← All changes | app/Modules/Form/Settings/FormCssJs.php +165 -61 3.6.65 → 6.2.14 View file →

		@@ -1,64 +1,161 @@
1	1	<?php
2	2
3	3	namespace FluentForm\App\Modules\Form\Settings;
4	4
	5	+defined('ABSPATH') or die;
	6	+
5	7	use FluentForm\App\Helpers\Helper;
	8	+use FluentForm\Framework\Helpers\ArrayHelper;
6	9
7	10	class FormCssJs
8	11	{
9		- public function addCssJs($formId)
	12	+ /**
	13	+ * Request object
	14	+ *
	15	+ * @var \FluentForm\Framework\Request\Request $request
	16	+ */
	17	+ protected $request;
	18	+
	19	+ public function __construct()
10	20	{
11		- // @todo: Limit 3 sometimes make things double
12		- $metas = wpFluent()->table('fluentform_form_meta')
13		- ->where('form_id', $formId)
14		- ->whereIn('meta_key', [
15		- '_custom_form_css',
16		- '_custom_form_js',
17		- '_ff_form_styler_css'
18		- ])
19		- ->groupBy('meta_key')
20		- //->limit(3)
21		- ->get();
	21	+ $this->request = wpFluentForm('request');
	22	+ }
22	23
23		- if (!$metas) {
	24	+ public function addCustomCssJs($formId)
	25	+ {
	26	+ if (did_action('fluentform/adding_custom_css_js_' . $formId)) {
24	27	return;
25	28	}
26	29
	30	+ do_action('fluentform/adding_custom_css_js_' . $formId, $formId);
27	31
28		- foreach ($metas as $meta) {
29		- if ($meta->meta_key == '_custom_form_css' && $meta->value) {
30		- $css = $meta->value;
31		- $css = str_replace('{form_id}', $formId, $css);
32		- $css = str_replace('FF_ID', $formId, $css);
33		- $this->addCss($formId, $css, 'fluentform_custom_css_'.$formId );
34		- } else if(($meta->meta_key == '_ff_form_styler_css' && $meta->value)) {
35		- $css = $meta->value;
36		- $this->addCss($formId, $css, 'fluentform_styler_css_'.$formId );
37		- } else if ($meta->meta_key == '_custom_form_js' && $meta->value) {
38		- $this->addJs($formId, $meta->value);
	32	+ $metaKeys = ['_custom_form_css', '_custom_form_js'];
	33	+
	34	+ $metas = (new \FluentForm\App\Services\Settings\Customizer())->get($formId, $metaKeys);
	35	+
	36	+ foreach ($metas as $metaKey => $metaValue) {
	37	+ if ($metaValue) {
	38	+ switch ($metaKey) {
	39	+ case 'css':
	40	+ $css = $metaValue;
	41	+ $css = str_replace('{form_id}', $formId, $css);
	42	+ $customCss = str_replace('FF_ID', $formId, $css);
	43	+
	44	+ if ($customCss) {
	45	+ $this->addCss($formId, $customCss, 'fluentform_custom_css_' . $formId);
	46	+ }
	47	+ break;
	48	+ case 'js':
	49	+ $this->addJs($formId, $metaValue);
	50	+ break;
	51	+ }
39	52	}
40	53	}
41	54	}
42	55
	56	+ public function addStylerCSS($formId, $styles = [])
	57	+ {
	58	+ $metaKeys = array_merge(
	59	+ ['_ff_form_styler_css', '_ff_selected_style'],
	60	+ $styles
	61	+ );
	62	+
	63	+ $metas = (new \FluentForm\App\Services\Settings\Customizer())->get($formId, $metaKeys);
	64	+
	65	+ foreach ($styles as $style) {
	66	+ if (!$style) {
	67	+ continue;
	68	+ }
	69	+
	70	+ if ('ffs_inherit_theme' === $style) {
	71	+ continue;
	72	+ }
	73	+
	74	+ $loadCss = ArrayHelper::get($metas, $style);
	75	+
	76	+ if (!$loadCss) {
	77	+ $loadCss = apply_filters('fluentform/build_style_from_theme', '', $formId, $style);
	78	+
	79	+ // todo: remove this from next version. it's only here to support if the user updates the free version first.
	80	+ if (!$loadCss) {
	81	+ $selectedStyle = ArrayHelper::get($metas, '_ff_selected_style');
	82	+ $selectedStyleCSS = ArrayHelper::get($metas, '_ff_form_styler_css');
	83	+
	84	+ if ($selectedStyle == $style && $selectedStyleCSS) {
	85	+ $loadCss = $selectedStyleCSS;
	86	+ }
	87	+ }
	88	+ }
	89	+
	90	+ if ($loadCss) {
	91	+ $this->addCss($formId, $loadCss, 'fluentform_styler_css_' . $formId . '_' . $style);
	92	+
	93	+ do_action('fluent_form/loaded_styler_' . $formId . '_' . $style);
	94	+ }
	95	+ }
	96	+ }
	97	+
	98	+ public function getCss($formId)
	99	+ {
	100	+ $cssMeta = wpFluent()->table('fluentform_form_meta')
	101	+ ->where('form_id', $formId)
	102	+ ->where('meta_key', '_custom_form_css')
	103	+ ->first();
	104	+
	105	+ if (!$cssMeta || !$cssMeta->value) {
	106	+ return '';
	107	+ }
	108	+
	109	+ $css = $cssMeta->value;
	110	+ $css = str_replace('{form_id}', $formId, $css);
	111	+ $css = str_replace('FF_ID', $formId, $css);
	112	+ return fluentformSanitizeCSS($css);
	113	+ }
	114	+
	115	+ public function getJs($formId)
	116	+ {
	117	+ $jsMeta = wpFluent()->table('fluentform_form_meta')
	118	+ ->where('form_id', $formId)
	119	+ ->where('meta_key', '_custom_form_js')
	120	+ ->first();
	121	+
	122	+ if (!$jsMeta || !$jsMeta->value) {
	123	+ return '';
	124	+ }
	125	+
	126	+ return $jsMeta->value;
	127	+ }
	128	+
43	129	public function addCss($formId, $css, $cssId = 'fluentform_custom_css')
44	130	{
45	131	if ($css) {
	132	+ $action = false;
	133	+
46	134	if (!did_action('wp_head')) {
47		- add_action('wp_head', function () use ($css, $formId, $cssId) {
	135	+ $action = 'wp_head';
	136	+ } elseif (!did_action('wp_footer')) {
	137	+ $action = 'wp_footer';
	138	+ }
	139	+
	140	+ if (Helper::isBlockEditor()) {
	141	+ $action = false;
	142	+ }
	143	+
	144	+ if ($action) {
	145	+ add_action($action, function () use ($css, $cssId) {
48	146	?>
	147	+ <style id="<?php echo esc_attr($cssId); ?>" type="text/css">
	148	+ <?php echo fluentformSanitizeCSS($css); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentformSanitizeCSS() removes HTML tags, CSS is safe in style context ?>
	149	+ </style>
49	150
50		-<style id="<?php echo $cssId; ?>" type="text/css">
51		- <?php echo $css; ?>
52		-</style>
53	151	<?php
54		- }, 10);
	152	+ }, 99);
55	153	} else {
56	154	?>
57		-
58		- <style id="<?php echo $cssId; ?>" type="text/css">
59		- <?php echo $css; ?>
60		- </style>
	155	+ <style id="<?php echo esc_attr($cssId); ?>" type="text/css">
	156	+ <?php echo fluentformSanitizeCSS($css); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentformSanitizeCSS() removes HTML tags, CSS is safe in style context ?>
	157	+ </style>
61	158	<?php
62	159	}
63	160	}
64	161	}
		@@ -68,19 +165,20 @@
68	165	if (trim($customJS)) {
69	166	add_action('wp_footer', function () use ($formId, $customJS) {
70	167	?>
71	168	<script type="text/javascript">
72		- jQuery(document.body).on('fluentform_init_<?php echo $formId; ?>', function (event, data) {
73		- var $form = jQuery(data[0]);
74		- var formId = "<?php echo $formId; ?>";
75		- var $ = jQuery;
76		- try {
77		- <?php echo $customJS; ?>
78		- } catch (e) {
79		- console.warn('Error in custom JS of Fluentform ID: ' + $form.data('form_id'));
80		- console.error(e);
81		- }
82		- });
	169	+ jQuery(document.body).on('fluentform_init_<?php echo esc_attr($formId); ?>',
	170	+ function(event, data) {
	171	+ var $form = jQuery(data[0]);
	172	+ var formId = "<?php echo esc_attr($formId); ?>";
	173	+ var $ = jQuery;
	174	+ try {
	175	+ <?php echo fluentform_kses_js($customJS); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- fluentform_kses_js() removes script tags, JS is safe in script context ?>
	176	+ } catch (e) {
	177	+ console.warn('Error in custom JS of Fluentform ID: ' + formId);
	178	+ console.error(e);
	179	+ }
	180	+ });
83	181	</script>
84	182	<?php
85	183	}, 100);
86	184	}
		@@ -87,41 +185,48 @@
87	185	}
88	186
89	187	/**
90	188	* Get settings for a particular form by id
91		- * @return void
92	189	*/
93	190	public function getSettingsAjax()
94	191	{
95		- $formId = absint($_REQUEST['form_id']);
96		- wp_send_json_success(array(
	192	+ $formId = absint($this->request->get('form_id'));
	193	+ // SECURITY (H-02): this handler is currently unregistered, but it read form CSS/JS with no
	194	+ // capability check. Guard it so it is safe if ever wired to an action.
	195	+ \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', $formId);
	196	+ wp_send_json_success([
97	197	'custom_css' => $this->getData($formId, '_custom_form_css'),
98	198	'custom_js' => $this->getData($formId, '_custom_form_js'),
99		- ), 200);
	199	+ ], 200);
100	200	}
101	201
102	202	/**
103	203	* Save settings for a particular form by id
104		- * @return void
105	204	*/
106	205	public function saveSettingsAjax()
107	206	{
108		- $formId = absint($_REQUEST['form_id']);
	207	+ // SECURITY (H-02): this handler is currently unregistered; guard it (forms_manager scope)
	208	+ // so it is safe if ever wired. The unfiltered_html gate below still applies on top.
	209	+ \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', absint($this->request->get('form_id')));
	210	+ if (!fluentformCanUnfilteredHTML()) {
	211	+ wp_send_json_error([
	212	+ 'message' => __('You need unfiltered_html permission to save Custom CSS & JS', 'fluentform'),
	213	+ ], 423);
	214	+ }
109	215
110		- $css = $_REQUEST['custom_css'];
111		- $js = $_REQUEST['custom_js'];
112		- $css = wp_strip_all_tags(wp_unslash($css));
113		- $js = wp_unslash($js);
	216	+ $formId = absint($this->request->get('form_id'));
114	217
	218	+ $css = fluentformSanitizeCSS($this->request->get('custom_css'));
	219	+ $js = fluentform_kses_js($this->request->get('custom_js'));
	220	+
115	221	$this->store($formId, '_custom_form_css', $css);
116	222	$this->store($formId, '_custom_form_js', $js);
117	223
118	224	wp_send_json_success([
119		- 'message' => __('Custom CSS and JS successfully updated', 'fluentform')
	225	+ 'message' => __('Custom CSS & JS successfully updated', 'fluentform'),
120	226	], 200);
121	227	}
122	228
123		-
124	229	protected function getData($formId, $metaKey)
125	230	{
126	231	$row = wpFluent()->table('fluentform_form_meta')
127	232	->where('form_id', $formId)
		@@ -132,9 +237,8 @@
132	237	}
133	238	return '';
134	239	}
135	240
136		-
137	241	protected function store($formId, $metaKey, $metaValue)
138	242	{
139	243	$row = wpFluent()->table('fluentform_form_meta')
140	244	->where('form_id', $formId)
		@@ -142,12 +246,12 @@
142	246	->first();
143	247
144	248	if (!$row) {
145	249	return wpFluent()->table('fluentform_form_meta')
146		- ->insert([
	250	+ ->insertGetId([
147	251	'form_id' => $formId,
148	252	'meta_key' => $metaKey,
149		- 'value' => $metaValue
	253	+ 'value' => $metaValue,
150	254	]);
151	255	}
152	256
153	257	return wpFluent()->table('fluentform_form_meta')
		@@ -152,8 +256,8 @@
152	256
153	257	return wpFluent()->table('fluentform_form_meta')
154	258	->where('id', $row->id)
155	259	->update([
156		- 'value' => $metaValue
	260	+ 'value' => $metaValue,
157	261	]);
158	262	}
159		-}
	263	+}