← All changes | app/Modules/Form/Settings/FormCssJs.php +165 -59 3.6.41 → 6.2.14 View file →

		@@ -1,62 +1,161 @@
1	1	<?php
2	2
3	3	namespace FluentForm\App\Modules\Form\Settings;
4	4
	5	+defined('ABSPATH') or die;
	6	+
5	7	use FluentForm\App\Helpers\Helper;
	8	+use FluentForm\Framework\Helpers\ArrayHelper;
6	9
7	10	class FormCssJs
8	11	{
9		- public function addCssJs($formId)
	12	+ /**
	13	+ * Request object
	14	+ *
	15	+ * @var \FluentForm\Framework\Request\Request $request
	16	+ */
	17	+ protected $request;
	18	+
	19	+ public function __construct()
10	20	{
11		- $metas = wpFluent()->table('fluentform_form_meta')
12		- ->where('form_id', $formId)
13		- ->whereIn('meta_key', [
14		- '_custom_form_css',
15		- '_custom_form_js',
16		- '_ff_form_styler_css'
17		- ])
18		- ->limit(3)
19		- ->get();
	21	+ $this->request = wpFluentForm('request');
	22	+ }
20	23
21		- if (!$metas) {
	24	+ public function addCustomCssJs($formId)
	25	+ {
	26	+ if (did_action('fluentform/adding_custom_css_js_' . $formId)) {
22	27	return;
23	28	}
24	29
	30	+ do_action('fluentform/adding_custom_css_js_' . $formId, $formId);
25	31
26		- foreach ($metas as $meta) {
27		- if ($meta->meta_key == '_custom_form_css' && $meta->value) {
28		- $css = $meta->value;
29		- $css = str_replace('{form_id}', $formId, $css);
30		- $css = str_replace('FF_ID', $formId, $css);
31		- $this->addCss($formId, $css, 'fluentform_custom_css_'.$formId );
32		- } else if(($meta->meta_key == '_ff_form_styler_css' && $meta->value)) {
33		- $css = $meta->value;
34		- $this->addCss($formId, $css, 'fluentform_styler_css_'.$formId );
35		- } else if ($meta->meta_key == '_custom_form_js' && $meta->value) {
36		- $this->addJs($formId, $meta->value);
	32	+ $metaKeys = ['_custom_form_css', '_custom_form_js'];
	33	+
	34	+ $metas = (new \FluentForm\App\Services\Settings\Customizer())->get($formId, $metaKeys);
	35	+
	36	+ foreach ($metas as $metaKey => $metaValue) {
	37	+ if ($metaValue) {
	38	+ switch ($metaKey) {
	39	+ case 'css':
	40	+ $css = $metaValue;
	41	+ $css = str_replace('{form_id}', $formId, $css);
	42	+ $customCss = str_replace('FF_ID', $formId, $css);
	43	+
	44	+ if ($customCss) {
	45	+ $this->addCss($formId, $customCss, 'fluentform_custom_css_' . $formId);
	46	+ }
	47	+ break;
	48	+ case 'js':
	49	+ $this->addJs($formId, $metaValue);
	50	+ break;
	51	+ }
37	52	}
38	53	}
39	54	}
40	55
	56	+ public function addStylerCSS($formId, $styles = [])
	57	+ {
	58	+ $metaKeys = array_merge(
	59	+ ['_ff_form_styler_css', '_ff_selected_style'],
	60	+ $styles
	61	+ );
	62	+
	63	+ $metas = (new \FluentForm\App\Services\Settings\Customizer())->get($formId, $metaKeys);
	64	+
	65	+ foreach ($styles as $style) {
	66	+ if (!$style) {
	67	+ continue;
	68	+ }
	69	+
	70	+ if ('ffs_inherit_theme' === $style) {
	71	+ continue;
	72	+ }
	73	+
	74	+ $loadCss = ArrayHelper::get($metas, $style);
	75	+
	76	+ if (!$loadCss) {
	77	+ $loadCss = apply_filters('fluentform/build_style_from_theme', '', $formId, $style);
	78	+
	79	+ // todo: remove this from next version. it's only here to support if the user updates the free version first.
	80	+ if (!$loadCss) {
	81	+ $selectedStyle = ArrayHelper::get($metas, '_ff_selected_style');
	82	+ $selectedStyleCSS = ArrayHelper::get($metas, '_ff_form_styler_css');
	83	+
	84	+ if ($selectedStyle == $style && $selectedStyleCSS) {
	85	+ $loadCss = $selectedStyleCSS;
	86	+ }
	87	+ }
	88	+ }
	89	+
	90	+ if ($loadCss) {
	91	+ $this->addCss($formId, $loadCss, 'fluentform_styler_css_' . $formId . '_' . $style);
	92	+
	93	+ do_action('fluent_form/loaded_styler_' . $formId . '_' . $style);
	94	+ }
	95	+ }
	96	+ }
	97	+
	98	+ public function getCss($formId)
	99	+ {
	100	+ $cssMeta = wpFluent()->table('fluentform_form_meta')
	101	+ ->where('form_id', $formId)
	102	+ ->where('meta_key', '_custom_form_css')
	103	+ ->first();
	104	+
	105	+ if (!$cssMeta || !$cssMeta->value) {
	106	+ return '';
	107	+ }
	108	+
	109	+ $css = $cssMeta->value;
	110	+ $css = str_replace('{form_id}', $formId, $css);
	111	+ $css = str_replace('FF_ID', $formId, $css);
	112	+ return fluentformSanitizeCSS($css);
	113	+ }
	114	+
	115	+ public function getJs($formId)
	116	+ {
	117	+ $jsMeta = wpFluent()->table('fluentform_form_meta')
	118	+ ->where('form_id', $formId)
	119	+ ->where('meta_key', '_custom_form_js')
	120	+ ->first();
	121	+
	122	+ if (!$jsMeta || !$jsMeta->value) {
	123	+ return '';
	124	+ }
	125	+
	126	+ return $jsMeta->value;
	127	+ }
	128	+
41	129	public function addCss($formId, $css, $cssId = 'fluentform_custom_css')
42	130	{
43	131	if ($css) {
	132	+ $action = false;
	133	+
44	134	if (!did_action('wp_head')) {
45		- add_action('wp_head', function () use ($css, $formId, $cssId) {
	135	+ $action = 'wp_head';
	136	+ } elseif (!did_action('wp_footer')) {
	137	+ $action = 'wp_footer';
	138	+ }
	139	+
	140	+ if (Helper::isBlockEditor()) {
	141	+ $action = false;
	142	+ }
	143	+
	144	+ if ($action) {
	145	+ add_action($action, function () use ($css, $cssId) {
46	146	?>
	147	+ <style id="<?php echo esc_attr($cssId); ?>" type="text/css">
	148	+ <?php echo fluentformSanitizeCSS($css); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentformSanitizeCSS() removes HTML tags, CSS is safe in style context ?>
	149	+ </style>
47	150
48		-<style id="<?php echo $cssId; ?>" type="text/css">
49		- <?php echo $css; ?>
50		-</style>
51	151	<?php
52		- }, 10);
	152	+ }, 99);
53	153	} else {
54	154	?>
55		-
56		- <style id="<?php echo $cssId; ?>" type="text/css">
57		- <?php echo $css; ?>
58		- </style>
	155	+ <style id="<?php echo esc_attr($cssId); ?>" type="text/css">
	156	+ <?php echo fluentformSanitizeCSS($css); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentformSanitizeCSS() removes HTML tags, CSS is safe in style context ?>
	157	+ </style>
59	158	<?php
60	159	}
61	160	}
62	161	}
		@@ -66,19 +165,20 @@
66	165	if (trim($customJS)) {
67	166	add_action('wp_footer', function () use ($formId, $customJS) {
68	167	?>
69	168	<script type="text/javascript">
70		- jQuery(document.body).on('fluentform_init_<?php echo $formId; ?>', function (event, data) {
71		- var $form = jQuery(data[0]);
72		- var formId = "<?php echo $formId; ?>";
73		- var $ = jQuery;
74		- try {
75		- <?php echo $customJS; ?>
76		- } catch (e) {
77		- console.warn('Error in custom JS of Fluentform ID: ' + $form.data('form_id'));
78		- console.error(e);
79		- }
80		- });
	169	+ jQuery(document.body).on('fluentform_init_<?php echo esc_attr($formId); ?>',
	170	+ function(event, data) {
	171	+ var $form = jQuery(data[0]);
	172	+ var formId = "<?php echo esc_attr($formId); ?>";
	173	+ var $ = jQuery;
	174	+ try {
	175	+ <?php echo fluentform_kses_js($customJS); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentform_kses_js() removes script tags, JS is safe in script context ?>
	176	+ } catch (e) {
	177	+ console.warn('Error in custom JS of Fluentform ID: ' + formId);
	178	+ console.error(e);
	179	+ }
	180	+ });
81	181	</script>
82	182	<?php
83	183	}, 100);
84	184	}
		@@ -85,41 +185,48 @@
85	185	}
86	186
87	187	/**
88	188	* Get settings for a particular form by id
89		- * @return void
90	189	*/
91	190	public function getSettingsAjax()
92	191	{
93		- $formId = absint($_REQUEST['form_id']);
94		- wp_send_json_success(array(
	192	+ $formId = absint($this->request->get('form_id'));
	193	+ // SECURITY (H-02): this handler is currently unregistered, but it read form CSS/JS with no
	194	+ // capability check. Guard it so it is safe if ever wired to an action.
	195	+ \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', $formId);
	196	+ wp_send_json_success([
95	197	'custom_css' => $this->getData($formId, '_custom_form_css'),
96	198	'custom_js' => $this->getData($formId, '_custom_form_js'),
97		- ), 200);
	199	+ ], 200);
98	200	}
99	201
100	202	/**
101	203	* Save settings for a particular form by id
102		- * @return void
103	204	*/
104	205	public function saveSettingsAjax()
105	206	{
106		- $formId = absint($_REQUEST['form_id']);
	207	+ // SECURITY (H-02): this handler is currently unregistered; guard it (forms_manager scope)
	208	+ // so it is safe if ever wired. The unfiltered_html gate below still applies on top.
	209	+ \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', absint($this->request->get('form_id')));
	210	+ if (!fluentformCanUnfilteredHTML()) {
	211	+ wp_send_json_error([
	212	+ 'message' => __('You need unfiltered_html permission to save Custom CSS & JS', 'fluentform'),
	213	+ ], 423);
	214	+ }
107	215
108		- $css = $_REQUEST['custom_css'];
109		- $js = $_REQUEST['custom_js'];
110		- $css = wp_strip_all_tags(wp_unslash($css));
111		- $js = wp_unslash($js);
	216	+ $formId = absint($this->request->get('form_id'));
112	217
	218	+ $css = fluentformSanitizeCSS($this->request->get('custom_css'));
	219	+ $js = fluentform_kses_js($this->request->get('custom_js'));
	220	+
113	221	$this->store($formId, '_custom_form_css', $css);
114	222	$this->store($formId, '_custom_form_js', $js);
115	223
116	224	wp_send_json_success([
117		- 'message' => __('Custom CSS and JS successfully updated', 'fluentform')
	225	+ 'message' => __('Custom CSS & JS successfully updated', 'fluentform'),
118	226	], 200);
119	227	}
120	228
121		-
122	229	protected function getData($formId, $metaKey)
123	230	{
124	231	$row = wpFluent()->table('fluentform_form_meta')
125	232	->where('form_id', $formId)
		@@ -130,9 +237,8 @@
130	237	}
131	238	return '';
132	239	}
133	240
134		-
135	241	protected function store($formId, $metaKey, $metaValue)
136	242	{
137	243	$row = wpFluent()->table('fluentform_form_meta')
138	244	->where('form_id', $formId)
		@@ -140,12 +246,12 @@
140	246	->first();
141	247
142	248	if (!$row) {
143	249	return wpFluent()->table('fluentform_form_meta')
144		- ->insert([
	250	+ ->insertGetId([
145	251	'form_id' => $formId,
146	252	'meta_key' => $metaKey,
147		- 'value' => $metaValue
	253	+ 'value' => $metaValue,
148	254	]);
149	255	}
150	256
151	257	return wpFluent()->table('fluentform_form_meta')
		@@ -150,8 +256,8 @@
150	256
151	257	return wpFluent()->table('fluentform_form_meta')
152	258	->where('id', $row->id)
153	259	->update([
154		- 'value' => $metaValue
	260	+ 'value' => $metaValue,
155	261	]);
156	262	}
157		-}
	263	+}