← All changes | app/Services/FormBuilder/EditorShortcodeParser.php +61 -54 6.2.11 → 6.2.14 View file →

		@@ -8,14 +8,16 @@
8	8	class EditorShortcodeParser
9	9	{
10	10	/**
11	11	* Available dynamic short codes
	12	+ *
12	13	* @var null
13	14	*/
14	15	private static $dynamicShortcodes = null;
15		-
	16	+
16	17	/**
17	18	* mappings of methods to parse the shortcode
	19	+ *
18	20	* @var array
19	21	*/
20	22	private static $handlers = [
21	23	'ip' => 'parseIp',
		@@ -20,18 +22,18 @@
20	22	private static $handlers = [
21	23	'ip' => 'parseIp',
22	24	'date.m/d/Y' => 'parseDate',
23	25	'date.d/m/Y' => 'parseDate',
24		-
	26	+
25	27	'embed_post.ID' => 'parsePostProperties',
26	28	'embed_post.post_title' => 'parsePostProperties',
27	29	'embed_post.permalink' => 'parsePostProperties',
28	30	'http_referer' => 'parseWPProperties',
29		-
	31	+
30	32	'wp.admin_email' => 'parseWPProperties',
31	33	'wp.site_url' => 'parseWPProperties',
32	34	'wp.site_title' => 'parseWPProperties',
33		-
	35	+
34	36	'user.ID' => 'parseUserProperties',
35	37	'user.display_name' => 'parseUserProperties',
36	38	'user.first_name' => 'parseUserProperties',
37	39	'user.last_name' => 'parseUserProperties',
		@@ -36,16 +38,16 @@
36	38	'user.first_name' => 'parseUserProperties',
37	39	'user.last_name' => 'parseUserProperties',
38	40	'user.user_email' => 'parseUserProperties',
39	41	'user.user_login' => 'parseUserProperties',
40		-
	42	+
41	43	'browser.name' => 'parseBrowserProperties',
42	44	'browser.platform' => 'parseBrowserProperties',
43		-
	45	+
44	46	'get.param_name' => 'parseRequestParam',
45	47	'random_string.param_name' => 'parseRandomString',
46	48	];
47		-
	49	+
48	50	/**
49	51	* Filter dynamic shortcodes in input value
50	52	*
51	53	* @param string $value
		@@ -57,15 +59,15 @@
57	59	if (0 === strpos($value, '{ ')) {
58	60	// it's the css
59	61	return $value;
60	62	}
61		-
	63	+
62	64	if (is_null(static::$dynamicShortcodes)) {
63	65	static::$dynamicShortcodes = fluentFormEditorShortCodes();
64	66	}
65		-
	67	+
66	68	$filteredValue = '';
67		-
	69	+
68	70	foreach (static::parseValue($value) as $handler) {
69	71	if (isset(static::$handlers[$handler])) {
70	72	return call_user_func_array(
71	73	[__CLASS__, static::$handlers[$handler]],
		@@ -71,9 +73,9 @@
71	73	[__CLASS__, static::$handlers[$handler]],
72	74	['{' . $handler . '}', $form]
73	75	);
74	76	}
75		-
	77	+
76	78	if (false !== strpos($handler, 'get.')) {
77	79	return static::parseRequestParam($handler);
78	80	}
79	81	if (false !== strpos($handler, 'random_string.')) {
		@@ -78,9 +80,9 @@
78	80	}
79	81	if (false !== strpos($handler, 'random_string.')) {
80	82	return static::parseRandomString($handler);
81	83	}
82		-
	84	+
83	85	if (false !== strpos($handler, 'user.')) {
84	86	$parsedValue = self::parseUserProperties($handler);
85	87	if (is_array($parsedValue) || is_object($parsedValue)) {
86	88	return '';
		@@ -86,13 +88,13 @@
86	88	return '';
87	89	}
88	90	return esc_html($parsedValue);
89	91	}
90		-
	92	+
91	93	if (false !== strpos($handler, 'date.')) {
92	94	return esc_html(self::parseDate($handler));
93	95	}
94		-
	96	+
95	97	if (false !== strpos($handler, 'embed_post.meta.')) {
96	98	$key = substr(str_replace(['{', '}'], '', $value), 16);
97	99	global $post;
98	100	if ($post) {
		@@ -102,19 +104,20 @@
102	104	}
103	105	}
104	106	return '';
105	107	}
106		-
	108	+
107	109	if (false !== strpos($handler, 'embed_post.')) {
108	110	return self::parsePostProperties($handler, $form);
109	111	}
110		-
	112	+
111	113	if (false !== strpos($handler, 'cookie.')) {
112	114	$scookieProperty = substr($handler, strlen('cookie.'));
113		-
114		- return array_key_exists($scookieProperty, $_COOKIE) ? wp_unslash($_COOKIE[$scookieProperty]) : '';
	115	+ $cookieValue = array_key_exists($scookieProperty, $_COOKIE) ? sanitize_text_field(wp_unslash($_COOKIE[$scookieProperty])) : '';
	116	+
	117	+ return esc_attr($cookieValue);
115	118	}
116		-
	119	+
117	120	if (false !== strpos($handler, 'dynamic.')) {
118	121	$dynamicKey = substr($handler, strlen('dynamic.'));
119	122	// maybe has fallback value
120	123	$dynamicKey = explode('|', $dynamicKey);
		@@ -125,23 +128,23 @@
125	128	}
126	129	if (isset($dynamicKey[0])) {
127	130	$ref = $dynamicKey[0];
128	131	}
129		-
	132	+
130	133	if ('payment_summary' == $ref) {
131	134	return fluentform_sanitize_html('<div class="ff_dynamic_value ff_dynamic_payment_summary" data-ref="payment_summary"><div class="ff_payment_summary"></div><div class="ff_payment_summary_fallback">' . $fallBack . '</div></div>');
132	135	}
133		-
	136	+
134	137	return fluentform_sanitize_html('<span class="ff_dynamic_value" data-ref="' . $ref . '" data-fallback="' . $fallBack . '">' . $fallBack . '</span>');
135	138	}
136		-
	139	+
137	140	// if it's multi line then just return
138	141	if (false !== strpos($handler, PHP_EOL)) { // most probably it's a css
139	142	return '{' . $handler . '}';
140	143	}
141		-
	144	+
142	145	$handlerArray = explode('.', $handler);
143		-
	146	+
144	147	if (count($handlerArray) > 1) {
145	148	// it's a grouped handler
146	149	$group = array_shift($handlerArray);
147	150	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_group_' . $group, '{' . $handler . '}', $form, $handlerArray);
		@@ -146,16 +149,16 @@
146	149	$group = array_shift($handlerArray);
147	150	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_group_' . $group, '{' . $handler . '}', $form, $handlerArray);
148	151	return apply_filters('fluentform/editor_shortcode_callback_group_' . $group, $parsedValue, $form, $handlerArray);
149	152	}
150		-
	153	+
151	154	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_' . $handler, '{' . $handler . '}', $form);
152	155	return apply_filters('fluentform/editor_shortcode_callback_' . $handler, $parsedValue, $form);
153	156	}
154		-
	157	+
155	158	return $filteredValue;
156	159	}
157		-
	160	+
158	161	/**
159	162	* Parse request query param.
160	163	*
161	164	* @param string $value
		@@ -174,9 +177,9 @@
174	177	}
175	178
176	179	return esc_attr(Helper::flattenRequestValue($value));
177	180	}
178		-
	181	+
179	182	/**
180	183	* Parse the curly braced shortcode into array
181	184	*
182	185	* @param string $value
		@@ -192,16 +195,16 @@
192	195	-1,
193	196	PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY
194	197	);
195	198	}
196		-
	199	+
197	200	return $value;
198	201	}
199		-
	202	+
200	203	/**
201	204	* Declare all parsers and must be [private] static methods
202	205	*/
203		-
	206	+
204	207	/**
205	208	* Parse loggedin user properties
206	209	*
207	210	* @param string $value
		@@ -211,13 +214,13 @@
211	214	private static function parseUserProperties($value, $form = null)
212	215	{
213	216	if ($user = wp_get_current_user()) {
214	217	$prop = substr(str_replace(['{', '}'], '', $value), 5);
215		-
	218	+
216	219	if (false !== strpos($prop, 'meta.')) {
217	220	$metaKey = substr($prop, strlen('meta.'));
218	221	$metaKey = sanitize_text_field($metaKey);
219		- if (empty($metaKey)) {
	222	+ if (empty($metaKey) || ShortCodeParser::isDeniedUserProperty($metaKey)) {
220	223	return '';
221	224	}
222	225	$userId = $user->ID;
223	226	$data = get_user_meta($userId, $metaKey, true);
		@@ -226,15 +229,19 @@
226	229	return esc_html($data);
227	230	}
228	231	return esc_html(implode(',', $data));
229	232	}
230		-
	233	+
	234	+ if (ShortCodeParser::isDeniedUserProperty($prop)) {
	235	+ return '';
	236	+ }
	237	+
231	238	return esc_html($user->{$prop});
232	239	}
233		-
	240	+
234	241	return '';
235	242	}
236		-
	243	+
237	244	/**
238	245	* Parse embedded post properties
239	246	*
240	247	* @param string $value
		@@ -246,15 +253,15 @@
246	253	global $post;
247	254	if (!$post) {
248	255	return '';
249	256	}
250		-
	257	+
251	258	$key = $prop = substr(str_replace(['{', '}'], '', $value), 11);
252		-
	259	+
253	260	if (false !== strpos($key, 'author.')) {
254	261	$authorProperty = substr($key, strlen('author.'));
255	262	$authorId = $post->post_author;
256		- if ($authorId) {
	263	+ if ($authorId && !ShortCodeParser::isDeniedUserProperty($authorProperty)) {
257	264	$data = get_the_author_meta($authorProperty, $authorId);
258	265	if (!is_array($data)) {
259	266	return esc_html($data);
260	267	}
		@@ -278,19 +285,19 @@
278	285	}
279	286	return '';
280	287	}
281	288	}
282		-
	289	+
283	290	if ('permalink' == $prop) {
284	291	return site_url(esc_attr(urldecode(wpFluentForm('request')->server('REQUEST_URI'))));
285	292	}
286		-
287		- if (property_exists($post, $prop)) {
	293	+
	294	+ if ('post_password' !== $prop && property_exists($post, $prop)) {
288	295	return esc_html($post->{$prop});
289	296	}
290	297	return '';
291	298	}
292		-
	299	+
293	300	/**
294	301	* Parse WP Properties
295	302	*
296	303	* @param string $value
		@@ -310,12 +317,12 @@
310	317	}
311	318	if ('{http_referer}' == $value) {
312	319	return esc_url(wp_get_referer());
313	320	}
314		-
	321	+
315	322	return '';
316	323	}
317		-
	324	+
318	325	/**
319	326	* Parse browser/user-agent properties
320	327	*
321	328	* @param string $value
		@@ -329,12 +336,12 @@
329	336	return esc_html($browser->getBrowser());
330	337	} elseif ('{browser.platform}' == $value) {
331	338	return esc_html($browser->getPlatform());
332	339	}
333		-
	340	+
334	341	return '';
335	342	}
336		-
	343	+
337	344	/**
338	345	* Parse ip shortcode
339	346	*
340	347	* @param string $value
		@@ -346,9 +353,9 @@
346	353	$rawIp = wpFluentForm('request')->getIp();
347	354	$ip = sanitize_text_field($rawIp);
348	355	return $ip ? esc_html($ip) : $value;
349	356	}
350		-
	357	+
351	358	/**
352	359	* Parse date shortcode
353	360	*
354	361	* @param string $value
		@@ -360,9 +367,9 @@
360	367	$format = substr(str_replace(['}', '{'], '', $value), 5);
361	368	$date = date($format, strtotime(current_time('mysql')));
362	369	return $date ? esc_html($date) : '';
363	370	}
364		-
	371	+
365	372	/**
366	373	* Parse request query param.
367	374	*
368	375	* @param string $value
		@@ -374,20 +381,20 @@
374	381	{
375	382	$exploded = explode('.', $value);
376	383	$param = array_pop($exploded);
377	384	$value = wpFluentForm('request')->get($param);
378		-
	385	+
379	386	if (!$value) {
380	387	return '';
381	388	}
382		-
	389	+
383	390	if (is_array($value)) {
384	391	return sanitize_textarea_field(implode(', ', $value));
385	392	}
386		-
	393	+
387	394	return sanitize_textarea_field($value);
388	395	}
389		-
	396	+
390	397	/**
391	398	* Generate random a string with prefix
392	399	*
393	400	* @param $value
		@@ -398,8 +405,8 @@
398	405	{
399	406	$exploded = explode('.', $value);
400	407	$prefix = array_pop($exploded);
401	408	$value = $prefix . uniqid();
402		-
	409	+
403	410	return esc_html(apply_filters('fluentform/shortcode_parser_callback_random_string', $value, $prefix, new static()));
404	411	}
405	412	}