← All changes | Inc/Core/Controllers/BoxImport.php +46 -106 trunk → 2.1.14 View file →

		@@ -1,12 +1,12 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.13 Free
	4	+ * @version 2.1.14 Free
5	5	*
6	6	* @author FirePlugins <info@fireplugins.com>
7	7	* @link https://www.fireplugins.com
8		- * @copyright Copyright © 2026 FirePlugins All Rights Reserved
	8	+ * @copyright Copyright © 2024 FirePlugins All Rights Reserved
9	9	* @license GNU GPLv3 <http://www.gnu.org/licenses/gpl.html> or later
10	10	*/
11	11
12	12	namespace FireBox\Core\Controllers;
		@@ -49,37 +49,14 @@
49	49	* @return void
50	50	*/
51	51	public function processBoxesImport($input)
52	52	{
53		- // run a quick security check
54		- if (!check_admin_referer('fpf_form_nonce_firebox_import', 'fpf_form_nonce_firebox_import'))
55		- {
56		- return; // get out if we didn't click the Activate button
57		- }
	53	+ $file = $this->getUploadedFile();
58	54
59		- /**
60		- * Importing creates campaigns from a file the user supplies, so it needs an
61		- * explicit capability check of its own. Today options.php also enforces
62		- * manage_options for this option group, but this method must not depend on
63		- * how it happens to be reached.
64		- */
65		- if (!current_user_can('edit_fireboxes'))
66		- {
67		- \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_CANNOT_VERIFY_REQUEST'));
68		- return;
69		- }
70		-
71		- if (!isset($_FILES['file']))
72		- {
73		- return;
74		- }
75		-
76		- $file = $_FILES['file'];
77		-
78	55	// ensure a file was given
79	56	if (!is_array($file) || !isset($file['name']) || empty($file['name']))
80	57	{
81		- \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_PLEASE_SELECT_A_FILE_TO_UPLOAD'));
	58	+ add_settings_error(self::settings_name, 'settings_updated', fpframework()->_('FPF_PLEASE_SELECT_A_FILE_TO_UPLOAD'), 'error');
82	59	return;
83	60	}
84	61
85	62	$ext = explode('.', $file['name']);
		@@ -86,9 +63,9 @@
86	63
87	64	// ensure given file plugin was given
88	65	if (!in_array($ext[count($ext) - 1], ['fbox']))
89	66	{
90		- \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_PLEASE_CHOOSE_A_VALID_FILE'));
	67	+ add_settings_error(self::settings_name, 'settings_updated', fpframework()->_('FPF_PLEASE_CHOOSE_A_VALID_FILE'), 'error');
91	68	return;
92	69	}
93	70
94	71	$publish_all = isset($input['publish_all']) ? $input['publish_all'] : 0;
		@@ -93,24 +70,20 @@
93	70
94	71	$publish_all = isset($input['publish_all']) ? $input['publish_all'] : 0;
95	72
96	73	// read file contents
97		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
98		- $data = file_get_contents($file['tmp_name']);
	74	+ $data = $this->getUploadedFileContents($file['tmp_name']);
99	75
100	76	// if empty data file then abort
101	77	if (empty($data))
102	78	{
103		- \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_FILE_EMPTY'));
	79	+ add_settings_error(self::settings_name, 'settings_updated', fpframework()->_('FPF_FILE_EMPTY'), 'error');
104	80	return;
105	81	}
106	82
107		- $items = json_decode($data, true);
108		-
109		- // Scalar JSON (e.g. "123") is valid JSON but not an export payload
110		- if (!$items || !is_array($items))
	83	+ if (!$items = json_decode($data, true))
111	84	{
112		- \FPFramework\Libs\AdminNotice::displayError(firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR'));
	85	+ add_settings_error(self::settings_name, 'settings_updated', firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR'), 'error');
113	86	return;
114	87	}
115	88
116	89	if (is_null($items))
		@@ -125,17 +98,41 @@
125	98
126	99	// import all boxes
127	100	if (!$new_box_id = $this->importBoxes($items, $publish_all))
128	101	{
129		- \FPFramework\Libs\AdminNotice::displayError(firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR'));
	102	+ add_settings_error(self::settings_name, 'settings_updated', firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR'), 'error');
130	103	return;
131	104	}
132	105
133		- \FPFramework\Libs\AdminNotice::displaySuccess(fpframework()->_('FPF_ITEMS_SAVED'));
	106	+ add_settings_error(self::settings_name, 'settings_updated', fpframework()->_('FPF_ITEMS_SAVED'), 'success');
134	107	return $new_box_id;
135	108	}
136	109
137	110	/**
	111	+ * Returns the uploaded file
	112	+ *
	113	+ * @return mixed
	114	+ */
	115	+ protected function getUploadedFile()
	116	+ {
	117	+ $file = isset($_FILES['file']) ? $_FILES['file'] : '';
	118	+ return $file;
	119	+ }
	120	+
	121	+ /**
	122	+ * Returns the contents of the file
	123	+ *
	124	+ * @param string $tmp_name
	125	+ *
	126	+ * @return string
	127	+ */
	128	+ protected function getUploadedFileContents($tmp_name)
	129	+ {
	130	+ // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	131	+ return file_get_contents($tmp_name);
	132	+ }
	133	+
	134	+ /**
138	135	* Imports boxes data
139	136	*
140	137	* @param array $items
141	138	* @param int $publish_all
		@@ -147,16 +144,14 @@
147	144	$success = true;
148	145
149	146	foreach ($items as $item)
150	147	{
151		- // The .fbox contents are user-supplied; validate the shape before
152		- // using it or a hand-edited file fatals instead of erroring.
153		- if (!is_array($item) || !isset($item['meta']))
	148	+ if (!isset($item['meta']))
154	149	{
155	150	$success = false;
156	151	break;
157	152	}
158		-
	153	+
159	154	// get meta
160	155	$meta = $item['meta'];
161	156
162	157	// remote meta from item
		@@ -161,58 +156,21 @@
161	156
162	157	// remote meta from item
163	158	unset($item['meta']);
164	159
165		- // Campaign settings are free-form, but they are always a map — never a scalar.
166		- if (!is_array($meta) && !is_object($meta))
	160	+ if (!isset($item['box']))
167	161	{
168	162	$success = false;
169	163	break;
170	164	}
171	165
172		- if (!isset($item['box']) || !is_array($item['box']))
173		- {
174		- $success = false;
175		- break;
176		- }
177		-
178	166	$box = $item['box'];
179	167
180		- /**
181		- * The .fbox file carries a full wp_posts row, and every key in it used to be
182		- * written straight to the database. Keep only the columns that actually
183		- * describe a campaign; everything else (post_type, post_author, guid,
184		- * post_parent, ...) is either forced below or dropped.
185		- */
186		- $box = array_intersect_key($box, array_flip([
187		- 'post_title',
188		- 'post_content',
189		- 'post_excerpt',
190		- 'post_name',
191		- 'menu_order'
192		- ]));
	168	+ // remove ID
	169	+ $box['ID'] = '';
193	170
194		- if (!isset($box['post_content']) || !is_string($box['post_content']))
195		- {
196		- $box['post_content'] = '';
197		- }
198		-
199		- $box['post_title'] = isset($box['post_title']) && is_string($box['post_title'])
200		- ? sanitize_text_field($box['post_title'])
201		- : '';
202		-
203		- $box['post_excerpt'] = isset($box['post_excerpt']) && is_string($box['post_excerpt'])
204		- ? sanitize_textarea_field($box['post_excerpt'])
205		- : '';
206		-
207		- $box['post_name'] = isset($box['post_name']) && is_string($box['post_name'])
208		- ? sanitize_title($box['post_name'])
209		- : '';
210		-
211		- $box['menu_order'] = isset($box['menu_order']) ? (int) $box['menu_order'] : 0;
212		-
213	171	$factory = new \FPFramework\Base\Factory();
214		-
	172	+
215	173	$tz = wp_timezone();
216	174	$date_without_tz = $factory->getDate();
217	175	$date_with_tz = $factory->getDate()->setTimezone($tz);
218	176
		@@ -218,41 +176,23 @@
218	176
219	177	$box['post_date'] = $date_with_tz->format('Y-m-d H:i:s');
220	178	$box['post_date_gmt'] = $date_without_tz->format('Y-m-d H:i:s');
221	179
222		- // These are ours to decide, never the file's.
223		- $box['post_type'] = 'firebox';
224		- $box['post_author'] = get_current_user_id();
225		-
226		- \FireBox\Core\Helpers\Form\Form::ensureUniqueFormIDs($box['post_content']);
227		-
228	180	// set publish status
229	181	if (in_array($publish_all, [0, 1]))
230	182	{
231	183	$box['post_status'] = ($publish_all == 0) ? 'draft' : 'publish';
232	184	}
233		- else
	185	+
	186	+ // insert new box
	187	+ if (!$new_box_id = firebox()->tables->box->insert((object) $box))
234	188	{
235		- $box['post_status'] = 'draft';
236		- }
237		-
238		- /**
239		- * Insert through wp_insert_post() rather than the raw table layer so that
240		- * kses, slug uniqueness and the usual save_post hooks all apply.
241		- */
242		- $new_box_id = wp_insert_post(wp_slash($box), true);
243		-
244		- if (is_wp_error($new_box_id) || !$new_box_id)
245		- {
246	189	$success = false;
247	190	break;
248	191	}
249	192
250	193	// add meta options for new box
251		- // TODO: In the future, use "firebox_meta". This is a temporary fix for backwards compatibility.
252		- $checkMeta = (array) $meta;
253		- $meta_key = isset($checkMeta['width']) ? 'firebox_meta' : 'fpframework_meta_settings';
254		- update_post_meta($new_box_id, $meta_key, wp_slash($meta));
	194	+ update_post_meta($new_box_id, 'fpframework_meta_settings', wp_slash($meta));
255	195	$success = $new_box_id;
256	196	}
257	197
258	198	return $success;
		@@ -271,7 +211,7 @@
271	211	'class' => 'settings-ui-inner-fields',
272	212	'button_label' => 'FPF_IMPORT'
273	213	]);
274	214
275		- echo $form->render(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	215	+ echo $form->render();
276	216	}
277	217	}