← All changes | app/Services/FormBuilder/Components/SubmitButton.php +95 -33 3.6.41 → 6.2.14 View file →

		@@ -1,8 +1,10 @@
1	1	<?php
2	2
3	3	namespace FluentForm\App\Services\FormBuilder\Components;
4	4
	5	+defined('ABSPATH') or die;
	6	+
5	7	use FluentForm\App\Helpers\Helper;
6	8	use FluentForm\Framework\Helpers\ArrayHelper;
7	9
8	10	class SubmitButton extends BaseComponent
		@@ -8,42 +10,83 @@
8	10	class SubmitButton extends BaseComponent
9	11	{
10	12	/**
11	13	* Compile and echo the html element
12		- * @param array $data [element data]
13		- * @param stdClass $form [Form Object]
14		- * @return viod
	14	+ *
	15	+ * @param array $data [element data]
	16	+ * @param \stdClass $form [Form Object]
	17	+ *
	18	+ * @return void
15	19	*/
16	20	public function compile($data, $form)
17	21	{
18		-
19		- if(apply_filters('fluentform_is_hide_submit_btn_'.$form->id, false)) {
	22	+ $maybeHide = apply_filters_deprecated(
	23	+ 'fluentform_is_hide_submit_btn_' . $form->id,
	24	+ [
	25	+ false
	26	+ ],
	27	+ FLUENTFORM_FRAMEWORK_UPGRADE,
	28	+ 'fluentform/is_hide_submit_btn_' . $form->id,
	29	+ 'Use fluentform/is_hide_submit_btn_' . $form->id. ' instead of fluentform_is_hide_submit_btn_' . $form->id
	30	+ );
	31	+ if (apply_filters('fluentform/is_hide_submit_btn_' . $form->id, $maybeHide)) {
20	32	return '';
21	33	}
22	34
23	35	$elementName = $data['element'];
24		- $data = apply_filters('fluenform_rendering_field_data_'.$elementName, $data, $form);
	36	+
	37	+ $data = apply_filters_deprecated(
	38	+ 'fluentform_rendering_field_data_' . $elementName,
	39	+ [
	40	+ $data,
	41	+ $form
	42	+ ],
	43	+ FLUENTFORM_FRAMEWORK_UPGRADE,
	44	+ 'fluentform/rendering_field_data_' . $elementName,
	45	+ 'Use fluentform/rendering_field_data_' . $elementName . ' instead of fluentform_rendering_field_data_' . $elementName
	46	+ );
25	47
	48	+ $data = apply_filters('fluentform/rendering_field_data_' . $elementName, $data, $form);
	49	+
	50	+ $btnStyle = ArrayHelper::get($data['settings'], 'button_style');
	51	+
	52	+ /* This filter is deprecated and will be removed soon */
	53	+ $noStyle = apply_filters('fluentform_submit_button_force_no_style', false);
	54	+
	55	+ if (apply_filters('fluentform/submit_button_force_no_style', $noStyle)) {
	56	+ $btnStyle = 'no_style';
	57	+ }
	58	+
26	59	$btnSize = 'ff-btn-';
27		- $color = isset($data['settings']['color']) ? $data['settings']['color'] : '#ffffff';
28	60	$btnSize .= isset($data['settings']['button_size']) ? $data['settings']['button_size'] : 'md';
29		- $backgroundColor = isset($data['settings']['background_color']) ? $data['settings']['background_color'] : '#409EFF';
30	61	$oldBtnType = isset($data['settings']['button_style']) ? '' : ' ff-btn-primary ';
31	62
	63	+ $btnClasses = [
	64	+ 'ff-btn ff-btn-submit',
	65	+ $oldBtnType,
	66	+ $btnSize,
	67	+ $data['attributes']['class'],
	68	+ ];
	69	+
	70	+ $loadDefaultFluentStyle = $form->theme != 'ffs_inherit_theme';
	71	+ if(!$loadDefaultFluentStyle){
	72	+ $btnStyle = 'no_style';
	73	+ }
	74	+ if ('no_style' == $btnStyle) {
	75	+ $btnClasses[] = 'ff_btn_no_style';
	76	+ } else {
	77	+ $btnClasses[] = 'ff_btn_style';
	78	+ }
	79	+
32	80	$align = 'ff-el-group ff-text-' . @$data['settings']['align'];
33		- $data['attributes']['class'] = trim(
34		- 'ff-btn ff-btn-submit ' . ' ' .
35		- $oldBtnType . ' ' .
36		- $btnSize . ' ' .
37		- $data['attributes']['class']
38		- );
	81	+ $data['attributes']['class'] = trim(implode(' ', array_filter($btnClasses)));
39	82
40		- if($tabIndex = \FluentForm\App\Helpers\Helper::getNextTabIndex()) {
	83	+ if ($tabIndex = Helper::getNextTabIndex()) {
41	84	$data['attributes']['tabindex'] = $tabIndex;
42	85	}
43	86
44	87	$styles = '';
45		- if (ArrayHelper::get($data, 'settings.button_style') == '') {
	88	+ if ('' == ArrayHelper::get($data, 'settings.button_style')) {
46	89	$data['attributes']['class'] .= ' wpf_has_custom_css';
47	90	// it's a custom button
48	91	$buttonActiveStyles = ArrayHelper::get($data, 'settings.normal_styles', []);
49	92	$buttonHoverStyles = ArrayHelper::get($data, 'settings.hover_styles', []);
		@@ -49,12 +92,12 @@
49	92	$buttonHoverStyles = ArrayHelper::get($data, 'settings.hover_styles', []);
50	93
51	94	$activeStates = '';
52	95	foreach ($buttonActiveStyles as $styleAtr => $styleValue) {
53		- if (!$styleValue) {
	96	+ if ('0' !== $styleValue && !$styleValue) {
54	97	continue;
55	98	}
56		- if ($styleAtr == 'borderRadius') {
	99	+ if ('borderRadius' == $styleAtr) {
57	100	$styleValue .= 'px';
58	101	}
59	102	$activeStates .= ltrim(strtolower(preg_replace('/[A-Z]([A-Z](?![a-z]))*/', '-$0', $styleAtr)), '_') . ':' . $styleValue . ';';
60	103	}
		@@ -62,12 +105,12 @@
62	105	$styles .= 'form.fluent_form_' . $form->id . ' .wpf_has_custom_css.ff-btn-submit { ' . $activeStates . ' }';
63	106	}
64	107	$hoverStates = '';
65	108	foreach ($buttonHoverStyles as $styleAtr => $styleValue) {
66		- if (!$styleValue) {
	109	+ if ('0' !== $styleValue && !$styleValue) {
67	110	continue;
68	111	}
69		- if ($styleAtr == 'borderRadius') {
	112	+ if ('borderRadius' == $styleAtr) {
70	113	$styleValue .= 'px';
71	114	}
72	115	$hoverStates .= ltrim(strtolower(preg_replace('/[A-Z]([A-Z](?![a-z]))*/', '-$0', $styleAtr)), '-') . ':' . $styleValue . ';';
73	116	}
		@@ -73,40 +116,59 @@
73	116	}
74	117	if ($hoverStates) {
75	118	$styles .= 'form.fluent_form_' . $form->id . ' .wpf_has_custom_css.ff-btn-submit:hover { ' . $hoverStates . ' } ';
76	119	}
77		- } else {
78		- $styles .= 'form.fluent_form_' . $form->id . ' .ff-btn-submit { background-color: '.ArrayHelper::get($data, 'settings.background_color').'; color: '.ArrayHelper::get($data, 'settings.color').'; }';
	120	+ } elseif ('no_style' != $btnStyle) {
	121	+ $bgColor = esc_attr(ArrayHelper::get($data, 'settings.background_color'));
	122	+ $bgColor = str_replace('#1a7efb','var(--fluentform-primary)',$bgColor);
	123	+ $styles .= 'form.fluent_form_' . $form->id . ' .ff-btn-submit:not(.ff_btn_no_style) { background-color: ' . $bgColor . '; color: ' . esc_attr(ArrayHelper::get($data, 'settings.color')) . '; }';
79	124	}
80	125
81	126	$atts = $this->buildAttributes($data['attributes']);
82	127	$cls = trim($align . ' ' . $data['settings']['container_class']);
83	128
	129	+ $html = "<div class='" . esc_attr($cls) . " ff_submit_btn_wrapper'>";
84	130
85		- $html = "<div class='{$cls} ff_submit_btn_wrapper'>";
86		-
87	131	// ADDED IN v1.2.6 - updated in 1.4.4
88	132	if (isset($data['settings']['button_ui'])) {
89		- if ($data['settings']['button_ui']['type'] == 'default') {
90		- $html .= '<button ' . $atts . '>' . $data['settings']['button_ui']['text'] . '</button>';
	133	+ if ('default' == $data['settings']['button_ui']['type']) {
	134	+ $buttonText = $data['settings']['button_ui']['text'];
	135	+ $html .= '<button ' . $atts . ' aria-label="' . esc_attr($this->removeShortcode($buttonText)) . '">' . fluentform_sanitize_html($buttonText) . '</button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $atts is escaped before being passed in.
91	136	} else {
92		- $html .= "<button class='ff-btn-submit' type='submit'><img style='max-width: 200px;' src='{$data['settings']['button_ui']['img_url']}' alt='Submit Form'></button>";
	137	+ $html .= "<button class='ff-btn-submit' type='submit' aria-label='Submit The Form'><img style='max-width: 200px;' src='" . esc_url($data['settings']['button_ui']['img_url']) . "' alt='Submit Form'></button>";
93	138	}
94	139	} else {
95		- $html .= '<button ' . $atts . '>' . $data['settings']['btn_text'] . '</button>';
	140	+ $buttonText = $data['settings']['btn_text'];
	141	+ $html .= '<button ' . $atts . ' aria-label="' . esc_attr($this->removeShortcode($buttonText)) . '">' . fluentform_sanitize_html($buttonText) . '</button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $atts is escaped before being passed in.
96	142	}
97	143
98		- if($styles) {
99		- if(did_action('wp_footer')) {
100		- $html .= '<style>'.$styles.'</style>';
	144	+ // SECURITY (FINDING-12): the custom-button style map keys and values are user-controlled
	145	+ // and unsanitized at save; a value like "#fff}</style><script>..." would break out of the
	146	+ // <style> element. fluentformSanitizeCSS() blanks any CSS containing a tag pattern.
	147	+ $styles = fluentformSanitizeCSS($styles);
	148	+ if ($styles) {
	149	+ if (did_action('wp_footer') || Helper::isBlockEditor()) {
	150	+ $html .= '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is sanitized via fluentformSanitizeCSS().
101	151	} else {
102	152	add_action('wp_footer', function () use ($styles) {
103		- echo '<style>'.$styles.'</style>';
	153	+ echo '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is sanitized via fluentformSanitizeCSS().
104	154	});
105	155	}
106	156	}
107	157
108	158	$html .= '</div>';
	159	+
	160	+ $html = apply_filters_deprecated(
	161	+ 'fluentform_rendering_field_html_' . $elementName,
	162	+ [
	163	+ $html,
	164	+ $data,
	165	+ $form
	166	+ ],
	167	+ FLUENTFORM_FRAMEWORK_UPGRADE,
	168	+ 'fluentform/rendering_field_html_' . $elementName,
	169	+ 'Use fluentform/rendering_field_html_' . $elementName . ' instead of fluentform_rendering_field_html_' . $elementName
	170	+ );
109	171
110		- echo apply_filters('fluenform_rendering_field_html_'.$elementName, $html, $data, $form);
	172	+ $this->printContent('fluentform/rendering_field_html_' . $elementName, $html, $data, $form);
111	173	}
112	174	}