| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentForm\App\Services\FormBuilder\Components; |
| 4 |
|
| 5 |
use FluentForm\Framework\Helpers\ArrayHelper; |
| 6 |
|
| 7 |
class TabularGrid extends BaseComponent |
| 8 |
{ |
| 9 |
/** |
| 10 |
* Compile and echo the html element |
| 11 |
* |
| 12 |
* @param array $data [element data] |
| 13 |
* @param \stdClass $form [Form Object] |
| 14 |
* |
| 15 |
* @return void |
| 16 |
*/ |
| 17 |
public function compile($data, $form) |
| 18 |
{ |
| 19 |
$elementName = $data['element']; |
| 20 |
$data = apply_filters_deprecated( |
| 21 |
'fluentform_rendering_field_data_' . $elementName, |
| 22 |
[ |
| 23 |
$data, |
| 24 |
$form |
| 25 |
], |
| 26 |
FLUENTFORM_FRAMEWORK_UPGRADE, |
| 27 |
'fluentform/rendering_field_data_' . $elementName, |
| 28 |
'Use fluentform/rendering_field_data_' . $elementName . ' instead of fluentform_rendering_field_data_' . $elementName |
| 29 |
); |
| 30 |
$data = apply_filters('fluentform/rendering_field_data_' . $elementName, $data, $form); |
| 31 |
|
| 32 |
$checked = $data['settings']['selected_grids']; |
| 33 |
$columnLabels = $data['settings']['grid_columns']; |
| 34 |
|
| 35 |
$fieldType = $data['settings']['tabular_field_type']; |
| 36 |
$columnHeaders = implode('</th><th>', array_values($columnLabels)); |
| 37 |
$elementHelpMessage = $this->getElementHelpMessage($data, $form); |
| 38 |
$elementLabel = $this->setClasses($data)->buildElementLabel($data, $form); |
| 39 |
|
| 40 |
$elMarkup = "<table class='ff-table ff-checkable-grids ff_flexible_table' role='table'><thead><tr><th></th><th>" . fluentform_sanitize_html($columnHeaders) . '</th></tr></thead><tbody>'; |
| 41 |
|
| 42 |
$tabIndex = \FluentForm\App\Helpers\Helper::getNextTabIndex(); |
| 43 |
foreach ($this->makeTabularData($data) as $index => $row) { |
| 44 |
$elMarkup .= '<tr role="row"">'; |
| 45 |
$elMarkup .= "<td class='ff_grid_header' role='cell'>" . fluentform_sanitize_html($row['label']) . '</td>'; |
| 46 |
$isRowChecked = in_array($row['name'], $checked) ? 'checked' : ''; |
| 47 |
foreach ($row['columns'] as $column) { |
| 48 |
$name = $data['attributes']['name'] . '[' . $row['name'] . ']'; |
| 49 |
$name = 'checkbox' == $fieldType ? ($name . '[]') : $name; |
| 50 |
$isColChecked = in_array($column['name'], $checked) ? 'checked' : ''; |
| 51 |
$isChecked = $isRowChecked ? $isRowChecked : $isColChecked; |
| 52 |
|
| 53 |
$atts = [ |
| 54 |
'name' => $name, |
| 55 |
'type' => $fieldType, |
| 56 |
'value' => $column['name'], |
| 57 |
]; |
| 58 |
if ($tabIndex) { |
| 59 |
$atts['tabindex'] = $tabIndex; |
| 60 |
} |
| 61 |
$attributes = $this->buildAttributes($atts, $form); |
| 62 |
|
| 63 |
$ariaRequired = 'false'; |
| 64 |
if (ArrayHelper::get($data, 'settings.validation_rules.required.value')) { |
| 65 |
$ariaRequired = 'true'; |
| 66 |
} |
| 67 |
|
| 68 |
// SECURITY (FINDING-12): esc_attr the row/column labels before interpolating them |
| 69 |
// into the double-quoted aria-label; save-time sanitizers do not encode quotes. |
| 70 |
$input = '<input aria-label="'. esc_attr($row['name']) .'-'. esc_attr($column['label']) . '" ' . $attributes . " {$isChecked} aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $attributes is escaped before being passed in. |
| 71 |
$responsiveLabel = esc_attr(wp_strip_all_tags($column['label'])); |
| 72 |
$elMarkup .= "<td data-label='{$responsiveLabel}'>{$input}</td>"; |
| 73 |
} |
| 74 |
$elMarkup .= '</tr>'; |
| 75 |
} |
| 76 |
|
| 77 |
$elMarkup .= '</tbody></table>'; |
| 78 |
|
| 79 |
$elMarkup = "<div class='ff-el-input--content'>{$elMarkup}" . fluentform_sanitize_html($elementHelpMessage) . '</div>'; |
| 80 |
|
| 81 |
// SECURITY (FINDING-12): esc_attr the attribute values interpolated into the single-quoted |
| 82 |
// data-type / data-name / class attributes; sanitize_text_field at save does not encode quotes. |
| 83 |
$html = sprintf( |
| 84 |
"<div data-type='%s' data-name='%s' class='%s'>%s", |
| 85 |
esc_attr($data['attributes']['data-type']), |
| 86 |
esc_attr($data['attributes']['name']), |
| 87 |
esc_attr($data['attributes']['class']), |
| 88 |
$elementLabel |
| 89 |
) . $elMarkup . '</div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $elementLabel is escaped before being passed in. |
| 90 |
|
| 91 |
$html = apply_filters_deprecated( |
| 92 |
'fluentform_rendering_field_html_' . $elementName, |
| 93 |
[ |
| 94 |
$html, |
| 95 |
$data, |
| 96 |
$form |
| 97 |
], |
| 98 |
FLUENTFORM_FRAMEWORK_UPGRADE, |
| 99 |
'fluentform/rendering_field_html_' . $elementName, |
| 100 |
'Use fluentform/rendering_field_html_' . $elementName . ' instead of fluentform_rendering_field_html_' . $elementName |
| 101 |
); |
| 102 |
$this->printContent('fluentform/rendering_field_html_' . $elementName, $html, $data, $form); |
| 103 |
} |
| 104 |
|
| 105 |
public function makeTabularData($data) |
| 106 |
{ |
| 107 |
$table = []; |
| 108 |
$rows = $data['settings']['grid_rows']; |
| 109 |
$columns = $data['settings']['grid_columns']; |
| 110 |
|
| 111 |
foreach ($rows as $rowKey => $rowValue) { |
| 112 |
$rowKey = trim(sanitize_text_field($rowKey)); |
| 113 |
$table[$rowKey] = [ |
| 114 |
'name' => $rowKey, |
| 115 |
'label' => $rowValue, |
| 116 |
'columns' => [], |
| 117 |
]; |
| 118 |
|
| 119 |
foreach ($columns as $columnKey => $columnValue) { |
| 120 |
$columnKey = trim(sanitize_text_field($columnKey)); |
| 121 |
$table[$rowKey]['columns'][] = [ |
| 122 |
'name' => $columnKey, |
| 123 |
'label' => $columnValue, |
| 124 |
]; |
| 125 |
} |
| 126 |
} |
| 127 |
|
| 128 |
return $table; |
| 129 |
} |
| 130 |
|
| 131 |
protected function getElementHelpMessage($data, $form) |
| 132 |
{ |
| 133 |
$elementHelpMessage = ''; |
| 134 |
$helpMessagePlacement = ArrayHelper::get($form->settings, 'layout.helpMessagePlacement', 'with_label'); |
| 135 |
if ('under_input' == $helpMessagePlacement) { |
| 136 |
$elementHelpMessage = $this->getInputHelpMessage($data); |
| 137 |
} |
| 138 |
|
| 139 |
return $elementHelpMessage; |
| 140 |
} |
| 141 |
|
| 142 |
protected function setClasses(&$data) |
| 143 |
{ |
| 144 |
if (! isset($data['attributes']['class'])) { |
| 145 |
$data['attributes']['class'] = ''; |
| 146 |
} |
| 147 |
|
| 148 |
$placement = $data['settings']['label_placement']; |
| 149 |
$placementClass = $placement ? 'ff-el-form-' . $placement : ''; |
| 150 |
$hasConditions = $this->hasConditions($data) ? ' has-conditions' : ''; |
| 151 |
$defaultContainerClass = $this->getDefaultContainerClass(); |
| 152 |
$containerClass = $data['settings']['container_class']; |
| 153 |
$data['attributes']['class'] .= trim(implode(' ', array_map('trim', [ |
| 154 |
$defaultContainerClass, $containerClass, $placementClass, $hasConditions, |
| 155 |
]))); |
| 156 |
|
| 157 |
return $this; |
| 158 |
} |
| 159 |
} |
| 160 |
|
