# firebox/3.1.13/Inc/Core/Controllers/BoxImport.php FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment, version 3.1.13. 277 lines. - Page: https://pluginprobe.com/plugins/firebox/3.1.13/code/Inc/Core/Controllers/BoxImport.php - Raw: https://pluginprobe.com/plugins/firebox/3.1.13/raw/Inc/Core/Controllers/BoxImport.php - Modified: 2026-09-07T07:54:40+00:00 Line numbers below start at 1. Link to a line or a range by appending a fragment to the page URL, for example `https://pluginprobe.com/plugins/firebox/3.1.13/code/Inc/Core/Controllers/BoxImport.php#L10-L20`. ```php * @link https://www.fireplugins.com * @copyright Copyright © 2026 FirePlugins All Rights Reserved * @license GNU GPLv3 or later */ namespace FireBox\Core\Controllers; if (!defined('ABSPATH')) { exit; // Exit if accessed directly. } use FPFramework\Base\Form; class BoxImport extends BaseController { /** * The form settings name * * @var string */ const settings_name = 'firebox_import'; /** * Render the page content * * @return void */ public function render() { // page content add_action('firebox/settings_page', [$this, 'settingsPageContent']); // render layout firebox()->renderer->admin->render('pages/settings'); } /** * Import box * * @param array $input * * @return void */ public function processBoxesImport($input) { // run a quick security check if (!check_admin_referer('fpf_form_nonce_firebox_import', 'fpf_form_nonce_firebox_import')) { return; // get out if we didn't click the Activate button } /** * Importing creates campaigns from a file the user supplies, so it needs an * explicit capability check of its own. Today options.php also enforces * manage_options for this option group, but this method must not depend on * how it happens to be reached. */ if (!current_user_can('edit_fireboxes')) { \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_CANNOT_VERIFY_REQUEST')); return; } if (!isset($_FILES['file'])) { return; } $file = $_FILES['file']; // ensure a file was given if (!is_array($file) || !isset($file['name']) || empty($file['name'])) { \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_PLEASE_SELECT_A_FILE_TO_UPLOAD')); return; } $ext = explode('.', $file['name']); // ensure given file plugin was given if (!in_array($ext[count($ext) - 1], ['fbox'])) { \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_PLEASE_CHOOSE_A_VALID_FILE')); return; } $publish_all = isset($input['publish_all']) ? $input['publish_all'] : 0; // read file contents // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents $data = file_get_contents($file['tmp_name']); // if empty data file then abort if (empty($data)) { \FPFramework\Libs\AdminNotice::displayError(fpframework()->_('FPF_FILE_EMPTY')); return; } $items = json_decode($data, true); // Scalar JSON (e.g. "123") is valid JSON but not an export payload if (!$items || !is_array($items)) { \FPFramework\Libs\AdminNotice::displayError(firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR')); return; } if (is_null($items)) { $items = []; } if (!$items) { return; } // import all boxes if (!$new_box_id = $this->importBoxes($items, $publish_all)) { \FPFramework\Libs\AdminNotice::displayError(firebox()->_('FB_CAMPAIGN_IMPORT_CONTENTS_ERROR')); return; } \FPFramework\Libs\AdminNotice::displaySuccess(fpframework()->_('FPF_ITEMS_SAVED')); return $new_box_id; } /** * Imports boxes data * * @param array $items * @param int $publish_all * * @return boolean */ protected function importBoxes($items, $publish_all = 0) { $success = true; foreach ($items as $item) { // The .fbox contents are user-supplied; validate the shape before // using it or a hand-edited file fatals instead of erroring. if (!is_array($item) || !isset($item['meta'])) { $success = false; break; } // get meta $meta = $item['meta']; // remote meta from item unset($item['meta']); // Campaign settings are free-form, but they are always a map — never a scalar. if (!is_array($meta) && !is_object($meta)) { $success = false; break; } if (!isset($item['box']) || !is_array($item['box'])) { $success = false; break; } $box = $item['box']; /** * The .fbox file carries a full wp_posts row, and every key in it used to be * written straight to the database. Keep only the columns that actually * describe a campaign; everything else (post_type, post_author, guid, * post_parent, ...) is either forced below or dropped. */ $box = array_intersect_key($box, array_flip([ 'post_title', 'post_content', 'post_excerpt', 'post_name', 'menu_order' ])); if (!isset($box['post_content']) || !is_string($box['post_content'])) { $box['post_content'] = ''; } $box['post_title'] = isset($box['post_title']) && is_string($box['post_title']) ? sanitize_text_field($box['post_title']) : ''; $box['post_excerpt'] = isset($box['post_excerpt']) && is_string($box['post_excerpt']) ? sanitize_textarea_field($box['post_excerpt']) : ''; $box['post_name'] = isset($box['post_name']) && is_string($box['post_name']) ? sanitize_title($box['post_name']) : ''; $box['menu_order'] = isset($box['menu_order']) ? (int) $box['menu_order'] : 0; $factory = new \FPFramework\Base\Factory(); $tz = wp_timezone(); $date_without_tz = $factory->getDate(); $date_with_tz = $factory->getDate()->setTimezone($tz); $box['post_date'] = $date_with_tz->format('Y-m-d H:i:s'); $box['post_date_gmt'] = $date_without_tz->format('Y-m-d H:i:s'); // These are ours to decide, never the file's. $box['post_type'] = 'firebox'; $box['post_author'] = get_current_user_id(); \FireBox\Core\Helpers\Form\Form::ensureUniqueFormIDs($box['post_content']); // set publish status if (in_array($publish_all, [0, 1])) { $box['post_status'] = ($publish_all == 0) ? 'draft' : 'publish'; } else { $box['post_status'] = 'draft'; } /** * Insert through wp_insert_post() rather than the raw table layer so that * kses, slug uniqueness and the usual save_post hooks all apply. */ $new_box_id = wp_insert_post(wp_slash($box), true); if (is_wp_error($new_box_id) || !$new_box_id) { $success = false; break; } // add meta options for new box // TODO: In the future, use "firebox_meta". This is a temporary fix for backwards compatibility. $checkMeta = (array) $meta; $meta_key = isset($checkMeta['width']) ? 'firebox_meta' : 'fpframework_meta_settings'; update_post_meta($new_box_id, $meta_key, wp_slash($meta)); $success = $new_box_id; } return $success; } /** * What the settings page will contain * * @return void */ public function settingsPageContent() { $form = new Form(\FireBox\Core\Admin\Forms\Import::getSettings(), [ 'fields_name_prefix' => self::settings_name, 'section_name' => self::settings_name, 'class' => 'settings-ui-inner-fields', 'button_label' => 'FPF_IMPORT' ]); echo $form->render(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped } } ```