469 340 }
470 341 if (!empty($post["form-field-{$wid}-override-datemin-values"])) {
471 342 @ $mindate_values = (string) $post["form-field-{$wid}-min-of-date"];
472 - $draft_data['fields'][$wid]['min_date'] = accua_forms_filter_date($mindate_values);
343 + $forms_data[$fid]['fields'][$wid]['min_date'] = accua_forms_filter_date($mindate_values);
473 344 }
474 345 if (!empty($post["form-field-{$wid}-override-datemax-values"])) {
475 346 @ $maxdate_values = (string) $post["form-field-{$wid}-max-of-date"];
476 - $draft_data['fields'][$wid]['max_date'] = accua_forms_filter_date($maxdate_values);
347 + $forms_data[$fid]['fields'][$wid]['max_date'] = accua_forms_filter_date($maxdate_values);
477 348 }
478 -
479 - // Save post_type for post-select and post-multicheckbox fields
480 - if (isset($post["form-field-{$wid}-post-type"])) {
481 - @ $post_type_value = (string) $post["form-field-{$wid}-post-type"];
482 - // Validate post type
483 - $valid_post_types = get_post_types(array('public' => true));
484 - if (isset($valid_post_types[$post_type_value])) {
485 - $draft_data['fields'][$wid]['post_type'] = $post_type_value;
486 - }
487 - }
488 -
489 - // Save country_code for telephone fields (for libphonenumber validation)
490 - if (isset($post["form-field-{$wid}-country-code"])) {
491 - $country_code = strtoupper(sanitize_text_field($post["form-field-{$wid}-country-code"]));
492 - // Validate against the list of countries
493 - $valid_countries = accua_forms_get_countries();
494 - if (isset($valid_countries[$country_code])) {
495 - $draft_data['fields'][$wid]['country_code'] = $country_code;
496 - }
497 - }
498 -
499 - /**
500 - * Filter field instance data before saving to draft.
501 - *
502 - * @param array $field_instance The field instance data being saved.
503 - * @param string $widget_id The field widget ID.
504 - * @param array $post_data The raw POST data (already stripslashed).
505 - * @param array $field_def The field definition from avail_fields.
506 - */
507 - $draft_data['fields'][$wid] = apply_filters(
508 - 'accua_forms_save_field_data',
509 - $draft_data['fields'][$wid],
510 - $wid,
511 - $post,
512 - isset($avail_fields[$wid]) ? $avail_fields[$wid] : array()
513 - );
514 -
515 - // Save custom CSS class for the field wrapper
516 - if (isset($post["form-field-{$wid}-css-class"])) {
517 - $css_class_raw = sanitize_text_field($post["form-field-{$wid}-css-class"]);
518 - if ($css_class_raw !== '') {
519 - // Sanitize each class individually
520 - $classes = array_filter(array_map('sanitize_html_class', explode(' ', $css_class_raw)));
521 - $draft_data['fields'][$wid]['css_class'] = implode(' ', $classes);
522 - } else {
523 - $draft_data['fields'][$wid]['css_class'] = '';
524 - }
525 - }
526 -
527 - // Save custom CSS ID for the field wrapper
528 - if (isset($post["form-field-{$wid}-css-id"])) {
529 - $css_id_raw = sanitize_text_field($post["form-field-{$wid}-css-id"]);
530 - $draft_data['fields'][$wid]['css_id'] = sanitize_html_class($css_id_raw);
531 - }
532 -
533 - // Save custom required message override
534 - if (!empty($post["form-field-{$wid}-override-required-msg"])) {
535 - $draft_data['fields'][$wid]['custom_required_message'] = sanitize_text_field($post["form-field-{$wid}-custom-required-msg"]);
536 - }
537 -
538 - // Save custom format message override (email/phone)
539 - if (!empty($post["form-field-{$wid}-override-format-msg"])) {
540 - $draft_data['fields'][$wid]['custom_format_message'] = sanitize_text_field($post["form-field-{$wid}-custom-format-msg"]);
541 - }
542 349 } else {
543 - unset($draft_data['fields'][$wid]);
350 + unset($forms_data[$fid]['fields'][$wid]);
544 351 }
545 352
546 - // Save to draft (not to live database)
547 - _accua_forms_save_draft($fid, $draft_data);
353 + update_option('accua_forms_saved_forms', $forms_data);
548 354
549 355 die('1');
550 356 }
551 357
@@ -586,9 +392,9 @@
586 392 $cleaned_extensions = array();
587 393 $mimes = get_allowed_mime_types();
588 394 $extensions = explode("\n", $extensions);
589 395 foreach ($extensions as $extension) {
590 - $extension = strtolower( trim( ltrim( trim( $extension ), '.' ) ) );
396 + $extension = trim($extension);
591 397 if ($extension !== '') {
592 398 foreach ( $mimes as $ext_preg => $mime_match ) {
593 399 $ext_preg = '!^' . $ext_preg . '$!i';
594 400 if ( preg_match( $ext_preg, $extension ) ) {
@@ -612,14 +418,9 @@
612 418 //boolean
613 419 $form_settings[$k] = (bool) $v;
614 420 break;
615 421 case 'layout':
616 - // Only set if valid layout value, otherwise remove to use default
617 - if ($v === 'toplabel' || $v === 'inlinelabel' || $v === 'sidebyside') {
618 - $form_settings[$k] = $v;
619 - } else {
620 - unset($form_settings[$k]); // Reset to default
621 - }
422 + $form_settings[$k] = ($v === 'toplabel') ? 'toplabel' : 'sidebyside';
622 423 break;
623 424 case 'emails_from':
624 425 // single email
625 426 $form_settings[$k] = accua_forms_filter_email($v);
@@ -650,66 +451,8 @@
650 451 }
651 452 return $form_settings;
652 453 }
653 454
654 -/**
655 - * AJAX handler to restore default message values.
656 - *
657 - * Restores the default content for a specific message section:
658 - * - success_message: On-screen success message
659 - * - error_message: On-screen error message
660 - * - admin_emails: Admin notification email (subject + message only)
661 - * - confirmation_emails: Confirmation email (subject + message only)
662 - *
663 - * @since 2.0.0-beta.6
664 - */
665 -add_action('wp_ajax_accua_forms_restore_default_message', 'accua_forms_restore_default_message');
666 -function accua_forms_restore_default_message() {
667 - if (!current_user_can('manage_options')) {
668 - wp_send_json_error(array('message' => __('Permission denied.', 'contact-forms')), 403);
669 - }
670 -
671 - check_ajax_referer('accua_forms_restore_default', 'nonce');
672 -
673 - $message_type = isset($_POST['message_type']) ? sanitize_key($_POST['message_type']) : '';
674 -
675 - // Get default values
676 - $defaults = accua_forms_get_default_form_data();
677 -
678 - // Define which fields to restore for each message type
679 - $restore_map = array(
680 - 'success_message' => array('success_message'),
681 - 'error_message' => array('error_message'),
682 - 'admin_emails' => array('admin_emails_subject', 'admin_emails_message'),
683 - 'confirmation_emails' => array('confirmation_emails_subject', 'confirmation_emails_message'),
684 - );
685 -
686 - if (!isset($restore_map[$message_type])) {
687 - wp_send_json_error(array('message' => __('Invalid message type.', 'contact-forms')), 400);
688 - }
689 -
690 - // Get current form data
691 - $form_data = get_option('accua_forms_default_form_data', array());
692 - if (!is_array($form_data)) {
693 - $form_data = array();
694 - }
695 -
696 - // Restore the specified fields
697 - $restored_values = array();
698 - foreach ($restore_map[$message_type] as $field) {
699 - $form_data[$field] = $defaults[$field];
700 - $restored_values[$field] = $defaults[$field];
701 - }
702 -
703 - // Save updated form data
704 - update_option('accua_forms_default_form_data', $form_data);
705 -
706 - wp_send_json_success(array(
707 - 'message' => __('Default values restored successfully.', 'contact-forms'),
708 - 'values' => $restored_values,
709 - ));
710 -}
711 -
712 455 add_action( 'wp_ajax_accua-save-form-settings', 'accua_forms_save_form_settings');
713 456 function accua_forms_save_form_settings() {
714 457 if (!current_user_can('manage_options')){
715 458 wp_die( -1, 403 );
@@ -717,16 +460,14 @@
717 460 check_ajax_referer('edit_form', '_nonce_edit_form');
718 461
719 462 $post = stripslashes_deep($_POST);
720 463
464 + $forms_data = get_option('accua_forms_saved_forms', array());
721 465 $fid = $post['form-id'];
722 466 if (accua_forms_validate_form_id($fid) !== '') {
723 467 die('-1');
724 468 }
725 469
726 - // Get draft data instead of live data
727 - $draft_data = _accua_forms_get_draft_data($fid);
728 -
729 470 $settings = array(
730 471 'title',
731 472 'success_message',
732 473 'success_message_no_message',
@@ -741,9 +482,8 @@
741 482 'admin_emails_message_no_message',
742 483 'confirmation_emails_subject',
743 484 'confirmation_emails_message',
744 485 'confirmation_emails_message_no_message',
745 - 'gads_conversion_tracking_code',
746 486 //'use_ajax',
747 487
748 488 'layout',
749 489 'style_margin',
@@ -767,11 +507,8 @@
767 507 'style_submit_background_color',
768 508 'style_submit_padding',
769 509 'style_submit_color',
770 510 'style_submit_font_size',
771 - 'submission_retention_value',
772 - 'submission_retention_unit',
773 - 'submission_retention_mode',
774 511 );
775 512
776 513 // print_r($post);
777 514
@@ -779,215 +516,22 @@
779 516 foreach($settings as $i) {
780 517 if (isset($post[$i])) {
781 518 $new_form_settings[$i] = $post[$i];
782 519 }
783 - if (isset($draft_data[$i])) {
784 - unset($draft_data[$i]);
785 - }
520 + unset($forms_data[$fid][$i]);
786 521 }
787 522
788 - $draft_data += accua_forms_filter_settings($new_form_settings);
523 + $forms_data[$fid] += accua_forms_filter_settings($new_form_settings);
789 524
790 - $draft_data['use_ajax'] = !empty($post['use_ajax']);
791 - $draft_data['submission_retention_override'] = !empty($post['submission_retention_override']);
525 + $forms_data[$fid]['use_ajax'] = !empty($post['use_ajax']);
792 526
793 - // Save to draft (not to live database)
794 - _accua_forms_save_draft($fid, $draft_data);
527 + update_option('accua_forms_saved_forms', $forms_data);
795 528
796 - // Return JSON response for AJAX handler
797 - wp_send_json_success($draft_data);
798 -}
529 + //print_r($forms_data[$fid]);
799 530
800 -/**
801 - * AJAX handler to publish draft to live database.
802 - * Called when user clicks the Save button.
803 - */
804 -add_action( 'wp_ajax_accua-publish-form-draft', 'accua_forms_publish_form_draft');
805 -function accua_forms_publish_form_draft() {
806 - if (!current_user_can('manage_options')){
807 - wp_die( -1, 403 );
808 - }
809 - check_ajax_referer('edit_form', '_nonce_edit_form');
810 -
811 - $post = stripslashes_deep($_POST);
812 - $fid = isset($post['form-id']) ? $post['form-id'] : '';
813 -
814 - if (accua_forms_validate_form_id($fid) !== '') {
815 - wp_send_json_error(array('message' => __('Invalid form ID.', 'contact-forms')), 400);
816 - }
817 -
818 - // Publish the draft
819 - $result = _accua_forms_publish_draft($fid);
820 -
821 - if ($result) {
822 - wp_send_json_success(array('message' => __('Form saved successfully.', 'contact-forms')));
823 - } else {
824 - // Draft might not exist (nothing to publish) - this is OK for a new form
825 - // Check if form exists in database
826 - $forms_data = get_option('accua_forms_saved_forms', array());
827 - if (isset($forms_data[$fid])) {
828 - wp_send_json_success(array('message' => __('No changes to save.', 'contact-forms')));
829 - } else {
830 - wp_send_json_error(array('message' => __('Failed to save form.', 'contact-forms')), 500);
831 - }
832 - }
531 + die('');
833 532 }
834 533
835 -/**
836 - * AJAX handler to discard draft and reload from published data.
837 - * Called when user clicks "Discard changes".
838 - */
839 -add_action( 'wp_ajax_accua-discard-form-draft', 'accua_forms_discard_form_draft');
840 -function accua_forms_discard_form_draft() {
841 - if (!current_user_can('manage_options')){
842 - wp_die( -1, 403 );
843 - }
844 - check_ajax_referer('edit_form', '_nonce_edit_form');
845 -
846 - $post = stripslashes_deep($_POST);
847 - $fid = isset($post['form-id']) ? $post['form-id'] : '';
848 -
849 - if (accua_forms_validate_form_id($fid) !== '') {
850 - wp_send_json_error(array('message' => __('Invalid form ID.', 'contact-forms')), 400);
851 - }
852 -
853 - // Delete the draft
854 - _accua_forms_delete_draft($fid);
855 -
856 - wp_send_json_success(array('message' => __('Changes discarded.', 'contact-forms')));
857 -}
858 -
859 -/**
860 - * AJAX handler to get posts for post-select fields with pagination.
861 - * Available to both logged-in and anonymous users (for frontend forms).
862 - *
863 - * @since 2.0.0-beta.29
864 - */
865 -add_action('wp_ajax_accua_forms_get_posts', 'accua_forms_ajax_get_posts');
866 -add_action('wp_ajax_nopriv_accua_forms_get_posts', 'accua_forms_ajax_get_posts');
867 -function accua_forms_ajax_get_posts() {
868 - // Verify nonce
869 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Nonce verification
870 - if (!isset($_REQUEST['_nonce']) || !wp_verify_nonce($_REQUEST['_nonce'], 'accua_forms_get_posts')) {
871 - wp_send_json_error(array('message' => __('Security check failed.', 'contact-forms')), 403);
872 - }
873 -
874 - // Sanitize inputs
875 - $post_type = isset($_REQUEST['post_type']) ? sanitize_text_field(wp_unslash($_REQUEST['post_type'])) : 'page';
876 - $search = isset($_REQUEST['search']) ? sanitize_text_field(wp_unslash($_REQUEST['search'])) : '';
877 - $page = isset($_REQUEST['page']) ? absint($_REQUEST['page']) : 1;
878 - $per_page = isset($_REQUEST['per_page']) ? min(absint($_REQUEST['per_page']), 100) : 50;
879 - $extra_args = isset($_REQUEST['extra_args']) ? sanitize_text_field(wp_unslash($_REQUEST['extra_args'])) : '';
880 - $selected = isset($_REQUEST['selected']) ? sanitize_text_field(wp_unslash($_REQUEST['selected'])) : '';
881 -
882 - // Validate post type
883 - $valid_post_types = get_post_types(array('public' => true));
884 - if (!isset($valid_post_types[$post_type])) {
885 - $post_type = 'page';
886 - }
887 -
888 - // Calculate offset
889 - $offset = ($page - 1) * $per_page;
890 -
891 - // Build query arguments
892 - $args = array(
893 - 'post_type' => $post_type,
894 - 'number' => $per_page + 1, // Get one extra to check if there are more
895 - 'offset' => $offset,
896 - 's' => $search,
897 - );
898 -
899 - // Parse extra arguments (backward compatibility with allowed_values textarea)
900 - if (!empty($extra_args)) {
901 - // Parse the query string format
902 - $extra = array();
903 - wp_parse_str($extra_args, $extra);
904 -
905 - // Allow post_type override from extra_args (backward compatibility)
906 - if (isset($extra['post_type'])) {
907 - $override_post_type = sanitize_text_field($extra['post_type']);
908 - // Validate the overridden post type
909 - if (isset($valid_post_types[$override_post_type])) {
910 - $post_type = $override_post_type;
911 - $args['post_type'] = $post_type;
912 - }
913 - }
914 -
915 - // Merge only safe parameters
916 - $safe_params = array('meta_key', 'meta_value', 'authors', 'parent', 'child_of', 'exclude', 'include', 'sort_column', 'sort_order');
917 - foreach ($safe_params as $param) {
918 - if (isset($extra[$param])) {
919 - $args[$param] = $extra[$param];
920 - }
921 - }
922 - }
923 -
924 - // Get posts using WPML-compatible function
925 - $posts = accua_get_pages($args);
926 -
927 - // Check if there are more results
928 - $has_more = count($posts) > $per_page;
929 - if ($has_more) {
930 - array_pop($posts); // Remove the extra item
931 - }
932 -
933 - // Format results for the dropdown
934 - $results = array();
935 - foreach ($posts as $post) {
936 - $results[] = array(
937 - 'id' => $post->ID,
938 - 'text' => $post->post_title,
939 - );
940 - }
941 -
942 - // If this is the first page and we have a selected value, ensure it's in the list
943 - if ($page === 1 && !empty($selected) && is_numeric($selected)) {
944 - $selected_id = absint($selected);
945 - $found = false;
946 - foreach ($results as $result) {
947 - if ($result['id'] === $selected_id) {
948 - $found = true;
949 - break;
950 - }
951 - }
952 - // If selected post not in results, fetch it separately and prepend
953 - if (!$found) {
954 - $selected_post = get_post($selected_id);
955 - if ($selected_post && $selected_post->post_type === $post_type) {
956 - array_unshift($results, array(
957 - 'id' => $selected_post->ID,
958 - 'text' => $selected_post->post_title,
959 - ));
960 - }
961 - }
962 - }
963 -
964 - wp_send_json_success(array(
965 - 'results' => $results,
966 - 'more' => $has_more,
967 - 'page' => $page,
968 - ));
969 -}
970 -
971 -/**
972 - * Get available public post types for the post-select field editor.
973 - *
974 - * @since 2.0.0-beta.29
975 - * @return array Array of post type slug => label pairs.
976 - */
977 -function accua_forms_get_public_post_types() {
978 - $post_types = get_post_types(array('public' => true), 'objects');
979 - $options = array();
980 - foreach ($post_types as $post_type) {
981 - // Skip attachments
982 - if ($post_type->name === 'attachment') {
983 - continue;
984 - }
985 - $options[$post_type->name] = $post_type->labels->singular_name;
986 - }
987 - return $options;
988 -}
989 -
990 534 function accua_forms_field_settings_form_counter() {
991 535 static $i = 0;
992 536 $i++;
993 537 return $i;
@@ -1027,10 +571,8 @@
1027 571 $override_label = isset($istance_data['label']) ? 'checked="checked"' : '';
1028 572 $override_default_value = isset($istance_data['default_value']) ? 'checked="checked"' : '';
1029 573 $override_allowed_values = isset($istance_data['allowed_values']) ? 'checked="checked"' : '';
1030 574 $override_allowed_extensions = '';
1031 - $override_custom_required_msg = isset($istance_data['custom_required_message']) ? 'checked="checked"' : '';
1032 - $override_custom_format_msg = isset($istance_data['custom_format_message']) ? 'checked="checked"' : '';
1033 575
1034 576 if ($field_data['type'] == 'file') {
1035 577 if (isset($istance_data['version']) && $istance_data['version'] >= 2) {
1036 578 if (isset($istance_data['allowed_extensions'])) {
@@ -1076,21 +618,16 @@
1076 618 'default_value' => $field_data['default_value'],
1077 619 'allowed_values' => $field_data['allowed_values'],
1078 620 'allowed_extensions' => $field_data['allowed_extensions'],
1079 621 'required' => false,
1080 - 'post_type' => 'page', // Default post type for post-select fields
1081 - 'css_class' => '',
1082 - 'css_id' => '',
1083 - 'custom_required_message' => '',
1084 - 'custom_format_message' => '',
1085 622 );
1086 623
1087 624 foreach ($istance_data as $key => $value) {
1088 - $istance_data[$key] = esc_attr($istance_data[$key]);
625 + $istance_data[$key] = htmlspecialchars($istance_data[$key], ENT_QUOTES);
1089 626 }
1090 627
1091 628 foreach ($field_data as $key => $value) {
1092 - $field_data[$key] = esc_attr($field_data[$key]);
629 + $field_data[$key] = htmlspecialchars($field_data[$key], ENT_QUOTES);
1093 630 }
1094 631
1095 632 $multi_number = '';
1096 633 $add_new = '';
@@ -1111,9 +648,9 @@
1111 648 $forceoverride_field = false;
1112 649 $add_new = $empty_istance ? 'single' : '';
1113 650 }
1114 651
1115 - $fid = esc_attr($fid);
652 + $fid = htmlspecialchars($fid, ENT_QUOTES);
1116 653 $testi_eot = array (
1117 654 'label' => __( 'Label', 'contact-forms'),
1118 655 'override' => __( 'override', 'contact-forms'),
1119 656 'default_value' => __( 'Default value', 'contact-forms'),
@@ -1124,9 +661,8 @@
1124 661 'allowed_extensions' => __( 'Allowed extensions', 'contact-forms'),
1125 662 'desc_all_ext' => __( 'Accepted file extensions. One per line, without dots.', 'contact-forms'),
1126 663 'required' => __( 'Required', 'contact-forms'),
1127 664 'custom_HTML_content' => __( 'Custom HTML content', 'contact-forms'),
1128 - 'refresh_preview' => __( 'Refresh Preview', 'contact-forms'),
1129 665 'remove' => __( 'Remove', 'contact-forms'),
1130 666 'close' => __( 'Close', 'contact-forms'),
1131 667 'save' => __( 'Save', 'contact-forms'),
1132 668 'min-of-date' => __( 'Min date', 'contact-forms'),
@@ -1142,9 +678,8 @@
1142 678 $override_type = 'checkbox';
1143 679 $override_end = ')';
1144 680 }
1145 681
1146 - // phpcs:disable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped -- Heredoc used for HTML templates with pre-escaped variables
1147 682 $content = <<<EOT
1148 683 <p><label for="widget-{$istance_data['istance_id']}-label">{$testi_eot['label']}:</label>
1149 684 {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-label" value="1" {$override_label} />{$override_end}<br>
1150 685 <input type="text" value="{$istance_data['label']}" name="form-field-{$istance_data['istance_id']}-label" id="widget-{$istance_data['istance_id']}-label" class="widefat"></p>
@@ -1182,43 +717,8 @@
1182 717 <p><label for="widget-{$istance_data['istance_id']}-required">{$testi_eot['required']}:</label>
1183 718 <input type="checkbox" value="1" {$required_checked} name="form-field-{$istance_data['istance_id']}-required" id="widget-{$istance_data['istance_id']}-required"></p>
1184 719 EOT;
1185 720
1186 - // Custom required message override (checkbox + text input, same pattern as custom label)
1187 - $custom_required_msg_label = __( 'Custom required message', 'contact-forms');
1188 - // translators: %s is the field name/label
1189 - $custom_required_msg_desc = __( 'Overrides the default "required" error message. Use %s for the field name.', 'contact-forms');
1190 - $custom_required_msg = <<<EOT
1191 - <p><label for="widget-{$istance_data['istance_id']}-custom-required-msg">{$custom_required_msg_label}:</label>
1192 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-required-msg" value="1" {$override_custom_required_msg} />{$override_end}<br>
1193 - <input type="text" value="{$istance_data['custom_required_message']}" name="form-field-{$istance_data['istance_id']}-custom-required-msg" id="widget-{$istance_data['istance_id']}-custom-required-msg" class="widefat"><br>
1194 - <small>{$custom_required_msg_desc}</small></p>
1195 -EOT;
1196 -
1197 - // Custom format message override for email and telephone fields
1198 - $custom_format_msg = '';
1199 - if ($field_data['type'] === 'email' || $field_data['type'] === 'autoreply_email') {
1200 - $custom_format_msg_label = __( 'Custom invalid email message', 'contact-forms');
1201 - // translators: %s is the field name/label
1202 - $custom_format_msg_desc = __( 'Overrides the default email format error message. Use %s for the field name.', 'contact-forms');
1203 - $custom_format_msg = <<<EOT
1204 - <p><label for="widget-{$istance_data['istance_id']}-custom-format-msg">{$custom_format_msg_label}:</label>
1205 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-format-msg" value="1" {$override_custom_format_msg} />{$override_end}<br>
1206 - <input type="text" value="{$istance_data['custom_format_message']}" name="form-field-{$istance_data['istance_id']}-custom-format-msg" id="widget-{$istance_data['istance_id']}-custom-format-msg" class="widefat"><br>
1207 - <small>{$custom_format_msg_desc}</small></p>
1208 -EOT;
1209 - } elseif ($field_data['type'] === 'telephone') {
1210 - $custom_format_msg_label = __( 'Custom invalid phone message', 'contact-forms');
1211 - // translators: %s is the field name/label
1212 - $custom_format_msg_desc = __( 'Overrides the default phone format error message. Use %s for the field name.', 'contact-forms');
1213 - $custom_format_msg = <<<EOT
1214 - <p><label for="widget-{$istance_data['istance_id']}-custom-format-msg">{$custom_format_msg_label}:</label>
1215 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-format-msg" value="1" {$override_custom_format_msg} />{$override_end}<br>
1216 - <input type="text" value="{$istance_data['custom_format_message']}" name="form-field-{$istance_data['istance_id']}-custom-format-msg" id="widget-{$istance_data['istance_id']}-custom-format-msg" class="widefat"><br>
1217 - <small>{$custom_format_msg_desc}</small></p>
1218 -EOT;
1219 - }
1220 -
1221 721 if ($field_data['type'] == 'date'){
1222 722 $default_date_value = <<<EOT
1223 723 <p><label for="widget-{$istance_data['istance_id']}-default-value">{$testi_eot['default_value']}:</label>
1224 724 {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-default-value" value="1" {$override_default_value} />{$override_end}<br>
@@ -1235,76 +735,8 @@
1235 735 <input type="date" value="{$istance_data['max_date']}" name="form-field-{$istance_data['istance_id']}-max-of-date" id="widget-{$istance_data['istance_id']}-max-of-date"></p>
1236 736 EOT;
1237 737 }
1238 738
1239 - // Post type selector for post-select and post-multicheckbox fields
1240 - $post_type_selector = '';
1241 - if ($field_data['type'] === 'post-select' || $field_data['type'] === 'post-multicheckbox') {
1242 - $override_post_type = isset($istance_data['post_type']) && $istance_data['post_type'] !== 'page' ? 'checked="checked"' : '';
1243 - $post_types = accua_forms_get_public_post_types();
1244 - $post_type_options = '';
1245 - $current_post_type = esc_attr($istance_data['post_type']);
1246 - foreach ($post_types as $pt_slug => $pt_label) {
1247 - $selected = ($pt_slug === $current_post_type) ? ' selected="selected"' : '';
1248 - $post_type_options .= '<option value="' . esc_attr($pt_slug) . '"' . $selected . '>' . esc_html($pt_label) . '</option>';
1249 - }
1250 - $post_type_label = __('Post type', 'contact-forms');
1251 - $post_type_desc = __('Select which post type to show in the dropdown.', 'contact-forms');
1252 - $query_params_label = __('Additional query parameters', 'contact-forms');
1253 - // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- This is example help text, not actual code.
1254 - $query_params_desc = __('Optional: Filter posts using query parameters (e.g., authors=admin or meta_key=featured&meta_value=1). Leave empty for all posts of the selected type.', 'contact-forms');
1255 - $post_type_selector = <<<EOT
1256 - <p><label for="widget-{$istance_data['istance_id']}-post-type">{$post_type_label}:</label>
1257 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-post-type" value="1" {$override_post_type} />{$override_end}<br>
1258 - <select name="form-field-{$istance_data['istance_id']}-post-type" id="widget-{$istance_data['istance_id']}-post-type" class="widefat">{$post_type_options}</select><br />
1259 - {$post_type_desc}</p>
1260 - <p><label for="widget-{$istance_data['istance_id']}-allowed-values">{$query_params_label}:</label>
1261 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-allowed-values" value="1" {$override_allowed_values} />{$override_end}<br>
1262 - <textarea rows="3" cols="50" name="form-field-{$istance_data['istance_id']}-allowed-values" id="widget-{$istance_data['istance_id']}-allowed-values" class="widefat">{$istance_data['allowed_values']}</textarea><br />
1263 - {$query_params_desc}</p>
1264 -EOT;
1265 - }
1266 -
1267 - // Country selector for telephone fields (for libphonenumber validation)
1268 - $country_selector = '';
1269 - if ($field_data['type'] === 'telephone') {
1270 - $countries = accua_forms_get_countries();
1271 - $current_country = isset($istance_data['country_code']) ? esc_attr($istance_data['country_code']) : 'IT';
1272 - $override_country = isset($istance_data['country_code']) && $istance_data['country_code'] !== 'IT' ? 'checked="checked"' : '';
1273 - $country_options = '';
1274 - foreach ($countries as $code => $country_name) {
1275 - $selected = ($code === $current_country) ? ' selected="selected"' : '';
1276 - $country_options .= '<option value="' . esc_attr($code) . '"' . $selected . '>' . esc_html($country_name) . '</option>';
1277 - }
1278 - $country_label = __('Default country', 'contact-forms');
1279 - // translators: Help text for phone field country selector in form editor
1280 - $country_desc = __('For numbers without international prefix, validation assumes this country.', 'contact-forms');
1281 - $country_selector = <<<EOT
1282 - <p><label for="widget-{$istance_data['istance_id']}-country-code">{$country_label}:</label>
1283 - {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-country-code" value="1" {$override_country} />{$override_end}<br>
1284 - <select name="form-field-{$istance_data['istance_id']}-country-code" id="widget-{$istance_data['istance_id']}-country-code" class="widefat">{$country_options}</select><br />
1285 - {$country_desc}</p>
1286 -EOT;
1287 - }
1288 -
1289 - // CSS Class and CSS ID fields (universal, apply to all field types)
1290 - $css_class_label = __( 'CSS Class', 'contact-forms');
1291 - $css_id_label = __( 'CSS ID', 'contact-forms');
1292 - // translators: Help text for CSS Class field in form editor
1293 - $css_class_desc = __( 'Custom CSS class(es) for the field wrapper. Separate multiple classes with spaces.', 'contact-forms');
1294 - // translators: Help text for CSS ID field in form editor
1295 - $css_id_desc = __( 'Custom CSS ID for the field wrapper. Must be unique on the page.', 'contact-forms');
1296 - $css_class_field = <<<EOT
1297 - <p><label for="widget-{$istance_data['istance_id']}-css-class">{$css_class_label}:</label><br>
1298 - <input type="text" value="{$istance_data['css_class']}" name="form-field-{$istance_data['istance_id']}-css-class" id="widget-{$istance_data['istance_id']}-css-class" class="widefat"><br>
1299 - <small>{$css_class_desc}</small></p>
1300 -EOT;
1301 - $css_id_field = <<<EOT
1302 - <p><label for="widget-{$istance_data['istance_id']}-css-id">{$css_id_label}:</label><br>
1303 - <input type="text" value="{$istance_data['css_id']}" name="form-field-{$istance_data['istance_id']}-css-id" id="widget-{$istance_data['istance_id']}-css-id" class="widefat"><br>
1304 - <small>{$css_id_desc}</small></p>
1305 -EOT;
1306 -
1307 739 switch ($field_data['type']) {
1308 740 case 'textarea':
1309 741 $content .= <<<EOT
1310 742 <p><label for="widget-{$istance_data['istance_id']}-default-value">{$testi_eot['default_value']}:</label>
@@ -1310,9 +742,8 @@
1310 742 <p><label for="widget-{$istance_data['istance_id']}-default-value">{$testi_eot['default_value']}:</label>
1311 743 {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-default-value" value="1" {$override_default_value} />{$override_end}<br>
1312 744 <textarea rows="6" cols="50" name="form-field-{$istance_data['istance_id']}-default-value" id="widget-{$istance_data['istance_id']}-default-value" class="widefat">{$istance_data['default_value']}</textarea></p>
1313 745 $required
1314 - $custom_required_msg
1315 746 EOT;
1316 747 break;
1317 748 case 'hidden':
1318 749 $content = $default_value;
@@ -1317,34 +748,26 @@
1317 748 case 'hidden':
1318 749 $content = $default_value;
1319 750 break;
1320 751 case 'checkbox':
1321 - $content .= $default_value . $required . $custom_required_msg;
752 + $content .= $default_value . $required;
1322 753 break;
1323 754 case 'select':
1324 755 case 'radio':
1325 - $content .= $default_value . $allowed_values . $required . $custom_required_msg;
1326 - break;
1327 756 case 'post-select':
1328 - $content .= $default_value . $post_type_selector . $required . $custom_required_msg;
757 + $content .= $default_value . $allowed_values . $required;
1329 758 break;
1330 759 case 'multiselect':
1331 760 case 'multicheckbox':
1332 - $content .= $default_values . $allowed_values . $required . $custom_required_msg;
1333 - break;
1334 761 case 'post-multicheckbox':
1335 - $content .= $default_values . $post_type_selector . $required . $custom_required_msg;
762 + $content .= $default_values . $allowed_values . $required;
1336 763 break;
1337 764 case 'file':
1338 - $content .= $allowed_ext . $required . $custom_required_msg;
1339 - break;
765 + $content .= $allowed_ext . $required;
1340 766 case 'submit':
767 + case 'fieldset-begin':
1341 768 //just the label
1342 769 break;
1343 - case 'fieldset-begin':
1344 - //just the label + css fields
1345 - $content .= $css_class_field . $css_id_field;
1346 - break;
1347 770 case 'fieldset-end':
1348 771 //Nothing!
1349 772 $content = '';
1350 773 break;
@@ -1352,46 +775,23 @@
1352 775 $content = <<<EOT
1353 776 <p><label for="widget-{$istance_data['istance_id']}-default-value">{$testi_eot['custom_HTML_content']}</label>
1354 777 {$override_begin}<input type="{$override_type}" name="form-field-{$istance_data['istance_id']}-override-default-value" value="1" {$override_default_value} />{$override_end}<br>
1355 778 <textarea rows="6" cols="50" name="form-field-{$istance_data['istance_id']}-default-value" id="widget-{$istance_data['istance_id']}-default-value" class="widefat">{$istance_data['default_value']}</textarea></p>
1356 - <p><a href="#" class="accua-refresh-preview">{$testi_eot['refresh_preview']}</a></p>
1357 779 EOT;
1358 780 break;
1359 781 case 'date':
1360 - $content .= $default_date_value . $min_date . $max_date . $required . $custom_required_msg;
782 + $content .= $default_date_value . $min_date . $max_date . $required;
1361 783 break;
1362 - case 'telephone':
1363 - $content .= $default_value . $country_selector . $required . $custom_required_msg . $custom_format_msg;
1364 - break;
1365 784 case 'email':
1366 785 case 'autoreply_email':
1367 - $content .= $default_value . $required . $custom_required_msg . $custom_format_msg;
1368 - break;
1369 786 case 'textfield':
1370 787 case 'colorpicker':
1371 788 case 'datepicker':
1372 789 case 'dateselect':
1373 790 default:
1374 - /**
1375 - * Action to render additional field settings in the form editor.
1376 - *
1377 - * @param string $field_type The field type identifier.
1378 - * @param array $field_data The field definition.
1379 - * @param array $istance_data The field instance data.
1380 - * @param string $content The current settings HTML (passed by reference via output buffering).
1381 - */
1382 - ob_start();
1383 - do_action( 'accua_forms_field_settings', $field_data['type'], $field_data, $istance_data );
1384 - $extra_settings = ob_get_clean();
1385 - $content .= $default_value . $extra_settings . $required . $custom_required_msg;
791 + $content .= $default_value . $required;
1386 792 break;
1387 793 }
1388 -
1389 - // Append CSS Class and CSS ID fields to all types except fieldset-end (which has no settings)
1390 - if ($field_data['type'] !== 'fieldset-end' && $field_data['type'] !== 'fieldset-begin') {
1391 - $content .= $css_class_field . $css_id_field;
1392 - }
1393 -
1394 794 $adminurl = admin_url();
1395 795
1396 796 return <<<EOT
1397 797 <div class="widget ui-draggable" id="widget-{$i}_{$istance_data['istance_id']}" $hidden> <div class="widget-top">
@@ -1420,9 +820,10 @@
1420 820 <a href="#remove" class="widget-control-remove delete">{$testi_eot['remove']}</a> |
1421 821 <a href="#close" class="widget-control-close">{$testi_eot['close']}</a>
1422 822 </div>
1423 823 <div class="alignright">
1424 - <input type="submit" value="{$testi_eot['save']}" class="button button-primary widget-control-save accua-field-save-btn" id="widget-{$istance_data['istance_id']}-savewidget" name="savewidget">
824 + <img alt="" title="" class="ajax-feedback" src="{$adminurl}images/wpspin_light.gif">
825 + <input type="submit" value="{$testi_eot['save']}" class="button-primary widget-control-save" id="widget-{$istance_data['istance_id']}-savewidget" name="savewidget">
1425 826 </div>
1426 827 <br class="clear">
1427 828 </div>
1428 829 </form>
@@ -1433,18 +834,15 @@
1433 834 </div>-->
1434 835 </div>
1435 836
1436 837 EOT;
1437 - // phpcs:enable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
1438 838 }
1439 839
1440 840 function accua_forms_add_page($message='') {
1441 841 $forms_data = get_option('accua_forms_saved_forms', array());
1442 842 $trash_data = get_option('accua_forms_trash_forms', array());
1443 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only form ID, parent function accua_forms_list_page() checks nonce
1444 843 if (!empty($_GET['fid'])) {
1445 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only form ID
1446 - $fid = absint(wp_unslash($_GET['fid']));
844 + $fid = htmlspecialchars(stripslashes($_GET['fid']), ENT_QUOTES);
1447 845 } else {
1448 846 if ($message === '') {
1449 847 $fid = 1 + ((int) get_option('accua_forms_lastid', 0));
1450 848 while (isset($forms_data[$fid]) || isset($trash_data[$fid])) {
@@ -1460,9 +858,9 @@
1460 858 }
1461 859 }
1462 860 if (!empty($_GET['clonefrom'])) {
1463 861 check_admin_referer('clone_posts');
1464 - $clonefrom = sanitize_text_field( wp_unslash( $_GET['clonefrom'] ) );
862 + $clonefrom = stripslashes($_GET['clonefrom']);
1465 863 } else {
1466 864 $clonefrom = '';
1467 865 }
1468 866 ?>
@@ -1467,70 +865,49 @@
1467 865 }
1468 866 ?>
1469 867
1470 868 <div id="accua_forms_add_page" class="accua_forms_admin_page wrap">
1471 -<h1><?php esc_html_e( 'Create a form', 'contact-forms'); ?></h1>
869 +<h2><?php _e( 'Create a form', 'contact-forms'); ?> </h2>
1472 870 <?php if ($message !== '') {
1473 - echo "<div style='border:1px solid; padding: 10px;'>".esc_html($message)."</div>";
871 + echo "<div style='border:1px solid; padding: 10px;'>$message</div>";
1474 872 } ?>
1475 873 <form action="admin.php" method="GET">
1476 874 <?php wp_nonce_field('edit_posts', '_wpnonce', false, true) ?>
1477 875 <input type="hidden" name="page" value="accua_forms_list" />
1478 -<p>Form id: <input type="text" name="fid" value="<?php echo esc_attr($fid); ?>" /></p>
876 +<p>Form id: <input type="text" name="fid" value="<?php echo $fid; ?>" /></p>
1479 877 <?php
1480 878 if ($forms_data) {
1481 879 echo '<p><select name="clonefrom">
1482 - <option value="">'.esc_html__( 'Empty form', 'contact-forms').'</option>
1483 - <optgroup label="'.esc_attr__( 'Clone form:', 'contact-forms').'">';
880 + <option value="">'.__( 'Empty form', 'contact-forms').'</option>
881 + <optgroup label="'.__( 'Clone form:', 'contact-forms').'">';
1484 882 foreach ($forms_data as $i => $formdata) {
1485 - $sel = ( $i === $clonefrom ) ? ' selected="selected"' : '';
1486 - $i_esc = esc_attr($i);
883 + $sel = ($i == $clonefrom) ? " selected='selected'" : '';
884 + $i = htmlspecialchars($i, ENT_QUOTES);
1487 885 if (isset($formdata['title']) && ('' !== trim($formdata['title']))) {
1488 - $formtitle = esc_html($formdata['title']);
886 + $formtitle = htmlspecialchars($formdata['title']);
1489 887 } else {
1490 - $formtitle = $i_esc;
888 + $formtitle = $i;
1491 889 }
1492 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $sel is a static string, other vars pre-escaped
1493 - echo '<option value="' . esc_attr( $i_esc ) . '"' . $sel . '>' . esc_html( $formtitle ) . "</option>\n";
890 + echo "<option value='$i'$sel>$formtitle</option>\n";
1494 891 }
1495 892 echo '</optgroup></select></p>';
1496 893 }
1497 894 ?>
1498 -<p><input type="submit" value="<?php esc_attr_e( 'Create', 'contact-forms'); ?>" /></p>
895 +<p><input type="submit" value="<?php _e( 'Create', 'contact-forms'); ?>" /></p>
1499 896 </form>
1500 897 </div>
1501 898 <?php
1502 899 }
1503 900
1504 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, underscore prefix indicates private
1505 901 function _accua_forms_test_clonefrom($fid){
1506 902 $error = '';
1507 903 if (isset($_GET['clonefrom'])&&$_GET['clonefrom']!=='') {
1508 - // Verify nonce for clone operation to prevent CSRF attacks
1509 - // Check for both possible nonce actions depending on the entry point
1510 - $nonce_valid = false;
1511 - if (isset($_GET['_wpnonce'])) {
1512 - $nonce = sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) );
1513 - // First try clone_posts nonce (from accua_forms_add page)
1514 - if (wp_verify_nonce($nonce, 'clone_posts')) {
1515 - $nonce_valid = true;
1516 - }
1517 - // Then try edit_posts nonce (from accua_forms_list page)
1518 - elseif (wp_verify_nonce($nonce, 'edit_posts')) {
1519 - $nonce_valid = true;
1520 - }
1521 - }
1522 -
1523 - if (!$nonce_valid) {
1524 - wp_die(esc_html__('Security check failed. Please try again.', 'contact-forms'), esc_html__('Security Error', 'contact-forms'), array('response' => 403));
1525 - }
1526 -
1527 - $clonefrom = sanitize_text_field( wp_unslash( $_GET['clonefrom'] ) );
904 + $clonefrom = stripslashes($_GET['clonefrom']);
1528 905 $forms_data = get_option('accua_forms_saved_forms', array());
1529 906 if (isset($forms_data[$fid])){
1530 - $error .= '<p>' . esc_html__( 'Form already exists', 'contact-forms') . '</p>';
1531 - } elseif (empty($forms_data[$clonefrom])) {
1532 - $error .= '<p>' . esc_html__( 'Source form doesn\'t exists.', 'contact-forms') . '</p>';
907 + $error .= "<p>".__( 'Form already exists', 'contact-forms')."</p>";
908 + } else if (empty($forms_data[$clonefrom])) {
909 + $error .= "<p>".__( 'Source form doesn\'t exists.', 'contact-forms')."</p>";
1533 910 } else {
1534 911 $forms_data[$fid] = $forms_data[$clonefrom];
1535 912 if (!isset($forms_data[$fid]['title'])) {
1536 913 $forms_data[$fid]['title'] = $clonefrom ." ".__( 'clone', 'contact-forms');
@@ -1542,9 +919,8 @@
1542 919 }
1543 920 return $error;
1544 921 }
1545 922
1546 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, underscore prefix indicates private
1547 923 function _accua_forms_form_edit_action() {
1548 924 static $message = null;
1549 925 if ($message === null) {
1550 926 $message = '';
@@ -1556,10 +932,9 @@
1556 932 check_admin_referer('contact-forms-delete_'.$fid);
1557 933 $forms_data = get_option('accua_forms_saved_forms', array());
1558 934 unset($forms_data[$fid]);
1559 935 update_option('accua_forms_saved_forms', $forms_data);
1560 - $fid = esc_html($fid);
1561 - // translators: %s is the form ID being deleted
936 + $fid = htmlspecialchars($fid);
1562 937 $message .= sprintf( __( 'Form "%s" deleted','contact-forms' ), $fid );
1563 938 break;
1564 939 }
1565 940 }
@@ -1569,15 +944,15 @@
1569 944
1570 945 function accua_forms_validate_form_id($fid) {
1571 946 $error = '';
1572 947 if (!preg_match('/^[a-z0-9_-]+$/i', $fid)) {
1573 - $error .= "<p>".__( 'Only letters, numbers, hyphens, and underscores allowed in form identifier', 'contact-forms')."</p>";
948 + $error .= "<p>".__( 'Only letters, numbers, hyphen and underscores allowed in form identificative name', 'contact-forms')."</p>";
1574 949 }
1575 950 if (substr($fid,0,2) == '__') {
1576 - $error .= "<p>".__( 'The identifier cannot start with two underscores (__)', 'contact-forms')."</p>";
951 + $error .= "<p>".__( 'The identificative name can\'t start with two underscores (__)', 'contact-forms')."</p>";
1577 952 }
1578 953 if (strlen($fid) > 70) {
1579 - $error .= "<p>".__( 'The identifier cannot be longer than 70 characters', 'contact-forms')."</p>";
954 + $error .= "<p>".__( 'You cannot use more than 70 characters for the identificative name', 'contact-forms')."</p>";
1580 955 }
1581 956 return $error;
1582 957 }
1583 958
@@ -1582,17 +957,15 @@
1582 957 }
1583 958
1584 959 function accua_forms_list_page() {
1585 960 $message = '';
1586 - // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verified below
1587 961 if (isset($_POST['accua-form-edit-action'])){
1588 962 $message = _accua_forms_form_edit_action();
1589 - } elseif (isset($_GET['fid'])) {
963 + } else if (isset($_GET['fid'])) {
1590 964 check_admin_referer('edit_posts');
1591 - $fid = sanitize_text_field(wp_unslash($_GET['fid']));
965 + $fid = stripslashes($_GET['fid']);
1592 966 $error = accua_forms_validate_form_id($fid);
1593 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified above
1594 - if ($error === '' && (isset($_GET['clonefrom']) && $_GET['clonefrom'] !== '')) {
967 + if ($error === '' && (isset($_GET['clonefrom'])&&$_GET['clonefrom']!=='')) {
1595 968 $error .= _accua_forms_test_clonefrom($fid);
1596 969 }
1597 970 if ($error === '') {
1598 971 return accua_forms_edit_page($fid);
@@ -1602,14 +975,18 @@
1602 975 }
1603 976 ?>
1604 977 <div id="accua_forms_list_page" class="accua_forms_admin_page wrap">
1605 978 <?php if ($message !== '') {
1606 - echo "<div style='border:1px solid; padding: 10px;'>".esc_html($message)."</div>";
979 + echo "<div style='border:1px solid; padding: 10px;'>$message</div>";
1607 980 } ?>
1608 -<h1 class="wp-heading-inline"><?php esc_html_e( 'Contact Forms', 'contact-forms'); ?></h1>
1609 -<a class="page-title-action" href="<?php echo esc_url( get_admin_url() ); ?>admin.php?page=accua_forms_add"><?php esc_html_e('Add New','contact-forms'); ?></a>
1610 -<hr class="wp-header-end">
1611 -<p><?php esc_html_e( 'Use the shortcode or block to include forms in posts, pages or other content types.', 'contact-forms'); ?></p>
981 +<h2><img src="<?php echo ACCUA_FORMS_DIR_URL.'img/cimatti-icon-20.png'; ?>"/> <?php _e( 'Contact Forms', 'contact-forms'); ?>
982 + <a class="add-new-h2" href="<?php echo get_admin_url(); ?>admin.php?page=accua_forms_add"><?php _e('Add New','contact-forms'); ?></a>
983 +</h2>
984 +<div ><?php
985 + echo strtr(__( 'Use the turquoise blue %img_c button in the TinyMCE editor to include the forms in posts, pages or other content types (shortcode and php functions also available)', 'contact-forms'),
986 + array('%img_c'=>'<img alt="C" src="' . plugins_url('img/cimatti-icon-16.png', ACCUA_FORMS_FILE ) . '" />')
987 + );
988 +?></div>
1612 989 <?php
1613 990 accua_forms_list_page_table();
1614 991 ?>
1615 992 </div>
@@ -1616,17 +993,11 @@
1616 993 <?php
1617 994 }
1618 995
1619 996 function accua_forms_edit_page($fid) {
1620 - global $wpdb;
997 + wp_enqueue_script('jquery-ui-tabs','','','',true);
998 + wp_enqueue_script('contact_forms_tabs', plugins_url('accua_tabs.js', ACCUA_FORMS_FILE ), array( 'jquery' ), ACCUA_FORMS_JS_VERSION);
1621 999
1622 - // Initialize draft for this form (creates from published data if no draft exists)
1623 - _accua_forms_init_draft($fid);
1624 -
1625 - wp_enqueue_script('accua_tabs_component', plugins_url('assets/js/admin/accua-tabs.js', ACCUA_FORMS_FILE ), array( 'jquery' ), ACCUA_FORMS_JS_VERSION, true );
1626 - wp_enqueue_script('contact_forms_tabs', plugins_url('assets/js/admin/tabs.js', ACCUA_FORMS_FILE ), array( 'jquery', 'accua_tabs_component' ), ACCUA_FORMS_JS_VERSION, true );
1627 - wp_enqueue_script('accua_verify_gads_conversion_code', plugins_url('assets/js/admin/verify-gads-conversion.js', ACCUA_FORMS_FILE ), array( 'jquery' ), ACCUA_FORMS_JS_VERSION, true );
1628 -
1629 1000 if (!class_exists('AccuaFormsHelp')) {
1630 1001 require_once('accua-forms-help.php');
1631 1002 }
1632 1003 $accuaHelp = AccuaFormsHelp::getInstance();
@@ -1653,15 +1024,16 @@
1653 1024 );
1654 1025 */
1655 1026
1656 1027 $avail_fields = get_option('accua_forms_avail_fields', array());
1657 - $default_form_data = get_option('accua_forms_default_form_data', array()) + accua_forms_get_default_form_data();
1028 + $default_form_data = get_option('accua_forms_default_form_data',array());
1658 1029
1659 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only form restore flag, parent function checks nonce
1030 +
1031 +
1660 1032 $form_data = _accua_forms_get_form_data($fid, true, !empty($_GET['restore']));
1661 1033 $form_overrided_data = $form_data['_overrided'];
1662 1034
1663 - $fid_esc = esc_attr($fid);
1035 + $fid_esc = htmlspecialchars($fid, ENT_QUOTES);
1664 1036
1665 1037 $adminurl = admin_url();
1666 1038
1667 1039 global $wp_version;
@@ -1676,60 +1048,63 @@
1676 1048 }
1677 1049
1678 1050 ?>
1679 1051 <div id="accua_forms_edit_page" class="accua_forms_admin_page wrap">
1680 -<h1 class="wp-heading-inline"><?php esc_html_e( 'Contact Forms - Edit Form', 'contact-forms' ); ?></h1>
1681 -<?php
1682 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table, lightweight count query
1683 - $submission_count = (int) $wpdb->get_var( $wpdb->prepare(
1684 - "SELECT COUNT(*) FROM `{$wpdb->prefix}accua_forms_submissions` WHERE afs_form_id = %s AND afs_status >= 0",
1685 - $fid
1686 - ) );
1687 - $submissions_url = admin_url( 'admin.php?page=accua_forms_submissions_list&fid=' . urlencode( $fid ) );
1688 - printf(
1689 - '<a class="page-title-action" href="%s">%s (%s)</a>',
1690 - esc_url( $submissions_url ),
1691 - esc_html__( 'Submissions', 'contact-forms' ),
1692 - esc_html( number_format_i18n( $submission_count ) )
1693 - );
1694 -?>
1695 -<hr class="wp-header-end">
1052 +<h2><img src="<?php echo ACCUA_FORMS_DIR_URL.'img/cimatti-icon-20.png'; ?>"/> <?php _e('Contact Forms - Edit Form', 'contact-forms'); ?></h2>
1053 +<div class="accua_form_save_settings_status"></div>
1696 1054 <?php wp_nonce_field('edit_form', '_nonce_edit_form'); ?>
1697 -<div id="titlediv">
1698 - <div id="titlewrap">
1699 - <input id="title" type="text" autocomplete="off" value="<?php echo esc_attr($form_data['title']) ?>" size="30" name="post_title" placeholder="<?php esc_attr_e( 'Enter title here', 'contact-forms' ); ?>">
1700 - </div>
1055 +<div id="titlediv"><br />
1056 + <label id="title-prompt-text" class="screen-reader-text" for="title"><?php _e( 'Enter title here', 'contact-forms'); ?></label>
1057 + <input id="title" type="text" autocomplete="off" value="<?php echo htmlspecialchars($form_data['title'], ENT_QUOTES) ?>" size="30" name="post_title">
1058 + <script type="text/javascript">
1059 + jQuery(function($){
1060 + if ( jQuery('#titlediv #title').val() == '' )
1061 + jQuery('#title-prompt-text').removeClass('screen-reader-text');
1062 +
1063 + jQuery('#titlediv #title').focus(function() {
1064 + jQuery('#title-prompt-text').addClass('screen-reader-text');
1065 + });
1066 + jQuery('#titlediv #title').blur(function() {
1067 + if ( jQuery('#titlediv #title').val() == '' )
1068 + jQuery('#title-prompt-text').removeClass('screen-reader-text');
1069 + });
1070 + });
1071 + </script>
1701 1072 </div>
1702 - <div id="accua_tabs" class="accua-tabs accua-tabs--primary" data-default-tab="fields">
1703 - <div class="accua-tabs__header">
1704 - <div class="accua-tabs__tablist" role="tablist" aria-label="<?php esc_attr_e( 'Form editor', 'contact-forms' ); ?>">
1705 - <button class="accua-tabs__tab" role="tab" data-tab="fields"><?php esc_html_e( 'Fields', 'contact-forms' ); ?></button>
1706 - <button class="accua-tabs__tab" role="tab" data-tab="customise"><?php esc_html_e( 'Appearance and General', 'contact-forms' ); ?></button>
1707 - <button class="accua-tabs__tab" role="tab" data-tab="messages"><?php esc_html_e( 'Messages', 'contact-forms' ); ?></button>
1708 - <button class="accua-tabs__tab" role="tab" data-tab="retention"><?php esc_html_e( 'Data Retention', 'contact-forms' ); ?></button>
1709 - <button class="accua-tabs__tab" role="tab" data-tab="google_ads">Google Ads</button>
1710 - <button class="accua-tabs__tab" role="tab" data-tab="tokens"><?php esc_html_e( 'Tokens', 'contact-forms' ); ?></button>
1711 - </div>
1712 - <div id="accua_tabs_actions" class="accua_tabs_actions">
1713 - <form id="delete_form" action="admin.php?page=accua_forms_list" method="POST" onsubmit="return confirm(<?php print esc_attr(_accua_forms_json_encode(__('Do you really want to delete this form?', 'contact-forms'))); ?>);">
1714 - <input type="hidden" name="accua-form-edit-action" value="delete" />
1715 - <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $fid_esc is pre-escaped with esc_attr() ?>
1716 - <input type="hidden" name="form-id" value="<?php echo $fid_esc; ?>" />
1717 - <input type="submit" value="<?php esc_attr_e( 'Delete this form', 'contact-forms' ); ?>" />
1718 - <?php wp_nonce_field( 'contact-forms-delete_'.$fid ); ?>
1719 - </form>
1720 - <input class="button button-primary button-large accua_form_save_settings_button" id="accua_form_save_settings_top" type="button" value="<?php echo esc_attr(__( 'Save', 'contact-forms')); ?>" />
1721 - <span class="accua_form_save_settings_status"></span>
1722 - </div>
1073 + <div id="accua_tabs">
1074 + <div id="save_settings_top" class="accua_forms_save_settings_top">
1075 + <form id="delete_form" action="admin.php?page=accua_forms_list" method="POST" onsubmit="return confirm(<?php print htmlspecialchars(_accua_forms_json_encode(__('Do you really want to delete this form?', 'contact-forms')), ENT_QUOTES); ?>);">
1076 + <input type="hidden" name="accua-form-edit-action" value="delete" />
1077 + <input type="hidden" name="form-id" value="<?php echo $fid_esc; ?>" />
1078 + <input type="submit" value="<?php _e( 'Delete this form', 'contact-forms'); ?>" />
1079 + <?php wp_nonce_field( 'contact-forms-delete_'.$fid ); ?>
1080 + </form>
1081 + <?php /*<input class="button button-primary button-large accua_form_save_settings_button" id="accua_form_save_settings" type="button" value="<?php echo htmlspecialchars(__( 'Save settings', 'contact-forms'), ENT_QUOTES); ?>" /> */ ?>
1723 1082 </div>
1724 - <div id="accua_tab_fields" class="accua-tabs__panel" role="tabpanel" data-tab="fields">
1725 - <h2><?php esc_html_e( 'Drag & Drop Form Fields', 'contact-forms' ); ?></h2>
1083 + <ul id="ul_accua_tabs">
1084 + <li class="tabs"><a href="#accua_tab_fields"><?php _e( 'Fields', 'contact-forms'); ?></a></li>
1085 + <li class="tabs"><a href="#accua_tab_messages"><?php _e( 'Messages', 'contact-forms'); ?></a></li>
1086 + <?php /*<li class="tabs"><a href="#accua_tab_preview"><?php _e( 'Preview/Test', 'contact-forms'); ?></a></li> */ ?>
1087 + </ul>
1088 + <div id="accua_tab_fields" class="content_tab">
1089 + <div style="width:50%; float:left;background: #f4f4f4;">
1090 + <div style="padding: 20px;">
1091 + <input class="button button-primary button-large accua_form_save_settings_button" id="accua_form_save_settings_inside" type="button" value="<?php echo htmlspecialchars(__( 'Save', 'contact-forms'), ENT_QUOTES); ?>" />
1092 + <div id="accua_tabs2">
1093 + <ul>
1094 + <li class="tabs"><a href="#accua_tab_fields2"><?php _e( 'Fields', 'contact-forms'); ?></a></li>
1095 + <li class="tabs"><a href="#accua_tab_customise"><?php _e( 'Appearance', 'contact-forms'); ?></a></li>
1096 + </ul>
1097 + <div id="accua_tab_fields2">
1098 + <h2><?php _e( 'Drag & Drop Form Fields', 'contact-forms'); ?></h2>
1726 1099 <?php /*<a href="admin.php?page=accua_forms_fields" target="_blank"><strong><?php _e( 'Create new fields here', 'contact-forms'); ?></strong></a></p> */ ?>
1100 + <div style="width:30%; float:left;">
1727 1101 <!-- Begin available fields -->
1728 - <div class="widget-liquid-left">
1729 - <div id="widgets-left">
1102 +
1103 + <div class="widget-liquid-left" style="margin-right:0">
1104 + <!-- <div id="widgets-left"> -->
1105 + <div id="widgets-left" style="margin-right:5px;">
1730 1106 <div id="available-widgets" class="widgets-holder-wrap">
1731 - <div class="accua-form-widget-scroll-wrapper">
1732 1107 <div class="widget-holder">
1733 1108 <div id="widget-list">
1734 1109 <!-- begin fields list -->
1735 1110
@@ -1747,9 +1122,9 @@
1747 1122 'name' => __('Fieldset begin', 'contact-forms'),
1748 1123 'type' => 'fieldset-begin',
1749 1124 'description' => '',
1750 1125 );
1751 - } elseif ($field['ref'] == '__fieldset-end') {
1126 + } else if ($field['ref'] == '__fieldset-end') {
1752 1127 $ref = array(
1753 1128 'id' => '__fieldset-end',
1754 1129 'name' => __('Fieldset end', 'contact-forms'),
1755 1130 'type' => 'fieldset-end',
@@ -1758,10 +1133,8 @@
1758 1133 }
1759 1134 }
1760 1135 } else {
1761 1136 $ref = $avail_fields[$field['ref']];
1762 - if ( ! isset( $ref['id'] ) ) { $ref['id'] = $field['ref']; }
1763 - if ( ! isset( $ref['name'] ) ) { $ref['name'] = $ref['label'] ?? $field['ref']; }
1764 1137 }
1765 1138
1766 1139 //print_r($ref);
1767 1140 $form_fields_html .= accua_forms_field_text_settings_form($fid, $ref, $field);
@@ -1767,20 +1140,15 @@
1767 1140 $form_fields_html .= accua_forms_field_text_settings_form($fid, $ref, $field);
1768 1141 }
1769 1142
1770 1143
1771 - foreach ($avail_fields as $avail_field_key => $avail_field) {
1772 - if ( ! isset( $avail_field['id'] ) ) { $avail_field['id'] = $avail_field_key; }
1773 - if ( ! isset( $avail_field['name'] ) ) { $avail_field['name'] = $avail_field['label'] ?? $avail_field_key; }
1144 + foreach ($avail_fields as $avail_field) {
1774 1145 $hidden = (empty($form_data['fields'][$avail_field['id']])) ? false : 'hidden';
1775 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pre-escaped in heredoc templates
1776 1146 echo accua_forms_field_text_settings_form($fid, $avail_field, $hidden);
1777 1147 }
1778 - // Custom HTML field
1779 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pre-escaped in heredoc templates
1148 + //Custom HTML field
1780 1149 echo accua_forms_field_text_settings_form($fid);
1781 - // Fieldset begin
1782 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pre-escaped in heredoc templates
1150 + //Fieldset begin
1783 1151 echo accua_forms_field_text_settings_form($fid, array(
1784 1152 'id' => '__fieldset-begin',
1785 1153 'name' => __( 'Fieldset begin', 'contact-forms'),
1786 1154 'type' => 'fieldset-begin',
@@ -1787,10 +1155,9 @@
1787 1155 'description' => __('You can use this field multiple times.', 'contact-forms'),
1788 1156 'default_value' => '',
1789 1157 'allowed_values' => '',
1790 1158 ));
1791 - // Fieldset end
1792 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pre-escaped in heredoc templates
1159 + //Fieldset end
1793 1160 echo accua_forms_field_text_settings_form($fid, array(
1794 1161 'id' => '__fieldset-end',
1795 1162 'name' => __( 'Fieldset end', 'contact-forms'),
1796 1163 'type' => 'fieldset-end',
@@ -1804,9 +1171,8 @@
1804 1171 </div>
1805 1172
1806 1173 <br class='clear' />
1807 1174 </div>
1808 - </div>
1809 1175 <br class="clear" />
1810 1176 </div>
1811 1177
1812 1178 </div>
@@ -1811,321 +1177,200 @@
1811 1177
1812 1178 </div>
1813 1179 </div>
1814 1180 <!-- End available fields -->
1181 + </div>
1815 1182
1816 - <div class="widget-liquid-right">
1817 - <div id="widgets-right">
1183 + <div style="width:70%; float:left;" class="container">
1184 + <!--
1185 + <h3>Form Fields</h3>
1186 + <div id="form_fields_container">
1187 + </div>
1188 + -->
1189 +
1190 + <div class="widget-liquid-right" style="width:100%">
1191 + <div id="widgets-right" style="width:100%">
1818 1192 <div class="widgets-holder-wrap dashed">
1819 1193 <div class="sidebar-name">
1820 1194 <div class="sidebar-name-arrow"><br></div>
1821 - <h3><?php esc_html_e( 'Drop fields here', 'contact-forms' ); ?> <span><img alt="" title="" class="ajax-feedback" src="<?php echo esc_url( $adminurl . 'images/wpspin_light.gif' ); ?>"></span></h3>
1195 + <h3><?php _e( 'Drop fields here', 'contact-forms'); ?> <span><img alt="" title="" class="ajax-feedback" src="<?php echo $adminurl;?>images/wpspin_light.gif"></span></h3>
1822 1196 </div>
1823 - <div class="accua-form-widget-scroll-wrapper">
1824 - <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $fid_esc is pre-escaped with esc_attr() ?>
1825 1197 <div class="widgets-sortables ui-sortable" id="cimatti-accua-fields-form-area-<?php echo $fid_esc ?>">
1826 - <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $form_fields_html is built from pre-escaped heredoc templates ?>
1827 1198 <?php echo $form_fields_html; ?>
1828 1199 </div>
1829 - </div>
1830 1200 </div>
1831 1201 </div>
1832 1202 </div>
1833 - </div><!-- /panel: fields -->
1834 - <div id="accua_tab_customise" class="accua-tabs__panel" role="tabpanel" data-tab="customise">
1835 - <div class="accua-customise-columns">
1836 - <div class="accua-style-column">
1837 - <h3><?php esc_html_e( 'General', 'contact-forms' ); ?></h3>
1838 - <p id="accua_form_use_ajax"><input class="accua_form_value" type="checkbox" value="1" <?php if (!empty($form_data['use_ajax'])) {echo 'checked="checked" ';} ?>/><?php esc_html_e( 'Do not reload the page on form submission', 'contact-forms' ); ?></p>
1839 1203
1840 - <p id="accua_form_layout"><?php esc_html_e( 'Labels', 'contact-forms' ); ?> <select name="layout" class="accua_form_value">
1841 - <option value="" <?php selected( ! isset( $form_overrided_data['layout'] ) ); ?>><?php printf( /* translators: %s: current default layout label */ esc_html__( 'default (%s)', 'contact-forms' ), esc_html( accua_forms_get_layout_label( $default_form_data['layout'] ) ) ); ?></option>
1842 - <option value="sidebyside" <?php selected( isset( $form_overrided_data['layout'] ) && 'sidebyside' === $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'sidebyside' ) ); ?></option>
1843 - <option value="toplabel" <?php selected( isset( $form_overrided_data['layout'] ) && 'toplabel' === $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'toplabel' ) ); ?></option>
1844 - <option value="inlinelabel" <?php selected( isset( $form_overrided_data['layout'] ) && 'inlinelabel' === $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'inlinelabel' ) ); ?></option>
1845 - </select></p>
1204 + </div>
1205 + </div>
1206 + <div id="accua_tab_customise">
1207 + <div style="width: 48%; float:left;">
1208 + <h3><?php _e( 'General', 'contact-forms'); ?></h3>
1209 + <p id="accua_form_use_ajax"><input class="accua_form_value" type="checkbox" value="1" <?php if (!empty($form_data['use_ajax'])) {echo 'checked="checked" ';} ?>/><?php _e('Do not reload the page on form submission', 'contact-forms'); ?></p>
1846 1210
1847 - <h3><?php esc_html_e( 'Form Container', 'contact-forms' ); ?></h3>
1211 + <p id="accua_form_layout"><?php _e( 'Labels', 'contact-forms'); ?> <select name="layout" class="accua_form_value">
1212 + <option value="" <?php if (isset($form_overrided_data['layout'])) { echo 'selected="selected"'; } ?>>default (<?php if($default_form_data['layout']=='sidebyside') _e( 'Labels on the left of the fields', 'contact-forms'); else _e( 'Labels on top of the fields', 'contact-forms'); ?>)</option><option value="sidebyside" <?php if ((isset($form_overrided_data['layout'])) && ($form_data['layout'] == 'sidebyside')) { echo 'selected="selected"'; } ?>><?php _e( 'Labels on the left of the fields', 'contact-forms'); ?></option><option value="toplabel" <?php if ((isset($form_overrided_data['layout'])) && ($form_data['layout'] == 'toplabel')) { echo 'selected="selected"'; } ?>><?php _e( 'Labels on top of the fields', 'contact-forms'); ?></option></select>
1213 + </p>
1848 1214
1849 - <div class="accua-style-row" id="accua_form_style_margin">
1850 - <div class="accua-style-toggle">
1851 - <input name="accua_form_style_margin" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_margin'])) {echo 'checked="checked" ';} ?>/>
1852 - </div>
1853 - <div class="accua-style-content">
1854 - <span class="accua-style-label">margin</span>
1855 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_margin']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_margin']); ?>" />
1856 - <span class="accua-style-help"><?php esc_html_e( 'Outer spacing around the form', 'contact-forms' ); ?></span>
1857 - </div>
1215 + <div id="accua_form_style_margin" class="label_input" class="label_container">
1216 + <input name="accua_form_style_margin" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_margin'])) {echo 'checked="checked" ';} ?>/><strong><?php _e( 'Margin', 'contact-forms'); ?></strong>
1217 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_margin']); ?></div>
1218 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_margin'], ENT_QUOTES) ?>" />
1219 +
1858 1220 </div>
1859 1221
1860 - <div class="accua-style-row" id="accua_form_style_padding">
1861 - <div class="accua-style-toggle">
1862 - <input name="accua_form_style_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_padding'])) {echo 'checked="checked" ';} ?>/>
1863 - </div>
1864 - <div class="accua-style-content">
1865 - <span class="accua-style-label">padding</span>
1866 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_padding']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_padding']); ?>" />
1867 - <span class="accua-style-help"><?php esc_html_e( 'Inner spacing inside the form', 'contact-forms' ); ?></span>
1868 - </div>
1222 + <div class="label_input">
1223 + <div id="accua_form_style_border_color" class="label_container">
1224 + <input name="accua_form_style_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_color'])) {echo 'checked="checked" ';} ?>/><strong><?php _e( 'Border color', 'contact-forms'); ?></strong>
1225 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_border_color']); ?></div>
1226 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_color'], ENT_QUOTES) ?>" />
1227 + </div>
1228 + <div id="accua_form_style_border_width" class="label_container">
1229 + <input name="accua_form_style_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_width'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Width', 'contact-forms'); ?>
1230 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_border_width']); ?></div>
1231 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_width'], ENT_QUOTES) ?>" />
1232 + </div>
1233 + <div id="accua_form_style_border_radius" class="label_container">
1234 + <input name="accua_form_style_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_radius'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Radius', 'contact-forms'); ?>
1235 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_border_radius']); ?></div>
1236 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_radius'], ENT_QUOTES) ?>" />
1237 + </div>
1869 1238 </div>
1870 1239
1871 - <div class="accua-style-row" id="accua_form_style_background_color">
1872 - <div class="accua-style-toggle">
1873 - <input name="accua_form_style_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_background_color'])) {echo 'checked="checked" ';} ?>/>
1874 - </div>
1875 - <div class="accua-style-content">
1876 - <span class="accua-style-label">background-color</span>
1877 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_background_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_background_color']); ?>" />
1878 - <span class="accua-style-help"><?php esc_html_e( 'Form background fill', 'contact-forms' ); ?></span>
1879 - </div>
1880 - </div>
1240 + <div class="label_input">
1241 + <div id="accua_form_style_background_color" class="label_container">
1242 + <input name="accua_form_style_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_background_color'])) {echo 'checked="checked" ';} ?>/><strong><?php _e( 'Background', 'contact-forms'); ?></strong>
1243 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_background_color']); ?></div>
1244 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_background_color'], ENT_QUOTES) ?>" />
1245 + </div>
1881 1246
1882 - <div class="accua-style-row" id="accua_form_style_border_color">
1883 - <div class="accua-style-toggle">
1884 - <input name="accua_form_style_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_color'])) {echo 'checked="checked" ';} ?>/>
1885 - </div>
1886 - <div class="accua-style-content">
1887 - <span class="accua-style-label">border-color</span>
1888 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_border_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_border_color']); ?>" />
1889 - <span class="accua-style-help"><?php esc_html_e( 'Form border color', 'contact-forms' ); ?></span>
1890 - </div>
1247 + <div id="accua_form_style_padding" class="label_container">
1248 + <input name="accua_form_style_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_padding'])) {echo 'checked="checked" ';} ?>/><strong><?php _e( 'Padding', 'contact-forms'); ?></strong>
1249 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_padding']); ?></div>
1250 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_padding'], ENT_QUOTES) ?>" />
1251 + </div>
1891 1252 </div>
1253 + <div class="label_input">
1254 + <div id="accua_form_style_color" class="label_container">
1255 + <input name="accua_form_style_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_color'])) {echo 'checked="checked" ';} ?>/><strong><?php _e( 'Font', 'contact-forms'); ?></strong>
1256 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_color']); ?></div>
1257 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_color'], ENT_QUOTES) ?>" />
1258 + </div>
1892 1259
1893 - <div class="accua-style-row" id="accua_form_style_border_width">
1894 - <div class="accua-style-toggle">
1895 - <input name="accua_form_style_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_width'])) {echo 'checked="checked" ';} ?>/>
1896 - </div>
1897 - <div class="accua-style-content">
1898 - <span class="accua-style-label">border-width</span>
1899 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_border_width']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_border_width']); ?>" />
1900 - <span class="accua-style-help"><?php esc_html_e( 'Form border thickness', 'contact-forms' ); ?></span>
1901 - </div>
1260 + <div id="accua_form_style_font_size" class="label_container">
1261 + <input name="accua_form_style_font_size" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_font_size'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Size', 'contact-forms'); ?>
1262 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_font_size']); ?></div>
1263 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_font_size'], ENT_QUOTES) ?>" />
1264 + </div>
1902 1265 </div>
1903 -
1904 - <div class="accua-style-row" id="accua_form_style_border_radius">
1905 - <div class="accua-style-toggle">
1906 - <input name="accua_form_style_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_border_radius'])) {echo 'checked="checked" ';} ?>/>
1907 - </div>
1908 - <div class="accua-style-content">
1909 - <span class="accua-style-label">border-radius</span>
1910 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_border_radius']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_border_radius']); ?>" />
1911 - <span class="accua-style-help"><?php esc_html_e( 'Rounded corners', 'contact-forms' ); ?></span>
1912 - </div>
1913 1266 </div>
1267 + <div style="width: 48%; float:left;">
1914 1268
1915 - <div class="accua-style-row" id="accua_form_style_color">
1916 - <div class="accua-style-toggle">
1917 - <input name="accua_form_style_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_color'])) {echo 'checked="checked" ';} ?>/>
1918 - </div>
1919 - <div class="accua-style-content">
1920 - <span class="accua-style-label">color</span>
1921 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_color']); ?>" />
1922 - <span class="accua-style-help"><?php esc_html_e( 'Form text color', 'contact-forms' ); ?></span>
1923 - </div>
1924 - </div>
1269 + <h3><?php _e( 'Fields', 'contact-forms'); ?></h3>
1925 1270
1926 - <div class="accua-style-row" id="accua_form_style_font_size">
1927 - <div class="accua-style-toggle">
1928 - <input name="accua_form_style_font_size" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_font_size'])) {echo 'checked="checked" ';} ?>/>
1929 - </div>
1930 - <div class="accua-style-content">
1931 - <span class="accua-style-label">font-size</span>
1932 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_font_size']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_font_size']); ?>" />
1933 - <span class="accua-style-help"><?php esc_html_e( 'Base text size', 'contact-forms' ); ?></span>
1934 - </div>
1271 + <div id="accua_form_style_field_spacing" class="label_input">
1272 + <input name="accua_form_style_field_spacing" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_spacing'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Spacing', 'contact-forms'); ?>
1273 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_spacing']); ?></div>
1274 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_spacing'], ENT_QUOTES) ?>" />
1935 1275 </div>
1936 1276
1937 - </div>
1938 - <div class="accua-style-column">
1939 -
1940 - <h3><?php esc_html_e( 'Input Fields', 'contact-forms' ); ?></h3>
1941 -
1942 - <div class="accua-style-row" id="accua_form_style_field_spacing">
1943 - <div class="accua-style-toggle">
1944 - <input name="accua_form_style_field_spacing" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_spacing'])) {echo 'checked="checked" ';} ?>/>
1945 - </div>
1946 - <div class="accua-style-content">
1947 - <span class="accua-style-label">margin-bottom</span>
1948 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_spacing']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_spacing']); ?>" />
1949 - <span class="accua-style-help"><?php esc_html_e( 'Space between fields', 'contact-forms' ); ?></span>
1950 - </div>
1277 + <div id="accua_form_style_field_border_color" class="label_input">
1278 + <input name="accua_form_style_field_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Border color', 'contact-forms'); ?>
1279 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_border_color']); ?></div>
1280 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_color'], ENT_QUOTES) ?>" />
1951 1281 </div>
1952 1282
1953 - <div class="accua-style-row" id="accua_form_style_field_padding">
1954 - <div class="accua-style-toggle">
1955 - <input name="accua_form_style_field_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_padding'])) {echo 'checked="checked" ';} ?>/>
1956 - </div>
1957 - <div class="accua-style-content">
1958 - <span class="accua-style-label">padding</span>
1959 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_padding']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_padding']); ?>" />
1960 - <span class="accua-style-help"><?php esc_html_e( 'Inner spacing in inputs', 'contact-forms' ); ?></span>
1961 - </div>
1283 + <div id="accua_form_style_field_border_width" class="label_input">
1284 + <input name="accua_form_style_field_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_width'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Border width', 'contact-forms'); ?>
1285 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_border_width']); ?></div>
1286 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_width'], ENT_QUOTES) ?>" />
1962 1287 </div>
1963 1288
1964 - <div class="accua-style-row" id="accua_form_style_field_background_color">
1965 - <div class="accua-style-toggle">
1966 - <input name="accua_form_style_field_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_background_color'])) {echo 'checked="checked" ';} ?>/>
1967 - </div>
1968 - <div class="accua-style-content">
1969 - <span class="accua-style-label">background-color</span>
1970 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_background_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_background_color']); ?>" />
1971 - <span class="accua-style-help"><?php esc_html_e( 'Input field fill color', 'contact-forms' ); ?></span>
1972 - </div>
1289 + <div id="accua_form_style_field_border_radius" class="label_input">
1290 + <input name="accua_form_style_field_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_radius'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Rounded corner radius', 'contact-forms'); ?>
1291 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_border_radius']); ?></div>
1292 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_radius'], ENT_QUOTES) ?>" />
1973 1293 </div>
1974 1294
1975 - <div class="accua-style-row" id="accua_form_style_field_border_color">
1976 - <div class="accua-style-toggle">
1977 - <input name="accua_form_style_field_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_color'])) {echo 'checked="checked" ';} ?>/>
1978 - </div>
1979 - <div class="accua-style-content">
1980 - <span class="accua-style-label">border-color</span>
1981 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_border_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_border_color']); ?>" />
1982 - <span class="accua-style-help"><?php esc_html_e( 'Input border color', 'contact-forms' ); ?></span>
1983 - </div>
1295 + <div id="accua_form_style_field_background_color" class="label_input">
1296 + <input name="accua_form_style_field_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_background_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Background color', 'contact-forms'); ?>
1297 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_background_color']); ?></div>
1298 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_background_color'], ENT_QUOTES) ?>" />
1984 1299 </div>
1985 1300
1986 - <div class="accua-style-row" id="accua_form_style_field_border_width">
1987 - <div class="accua-style-toggle">
1988 - <input name="accua_form_style_field_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_width'])) {echo 'checked="checked" ';} ?>/>
1989 - </div>
1990 - <div class="accua-style-content">
1991 - <span class="accua-style-label">border-width</span>
1992 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_border_width']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_border_width']); ?>" />
1993 - <span class="accua-style-help"><?php esc_html_e( 'Input border thickness', 'contact-forms' ); ?></span>
1994 - </div>
1301 + <div id="accua_form_style_field_padding" class="label_input">
1302 + <input name="accua_form_style_field_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_padding'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Padding', 'contact-forms'); ?>
1303 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_padding']); ?></div>
1304 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_padding'], ENT_QUOTES) ?>" />
1995 1305 </div>
1996 1306
1997 - <div class="accua-style-row" id="accua_form_style_field_border_radius">
1998 - <div class="accua-style-toggle">
1999 - <input name="accua_form_style_field_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_border_radius'])) {echo 'checked="checked" ';} ?>/>
2000 - </div>
2001 - <div class="accua-style-content">
2002 - <span class="accua-style-label">border-radius</span>
2003 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_border_radius']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_border_radius']); ?>" />
2004 - <span class="accua-style-help"><?php esc_html_e( 'Input rounded corners', 'contact-forms' ); ?></span>
2005 - </div>
1307 + <div id="accua_form_style_field_color" class="label_input">
1308 + <input name="accua_form_style_field_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Text color', 'contact-forms'); ?>
1309 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_field_color']); ?></div>
1310 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_color'], ENT_QUOTES) ?>" />
2006 1311 </div>
2007 1312
2008 - <div class="accua-style-row" id="accua_form_style_field_color">
2009 - <div class="accua-style-toggle">
2010 - <input name="accua_form_style_field_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_field_color'])) {echo 'checked="checked" ';} ?>/>
2011 - </div>
2012 - <div class="accua-style-content">
2013 - <span class="accua-style-label">color</span>
2014 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_field_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_field_color']); ?>" />
2015 - <span class="accua-style-help"><?php esc_html_e( 'Input text color', 'contact-forms' ); ?></span>
2016 - </div>
2017 - </div>
2018 1313
2019 - <h3><?php esc_html_e( 'Submit Button', 'contact-forms' ); ?></h3>
1314 + <h3><?php _e( 'Submit button', 'contact-forms'); ?></h3>
2020 1315
2021 - <div class="accua-style-row" id="accua_form_style_submit_padding">
2022 - <div class="accua-style-toggle">
2023 - <input name="accua_form_style_submit_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_padding'])) {echo 'checked="checked" ';} ?>/>
2024 - </div>
2025 - <div class="accua-style-content">
2026 - <span class="accua-style-label">padding</span>
2027 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_padding']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_padding']); ?>" />
2028 - <span class="accua-style-help"><?php esc_html_e( 'Button inner spacing', 'contact-forms' ); ?></span>
2029 - </div>
1316 + <div id="accua_form_style_submit_border_color" class="label_input">
1317 + <input name="accua_form_style_submit_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Border color', 'contact-forms'); ?>
1318 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_border_color']); ?></div>
1319 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_color'], ENT_QUOTES) ?>" />
1320 + <?php _e( 'Customize', 'contact-forms'); ?>
2030 1321 </div>
2031 1322
2032 - <div class="accua-style-row" id="accua_form_style_submit_background_color">
2033 - <div class="accua-style-toggle">
2034 - <input name="accua_form_style_submit_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_background_color'])) {echo 'checked="checked" ';} ?>/>
2035 - </div>
2036 - <div class="accua-style-content">
2037 - <span class="accua-style-label">background-color</span>
2038 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_background_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_background_color']); ?>" />
2039 - <span class="accua-style-help"><?php esc_html_e( 'Button fill color', 'contact-forms' ); ?></span>
2040 - </div>
1323 + <div id="accua_form_style_submit_border_width" class="label_input">
1324 + <input name="accua_form_style_submit_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_width'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Border width', 'contact-forms'); ?>
1325 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_border_width']); ?></div>
1326 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_width'], ENT_QUOTES) ?>" />
2041 1327 </div>
2042 1328
2043 - <div class="accua-style-row" id="accua_form_style_submit_color">
2044 - <div class="accua-style-toggle">
2045 - <input name="accua_form_style_submit_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_color'])) {echo 'checked="checked" ';} ?>/>
2046 - </div>
2047 - <div class="accua-style-content">
2048 - <span class="accua-style-label">color</span>
2049 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_color']); ?>" />
2050 - <span class="accua-style-help"><?php esc_html_e( 'Button text color', 'contact-forms' ); ?></span>
2051 - </div>
1329 + <div id="accua_form_style_submit_border_radius" class="label_input">
1330 + <input name="accua_form_style_submit_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_radius'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Rounded corner radius', 'contact-forms'); ?>
1331 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_border_radius']); ?></div>
1332 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_radius'], ENT_QUOTES) ?>" />
2052 1333 </div>
2053 1334
2054 - <div class="accua-style-row" id="accua_form_style_submit_font_size">
2055 - <div class="accua-style-toggle">
2056 - <input name="accua_form_style_submit_font_size" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_font_size'])) {echo 'checked="checked" ';} ?>/>
2057 - </div>
2058 - <div class="accua-style-content">
2059 - <span class="accua-style-label">font-size</span>
2060 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_font_size']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_font_size']); ?>" />
2061 - <span class="accua-style-help"><?php esc_html_e( 'Button text size', 'contact-forms' ); ?></span>
2062 - </div>
1335 + <div id="accua_form_style_submit_background_color" class="label_input">
1336 + <input name="accua_form_style_submit_background_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_background_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Background color', 'contact-forms'); ?>
1337 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_background_color']); ?></div>
1338 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_background_color'], ENT_QUOTES) ?>" />
2063 1339 </div>
2064 1340
2065 - <div class="accua-style-row" id="accua_form_style_submit_border_color">
2066 - <div class="accua-style-toggle">
2067 - <input name="accua_form_style_submit_border_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_color'])) {echo 'checked="checked" ';} ?>/>
2068 - </div>
2069 - <div class="accua-style-content">
2070 - <span class="accua-style-label">border-color</span>
2071 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_border_color']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_border_color']); ?>" />
2072 - <span class="accua-style-help"><?php esc_html_e( 'Button border color', 'contact-forms' ); ?></span>
2073 - </div>
1341 + <div id="accua_form_style_submit_padding" class="label_input">
1342 + <input name="accua_form_style_submit_padding" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_padding'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Padding', 'contact-forms'); ?>
1343 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_padding']); ?></div>
1344 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_padding'], ENT_QUOTES) ?>" />
2074 1345 </div>
2075 1346
2076 - <div class="accua-style-row" id="accua_form_style_submit_border_width">
2077 - <div class="accua-style-toggle">
2078 - <input name="accua_form_style_submit_border_width" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_width'])) {echo 'checked="checked" ';} ?>/>
2079 - </div>
2080 - <div class="accua-style-content">
2081 - <span class="accua-style-label">border-width</span>
2082 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_border_width']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_border_width']); ?>" />
2083 - <span class="accua-style-help"><?php esc_html_e( 'Button border thickness', 'contact-forms' ); ?></span>
2084 - </div>
1347 + <div id="accua_form_style_submit_color" class="label_input">
1348 + <input name="accua_form_style_submit_color" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_color'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Text color', 'contact-forms'); ?>
1349 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_color']); ?></div>
1350 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_color'], ENT_QUOTES) ?>" />
2085 1351 </div>
2086 1352
2087 - <div class="accua-style-row" id="accua_form_style_submit_border_radius">
2088 - <div class="accua-style-toggle">
2089 - <input name="accua_form_style_submit_border_radius" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_border_radius'])) {echo 'checked="checked" ';} ?>/>
2090 - </div>
2091 - <div class="accua-style-content">
2092 - <span class="accua-style-label">border-radius</span>
2093 - <input class="accua_form_value" type="text" value="<?php echo esc_attr($form_data['style_submit_border_radius']) ?>" placeholder="<?php echo esc_attr($default_form_data['style_submit_border_radius']); ?>" />
2094 - <span class="accua-style-help"><?php esc_html_e( 'Button rounded corners', 'contact-forms' ); ?></span>
2095 - </div>
1353 + <div id="accua_form_style_submit_font_size" class="label_input">
1354 + <input name="accua_form_style_submit_font_size" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['style_submit_font_size'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Font size', 'contact-forms'); ?>
1355 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['style_submit_font_size']); ?></div>
1356 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_font_size'], ENT_QUOTES) ?>" />
2096 1357 </div>
2097 1358
1359 + <br clear="all"/>
2098 1360 </div>
2099 - </div>
2100 - </div><!-- /panel: customise -->
2101 - <div id="accua_tab_google_ads" class="accua-tabs__panel" role="tabpanel" data-tab="google_ads">
2102 - <div class="postbox">
2103 - <div class="postbox-header"><h2>Google Ads Conversion Tracking</h2></div>
2104 - <div class="inside">
2105 - <table class="form-table" role="presentation">
2106 - <tr>
2107 - <th scope="row"><label for="gads_conversion_code_input"><?php esc_html_e( 'GADS Conversion Code', 'contact-forms' ); ?></label></th>
2108 - <td>
2109 - <input type="text"
2110 - id="gads_conversion_code_input"
2111 - name="gads_conversion_tracking_code"
2112 - class="accua_form_value regular-text"
2113 - value="<?php echo esc_attr($form_data['gads_conversion_tracking_code'] ?? ''); ?>"
2114 - pattern="AW-\d+/[a-zA-Z0-9]+"
2115 - title="(es: AW-123456789/aaBBccDD)"
2116 - />
2117 - <span id="gads_code_validation_message" class="validation-message" style="display:none; color:#d63638;"></span>
2118 - <p class="description"><?php esc_html_e( 'If you want to use Google Ads Conversion Tracking Code, please enter it here.', 'contact-forms' ); ?> (es: AW-123456789/aaBBccDD)</p>
2119 - </td>
2120 - </tr>
2121 - </table>
2122 - </div>
2123 - </div>
2124 - </div><!-- /panel: google_ads -->
1361 + </div>
1362 + </div>
2125 1363
2126 - <div id="accua_form_preview_pane" class="accua-form-preview-pane">
2127 - <h2><?php esc_html_e( 'Preview', 'contact-forms' ); ?></h2>
1364 +
1365 +
1366 + </div>
1367 + </div>
1368 + <div style="width:50%; float:right;">
1369 + <div style="padding: 15px;">
1370 + <h2><?php _e('Preview', 'contact-forms'); ?>
1371 + <?php echo $accuaHelp->add_pointer('form_edit_preview'); ?>
1372 + </h2>
2128 1373 <div id="accua_form_preview_area_wrapper">
2129 1374 <?php
2130 1375 echo "<script>
2131 1376 function resizeIframe(obj) {
@@ -2132,246 +1377,164 @@
2132 1377 altezza = obj.contentWindow.document.documentElement.scrollHeight + 200;
2133 1378 obj.style.height = altezza + 'px';
2134 1379 }
2135 1380 </script>";
1381 +
2136 1382 ?>
2137 - <iframe id="accua_form_preview_area" src="admin-ajax.php?action=accua_forms_preview&fid=<?php echo esc_attr($fid);?>&_wpnonce=<?php echo esc_attr( wp_create_nonce('accua_forms_preview') ); ?>" frameborder="0" scrolling="no" onload="resizeIframe(this)" ></iframe>
1383 + <iframe id="accua_form_preview_area" src="admin-ajax.php?action=accua_forms_preview&fid=<?php echo htmlspecialchars($fid,ENT_QUOTES);?>" frameborder="0" scrolling="no" onload="resizeIframe(this)" ></iframe>
1384 + <?php //todo: posso usare lo stile del sito? font ecc ?>
2138 1385 </div>
1386 +
1387 + </div>
2139 1388 </div>
2140 1389
2141 - <div id="accua_tab_messages" class="accua-tabs__panel" role="tabpanel" data-tab="messages">
1390 + <div style="clear:both;">&nbsp;</div>
1391 +
1392 + <?php /* * / ?>
1393 + <pre>
1394 + accua_forms_form_fields_order_post: <?php echo htmlspecialchars(print_r(get_option('accua_forms_form_fields_order_post'), true)); ?>
1395 +
1396 + accua_forms_save_form_field_post: <?php echo htmlspecialchars(print_r(get_option('accua_forms_save_form_field_post'), true)); ?>
1397 +
1398 + accua_forms_saved_form_data: <?php echo htmlspecialchars(print_r($form_data, true)); ?>
1399 +
1400 + </pre>
1401 + <?php /* */ ?>
1402 +</div>
1403 + <div id="accua_tab_messages" class="content_tab">
2142 1404 <?php
2143 - $email_font_formats =
2144 - 'Arial=arial,helvetica,sans-serif;'
2145 - . 'Arial Black=arial black,avant garde,sans-serif;'
2146 - . 'Comic Sans MS=comic sans ms,sans-serif;'
2147 - . 'Courier New=courier new,courier,monospace;'
2148 - . 'Georgia=georgia,palatino,serif;'
2149 - . 'Lucida Sans=lucida sans unicode,lucida grande,sans-serif;'
2150 - . 'Tahoma=tahoma,arial,helvetica,sans-serif;'
2151 - . 'Times New Roman=times new roman,times,serif;'
2152 - . 'Trebuchet MS=trebuchet ms,geneva,sans-serif;'
2153 - . 'Verdana=verdana,geneva,sans-serif;';
2154 -
2155 1405 $settings_editor = array(
2156 1406 'teeny' => true,
2157 1407 'editor_class' => 'accua_form_value',
2158 1408 'tinymce' => array(
2159 - 'toolbar1' => 'fontselect,|,bold,italic,underline,|,bullist,numlist,|,link,unlink',
2160 - 'font_formats' => $email_font_formats,
2161 - 'content_style' => 'body { font-family: arial, helvetica, sans-serif; }',
2162 - ));
1409 + 'theme_advanced_buttons1' => 'bold,italic,underline,|,bullist,numlist,'));
2163 1410 ?>
2164 - <div class="accua-settings-grid">
2165 - <div class="postbox">
2166 - <div class="postbox-header"><h2><?php esc_html_e('1. On-screen success message', 'contact-forms'); ?></h2></div>
2167 - <div class="inside">
1411 +
1412 + <div class="metabox-holder accua-forms-metabox-holder">
1413 + <div class="postbox ">
1414 + <h3 class="hndle"><span><?php _e('1. On-screen success message', 'contact-forms'); ?></span></h3>
1415 + <div class="inside" id="dashboard_right_now">
2168 1416 <div id="accua_form_success_message">
2169 - <fieldset class="accua-radio-group">
2170 - <label><input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="0" <?php if (!isset($form_overrided_data['success_message'])) {echo ' checked ';} ?>> <?php esc_html_e( 'Use the default message', 'contact-forms' ); ?></label>
2171 - <label><input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="1" <?php if (isset($form_overrided_data['success_message']) && !isset($form_overrided_data['success_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2172 - <label><input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="-1" <?php if (isset($form_overrided_data['success_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Don\'t show any messages', 'contact-forms' ); ?></label>
2173 - </fieldset>
1417 + <input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="0" <?php if (!isset($form_overrided_data['success_message'])) {echo ' checked ';} ?>> <?php _e( 'Use the default message', 'contact-forms'); ?>
1418 + <input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="1" <?php if (isset($form_overrided_data['success_message']) && !isset($form_overrided_data['success_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Customize', 'contact-forms'); ?>
1419 + <input class="accua_form_check_override" name="accua_form_success_message" type="radio" value="-1" <?php if (isset($form_overrided_data['success_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Don\'t show any messages', 'contact-forms'); ?><br />
2174 1420 <div class="defalut_message">
2175 - <?php esc_html_e( 'Default Success message', 'contact-forms' ); ?>
2176 - <div class="defalut_content_message"><?php echo wp_kses_post( wpautop( $default_form_data['success_message'] ) ); ?></div>
1421 + <?php _e( 'Default Success message', 'contact-forms'); ?>
1422 + <div class="defalut_content_message"><?php echo wpautop($default_form_data['success_message']); ?></div>
2177 1423 </div>
2178 1424 <?php wp_editor( $form_data['success_message'] , 'accua_form_success_message_textarea' , $settings_editor); ?>
1425 + <!-- <textarea class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($form_data['success_message'], ENT_QUOTES) ?></textarea> -->
2179 1426 </div>
2180 - </div>
1427 + </div>
1428 + </div>
2181 1429 </div>
2182 1430
2183 - <div class="postbox">
2184 - <div class="postbox-header"><h2><?php esc_html_e('2. On-screen error message', 'contact-forms'); ?></h2></div>
2185 - <div class="inside">
1431 + <div class="metabox-holder accua-forms-metabox-holder">
1432 + <div class="postbox ">
1433 + <h3 class="hndle"><span><?php _e('2. On-screen error message', 'contact-forms'); ?></span></h3>
1434 + <div class="inside" id="dashboard_right_now">
2186 1435 <div id="accua_form_error_message">
2187 - <fieldset class="accua-radio-group">
2188 - <label><input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="0" <?php if (!isset($form_overrided_data['error_message'])) {echo ' checked ';} ?>> <?php esc_html_e( 'Use the default message', 'contact-forms' ); ?></label>
2189 - <label><input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="1" <?php if (isset($form_overrided_data['error_message']) && !isset($form_overrided_data['error_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2190 - <label><input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="-1" <?php if (isset($form_overrided_data['error_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Don\'t show any messages', 'contact-forms' ); ?></label>
2191 - </fieldset>
1436 + <input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="0" <?php if (!isset($form_overrided_data['error_message'])) {echo ' checked ';} ?>> <?php _e( 'Use the default message', 'contact-forms'); ?>
1437 + <input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="1" <?php if (isset($form_overrided_data['error_message']) && !isset($form_overrided_data['error_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Customize', 'contact-forms'); ?>
1438 + <input class="accua_form_check_override" name="accua_form_error_message" type="radio" value="-1" <?php if (isset($form_overrided_data['error_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Don\'t show any messages', 'contact-forms'); ?><br />
2192 1439 <div class="defalut_message">
2193 - <?php esc_html_e( 'Default error message', 'contact-forms' ); ?> <br />
2194 - <div class="defalut_content_message" ><?php echo wp_kses_post( wpautop( $default_form_data['error_message'] ) ); ?></div>
1440 + <?php _e( 'Default error message', 'contact-forms'); ?> <br />
1441 + <div class="defalut_content_message" ><?php echo wpautop($default_form_data['error_message']); ?></div>
2195 1442 </div>
2196 1443 <?php wp_editor( $form_data['error_message'] , 'accua_form_error_message_textarea' , $settings_editor); ?>
2197 1444 </div>
2198 1445 </div>
1446 + </div>
2199 1447 </div>
1448 + <br clear="all"/>
1449 + <div class="metabox-holder accua-forms-metabox-holder">
1450 + <div class="postbox ">
1451 + <h3 class="hndle"><span><?php _e('3. Email to notify administrator', 'contact-forms'); ?></span></h3>
1452 + <div class="inside" id="dashboard_right_now">
1453 + <div id="accua_form_admin_emails_to" class="label_input">
1454 + <label><?php _e('To', 'contact-forms'); ?></label>
1455 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['admin_emails_to']); ?></div>
1456 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_to'], ENT_QUOTES) ?>" />
1457 + <input name="accua_form_admin_emails_to" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['admin_emails_to'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1458 + </div>
1459 + <div id="accua_form_emails_bcc" class="label_input">
1460 + <label><?php _e('Bcc', 'contact-forms'); ?></label>
1461 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['emails_bcc']); ?></div>
1462 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_bcc'], ENT_QUOTES) ?>" />
1463 + <input name ="accua_form_emails_bcc" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_bcc'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1464 + </div>
2200 1465
2201 - <div class="postbox">
2202 - <div class="postbox-header"><h2><?php esc_html_e('3. Email to notify administrator', 'contact-forms'); ?></h2></div>
2203 - <div class="inside">
2204 - <table class="form-table" role="presentation">
2205 - <tr>
2206 - <th scope="row"><label><?php esc_html_e( 'To', 'contact-forms' ); ?></label></th>
2207 - <td id="accua_form_admin_emails_to">
2208 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['admin_emails_to']) ?>" <?php if (!isset($form_overrided_data['admin_emails_to'])) echo 'disabled'; ?> />
2209 - <label><input name="accua_form_admin_emails_to" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['admin_emails_to'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2210 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['admin_emails_to']) . '</code>' ); ?></p>
2211 - </td>
2212 - </tr>
2213 - <tr>
2214 - <th scope="row"><label><?php esc_html_e( 'Bcc', 'contact-forms' ); ?></label></th>
2215 - <td id="accua_form_emails_bcc">
2216 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['emails_bcc']) ?>" <?php if (!isset($form_overrided_data['emails_bcc'])) echo 'disabled'; ?> />
2217 - <label><input name="accua_form_emails_bcc" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_bcc'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2218 - <?php if ( ! empty( $default_form_data['emails_bcc'] ) ) { ?>
2219 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['emails_bcc']) . '</code>' ); ?></p>
2220 - <?php } ?>
2221 - </td>
2222 - </tr>
2223 - <tr>
2224 - <th scope="row"><label><?php esc_html_e( 'Subject', 'contact-forms'); ?></label></th>
2225 - <td id="accua_form_admin_emails_subject">
2226 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['admin_emails_subject']) ?>" <?php if (!isset($form_overrided_data['admin_emails_subject'])) echo 'disabled'; ?> />
2227 - <label><input name="accua_form_admin_emails_subject" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['admin_emails_subject'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2228 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['admin_emails_subject']) . '</code>' ); ?></p>
2229 - </td>
2230 - </tr>
2231 - </table>
1466 + <div id="accua_form_admin_emails_subject" class="label_input">
1467 + <label><?php _e( 'Subject', 'contact-forms'); ?></label>
1468 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['admin_emails_subject']); ?></div>
1469 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_subject'], ENT_QUOTES) ?>" />
1470 + <input name="accua_form_admin_emails_subject" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['admin_emails_subject'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1471 + </div>
2232 1472
2233 1473 <div id="accua_form_admin_emails_message">
2234 - <fieldset class="accua-radio-group">
2235 - <label><input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="0" <?php if (!isset($form_overrided_data['admin_emails_message'])) {echo ' checked ';} ?>> <?php esc_html_e( 'Use the default message', 'contact-forms' ); ?></label>
2236 - <label><input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="1" <?php if (isset($form_overrided_data['admin_emails_message']) && !isset($form_overrided_data['admin_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2237 - <label><input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="-1" <?php if (isset($form_overrided_data['admin_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Don\'t show any messages', 'contact-forms' ); ?></label>
2238 - </fieldset>
1474 + <input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="0" <?php if (!isset($form_overrided_data['admin_emails_message'])) {echo ' checked ';} ?>> <?php _e( 'Use the default message', 'contact-forms'); ?>
1475 + <input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="1" <?php if (isset($form_overrided_data['admin_emails_message']) && !isset($form_overrided_data['admin_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Customize', 'contact-forms'); ?>
1476 + <input class="accua_form_check_override" name="accua_form_admin_emails_message" type="radio" value="-1" <?php if (isset($form_overrided_data['admin_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Don\'t show any messages', 'contact-forms'); ?><br />
2239 1477 <div class="defalut_message">
2240 - <?php esc_html_e( 'Default message', 'contact-forms' ); ?>
2241 - <div class="defalut_content_message"><?php echo wp_kses_post( wpautop( $default_form_data['admin_emails_message'] ) ); ?></div>
1478 + <?php _e( 'Default message', 'contact-forms'); ?>
1479 + <div class="defalut_content_message"><?php echo wpautop($default_form_data['admin_emails_message']); ?></div>
2242 1480 </div>
2243 1481 <?php wp_editor( $form_data['admin_emails_message'] , 'accua_form_admin_emails_message_textarea' , $settings_editor); ?>
2244 1482 </div>
2245 1483
1484 + </div>
2246 1485 </div>
2247 1486 </div>
2248 1487
2249 - <div class="postbox">
2250 - <div class="postbox-header"><h2><?php esc_html_e('4. Email confirmation to the person who completed the form', 'contact-forms'); ?></h2></div>
2251 - <div class="inside">
2252 - <table class="form-table" role="presentation">
2253 - <tr>
2254 - <th scope="row"><label><?php esc_html_e( 'From name', 'contact-forms'); ?></label></th>
2255 - <td id="accua_form_emails_from_name">
2256 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['emails_from_name']) ?>" <?php if (!isset($form_overrided_data['emails_from_name'])) echo 'disabled'; ?> />
2257 - <label><input name="accua_form_emails_from_name" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_from_name'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2258 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['emails_from_name']) . '</code>' ); ?></p>
2259 - </td>
2260 - </tr>
2261 - <tr>
2262 - <th scope="row"><label><?php esc_html_e( 'From email', 'contact-forms'); ?></label></th>
2263 - <td id="accua_form_emails_from">
2264 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['emails_from']) ?>" <?php if (!isset($form_overrided_data['emails_from'])) echo 'disabled'; ?> />
2265 - <label><input name="accua_form_emails_from" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_from'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2266 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['emails_from']) . '</code>' ); ?></p>
2267 - </td>
2268 - </tr>
2269 - <tr>
2270 - <th scope="row"><label><?php esc_html_e( 'Subject', 'contact-forms'); ?></label></th>
2271 - <td id="accua_form_confirmation_emails_subject">
2272 - <input class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['confirmation_emails_subject']) ?>" <?php if (!isset($form_overrided_data['confirmation_emails_subject'])) echo 'disabled'; ?> />
2273 - <label><input name="accua_form_confirmation_emails_subject" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['confirmation_emails_subject'])) {echo 'checked="checked" ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2274 - <p class="description"><?php printf( esc_html__( 'Default: %s', 'contact-forms' ), '<code>' . esc_html($default_form_data['confirmation_emails_subject']) . '</code>' ); ?></p>
2275 - </td>
2276 - </tr>
2277 - </table>
1488 + <div class="metabox-holder accua-forms-metabox-holder">
1489 + <div class="postbox ">
1490 + <h3 class="hndle"><span><?php _e('4. Email confirmation to the person who completed the form', 'contact-forms'); ?></span></h3>
1491 + <div class="inside" id="dashboard_right_now">
1492 + <div id="accua_form_emails_from_name" class="label_input">
1493 + <label><?php _e( 'From name', 'contact-forms'); ?></label>
1494 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['emails_from_name']); ?></div>
1495 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_from_name'], ENT_QUOTES) ?>" />
1496 + <input name="accua_form_emails_from_name" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_from_name'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1497 + </div>
1498 + <div id="accua_form_emails_from" class="label_input">
1499 + <label><?php _e( 'From email', 'contact-forms'); ?></label>
1500 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['emails_from']); ?></div>
1501 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_from'], ENT_QUOTES) ?>" />
1502 + <input name="accua_form_emails_from" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['emails_from'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1503 + </div>
1504 + <div id="accua_form_confirmation_emails_subject" class="label_input">
1505 + <label><?php _e( 'Subject', 'contact-forms'); ?></label>
1506 + <div class="default_value"><?php echo htmlspecialchars($default_form_data['confirmation_emails_subject']); ?></div>
1507 + <input class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['confirmation_emails_subject'], ENT_QUOTES) ?>" />
1508 + <input name="accua_form_confirmation_emails_subject" class="accua_form_check_override" type="checkbox" value="1" <?php if (isset($form_overrided_data['confirmation_emails_subject'])) {echo 'checked="checked" ';} ?>/><?php _e( 'Customize', 'contact-forms'); ?>
1509 + </div>
2278 1510
2279 1511 <div id="accua_form_confirmation_emails_message">
2280 - <fieldset class="accua-radio-group">
2281 - <label><input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="0" <?php if (!isset($form_overrided_data['confirmation_emails_message'])) {echo ' checked ';} ?>> <?php esc_html_e( 'Use the default message', 'contact-forms' ); ?></label>
2282 - <label><input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="1" <?php if (isset($form_overrided_data['confirmation_emails_message']) && !isset($form_overrided_data['confirmation_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Customize', 'contact-forms' ); ?></label>
2283 - <label><input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="-1" <?php if (isset($form_overrided_data['confirmation_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php esc_html_e( 'Don\'t show any messages', 'contact-forms' ); ?></label>
2284 - </fieldset>
1512 + <input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="0" <?php if (!isset($form_overrided_data['confirmation_emails_message'])) {echo ' checked ';} ?>> <?php _e( 'Use the default message', 'contact-forms'); ?>
1513 + <input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="1" <?php if (isset($form_overrided_data['confirmation_emails_message']) && !isset($form_overrided_data['confirmation_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Customize', 'contact-forms'); ?>
1514 + <input class="accua_form_check_override" name="accua_form_confirmation_emails_message" type="radio" value="-1" <?php if (isset($form_overrided_data['confirmation_emails_message_no_message'])) {echo ' checked ';} ?>/> <?php _e( 'Don\'t show any messages', 'contact-forms'); ?><br />
2285 1515 <div class="defalut_message">
2286 - <?php esc_html_e( 'Default message', 'contact-forms' ); ?>
2287 - <div class="defalut_content_message"><?php echo wp_kses_post( wpautop( $default_form_data['confirmation_emails_message'] ) ); ?></div>
1516 + <?php _e( 'Default message', 'contact-forms'); ?>
1517 + <div class="defalut_content_message"><?php echo wpautop($default_form_data['confirmation_emails_message']); ?></div>
2288 1518 </div>
2289 1519 <?php wp_editor( $form_data['confirmation_emails_message'] , 'accua_form_confirmation_emails_message_textarea' , $settings_editor); ?>
2290 1520 </div>
2291 - </div>
1521 + </div>
1522 + </div>
2292 1523 </div>
2293 - </div><!-- /.accua-settings-grid -->
2294 - </div><!-- /panel: messages -->
1524 + <br clear="all"/>
2295 1525
2296 - <div id="accua_tab_tokens" class="accua-tabs__panel" role="tabpanel" data-tab="tokens">
2297 - <div class="postbox">
2298 - <div class="postbox-header"><h2><?php esc_html_e( 'Tokens', 'contact-forms' ); ?></h2></div>
2299 - <div class="inside">
2300 - <?php accua_forms_print_tokens(); ?>
2301 - </div>
2302 - </div>
2303 -</div>
1526 +<?php accua_forms_print_tokens(); ?>
2304 1527
2305 -<div id="accua_tab_retention" class="accua-tabs__panel" role="tabpanel" data-tab="retention">
2306 -<?php
2307 - $global_retention = get_option( 'accua_forms_retention_data', array() );
2308 - $global_retention = wp_parse_args( $global_retention, array( 'retention_value' => 0, 'retention_unit' => 'months', 'retention_mode' => 'anonymize' ) );
2309 - $global_val = (int) $global_retention['retention_value'];
2310 - $global_unit = $global_retention['retention_unit'];
2311 - $global_mode = $global_retention['retention_mode'];
2312 - $unit_labels = array( 'days' => __( 'days', 'contact-forms' ), 'months' => __( 'months', 'contact-forms' ), 'years' => __( 'years', 'contact-forms' ) );
2313 - $mode_labels = array( 'anonymize' => __( 'Anonymize', 'contact-forms' ), 'delete' => __( 'Delete permanently', 'contact-forms' ) );
2314 - if ( $global_val > 0 ) {
2315 - $global_summary = sprintf( '%d %s — %s', $global_val, $unit_labels[ $global_unit ] ?? $global_unit, $mode_labels[ $global_mode ] ?? $global_mode );
2316 - } else {
2317 - $global_summary = __( 'Keep indefinitely', 'contact-forms' );
2318 - }
2319 -?>
2320 - <div class="postbox">
2321 - <div class="postbox-header"><h2><?php esc_html_e('Data Retention', 'contact-forms'); ?></h2></div>
2322 - <div class="inside">
2323 - <table class="form-table" role="presentation">
2324 - <tr>
2325 - <th scope="row"><?php esc_html_e( 'Override', 'contact-forms'); ?></th>
2326 - <td>
2327 - <input type="checkbox" name="submission_retention_override" id="accua_form_retention_override" value="1" <?php checked( ! empty( $form_data['submission_retention_override'] ) ); ?> />
2328 - <label for="accua_form_retention_override"><?php esc_html_e( 'Override default data retention', 'contact-forms'); ?></label>
2329 - <p class="description"><?php
2330 - printf(
2331 - /* translators: %s: current global retention summary, e.g. "12 months — Anonymize" or "Keep indefinitely" */
2332 - esc_html__( 'Global default: %s', 'contact-forms' ),
2333 - '<strong>' . esc_html( $global_summary ) . '</strong>'
2334 - );
2335 - ?></p>
2336 - </td>
2337 - </tr>
2338 - </table>
2339 - <div id="accua_form_retention_fields" style="<?php echo empty( $form_data['submission_retention_override'] ) ? 'display:none;' : ''; ?>">
2340 - <table class="form-table" role="presentation">
2341 - <tr>
2342 - <th scope="row"><label for="submission_retention_value"><?php esc_html_e( 'Retention period', 'contact-forms'); ?></label></th>
2343 - <td>
2344 - <input type="number" id="submission_retention_value" name="submission_retention_value" min="0" step="1" value="<?php echo esc_attr( $form_data['submission_retention_value'] ); ?>" style="width: 80px;" />
2345 - <select name="submission_retention_unit" id="submission_retention_unit">
2346 - <option value="days" <?php selected( $form_data['submission_retention_unit'], 'days' ); ?>><?php esc_html_e( 'days', 'contact-forms'); ?></option>
2347 - <option value="months" <?php selected( $form_data['submission_retention_unit'], 'months' ); ?>><?php esc_html_e( 'months', 'contact-forms'); ?></option>
2348 - <option value="years" <?php selected( $form_data['submission_retention_unit'], 'years' ); ?>><?php esc_html_e( 'years', 'contact-forms'); ?></option>
2349 - </select>
2350 - <span class="description"><?php esc_html_e( '(0 = keep indefinitely)', 'contact-forms'); ?></span>
2351 - </td>
2352 - </tr>
2353 - <tr>
2354 - <th scope="row"><?php esc_html_e( 'When submissions expire', 'contact-forms'); ?></th>
2355 - <td>
2356 - <fieldset>
2357 - <label><input type="radio" name="submission_retention_mode" id="submission_retention_mode_anonymize" value="anonymize" <?php checked( $form_data['submission_retention_mode'], 'anonymize' ); ?> />
2358 - <?php esc_html_e( 'Anonymize — replace personal data with placeholders, keep submission record for statistics', 'contact-forms'); ?></label><br />
2359 - <label><input type="radio" name="submission_retention_mode" id="submission_retention_mode_delete" value="delete" <?php checked( $form_data['submission_retention_mode'], 'delete' ); ?> />
2360 - <?php esc_html_e( 'Delete — permanently remove submission records from the database', 'contact-forms'); ?></label>
2361 - </fieldset>
2362 - </td>
2363 - </tr>
2364 - </table>
2365 - </div>
2366 - </div></div>
2367 -
2368 -</div><!-- /panel: retention -->
2369 -
2370 -<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $fid_esc is pre-escaped with esc_attr() ?>
2371 1528 <input type="hidden" id="accua_form_save_settings_id" value="<?php echo $fid_esc; ?>" />
1529 +</div>
1530 +<?php /*
1531 +<div id="accua_tab_preview" class="content_tab">
1532 +</div> */?>
1533 +<p></p>
1534 +<input class="button button-primary button-large accua_form_save_settings_button" id="accua_form_save_settings_2" type="button" value="<?php _e( 'Save settings', 'contact-forms'); ?>" /> <span class="accua_form_save_settings_status"></span>
2372 1535
2373 -</div><!-- /#accua_tabs -->
1536 +</div>
2374 1537 <script>
2375 1538 jQuery('input[type=radio]').change(function() {
2376 1539 var name = jQuery(this).attr('name');
2377 1540 if (jQuery(this).val() == '1') {
@@ -2386,26 +1549,18 @@
2386 1549 jQuery('#'+name+' .wp-editor-wrap').hide();
2387 1550 }
2388 1551 });
2389 1552
2390 -jQuery('#accua_form_retention_override').on('change', function() {
2391 - jQuery('#accua_form_retention_fields').toggle(this.checked);
2392 -});
2393 -
2394 -jQuery('input[type=checkbox].accua_form_check_override').click(function() {
1553 +jQuery('input[type=checkbox]').click(function() {
2395 1554 var name = jQuery(this).attr('name');
2396 - var $container = jQuery('#'+name);
2397 1555 if (!this.checked) {
2398 - $container.find('.default_value').show();
2399 - $container.find('.accua_form_value').prop('disabled', true);
2400 - $container.find('.wp-picker-container').hide();
2401 - $container.find('.accua-style-help').hide();
1556 + jQuery('#'+name+' .default_value').show();
1557 + jQuery('#'+name+' .accua_form_value, #'+name+' .cp-color-picker').hide();
2402 1558 }
2403 1559 else {
2404 - $container.find('.default_value').hide();
2405 - $container.find('.accua_form_value').prop('disabled', false);
2406 - $container.find('.wp-picker-container').show();
2407 - $container.find('.accua-style-help').show();
1560 + jQuery('#'+name+' .default_value').hide();
1561 + jQuery('#'+name+' .accua_form_value, #'+name+' .cp-color-picker').show();
1562 + //cp-color-picker
2408 1563 }
2409 1564 });
2410 1565
2411 1566 jQuery(".token_link").click(function() {
@@ -2440,20 +1595,15 @@
2440 1595 );
2441 1596 $.each(
2442 1597 ['emails_from_name','emails_from','admin_emails_to','emails_bcc','admin_emails_subject','confirmation_emails_subject','style_margin','style_border_color','style_border_width','style_border_radius','style_background_color','style_padding','style_color','style_font_size','style_field_spacing','style_field_border_color','style_field_border_width','style_field_border_radius','style_field_background_color','style_field_padding','style_field_color','style_submit_border_color','style_submit_border_width','style_submit_border_radius','style_submit_background_color','style_submit_padding','style_submit_color','style_submit_font_size'],
2443 1598 function(i,key){
2444 - var $container = $('#accua_form_'+key);
2445 - if(!$container.find('.accua_form_check_override').is(':checked')) {
2446 - $container.find('.default_value').show();
2447 - $container.find('.accua_form_value').prop('disabled', true);
2448 - $container.find('.wp-picker-container').hide();
2449 - $container.find('.accua-style-help').hide();
1599 + if(!$('#accua_form_'+key+' .accua_form_check_override').is(':checked')) {
1600 + jQuery('#accua_form_'+key+' .default_value').show();
1601 + jQuery('#accua_form_'+key+' .accua_form_value, #accua_form_'+key+' .wp-picker-container').hide();
2450 1602 }
2451 1603 else {
2452 - $container.find('.default_value').hide();
2453 - $container.find('.accua_form_value').prop('disabled', false);
2454 - $container.find('.wp-picker-container').show();
2455 - $container.find('.accua-style-help').show();
1604 + jQuery('#accua_form_'+key+' .default_value').hide();
1605 + jQuery('#accua_form_'+key+' .accua_form_value, #accua_form_'+key+' .wp-picker-container').show();
2456 1606 }
2457 1607 });
2458 1608 $("#dialog_token").dialog({ dialogClass:'wp-dialog' ,autoOpen : false, modal : true, show : "blind", hide : "blind"});
2459 1609
@@ -2563,14 +1713,13 @@
2563 1713 */
2564 1714 }
2565 1715
2566 1716 function accua_forms_fields_get_types() {
2567 - $types = array(
1717 + return array(
2568 1718 'textfield' => __( 'Text Field', 'contact-forms'),
2569 1719 'textarea' => __( 'Text Area', 'contact-forms'),
2570 1720 'email' => __( 'Email', 'contact-forms'),
2571 1721 'autoreply_email' => __( 'Autoreply Email', 'contact-forms'),
2572 - 'telephone' => __( 'Telephone', 'contact-forms'),
2573 1722 'checkbox' => __( 'Checkbox','contact-forms'),
2574 1723 'select' => __('Select', 'contact-forms'),
2575 1724 'radio' => __( 'Radio buttons', 'contact-forms'),
2576 1725 'multiselect' => __( 'Multiple selections area', 'contact-forms'),
@@ -2586,15 +1735,8 @@
2586 1735 'password' => 'Password',
2587 1736 'password-and-confirm' => __( 'Password and password confirmation','contact-forms'),
2588 1737 'date' => __( 'Date','contact-forms'),
2589 1738 );
2590 -
2591 - /**
2592 - * Filter the available field types.
2593 - *
2594 - * @param array $types Associative array of type_id => label.
2595 - */
2596 - return apply_filters( 'accua_forms_field_types', $types );
2597 1739 }
2598 1740
2599 1741 function accua_forms_filter_date($value){
2600 1742 if (($value !== '') && preg_match('/^\d{4}-\d{2}-\d{2}$/', $value)) {
@@ -2622,10 +1764,8 @@
2622 1764 'allowed_values' => $post['form-field-allowed-values'],
2623 1765 'allowed_extensions' => '',
2624 1766 'min_date' => $post['form-field-min-of-date'],
2625 1767 'max_date' => $post['form-field-max-of-date'],
2626 - 'custom_required_message' => sanitize_text_field($post['form-field-custom-required-message']),
2627 - 'custom_format_message' => sanitize_text_field($post['form-field-custom-format-message']),
2628 1768 );
2629 1769 $valid = true;
2630 1770 $message = '';
2631 1771
@@ -2717,10 +1857,8 @@
2717 1857 'allowed_values' => '',
2718 1858 'allowed_extensions' => '',
2719 1859 'min_date' => '',
2720 1860 'max_date' => '',
2721 - 'custom_required_message' => '',
2722 - 'custom_format_message' => '',
2723 1861 );
2724 1862
2725 1863 $editing = false;
2726 1864 $adding = true;
@@ -2730,21 +1868,19 @@
2730 1868 $post = stripslashes_deep($_POST) + $default_form_values;
2731 1869 switch($post['action']) {
2732 1870 case 'edit-form-field':
2733 1871 if (empty($avail_fields[$post['form-field-id']])) {
2734 - $message .= 'Field "'.esc_html(sanitize_text_field($post['form-field-id'])).'" doesn\'t exists';
1872 + $message .= 'Field "'.htmlspecialchars(sanitize_text_field($post['form-field-id'])).'" doesn\'t exists';
2735 1873 } else {
2736 1874 if (empty($post['delete-field'])) {
2737 1875 $filtered_data = accua_forms_fields_filter_values($post, $avail_fields[$post['form-field-id']]);
2738 1876 $avail_fields[$post['form-field-id']] = $filtered_data['data'];
2739 - /* translators: %s is the field slug */
2740 - $message .= sprintf( __( 'Field "%s" updated', 'contact-forms'), esc_html($post['form-field-id']) );
1877 + $message .= sprintf( __( 'Field "%s" updated', 'contact-forms'), htmlspecialchars($post['form-field-id']) );
2741 1878 do_action('accua_forms_field_updated', $avail_fields[$post['form-field-id']]);
2742 1879 } else {
2743 1880 $deleting_field = $avail_fields[$post['form-field-id']];
2744 1881 unset ($avail_fields[$post['form-field-id']]);
2745 - /* translators: %s is the field slug */
2746 - $message .= sprintf( __( 'Field "%s" deleted', 'contact-forms'), esc_html($post['form-field-id']) );
1882 + $message .= sprintf( __( 'Field "%s" deleted', 'contact-forms'), htmlspecialchars($post['form-field-id']) );
2747 1883 do_action('accua_forms_field_deleted', $deleting_field);
2748 1884 }
2749 1885 update_option('accua_forms_avail_fields', $avail_fields);
2750 1886 }
@@ -2752,22 +1888,21 @@
2752 1888 case 'add-form-field':
2753 1889 $fill_form_fields = true;
2754 1890 $valid = true;
2755 1891 if (empty($post['form-field-id']) || !preg_match('/^[a-z0-9_-]+$/i', $post['form-field-id'])) {
2756 - $message .= "<p>".__( 'Only letters, numbers, hyphens, and underscores allowed in field slug', 'contact-forms')."</p>";
1892 + $message .= "<p>".__( 'Only letters, numbers, hyphen and underscores allowed in field identificative slug', 'contact-forms')."</p>";
2757 1893 $valid = false;
2758 1894 }
2759 1895 if(substr($post['form-field-id'], 0, 2) == '__') {
2760 - $message .= "<p>".__( 'The field slug cannot start with two underscores (__)', 'contact-forms')."</p>";
1896 + $message .= "<p>".__( 'The field identificative slug can\'t start with two underscores (__)', 'contact-forms')."</p>";
2761 1897 $valid = false;
2762 1898 }
2763 1899 if (!empty($avail_fields[$post['form-field-id']])) {
2764 - /* translators: %s is the field slug */
2765 - $message .= sprintf( __( '<p>A field with slug "%s" already exists.</p><p>Field was not added.</p>', 'contact-forms'), esc_html($post['form-field-id']) );
1900 + $message .= sprintf( __( '<p>A field with identificative slug "%s" already exists</p> Field "%s" deleted', 'contact-forms'), htmlspecialchars($post['form-field-id']) );
2766 1901 $valid = false;
2767 1902 }
2768 1903 if (strlen($post['form-field-id']) > 70) {
2769 - $message .= "<p>".__( 'The field slug cannot be longer than 70 characters', 'contact-forms')."</p>";
1904 + $message .= "<p>".__( 'The identificative slug cannot be longer than 70 characters', 'contact-forms')."</p>";
2770 1905 $valid = false;
2771 1906 }
2772 1907 $filtered_data = accua_forms_fields_filter_values($post);
2773 1908 $message .= $filtered_data['message'];
@@ -2775,10 +1910,9 @@
2775 1910 if ($valid) {
2776 1911 $fill_form_fields = false;
2777 1912 $avail_fields[$post['form-field-id']] = $filtered_data['data'];
2778 1913 update_option('accua_forms_avail_fields', $avail_fields);
2779 - /* translators: %s is the field slug */
2780 - $message .= sprintf( __( 'Field "%s" created', 'contact-forms'), esc_html($post['form-field-id']) );
1914 + $message .= sprintf( __( 'Field "%s" created', 'contact-forms'), htmlspecialchars($post['form-field-id']) );
2781 1915 do_action('accua_forms_field_added', $avail_fields[$post['form-field-id']]);
2782 1916 }
2783 1917 if ($fill_form_fields) {
2784 1918 $editing = true;
@@ -2785,14 +1919,12 @@
2785 1919 $default_form_values = $filtered_data['data'];
2786 1920 }
2787 1921 break;
2788 1922 }
2789 - } elseif (!empty($_GET['edit-fid'])) {
2790 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only field lookup
2791 - $fid = sanitize_text_field(wp_unslash($_GET['edit-fid']));
1923 + } else if (!empty($_GET['edit-fid'])) {
1924 + $fid = stripslashes($_GET['edit-fid']);
2792 1925 if (empty($avail_fields[$fid])) {
2793 - /* translators: %s is the field slug */
2794 - $message .= sprintf( __( 'Field "%s" doesn\'t exists', 'contact-forms'), esc_html($fid) );
1926 + $message .= sprintf( __( 'Field "%s" doesn\'t exists', 'contact-forms'), htmlspecialchars($fid) );
2795 1927 } else {
2796 1928 $adding = false;
2797 1929 $editing = true;
2798 1930 $default_form_values = $avail_fields[$fid] + $default_form_values;
@@ -2804,9 +1936,9 @@
2804 1936 }
2805 1937
2806 1938 ?>
2807 1939 <div id="accua_forms_fields_page" class="accua_forms_admin_page wrap nosubsub">
2808 -<h1><?php esc_html_e('Contact Forms - Fields', 'contact-forms'); ?></h1>
1940 +<h2><img src="<?php echo ACCUA_FORMS_DIR_URL.'img/cimatti-icon-20.png'; ?>"/> <?php _e('Contact Forms - Fields', 'contact-forms'); ?></h2>
2809 1941 <?php /* screen_icon(); ?>
2810 1942 <h2><?php echo esc_html( $title );
2811 1943 if ( !empty($_REQUEST['s']) )
2812 1944 printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_REQUEST['s']) ) ); ?>
@@ -2815,9 +1947,9 @@
2815 1947 <?php if ( isset($_REQUEST['message']) && ( $msg = (int) $_REQUEST['message'] ) ) : ?>
2816 1948 <div id="message" class="updated"><p><?php echo $messages[$msg]; ?></p></div>
2817 1949 <?php $_SERVER['REQUEST_URI'] = remove_query_arg(array('message'), $_SERVER['REQUEST_URI']);
2818 1950 endif; */ ?>
2819 -<div id="ajax-response"><?php echo wp_kses_post( $message ); ?></div>
1951 +<div id="ajax-response"><?php echo $message?></div>
2820 1952
2821 1953 <?php /*
2822 1954 <form class="search-form" action="" method="get">
2823 1955 <input type="hidden" name="taxonomy" value="<?php echo esc_attr($taxonomy); ?>" />
@@ -2844,12 +1976,12 @@
2844 1976 <table cellspacing="0" class="wp-list-table widefat fixed tags">
2845 1977 <thead>
2846 1978 <tr>
2847 1979 <th style="" class="manage-column column-cb check-column" id="cb" scope="col"><input type="checkbox" /></th>
2848 - <th style="" class="manage-column column-name" id="name" scope="col"><?php esc_html_e( 'Label', 'contact-forms'); ?></th>
2849 - <th style="" class="manage-column column-description" id="description" scope="col"><?php esc_html_e( 'Description', 'contact-forms'); ?></th>
2850 - <th style="" class="manage-column column-slug" id="slug" scope="col"><?php esc_html_e( 'Slug', 'contact-forms'); ?></th>
2851 - <th style="" class="manage-column column-type" id="type" scope="col"><?php esc_html_e( 'Type', 'contact-forms'); ?></th>
1980 + <th style="" class="manage-column column-name" id="name" scope="col"><?php _e( 'Label', 'contact-forms'); ?></th>
1981 + <th style="" class="manage-column column-description" id="description" scope="col"><?php _e( 'Description', 'contact-forms'); ?></th>
1982 + <th style="" class="manage-column column-slug" id="slug" scope="col"><?php _e( 'Slug', 'contact-forms'); ?></th>
1983 + <th style="" class="manage-column column-type" id="type" scope="col"><?php _e( 'Type', 'contact-forms'); ?></th>
2852 1984 </tr>
2853 1985 </thead>
2854 1986
2855 1987 <tfoot>
@@ -2854,12 +1986,12 @@
2854 1986
2855 1987 <tfoot>
2856 1988 <tr>
2857 1989 <th style="" class="manage-column column-cb check-column" scope="col"><input type="checkbox" /></th>
2858 - <th style="" class="manage-column column-name" scope="col"><?php esc_html_e( 'Label', 'contact-forms'); ?></th>
2859 - <th style="" class="manage-column column-description" scope="col"><?php esc_html_e( 'Description', 'contact-forms'); ?></th>
2860 - <th style="" class="manage-column column-slug" scope="col"><?php esc_html_e( 'Slug', 'contact-forms'); ?></th>
2861 - <th style="" class="manage-column column-type" scope="col"><?php esc_html_e( 'Type', 'contact-forms'); ?></th>
1990 + <th style="" class="manage-column column-name" scope="col"><?php _e( 'Label', 'contact-forms'); ?></th>
1991 + <th style="" class="manage-column column-description" scope="col"><?php _e( 'Description', 'contact-forms'); ?></th>
1992 + <th style="" class="manage-column column-slug" scope="col"><?php _e( 'Slug', 'contact-forms'); ?></th>
1993 + <th style="" class="manage-column column-type" scope="col"><?php _e( 'Type', 'contact-forms'); ?></th>
2862 1994 </tr>
2863 1995 </tfoot>
2864 1996
2865 1997 <tbody class="list:tag" id="the-list">
@@ -2864,14 +1996,12 @@
2864 1996
2865 1997 <tbody class="list:tag" id="the-list">
2866 1998 <?php
2867 1999 foreach ($avail_fields as $id => $field) {
2868 - $field = array_merge(array('id' => '', 'name' => '', 'type' => '', 'description' => ''), $field);
2869 2000 foreach (array('id', 'name', 'type', 'description') as $i) {
2870 - $field[$i] = esc_attr($field[$i]);
2001 + $field[$i] = htmlspecialchars($field[$i], ENT_QUOTES);
2871 2002 $field[$i] = sanitize_text_field($field[$i]);
2872 2003 }
2873 - // phpcs:disable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped -- Heredoc for HTML row with pre-escaped variables
2874 2004 echo <<<END_OF_ROW
2875 2005 <tr id="field-{$field['id']}">
2876 2006 <th class="check-column" scope="row"><input type="checkbox" /></th>
2877 2007 <td class="name column-name"><strong><a title="Edit “{$field['name']}”" href="admin.php?page=accua_forms_fields&amp;edit-fid={$field['id']}" class="row-title">{$field['name']}</a></strong><br><div class="row-actions"><span class="edit"><a href="admin.php?page=accua_forms_fields&amp;edit-fid={$field['id']}">Edit</a></span></div></td>
@@ -2879,9 +2009,8 @@
2879 2009 <td class="slug column-slug">{$field['id']}</td>
2880 2010 <td class="type column-type">{$field['type']}</td>
2881 2011 </tr>
2882 2012 END_OF_ROW;
2883 - // phpcs:enable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
2884 2013 }
2885 2014 ?>
2886 2015 </tbody>
2887 2016 </table>
@@ -2944,9 +2073,9 @@
2944 2073
2945 2074 $types = accua_forms_fields_get_types();
2946 2075 ?>
2947 2076 <div class="form-wrap">
2948 -<h3><?php echo $adding ? esc_html__( 'Add new field', 'contact-forms' ) : esc_html__( 'Edit field', 'contact-forms' ); ?></h3>
2077 +<h3><?php echo $adding? __( 'Add new field','contact-forms'): __( 'Edit field','contact-forms') ; ?></h3>
2949 2078 <form id="addtag" method="post" action="admin.php?page=accua_forms_fields" class="validate">
2950 2079 <input type="hidden" name="action" value="<?php echo $adding?'add':'edit'; ?>-form-field" />
2951 2080 <?php /*
2952 2081 <input type="hidden" name="screen" value="<?php echo esc_attr($current_screen->id); ?>" />
@@ -2955,21 +2084,21 @@
2955 2084 */ ?>
2956 2085 <?php wp_nonce_field('edit_form_field', '_wpnonce_edit_form_field'); ?>
2957 2086
2958 2087 <div class="form-field form-required">
2959 - <label for="tag-name"><?php esc_html_e( 'Field label', 'contact-forms'); ?></label>
2960 - <input name="form-field-name" id="tag-name" type="text" value="<?php echo esc_attr($default_form_values['name']) ?>" size="40" aria-required="true" />
2961 - <p><?php esc_html_e('The name is how it appears on your site.', 'contact-forms'); ?></p>
2088 + <label for="tag-name"><?php _e( 'Field label', 'contact-forms'); ?></label>
2089 + <input name="form-field-name" id="tag-name" type="text" value="<?php echo htmlspecialchars($default_form_values['name'], ENT_QUOTES) ?>" size="40" aria-required="true" />
2090 + <p><?php _e('The name is how it appears on your site.', 'contact-forms'); ?></p>
2962 2091 </div>
2963 2092 <?php /* if ( ! global_terms_enabled() ) : */ ?>
2964 2093 <div class="form-field">
2965 - <label for="tag-slug"><?php esc_html_e( 'Field slug (identifier)', 'contact-forms'); ?></label>
2966 - <input name="form-field-id" id="tag-slug" type="text" value="<?php echo esc_attr($default_form_values['id']) ?>" <?php if (!$adding) { echo 'disabled="disabled"'; } ?> size="40" />
2967 - <?php if (!$adding) { echo '<input type="hidden" name="form-field-id" value="'.esc_attr($default_form_values['id']).'" />'; } ?>
2968 - <p><?php esc_html_e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is used as a unique identifier and cannot be changed. It is usually all lowercase and must contain only letters, numbers, and underscores.', 'contact-forms'); ?></p>
2094 + <label for="tag-slug"><?php _e( 'Field slug (identificative)', 'contact-forms'); ?></label>
2095 + <input name="form-field-id" id="tag-slug" type="text" value="<?php echo htmlspecialchars($default_form_values['id'], ENT_QUOTES) ?>" <?php if (!$adding) { echo 'disabled="disabled"'; } ?> size="40" />
2096 + <?php if (!$adding) { echo '<input type="hidden" name="form-field-id" value="'.htmlspecialchars($default_form_values['id'], ENT_QUOTES).'" />'; } ?>
2097 + <p><?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is used as an identificator, and is unchangeable. It is usually all lowercase and it must contains only letters, numbers, and underscores.', 'contact-forms'); ?></p>
2969 2098 </div>
2970 2099 <div class="form-field">
2971 - <label for="parent"><?php esc_html_e( 'Field type', 'contact-forms'); ?></label>
2100 + <label for="parent"><?php _e( 'Field type', 'contact-forms'); ?></label>
2972 2101 <select class="postform" id="parent" name="form-field-type">
2973 2102 <?php /*
2974 2103 <option value="textfield" class="level-0" <?php echo ($default_form_values['type'] == 'textfield')?'selected="selected"':'';?> >Text Field</option>
2975 2104 <option value="textarea" class="level-0" <?php echo ($default_form_values['type'] == 'textarea')?'selected="selected"':'';?> >Text Area</option>
@@ -2978,13 +2107,11 @@
2978 2107 <option value="select" class="level-0" <?php echo ($default_form_values['type'] == 'select')?'selected="selected"':'';?> >Select</option>
2979 2108 */
2980 2109 foreach ($types as $typeid => $typename) {
2981 2110 $selected = ($default_form_values['type'] == $typeid)?'selected="selected"':'';
2982 - // phpcs:disable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped -- Heredoc for option element with pre-escaped variables
2983 2111 echo <<<EOT
2984 2112 <option value="{$typeid}" class="level-0" {$selected} >{$typename}</option>
2985 2113 EOT;
2986 - // phpcs:enable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
2987 2114 }
2988 2115
2989 2116 ?>
2990 2117 </select>
@@ -2999,56 +2126,42 @@
2999 2126 <?php endif; ?>
3000 2127 </div>
3001 2128 <?php endif; // is_taxonomy_hierarchical() */ ?>
3002 2129 <div class="form-field">
3003 - <label for="tag-description"><?php esc_html_e( 'Field description', 'contact-forms'); ?></label>
3004 - <textarea name="form-field-description" id="tag-description" rows="5" cols="40"><?php echo esc_textarea($default_form_values['description']) ?></textarea>
3005 - <p><?php esc_html_e('The description is not prominent by default; however, some themes may show it.', 'contact-forms'); ?></p>
2130 + <label for="tag-description"><?php _e( 'Field description', 'contact-forms'); ?></label>
2131 + <textarea name="form-field-description" id="tag-description" rows="5" cols="40"><?php echo htmlspecialchars($default_form_values['description'], ENT_QUOTES) ?></textarea>
2132 + <p><?php _e('The description is not prominent by default; however, some themes may show it.', 'contact-forms'); ?></p>
3006 2133 </div>
3007 2134
3008 2135 <div class="form-field">
3009 - <label for="form-field-default-value"><?php esc_html_e( 'Default value(s)', 'contact-forms'); ?>:</label>
3010 - <textarea name="form-field-default-value" id="form-field-default-value" rows="5" cols="40"><?php echo esc_textarea($default_form_values['default_value']) ?></textarea>
3011 - <p><?php esc_html_e( 'For multiple default values in multiple select and multiple checkboxes, use | as separator.', 'contact-forms'); ?></p>
2136 + <label for="form-field-default-value"><?php _e( 'Default value(s)', 'contact-forms'); ?>:</label>
2137 + <textarea name="form-field-default-value" id="form-field-default-value" rows="5" cols="40"><?php echo htmlspecialchars($default_form_values['default_value'], ENT_QUOTES) ?></textarea>
2138 + <p><?php _e( 'For multiple default values in multiple select and multiple checkboxes, use | as separator.', 'contact-forms'); ?></p>
3012 2139 </div>
3013 2140
3014 2141 <div class="form-field">
3015 - <label for="form-field-allowed-values"><?php esc_html_e( 'Allowed values', 'contact-forms'); ?>:</label>
3016 - <textarea rows="5" cols="40" name="form-field-allowed-values" id=form-field-allowed-values"><?php echo esc_textarea($default_form_values['allowed_values']) ?></textarea>
3017 - <p><?php esc_html_e( 'Options used in select, radio and multiple checkboxes. Enter one value per line, in the format key|label. The key is the value that will be stored in the database. The label is optional, and the key will be used as the label if no label is specified. For file fields, this indicates allowed extensions (one per line without dot)', 'contact-forms'); ?></p>
2142 + <label for="form-field-allowed-values"><?php _e( 'Allowed values', 'contact-forms'); ?>:</label>
2143 + <textarea rows="5" cols="40" name="form-field-allowed-values" id=form-field-allowed-values"><?php echo htmlspecialchars($default_form_values['allowed_values'], ENT_QUOTES) ?></textarea>
2144 + <p><?php _e( 'Options used in select, radio and multiple checkboxes. Enter one value per line, in the format key|label. The key is the value that will be stored in the database. The label is optional, and the key will be used as the label if no label is specified. For file fields, this indicates allowed extensions (one per line without dot)', 'contact-forms'); ?></p>
3018 2145 </div>
3019 2146
3020 2147 <div class="form-field">
3021 -<?php esc_html_e( 'Settings for date fields', 'contact-forms'); ?>
2148 +<?php _e( 'Settings for date fields', 'contact-forms'); ?>
3022 2149 <div class="form-field">
3023 - <label for="form-field-default-date-value"><?php esc_html_e( 'Default value', 'contact-forms'); ?>:</label>
3024 - <input type="date" name="form-field-default-date-value" id="form-field-default-date-value" value="<?php echo esc_attr($default_form_values['default_date_value']) ?>">
2150 + <label for="form-field-default-date-value"><?php _e( 'Default value', 'contact-forms'); ?>:</label>
2151 + <input type="date" name="form-field-default-date-value" id="form-field-default-date-value" value="<?php echo htmlspecialchars($default_form_values['default_date_value'], ENT_QUOTES) ?>">
3025 2152 </div>
3026 2153
3027 2154
3028 -<label for="form-field-min-of-date"><?php esc_html_e( 'Min date', 'contact-forms'); ?>:</label>
3029 -<input type="date" id="form-field-min-of-date" name="form-field-min-of-date" value="<?php echo esc_attr($default_form_values['min_date']) ?>">
2155 +<label for="form-field-min-of-date"><?php _e( 'Min date', 'contact-forms'); ?>:</label>
2156 +<input type="date" id="form-field-min-of-date" name="form-field-min-of-date" value="<?php echo htmlspecialchars($default_form_values['min_date'], ENT_QUOTES) ?>">
3030 2157
3031 -<label for="form-field-max-of-date"><?php esc_html_e( 'Max date', 'contact-forms'); ?>:</label>
3032 -<input type="date" id="form-field-max-of-date" name="form-field-max-of-date" value="<?php echo esc_attr($default_form_values['max_date']) ?>">
2158 +<label for="form-field-max-of-date"><?php _e( 'Max date', 'contact-forms'); ?>:</label>
2159 +<input type="date" id="form-field-max-of-date" name="form-field-max-of-date" value="<?php echo htmlspecialchars($default_form_values['max_date'], ENT_QUOTES) ?>">
3033 2160
3034 2161 </div>
3035 2162
3036 -<div class="form-field">
3037 - <label for="form-field-custom-required-message"><?php esc_html_e( 'Custom required message', 'contact-forms'); ?></label>
3038 - <input name="form-field-custom-required-message" id="form-field-custom-required-message" type="text" value="<?php echo esc_attr($default_form_values['custom_required_message']) ?>" />
3039 - <?php // translators: %s is the field name/label placeholder ?>
3040 - <p><?php esc_html_e('Overrides the default "required" error message for this field. Use %s for the field name. Leave blank to use the default translated message.', 'contact-forms'); ?></p>
3041 -</div>
3042 2163
3043 -<div class="form-field">
3044 - <label for="form-field-custom-format-message"><?php esc_html_e( 'Custom format message', 'contact-forms'); ?></label>
3045 - <input name="form-field-custom-format-message" id="form-field-custom-format-message" type="text" value="<?php echo esc_attr($default_form_values['custom_format_message']) ?>" />
3046 - <?php // translators: %s is the field name/label placeholder ?>
3047 - <p><?php esc_html_e('Overrides the default format error message for email and telephone fields. Use %s for the field name. Leave blank to use the default translated message.', 'contact-forms'); ?></p>
3048 -</div>
3049 -
3050 -
3051 2164 <?php
3052 2165 /*
3053 2166 if ( ! is_taxonomy_hierarchical($taxonomy) )
3054 2167 do_action('add_tag_form_fields', $taxonomy);
@@ -3088,9 +2201,9 @@
3088 2201
3089 2202 function accua_forms_settings_page() {
3090 2203 ?>
3091 2204 <div id="accua_forms_settings_page" class="accua_forms_admin_page wrap">
3092 -<h1><?php esc_html_e('Contact Forms - Default Settings', 'contact-forms'); ?></h1>
2205 +<h2><img src="<?php echo ACCUA_FORMS_DIR_URL.'img/cimatti-icon-20.png'; ?>"/> <?php _e('Contact Forms - Default Settings', 'contact-forms'); ?></h2>
3093 2206 <?php
3094 2207 $empty_form_data = array(
3095 2208 'success_message' => '',
3096 2209 'error_message' => '',
@@ -3147,16 +2260,9 @@
3147 2260 $empty_anonymize_ip_data = array(
3148 2261 'anonymize_ip_bytes' => 0,
3149 2262 );
3150 2263
3151 - $empty_retention_data = array(
3152 - 'retention_value' => 0,
3153 - 'retention_unit' => 'months',
3154 - 'retention_mode' => 'anonymize',
3155 - );
3156 -
3157 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- REQUEST_METHOD is always set by server
3158 - if ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] && ! empty( $_POST['accua_form_save_form_settings'] ) ) {
2264 + if($_SERVER['REQUEST_METHOD'] == 'POST' && !empty($_POST['accua_form_save_form_settings'])) {
3159 2265 check_admin_referer('accua_form_save_settings', '_nonce_accua_form_save_settings');
3160 2266 $post = stripslashes_deep($_POST);
3161 2267 $post += $empty_form_data;
3162 2268 $post += $empty_file_data;
@@ -3162,15 +2268,13 @@
3162 2268 $post += $empty_file_data;
3163 2269 $post += $empty_captcha_data;
3164 2270 $post += $empty_analytics_data;
3165 2271 $post += $empty_anonymize_ip_data;
3166 - $post += $empty_retention_data;
3167 2272 $form_data = array();
3168 2273 $file_data = array();
3169 2274 $captcha_data = array();
3170 2275 $analytics_data = array();
3171 2276 $anonymize_ip_data = array();
3172 - $retention_data = array();
3173 2277 foreach($empty_form_data as $key=>$val){
3174 2278 $form_data[$key] = $post[$key];
3175 2279 }
3176 2280 $form_data = accua_forms_filter_settings($form_data);
@@ -3197,9 +2301,9 @@
3197 2301 } */
3198 2302 $anonymize_ip_bytes = (int) $post['anonymize_ip_bytes'];
3199 2303 if ($anonymize_ip_bytes < 0) {
3200 2304 $anonymize_ip_bytes = 0;
3201 - } elseif ($anonymize_ip_bytes > 4) {
2305 + } else if ($anonymize_ip_bytes > 4) {
3202 2306 $anonymize_ip_bytes = 4;
3203 2307 }
3204 2308 $anonymize_ip_data['anonymize_ip_bytes'] = $anonymize_ip_bytes;
3205 2309
@@ -3208,16 +2312,10 @@
3208 2312 update_option('accua_forms_default_captcha_field_data', $captcha_data);
3209 2313 update_option('accua_forms_default_analytics_data', $analytics_data);
3210 2314 update_option('accua_forms_anonymize_ip_data', $anonymize_ip_data);
3211 2315
3212 - $retention_data['retention_value'] = max( 0, (int) $post['retention_value'] );
3213 - $retention_data['retention_unit'] = in_array( $post['retention_unit'], array( 'days', 'months', 'years' ), true ) ? $post['retention_unit'] : 'months';
3214 - $retention_data['retention_mode'] = in_array( $post['retention_mode'], array( 'anonymize', 'delete' ), true ) ? $post['retention_mode'] : 'anonymize';
3215 - update_option('accua_forms_retention_data', $retention_data);
3216 -
3217 2316 if (!empty($post['delete_previous_ip_values'])) {
3218 2317 global $wpdb;
3219 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Admin-only IP anonymization action, no caching needed
3220 2318 $wpdb->query("UPDATE `{$wpdb->prefix}accua_forms_submissions` SET afs_ip = ''");
3221 2319 }
3222 2320 } else {
3223 2321 $form_data = get_option('accua_forms_default_form_data',array()) + $empty_form_data;
@@ -3224,9 +2322,8 @@
3224 2322 $file_data = get_option('accua_forms_default_file_field_data',array()) + $empty_file_data;
3225 2323 $captcha_data = get_option('accua_forms_default_captcha_field_data',array()) + $empty_captcha_data;
3226 2324 $analytics_data = get_option('accua_forms_default_analytics_data',array()) + $empty_analytics_data;
3227 2325 $anonymize_ip_data = get_option('accua_forms_anonymize_ip_data',array()) + $empty_anonymize_ip_data;
3228 - $retention_data = get_option('accua_forms_retention_data',array()) + $empty_retention_data;
3229 2326 }
3230 2327 if ($captcha_data['recaptcha_force_v1']) {
3231 2328 $captcha_data = $empty_captcha_data;
3232 2329 }
@@ -3233,460 +2330,304 @@
3233 2330 ?>
3234 2331 <form method="post">
3235 2332 <?php wp_nonce_field('accua_form_save_settings', '_nonce_accua_form_save_settings'); ?>
3236 2333 <input type="hidden" name="accua_form_save_form_settings" value="1" />
3237 -<div id="accua_settings_tabs" class="accua-tabs accua-tabs--primary" data-default-tab="messages">
3238 - <div class="accua-tabs__tablist" role="tablist" aria-label="<?php esc_attr_e( 'Settings', 'contact-forms' ); ?>">
3239 - <button class="accua-tabs__tab" role="tab" data-tab="messages"><?php esc_html_e( 'Default Messages', 'contact-forms' ); ?></button>
3240 - <button class="accua-tabs__tab" role="tab" data-tab="integrations"><?php esc_html_e( 'Integrations', 'contact-forms' ); ?></button>
3241 - <button class="accua-tabs__tab" role="tab" data-tab="privacy"><?php esc_html_e( 'Privacy', 'contact-forms' ); ?></button>
3242 - <button class="accua-tabs__tab" role="tab" data-tab="styling"><?php esc_html_e( 'Layout & Styling', 'contact-forms' ); ?></button>
3243 - <button class="accua-tabs__tab" role="tab" data-tab="theme_helper"><?php esc_html_e( 'Theme Helper', 'contact-forms' ); ?></button>
3244 - <?php if ( current_user_can( 'manage_options' ) ) : ?>
3245 - <button class="accua-tabs__tab" role="tab" data-tab="danger_zone"><?php esc_html_e( 'Danger Zone', 'contact-forms' ); ?></button>
3246 - <?php endif; ?>
3247 - <button class="accua-tabs__tab" role="tab" data-tab="tokens"><?php esc_html_e( 'Tokens', 'contact-forms' ); ?></button>
3248 - </div>
3249 -
3250 - <div class="accua-tabs__panel" role="tabpanel" data-tab="messages">
2334 +<?php /*
2335 +<p id="accua_form_layout"><?php _e( 'Layout', 'contact-forms'); ?>: <select name="layout" class="accua_form_value"><option value="sidebyside" <?php if ($form_data['layout'] == 'sidebyside') { echo 'selected="selected"'; } ?>>Labels on the left of the fields</option><option value="toplabel" <?php if ($form_data['layout'] == 'toplabel') { echo 'selected="selected"'; } ?>>Labels on top of the fields</option></select></p>
2336 +<p id="accua_form_success_message"><?php _e( 'Success message', 'contact-forms'); ?>:<br /><textarea name="success_message" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($form_data['success_message'], ENT_QUOTES) ?></textarea></p>
2337 +<p id="accua_form_error_message"><?php _e( 'Error message', 'contact-forms'); ?>:<br /><textarea name="error_message" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($form_data['error_message'], ENT_QUOTES) ?></textarea></p>
2338 +<p id="accua_form_emails_from"><?php _e( 'Emails from', 'contact-forms'); ?>: <input name="emails_from" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_from'], ENT_QUOTES) ?>" /></p>
2339 +<p id="accua_form_admin_emails_to"><?php _e( 'Admin emails to', 'contact-forms'); ?>: <input name="admin_emails_to" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_to'], ENT_QUOTES) ?>" /></p>
2340 +<p id="accua_form_emails_bcc"><?php _e( 'Emails bcc', 'contact-forms'); ?>: <input name="emails_bcc" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_bcc'], ENT_QUOTES) ?>" /></p>
2341 +<p id="accua_form_admin_emails_subject"><?php _e( 'Admin email subject', 'contact-forms'); ?>: <input name="admin_emails_subject" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_subject'], ENT_QUOTES) ?>" /></p>
2342 +<p id="accua_form_admin_emails_message"><?php _e( 'Admin email message', 'contact-forms'); ?>:<br /><textarea name="admin_emails_message" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($form_data['admin_emails_message'], ENT_QUOTES) ?></textarea></p>
2343 +<p id="accua_form_confirmation_emails_subject"><?php _e( 'Confirmation email subject', 'contact-forms'); ?>: <input name="confirmation_emails_subject" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['confirmation_emails_subject'], ENT_QUOTES) ?>" /></p>
2344 +<p id="accua_form_confirmation_emails_message"><?php _e( 'Confirmation email message', 'contact-forms'); ?>:<br /><textarea name="confirmation_emails_message" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($form_data['confirmation_emails_message'], ENT_QUOTES) ?></textarea></p>
2345 +*/ ?>
2346 +<div id="accua_tab_messages" class="content_tab">
3251 2347 <?php
3252 - $email_font_formats =
3253 - 'Arial=arial,helvetica,sans-serif;'
3254 - . 'Arial Black=arial black,avant garde,sans-serif;'
3255 - . 'Comic Sans MS=comic sans ms,sans-serif;'
3256 - . 'Courier New=courier new,courier,monospace;'
3257 - . 'Georgia=georgia,palatino,serif;'
3258 - . 'Lucida Sans=lucida sans unicode,lucida grande,sans-serif;'
3259 - . 'Tahoma=tahoma,arial,helvetica,sans-serif;'
3260 - . 'Times New Roman=times new roman,times,serif;'
3261 - . 'Trebuchet MS=trebuchet ms,geneva,sans-serif;'
3262 - . 'Verdana=verdana,geneva,sans-serif;';
3263 -
3264 2348 $settings_editor = array(
3265 2349 'teeny' => true,
3266 2350 'editor_class' => 'accua_form_value',
3267 2351 'tinymce' => array(
3268 - 'toolbar1' => 'fontselect,|,bold,italic,underline,|,bullist,numlist,|,link,unlink',
3269 - 'font_formats' => $email_font_formats,
3270 - 'content_style' => 'body { font-family: arial, helvetica, sans-serif; }',
3271 - ));
2352 + 'theme_advanced_buttons1' => 'bold,italic,underline,|,bullist,numlist,'));
3272 2353 ?>
3273 - <div class="accua-settings-grid">
2354 + <div class="metabox-holder accua-forms-metabox-holder">
2355 + <div class="postbox ">
2356 + <h3 class="hndle"><span><?php _e('1. On-screen success message', 'contact-forms'); ?></span></h3>
2357 + <div class="inside" id="dashboard_right_now">
2358 + <div id="accua_form_success_message">
2359 + <?php wp_editor( $form_data['success_message'] , 'success_message' , $settings_editor); ?>
2360 + </div>
2361 + </div>
2362 + </div>
2363 + </div>
3274 2364
3275 - <div class="postbox">
3276 - <div class="postbox-header"><h2><?php esc_html_e('1. On-screen success message', 'contact-forms'); ?></h2></div>
3277 - <div class="inside">
3278 - <div id="accua_form_success_message">
3279 - <?php wp_editor( $form_data['success_message'] , 'success_message' , $settings_editor); ?>
2365 + <div class="metabox-holder accua-forms-metabox-holder">
2366 + <div class="postbox ">
2367 + <h3 class="hndle"><span><?php _e('2. On-screen error message', 'contact-forms'); ?></span></h3>
2368 + <div class="inside" id="dashboard_right_now">
2369 + <div id="accua_form_error_message">
2370 + <?php wp_editor( $form_data['error_message'] , 'error_message' , $settings_editor); ?>
2371 + </div>
3280 2372 </div>
3281 - <p class="accua-restore-default-wrapper">
3282 - <button type="button" class="button-link accua-restore-default-btn" data-message-type="success_message">
3283 - <?php esc_html_e('Restore default', 'contact-forms'); ?>
3284 - </button>
3285 - </p>
3286 - </div></div>
2373 + </div>
2374 + </div>
2375 + <br clear="all"/>
2376 + <div class="metabox-holder accua-forms-metabox-holder">
2377 + <div class="postbox ">
2378 + <h3 class="hndle"><span><?php _e('3. Email to notify administrator', 'contact-forms'); ?></span></h3>
2379 + <div class="inside" id="dashboard_right_now">
2380 + <div id="accua_form_admin_emails_to" class="label_input">
2381 + <label><?php _e( 'To', 'contact-forms'); ?></label>
2382 + <input name="admin_emails_to" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_to'], ENT_QUOTES) ?>" />
2383 + </div>
2384 + <br clear="all" />
2385 + <div id="accua_form_emails_bcc" class="label_input">
2386 + <label><?php _e( 'Bcc', 'contact-forms'); ?></label>
2387 + <input name="emails_bcc" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['emails_bcc'], ENT_QUOTES) ?>" />
2388 + </div>
2389 + <br clear="all" />
2390 + <div id="accua_form_admin_emails_subject" class="label_input">
2391 + <label><?php _e( 'Subject', 'contact-forms'); ?></label>
2392 + <input name="admin_emails_subject" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['admin_emails_subject'], ENT_QUOTES) ?>" />
2393 + </div>
2394 + <br clear="all" />
2395 + <div id="accua_form_admin_emails_message">
2396 + <?php wp_editor( $form_data['admin_emails_message'] , 'admin_emails_message' , $settings_editor); ?>
2397 + </div>
3287 2398
3288 - <div class="postbox">
3289 - <div class="postbox-header"><h2><?php esc_html_e('2. On-screen error message', 'contact-forms'); ?></h2></div>
3290 - <div class="inside">
3291 - <div id="accua_form_error_message">
3292 - <?php wp_editor( $form_data['error_message'] , 'error_message' , $settings_editor); ?>
3293 - </div>
3294 - <p class="accua-restore-default-wrapper">
3295 - <button type="button" class="button-link accua-restore-default-btn" data-message-type="error_message">
3296 - <?php esc_html_e('Restore default', 'contact-forms'); ?>
3297 - </button>
3298 - </p>
3299 - </div></div>
2399 + </div>
2400 + </div>
2401 + </div>
3300 2402
3301 - <div class="postbox">
3302 - <div class="postbox-header"><h2><?php esc_html_e('3. Email to notify administrator', 'contact-forms'); ?></h2></div>
3303 - <div class="inside">
3304 - <table class="form-table" role="presentation">
3305 - <tr>
3306 - <th scope="row"><label for="accua_settings_admin_emails_to"><?php esc_html_e( 'To', 'contact-forms'); ?></label></th>
3307 - <td id="accua_form_admin_emails_to"><input id="accua_settings_admin_emails_to" name="admin_emails_to" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['admin_emails_to']) ?>" /></td>
3308 - </tr>
3309 - <tr>
3310 - <th scope="row"><label for="accua_settings_emails_bcc"><?php esc_html_e( 'Bcc', 'contact-forms'); ?></label></th>
3311 - <td id="accua_form_emails_bcc"><input id="accua_settings_emails_bcc" name="emails_bcc" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['emails_bcc']) ?>" /></td>
3312 - </tr>
3313 - <tr>
3314 - <th scope="row"><label for="accua_settings_admin_emails_subject"><?php esc_html_e( 'Subject', 'contact-forms'); ?></label></th>
3315 - <td id="accua_form_admin_emails_subject"><input id="accua_settings_admin_emails_subject" name="admin_emails_subject" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['admin_emails_subject']) ?>" /></td>
3316 - </tr>
3317 - </table>
3318 - <div id="accua_form_admin_emails_message">
3319 - <?php wp_editor( $form_data['admin_emails_message'] , 'admin_emails_message' , $settings_editor); ?>
3320 - </div>
3321 - <p class="accua-restore-default-wrapper">
3322 - <button type="button" class="button-link accua-restore-default-btn" data-message-type="admin_emails">
3323 - <?php esc_html_e('Restore default', 'contact-forms'); ?>
3324 - </button>
3325 - <span class="description"><?php esc_html_e('(Restores subject and message only)', 'contact-forms'); ?></span>
3326 - </p>
3327 - </div></div>
2403 + <div class="metabox-holder accua-forms-metabox-holder">
2404 + <div class="postbox ">
2405 + <h3 class="hndle"><span><?php _e('4. Email confirmation to the person who completed the form', 'contact-forms'); ?></span></h3>
2406 + <div class="inside" id="dashboard_right_now">
2407 + <div id="accua_form_emails_from_name" class="label_input">
2408 + <label><?php _e( 'From name', 'contact-forms'); ?></label>
2409 + <input class="accua_form_value" name="emails_from_name" type="text" value="<?php echo htmlspecialchars($form_data['emails_from_name'], ENT_QUOTES) ?>" />
2410 + </div>
2411 + <div id="accua_form_emails_from" class="label_input">
2412 + <label><?php _e( 'From email', 'contact-forms'); ?></label>
2413 + <input class="accua_form_value" name="emails_from" type="text" value="<?php echo htmlspecialchars($form_data['emails_from'], ENT_QUOTES) ?>" />
2414 + </div>
2415 + <br clear="all" />
2416 + <div id="accua_form_confirmation_emails_subject" class="label_input">
2417 + <label><?php _e( 'Subject', 'contact-forms'); ?></label>
2418 + <input class="accua_form_value" type="text" name="confirmation_emails_subject" value="<?php echo htmlspecialchars($form_data['confirmation_emails_subject'], ENT_QUOTES) ?>" />
2419 + </div>
2420 + <br clear="all" />
2421 + <div id="accua_form_confirmation_emails_message">
2422 + <?php wp_editor( $form_data['confirmation_emails_message'] , 'confirmation_emails_message' , $settings_editor); ?>
2423 + </div>
2424 + </div>
2425 + </div>
2426 + </div>
2427 + <br clear="all"/>
3328 2428
3329 - <div class="postbox">
3330 - <div class="postbox-header"><h2><?php esc_html_e('4. Email confirmation to the person who completed the form', 'contact-forms'); ?></h2></div>
3331 - <div class="inside">
3332 - <table class="form-table" role="presentation">
3333 - <tr>
3334 - <th scope="row"><label for="accua_settings_emails_from_name"><?php esc_html_e( 'From name', 'contact-forms'); ?></label></th>
3335 - <td id="accua_form_emails_from_name"><input id="accua_settings_emails_from_name" class="accua_form_value regular-text" name="emails_from_name" type="text" value="<?php echo esc_attr($form_data['emails_from_name']) ?>" /></td>
3336 - </tr>
3337 - <tr>
3338 - <th scope="row"><label for="accua_settings_emails_from"><?php esc_html_e( 'From email', 'contact-forms'); ?></label></th>
3339 - <td id="accua_form_emails_from"><input id="accua_settings_emails_from" class="accua_form_value regular-text" name="emails_from" type="text" value="<?php echo esc_attr($form_data['emails_from']) ?>" /></td>
3340 - </tr>
3341 - <tr>
3342 - <th scope="row"><label for="accua_settings_confirmation_emails_subject"><?php esc_html_e( 'Subject', 'contact-forms'); ?></label></th>
3343 - <td id="accua_form_confirmation_emails_subject"><input id="accua_settings_confirmation_emails_subject" class="accua_form_value regular-text" type="text" name="confirmation_emails_subject" value="<?php echo esc_attr($form_data['confirmation_emails_subject']) ?>" /></td>
3344 - </tr>
3345 - </table>
3346 - <div id="accua_form_confirmation_emails_message">
3347 - <?php wp_editor( $form_data['confirmation_emails_message'] , 'confirmation_emails_message' , $settings_editor); ?>
3348 - </div>
3349 - <p class="accua-restore-default-wrapper">
3350 - <button type="button" class="button-link accua-restore-default-btn" data-message-type="confirmation_emails">
3351 - <?php esc_html_e('Restore default', 'contact-forms'); ?>
3352 - </button>
3353 - <span class="description"><?php esc_html_e('(Restores subject and message only)', 'contact-forms'); ?></span>
3354 - </p>
3355 - </div></div>
3356 -
3357 - </div>
3358 - </div><!-- /panel: messages -->
3359 -
3360 - <div class="accua-tabs__panel" role="tabpanel" data-tab="integrations">
3361 - <div class="accua-settings-grid">
3362 -
3363 - <div class="postbox">
3364 - <div class="postbox-header"><h2><?php esc_html_e( 'File upload default settings', 'contact-forms'); ?></h2></div>
3365 - <div class="inside">
3366 - <div id="accua_form_valid_extensions"><?php esc_html_e( 'Valid extensions', 'contact-forms'); ?> <br /><textarea name="valid_extensions" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo esc_textarea($file_data['valid_extensions']) ?></textarea>
3367 - <small><?php esc_html_e( 'List of valid extensions, without dot, one per line.', 'contact-forms'); ?></small>
2429 + <div class="metabox-holder accua-forms-metabox-holder">
2430 + <div class="postbox ">
2431 + <h3 class="hndle"><span><?php _e( 'File upload default settings', 'contact-forms'); ?></span></h3>
2432 + <div class="inside" id="dashboard_right_now">
2433 + <div id="accua_form_valid_extensions"><?php _e( 'Valid extensions', 'contact-forms'); ?> <br /><textarea name="valid_extensions" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($file_data['valid_extensions'], ENT_QUOTES) ?></textarea>
2434 + <small><?php _e( 'List of valid extensions, without dot, one per line.', 'contact-forms'); ?></small>
3368 2435 </div>
3369 - <div id="accua_form_max_size"><?php esc_html_e( 'Maximum file size:', 'contact-forms'); ?> <input name="max_size" class="accua_form_value" type="text" value="<?php echo esc_attr($file_data['max_size']) ?>" /><br />
3370 - <small><?php esc_html_e( 'You can use suffix K, M or G for kilobyte, megabyte or gigabyte.', 'contact-forms'); ?>
2436 + <div id="accua_form_max_size"><?php _e( 'Maximum file size:', 'contact-forms'); ?> <input name="max_size" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($file_data['max_size'], ENT_QUOTES) ?>" /><br />
2437 + <small><?php _e( 'You can use suffix K, M or G for kilobyte, megabyte or gigabyte.', 'contact-forms'); ?>
3371 2438 <?php
3372 2439 $server_max_size = AccuaForm_Element_File::file_upload_max_size();
3373 2440 if ($server_max_size > 0) {
3374 - esc_html_e( 'This value is limited by server upload limits of ', 'contact-forms');
3375 - echo esc_html( AccuaForm_Element_File::format_size( $server_max_size ) ) . '. ';
3376 - esc_html_e( 'If you need a greater limit you should ask to the server administrator.', 'contact-forms');
2441 + _e( 'This value is limited by server upload limits of ', 'contact-forms');
2442 + echo AccuaForm_Element_File::format_size($server_max_size).". ";
2443 + _e( 'If you need a greater limit you should ask to the server administrator.', 'contact-forms');
3377 2444 }
3378 2445 ?>
3379 2446 </small>
3380 2447 </div>
3381 2448 <?php if (current_user_can('edit_files') || current_user_can('install_plugins')) { ?>
3382 - <div id="accua_form_dest_path"><?php esc_html_e( 'Upload path', 'contact-forms');?> : <input name="dest_path" class="accua_form_value" type="text" value="<?php echo esc_attr($file_data['dest_path']) ?>" />
3383 - <small><?php esc_html_e( 'If it stars with \'/\' an absolute path is used, otherwise a path relative to the WordPress installation directory. Default value is "wp-content/uploads/accua-forms"', 'contact-forms');?>.</small>
2449 + <div id="accua_form_dest_path"><?php _e( 'Upload path', 'contact-forms');?> : <input name="dest_path" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($file_data['dest_path'], ENT_QUOTES) ?>" />
2450 + <small><?php _e( 'If it stars with \'/\' an absolute path is used, otherwise a path relative to the WordPress installation directory. Default value is "wp-content/uploads/accua-forms"', 'contact-forms');?>.</small>
3384 2451 </div>
3385 2452 <?php } ?>
3386 - </div></div>
2453 + </div>
2454 + </div>
3387 2455
3388 - <div class="postbox">
3389 - <div class="postbox-header"><h2><?php esc_html_e( 'reCaptcha settings', 'contact-forms'); ?></h2></div>
3390 - <div class="inside">
3391 - <p><?php esc_html_e( 'As reCAPTCHA v1 is discontinued, only reCAPTCHA v2 is supported', 'contact-forms');?></p>
3392 - <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML with hardcoded link is intentional ?>
2456 + <div class="postbox ">
2457 + <h3 class="hndle"><span><?php _e( 'reCaptcha settings', 'contact-forms'); ?></span></h3>
2458 + <div class="inside" id="dashboard_right_now">
2459 + <p><?php _e( 'As reCAPTCHA v1 is discontinued, only reCAPTCHA v2 is supported', 'contact-forms');?></p>
3393 2460 <p><?php echo strtr(__('Please register this site for reCAPTCHA v2 on %REGISTERURL%, then enter the keys for this site in the following fields', 'contact-forms'), array('%REGISTERURL%' => '<a href="https://www.google.com/recaptcha" target="_blank">google.com/recaptcha</a>'));?></p>
3394 - <div id="accua_form_recaptcha_public_key"><?php esc_html_e('Site key', 'contact-forms');?> : <input name="recaptcha_public_key" class="accua_form_value" type="text" value="<?php echo esc_attr($captcha_data['recaptcha_public_key']) ?>" />
2461 + <div id="accua_form_recaptcha_public_key"><?php _e('Site key', 'contact-forms');?> : <input name="recaptcha_public_key" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($captcha_data['recaptcha_public_key'], ENT_QUOTES) ?>" />
3395 2462 </div>
3396 - <div id="accua_form_recaptcha_private_key"><?php esc_html_e('Secret key', 'contact-forms');?> : <input name="recaptcha_private_key" class="accua_form_value" type="text" value="<?php echo esc_attr($captcha_data['recaptcha_private_key']) ?>" />
2463 + <div id="accua_form_recaptcha_private_key"><?php _e('Secret key', 'contact-forms');?> : <input name="recaptcha_private_key" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($captcha_data['recaptcha_private_key'], ENT_QUOTES) ?>" />
3397 2464 </div>
3398 - </div></div>
2465 + </div>
2466 + </div>
3399 2467
3400 - <div class="postbox">
3401 - <div class="postbox-header"><h2><?php esc_html_e( 'Cloudflare Turnstile settings', 'contact-forms'); ?></h2></div>
3402 - <div class="inside">
3403 - <p><?php esc_html_e( 'Cloudflare Turnstile is a modern CAPTCHA alternative that provides bot protection without frustrating user experiences.', 'contact-forms');?></p>
3404 - <?php
3405 - $turnstile_plugin_installed = function_exists('cfturnstile_field_show');
3406 - if (!$turnstile_plugin_installed) {
3407 - echo '<div class="notice notice-warning inline"><p>';
3408 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML with hardcoded link is intentional
3409 - echo strtr(__('<strong>Required Plugin:</strong> The Turnstile field requires the %PLUGINLINK% plugin to be installed and activated.', 'contact-forms'), array(
3410 - '%PLUGINLINK%' => '<a href="https://it.wordpress.org/plugins/simple-cloudflare-turnstile/" target="_blank">Simple Cloudflare Turnstile</a>'
3411 - ));
3412 - echo '</p></div>';
3413 - } else {
3414 - $turnstile_key = get_option('cfturnstile_key', '');
3415 - $turnstile_secretkey = get_option('cfturnstile_secretkey', '');
3416 - if (empty($turnstile_key) || empty($turnstile_secretkey)) {
3417 - echo '<div class="notice notice-info inline"><p>';
3418 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML with esc_url() link is intentional
3419 - echo strtr(__('The plugin is installed. Please configure your Cloudflare Turnstile keys in %SETTINGSLINK%.', 'contact-forms'), array(
3420 - '%SETTINGSLINK%' => '<a href="' . esc_url( admin_url('options-general.php?page=cfturnstile') ) . '">Settings &rarr; Cloudflare Turnstile</a>'
3421 - ));
3422 - echo '</p></div>';
3423 - } else {
3424 - echo '<div class="notice notice-success inline"><p>';
3425 - echo '✓ ' . esc_html__( 'Simple Cloudflare Turnstile plugin is installed and configured.', 'contact-forms' );
3426 - echo '</p></div>';
3427 - }
3428 - }
3429 - ?>
3430 - <p><?php esc_html_e( 'Once the Simple Cloudflare Turnstile plugin is installed and configured, you can add the Turnstile field to any form:', 'contact-forms');?></p>
3431 - <ol style="max-width: 600px;">
3432 - <li><?php esc_html_e( 'Go to Forms → Edit Form', 'contact-forms');?></li>
3433 - <li><?php esc_html_e( 'Find "Turnstile" in the Fields sidebar', 'contact-forms');?></li>
3434 - <li><?php esc_html_e( 'Drag it into your form (typically before the Submit button)', 'contact-forms');?></li>
3435 - <li><?php esc_html_e( 'Save your form', 'contact-forms');?></li>
3436 - </ol>
3437 - <p><?php esc_html_e( 'The Turnstile field gives you complete control over which forms use bot protection - simply add it to the forms that need it.', 'contact-forms');?></p>
3438 - </div></div>
3439 -
3440 - <div class="postbox">
3441 - <div class="postbox-header"><h2><?php esc_html_e( 'Track actions with Google Analytics and/or Matomo', 'contact-forms'); ?></h2></div>
3442 - <div class="inside">
2468 + <div class="postbox ">
2469 + <h3 class="hndle"><span><?php _e( 'IP address tracking', 'contact-forms'); ?></span></h3>
2470 + <div class="inside" id="dashboard_accua_form_anonymize_ip_addresses">
3443 2471 <p>
3444 - <input type="checkbox" id="accua_form_analytics_track_submit" name="analytics_track_submit" class="accua_form_value" value="1" <?php if($analytics_data['analytics_track_submit']) { echo 'checked="checked"'; } ?> />
3445 - <label for="accua_form_analytics_track_submit"><?php esc_html_e('Track submissions', 'contact-forms');?></label>
2472 + <?php _e("Select how many bytes of the visitor's IPs should be masked.", 'contact-forms');?>
3446 2473 </p>
3447 2474 <p>
3448 - <input type="checkbox" id="accua_form_analytics_track_fields" name="analytics_track_fields" class="accua_form_value" value="1" <?php if($analytics_data['analytics_track_fields']) { echo 'checked="checked"'; } ?> />
3449 - <label for="accua_form_analytics_track_fields"><?php esc_html_e('Track fields filled in', 'contact-forms');?></label>
3450 - </p>
3451 - </div></div>
3452 -
3453 - </div>
3454 - </div><!-- /panel: integrations -->
3455 -
3456 - <div class="accua-tabs__panel" role="tabpanel" data-tab="privacy">
3457 -
3458 - <div class="postbox">
3459 - <div class="postbox-header"><h2><?php esc_html_e( 'IP address tracking', 'contact-forms'); ?></h2></div>
3460 - <div class="inside">
3461 - <p>
3462 - <?php esc_html_e("Select how many bytes of the visitor's IPs should be masked.", 'contact-forms');?>
3463 - </p>
3464 - <p>
3465 2475 <input type="radio" name="anonymize_ip_bytes" id="anonymize_ip_bytes_0" value="0" <?php if($anonymize_ip_data['anonymize_ip_bytes'] == 0) { echo 'checked="checked"'; } ?> />
3466 - <label for="anonymize_ip_bytes_0"><?php esc_html_e('No mask - e.g. 192.168.1.1', 'contact-forms');?></label><br />
2476 + <label for="anonymize_ip_bytes_0"><?php _e('No mask - e.g. 192.168.1.1', 'contact-forms');?></label><br />
3467 2477 </p>
3468 2478 <p>
3469 2479 <input type="radio" name="anonymize_ip_bytes" id="anonymize_ip_bytes_1" value="1" <?php if($anonymize_ip_data['anonymize_ip_bytes'] == 1) { echo 'checked="checked"'; } ?> />
3470 - <label for="anonymize_ip_bytes_1"><?php esc_html_e('1 byte - e.g. 192.168.1.xxx', 'contact-forms');?></label><br />
2480 + <label for="anonymize_ip_bytes_1"><?php _e('1 byte - e.g. 192.168.1.xxx', 'contact-forms');?></label><br />
3471 2481 </p>
3472 2482 <p>
3473 2483 <input type="radio" name="anonymize_ip_bytes" id="anonymize_ip_bytes_2" value="2" <?php if($anonymize_ip_data['anonymize_ip_bytes'] == 2) { echo 'checked="checked"'; } ?> />
3474 - <label for="anonymize_ip_bytes_2"><?php esc_html_e('2 byte - e.g. 192.168.xxx.xxx', 'contact-forms');?></label><br />
2484 + <label for="anonymize_ip_bytes_2"><?php _e('2 byte - e.g. 192.168.xxx.xxx', 'contact-forms');?></label><br />
3475 2485 </p>
3476 2486 <p>
3477 2487 <input type="radio" name="anonymize_ip_bytes" id="anonymize_ip_bytes_3" value="3" <?php if($anonymize_ip_data['anonymize_ip_bytes'] == 3) { echo 'checked="checked"'; } ?> />
3478 - <label for="anonymize_ip_bytes_3"><?php esc_html_e('3 byte - e.g. 192.xxx.xxx.xxx', 'contact-forms');?></label><br />
2488 + <label for="anonymize_ip_bytes_3"><?php _e('3 byte - e.g. 192.xxx.xxx.xxx', 'contact-forms');?></label><br />
3479 2489 </p>
3480 2490 <p>
3481 2491 <input type="radio" name="anonymize_ip_bytes" id="anonymize_ip_bytes_4" value="4" <?php if($anonymize_ip_data['anonymize_ip_bytes'] == 4) { echo 'checked="checked"'; } ?> />
3482 - <label for="anonymize_ip_bytes_4"><?php esc_html_e('Fully mask IP address', 'contact-forms');?></label><br />
2492 + <label for="anonymize_ip_bytes_4"><?php _e('Fully mask IP address', 'contact-forms');?></label><br />
3483 2493 </p>
3484 - <h4><?php esc_html_e( 'Delete IP addresses', 'contact-forms'); ?></h4>
2494 + <h4><?php _e( 'Delete IP addresses', 'contact-forms'); ?></h4>
3485 2495 <p>
3486 2496 <input type="checkbox" id="delete_previous_ip_values" name="delete_previous_ip_values" class="accua_form_value" value="1" />
3487 - <label for="delete_previous_ip_values"><?php esc_html_e('Delete all previous IP values', 'contact-forms');?></label><br />
2497 + <label for="delete_previous_ip_values"><?php _e('Delete all previous IP values', 'contact-forms');?></label><br />
3488 2498 </p>
3489 - </div></div>
2499 + <br clear="all">
2500 + </div>
2501 + </div>
3490 2502
3491 - <div class="postbox">
3492 - <div class="postbox-header"><h2><?php esc_html_e( 'Data retention', 'contact-forms'); ?></h2></div>
3493 - <div class="inside">
3494 - <p><?php esc_html_e( 'Automatically anonymize or delete form submissions after a specified period. Set to 0 to keep submissions indefinitely.', 'contact-forms'); ?></p>
2503 + <div class="postbox ">
2504 + <h3 class="hndle"><span><?php _e( 'Track actions with Google Analytics', 'contact-forms'); ?></span></h3>
2505 + <div class="inside" id="dashboard_right_now">
3495 2506 <p>
3496 - <label for="retention_value"><?php esc_html_e( 'Retention period', 'contact-forms'); ?></label>
3497 - <input type="number" id="retention_value" name="retention_value" min="0" step="1" value="<?php echo esc_attr( $retention_data['retention_value'] ); ?>" style="width: 80px;" />
3498 - <select name="retention_unit" id="retention_unit">
3499 - <option value="days" <?php selected( $retention_data['retention_unit'], 'days' ); ?>><?php esc_html_e( 'days', 'contact-forms'); ?></option>
3500 - <option value="months" <?php selected( $retention_data['retention_unit'], 'months' ); ?>><?php esc_html_e( 'months', 'contact-forms'); ?></option>
3501 - <option value="years" <?php selected( $retention_data['retention_unit'], 'years' ); ?>><?php esc_html_e( 'years', 'contact-forms'); ?></option>
3502 - </select>
2507 + <input type="checkbox" id="accua_form_analytics_track_submit" name="analytics_track_submit" class="accua_form_value" value="1" <?php if($analytics_data['analytics_track_submit']) { echo 'checked="checked"'; } ?> />
2508 + <label for="accua_form_analytics_track_submit"><?php _e('Track submissions', 'contact-forms');?></label>
3503 2509 </p>
3504 2510 <p>
3505 - <strong><?php esc_html_e( 'When submissions expire:', 'contact-forms'); ?></strong><br />
3506 - <input type="radio" name="retention_mode" id="retention_mode_anonymize" value="anonymize" <?php checked( $retention_data['retention_mode'], 'anonymize' ); ?> />
3507 - <label for="retention_mode_anonymize"><?php esc_html_e( 'Anonymize — replace personal data with placeholders, keep submission record for statistics', 'contact-forms'); ?></label><br />
3508 - <input type="radio" name="retention_mode" id="retention_mode_delete" value="delete" <?php checked( $retention_data['retention_mode'], 'delete' ); ?> />
3509 - <label for="retention_mode_delete"><?php esc_html_e( 'Delete — permanently remove submission records from the database', 'contact-forms'); ?></label>
2511 + <input type="checkbox" id="accua_form_analytics_track_fields" name="analytics_track_fields" class="accua_form_value" value="1" <?php if($analytics_data['analytics_track_fields']) { echo 'checked="checked"'; } ?> />
2512 + <label for="accua_form_analytics_track_fields"><?php _e('Track fields filled in', 'contact-forms');?></label>
3510 2513 </p>
3511 - <p class="description"><?php esc_html_e( 'Individual forms can override this setting in the form editor.', 'contact-forms'); ?></p>
3512 - <p class="description"><?php
3513 - /* translators: %s: URL to the WordPress Erase Personal Data tool */
3514 - printf( esc_html__( 'To manually erase data for a specific person, use the WordPress %s tool.', 'contact-forms'),
3515 - '<a href="' . esc_url( admin_url( 'erase-personal-data.php' ) ) . '">' . esc_html__( 'Erase Personal Data', 'contact-forms') . '</a>'
3516 - );
3517 - ?></p>
3518 - </div></div>
2514 + </div>
2515 + </div>
3519 2516
3520 - </div><!-- /panel: privacy -->
2517 + </div>
3521 2518
3522 - <div class="accua-tabs__panel" role="tabpanel" data-tab="styling">
3523 - <div class="accua-settings-grid">
2519 + <div class="metabox-holder accua-forms-metabox-holder">
2520 + <div class="postbox ">
2521 + <h3 class="hndle"><span><?php _e( 'Layout &amp; Styling', 'contact-forms'); ?></span></h3>
2522 + <div class="inside" id="dashboard_right_now">
2523 + <p><?php _e( 'Customize the look and feel of your forms. Leave fields empty if you wish to use the native styles of your WordPress Theme.', 'contact-forms'); ?><p>
2524 + <h4><?php _e( 'Forms', 'contact-forms'); ?></h4>
2525 + <div id="accua_form_layout"> <?php _e( 'Layout', 'contact-forms'); ?>
2526 + <select name="layout" class="accua_form_value"><option value="sidebyside" <?php if ($form_data['layout'] == 'sidebyside') { echo 'selected="selected"'; } ?>>Labels on the left of the fields</option><option value="toplabel" <?php if ($form_data['layout'] == 'toplabel') { echo 'selected="selected"'; } ?>>Labels on top of the fields</option></select>
2527 + </div>
2528 + <div id="accua_form_style_margin" class="label_input">
2529 + <label><?php _e( 'Margin', 'contact-forms'); ?></label>
2530 + <input name="style_margin" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_margin'], ENT_QUOTES) ?>" />
2531 + </div>
2532 + <div id="accua_form_style_border_color" class="label_input">
2533 + <label><?php _e( 'Border color', 'contact-forms'); ?></label>
2534 + <input name="style_border_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_color'], ENT_QUOTES) ?>" />
2535 + </div>
2536 + <div id="accua_form_style_border_width" class="label_input">
2537 + <label><?php _e( 'Border width', 'contact-forms'); ?></label>
2538 + <input name="style_border_width" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_width'], ENT_QUOTES) ?>" />
2539 + </div>
2540 + <div id="accua_form_style_border_radius" class="label_input">
2541 + <label><?php _e( 'Rounded corner radius', 'contact-forms'); ?></label>
2542 + <input name="style_border_radius" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_border_radius'], ENT_QUOTES) ?>" />
2543 + </div>
2544 + <div id="accua_form_style_background_color" class="label_input">
2545 + <label><?php _e( 'Background color', 'contact-forms'); ?></label>
2546 + <input name="style_background_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_background_color'], ENT_QUOTES) ?>" />
2547 + </div>
2548 + <div id="accua_form_style_padding" class="label_input">
2549 + <label><?php _e( 'Padding', 'contact-forms'); ?></label>
2550 + <input name="style_padding" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_padding'], ENT_QUOTES) ?>" />
2551 + </div>
2552 + <div id="accua_form_style_color" class="label_input">
2553 + <label><?php _e( 'Text color', 'contact-forms'); ?></label>
2554 + <input name="style_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_color'], ENT_QUOTES) ?>" />
2555 + </div>
2556 + <div id="accua_form_style_font_size" class="label_input">
2557 + <label><?php _e( 'Font size', 'contact-forms'); ?></label>
2558 + <input name="style_font_size" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_font_size'], ENT_QUOTES) ?>" />
2559 + </div>
3524 2560
3525 - <div class="postbox">
3526 - <div class="postbox-header"><h2><?php esc_html_e( 'Form Container', 'contact-forms'); ?></h2></div>
3527 - <div class="inside">
3528 - <table class="form-table" role="presentation">
3529 - <tr>
3530 - <th scope="row"><label for="accua_form_layout_select"><?php esc_html_e( 'Layout', 'contact-forms'); ?></label></th>
3531 - <td>
3532 - <select id="accua_form_layout_select" name="layout" class="accua_form_value">
3533 - <option value="sidebyside" <?php selected( 'sidebyside', $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'sidebyside' ) ); ?></option>
3534 - <option value="toplabel" <?php selected( 'toplabel', $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'toplabel' ) ); ?></option>
3535 - <option value="inlinelabel" <?php selected( 'inlinelabel', $form_data['layout'] ); ?>><?php echo esc_html( accua_forms_get_layout_label( 'inlinelabel' ) ); ?></option>
3536 - </select>
3537 - </td>
3538 - </tr>
3539 - <tr>
3540 - <th scope="row"><label for="accua_style_margin"><?php esc_html_e( 'Margin', 'contact-forms'); ?></label></th>
3541 - <td><input id="accua_style_margin" name="style_margin" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['style_margin']) ?>" /></td>
3542 - </tr>
3543 - <tr>
3544 - <th scope="row"><label for="accua_style_border_color"><?php esc_html_e( 'Border color', 'contact-forms'); ?></label></th>
3545 - <td><input id="accua_style_border_color" name="style_border_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_border_color']) ?>" /></td>
3546 - </tr>
3547 - <tr>
3548 - <th scope="row"><label for="accua_style_border_width"><?php esc_html_e( 'Border width', 'contact-forms'); ?></label></th>
3549 - <td><input id="accua_style_border_width" name="style_border_width" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_border_width']) ?>" /></td>
3550 - </tr>
3551 - <tr>
3552 - <th scope="row"><label for="accua_style_border_radius"><?php esc_html_e( 'Rounded corner radius', 'contact-forms'); ?></label></th>
3553 - <td><input id="accua_style_border_radius" name="style_border_radius" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_border_radius']) ?>" /></td>
3554 - </tr>
3555 - <tr>
3556 - <th scope="row"><label for="accua_style_background_color"><?php esc_html_e( 'Background color', 'contact-forms'); ?></label></th>
3557 - <td><input id="accua_style_background_color" name="style_background_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_background_color']) ?>" /></td>
3558 - </tr>
3559 - <tr>
3560 - <th scope="row"><label for="accua_style_padding"><?php esc_html_e( 'Padding', 'contact-forms'); ?></label></th>
3561 - <td><input id="accua_style_padding" name="style_padding" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['style_padding']) ?>" /></td>
3562 - </tr>
3563 - <tr>
3564 - <th scope="row"><label for="accua_style_color"><?php esc_html_e( 'Text color', 'contact-forms'); ?></label></th>
3565 - <td><input id="accua_style_color" name="style_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_color']) ?>" /></td>
3566 - </tr>
3567 - <tr>
3568 - <th scope="row"><label for="accua_style_font_size"><?php esc_html_e( 'Font size', 'contact-forms'); ?></label></th>
3569 - <td><input id="accua_style_font_size" name="style_font_size" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_font_size']) ?>" /></td>
3570 - </tr>
3571 - </table>
3572 - </div></div>
2561 + <h4><?php _e( 'Fields', 'contact-forms'); ?></h4>
2562 + <div id="accua_form_style_field_spacing" class="label_input">
2563 + <label><?php _e( 'Spacing', 'contact-forms'); ?></label>
2564 + <input name="style_field_spacing" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_spacing'], ENT_QUOTES) ?>" />
2565 + </div>
2566 + <div id="accua_form_style_field_border_color" class="label_input">
2567 + <label><?php _e( 'Border color', 'contact-forms'); ?></label>
2568 + <input name="style_field_border_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_color'], ENT_QUOTES) ?>" />
2569 + </div>
2570 + <div id="accua_form_style_field_border_width" class="label_input">
2571 + <label><?php _e( 'Border width', 'contact-forms'); ?></label>
2572 + <input name="style_field_border_width" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_width'], ENT_QUOTES) ?>" />
2573 + </div>
2574 + <div id="accua_form_style_field_border_radius" class="label_input">
2575 + <label><?php _e( 'Rounded corner radius', 'contact-forms'); ?></label>
2576 + <input name="style_field_border_radius" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_border_radius'], ENT_QUOTES) ?>" />
2577 + </div>
2578 + <div id="accua_form_style_field_background_color" class="label_input">
2579 + <label><?php _e( 'Background color', 'contact-forms'); ?></label>
2580 + <input name="style_field_background_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_background_color'], ENT_QUOTES) ?>" />
2581 + </div>
2582 + <div id="accua_form_style_field_padding" class="label_input">
2583 + <label><?php _e( 'Padding', 'contact-forms'); ?></label>
2584 + <input name="style_field_padding" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_padding'], ENT_QUOTES) ?>" />
2585 + </div>
2586 + <div id="accua_form_style_field_color" class="label_input">
2587 + <label><?php _e( 'Text color', 'contact-forms'); ?></label>
2588 + <input name="style_field_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_field_color'], ENT_QUOTES) ?>" />
2589 + </div>
3573 2590
3574 - <div class="postbox">
3575 - <div class="postbox-header"><h2><?php esc_html_e( 'Fields', 'contact-forms'); ?></h2></div>
3576 - <div class="inside">
3577 - <table class="form-table" role="presentation">
3578 - <tr>
3579 - <th scope="row"><label for="accua_style_field_spacing"><?php esc_html_e( 'Spacing', 'contact-forms'); ?></label></th>
3580 - <td><input id="accua_style_field_spacing" name="style_field_spacing" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_field_spacing']) ?>" /></td>
3581 - </tr>
3582 - <tr>
3583 - <th scope="row"><label for="accua_style_field_border_color"><?php esc_html_e( 'Border color', 'contact-forms'); ?></label></th>
3584 - <td><input id="accua_style_field_border_color" name="style_field_border_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_field_border_color']) ?>" /></td>
3585 - </tr>
3586 - <tr>
3587 - <th scope="row"><label for="accua_style_field_border_width"><?php esc_html_e( 'Border width', 'contact-forms'); ?></label></th>
3588 - <td><input id="accua_style_field_border_width" name="style_field_border_width" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_field_border_width']) ?>" /></td>
3589 - </tr>
3590 - <tr>
3591 - <th scope="row"><label for="accua_style_field_border_radius"><?php esc_html_e( 'Rounded corner radius', 'contact-forms'); ?></label></th>
3592 - <td><input id="accua_style_field_border_radius" name="style_field_border_radius" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_field_border_radius']) ?>" /></td>
3593 - </tr>
3594 - <tr>
3595 - <th scope="row"><label for="accua_style_field_background_color"><?php esc_html_e( 'Background color', 'contact-forms'); ?></label></th>
3596 - <td><input id="accua_style_field_background_color" name="style_field_background_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_field_background_color']) ?>" /></td>
3597 - </tr>
3598 - <tr>
3599 - <th scope="row"><label for="accua_style_field_padding"><?php esc_html_e( 'Padding', 'contact-forms'); ?></label></th>
3600 - <td><input id="accua_style_field_padding" name="style_field_padding" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['style_field_padding']) ?>" /></td>
3601 - </tr>
3602 - <tr>
3603 - <th scope="row"><label for="accua_style_field_color"><?php esc_html_e( 'Text color', 'contact-forms'); ?></label></th>
3604 - <td><input id="accua_style_field_color" name="style_field_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_field_color']) ?>" /></td>
3605 - </tr>
3606 - </table>
3607 - </div></div>
2591 + <h4><?php _e( 'Submit button', 'contact-forms'); ?></h4>
2592 + <div id="accua_form_style_submit_border_color" class="label_input">
2593 + <label><?php _e( 'Border color', 'contact-forms'); ?></label>
2594 + <input name="style_submit_border_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_color'], ENT_QUOTES) ?>" />
2595 + </div>
2596 + <div id="accua_form_style_submit_border_width" class="label_input">
2597 + <label><?php _e( 'Border width', 'contact-forms'); ?></label>
2598 + <input name="style_submit_border_width" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_width'], ENT_QUOTES) ?>" />
2599 + </div>
2600 + <div id="accua_form_style_submit_border_radius" class="label_input">
2601 + <label><?php _e( 'Rounded corner radius', 'contact-forms'); ?></label>
2602 + <input name="style_submit_border_radius" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_border_radius'], ENT_QUOTES) ?>" />
2603 + </div>
2604 + <div id="accua_form_style_submit_background_color" class="label_input">
2605 + <label><?php _e( 'Background color', 'contact-forms'); ?></label>
2606 + <input name="style_submit_background_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_background_color'], ENT_QUOTES) ?>" />
2607 + </div>
2608 + <div id="accua_form_style_submit_padding" class="label_input">
2609 + <label><?php _e( 'Padding', 'contact-forms'); ?></label>
2610 + <input name="style_submit_padding" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_padding'], ENT_QUOTES) ?>" />
2611 + </div>
2612 + <div id="accua_form_style_submit_color" class="label_input">
2613 + <label><?php _e( 'Text color', 'contact-forms'); ?></label>
2614 + <input name="style_submit_color" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_color'], ENT_QUOTES) ?>" />
2615 + </div>
2616 + <div id="accua_form_style_submit_font_size" class="label_input">
2617 + <label><?php _e( 'Font size', 'contact-forms'); ?></label>
2618 + <input name="style_submit_font_size" class="accua_form_value" type="text" value="<?php echo htmlspecialchars($form_data['style_submit_font_size'], ENT_QUOTES) ?>" />
2619 + </div>
2620 + <br clear="all" />
2621 + </div>
2622 + </div>
2623 + </div>
3608 2624
3609 - <div class="postbox">
3610 - <div class="postbox-header"><h2><?php esc_html_e( 'Submit Button', 'contact-forms'); ?></h2></div>
3611 - <div class="inside">
3612 - <table class="form-table" role="presentation">
3613 - <tr>
3614 - <th scope="row"><label for="accua_style_submit_border_color"><?php esc_html_e( 'Border color', 'contact-forms'); ?></label></th>
3615 - <td><input id="accua_style_submit_border_color" name="style_submit_border_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_submit_border_color']) ?>" /></td>
3616 - </tr>
3617 - <tr>
3618 - <th scope="row"><label for="accua_style_submit_border_width"><?php esc_html_e( 'Border width', 'contact-forms'); ?></label></th>
3619 - <td><input id="accua_style_submit_border_width" name="style_submit_border_width" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_submit_border_width']) ?>" /></td>
3620 - </tr>
3621 - <tr>
3622 - <th scope="row"><label for="accua_style_submit_border_radius"><?php esc_html_e( 'Rounded corner radius', 'contact-forms'); ?></label></th>
3623 - <td><input id="accua_style_submit_border_radius" name="style_submit_border_radius" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_submit_border_radius']) ?>" /></td>
3624 - </tr>
3625 - <tr>
3626 - <th scope="row"><label for="accua_style_submit_background_color"><?php esc_html_e( 'Background color', 'contact-forms'); ?></label></th>
3627 - <td><input id="accua_style_submit_background_color" name="style_submit_background_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_submit_background_color']) ?>" /></td>
3628 - </tr>
3629 - <tr>
3630 - <th scope="row"><label for="accua_style_submit_padding"><?php esc_html_e( 'Padding', 'contact-forms'); ?></label></th>
3631 - <td><input id="accua_style_submit_padding" name="style_submit_padding" class="accua_form_value regular-text" type="text" value="<?php echo esc_attr($form_data['style_submit_padding']) ?>" /></td>
3632 - </tr>
3633 - <tr>
3634 - <th scope="row"><label for="accua_style_submit_color"><?php esc_html_e( 'Text color', 'contact-forms'); ?></label></th>
3635 - <td><input id="accua_style_submit_color" name="style_submit_color" class="accua_form_value accua-color-picker" type="text" value="<?php echo esc_attr($form_data['style_submit_color']) ?>" /></td>
3636 - </tr>
3637 - <tr>
3638 - <th scope="row"><label for="accua_style_submit_font_size"><?php esc_html_e( 'Font size', 'contact-forms'); ?></label></th>
3639 - <td><input id="accua_style_submit_font_size" name="style_submit_font_size" class="accua_form_value small-text" type="text" value="<?php echo esc_attr($form_data['style_submit_font_size']) ?>" /></td>
3640 - </tr>
3641 - </table>
3642 - </div></div>
3643 2625
3644 - </div>
3645 - </div><!-- /panel: styling -->
2626 + <br clear="all"/>
3646 2627
3647 - <?php if ( current_user_can( 'manage_options' ) ) : ?>
3648 - <div class="accua-tabs__panel" role="tabpanel" data-tab="danger_zone">
2628 +</div>
3649 2629
3650 - <div class="postbox accua-danger-zone">
3651 - <div class="postbox-header"><h2><?php esc_html_e( 'Anonymize old submissions', 'contact-forms' ); ?></h2></div>
3652 - <div class="inside">
3653 - <p class="description"><?php esc_html_e( 'Anonymize all submissions older than the specified period, across all forms. This replaces personal data with placeholders and sets IP to 0.0.0.0. This cannot be undone.', 'contact-forms' ); ?></p>
3654 - <p>
3655 - <input type="number" id="accua_danger_anon_value" min="1" step="1" value="12" style="width: 80px;" />
3656 - <select id="accua_danger_anon_unit" style="vertical-align: baseline;">
3657 - <option value="days"><?php esc_html_e( 'days', 'contact-forms' ); ?></option>
3658 - <option value="months" selected><?php esc_html_e( 'months', 'contact-forms' ); ?></option>
3659 - <option value="years"><?php esc_html_e( 'years', 'contact-forms' ); ?></option>
3660 - </select>
3661 - <button type="button" id="accua_danger_anon_btn" class="button" style="color: #d63638; border-color: #d63638;"><?php esc_html_e( 'Anonymize submissions', 'contact-forms' ); ?></button>
3662 - </p>
3663 - <div id="accua_danger_anon_result" style="display:none;"></div>
3664 - </div></div>
3665 -
3666 - <div class="postbox accua-danger-zone">
3667 - <div class="postbox-header"><h2><?php esc_html_e( 'Delete all Contact Forms data', 'contact-forms' ); ?></h2></div>
3668 - <div class="inside">
3669 - <p class="description"><?php esc_html_e( 'Permanently delete ALL Contact Forms settings, forms, submissions, and uploaded files. The plugin will remain installed but completely reset. Make a full backup before proceeding.', 'contact-forms' ); ?></p>
3670 - <p>
3671 - <button type="button" id="accua_danger_delete_btn" class="button" style="color: #d63638; border-color: #d63638;"><?php esc_html_e( 'Delete all data', 'contact-forms' ); ?></button>
3672 - </p>
3673 - <div id="accua_danger_delete_result" style="display:none;"></div>
3674 - </div></div>
3675 -
3676 - </div><!-- /panel: danger_zone -->
3677 - <?php endif; ?>
3678 -
3679 - <div class="accua-tabs__panel" role="tabpanel" data-tab="tokens">
3680 - <?php accua_forms_print_tokens(); ?>
3681 - </div><!-- /panel: tokens -->
3682 -
3683 - <div class="accua-tabs__panel" role="tabpanel" data-tab="theme_helper">
3684 - <?php accua_forms_theme_helper_content(); ?>
3685 - </div><!-- /panel: theme_helper -->
3686 -
3687 -</div><!-- /accua_settings_tabs -->
3688 -
3689 2630 <?php /*
3690 2631 <h3><?php _e( 'File upload default settings', 'contact-forms'); ?></h3>
3691 2632 <p id="accua_form_valid_extensions"><?php _e( 'Valid extensions', 'contact-forms'); ?> <br /><textarea name="valid_extensions" class="accua_form_value" style="width:95%"; cols="80" rows="8"><?php echo htmlspecialchars($file_data['valid_extensions'], ENT_QUOTES) ?></textarea>
3692 2633 <small><?php _e( 'List of valid extensions, without dot, one per line.', 'contact-forms'); ?></small>
@@ -3706,28 +2647,24 @@
3706 2647 <small><?php _e( 'If it stars with \'/\' an absolute path is used, otherwise a path relative to the WordPress installation directory. Default value is "wp-content/uploads/accua-forms"', 'contact-forms');?>.</small>
3707 2648 </p> */ ?>
3708 2649 <p><input class="button button-primary button-large" id="accua_form_save_settings" type="submit" value="Save settings" /></p>
3709 2650
2651 +<?php accua_forms_print_tokens(); ?>
2652 +
3710 2653 </form>
3711 -
3712 -<span id="accua-forms-version"><?php
3713 - $plugin_data = get_plugin_data( ACCUA_FORMS_FILE );
3714 - echo esc_html( $plugin_data['Name'] ); ?> &mdash; <a href="https://www.cimatti.it/en/wordpress-plugins/contact-forms/"><?php
3715 - esc_html_e('Version', 'contact-forms'); echo ' ' . esc_html( $plugin_data['Version'] ); ?></a></span>
3716 -
3717 2654 </div>
3718 2655
3719 2656 <script type='text/javascript'>
3720 2657 jQuery(function($) {
3721 - $('#accua_form_style_border_color .accua_form_value').wpColorPicker();
3722 - $('#accua_form_style_background_color .accua_form_value').wpColorPicker();
3723 - $('#accua_form_style_color .accua_form_value').wpColorPicker();
3724 - $('#accua_form_style_field_border_color .accua_form_value').wpColorPicker();
3725 - $('#accua_form_style_field_background_color .accua_form_value').wpColorPicker();
3726 - $('#accua_form_style_field_color .accua_form_value').wpColorPicker();
3727 - $('#accua_form_style_submit_border_color .accua_form_value').wpColorPicker();
3728 - $('#accua_form_style_submit_background_color .accua_form_value').wpColorPicker();
3729 - $('#accua_form_style_submit_color .accua_form_value').wpColorPicker();
2658 + $('#accua_form_style_border_color .accua_form_value').colorPicker();
2659 + $('#accua_form_style_background_color .accua_form_value').colorPicker();
2660 + $('#accua_form_style_color .accua_form_value').colorPicker();
2661 + $('#accua_form_style_field_border_color .accua_form_value').colorPicker();
2662 + $('#accua_form_style_field_background_color .accua_form_value').colorPicker();
2663 + $('#accua_form_style_field_color .accua_form_value').colorPicker();
2664 + $('#accua_form_style_submit_border_color .accua_form_value').colorPicker();
2665 + $('#accua_form_style_submit_background_color .accua_form_value').colorPicker();
2666 + $('#accua_form_style_submit_color .accua_form_value').colorPicker();
3730 2667 });
3731 2668 </script>
3732 2669
3733 2670 <?php
@@ -3732,13 +2669,12 @@
3732 2669
3733 2670 <?php
3734 2671 }
3735 2672
3736 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, underscore prefix indicates private
3737 2673 function _accua_forms_get_abs_dest_path($dest_path = '') {
3738 2674 if ($dest_path === '') {
3739 2675 return realpath(ABSPATH) . '/wp-content/uploads/accua-forms';
3740 - } elseif (substr($dest_path,0,1) === '/') {
2676 + } else if (substr($dest_path,0,1) === '/') {
3741 2677 return $dest_path;
3742 2678 } else {
3743 2679 return realpath(ABSPATH) . '/' . $dest_path;
3744 2680 }
@@ -3743,9 +2679,8 @@
3743 2679 return realpath(ABSPATH) . '/' . $dest_path;
3744 2680 }
3745 2681 }
3746 2682
3747 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, underscore prefix indicates private
3748 2683 function _accua_forms_get_form_data($fid = false, $return_empty = true, $restore_trash = false){
3749 2684 $empty_form_data = array(
3750 2685 'fields' => array(),
3751 2686 'title' => '',
@@ -3759,9 +2694,8 @@
3759 2694 'admin_emails_message' => '',
3760 2695 'confirmation_emails_subject' => '',
3761 2696 'confirmation_emails_message' => '',
3762 2697 'use_ajax' => true,
3763 - 'gads_conversion_tracking_code' => '',
3764 2698 'layout' => 'sidebyside',
3765 2699 'style_margin' => '',
3766 2700 'style_border_color' => '',
3767 2701 'style_border_width' => '',
@@ -3783,12 +2717,8 @@
3783 2717 'style_submit_background_color' => '',
3784 2718 'style_submit_padding' => '',
3785 2719 'style_submit_color' => '',
3786 2720 'style_submit_font_size' => '',
3787 - 'submission_retention_override' => false,
3788 - 'submission_retention_value' => 0,
3789 - 'submission_retention_unit' => 'months',
3790 - 'submission_retention_mode' => 'anonymize',
3791 2721 );
3792 2722
3793 2723 if ($fid === false) {
3794 2724 return $empty_form_data;
@@ -3822,9 +2752,9 @@
3822 2752 }
3823 2753 }
3824 2754 */
3825 2755 return $form_data;
3826 - } elseif ($return_empty) {
2756 + } else if ($return_empty) {
3827 2757 return array(
3828 2758 '_overrided' => array()
3829 2759 ) + $default_form_data + $empty_form_data;
3830 2760 } else {
@@ -3832,174 +2762,8 @@
3832 2762 }
3833 2763
3834 2764 }
3835 2765
3836 -/**
3837 - * Draft System Functions
3838 - *
3839 - * The draft system allows users to make changes to forms in the admin editor
3840 - * without immediately affecting the live/published form. Changes are stored in
3841 - * a transient until the user clicks Save, which publishes the draft.
3842 - *
3843 - * Pattern follows WordPress auto-draft system.
3844 - */
3845 -
3846 -/**
3847 - * Get the transient key for a form's draft data.
3848 - *
3849 - * @param string|int $fid Form ID.
3850 - * @return string Transient key.
3851 - */
3852 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3853 -function _accua_forms_get_draft_key( $fid ) {
3854 - return 'accua_forms_draft_' . $fid;
3855 -}
3856 -
3857 -/**
3858 - * Initialize or get existing draft for a form.
3859 - * Called when the form editor is loaded.
3860 - *
3861 - * If a draft exists, returns it.
3862 - * If no draft exists, creates one from published data.
3863 - *
3864 - * @param string|int $fid Form ID.
3865 - * @return array Draft data array.
3866 - */
3867 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3868 -function _accua_forms_init_draft( $fid ) {
3869 - $draft_key = _accua_forms_get_draft_key( $fid );
3870 -
3871 - // Check for existing draft
3872 - $draft_data = get_transient( $draft_key );
3873 -
3874 - if ( $draft_data !== false ) {
3875 - // Draft exists - return it
3876 - return $draft_data;
3877 - }
3878 -
3879 - // No draft - create from published data
3880 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
3881 -
3882 - if ( isset( $forms_data[ $fid ] ) ) {
3883 - $draft_data = $forms_data[ $fid ];
3884 - } else {
3885 - // New form - initialize empty structure
3886 - $draft_data = array( 'fields' => array() );
3887 - }
3888 -
3889 - // Store as draft with 24 hour expiry
3890 - set_transient( $draft_key, $draft_data, DAY_IN_SECONDS );
3891 -
3892 - return $draft_data;
3893 -}
3894 -
3895 -/**
3896 - * Get draft data for a form (creating if necessary).
3897 - * Used by AJAX handlers to read current draft state.
3898 - *
3899 - * @param string|int $fid Form ID.
3900 - * @return array Draft data array.
3901 - */
3902 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3903 -function _accua_forms_get_draft_data( $fid ) {
3904 - $draft_key = _accua_forms_get_draft_key( $fid );
3905 - $draft_data = get_transient( $draft_key );
3906 -
3907 - if ( $draft_data === false ) {
3908 - // Initialize draft from published data
3909 - $draft_data = _accua_forms_init_draft( $fid );
3910 - }
3911 -
3912 - return $draft_data;
3913 -}
3914 -
3915 -/**
3916 - * Save data to draft transient.
3917 - * Called by AJAX handlers when fields are edited.
3918 - *
3919 - * @param string|int $fid Form ID.
3920 - * @param array $draft_data Complete draft data to save.
3921 - * @return bool True on success.
3922 - */
3923 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3924 -function _accua_forms_save_draft( $fid, $draft_data ) {
3925 - $draft_key = _accua_forms_get_draft_key( $fid );
3926 - return set_transient( $draft_key, $draft_data, DAY_IN_SECONDS );
3927 -}
3928 -
3929 -/**
3930 - * Publish draft to live data.
3931 - * Called when user clicks Save button.
3932 - *
3933 - * @param string|int $fid Form ID.
3934 - * @return bool True on success.
3935 - */
3936 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3937 -function _accua_forms_publish_draft( $fid ) {
3938 - $draft_key = _accua_forms_get_draft_key( $fid );
3939 - $draft_data = get_transient( $draft_key );
3940 -
3941 - if ( $draft_data === false ) {
3942 - // No draft to publish - shouldn't happen normally
3943 - return false;
3944 - }
3945 -
3946 - // Get current published data
3947 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
3948 -
3949 - // Update with draft
3950 - $forms_data[ $fid ] = $draft_data;
3951 -
3952 - // Save to database
3953 - $result = update_option( 'accua_forms_saved_forms', $forms_data );
3954 -
3955 - if ( $result ) {
3956 - // Clear draft after successful publish
3957 - delete_transient( $draft_key );
3958 - }
3959 -
3960 - return $result;
3961 -}
3962 -
3963 -/**
3964 - * Delete draft for a form.
3965 - * Called when discarding changes or after successful publish.
3966 - *
3967 - * @param string|int $fid Form ID.
3968 - * @return bool True on success.
3969 - */
3970 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3971 -function _accua_forms_delete_draft( $fid ) {
3972 - $draft_key = _accua_forms_get_draft_key( $fid );
3973 - return delete_transient( $draft_key );
3974 -}
3975 -
3976 -/**
3977 - * Check if a draft exists and differs from published data.
3978 - * Used to show "unsaved changes" warning.
3979 - *
3980 - * @param string|int $fid Form ID.
3981 - * @return bool True if draft exists and differs from published.
3982 - */
3983 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function
3984 -function _accua_forms_has_unsaved_draft( $fid ) {
3985 - $draft_key = _accua_forms_get_draft_key( $fid );
3986 - $draft_data = get_transient( $draft_key );
3987 -
3988 - if ( $draft_data === false ) {
3989 - return false;
3990 - }
3991 -
3992 - // Compare with published data
3993 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
3994 - $published_data = isset( $forms_data[ $fid ] ) ? $forms_data[ $fid ] : array();
3995 -
3996 - // Deep comparison (serialize for simplicity)
3997 - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_serialize -- Used for comparison only
3998 - return serialize( $draft_data ) !== serialize( $published_data );
3999 -}
4000 -
4001 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, underscore prefix indicates private
4002 2766 function _accua_forms_style_parameters($params) {
4003 2767 $ret = '';
4004 2768 foreach ($params as $key => $value) {
4005 2769 $value = trim($value);
@@ -4023,23 +2787,9 @@
4023 2787 add_action('accua_form_alter', 'accua_forms_form_generate', -999, 2);
4024 2788 function accua_forms_form_generate($baseid, $form) {
4025 2789 if (substr($baseid, 0, 14) == '__accua-form__') {
4026 2790 $fid = substr($baseid,14);
4027 -
4028 - // Check if we're in admin preview mode - if so, read from draft
4029 - $use_draft = apply_filters('accua_forms_use_draft_for_preview', false);
4030 - if ($use_draft) {
4031 - // Get draft data and merge with defaults
4032 - $draft_data = _accua_forms_get_draft_data($fid);
4033 - $default_form_data = get_option('accua_forms_default_form_data', array());
4034 - $empty_form_data = _accua_forms_get_form_data(false); // Get empty structure
4035 - $form_data = array(
4036 - '_overrided' => $draft_data
4037 - ) + $draft_data + $default_form_data + $empty_form_data;
4038 - } else {
4039 - // Frontend: read from published data
4040 - $form_data = _accua_forms_get_form_data($fid, false);
4041 - }
2791 + $form_data = _accua_forms_get_form_data($fid, false);
4042 2792 /*
4043 2793 echo '<!-- fid = ';
4044 2794 print_r($fid);
4045 2795 echo "\n\nform_data = ";
@@ -4046,45 +2796,14 @@
4046 2796 print_r($form_data);
4047 2797 echo "\n-->";
4048 2798 */
4049 2799 if ($form_data) {
4050 - // Check for preview order override (allows live preview of field reorder before save)
4051 - $preview_order_override = apply_filters('accua_forms_preview_order_override', null);
4052 - if ($preview_order_override && !empty($form_data['fields'])) {
4053 - // Find the sidebar key for this form (format: cimatti-accua-fields-form-area-{fid})
4054 - $sidebar_key = 'cimatti-accua-fields-form-area-' . $fid;
4055 - if (isset($preview_order_override[$sidebar_key])) {
4056 - $order_string = $preview_order_override[$sidebar_key];
4057 - $order_array = explode(',', $order_string);
4058 -
4059 - // Reorder fields according to preview order
4060 - $old_fields = $form_data['fields'];
4061 - $new_fields = array();;
4062 -
4063 - foreach ($order_array as $widget_id) {
4064 - // Extract instance ID from widget ID (format: widget-{type}_{instance_id})
4065 - $instance_id = preg_replace('/^(new-)?widget-\\d+_/', '', $widget_id);
4066 - if (isset($old_fields[$instance_id])) {
4067 - $new_fields[$instance_id] = $old_fields[$instance_id];
4068 - unset($old_fields[$instance_id]);
4069 - }
4070 - }
4071 -
4072 - // Append any remaining fields not in order
4073 - if ($old_fields) {
4074 - $new_fields += $old_fields;
4075 - }
4076 -
4077 - $form_data['fields'] = $new_fields;
4078 - }
4079 - }
4080 -
4081 2800 $form_style = _accua_forms_style_parameters(array(
4082 2801 'margin' => $form_data['style_margin'],
4083 2802 'border-color' => $form_data['style_border_color'],
4084 2803 'border-width' => $form_data['style_border_width'],
4085 2804 'border-radius' => $form_data['style_border_radius'],
4086 - 'background-color' => $form_data['style_background_color'],
2805 + 'background' => $form_data['style_background_color'],
4087 2806 'padding' => $form_data['style_padding'],
4088 2807 'color' => $form_data['style_color'],
4089 2808 'font-size' => $form_data['style_font_size'],
4090 2809 ));
@@ -4093,9 +2812,9 @@
4093 2812 'margin-bottom' => $form_data['style_field_spacing'],
4094 2813 'border-color' => $form_data['style_field_border_color'],
4095 2814 'border-width' => $form_data['style_field_border_width'],
4096 2815 'border-radius' => $form_data['style_field_border_radius'],
4097 - 'background-color' => $form_data['style_field_background_color'],
2816 + 'background' => (trim($form_data['style_field_background_color']) === '')?'transparent':$form_data['style_field_background_color'],
4098 2817 'padding' => $form_data['style_field_padding'],
4099 2818 'color' => (trim($form_data['style_field_color']) === '')?$form_data['style_color']:$form_data['style_field_color'],
4100 2819 'font-size' => $form_data['style_font_size'],
4101 2820 ));
@@ -4102,17 +2821,14 @@
4102 2821 $field_properties = array();
4103 2822 if ($field_style !== '') {
4104 2823 $field_properties['style'] = $field_style;
4105 2824 }
4106 - // These will be set per-field in the loop below, initialized empty here
4107 - $field_properties['wrapperCssClass'] = '';
4108 - $field_properties['wrapperCssId'] = '';
4109 2825
4110 2826 $submit_style = _accua_forms_style_parameters(array(
4111 2827 'border-color' => $form_data['style_submit_border_color'],
4112 2828 'border-width' => $form_data['style_submit_border_width'],
4113 2829 'border-radius' => $form_data['style_submit_border_radius'],
4114 - 'background-color' => $form_data['style_submit_background_color'],
2830 + 'background' => $form_data['style_submit_background_color'],
4115 2831 'padding' => $form_data['style_submit_padding'],
4116 2832 'color' => $form_data['style_submit_color'],
4117 2833 'font-size' => $form_data['style_submit_font_size'],
4118 2834 ));
@@ -4145,9 +2861,9 @@
4145 2861 'name' => __('Fieldset begin', 'contact-forms'),
4146 2862 'type' => 'fieldset-begin',
4147 2863 'description' => '',
4148 2864 );
4149 - } elseif ($istance_data['ref'] == '__fieldset-end') {
2865 + } else if ($istance_data['ref'] == '__fieldset-end') {
4150 2866 $field_data = array(
4151 2867 'id' => '__fieldset-end',
4152 2868 'name' => __('Fieldset end', 'contact-forms'),
4153 2869 'type' => 'fieldset-end',
@@ -4167,10 +2883,8 @@
4167 2883 'description' => __('Use this special field to inject raw HTML in the form. You can use this multiple times.', 'contact-forms'),
4168 2884 'default_value' => '',
4169 2885 'allowed_values' => '',
4170 2886 'allowed_extensions' => '',
4171 - 'custom_required_message' => '',
4172 - 'custom_format_message' => '',
4173 2887 );
4174 2888
4175 2889 $istance_data += array(
4176 2890 'version' => 1,
@@ -4204,13 +2918,8 @@
4204 2918 'label' => $field_data['name'],
4205 2919 'default_value' => $field_data['default_value'], /* viene impostato il valore di defualt se non è un campo data */
4206 2920 'allowed_values' => $field_data['allowed_values'],
4207 2921 'allowed_extensions' => $field_data['allowed_extensions'],
4208 - 'post_type' => 'page', // Default for post-select fields
4209 - 'css_class' => '',
4210 - 'css_id' => '',
4211 - 'custom_required_message' => '',
4212 - 'custom_format_message' => '',
4213 2922 );
4214 2923
4215 2924 $element = NULL;
4216 2925 $element_conf = NULL;
@@ -4216,26 +2925,15 @@
4216 2925 $element_conf = NULL;
4217 2926
4218 2927 $allowed_val = trim($istance_data['allowed_values']);
4219 2928
4220 - // For post-select fields, we use lazy loading via AJAX, so don't pre-load posts here
4221 - if ($field_data['type'] == 'post-multicheckbox') {
4222 - // Post-multicheckbox still needs pre-loaded options for checkbox rendering
4223 - $post_type = isset($istance_data['post_type']) ? $istance_data['post_type'] : 'page';
4224 - $query_args = $allowed_val;
4225 - if (!empty($query_args)) {
4226 - $query_args .= '&post_type=' . $post_type;
4227 - } else {
4228 - $query_args = 'post_type=' . $post_type;
4229 - }
4230 - $posts = accua_get_pages($query_args);
2929 + if ($field_data['type'] == 'post-multicheckbox' || $field_data['type'] == 'post-select') {
2930 + $posts = accua_get_pages($allowed_val);
4231 2931 $allowed_values = array();
4232 2932 foreach ($posts as $p) {
2933 + //$allowed_values[$p->ID] = apply_filters( 'the_title', $p->post_title, $p->ID );
4233 2934 $allowed_values[$p->ID] = $p->post_title;
4234 2935 }
4235 - } elseif ($field_data['type'] == 'post-select') {
4236 - // Post-select uses lazy loading - just set empty options, JS will fetch
4237 - $allowed_values = array();
4238 2936 } else {
4239 2937 if ($field_data['type'] == 'file') {
4240 2938 $filedata = get_option('accua_forms_default_file_field_data',array());
4241 2939 $filedata += array(
@@ -4269,37 +2967,8 @@
4269 2967 $allowed_values[$val[0]] = $val[1];
4270 2968 }
4271 2969 }
4272 2970
4273 - // Set per-field wrapper CSS class and ID
4274 - $field_properties['wrapperCssClass'] = isset($istance_data['css_class']) ? $istance_data['css_class'] : '';
4275 - $field_properties['wrapperCssId'] = isset($istance_data['css_id']) ? $istance_data['css_id'] : '';
4276 -
4277 - // Resolve per-field custom validation messages (per-form instance → field definition → default)
4278 - $resolved_required_msg = '';
4279 - if (!empty($istance_data['custom_required_message'])) {
4280 - $resolved_required_msg = $istance_data['custom_required_message'];
4281 - } elseif (!empty($field_data['custom_required_message'])) {
4282 - $resolved_required_msg = $field_data['custom_required_message'];
4283 - }
4284 -
4285 - $resolved_format_msg = '';
4286 - if (!empty($istance_data['custom_format_message'])) {
4287 - $resolved_format_msg = $istance_data['custom_format_message'];
4288 - } elseif (!empty($field_data['custom_format_message'])) {
4289 - $resolved_format_msg = $field_data['custom_format_message'];
4290 - }
4291 -
4292 - // Add data attributes for client-side custom messages (reset each iteration)
4293 - unset($field_properties['data-custom-required-msg']);
4294 - unset($field_properties['data-custom-format-msg']);
4295 - if ($resolved_required_msg !== '') {
4296 - $field_properties['data-custom-required-msg'] = $resolved_required_msg;
4297 - }
4298 - if ($resolved_format_msg !== '') {
4299 - $field_properties['data-custom-format-msg'] = $resolved_format_msg;
4300 - }
4301 -
4302 2971 switch ($field_data['type']) {
4303 2972 case 'textarea':
4304 2973 $element = new Element_Textarea($istance_data['label'], $istance_data['istance_id'], $field_properties+array('cols' => '50', 'value'=>$istance_data['default_value']));
4305 2974 break;
@@ -4314,17 +2983,18 @@
4314 2983 if ($allowed_values) {
4315 2984 reset($allowed_values);
4316 2985 $val = (string) key($allowed_values);
4317 2986 $defval = trim($istance_data['default_value']);
4318 - } elseif ($istance_data['default_value'] == '1') {
2987 + } else if ($istance_data['default_value'] == '1') {
4319 2988 $defval = $val = '1';
4320 2989 } else {
4321 2990 $val = empty($istance_data['default_value'])?'1':$istance_data['default_value'];
4322 2991 $defval = '';
4323 2992 }
4324 - $element = new AccuaForm_Element_Checkbox('', $istance_data['istance_id'], array($val => $lab), $field_properties+array('value' => $defval));
2993 + $element = new AccuaForm_Element_Checkbox('', $istance_data['istance_id'], array($val => $lab), array('value' => $defval));
4325 2994 break;
4326 2995 case 'select':
2996 + case 'post-select':
4327 2997 if (!isset($allowed_values[''])) {
4328 2998 $allowed_values = array('' => '') + $allowed_values;
4329 2999 }
4330 3000 $defval = trim($istance_data['default_value']);
@@ -4329,17 +2999,11 @@
4329 2999 }
4330 3000 $defval = trim($istance_data['default_value']);
4331 3001 $element = new AccuaForm_Element_Select($istance_data['label'], $istance_data['istance_id'], $allowed_values, $field_properties+array('value'=>$defval));
4332 3002 break;
4333 - case 'post-select':
4334 - $post_type = isset($istance_data['post_type']) ? $istance_data['post_type'] : 'page';
4335 - $extra_args = trim($istance_data['allowed_values']);
4336 - $defval = trim($istance_data['default_value']);
4337 - $element = new AccuaForm_Element_PostSelect($istance_data['label'], $istance_data['istance_id'], $post_type, $extra_args, $field_properties+array('value'=>$defval));
4338 - break;
4339 3003 case 'radio':
4340 3004 $defval = trim($istance_data['default_value']);
4341 - $element = new AccuaForm_Element_Radio($istance_data['label'], $istance_data['istance_id'], $allowed_values, $field_properties+array('value'=>$defval));
3005 + $element = new AccuaForm_Element_Radio($istance_data['label'], $istance_data['istance_id'], $allowed_values, array('value'=>$defval));
4342 3006 break;
4343 3007 case 'multiselect':
4344 3008 $defval = explode('|', $istance_data['default_value']);
4345 3009 foreach ($defval as $k => $v) {
@@ -4352,9 +3016,9 @@
4352 3016 $defval = explode('|', $istance_data['default_value']);
4353 3017 foreach ($defval as $k => $v) {
4354 3018 $defval[$k] = trim($v);
4355 3019 }
4356 - $element = new AccuaForm_Element_Checkbox($istance_data['label'], $istance_data['istance_id'], $allowed_values, $field_properties+array('value'=>$defval));
3020 + $element = new AccuaForm_Element_Checkbox($istance_data['label'], $istance_data['istance_id'], $allowed_values, array('value'=>$defval));
4357 3021 break;
4358 3022 case 'file':
4359 3023 $fdata = array();
4360 3024
@@ -4370,17 +3034,17 @@
4370 3034
4371 3035 $element = new AccuaForm_Element_File($istance_data['label'], $istance_data['istance_id'], $field_properties+$fdata);
4372 3036 break;
4373 3037 case 'html':
4374 - $element = new Element_HTML($istance_data['default_value'], $field_properties);
3038 + $element = new Element_HTML($istance_data['default_value']);
4375 3039 break;
4376 3040 case 'email':
4377 3041 case 'autoreply_email':
4378 - $email_props = $field_properties+array('value'=>$istance_data['default_value']);
4379 - if ($resolved_format_msg !== '') {
4380 - $email_props['custom_format_message'] = $resolved_format_msg;
4381 - }
4382 - $element = new AccuaForm_Element_Email($istance_data['label'], $istance_data['istance_id'], $email_props);
3042 + $element = new AccuaForm_Element_Email($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
3043 + $element->setValidation(new Validation_Email(
3044 + str_replace('%element%', $istance_data['label'], __("Attention: '%element%' must contain an email address.", 'contact-forms'))
3045 + ));
3046 + //"Errore: '{$istance_data['label']}' deve contenere un indirizzo email valido."
4383 3047 break;
4384 3048 case 'colorpicker':
4385 3049 $element = new AccuaForm_Element_ColorPicker($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
4386 3050 break;
@@ -4389,9 +3053,9 @@
4389 3053 $form->addElement(new AccuaForm_Element_FieldsetEnd());
4390 3054 } else {
4391 3055 $fieldset_open = true;
4392 3056 }
4393 - $element = new AccuaForm_Element_FieldsetBegin($istance_data['label'], $istance_data['istance_id'], $field_properties);
3057 + $element = new AccuaForm_Element_FieldsetBegin($istance_data['label'], $istance_data['istance_id']);
4394 3058 break;
4395 3059 case 'fieldset-end':
4396 3060 if ($fieldset_open) {
4397 3061 $element = new AccuaForm_Element_FieldsetEnd();
@@ -4418,20 +3082,17 @@
4418 3082 }
4419 3083 if ($captcha_use_v1) {
4420 3084 $element = new Element_HTML("\n\n<!-- ReCaptcha 1 is discontinued, please go to Contact Forms settings page and set reCaptcha v2 keys -->\n\n");
4421 3085 } else {
4422 - $element = new AccuaForm_Element_Captcha2 ($istance_data['label'], '', $field_properties+$captcha_properties);
3086 + $element = new AccuaForm_Element_Captcha2 ($istance_data['label'], '', $captcha_properties);
4423 3087 }
4424 3088 break;
4425 - case 'turnstile':
4426 - $element = new AccuaForm_Element_Turnstile($istance_data['label'], $istance_data['istance_id'], $field_properties+array("description" => ""));
4427 - break;
4428 3089 case 'password':
4429 3090 $element = new Element_Password($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
4430 3091 break;
4431 3092 case 'password-and-confirm':
4432 3093 $id_2 = "___{$istance_data['istance_id']}___confirmpass";
4433 - $element = new Element_Password($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
3094 + $element = new Element_Password(__("Password", 'contact-forms'), $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
4434 3095 $element_conf = new Element_Password(__("Confirm password", 'contact-forms'), $id_2, $field_properties+array('value'=>$istance_data['default_value']));
4435 3096 $element_conf_validator = new AccuaForm_Validation_Password();
4436 3097 $element_conf_validator->configure(array('otherPasswordFieldName'=>$istance_data['istance_id']));
4437 3098 $element_conf->setValidation($element_conf_validator);
@@ -4438,57 +3099,26 @@
4438 3099 break;
4439 3100 case 'date':
4440 3101 $element = new AccuaForm_Element_Date($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value'], 'minDate'=>$istance_data['min_date'], 'maxDate'=>$istance_data['max_date']));
4441 3102 break;
4442 - case 'telephone':
4443 - $phone_country = isset($istance_data['country_code']) ? $istance_data['country_code'] : 'IT';
4444 - $phone_props = $field_properties+array('value'=>$istance_data['default_value'], 'country_code'=>$phone_country);
4445 - if ($resolved_format_msg !== '') {
4446 - $phone_props['custom_format_message'] = $resolved_format_msg;
4447 - }
4448 - $element = new AccuaForm_Element_Telephone($istance_data['label'], $istance_data['istance_id'], $phone_props);
4449 - break;
4450 3103 //case 'textfield':
4451 3104 default:
4452 - /**
4453 - * Filter to create a custom Element for an external field type.
4454 - *
4455 - * @param Element|null $element Null by default; return an Element to override.
4456 - * @param string $field_type The field type identifier.
4457 - * @param array $field_data The field definition from avail_fields.
4458 - * @param array $istance_data The field instance data (label, required, etc.).
4459 - * @param array $field_properties Common properties (description, shortDesc, etc.).
4460 - */
4461 - $element = apply_filters( 'accua_forms_render_field_element', null, $field_data['type'], $field_data, $istance_data, $field_properties );
4462 - if ( ! $element ) {
4463 - $element = new Element_Textbox($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
4464 - }
3105 + $element = new Element_Textbox($istance_data['label'], $istance_data['istance_id'], $field_properties+array('value'=>$istance_data['default_value']));
4465 3106 break;
4466 3107 }
4467 3108 if ($element) {
4468 3109 if (!empty($istance_data['required'])) {
4469 3110 $element->setClass('accuaforms-field-required');
4470 - if ($field_data['type'] === 'captcha' && empty($captcha_use_v1)) {
3111 + if($field_data['type'] == 'captcha' && empty($captcha_use_v1)) {
4471 3112 //nothing
4472 - } elseif ($field_data['type'] === 'turnstile') {
4473 - //nothing - turnstile has its own validation set in the Element constructor
4474 - } elseif ($field_data['type'] === 'password-and-confirm') {
4475 - if ($resolved_required_msg !== '') {
4476 - $req_msg = str_replace(array('%s', '%element%'), $istance_data['label'], $resolved_required_msg);
4477 - } else {
4478 - /* translators: Password field required error */
4479 - $req_msg = __( 'Password is required', 'contact-forms' );
4480 - }
4481 - $element->setValidation(new Validation_Required($req_msg));
3113 + } else if($field_data['type'] == 'password-and-confirm') {
3114 + $element->setValidation(new Validation_Required(
3115 + str_replace('%element%', $istance_data['label'], __("Attention: Passwords are required fields.", 'contact-forms'))
3116 + ));
4482 3117 } else {
4483 - if ($resolved_required_msg !== '') {
4484 - $req_msg = str_replace(array('%s', '%element%'), $istance_data['label'], $resolved_required_msg);
4485 - } else {
4486 - /* translators: %element% is the field label, replaced with str_replace() */
4487 - // phpcs:ignore WordPress.WP.I18n.MissingTranslatorsComment -- Translators comment is above
4488 - $req_msg = str_replace('%element%', $istance_data['label'], __( '%element% is required', 'contact-forms' ));
4489 - }
4490 - $element->setValidation(new Validation_Required($req_msg));
3118 + $element->setValidation(new Validation_Required(
3119 + str_replace('%element%', $istance_data['label'], __("Attention: '%element%' is a required field.", 'contact-forms'))
3120 + ));
4491 3121 }
4492 3122 }
4493 3123
4494 3124 if ($elementName = $element->getName()) {
@@ -4603,9 +3233,8 @@
4603 3233 ));
4604 3234
4605 3235 $anonymized_ip = accua_forms_anonymize_ip($form->stats['ip']);
4606 3236
4607 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Form submission insert requires direct query
4608 3237 $insert_ret = $wpdb->insert(
4609 3238 $wpdb->prefix . 'accua_forms_submissions',
4610 3239 array (
4611 3240 'afs_form_id' => (string) $fid,
@@ -4623,10 +3252,9 @@
4623 3252 if ($insert_ret) {
4624 3253 $submission_id = $form->stats['submission_id'] = $wpdb->insert_id;
4625 3254 } else {
4626 3255 $submission_id = $form->stats['submission_id'] = 0;
4627 - // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Legitimate error logging for failed DB insert
4628 - error_log("[Contact Forms] unable to save submitted form data");
3256 + error_log("[WordPress Contact Forms] unable to save submitted form data");
4629 3257 }
4630 3258
4631 3259 $review_submission_url = admin_url('admin.php').'?page=accua_forms_submissions_list&sid='.$submission_id;
4632 3260
@@ -4641,15 +3269,15 @@
4641 3269 '__referrer' => $form->stats['referrer'],
4642 3270 '__lang' => $form->stats['lang'],
4643 3271 '__locale' => $form->stats['locale'],
4644 3272 '__created' => $form->stats['created'],
4645 - '__created_day' => wp_date('l j F Y', $form->stats['created']),
4646 - '__created_day_month_year' => wp_date('j F Y', $form->stats['created']),
4647 - '__created_hour' => wp_date('G:i', $form->stats['created']),
3273 + '__created_day' => date('l j F Y', $form->stats['created']),
3274 + '__created_day_month_year' => date('j F Y', $form->stats['created']),
3275 + '__created_hour' => date('G:i', $form->stats['created']),
4648 3276 '__submitted' => $time,
4649 - '__submitted_day' => wp_date('l j F Y', $time),
4650 - '__submitted_day_month_year' => wp_date('j F Y', $time),
4651 - '__submitted_hour' => wp_date('G:i', $time),
3277 + '__submitted_day' => date('l j F Y', $time),
3278 + '__submitted_day_month_year' => date('j F Y', $time),
3279 + '__submitted_hour' => date('G:i', $time),
4652 3280 '__confirmation_emails_message' => $form_data['confirmation_emails_message'],
4653 3281 '__user_agent' => $form->stats['user_agent'],
4654 3282 '__platform' => $form->stats['platform'],
4655 3283 '__tentatives' => $form->stats['tentatives'],
@@ -4683,9 +3311,9 @@
4683 3311 'name' => __('Fieldset begin', 'contact-forms'),
4684 3312 'type' => 'fieldset-begin',
4685 3313 'description' => '',
4686 3314 );
4687 - } elseif ($istance_data['ref'] == '__fieldset-end') {
3315 + } else if ($istance_data['ref'] == '__fieldset-end') {
4688 3316 $field_data = array(
4689 3317 'id' => '__fieldset-end',
4690 3318 'name' => __('Fieldset end', 'contact-forms'),
4691 3319 'type' => 'fieldset-end',
@@ -4819,10 +3447,9 @@
4819 3447 if ($value !== null && $value !== '' && $file) {
4820 3448 if ($form->renameFile($istance_id, "{$submission_id}_{$field_data['id']}_{$file['name']}")) {
4821 3449 $urlfield = rawurlencode($istance_data['istance_id']);
4822 3450 $urlfile = rawurlencode($value);
4823 - $token = accua_forms_generate_download_token($submission_id);
4824 - $file_download_url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$submission_id}&field={$urlfield}&file={$urlfile}&nonce=" . wp_create_nonce('accua_forms_download_nonce')."&token={$token}&_wpnonce=" . wp_create_nonce('download_file_' . $submission_id . '_' . $urlfield);
3451 + $file_download_url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$submission_id}&field={$urlfield}&file={$urlfile}";
4825 3452 }
4826 3453 }
4827 3454 $replace_map[$istance_data['istance_id']] = $value;
4828 3455 $replace_map['__download_'.$istance_data['istance_id']] = $file_download_url;
@@ -4844,9 +3471,9 @@
4844 3471 switch ($field_data['type']) {
4845 3472 case 'file':
4846 3473 $replace_map['__submitted_txt_raw'][$istance_data['istance_id']] = "{$istance_data['istance_id']}\t$value\t$file_download_url";
4847 3474 $replace_map['__submitted_json_raw'][$istance_data['istance_id']] = "$value\t$file_download_url";
4848 - $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'><a href='".esc_url($file_download_url)."'>".esc_html($value)."</a>";
3475 + $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'><a href='".htmlspecialchars($file_download_url,ENT_QUOTES)."'>".htmlspecialchars($value)."</a>";
4849 3476 break;
4850 3477
4851 3478 case 'email':
4852 3479 case 'autoreply_email':
@@ -4851,9 +3478,9 @@
4851 3478 case 'email':
4852 3479 case 'autoreply_email':
4853 3480 $replace_map['__submitted_txt_raw'][$istance_data['istance_id']] = "{$istance_data['istance_id']}\t$value";
4854 3481 $replace_map['__submitted_json_raw'][$istance_data['istance_id']] = $value;
4855 - $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'><a href='mailto:".esc_attr($value)."'>".esc_html($value)."</a>";
3482 + $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'><a href='mailto:".htmlspecialchars($value,ENT_QUOTES)."'>".htmlspecialchars($value)."</a>";
4856 3483 break;
4857 3484 case 'submit':
4858 3485 break;
4859 3486 case 'colorpicker':
@@ -4861,9 +3488,9 @@
4861 3488 $replace_map['__submitted_json_raw'][$istance_data['istance_id']] = $value;
4862 3489 if ($value === '') {
4863 3490 $value_html = '';
4864 3491 } else {
4865 - $value_esc = esc_attr($value);
3492 + $value_esc = htmlspecialchars($value, ENT_QUOTES);
4866 3493 $value_html = "<span style='color: $value_esc'><font color='$value_esc'>&#9608;</font></span> $value_esc";
4867 3494 }
4868 3495 $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'>$value_html";
4869 3496 break;
@@ -4872,14 +3499,12 @@
4872 3499 break;
4873 3500 default:
4874 3501 $replace_map['__submitted_txt_raw'][$istance_data['istance_id']] = "{$istance_data['istance_id']}\t$value";
4875 3502 $replace_map['__submitted_json_raw'][$istance_data['istance_id']] = $value;
4876 - $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'>".esc_html($value);
4877 - } if ($submission_id) {
4878 - // Ensure value is never NULL to prevent database errors
4879 - $safe_value = $value === null ? '' : $value;
4880 -
4881 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Form field values insert requires direct query
3503 + $replace_map['__submitted_html_raw'][$istance_data['istance_id']] = "<strong>{$istance_data['istance_id']}</strong></td><td class='valori_submitted'>".htmlspecialchars($value);
3504 + }
3505 +
3506 + if ($submission_id) {
4882 3507 $wpdb->insert(
4883 3508 $wpdb->prefix . 'accua_forms_submissions_values',
4884 3509 array (
4885 3510 'afsv_sub_id' => $submission_id,
@@ -4884,9 +3509,9 @@
4884 3509 array (
4885 3510 'afsv_sub_id' => $submission_id,
4886 3511 'afsv_field_id' => $istance_data['istance_id'],
4887 3512 'afsv_type' => $type,
4888 - 'afsv_value' => $safe_value,
3513 + 'afsv_value' => $value,
4889 3514 ),
4890 3515 array('%d','%s','%s','%s')
4891 3516 );
4892 3517 }
@@ -4914,9 +3539,9 @@
4914 3539
4915 3540 $replace_map_html = array();
4916 3541 foreach($replace_map as $key => $value) {
4917 3542 $replace_map_html["!$key"] = wp_kses($value, 'post');
4918 - $replace_map_html[$key] = esc_attr($value);
3543 + $replace_map_html[$key] = htmlspecialchars($value, ENT_QUOTES);
4919 3544 }
4920 3545
4921 3546 $replace_map['__submitted_html'] = $replace_map_html['__submitted_html'] = $replace_map_html['!__submitted_html'] = $submitted_html;
4922 3547 $replacer_html = new AccuaConditionalReplacer($replace_map_html);
@@ -4941,9 +3566,8 @@
4941 3566 }
4942 3567
4943 3568 $settings_html = array(
4944 3569 'success_message',
4945 - 'error_message',
4946 3570 'admin_emails_message',
4947 3571 );
4948 3572
4949 3573 foreach($settings_html as $i) {
@@ -4949,12 +3573,9 @@
4949 3573 foreach($settings_html as $i) {
4950 3574 $form_data_replaced[$i] = $replacer_html->doReplace($form_data[$i]);
4951 3575 }
4952 3576
4953 - // Track mail sending success for showing appropriate message
4954 - $mail_success = true;
4955 - $mail1 = true;
4956 - $mail2 = true;
3577 + AccuaForm::appendSubmittedMessages(wpautop($form_data_replaced['success_message']));
4957 3578
4958 3579 $header = array("Content-Type: text/html; charset=".get_option('blog_charset'));
4959 3580
4960 3581 $emails_from = trim($form_data_replaced['emails_from']);
@@ -4980,11 +3601,8 @@
4980 3601 $mail1 = wp_mail(trim($admin_to), $form_data_replaced['admin_emails_subject'], $form_data_replaced['admin_emails_message'], $header);
4981 3602 }
4982 3603 */
4983 3604 $mail1 = wp_mail($form_data_replaced['admin_emails_to'], $form_data_replaced['admin_emails_subject'],'<html><head></head><body style="background:#f9f8f8;font-size: 12px;font-family: "Lucida Sans","Lucida Grande", Verdana, Arial, Sans-Serif;"">'.wpautop($form_data_replaced['admin_emails_message']).'</body></html>', $header);
4984 - if (!$mail1) {
4985 - $mail_success = false;
4986 - }
4987 3605 }
4988 3606
4989 3607 if ($replace_map['__autoreply'] && $replace_map['__autoreply_email']
4990 3608 && $form_data_replaced['confirmation_emails_subject']
@@ -4989,32 +3607,10 @@
4989 3607 if ($replace_map['__autoreply'] && $replace_map['__autoreply_email']
4990 3608 && $form_data_replaced['confirmation_emails_subject']
4991 3609 && $confirmation_emails_message) {
4992 3610 $mail2 = wp_mail($replace_map['__autoreply_email'], $form_data_replaced['confirmation_emails_subject'], '<html><head></head><body>'.wpautop($confirmation_emails_message).'</body></html>', $header);
4993 - if (!$mail2) {
4994 - $mail_success = false;
4995 - }
4996 3611 }
4997 3612
4998 - // Determine which message to show based on mail success and user settings
4999 - if ($mail_success) {
5000 - // Show success message unless "Don't show any messages" is selected
5001 - if (empty($form_data['success_message_no_message'])) {
5002 - $message_content = trim($form_data_replaced['success_message']);
5003 - if ($message_content !== '') {
5004 - AccuaForm::appendSubmittedMessages(wpautop($message_content));
5005 - }
5006 - }
5007 - } else {
5008 - // Mail failed - show error message unless "Don't show any messages" is selected
5009 - if (empty($form_data['error_message_no_message'])) {
5010 - $error_content = trim($form_data_replaced['error_message']);
5011 - if ($error_content !== '') {
5012 - AccuaForm::appendSubmittedMessages(wpautop($error_content));
5013 - }
5014 - }
5015 - }
5016 -
5017 3613 /*
5018 3614 echo "<!-- replace_map: "
5019 3615 , print_r($replace_map, true)
5020 3616 , "\nreplace_map: "
@@ -5042,16 +3638,11 @@
5042 3638 'file_format' => 'name',
5043 3639 );
5044 3640 $ret = array();
5045 3641 if ($options['extra']) {
5046 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Submission data lookup requires direct query
5047 - $query1 = $wpdb->prepare(
5048 - "SELECT *
3642 + $query1 = "SELECT *
5049 3643 FROM `{$wpdb->prefix}accua_forms_submissions`
5050 - WHERE afs_id = %d",
5051 - $subid
5052 - );
5053 - // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $query1 is prepared above, submission lookup requires direct query
3644 + WHERE afs_id = $subid";
5054 3645 $data = $wpdb->get_row($query1);
5055 3646 if (!empty($data)) {
5056 3647 $created = $data->afs_created;
5057 3648 $created[10] = 'T';
@@ -5084,13 +3675,13 @@
5084 3675 '__uri' => $data->afs_uri,
5085 3676 '__referrer' => $data->afs_referrer,
5086 3677 '__lang' => $data->afs_lang,
5087 3678 '__created' => $created,
5088 - '__created_day' => wp_date('l j F Y', $created),
5089 - '__created_hour' => wp_date('G:i', $created),
3679 + '__created_day' => date('l j F Y', $created),
3680 + '__created_hour' => date('G:i', $created),
5090 3681 '__submitted' => $submitted,
5091 - '__submitted_day' => wp_date('l j F Y', $submitted),
5092 - '__submitted_hour' => wp_date('G:i', $submitted),
3682 + '__submitted_day' => date('l j F Y', $submitted),
3683 + '__submitted_hour' => date('G:i', $submitted),
5093 3684 '__user_agent' => $stats['user_agent'],
5094 3685 '__platform' => $stats['platform'],
5095 3686 '__tentatives' => $stats['tentatives'],
5096 3687 '__submit_method' => $stats['submit_method'],
@@ -5097,17 +3688,12 @@
5097 3688 );
5098 3689 }
5099 3690 }
5100 3691
5101 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Submission values lookup requires direct query
5102 - $query2 = $wpdb->prepare(
5103 - "SELECT *
5104 - FROM `{$wpdb->prefix}accua_forms_submissions_values`
5105 - WHERE afsv_sub_id = %d",
5106 - $subid
5107 - );
3692 + $query2 = "SELECT *
3693 + FROM `{$wpdb->prefix}accua_forms_submissions_values`
3694 + WHERE afsv_sub_id = $subid";
5108 3695
5109 - // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $query2 is prepared above, submission values lookup requires direct query
5110 3696 $data2 = $wpdb->get_results($query2, OBJECT);
5111 3697
5112 3698 foreach ($data2 as $row) {
5113 3699 switch ($row->afsv_type) {
@@ -5114,15 +3700,12 @@
5114 3700 case 'file' :
5115 3701 if ($options['file_format'] == 'url' || $options['file_format'] == 'link') {
5116 3702 $fieldid = rawurlencode($row->afsv_field_id);
5117 3703 $filename = rawurlencode($row->afsv_value);
5118 - $url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$row->afsv_sub_id}&field={$fieldid}&file={$filename}&nonce=" . wp_create_nonce('accua_forms_download_nonce') . "&_wpnonce=" . wp_create_nonce('download_file_' . $row->afsv_sub_id . '_' . $fieldid);
5119 - if(isset($options['token'])){
5120 - $url .= '&token='.$options['token'];
5121 - }
3704 + $url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$row->afsv_sub_id}&field={$fieldid}&file={$filename}";
5122 3705 if ($options['file_format'] == 'link'){
5123 - $url = esc_url($url);
5124 - $filename = esc_html($row->afsv_value);
3706 + $url = htmlspecialchars($url,ENT_QUOTES);
3707 + $filename = htmlspecialchars($row->afsv_value,ENT_QUOTES);
5125 3708 $fielddata = "<a href='{$url}' target='_blank'>{$filename}</a>";
5126 3709 } else {
5127 3710 $fielddata = $url;
5128 3711 }
@@ -5147,20 +3730,11 @@
5147 3730 $fid = $atts['fid'];
5148 3731 $form_data = _accua_forms_get_form_data($fid, false);
5149 3732
5150 3733 if (! $form_data) {
5151 - // In preview mode, allow unsaved (new) forms to render using draft + defaults
5152 - if (! apply_filters('accua_forms_use_draft_for_preview', false)) {
5153 - return '';
5154 - }
5155 - $default_form_data = get_option('accua_forms_default_form_data', array());
5156 - $empty_form_data = _accua_forms_get_form_data(false);
5157 - $form_data = array('_overrided' => array()) + $default_form_data + $empty_form_data;
3734 + return '';
5158 3735 }
5159 3736
5160 - // Note: Preview field order override is handled in accua_forms_form_generate()
5161 - // which applies the filter there for live preview
5162 -
5163 3737 $fid = '__accua-form__'.$fid;
5164 3738
5165 3739 $out = '';
5166 3740
@@ -5165,24 +3739,12 @@
5165 3739 $out = '';
5166 3740
5167 3741 if (AccuaForm::getSubmittedID() == $fid) {
5168 3742 /* return "<pre>Form submitted.\n\nData: " . print_r(AccuaForm::getSubmittedData(), true) . '</pre>'; */
5169 - // Get per-form messages (supports multiple forms on same page)
5170 - $messages = AccuaForm::getSubmittedMessages($fid);
5171 - if ($messages && trim($messages) !== '') {
3743 + $messages = AccuaForm::getSubmittedMessages();
3744 + if ($messages) {
5172 3745 $out .= '<div id="_response_messages_'.$fid.'" class="accua-form-messages">'.$messages.'</div>';
5173 3746 }
5174 -
5175 - // Non-AJAX fallback: scroll to result anchor and set URL hash on page load
5176 - $anchor_suffix = preg_replace('/[^a-zA-Z0-9]+/', '_', str_replace('__accua-form__', '', $fid));
5177 - $hash_type = AccuaForm::isValid() ? 'formSubmitSuccess' : 'formSubmitInvalid';
5178 - $anchor_full = esc_js($hash_type . '-' . $anchor_suffix);
5179 - $out .= '<script>document.addEventListener("DOMContentLoaded",function(){'
5180 - . 'var t=document.getElementById("' . $anchor_full . '");'
5181 - . 'if(t){t.scrollIntoView({behavior:"smooth",block:"start"});'
5182 - . 'if(history.replaceState)history.replaceState(null,"","#' . $anchor_full . '")'
5183 - . '}});</script>';
5184 -
5185 3747 if (AccuaForm::isValid()) {
5186 3748 return $out;
5187 3749 }
5188 3750 $form = AccuaForm::getSubmittedForm();
@@ -5187,28 +3749,13 @@
5187 3749 }
5188 3750 $form = AccuaForm::getSubmittedForm();
5189 3751 } else {
5190 3752 $analytics_data = get_option('accua_forms_default_analytics_data',array());
5191 -
5192 - // Check for preview layout override (allows live preview of layout changes before save)
5193 - $layout = $form_data['layout'];
5194 - $preview_layout_override = apply_filters('accua_forms_preview_layout_override', '');
5195 - if ($preview_layout_override) {
5196 - $layout = $preview_layout_override;
5197 - }
5198 -
5199 - // If layout is empty (meaning "use default"), resolve to the global default layout
5200 - if (empty($layout)) {
5201 - $default_form_data = get_option('accua_forms_default_form_data', array());
5202 - $layout = !empty($default_form_data['layout']) ? $default_form_data['layout'] : 'sidebyside';
5203 - }
5204 -
5205 3753 $params = array(
5206 - 'layout' => $layout,
3754 + 'layout' => $form_data['layout'],
5207 3755 'title' => $form_data['title'],
5208 3756 'track_submit' => !empty($analytics_data['analytics_track_submit']),
5209 3757 'track_fields' => !empty($analytics_data['analytics_track_fields']),
5210 - 'gads_conversion_tracking_code' => $form_data['gads_conversion_tracking_code'],
5211 3758 );
5212 3759 $form = AccuaForm::create($fid, $params);
5213 3760 }
5214 3761
@@ -5214,10 +3761,9 @@
5214 3761
5215 3762 $out .= $form->render(true);
5216 3763
5217 3764 $doing_ajax = function_exists('wp_doing_ajax') ? wp_doing_ajax() : (defined( 'DOING_AJAX' ) && DOING_AJAX);
5218 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check for Yoast SEO compatibility, strips HTML for preview
5219 - if ($doing_ajax && isset($_REQUEST['action']) && ($_REQUEST['action'] === 'wpseo_filter_shortcodes')) {
3765 + if ($doing_ajax && ($_REQUEST['action'] === 'wpseo_filter_shortcodes')) {
5220 3766 $strip_regexp = '/(<iframe[^>]*>(.*?)<\/iframe>|<script[^>]*>(.*?)<\/script>|<input([^>]*)type="hidden"[^>]*>)/is';
5221 3767 $out = preg_replace($strip_regexp, '', $out);
5222 3768 }
5223 3769
@@ -5226,15 +3772,12 @@
5226 3772 }
5227 3773
5228 3774 function accua_forms_include($fid, $atts=array(), $content = '', $code = '') {
5229 3775 $atts['fid'] = $fid;
5230 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Shortcode handler manages its own escaping
5231 3776 echo accua_forms_shortcode_handler($atts, $content, $code);
5232 3777 }
5233 3778
5234 -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound -- Internal helper function, double underscore prefix indicates private
5235 3779 function __accua_forms_submissions_list_page(){
5236 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing, actual actions have nonce checks
5237 3780 if(isset($_GET['sid'])) {
5238 3781 accua_forms_single_submission();
5239 3782 } else {
5240 3783 accua_forms_submissions_list_page();
@@ -5239,23 +3782,9 @@
5239 3782 } else {
5240 3783 accua_forms_submissions_list_page();
5241 3784 }
5242 3785 }
5243 -function accua_forms_submissions_list_page_load(){
5244 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing for screen option registration
5245 - if(isset($_GET['sid'])) {
5246 - return;
5247 - }
5248 - add_screen_option('per_page', array(
5249 - 'default' => 100,
5250 - 'option' => 'accua_forms_submissions_per_page',
5251 - ));
5252 -}
5253 -add_filter('set_screen_option_accua_forms_submissions_per_page', function($status, $option, $value) {
5254 - return (int) $value;
5255 -}, 10, 3);
5256 3786 function accua_forms_submissions_list_page_head(){
5257 - // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing, actual actions have nonce checks
5258 3787 if(isset($_GET['sid'])) {
5259 3788 require_once('accua-forms-single-submission.php');
5260 3789 accua_forms_single_submission(true);
5261 3790 } else {
@@ -5264,127 +3793,21 @@
5264 3793 }
5265 3794
5266 3795 }
5267 3796
5268 -/* Generiamo token di sicurezza per poter accedere anche da anonimo - email */
5269 -function accua_forms_generate_download_token($subid) {
5270 - global $wpdb;
5271 - $token = wp_generate_password(32, false); // Token casuale di 32 caratteri
5272 -
5273 - // Controlla se esiste già un token per questo sub_id
5274 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Token lookup requires direct query
5275 - $existing_token = $wpdb->get_var($wpdb->prepare(
5276 - "SELECT afsv_value FROM `{$wpdb->prefix}accua_forms_submissions_values` WHERE afsv_sub_id = %d AND afsv_field_id = '_accua_download_token'",
5277 - $subid
5278 - ));
5279 - if ($existing_token) {
5280 - return $existing_token;
5281 - } else{
5282 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Token insert requires direct query
5283 - $wpdb->insert(
5284 - $wpdb->prefix . 'accua_forms_submissions_values',
5285 - [
5286 - 'afsv_sub_id' => $subid,
5287 - 'afsv_field_id' => '_accua_download_token',
5288 - 'afsv_type' => 'token',
5289 - 'afsv_value' => $token
5290 - ],
5291 - ['%d', '%s', '%s', '%s']
5292 - );
5293 - return $token;
5294 - }
5295 -}
5296 -
5297 -function accua_forms_check_download_token($subid, $get_token) {
5298 - global $wpdb;
5299 -
5300 - $subid = (int) $subid; // Cast to integer for security
5301 -
5302 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Token verification requires direct query
5303 - $saved_token = $wpdb->get_var($wpdb->prepare(
5304 - "SELECT afsv_value FROM `{$wpdb->prefix}accua_forms_submissions_values` WHERE afsv_sub_id = %d AND afsv_field_id = '_accua_download_token'",
5305 - $subid
5306 - ));
5307 -
5308 - // Debug logging for token verification (comment out in production)
5309 - // error_log("Token check: Submission ID: $subid, Provided token: $get_token, Saved token: $saved_token");
5310 -
5311 - return isset($get_token) && $get_token === $saved_token;
5312 -}
5313 -
5314 -/**
5315 - * Gestisce il download di un file inviato tramite un modulo.
5316 - *
5317 - * Questa funzione viene eseguita tramite una richiesta AJAX e permette agli utenti di scaricare
5318 - * un file precedentemente caricato con un modulo. Controlla i parametri della richiesta per verificare
5319 - * la presenza di un file associato a un determinato ID di invio e campo del modulo.
5320 - *
5321 - * - Se il parametro "html" è presente, genera una pagina HTML con un link di reindirizzamento automatico.
5322 - * - Recupera le informazioni del file dal database per verificarne l'esistenza.
5323 - * - Se il file esiste e può essere letto, restituisce il contenuto con gli appropriati header HTTP.
5324 - * - Se il file non viene trovato, restituisce un errore 404.
5325 - *
5326 - * Sicurezza:
5327 - * - Nonce
5328 - * - Utilizza `stripslashes_deep` per sanificare i dati in ingresso.
5329 - * - Protegge il database utilizzando `wpdb->prepare` per prevenire SQL Injection.
5330 - * - Determina il tipo MIME del file per un download sicuro.
5331 - * - Aggiunto token di verifica per utenti
5332 - */
5333 -
5334 3797 add_action('wp_ajax_accua_forms_download_submitted_file', 'accua_forms_download_submitted_file');
5335 3798 add_action('wp_ajax_nopriv_accua_forms_download_submitted_file', 'accua_forms_download_submitted_file');
5336 3799 function accua_forms_download_submitted_file(){
5337 3800 $get = stripslashes_deep($_GET);
5338 - $token_valid = false;
5339 - $nonce_valid = false;
5340 - $subid = '';
5341 -
5342 - if(isset($get['subid'])){
5343 - $subid = rawurlencode($get['subid']);
5344 - }
5345 -
5346 - // First verify WordPress nonce for CSRF protection (for logged-in users)
5347 - if (isset($get['_wpnonce']) && wp_verify_nonce($get['_wpnonce'], 'download_file_' . $subid . '_' . $get['field'])) {
5348 - $nonce_valid = true;
5349 - }
5350 -
5351 - // For backward compatibility with older URL format that use 'nonce' instead of '_wpnonce'
5352 - if (!$nonce_valid && isset($get['nonce']) && check_ajax_referer('accua_forms_download_nonce', 'nonce', false)) {
5353 - $nonce_valid = true;
5354 - }
5355 -
5356 - // Check for token-based authentication (for email links and unauthenticated users)
5357 - if (isset($get['token']) && $subid != '') {
5358 - if (accua_forms_check_download_token($subid, $get['token']) == 1) {
5359 - $token_valid = true;
5360 - }
5361 - }
5362 -
5363 - // If both authentication methods fail, deny access
5364 - if (!$nonce_valid && !$token_valid) {
5365 - wp_die(esc_html__('Security check failed.', 'contact-forms'), 403);
5366 - }
5367 - // Additional permission check for admin users
5368 - if(!$token_valid && !$nonce_valid && $subid != ''){
5369 - // If neither token nor nonce is valid, check for logged-in admin permissions
5370 - if (!is_user_logged_in() || !current_user_can('manage_options')) {
5371 - wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'contact-forms'));
5372 - }
5373 - }
5374 3801 if (isset($get['subid'],$get['field'],$get['file'])) {
5375 - if (!empty($get['html'])) { /* export xls*/
3802 + if (!empty($get['html'])) {
5376 3803 header("Content-type: text/html");
5377 3804 $subid = rawurlencode($get['subid']);
5378 3805 $fieldid = rawurlencode($get['field']);
5379 3806 $filename = rawurlencode($get['file']);
5380 - $url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$subid}&field={$fieldid}&file={$filename}&nonce=" . wp_create_nonce('accua_forms_download_nonce') . "&_wpnonce=" . wp_create_nonce('download_file_' . $subid . '_' . $fieldid);
5381 - if(isset($get['token'])){
5382 - $url .= '&token='.$get['token'];
5383 - }
5384 - $url = esc_url($url);
5385 - $filename = esc_html($get['file']);
5386 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $filename and $url are pre-escaped above
3807 + $url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$subid}&field={$fieldid}&file={$filename}";
3808 + $url = htmlspecialchars($url,ENT_QUOTES);
3809 + $filename = htmlspecialchars($get['file'],ENT_QUOTES);
5387 3810 die("<html><head><title>{$filename}</title><meta http-equiv='refresh' content='0;URL={$url}'></head><body><a href='{$url}'>{$filename}</a></body></html>");
5388 3811 }
5389 3812 global $wpdb;
5390 3813 $subid = (int) $get['subid'];
@@ -5389,19 +3812,15 @@
5389 3812 global $wpdb;
5390 3813 $subid = (int) $get['subid'];
5391 3814 $field = $get['field'];
5392 3815 $file = $get['file'];
5393 - $query = $wpdb->prepare(
5394 - "SELECT *
5395 - FROM `{$wpdb->prefix}accua_forms_submissions_values`
5396 - WHERE afsv_sub_id = %d
5397 - AND afsv_field_id = %s
5398 - AND afsv_value = %s",
5399 - $subid,
5400 - $field,
5401 - $file
5402 - );
5403 - // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $query is prepared above, file download verification requires direct query
3816 + $query = "SELECT *
3817 + FROM `{$wpdb->prefix}accua_forms_submissions_values`
3818 + WHERE afsv_sub_id = %d
3819 + AND afsv_field_id = %s
3820 + AND afsv_value = %s
3821 + ";
3822 + $query = $wpdb->prepare($query, $subid, $field, $file);
5404 3823 $subval = $wpdb->get_results($query, OBJECT);
5405 3824 if ($subval) {
5406 3825 $file_data = get_option('accua_forms_default_file_field_data',array()) + array('dest_path' => '');
5407 3826 $dest_path = _accua_forms_get_abs_dest_path($file_data['dest_path']);
@@ -5407,9 +3826,9 @@
5407 3826 $dest_path = _accua_forms_get_abs_dest_path($file_data['dest_path']);
5408 3827 $filename = "{$dest_path}/{$subid}_{$field}_{$file}";
5409 3828 if (is_file($filename) && is_readable($filename)){
5410 3829 if (function_exists('finfo_open')){
5411 - @ $finfo = finfo_open(FILEINFO_MIME_TYPE);
3830 + @ $finfo = finfo_open(FILEINFO_MIME);
5412 3831 if ($finfo) {
5413 3832 @ $filetype = finfo_file($finfo, $filename);
5414 3833 @ finfo_close($finfo);
5415 3834 }
@@ -5419,23 +3838,15 @@
5419 3838 }
5420 3839 if (empty($filetype)) {
5421 3840 $filetype = "application/octet-stream";
5422 3841 }
5423 - // Clean any output buffers to prevent stale content from being sent before the file
5424 - while (ob_get_level()) {
5425 - ob_end_clean();
5426 - }
5427 - // Remove all pre-set headers (admin-ajax.php sets Content-Type: text/html early)
5428 - header_remove();
5429 - nocache_headers();
5430 - header("Content-Type: $filetype");
5431 - header("Content-Length: ".filesize($filename));
3842 + header("Content-type: $filetype");
3843 + header("Content-length: ".filesize($filename));
5432 3844 if (empty($_GET['view'])) {
5433 - header("Content-Disposition: attachment; filename=\"$file\"");
3845 + header("Content-disposition: attachment; filename=\"$file\"");
5434 3846 }
5435 - // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- WP_Filesystem not suitable for binary file streaming
5436 3847 readfile($filename);
5437 - exit;
3848 + die('');
5438 3849 }
5439 3850 }
5440 3851 }
5441 3852 header("HTTP/1.0 404 Not Found");
@@ -5455,87 +3866,17 @@
5455 3866 function accua_forms_preview() {
5456 3867 if (!current_user_can('manage_options')){
5457 3868 die ('');
5458 3869 }
5459 -
5460 - // Check nonce for CSRF protection
5461 - $nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '';
5462 - if ( ! wp_verify_nonce( $nonce, 'accua_forms_preview' ) ) {
5463 - wp_die( esc_html__( 'Security check failed.', 'contact-forms' ), 403 );
5464 - }
5465 3870
5466 - // Enqueue form styles before printing them
5467 - accua_form_enqueue_scripts_and_styles();
5468 -
5469 - // Accept temporary layout override for live preview (before save)
5470 - // This allows real-time preview when user changes layout dropdown
5471 - $preview_layout = '';
5472 - if ( ! empty( $_REQUEST['preview_layout'] ) ) {
5473 - $layout_input = sanitize_text_field( wp_unslash( $_REQUEST['preview_layout'] ) );
5474 - $allowed_layouts = array( 'toplabel', 'sidebyside', 'inlinelabel' );
5475 - if ( in_array( $layout_input, $allowed_layouts, true ) ) {
5476 - $preview_layout = $layout_input;
5477 - } elseif ( 'default' === $layout_input ) {
5478 - // 'default' means use the global default layout
5479 - $default_form_data = get_option( 'accua_forms_default_form_data', array() );
5480 - $preview_layout = ! empty( $default_form_data['layout'] ) ? $default_form_data['layout'] : 'sidebyside';
5481 - }
5482 - }
5483 -
5484 - // Accept temporary field order for live preview (before save)
5485 - // This allows preview to show reordered fields without saving to database
5486 - $preview_order = null;
5487 - if ( ! empty( $_REQUEST['preview_order'] ) ) {
5488 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- JSON decoded and validated below
5489 - $order_json = wp_unslash( $_REQUEST['preview_order'] );
5490 - $preview_order = json_decode( $order_json, true );
5491 - if ( json_last_error() !== JSON_ERROR_NONE ) {
5492 - $preview_order = null;
5493 - }
5494 - }
5495 -
5496 - // Store the preview layout override in a filter so shortcode handler can use it
5497 - if ($preview_layout) {
5498 - add_filter('accua_forms_preview_layout_override', function() use ($preview_layout) {
5499 - return $preview_layout;
5500 - });
5501 - }
5502 -
5503 - // Store the preview order override in a filter so shortcode handler can use it
5504 - if ($preview_order) {
5505 - add_filter('accua_forms_preview_order_override', function() use ($preview_order) {
5506 - return $preview_order;
5507 - });
5508 - }
5509 -
5510 - // Signal that we're in admin preview mode - form generator should read from draft
5511 - add_filter('accua_forms_use_draft_for_preview', '__return_true');
5512 -
5513 3871 echo '<html><head>
5514 3872 <style>
5515 - *, *::before, *::after { box-sizing: border-box; }
5516 - body {
5517 - font-family: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;
5518 - margin: 0;
5519 - padding: 16px;
5520 - background: #fff;
5521 - font-size: 14px;
5522 - line-height: 1.5;
5523 - }
3873 + body {font-family: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;}
5524 3874 </style>';
5525 3875 wp_print_styles();
5526 3876 wp_print_head_scripts();
5527 3877 echo '</head><body>';
5528 - $preview_fid = isset($_REQUEST['fid']) ? sanitize_text_field(wp_unslash($_REQUEST['fid'])) : '';
5529 -
5530 - // Check if the form has any fields — show placeholder if empty
5531 - $draft_data = _accua_forms_get_draft_data($preview_fid);
5532 - if (empty($draft_data['fields'])) {
5533 - echo '<p style="color:#50575e;text-align:center;margin-top:40px;">' . esc_html__('Add fields to the form to see the preview.', 'contact-forms') . '</p>';
5534 - } else {
5535 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Shortcode handler manages its own escaping
5536 - echo accua_forms_shortcode_handler(array('fid' => $preview_fid));
5537 - }
3878 + echo accua_forms_shortcode_handler(array('fid'=>$_REQUEST['fid']));
5538 3879 wp_print_footer_scripts();
5539 3880 echo '</body></html>';
5540 3881 die('');
5541 3882 }
@@ -5549,24 +3890,17 @@
5549 3890 header("HTTP/1.0 401 Access Denied");
5550 3891 //header("Status: 401 Access Denied");
5551 3892 die('You are not authorized to access this page.');
5552 3893 }
5553 -
5554 - // Check nonce for CSRF protection
5555 - if (!isset($_REQUEST['_wpnonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])), 'accua_forms_export_excel')) {
5556 - wp_die(esc_html__('Security check failed.', 'contact-forms'), 403);
5557 - }
5558 3894
5559 3895 require_once('accua-forms-submissions-page.php');
5560 3896 $listTable = new Accua_Forms_Submissions_List_Table();
5561 3897 $listTable->export_xls = true;
5562 3898 $listTable->prepare_items(true);
5563 - // Sanitize column selection input
5564 - $show_col_input = isset($_GET['accua_show_field']) ? sanitize_text_field(wp_unslash($_GET['accua_show_field'])) : '';
5565 - $show_col = array_map('sanitize_key', explode(',', $show_col_input));
3899 + $show_col = explode( ',', $_GET['accua_show_field']);
5566 3900 $show_col = array_diff($show_col, array('singlesub'));
5567 - header('Content-disposition: attachment; filename=downloads-report.xls');
5568 - header('Content-type: application/vnd.ms-excel');
3901 + header("Content-disposition: attachment; filename=downloads-report.xls");
3902 + header("Content-type: application/vnd.ms-excel");
5569 3903 accua_forms_submission_page_save_excel_general($listTable,$show_col);
5570 3904 die('');
5571 3905 }
5572 3906
@@ -5581,9 +3915,9 @@
5581 3915 ?><html xmlns:o="urn:schemas-microsoft-com:office:office"
5582 3916 xmlns:x="urn:schemas-microsoft-com:office:excel"
5583 3917 xmlns="http://www.w3.org/TR/REC-html40">
5584 3918 <head>
5585 - <meta http-equiv=Content-Type content="<?php echo esc_attr( $content_type ); ?>" />
3919 + <meta http-equiv=Content-Type content="<?php echo $content_type; ?>" />
5586 3920 <meta name=ProgId content=Excel.Sheet />
5587 3921 <style>
5588 3922 <!--
5589 3923 td {vertical-align:top;}
@@ -5622,9 +3956,9 @@
5622 3956 <?php
5623 3957 $cols = $listTable->get_columns();
5624 3958 foreach($cols as $col_key=>$col_value) {
5625 3959 if(in_array($col_key, $show_col)) { ?>
5626 - <td x:autofilter="all"><?php echo esc_html( $col_value ); ?></td>
3960 + <td x:autofilter="all"><?php echo $col_value; ?></td>
5627 3961 <?php }
5628 3962 } ?>
5629 3963 </tr>
5630 3964
@@ -5631,24 +3965,22 @@
5631 3965 <?php
5632 3966 $lead_statuses = accua_forms_get_lead_statuses();
5633 3967
5634 3968 foreach($listTable->items as $id_submission=>$single_submission) {
5635 - // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Required to prevent timeout during large exports
5636 3969 @ set_time_limit(10);
5637 3970 echo "<tr>";
5638 3971 foreach($cols as $col_key=>$col_value) {
5639 3972 if(in_array($col_key, $show_col)) {
5640 - echo '<td class="' . esc_attr($col_key) . '">';
3973 + echo "<td class='.$col_key.'>";
5641 3974 if ($col_key == 'lead_status') {
5642 3975 if (isset($lead_statuses[$single_submission['lead_status']])) {
5643 - echo esc_html($lead_statuses[$single_submission['lead_status']]);
3976 + echo htmlspecialchars($lead_statuses[$single_submission['lead_status']]);
5644 3977 }
5645 - } elseif(isset($single_submission[$col_key])) {
3978 + } else if(isset($single_submission[$col_key])) {
5646 3979 if ( method_exists( $listTable, 'column_' . $col_key ) ) {
5647 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- List table column methods handle their own escaping
5648 3980 echo call_user_func( array( &$listTable, 'column_' . $col_key ), $single_submission );
5649 - } else {
5650 - // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- List table column_default handles escaping
3981 + }
3982 + else {
5651 3983 echo $listTable->column_default( $single_submission, $col_key );
5652 3984 }
5653 3985 }
5654 3986 echo "</td>";
@@ -5668,36 +4000,34 @@
5668 4000 function accua_forms_print_tokens() {
5669 4001 $avail_fields = get_option('accua_forms_avail_fields', array());
5670 4002 $tokens = '';
5671 4003 foreach($avail_fields as $key=>$value) {
5672 - $field_name = $value['name'] ?? $value['label'] ?? $key;
5673 - $tokens .= $field_name . ": {" . $key . "}\n";
4004 + $tokens .= $value['name'] . ": {" . $key . "}\n";
5674 4005 switch ($value['type']) {
5675 4006 case 'file':
5676 - $tokens .= $field_name . " (download link): {__download_" . $key . "}\n";
4007 + $tokens .= $value['name'] . " (download link): {__download_" . $key . "}\n";
5677 4008 break;
5678 4009 case 'multiselect':
5679 4010 case 'multicheckbox':
5680 - $tokens .= $field_name . " (labels): {__label_" . $key . "}\n";
4011 + $tokens .= $value['name'] . " (labels): {__label_" . $key . "}\n";
5681 4012 break;
5682 4013 case 'select':
5683 4014 case 'radio':
5684 - $tokens .= $field_name . " (label): {__label_" . $key . "}\n";
4015 + $tokens .= $value['name'] . " (label): {__label_" . $key . "}\n";
5685 4016 break;
5686 4017 case 'post-multicheckbox':
5687 - $tokens .= $field_name . " (posts titles): {__label_" . $key . "}\n";
5688 - $tokens .= $field_name . " (posts ids): {__post_id_" . $key . "}\n";
5689 - $tokens .= $field_name . " (posts urls): {__post_url_" . $key . "}\n";
4018 + $tokens .= $value['name'] . " (posts titles): {__label_" . $key . "}\n";
4019 + $tokens .= $value['name'] . " (posts ids): {__post_id_" . $key . "}\n";
4020 + $tokens .= $value['name'] . " (posts urls): {__post_url_" . $key . "}\n";
5690 4021 break;
5691 4022 case 'post-select':
5692 - $tokens .= $field_name . " (post title): {__label_" . $key . "}\n";
5693 - $tokens .= $field_name . " (post id): {__post_id_" . $key . "}\n";
5694 - $tokens .= $field_name . " (post url): {__post_url_" . $key . "}\n";
4023 + $tokens .= $value['name'] . " (post title): {__label_" . $key . "}\n";
4024 + $tokens .= $value['name'] . " (post id): {__post_id_" . $key . "}\n";
4025 + $tokens .= $value['name'] . " (post url): {__post_url_" . $key . "}\n";
5695 4026 break;
5696 4027 }
5697 4028 }
5698 4029
5699 - // phpcs:disable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped -- Heredoc for tokens help HTML
5700 4030 echo <<<EOT
5701 4031 <div class="accua_forms_token_list">
5702 4032 <h2>Tokens</h2>
5703 4033 <em>In HTML text, use {!token_name} to insert unfiltered token value</em>
@@ -5735,373 +4065,356 @@
5735 4065 {__confirmation_emails_message}
5736 4066 {__review_submission_url}</pre>
5737 4067 </div>
5738 4068 EOT;
5739 - // phpcs:enable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
5740 4069 do_action('accua_forms_print_tokens');
5741 4070 }
5742 4071
5743 -/**
5744 - * Get posts/pages for post-select fields using get_posts() for WPML compatibility.
5745 - *
5746 - * Uses WordPress get_posts() instead of direct SQL to ensure WPML and other
5747 - * language plugins can filter results to current language automatically.
5748 - *
5749 - * Performance considerations:
5750 - * - Results are cached using transients (5 minute TTL) to reduce database queries
5751 - * - meta_key/meta_value queries are necessary for filtering by custom fields
5752 - * - post__not_in is used only when exclude is explicitly requested by admin
5753 - * - Default limit of 500 posts prevents runaway queries
5754 - *
5755 - * @since 2.0.0-beta.29
5756 - * @param string|array $args Query arguments (backward compatible with old function).
5757 - * @return array Array of post objects.
5758 - */
5759 4072 function accua_get_pages($args = '') {
5760 - // phpcs:disable WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude, WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- These are function parameter defaults, not actual query execution.
4073 + global $wpdb;
4074 +
5761 4075 $defaults = array(
5762 - 'child_of' => 0,
5763 - 'sort_order' => 'ASC',
5764 - 'sort_column' => 'post_title',
5765 - 'hierarchical' => 1,
5766 - 'exclude' => array(),
5767 - 'include' => array(),
5768 - 'meta_key' => '',
5769 - 'meta_value' => '',
5770 - 'meta_value_lt' => '',
5771 - 'meta_value_gt' => '',
5772 - 'meta_value_le' => '',
5773 - 'meta_value_ge' => '',
5774 - 'meta_value_like' => '',
5775 - 'meta_value_format' => 'string',
5776 - 'authors' => '',
5777 - 'parent' => -1,
5778 - 'exclude_tree' => '',
5779 - 'number' => 500, // Default limit for performance
5780 - 'offset' => 0,
5781 - 'post_type' => 'page',
5782 - 'post_status' => 'publish',
5783 - 'suppress_filters' => false, // IMPORTANT: Allow WPML to filter by language
5784 - 's' => '', // Search term (new parameter for AJAX search)
4076 + 'child_of' => 0,
4077 + 'sort_order' => 'ASC',
4078 + 'sort_column' => 'post_title',
4079 + 'hierarchical' => 1,
4080 + 'exclude' => array(),
4081 + 'include' => array(),
4082 + 'meta_key' => '',
4083 + 'meta_value' => '',
4084 + 'meta_value_lt' => '',
4085 + 'meta_value_gt' => '',
4086 + 'meta_value_le' => '',
4087 + 'meta_value_ge' => '',
4088 + 'meta_value_like' => '',
4089 + 'meta_value_format' => 'string',
4090 + 'authors' => '',
4091 + 'parent' => -1,
4092 + 'exclude_tree' => '',
4093 + 'number' => '',
4094 + 'offset' => 0,
4095 + 'post_type' => 'page',
4096 + 'post_status' => 'publish',
5785 4097 );
5786 - // phpcs:enable WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude, WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value
5787 4098
5788 - $r = wp_parse_args($args, $defaults);
4099 + $r = wp_parse_args( $args, $defaults );
4100 + $child_of = (int) $r['child_of'];
4101 + $sort_order = $r['sort_order'];
4102 + $sort_column = $r['sort_column'];
4103 + $hierarchical = $r['hierarchical'];
4104 + $exclude = $r['exclude'];
4105 + $include = $r['include'];
4106 + $meta_key = $r['meta_key'];
4107 + $meta_value = $r['meta_value'];
4108 + $meta_value_lt = $r['meta_value_lt'];
4109 + $meta_value_gt = $r['meta_value_gt'];
4110 + $meta_value_le = $r['meta_value_le'];
4111 + $meta_value_ge = $r['meta_value_ge'];
4112 + $meta_value_like = $r['meta_value_like'];
4113 + $meta_value_format = $r['meta_value_format'];
4114 + $authors = $r['authors'];
4115 + $parent = $r['parent'];
4116 + $exclude_tree = $r['exclude_tree'];
4117 + $number = (int) $r['number'];
4118 + $offset = (int) $r['offset'];
4119 + $post_type = $r['post_type'];
4120 + $post_status = $r['post_status'];
5789 4121
5790 - // Generate cache key based on arguments and current language
5791 - $cache_key_data = $r;
5792 - // Add current language to cache key for WPML/Polylang compatibility
5793 - if (function_exists('pll_current_language')) {
5794 - $cache_key_data['_lang'] = pll_current_language();
5795 - } elseif (defined('ICL_LANGUAGE_CODE')) {
5796 - $cache_key_data['_lang'] = ICL_LANGUAGE_CODE;
5797 - }
5798 - $cache_key = 'accua_pages_' . md5(wp_json_encode($cache_key_data));
4122 + /*
4123 + // Make sure the post type is hierarchical
4124 + $hierarchical_post_types = get_post_types( array( 'hierarchical' => true ) );
4125 + if ( !in_array( $post_type, $hierarchical_post_types ) )
4126 + return false;
4127 + */
5799 4128
5800 - // Check transient cache first (skip for search queries and random ordering)
5801 - $use_cache = empty($r['s']) && $r['sort_column'] !== 'rand';
5802 - if ($use_cache) {
5803 - $cached = get_transient($cache_key);
5804 - if ($cached !== false) {
5805 - return $cached;
5806 - }
5807 - }
4129 + // Make sure we have a valid post type
4130 + if ( !is_array( $post_type ) )
4131 + $post_type = explode( ',', $post_type );
4132 + if ( array_diff( $post_type, get_post_types() ) )
4133 + return false;
5808 4134
5809 - // Validate post type
5810 - $post_type = $r['post_type'];
5811 - if (!is_array($post_type)) {
5812 - $post_type = array_map('trim', explode(',', $post_type));
5813 - }
5814 - $valid_post_types = get_post_types();
5815 - $post_type = array_filter($post_type, function($pt) use ($valid_post_types) {
5816 - return in_array($pt, $valid_post_types, true);
5817 - });
5818 - if (empty($post_type)) {
5819 - return array();
5820 - }
4135 + // Make sure we have a valid post status
4136 + if ( !is_array( $post_status ) )
4137 + $post_status = explode( ',', $post_status );
4138 + if ( array_diff( $post_status, get_post_stati() ) )
4139 + return false;
5821 4140
5822 - // Validate post status
5823 - $post_status = $r['post_status'];
5824 - if (!is_array($post_status)) {
5825 - $post_status = array_map('trim', explode(',', $post_status));
4141 + /*
4142 + $cache = array();
4143 + $key = md5( serialize( compact(array_keys($defaults)) ) );
4144 + if ( $cache = wp_cache_get( 'get_pages', 'posts' ) ) {
4145 + if ( is_array($cache) && isset( $cache[ $key ] ) ) {
4146 + $pages = apply_filters('get_pages', $cache[ $key ], $r );
4147 + return $pages;
5826 4148 }
5827 - $valid_statuses = get_post_stati();
5828 - $post_status = array_filter($post_status, function($ps) use ($valid_statuses) {
5829 - return in_array($ps, $valid_statuses, true);
5830 - });
5831 - if (empty($post_status)) {
5832 - $post_status = array('publish');
5833 4149 }
5834 4150
5835 - // Map sort_column to orderby
5836 - $orderby_map = array(
5837 - 'post_title' => 'title',
5838 - 'title' => 'title',
5839 - 'post_date' => 'date',
5840 - 'date' => 'date',
5841 - 'post_modified' => 'modified',
5842 - 'modified' => 'modified',
5843 - 'menu_order' => 'menu_order',
5844 - 'post_name' => 'name',
5845 - 'name' => 'name',
5846 - 'post_parent' => 'parent',
5847 - 'parent' => 'parent',
5848 - 'ID' => 'ID',
5849 - 'rand' => 'rand',
5850 - 'comment_count' => 'comment_count',
5851 - 'post_author' => 'author',
5852 - 'author' => 'author',
5853 - );
5854 - $sort_column = $r['sort_column'];
5855 - $orderby = isset($orderby_map[$sort_column]) ? $orderby_map[$sort_column] : 'title';
4151 + if ( !is_array($cache) )
4152 + $cache = array();
4153 + */
5856 4154
5857 - // Build get_posts arguments
5858 - $query_args = array(
5859 - 'post_type' => $post_type,
5860 - 'post_status' => $post_status,
5861 - 'orderby' => $orderby,
5862 - 'order' => strtoupper($r['sort_order']) === 'DESC' ? 'DESC' : 'ASC',
5863 - 'posts_per_page' => !empty($r['number']) ? (int) $r['number'] : 500,
5864 - 'offset' => (int) $r['offset'],
5865 - 'suppress_filters' => (bool) $r['suppress_filters'],
5866 - );
5867 -
5868 - // Search term
5869 - if (!empty($r['s'])) {
5870 - $query_args['s'] = sanitize_text_field($r['s']);
4155 + $inclusions = '';
4156 + if ( !empty($include) ) {
4157 + $child_of = 0; //ignore child_of, parent, exclude, meta_key, and meta_value params if using include
4158 + $parent = -1;
4159 + $exclude = '';
4160 + $meta_key = '';
4161 + $meta_value = '';
4162 + $meta_value_lt = '';
4163 + $meta_value_gt = '';
4164 + $meta_value_le = '';
4165 + $meta_value_ge = '';
4166 + $meta_value_like = '';
4167 + $hierarchical = false;
4168 + $incpages = wp_parse_id_list( $include );
4169 + if ( ! empty( $incpages ) ) {
4170 + foreach ( $incpages as $incpage ) {
4171 + if (empty($inclusions))
4172 + $inclusions = $wpdb->prepare(' AND ( ID = %d ', $incpage);
4173 + else
4174 + $inclusions .= $wpdb->prepare(' OR ID = %d ', $incpage);
4175 + }
4176 + }
5871 4177 }
4178 + if (!empty($inclusions))
4179 + $inclusions .= ')';
5872 4180
5873 - // Include specific posts (overrides other filters)
5874 - if (!empty($r['include'])) {
5875 - $include = wp_parse_id_list($r['include']);
5876 - if (!empty($include)) {
5877 - $query_args['post__in'] = $include;
5878 - $query_args['orderby'] = 'post__in'; // Preserve include order
5879 - }
5880 - } else {
5881 - // Exclude posts - only used when admin explicitly configures exclusions.
5882 - if (!empty($r['exclude'])) {
5883 - $exclude = wp_parse_id_list($r['exclude']);
5884 - if (!empty($exclude)) {
5885 - // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- Exclusion is an optional admin-configured feature, not default behavior.
5886 - $query_args['post__not_in'] = $exclude;
4181 + $exclusions = '';
4182 + if ( !empty($exclude) ) {
4183 + $expages = wp_parse_id_list( $exclude );
4184 + if ( ! empty( $expages ) ) {
4185 + foreach ( $expages as $expage ) {
4186 + if (empty($exclusions))
4187 + $exclusions = $wpdb->prepare(' AND ( ID <> %d ', $expage);
4188 + else
4189 + $exclusions .= $wpdb->prepare(' AND ID <> %d ', $expage);
5887 4190 }
5888 4191 }
4192 + }
4193 + if (!empty($exclusions))
4194 + $exclusions .= ')';
5889 4195
5890 - // Parent filter
5891 - if ((int) $r['parent'] >= 0) {
5892 - $query_args['post_parent'] = (int) $r['parent'];
5893 - }
4196 + $author_query = '';
4197 + if (!empty($authors)) {
4198 + $post_authors = preg_split('/[\s,]+/',$authors);
5894 4199
5895 - // Child of (hierarchical)
5896 - if (!empty($r['child_of'])) {
5897 - $query_args['post_parent'] = (int) $r['child_of'];
5898 - }
4200 + if ( ! empty( $post_authors ) ) {
4201 + foreach ( $post_authors as $post_author ) {
4202 + //Do we have an author id or an author login?
4203 + if ( 0 == intval($post_author) ) {
4204 + $post_author = get_user_by('login', $post_author);
4205 + if ( empty($post_author) )
4206 + continue;
4207 + if ( empty($post_author->ID) )
4208 + continue;
4209 + $post_author = $post_author->ID;
4210 + }
5899 4211
5900 - // Authors filter
5901 - if (!empty($r['authors'])) {
5902 - $author_ids = array();
5903 - $post_authors = preg_split('/[\s,]+/', $r['authors']);
5904 - foreach ($post_authors as $post_author) {
5905 - $post_author = trim($post_author);
5906 - if (empty($post_author)) {
5907 - continue;
5908 - }
5909 - if (is_numeric($post_author)) {
5910 - $author_ids[] = (int) $post_author;
5911 - } else {
5912 - $user = get_user_by('login', $post_author);
5913 - if ($user && !empty($user->ID)) {
5914 - $author_ids[] = $user->ID;
5915 - }
5916 - }
4212 + if ( '' == $author_query )
4213 + $author_query = $wpdb->prepare(' post_author = %d ', $post_author);
4214 + else
4215 + $author_query .= $wpdb->prepare(' OR post_author = %d ', $post_author);
5917 4216 }
5918 - if (!empty($author_ids)) {
5919 - $query_args['author__in'] = $author_ids;
5920 - }
4217 + if ( '' != $author_query )
4218 + $author_query = " AND ($author_query)";
5921 4219 }
4220 + }
5922 4221
5923 - // Build meta_query for advanced meta comparisons
5924 - $meta_query = array();
4222 + $allowed_keys = array('author', 'post_author', 'date', 'post_date', 'title', 'post_title', 'name', 'post_name', 'modified',
4223 + 'post_modified', 'modified_gmt', 'post_modified_gmt', 'menu_order', 'parent', 'post_parent',
4224 + 'ID', 'rand', 'comment_count');
5925 4225
5926 - // Standard meta_key/meta_value - used for filtering posts by custom field.
5927 - // This is an optional admin-configured feature for advanced post filtering.
5928 - if (!empty($r['meta_key'])) {
5929 - // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Required for custom field filtering feature.
5930 - $query_args['meta_key'] = stripslashes($r['meta_key']);
5931 - if (!empty($r['meta_value'])) {
5932 - // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Required for custom field filtering feature.
5933 - $query_args['meta_value'] = stripslashes($r['meta_value']);
5934 - }
4226 + $join = '';
4227 + $where = "$exclusions $inclusions ";
4228 + if ( ! ( empty( $meta_key ) && empty( $meta_value )
4229 + && empty( $meta_value_lt ) && empty( $meta_value_gt )
4230 + && empty( $meta_value_le ) && empty( $meta_value_ge )
4231 + && empty( $meta_value_like ) ) ) {
4232 + $join = " LEFT JOIN $wpdb->postmeta ON ( $wpdb->posts.ID = $wpdb->postmeta.post_id )";
4233 + $allowed_keys[] = 'meta_key';
4234 + $allowed_keys[] = 'meta_value';
4235 +
4236 + // meta_key and meta_value might be slashed
4237 + $meta_key = stripslashes($meta_key);
4238 + $meta_value = stripslashes($meta_value);
4239 + $meta_value_lt = stripslashes($meta_value_lt);
4240 + $meta_value_gt = stripslashes($meta_value_gt);
4241 + $meta_value_le = stripslashes($meta_value_le);
4242 + $meta_value_ge = stripslashes($meta_value_ge);
4243 + $meta_value_like = stripslashes($meta_value_like);
4244 +
4245 + if ( ! empty( $meta_key ) ) {
4246 + $where .= $wpdb->prepare(" AND $wpdb->postmeta.meta_key = %s", $meta_key);
5935 4247 }
5936 4248
5937 - // Advanced meta comparisons (lt, gt, le, ge, like)
5938 - if (!empty($r['meta_key']) && (
5939 - !empty($r['meta_value_lt']) || !empty($r['meta_value_gt']) ||
5940 - !empty($r['meta_value_le']) || !empty($r['meta_value_ge']) ||
5941 - !empty($r['meta_value_like'])
5942 - )) {
5943 - $meta_key = stripslashes($r['meta_key']);
5944 - $meta_type = 'CHAR';
5945 - switch ($r['meta_value_format']) {
5946 - case 'int':
5947 - $meta_type = 'NUMERIC';
5948 - break;
5949 - case 'float':
5950 - $meta_type = 'DECIMAL';
5951 - break;
5952 - case 'timestamp':
5953 - $meta_type = 'DATETIME';
5954 - break;
5955 - }
4249 + $meta_value_field = "$wpdb->postmeta.meta_value";
4250 + $meta_value_timestamp = false;
4251 + switch($meta_value_format) {
4252 + case 'timestamp':
4253 + $meta_value_field = "TIMESTAMP( $meta_value_field )";
4254 + $meta_value_param = "FROM_UNIXTIME( %s )";
4255 + $meta_value_timestamp = true;
4256 + break;
4257 + case 'int':
4258 + $meta_value_param = "%d";
4259 + break;
4260 + case 'float':
4261 + $meta_value_param = "%f";
4262 + break;
4263 + //case 'string':
4264 + default:
4265 + $meta_value_param = "%s";
4266 + }
5956 4267
5957 - if (!empty($r['meta_value_lt'])) {
5958 - $value = stripslashes($r['meta_value_lt']);
5959 - if ($r['meta_value_format'] === 'timestamp') {
5960 - $value = gmdate('Y-m-d H:i:s', strtotime($value));
5961 - }
5962 - $meta_query[] = array(
5963 - 'key' => $meta_key,
5964 - 'value' => $value,
5965 - 'compare' => '<',
5966 - 'type' => $meta_type,
5967 - );
4268 + if ( ! empty( $meta_value ) ) {
4269 + if ($meta_value_timestamp) {
4270 + $meta_value = strtotime($meta_value);
5968 4271 }
5969 - if (!empty($r['meta_value_gt'])) {
5970 - $value = stripslashes($r['meta_value_gt']);
5971 - if ($r['meta_value_format'] === 'timestamp') {
5972 - $value = gmdate('Y-m-d H:i:s', strtotime($value));
5973 - }
5974 - $meta_query[] = array(
5975 - 'key' => $meta_key,
5976 - 'value' => $value,
5977 - 'compare' => '>',
5978 - 'type' => $meta_type,
5979 - );
4272 + $where .= $wpdb->prepare(" AND $meta_value_field = $meta_value_param", $meta_value);
4273 + }
4274 + if ( ! empty( $meta_value_lt ) ) {
4275 + if ($meta_value_timestamp) {
4276 + $meta_value_lt = strtotime($meta_value_lt);
5980 4277 }
5981 - if (!empty($r['meta_value_le'])) {
5982 - $value = stripslashes($r['meta_value_le']);
5983 - if ($r['meta_value_format'] === 'timestamp') {
5984 - $value = gmdate('Y-m-d H:i:s', strtotime($value));
5985 - }
5986 - $meta_query[] = array(
5987 - 'key' => $meta_key,
5988 - 'value' => $value,
5989 - 'compare' => '<=',
5990 - 'type' => $meta_type,
5991 - );
4278 + $where .= $wpdb->prepare(" AND $meta_value_field < $meta_value_param", $meta_value_lt);
4279 + }
4280 + if ( ! empty( $meta_value_gt ) ) {
4281 + if ($meta_value_timestamp) {
4282 + $meta_value_gt = strtotime($meta_value_gt);
5992 4283 }
5993 - if (!empty($r['meta_value_ge'])) {
5994 - $value = stripslashes($r['meta_value_ge']);
5995 - if ($r['meta_value_format'] === 'timestamp') {
5996 - $value = gmdate('Y-m-d H:i:s', strtotime($value));
5997 - }
5998 - $meta_query[] = array(
5999 - 'key' => $meta_key,
6000 - 'value' => $value,
6001 - 'compare' => '>=',
6002 - 'type' => $meta_type,
6003 - );
4284 + $where .= $wpdb->prepare(" AND $meta_value_field > $meta_value_param", $meta_value_gt);
4285 + }
4286 + if ( ! empty( $meta_value_le ) ) {
4287 + if ($meta_value_timestamp) {
4288 + $meta_value_le = strtotime($meta_value_le);
6004 4289 }
6005 - if (!empty($r['meta_value_like'])) {
6006 - $meta_query[] = array(
6007 - 'key' => $meta_key,
6008 - 'value' => stripslashes($r['meta_value_like']),
6009 - 'compare' => 'LIKE',
6010 - );
4290 + $where .= $wpdb->prepare(" AND $meta_value_field <= $meta_value_param", $meta_value_le);
4291 + }
4292 + if ( ! empty( $meta_value_ge ) ) {
4293 + if ($meta_value_timestamp) {
4294 + $meta_value_ge = strtotime($meta_value_ge);
6011 4295 }
6012 -
6013 - if (!empty($meta_query)) {
6014 - // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Required for advanced meta comparison operators (lt, gt, like, etc.).
6015 - $query_args['meta_query'] = $meta_query;
6016 - // Remove simple meta_value if we're using meta_query
6017 - unset($query_args['meta_value']);
4296 + $where .= $wpdb->prepare(" AND $meta_value_field >= $meta_value_param", $meta_value_ge);
4297 + }
4298 + if ( ! empty( $meta_value_like ) ) {
4299 + if ($meta_value_timestamp) {
4300 + $meta_value_like = strtotime($meta_value_like);
6018 4301 }
4302 + $where .= $wpdb->prepare(" AND $meta_value_field like $meta_value_param", $meta_value_like);
6019 4303 }
6020 4304 }
6021 4305
6022 - // Get posts using WordPress function (WPML automatically filters by current language)
6023 - $pages = get_posts($query_args);
4306 + if ( $parent >= 0 )
4307 + $where .= $wpdb->prepare(' AND post_parent = %d ', $parent);
6024 4308
6025 - if (empty($pages)) {
6026 - // Cache empty results too (5 minutes)
6027 - if ($use_cache) {
6028 - set_transient($cache_key, array(), 5 * MINUTE_IN_SECONDS);
4309 +
4310 + if ( 1 == count ( $post_type ) ) {
4311 + $where_post_type = $wpdb->prepare( "post_type = %s", array_shift( $post_type ) );
4312 + } else {
4313 + $post_type = implode( "', '", $post_type );
4314 + $where_post_type = "post_type IN ('$post_type')";
4315 + }
4316 +
4317 + if ( 1 == count( $post_status ) ) {
4318 + $where_post_type .= $wpdb->prepare( " AND post_status = %s", array_shift( $post_status ) );
4319 + } else {
4320 + $post_status = implode( "', '", $post_status );
4321 + $where_post_type .= " AND post_status IN ('$post_status')";
4322 + }
4323 +
4324 + $orderby_array = array();
4325 + foreach ( explode( ',', $sort_column ) as $orderby ) {
4326 + $orderby = trim( $orderby );
4327 + if ( !in_array( $orderby, $allowed_keys ) )
4328 + continue;
4329 +
4330 + switch ( $orderby ) {
4331 + case 'menu_order':
4332 + break;
4333 + case 'ID':
4334 + $orderby = "$wpdb->posts.ID";
4335 + break;
4336 + case 'rand':
4337 + $orderby = 'RAND()';
4338 + break;
4339 + case 'comment_count':
4340 + $orderby = "$wpdb->posts.comment_count";
4341 + break;
4342 + case 'meta_key':
4343 + case 'meta_value':
4344 + $orderby = "$wpdb->postmeta.$orderby";
4345 + break;
4346 + default:
4347 + if ( 0 === strpos( $orderby, 'post_' ) )
4348 + $orderby = "$wpdb->posts." . $orderby;
4349 + else
4350 + $orderby = "$wpdb->posts.post_" . $orderby;
6029 4351 }
6030 - /**
6031 - * Filters the list of pages retrieved from accua_get_pages.
6032 - *
6033 - * @since 2.0.0-beta.29
6034 - *
6035 - * @param array $pages List of page objects.
6036 - * @param array $r Arguments passed to accua_get_pages.
6037 - */
6038 - return apply_filters('accua_forms_get_pages', array(), $r);
4352 +
4353 + $orderby_array[] = $orderby;
4354 +
6039 4355 }
4356 + $sort_column = ! empty( $orderby_array ) ? implode( ',', $orderby_array ) : "$wpdb->posts.post_title";
6040 4357
6041 - // Handle hierarchical display with child_of
6042 - $child_of = (int) $r['child_of'];
6043 - $hierarchical = $r['hierarchical'];
6044 - if (($child_of || $hierarchical) && function_exists('get_page_children')) {
4358 + $sort_order = strtoupper( $sort_order );
4359 + if ( '' !== $sort_order && !in_array( $sort_order, array( 'ASC', 'DESC' ) ) )
4360 + $sort_order = 'ASC';
4361 +
4362 + $query = "SELECT * FROM $wpdb->posts $join WHERE ($where_post_type) $where ";
4363 + $query .= $author_query;
4364 + $query .= " ORDER BY " . $sort_column . " " . $sort_order ;
4365 +
4366 + if ( !empty($number) && !empty($offset) ) {
4367 + $query .= $wpdb->prepare(' LIMIT %d, %d', $offset, $number);
4368 + }
4369 +
4370 + //echo "<!-- accua_forms_query:\n$query\n-->";
4371 +
4372 + $pages = $wpdb->get_results($query);
4373 +
4374 + if ( empty($pages) ) {
4375 + $pages = apply_filters('get_pages', array(), $r);
4376 + return $pages;
4377 + }
4378 +
4379 + // Sanitize before caching so it'll only get done once
4380 + $num_pages = count($pages);
4381 + for ($i = 0; $i < $num_pages; $i++) {
4382 + $pages[$i] = sanitize_post($pages[$i], 'raw');
4383 + }
4384 +
4385 + /*
4386 + // Update cache.
4387 + update_post_cache( $pages );
4388 + */
4389 +
4390 + if ( $child_of || $hierarchical )
6045 4391 $pages = get_page_children($child_of, $pages);
6046 - }
6047 4392
6048 - // Exclude tree (remove a post and all its children)
6049 - if (!empty($r['exclude_tree'])) {
6050 - $exclude_tree = (int) $r['exclude_tree'];
6051 - $children = get_page_children($exclude_tree, $pages);
6052 - $excludes = array($exclude_tree);
6053 - foreach ($children as $child) {
4393 + if ( !empty($exclude_tree) ) {
4394 + $exclude = (int) $exclude_tree;
4395 + $children = get_page_children($exclude, $pages);
4396 + $excludes = array();
4397 + foreach ( $children as $child )
6054 4398 $excludes[] = $child->ID;
4399 + $excludes[] = $exclude;
4400 + $num_pages = count($pages);
4401 + for ( $i = 0; $i < $num_pages; $i++ ) {
4402 + if ( in_array($pages[$i]->ID, $excludes) )
4403 + unset($pages[$i]);
6055 4404 }
6056 - $pages = array_filter($pages, function($page) use ($excludes) {
6057 - return !in_array($page->ID, $excludes, true);
6058 - });
6059 - $pages = array_values($pages); // Re-index array
6060 4405 }
6061 4406
6062 - // Cache results for 5 minutes to improve performance
6063 - if ($use_cache) {
6064 - set_transient($cache_key, $pages, 5 * MINUTE_IN_SECONDS);
6065 - }
4407 + $pages = apply_filters('get_pages', $pages, $r);
6066 4408
6067 - /** This filter is documented above */
6068 - return apply_filters('accua_forms_get_pages', $pages, $r);
4409 + return $pages;
6069 4410 }
6070 4411
6071 -// phpcs:disable WordPress.DB.DirectDatabaseQuery
6072 4412 function accua_forms_trash_submission($id_sub){
6073 4413 global $wpdb;
6074 4414 return $wpdb->query($wpdb->prepare("UPDATE `{$wpdb->prefix}accua_forms_submissions` SET afs_status = -1 WHERE afs_id = %d", $id_sub)) !== FALSE;
6075 4415 }
6076 4416
6077 -function accua_forms_restore_submission($id_sub){
6078 - global $wpdb;
6079 - return $wpdb->query($wpdb->prepare("UPDATE `{$wpdb->prefix}accua_forms_submissions` SET afs_status = 0 WHERE afs_id = %d", $id_sub)) !== FALSE;
6080 -}
6081 -// phpcs:enable WordPress.DB.DirectDatabaseQuery
6082 -
6083 -/**
6084 - * Clear accua_get_pages cache when posts are modified.
6085 - *
6086 - * Called when posts are created, updated, deleted, or have status changed.
6087 - * This ensures that post-select dropdowns always show fresh data.
6088 - *
6089 - * @since 2.0.0-beta.29
6090 - * @param int $post_id Post ID that was modified.
6091 - */
6092 -function accua_forms_clear_pages_cache($post_id = 0) {
6093 - global $wpdb;
6094 - // Delete all transients that start with 'accua_pages_'
6095 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Direct query required to delete transients by prefix, and we're clearing cache not reading data.
6096 - $wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_accua_pages_%' OR option_name LIKE '_transient_timeout_accua_pages_%'");
6097 -}
6098 -// Clear cache when posts are modified
6099 -add_action('save_post', 'accua_forms_clear_pages_cache');
6100 -add_action('delete_post', 'accua_forms_clear_pages_cache');
6101 -add_action('trash_post', 'accua_forms_clear_pages_cache');
6102 -add_action('untrash_post', 'accua_forms_clear_pages_cache');
6103 -
6104 4417 function accua_forms_get_lead_statuses() {
6105 4418 static $statuses = NULL;
6106 4419 if ($statuses === NULL) {
6107 4420 $statuses = array(
@@ -6126,18 +4439,16 @@
6126 4439 require_once('accua-forms-help.php');
6127 4440 }
6128 4441 $accuaHelp = AccuaFormsHelp::getInstance();
6129 4442 }
6130 - $subid = absint( $subid );
6131 - $original_lead_status = absint( $original_lead_status );
6132 - $nonce = esc_attr( wp_json_encode( wp_create_nonce( "set_lead_status_$subid" ) ) );
6133 - $ret = '<select onchange="accua_forms_set_lead_status(this, ' . $subid . ', ' . $nonce . ', ' . $original_lead_status . ')">';
4443 + $nonce = htmlspecialchars(_accua_forms_json_encode(wp_create_nonce( "set_lead_status_$subid" )),ENT_QUOTES);
4444 + $ret = "<select onchange=\"accua_forms_set_lead_status(this, $subid, $nonce, $original_lead_status)\">";
6134 4445 $statuses = accua_forms_get_lead_statuses();
6135 4446 foreach ($statuses as $k => $l) {
6136 - $selected = ( (int) $k === $original_lead_status ) ? ' selected="selected" ' : '';
6137 - $ret .= '<option value="' . esc_attr( $k ) . '"' . $selected . '>' . esc_html( $l ) . '</option>';
4447 + $selected = ($k == $original_lead_status) ? ' selected="selected" ' : '';
4448 + $ret .= "<option value=\"$k\"$selected>" . htmlspecialchars($l) . "</option>";
6138 4449 }
6139 - $ret .= '</select>' . $accuaHelp->add_pointer('contact_forms_lead_statuses') . "<span class='accua-forms-select-lead-status-progress'></span>";
4450 + $ret .= "</select>" . $accuaHelp->add_pointer('contact_forms_lead_statuses') . "<span class='accua-forms-select-lead-status-progress'></span>";
6140 4451 return $ret;
6141 4452 }
6142 4453
6143 4454 add_action( 'wp_ajax_accua-forms-set-lead-status' , 'accua_forms_set_lead_status');
@@ -6144,9 +4455,8 @@
6144 4455 function accua_forms_set_lead_status() {
6145 4456 if (!current_user_can('manage_options')){
6146 4457 wp_die(0, 403);
6147 4458 }
6148 - // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification happens after subid is extracted via check_ajax_referer()
6149 4459 $post = $_POST + array(
6150 4460 'subid' => 0,
6151 4461 'lead_status' => 0,
6152 4462 );
@@ -6157,804 +4467,16 @@
6157 4467 $lead_status = (int) $post['lead_status'];
6158 4468 $statuses = accua_forms_get_lead_statuses();
6159 4469 if (isset($statuses[$lead_status])) {
6160 4470 global $wpdb;
6161 - // phpcs:disable WordPress.DB.DirectDatabaseQuery
6162 - $ret = $wpdb->update(
6163 - "{$wpdb->prefix}accua_forms_submissions",
4471 + $ret = $wpdb->update("{$wpdb->prefix}accua_forms_submissions",
6164 4472 array('afs_lead_status' => $lead_status),
6165 4473 array('afs_id' => $subid),
6166 - array('%d'),
6167 - array('%d')
4474 + '%d', '%d'
6168 4475 );
6169 - // phpcs:enable WordPress.DB.DirectDatabaseQuery
6170 4476 if ($ret !== FALSE) {
6171 - wp_die(1);
4477 + wp_die(1, 200);
6172 4478 }
6173 4479 }
6174 4480 }
6175 4481 wp_die(0, 500);
6176 -}
6177 -
6178 -/* =========================================================================
6179 - * GDPR DATA RETENTION & ANONYMIZATION
6180 - * ========================================================================= */
6181 -
6182 -add_action( 'wp_ajax_accua-forms-anonymize-submission', 'accua_forms_ajax_anonymize_submission' );
6183 -/**
6184 - * AJAX handler to anonymize a single submission.
6185 - */
6186 -function accua_forms_ajax_anonymize_submission() {
6187 - if ( ! current_user_can( 'manage_options' ) ) {
6188 - wp_die( 0, 403 );
6189 - }
6190 - // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verified below after extracting subid
6191 - $subid = isset( $_POST['subid'] ) ? (int) $_POST['subid'] : 0;
6192 - if ( $subid ) {
6193 - check_ajax_referer( "anonymize_sub_{$subid}", '_nonce_anonymize' );
6194 - if ( accua_forms_erase_submission( $subid, 'anonymize' ) ) {
6195 - wp_die( 1 );
6196 - }
6197 - }
6198 - wp_die( 0, 500 );
6199 -}
6200 -
6201 -add_action( 'wp_ajax_accua_forms_bulk_anonymize_preview', 'accua_forms_ajax_bulk_anonymize_preview' );
6202 -/**
6203 - * AJAX handler to preview how many submissions per form would be anonymized.
6204 - */
6205 -function accua_forms_ajax_bulk_anonymize_preview() {
6206 - if ( ! current_user_can( 'manage_options' ) ) {
6207 - wp_send_json_error( array( 'message' => 'Permission denied.' ), 403 );
6208 - }
6209 - check_ajax_referer( 'accua_forms_danger_zone', 'nonce' );
6210 -
6211 - $value = isset( $_POST['value'] ) ? absint( $_POST['value'] ) : 0;
6212 - $unit = isset( $_POST['unit'] ) ? sanitize_key( wp_unslash( $_POST['unit'] ) ) : '';
6213 -
6214 - if ( $value < 1 || ! in_array( $unit, array( 'days', 'months', 'years' ), true ) ) {
6215 - wp_send_json_error( array( 'message' => __( 'Invalid period.', 'contact-forms' ) ) );
6216 - }
6217 -
6218 - $seconds = accua_forms_retention_to_seconds( $value, $unit );
6219 - $cutoff = gmdate( 'Y-m-d H:i:s', time() - $seconds );
6220 -
6221 - global $wpdb;
6222 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6223 -
6224 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6225 - $rows = $wpdb->get_results( $wpdb->prepare(
6226 - "SELECT afs_form_id, COUNT(*) AS cnt FROM `{$table_subs}` WHERE afs_submitted < %s AND afs_anonymized = 0 GROUP BY afs_form_id ORDER BY cnt DESC",
6227 - $cutoff
6228 - ) );
6229 -
6230 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
6231 - $total = 0;
6232 - $forms = array();
6233 -
6234 - foreach ( $rows as $row ) {
6235 - $fid = $row->afs_form_id;
6236 - $count = (int) $row->cnt;
6237 - $total += $count;
6238 - $title = isset( $forms_data[ $fid ]['title'] ) && $forms_data[ $fid ]['title'] !== ''
6239 - ? $forms_data[ $fid ]['title']
6240 - : sprintf( __( 'Form #%s', 'contact-forms' ), $fid );
6241 - $forms[] = array(
6242 - 'id' => $fid,
6243 - 'title' => $title,
6244 - 'count' => $count,
6245 - );
6246 - }
6247 -
6248 - wp_send_json_success( array(
6249 - 'total' => $total,
6250 - 'forms' => $forms,
6251 - ) );
6252 -}
6253 -
6254 -add_action( 'wp_ajax_accua_forms_bulk_anonymize', 'accua_forms_ajax_bulk_anonymize' );
6255 -/**
6256 - * AJAX handler to bulk-anonymize submissions older than a given period.
6257 - */
6258 -function accua_forms_ajax_bulk_anonymize() {
6259 - if ( ! current_user_can( 'manage_options' ) ) {
6260 - wp_send_json_error( array( 'message' => 'Permission denied.' ), 403 );
6261 - }
6262 - check_ajax_referer( 'accua_forms_danger_zone', 'nonce' );
6263 -
6264 - $value = isset( $_POST['value'] ) ? absint( $_POST['value'] ) : 0;
6265 - $unit = isset( $_POST['unit'] ) ? sanitize_key( wp_unslash( $_POST['unit'] ) ) : '';
6266 -
6267 - if ( $value < 1 || ! in_array( $unit, array( 'days', 'months', 'years' ), true ) ) {
6268 - wp_send_json_error( array( 'message' => __( 'Invalid period.', 'contact-forms' ) ) );
6269 - }
6270 -
6271 - $seconds = accua_forms_retention_to_seconds( $value, $unit );
6272 - $cutoff = gmdate( 'Y-m-d H:i:s', time() - $seconds );
6273 -
6274 - global $wpdb;
6275 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6276 -
6277 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6278 - $ids = $wpdb->get_col( $wpdb->prepare(
6279 - "SELECT afs_id FROM `{$table_subs}` WHERE afs_submitted < %s AND afs_anonymized = 0",
6280 - $cutoff
6281 - ) );
6282 -
6283 - $count = 0;
6284 - foreach ( $ids as $id ) {
6285 - if ( accua_forms_erase_submission( (int) $id, 'anonymize' ) ) {
6286 - $count++;
6287 - }
6288 - }
6289 -
6290 - $unit_labels = array(
6291 - 'days' => __( 'days', 'contact-forms' ),
6292 - 'months' => __( 'months', 'contact-forms' ),
6293 - 'years' => __( 'years', 'contact-forms' ),
6294 - );
6295 -
6296 - wp_send_json_success( array(
6297 - 'message' => sprintf(
6298 - /* translators: 1: number of anonymized submissions, 2: total found, 3: retention period, 4: unit */
6299 - __( 'Done. %1$d of %2$d submissions older than %3$d %4$s have been anonymized.', 'contact-forms' ),
6300 - $count,
6301 - count( $ids ),
6302 - $value,
6303 - $unit_labels[ $unit ] ?? $unit
6304 - ),
6305 - ) );
6306 -}
6307 -
6308 -add_action( 'wp_ajax_accua_forms_delete_all_data', 'accua_forms_ajax_delete_all_data' );
6309 -/**
6310 - * AJAX handler to delete ALL Contact Forms plugin data.
6311 - */
6312 -function accua_forms_ajax_delete_all_data() {
6313 - if ( ! current_user_can( 'manage_options' ) ) {
6314 - wp_send_json_error( array( 'message' => 'Permission denied.' ), 403 );
6315 - }
6316 - check_ajax_referer( 'accua_forms_danger_zone', 'nonce' );
6317 -
6318 - $confirm_domain = isset( $_POST['confirm_domain'] ) ? sanitize_text_field( wp_unslash( $_POST['confirm_domain'] ) ) : '';
6319 - $expected = wp_parse_url( home_url(), PHP_URL_HOST );
6320 -
6321 - if ( $confirm_domain !== $expected ) {
6322 - wp_send_json_error( array( 'message' => __( 'Domain confirmation does not match.', 'contact-forms' ) ) );
6323 - }
6324 -
6325 - _accua_forms_delete_all_plugin_data();
6326 -
6327 - wp_send_json_success( array(
6328 - 'message' => __( 'All Contact Forms data has been deleted. The plugin is now reset. You may deactivate it or reload this page.', 'contact-forms' ),
6329 - ) );
6330 -}
6331 -
6332 -/**
6333 - * Delete all Contact Forms plugin data: uploaded files, DB tables, options, cron, and transients.
6334 - *
6335 - * Used by both the Danger Zone "Delete all data" and the deactivation cleanup handler.
6336 - */
6337 -function _accua_forms_delete_all_plugin_data() {
6338 - global $wpdb;
6339 -
6340 - // 1. Delete uploaded files
6341 - $dest_path = _accua_forms_get_abs_dest_path(
6342 - get_option( 'accua_forms_file_data', array() )['dest_path'] ?? ''
6343 - );
6344 - if ( is_dir( $dest_path ) ) {
6345 - accua_forms_recursive_rmdir( $dest_path );
6346 - }
6347 -
6348 - // 2. Drop custom database tables
6349 - $tables = array(
6350 - $wpdb->prefix . 'accua_forms_submissions_values',
6351 - $wpdb->prefix . 'accua_forms_submissions_notes',
6352 - $wpdb->prefix . 'accua_forms_submissions',
6353 - );
6354 - foreach ( $tables as $table ) {
6355 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
6356 - $wpdb->query( "DROP TABLE IF EXISTS `{$table}`" );
6357 - }
6358 -
6359 - // 3. Delete all plugin options
6360 - $options = array(
6361 - 'accua_forms_saved_forms',
6362 - 'accua_forms_trash_forms',
6363 - 'accua_forms_default_form_data',
6364 - 'accua_forms_avail_fields',
6365 - 'accua_forms_avail_fields_order',
6366 - 'accua_forms_file_data',
6367 - 'accua_forms_anonymize_ip_data',
6368 - 'accua_forms_retention_data',
6369 - 'accua_forms_matomo_data',
6370 - 'accua_forms_ga_data',
6371 - 'accua_forms_style',
6372 - 'accua_forms_db_version',
6373 - 'accua_forms_layout',
6374 - 'accua_forms_lastid',
6375 - 'accua_form_api_keys',
6376 - );
6377 - foreach ( $options as $option ) {
6378 - delete_option( $option );
6379 - }
6380 -
6381 - // 4. Clear any pending cron events
6382 - wp_clear_scheduled_hook( 'accua_forms_retention_cleanup' );
6383 -
6384 - // 5. Delete draft transients
6385 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6386 - $wpdb->query(
6387 - "DELETE FROM `{$wpdb->options}` WHERE option_name LIKE '_transient_accua_forms_draft_%' OR option_name LIKE '_transient_timeout_accua_forms_draft_%'"
6388 - );
6389 -
6390 - // 6. Prevent accua_forms_check_db_version_and_update() from re-creating data
6391 - // during the deactivation redirect (plugin still loads once more).
6392 - set_transient( '_accua_forms_data_deleted', 1, 60 );
6393 -}
6394 -
6395 -add_action( 'wp_ajax_accua_forms_deactivation_cleanup', 'accua_forms_ajax_deactivation_cleanup' );
6396 -/**
6397 - * AJAX handler for the deactivation modal.
6398 - *
6399 - * Accepts a mode: 'delete' (remove all data), 'anonymize' (anonymize all submissions), or 'skip' (do nothing).
6400 - */
6401 -function accua_forms_ajax_deactivation_cleanup() {
6402 - if ( ! current_user_can( 'manage_options' ) ) {
6403 - wp_send_json_error( array( 'message' => 'Permission denied.' ), 403 );
6404 - }
6405 - check_ajax_referer( 'accua_forms_deactivation_cleanup', 'nonce' );
6406 -
6407 - $mode = isset( $_POST['mode'] ) ? sanitize_key( wp_unslash( $_POST['mode'] ) ) : '';
6408 -
6409 - if ( ! in_array( $mode, array( 'delete', 'anonymize' ), true ) ) {
6410 - wp_send_json_error( array( 'message' => __( 'Invalid mode.', 'contact-forms' ) ) );
6411 - }
6412 -
6413 - if ( $mode === 'delete' ) {
6414 - _accua_forms_delete_all_plugin_data();
6415 - wp_send_json_success();
6416 - }
6417 -
6418 - // Anonymize all non-anonymized submissions
6419 - global $wpdb;
6420 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6421 -
6422 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6423 - $ids = $wpdb->get_col( "SELECT afs_id FROM `{$table_subs}` WHERE afs_anonymized = 0" );
6424 -
6425 - $count = 0;
6426 - foreach ( $ids as $id ) {
6427 - if ( accua_forms_erase_submission( (int) $id, 'anonymize' ) ) {
6428 - $count++;
6429 - }
6430 - }
6431 -
6432 - wp_send_json_success( array(
6433 - 'message' => sprintf(
6434 - /* translators: %d: number of submissions anonymized */
6435 - __( '%d submissions anonymized.', 'contact-forms' ),
6436 - $count
6437 - ),
6438 - ) );
6439 -}
6440 -
6441 -/**
6442 - * Recursively delete a directory and its contents.
6443 - *
6444 - * @param string $dir Directory path.
6445 - */
6446 -function accua_forms_recursive_rmdir( $dir ) {
6447 - if ( ! is_dir( $dir ) ) {
6448 - return;
6449 - }
6450 - $items = new RecursiveIteratorIterator(
6451 - new RecursiveDirectoryIterator( $dir, RecursiveDirectoryIterator::SKIP_DOTS ),
6452 - RecursiveIteratorIterator::CHILD_FIRST
6453 - );
6454 - global $wp_filesystem;
6455 - if ( ! function_exists( 'WP_Filesystem' ) ) {
6456 - require_once ABSPATH . 'wp-admin/includes/file.php';
6457 - }
6458 - WP_Filesystem();
6459 - foreach ( $items as $item ) {
6460 - if ( $item->isDir() ) {
6461 - $wp_filesystem->rmdir( $item->getRealPath() );
6462 - } else {
6463 - wp_delete_file( $item->getRealPath() );
6464 - }
6465 - }
6466 - $wp_filesystem->rmdir( $dir );
6467 -}
6468 -
6469 -/**
6470 - * Map a Contact Forms field type to a wp_privacy_anonymize_data() type.
6471 - *
6472 - * @param string $afsv_type Field type stored in afsv_type column.
6473 - * @return string One of 'email', 'url', 'text', 'longtext'.
6474 - */
6475 -function accua_forms_privacy_anonymize_type( $afsv_type ) {
6476 - $afsv_type = strtolower( $afsv_type );
6477 - switch ( $afsv_type ) {
6478 - case 'email':
6479 - case 'autoreply_email':
6480 - return 'email';
6481 - case 'url':
6482 - case 'website':
6483 - return 'url';
6484 - default:
6485 - return 'text';
6486 - }
6487 -}
6488 -
6489 -/**
6490 - * Erase or anonymize a single form submission.
6491 - *
6492 - * @param int $submission_id The afs_id of the submission.
6493 - * @param string $mode Either 'anonymize' or 'delete'.
6494 - * @return bool True if something was erased/anonymized.
6495 - */
6496 -function accua_forms_erase_submission( $submission_id, $mode = 'anonymize' ) {
6497 - global $wpdb;
6498 - $submission_id = absint( $submission_id );
6499 - if ( ! $submission_id ) {
6500 - return false;
6501 - }
6502 -
6503 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6504 - $table_values = $wpdb->prefix . 'accua_forms_submissions_values';
6505 - $table_notes = $wpdb->prefix . 'accua_forms_submissions_notes';
6506 -
6507 - if ( $mode === 'delete' ) {
6508 - // Delete uploaded files first
6509 - accua_forms_delete_submission_files( $submission_id );
6510 -
6511 - // phpcs:disable WordPress.DB.DirectDatabaseQuery
6512 - $wpdb->delete( $table_values, array( 'afsv_sub_id' => $submission_id ), array( '%d' ) );
6513 - $wpdb->delete( $table_notes, array( 'afsn_sub_id' => $submission_id ), array( '%d' ) );
6514 - $wpdb->delete( $table_subs, array( 'afs_id' => $submission_id ), array( '%d' ) );
6515 - // phpcs:enable WordPress.DB.DirectDatabaseQuery
6516 - return true;
6517 - }
6518 -
6519 - // Anonymize mode
6520 -
6521 - // Delete uploaded files first
6522 - accua_forms_delete_submission_files( $submission_id );
6523 -
6524 - // Anonymize each field value based on its type
6525 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6526 - $fields = $wpdb->get_results( $wpdb->prepare(
6527 - "SELECT afsv_field_id, afsv_type FROM `{$table_values}` WHERE afsv_sub_id = %d",
6528 - $submission_id
6529 - ) );
6530 -
6531 - if ( $fields ) {
6532 - foreach ( $fields as $field ) {
6533 - $anon_type = accua_forms_privacy_anonymize_type( $field->afsv_type );
6534 - $anon_value = wp_privacy_anonymize_data( $anon_type );
6535 -
6536 - // Use our own string for text fields — WP's [deleted]/[eliminato] is ambiguous
6537 - if ( $anon_type === 'text' ) {
6538 - $anon_value = __( '[Anonymized]', 'contact-forms' );
6539 - }
6540 -
6541 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6542 - $wpdb->update(
6543 - $table_values,
6544 - array( 'afsv_value' => $anon_value ),
6545 - array( 'afsv_sub_id' => $submission_id, 'afsv_field_id' => $field->afsv_field_id ),
6546 - array( '%s' ),
6547 - array( '%d', '%s' )
6548 - );
6549 - }
6550 - }
6551 -
6552 - // Anonymize submission metadata (IP, stats)
6553 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6554 - $wpdb->update(
6555 - $table_subs,
6556 - array(
6557 - 'afs_ip' => '0.0.0.0',
6558 - 'afs_stats' => '',
6559 - 'afs_anonymized' => 1,
6560 - ),
6561 - array( 'afs_id' => $submission_id ),
6562 - array( '%s', '%s', '%d' ),
6563 - array( '%d' )
6564 - );
6565 -
6566 - // Anonymize notes — use our own string for consistency with field values
6567 - $anon_text = __( '[Anonymized]', 'contact-forms' );
6568 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6569 - $wpdb->query( $wpdb->prepare(
6570 - "UPDATE `{$table_notes}` SET afsn_text = %s, afsn_user = %s WHERE afsn_sub_id = %d",
6571 - $anon_text,
6572 - $anon_text,
6573 - $submission_id
6574 - ) );
6575 -
6576 - return true;
6577 -}
6578 -
6579 -/**
6580 - * Delete uploaded files associated with a submission.
6581 - *
6582 - * @param int $submission_id The afs_id of the submission.
6583 - */
6584 -function accua_forms_delete_submission_files( $submission_id ) {
6585 - global $wpdb;
6586 - $table_values = $wpdb->prefix . 'accua_forms_submissions_values';
6587 -
6588 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6589 - $file_fields = $wpdb->get_results( $wpdb->prepare(
6590 - "SELECT afsv_value FROM `{$table_values}` WHERE afsv_sub_id = %d AND afsv_type = 'file' AND afsv_value != ''",
6591 - $submission_id
6592 - ) );
6593 -
6594 - if ( ! $file_fields ) {
6595 - return;
6596 - }
6597 -
6598 - $upload_base = _accua_forms_get_abs_dest_path(
6599 - isset( get_option( 'accua_forms_default_file_field_data', array() )['dest_path'] )
6600 - ? get_option( 'accua_forms_default_file_field_data', array() )['dest_path']
6601 - : ''
6602 - );
6603 -
6604 - foreach ( $file_fields as $file_field ) {
6605 - $filename = $file_field->afsv_value;
6606 - if ( empty( $filename ) ) {
6607 - continue;
6608 - }
6609 - // The value is the filename within the upload directory
6610 - $filepath = trailingslashit( $upload_base ) . $filename;
6611 - // Safety: only delete if within the upload directory
6612 - $real_upload = realpath( $upload_base );
6613 - $real_file = realpath( $filepath );
6614 - if ( $real_file && $real_upload && strpos( $real_file, $real_upload ) === 0 ) {
6615 - wp_delete_file( $real_file );
6616 - }
6617 - }
6618 -}
6619 -
6620 -/**
6621 - * Find submission IDs for a given email address.
6622 - *
6623 - * Looks up submissions by matching email-type fields (afsv_type IN ('email', 'autoreply_email')).
6624 - *
6625 - * @param string $email_address Email to search for.
6626 - * @param int $page Page number (1-based).
6627 - * @param int $per_page Results per page.
6628 - * @return array Array of submission row objects (afs_id, afs_form_id).
6629 - */
6630 -function accua_forms_find_submissions_by_email( $email_address, $page = 1, $per_page = 50 ) {
6631 - global $wpdb;
6632 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6633 - $table_values = $wpdb->prefix . 'accua_forms_submissions_values';
6634 -
6635 - $offset = ( $page - 1 ) * $per_page;
6636 -
6637 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6638 - return $wpdb->get_results( $wpdb->prepare(
6639 - "SELECT DISTINCT s.afs_id, s.afs_form_id
6640 - FROM `{$table_subs}` s
6641 - INNER JOIN `{$table_values}` sv ON s.afs_id = sv.afsv_sub_id
6642 - WHERE sv.afsv_type IN ('email', 'autoreply_email')
6643 - AND sv.afsv_value = %s
6644 - AND s.afs_status >= 0
6645 - AND s.afs_anonymized = 0
6646 - ORDER BY s.afs_id ASC
6647 - LIMIT %d OFFSET %d",
6648 - $email_address,
6649 - $per_page,
6650 - $offset
6651 - ) );
6652 -}
6653 -
6654 -/* -------------------------------------------------------------------------
6655 - * WordPress Privacy API — Personal Data Exporter
6656 - * ------------------------------------------------------------------------- */
6657 -
6658 -add_filter( 'wp_privacy_personal_data_exporters', 'accua_forms_register_privacy_exporter' );
6659 -/**
6660 - * Register the Contact Forms personal data exporter.
6661 - *
6662 - * @param array $exporters Registered exporters.
6663 - * @return array
6664 - */
6665 -function accua_forms_register_privacy_exporter( $exporters ) {
6666 - $exporters['contact-forms'] = array(
6667 - 'exporter_friendly_name' => __( 'Contact Forms Submissions', 'contact-forms' ),
6668 - 'callback' => 'accua_forms_privacy_exporter',
6669 - );
6670 - return $exporters;
6671 -}
6672 -
6673 -/**
6674 - * Export personal data for a given email address.
6675 - *
6676 - * @param string $email_address The email to export data for.
6677 - * @param int $page Page number.
6678 - * @return array Export data array with 'data' and 'done' keys.
6679 - */
6680 -function accua_forms_privacy_exporter( $email_address, $page = 1 ) {
6681 - global $wpdb;
6682 - $per_page = 50;
6683 - $export_items = array();
6684 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6685 - $table_values = $wpdb->prefix . 'accua_forms_submissions_values';
6686 -
6687 - $submissions = accua_forms_find_submissions_by_email( $email_address, $page, $per_page );
6688 -
6689 - foreach ( $submissions as $sub ) {
6690 - $data = array();
6691 -
6692 - // Get submission metadata
6693 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6694 - $meta = $wpdb->get_row( $wpdb->prepare(
6695 - "SELECT afs_ip, afs_uri, afs_referrer, afs_submitted, afs_stats FROM `{$table_subs}` WHERE afs_id = %d",
6696 - $sub->afs_id
6697 - ) );
6698 -
6699 - if ( $meta ) {
6700 - if ( $meta->afs_ip !== '' ) {
6701 - $data[] = array(
6702 - 'name' => __( 'IP Address', 'contact-forms' ),
6703 - 'value' => $meta->afs_ip,
6704 - );
6705 - }
6706 - $data[] = array(
6707 - 'name' => __( 'Submitted', 'contact-forms' ),
6708 - 'value' => $meta->afs_submitted,
6709 - );
6710 - if ( $meta->afs_uri !== '' ) {
6711 - $data[] = array(
6712 - 'name' => __( 'Page URL', 'contact-forms' ),
6713 - 'value' => $meta->afs_uri,
6714 - );
6715 - }
6716 - if ( $meta->afs_referrer !== '' ) {
6717 - $data[] = array(
6718 - 'name' => __( 'Referrer', 'contact-forms' ),
6719 - 'value' => $meta->afs_referrer,
6720 - );
6721 - }
6722 - }
6723 -
6724 - // Get all field values
6725 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6726 - $fields = $wpdb->get_results( $wpdb->prepare(
6727 - "SELECT afsv_field_id, afsv_value FROM `{$table_values}` WHERE afsv_sub_id = %d",
6728 - $sub->afs_id
6729 - ) );
6730 -
6731 - foreach ( $fields as $field ) {
6732 - $data[] = array(
6733 - 'name' => $field->afsv_field_id,
6734 - 'value' => $field->afsv_value,
6735 - );
6736 - }
6737 -
6738 - $export_items[] = array(
6739 - 'group_id' => 'contact-form-submissions',
6740 - 'group_label' => __( 'Contact Form Submissions', 'contact-forms' ),
6741 - 'group_description' => __( 'Data submitted through contact forms on this site.', 'contact-forms' ),
6742 - 'item_id' => "contact-form-submission-{$sub->afs_id}",
6743 - 'data' => $data,
6744 - );
6745 - }
6746 -
6747 - return array(
6748 - 'data' => $export_items,
6749 - 'done' => count( $submissions ) < $per_page,
6750 - );
6751 -}
6752 -
6753 -/* -------------------------------------------------------------------------
6754 - * WordPress Privacy API — Personal Data Eraser
6755 - * ------------------------------------------------------------------------- */
6756 -
6757 -add_filter( 'wp_privacy_personal_data_erasers', 'accua_forms_register_privacy_eraser' );
6758 -/**
6759 - * Register the Contact Forms personal data eraser.
6760 - *
6761 - * @param array $erasers Registered erasers.
6762 - * @return array
6763 - */
6764 -function accua_forms_register_privacy_eraser( $erasers ) {
6765 - $erasers['contact-forms'] = array(
6766 - 'eraser_friendly_name' => __( 'Contact Forms Submissions', 'contact-forms' ),
6767 - 'callback' => 'accua_forms_privacy_eraser',
6768 - );
6769 - return $erasers;
6770 -}
6771 -
6772 -/**
6773 - * Erase personal data for a given email address.
6774 - *
6775 - * @param string $email_address The email to erase data for.
6776 - * @param int $page Page number.
6777 - * @return array Eraser response array.
6778 - */
6779 -function accua_forms_privacy_eraser( $email_address, $page = 1 ) {
6780 - $per_page = 50;
6781 - $items_removed = false;
6782 - $items_retained = false;
6783 - $messages = array();
6784 -
6785 - $submissions = accua_forms_find_submissions_by_email( $email_address, $page, $per_page );
6786 -
6787 - foreach ( $submissions as $sub ) {
6788 - $config = accua_forms_get_retention_config( $sub->afs_form_id );
6789 - $mode = $config['mode'];
6790 -
6791 - if ( accua_forms_erase_submission( $sub->afs_id, $mode ) ) {
6792 - $items_removed = true;
6793 - }
6794 - }
6795 -
6796 - return array(
6797 - 'items_removed' => $items_removed,
6798 - 'items_retained' => $items_retained,
6799 - 'messages' => $messages,
6800 - 'done' => count( $submissions ) < $per_page,
6801 - );
6802 -}
6803 -
6804 -/* -------------------------------------------------------------------------
6805 - * WordPress Privacy API — Privacy Policy Suggestion
6806 - * ------------------------------------------------------------------------- */
6807 -
6808 -add_action( 'admin_init', 'accua_forms_add_privacy_policy_content' );
6809 -/**
6810 - * Suggest privacy policy content for Contact Forms.
6811 - */
6812 -function accua_forms_add_privacy_policy_content() {
6813 - if ( ! function_exists( 'wp_add_privacy_policy_content' ) ) {
6814 - return;
6815 - }
6816 -
6817 - $content = '<h2>' . __( 'Contact Forms', 'contact-forms' ) . '</h2>' .
6818 - '<p>' . __( 'When you submit a form on this site, we collect the data you provide in the form fields (such as your name, email address, phone number, and message), as well as your IP address and browser user-agent string to help spam detection.', 'contact-forms' ) . '</p>' .
6819 - '<p>' . __( 'If the form includes file upload fields, the uploaded files are stored on our server.', 'contact-forms' ) . '</p>' .
6820 - '<p>' . __( 'Form submissions are retained for the period configured by the site administrator. After the retention period expires, submissions are automatically anonymized or deleted depending on site settings.', 'contact-forms' ) . '</p>' .
6821 - '<p>' . __( 'If you request data erasure through the WordPress personal data erasure tool, all form submissions associated with your email address will be anonymized or deleted.', 'contact-forms' ) . '</p>';
6822 -
6823 - wp_add_privacy_policy_content( 'Contact Forms', wp_kses_post( $content ) );
6824 -}
6825 -
6826 -/* -------------------------------------------------------------------------
6827 - * Data Retention Settings — Resolution Helper
6828 - * ------------------------------------------------------------------------- */
6829 -
6830 -/**
6831 - * Get the retention configuration for a specific form.
6832 - *
6833 - * Checks per-form override first, then falls back to global default.
6834 - *
6835 - * @param string $form_id Form ID.
6836 - * @return array {
6837 - * @type int $seconds Retention period in seconds (0 = no expiry).
6838 - * @type string $mode 'anonymize' or 'delete'.
6839 - * }
6840 - */
6841 -function accua_forms_get_retention_config( $form_id = '' ) {
6842 - $default = array(
6843 - 'seconds' => 0,
6844 - 'mode' => 'anonymize',
6845 - );
6846 -
6847 - // Check per-form override
6848 - if ( $form_id !== '' ) {
6849 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
6850 - if ( isset( $forms_data[ $form_id ] ) ) {
6851 - $form = $forms_data[ $form_id ];
6852 - if ( ! empty( $form['submission_retention_override'] ) ) {
6853 - $val = isset( $form['submission_retention_value'] ) ? (int) $form['submission_retention_value'] : 0;
6854 - $unit = isset( $form['submission_retention_unit'] ) ? $form['submission_retention_unit'] : 'months';
6855 - $mode = isset( $form['submission_retention_mode'] ) ? $form['submission_retention_mode'] : 'anonymize';
6856 - if ( $val > 0 ) {
6857 - return array(
6858 - 'seconds' => accua_forms_retention_to_seconds( $val, $unit ),
6859 - 'mode' => in_array( $mode, array( 'anonymize', 'delete' ), true ) ? $mode : 'anonymize',
6860 - );
6861 - }
6862 - return array( 'seconds' => 0, 'mode' => in_array( $mode, array( 'anonymize', 'delete' ), true ) ? $mode : 'anonymize' );
6863 - }
6864 - }
6865 - }
6866 -
6867 - // Fall back to global setting
6868 - $retention_data = get_option( 'accua_forms_retention_data', array() );
6869 - $val = isset( $retention_data['retention_value'] ) ? (int) $retention_data['retention_value'] : 0;
6870 - $unit = isset( $retention_data['retention_unit'] ) ? $retention_data['retention_unit'] : 'months';
6871 - $mode = isset( $retention_data['retention_mode'] ) ? $retention_data['retention_mode'] : 'anonymize';
6872 -
6873 - if ( $val > 0 ) {
6874 - return array(
6875 - 'seconds' => accua_forms_retention_to_seconds( $val, $unit ),
6876 - 'mode' => in_array( $mode, array( 'anonymize', 'delete' ), true ) ? $mode : 'anonymize',
6877 - );
6878 - }
6879 -
6880 - return $default;
6881 -}
6882 -
6883 -/**
6884 - * Convert a retention value + unit to seconds.
6885 - *
6886 - * @param int $value Retention value.
6887 - * @param string $unit 'days', 'months', or 'years'.
6888 - * @return int Seconds.
6889 - */
6890 -function accua_forms_retention_to_seconds( $value, $unit ) {
6891 - $value = max( 0, (int) $value );
6892 - switch ( $unit ) {
6893 - case 'days':
6894 - return $value * DAY_IN_SECONDS;
6895 - case 'years':
6896 - return $value * YEAR_IN_SECONDS;
6897 - case 'months':
6898 - default:
6899 - return $value * 30 * DAY_IN_SECONDS;
6900 - }
6901 -}
6902 -
6903 -/* -------------------------------------------------------------------------
6904 - * Data Retention — WP-Cron Cleanup Handler
6905 - * ------------------------------------------------------------------------- */
6906 -
6907 -add_action( 'accua_forms_retention_cleanup', 'accua_forms_retention_cleanup_handler' );
6908 -/**
6909 - * Cron callback: anonymize or delete expired submissions.
6910 - */
6911 -function accua_forms_retention_cleanup_handler() {
6912 - global $wpdb;
6913 - $table_subs = $wpdb->prefix . 'accua_forms_submissions';
6914 -
6915 - $forms_data = get_option( 'accua_forms_saved_forms', array() );
6916 - if ( ! is_array( $forms_data ) ) {
6917 - return;
6918 - }
6919 -
6920 - // Collect all unique form IDs that have submissions (including deleted forms)
6921 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6922 - $form_ids = $wpdb->get_col( "SELECT DISTINCT afs_form_id FROM `{$table_subs}` WHERE afs_status >= 0" );
6923 -
6924 - foreach ( $form_ids as $form_id ) {
6925 - $config = accua_forms_get_retention_config( $form_id );
6926 - if ( $config['seconds'] <= 0 ) {
6927 - continue;
6928 - }
6929 -
6930 - $cutoff = gmdate( 'Y-m-d H:i:s', time() - $config['seconds'] );
6931 -
6932 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
6933 - $expired_ids = $wpdb->get_col( $wpdb->prepare(
6934 - "SELECT afs_id FROM `{$table_subs}`
6935 - WHERE afs_form_id = %s
6936 - AND afs_submitted < %s
6937 - AND afs_status >= 0
6938 - AND ( %s = 'delete' OR afs_anonymized = 0 )
6939 - ORDER BY afs_id ASC
6940 - LIMIT 100",
6941 - $form_id,
6942 - $cutoff,
6943 - $config['mode']
6944 - ) );
6945 -
6946 - foreach ( $expired_ids as $sub_id ) {
6947 - accua_forms_erase_submission( (int) $sub_id, $config['mode'] );
6948 - }
6949 - }
6950 -}
6951 -
6952 -/**
6953 - * Self-healing: ensure the retention cron is scheduled.
6954 - */
6955 -add_action( 'admin_init', 'accua_forms_ensure_retention_cron' );
6956 -function accua_forms_ensure_retention_cron() {
6957 - if ( ! wp_next_scheduled( 'accua_forms_retention_cleanup' ) ) {
6958 - wp_schedule_event( time(), 'daily', 'accua_forms_retention_cleanup' );
6959 - }
6960 4482 }