← All changes | Inc/Core/Controllers/BoxImport.php +12 -79 trunk → 3.0.1 View file →

		@@ -1,12 +1,12 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.13 Free
	4	+ * @version 3.0.1 Free
5	5	*
6	6	* @author FirePlugins <info@fireplugins.com>
7	7	* @link https://www.fireplugins.com
8		- * @copyright Copyright © 2026 FirePlugins All Rights Reserved
	8	+ * @copyright Copyright © 2025 FirePlugins All Rights Reserved
9	9	* @license GNU GPLv3 <http://www.gnu.org/licenses/gpl.html> or later
10	10	*/
11	11
12	12	namespace FireBox\Core\Controllers;
		@@ -55,20 +55,8 @@
55	55	{
56	56	return; // get out if we didn't click the Activate button
57	57	}
58	58
59		- /**
60		- * Importing creates campaigns from a file the user supplies, so it needs an
61		- * explicit capability check of its own. Today options.php also enforces
62		- * manage_options for this option group, but this method must not depend on
63		- * how it happens to be reached.
64		- */
65		- if (!current_user_can('edit_fireboxes'))
66		- {
67		- \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_CANNOT_VERIFY_REQUEST'));
68		- return;
69		- }
70		-
71	59	if (!isset($_FILES['file']))
72	60	{
73	61	return;
74	62	}
		@@ -103,12 +91,9 @@
103	91	\FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_FILE_EMPTY'));
104	92	return;
105	93	}
106	94
107		- $items = json_decode($data, true);
108		-
109		- // Scalar JSON (e.g. "123") is valid JSON but not an export payload
110		- if (!$items || !is_array($items))
	95	+ if (!$items = json_decode($data, true))
111	96	{
112	97	\FPFramework\Libs\AdminNotice::displayError(firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR'));
113	98	return;
114	99	}
		@@ -147,16 +132,14 @@
147	132	$success = true;
148	133
149	134	foreach ($items as $item)
150	135	{
151		- // The .fbox contents are user-supplied; validate the shape before
152		- // using it or a hand-edited file fatals instead of erroring.
153		- if (!is_array($item) || !isset($item['meta']))
	136	+ if (!isset($item['meta']))
154	137	{
155	138	$success = false;
156	139	break;
157	140	}
158		-
	141	+
159	142	// get meta
160	143	$meta = $item['meta'];
161	144
162	145	// remote meta from item
		@@ -161,58 +144,21 @@
161	144
162	145	// remote meta from item
163	146	unset($item['meta']);
164	147
165		- // Campaign settings are free-form, but they are always a map — never a scalar.
166		- if (!is_array($meta) && !is_object($meta))
	148	+ if (!isset($item['box']))
167	149	{
168	150	$success = false;
169	151	break;
170	152	}
171	153
172		- if (!isset($item['box']) || !is_array($item['box']))
173		- {
174		- $success = false;
175		- break;
176		- }
177		-
178	154	$box = $item['box'];
179	155
180		- /**
181		- * The .fbox file carries a full wp_posts row, and every key in it used to be
182		- * written straight to the database. Keep only the columns that actually
183		- * describe a campaign; everything else (post_type, post_author, guid,
184		- * post_parent, ...) is either forced below or dropped.
185		- */
186		- $box = array_intersect_key($box, array_flip([
187		- 'post_title',
188		- 'post_content',
189		- 'post_excerpt',
190		- 'post_name',
191		- 'menu_order'
192		- ]));
	156	+ // remove ID
	157	+ $box['ID'] = '';
193	158
194		- if (!isset($box['post_content']) || !is_string($box['post_content']))
195		- {
196		- $box['post_content'] = '';
197		- }
198		-
199		- $box['post_title'] = isset($box['post_title']) && is_string($box['post_title'])
200		- ? sanitize_text_field($box['post_title'])
201		- : '';
202		-
203		- $box['post_excerpt'] = isset($box['post_excerpt']) && is_string($box['post_excerpt'])
204		- ? sanitize_textarea_field($box['post_excerpt'])
205		- : '';
206		-
207		- $box['post_name'] = isset($box['post_name']) && is_string($box['post_name'])
208		- ? sanitize_title($box['post_name'])
209		- : '';
210		-
211		- $box['menu_order'] = isset($box['menu_order']) ? (int) $box['menu_order'] : 0;
212		-
213	159	$factory = new \FPFramework\Base\Factory();
214		-
	160	+
215	161	$tz = wp_timezone();
216	162	$date_without_tz = $factory->getDate();
217	163	$date_with_tz = $factory->getDate()->setTimezone($tz);
218	164
		@@ -218,12 +164,8 @@
218	164
219	165	$box['post_date'] = $date_with_tz->format('Y-m-d H:i:s');
220	166	$box['post_date_gmt'] = $date_without_tz->format('Y-m-d H:i:s');
221	167
222		- // These are ours to decide, never the file's.
223		- $box['post_type'] = 'firebox';
224		- $box['post_author'] = get_current_user_id();
225		-
226	168	\FireBox\Core\Helpers\Form\Form::ensureUniqueFormIDs($box['post_content']);
227	169
228	170	// set publish status
229	171	if (in_array($publish_all, [0, 1]))
		@@ -229,20 +171,11 @@
229	171	if (in_array($publish_all, [0, 1]))
230	172	{
231	173	$box['post_status'] = ($publish_all == 0) ? 'draft' : 'publish';
232	174	}
233		- else
234		- {
235		- $box['post_status'] = 'draft';
236		- }
237		-
238		- /**
239		- * Insert through wp_insert_post() rather than the raw table layer so that
240		- * kses, slug uniqueness and the usual save_post hooks all apply.
241		- */
242		- $new_box_id = wp_insert_post(wp_slash($box), true);
243		-
244		- if (is_wp_error($new_box_id) || !$new_box_id)
	175	+
	176	+ // insert new box
	177	+ if (!$new_box_id = firebox()->tables->box->insert((object) $box))
245	178	{
246	179	$success = false;
247	180	break;
248	181	}