← All changes | app/Services/Logger/Logger.php +80 -22 6.2.5 → 6.2.14 View file →

		@@ -42,18 +42,18 @@
42	42	return $q->whereIn($componentColumn, array_map('sanitize_text_field', $components));
43	43	})
44	44	->when($startDate && $endDate, function ($q) use ($startDate, $endDate, $dateColumn) {
45	45	// Concatenate time if not time included on start/end date string
46		- if ($startDate != date("Y-m-d H:i:s", strtotime($startDate))) {
	46	+ if (date('Y-m-d H:i:s', strtotime($startDate)) != $startDate) { // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date -- comparing a local-time string to its own roundtrip; UTC would be wrong here
47	47	$startDate .= ' 00:00:01';
48	48	}
49		- if ($endDate != date("Y-m-d H:i:s", strtotime($endDate))) {
	49	+ if (date('Y-m-d H:i:s', strtotime($endDate)) != $endDate) { // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date -- comparing a local-time string to its own roundtrip; UTC would be wrong here
50	50	$endDate .= ' 23:59:59';
51	51	}
52	52	return $q->where($dateColumn, '>=', $startDate)
53	53	->where($dateColumn, '<=', $endDate);
54	54	});
55		-
	55	+
56	56	$logs = $logsQuery->paginate();
57	57
58	58	$logItems = $logs->items();
59	59
		@@ -90,9 +90,9 @@
90	90
91	91	$logItems = apply_filters_deprecated(
92	92	'fluentform_all_logs',
93	93	[
94		- $logItems
	94	+ $logItems,
95	95	],
96	96	FLUENTFORM_FRAMEWORK_UPGRADE,
97	97	'fluentform/get_logs',
98	98	'Use fluentform/get_logs instead of fluentform_all_logs'
		@@ -99,9 +99,19 @@
99	99	);
100	100
101	101	$logs->setCollection(Collection::make($logItems));
102	102
103		- return apply_filters('fluentform/get_logs', $logs);
	103	+ $logs = apply_filters('fluentform/get_logs', $logs);
	104	+
	105	+ foreach ($logs->items() as $log) {
	106	+ if ('api' === $type && isset($log->note)) {
	107	+ $log->note = static::sanitizeLogHtml($log->note);
	108	+ } elseif (isset($log->description)) {
	109	+ $log->description = static::sanitizeLogHtml($log->description);
	110	+ }
	111	+ }
	112	+
	113	+ return $logs;
104	114	}
105	115
106	116	protected function normalizeFormScope($formIds)
107	117	{
		@@ -167,19 +177,26 @@
167	177
168	178	public function getFilters($attributes = [])
169	179	{
170	180	$type = Arr::get($attributes, 'type', 'log');
	181	+ $allowedForms = FormManagerService::getUserAllowedFormsScope();
171	182
172	183	if ('log' === $type) {
173		- $statusRows = Log::select('status')->distinct()->get();
174		- $componentRows = Log::select('component')->distinct()->get();
175		- $formIdRows = Log::select('parent_source_id as form_id')->distinct()->get();
	184	+ $statusQuery = Log::select('status')->distinct();
	185	+ $componentQuery = Log::select('component')->distinct();
	186	+ $formIdQuery = Log::select('parent_source_id as form_id')->distinct();
	187	+ $scopeColumn = 'parent_source_id';
176	188	} else {
177		- $statusRows = Scheduler::select('status')->distinct()->get();
178		- $componentRows = Scheduler::select('action as component')->distinct()->get();
179		- $formIdRows = Scheduler::select('form_id')->distinct()->get();
	189	+ $statusQuery = Scheduler::select('status')->distinct();
	190	+ $componentQuery = Scheduler::select('action as component')->distinct();
	191	+ $formIdQuery = Scheduler::select('form_id')->distinct();
	192	+ $scopeColumn = 'form_id';
180	193	}
181	194
	195	+ $statusRows = $this->scopeFilterQuery($statusQuery, $scopeColumn, $allowedForms)->get();
	196	+ $componentRows = $this->scopeFilterQuery($componentQuery, $scopeColumn, $allowedForms)->get();
	197	+ $formIdRows = $this->scopeFilterQuery($formIdQuery, $scopeColumn, $allowedForms)->get();
	198	+
182	199	$statuses = $statusRows->pluck('status')->filter()->map(function ($item) {
183	200	return [
184	201	'label' => ucwords($item),
185	202	'value' => $item,
		@@ -194,9 +211,9 @@
194	211	})->values();
195	212
196	213	$formIds = $formIdRows->pluck('form_id')->filter()->toArray();
197	214	if (false !== ($allowForms = FormManagerService::getUserAllowedFormsScope())) {
198		- $formIds = array_filter($formIds, function($value) use ($allowForms) {
	215	+ $formIds = array_filter($formIds, function ($value) use ($allowForms) {
199	216	return in_array($value, $allowForms);
200	217	});
201	218	}
202	219
		@@ -208,8 +225,18 @@
208	225	'forms' => $forms,
209	226	]);
210	227	}
211	228
	229	+ protected function scopeFilterQuery($query, $formColumn, $allowedForms)
	230	+ {
	231	+ if (false !== $allowedForms) {
	232	+ // phpcs:ignore Universal.Operators.DisallowShortTernary.Found -- `?: [0]` is the delegated-scope regression contract (detect_resource_authorization)
	233	+ $query->whereIn($formColumn, $allowedForms ?: [0]);
	234	+ }
	235	+
	236	+ return $query;
	237	+ }
	238	+
212	239	public function getSubmissionLogs($submissionId, $attributes = [])
213	240	{
214	241	$logType = Arr::get($attributes, 'log_type', 'logs');
215	242
		@@ -224,9 +251,9 @@
224	251	$logs = apply_filters_deprecated(
225	252	'fluentform_entry_logs',
226	253	[
227	254	$logs,
228		- $submissionId
	255	+ $submissionId,
229	256	],
230	257	FLUENTFORM_FRAMEWORK_UPGRADE,
231	258	'fluentform/submission_logs',
232	259	'Use fluentform/submission_logs instead of fluentform_entry_logs.'
		@@ -241,12 +268,12 @@
241	268	continue;
242	269	}
243	270	$entryLogs[] = [
244	271	'id' => $log->id,
245		- 'status' => $log->status,
246		- 'title' => $log->component . ' (' . $log->title . ')',
	272	+ 'status' => esc_attr($log->status),
	273	+ 'title' => esc_html($log->component . ' (' . $log->title . ')'),
247	274	'description' => $log->description,
248		- 'created_at' => (string)$log->created_at,
	275	+ 'created_at' => (string) $log->created_at,
249	276	];
250	277	}
251	278	} else {
252	279	$columns = [
		@@ -268,9 +295,9 @@
268	295	$logs = apply_filters_deprecated(
269	296	'fluentform_entry_api_logs',
270	297	[
271	298	$logs,
272		- $submissionId
	299	+ $submissionId,
273	300	],
274	301	FLUENTFORM_FRAMEWORK_UPGRADE,
275	302	'fluentform/submission_api_logs',
276	303	'Use fluentform/submission_api_logs instead of fluentform_entry_api_logs.'
		@@ -281,16 +308,16 @@
281	308
282	309	foreach ($logs as $log) {
283	310	$entryLog = [
284	311	'id' => $log->id,
285		- 'status' => $log->status,
	312	+ 'status' => esc_attr($log->status),
286	313	'title' => 'n/a',
287	314	'description' => $log->note,
288		- 'created_at' => (string)$log->created_at,
	315	+ 'created_at' => (string) $log->created_at,
289	316	'form_id' => $log->form_id,
290	317	'feed_id' => $log->feed_id,
291	318	'submission_id' => $log->origin_id,
292		- 'integration_enabled' => false
	319	+ 'integration_enabled' => false,
293	320	];
294	321
295	322	$notificationKeys = apply_filters('fluentform/global_notification_active_types', [], $log->form_id);
296	323
		@@ -308,9 +335,9 @@
308	335	}
309	336	}
310	337
311	338	if ($log->action) {
312		- $entryLog['title'] = Helper::getLogInitiator($log->action, $logType);
	339	+ $entryLog['title'] = esc_html(Helper::getLogInitiator($log->action, $logType));
313	340	}
314	341
315	342	$entryLogs[] = $entryLog;
316	343	}
		@@ -315,9 +342,40 @@
315	342	$entryLogs[] = $entryLog;
316	343	}
317	344	}
318	345
319		- return apply_filters('fluentform/submission_logs', $entryLogs, $submissionId);
	346	+ $entryLogs = apply_filters('fluentform/submission_logs', $entryLogs, $submissionId);
	347	+
	348	+ foreach ($entryLogs as &$entryLog) {
	349	+ if (isset($entryLog['description'])) {
	350	+ $entryLog['description'] = static::sanitizeLogHtml($entryLog['description']);
	351	+ }
	352	+ }
	353	+ unset($entryLog);
	354	+
	355	+ return $entryLogs;
	356	+ }
	357	+
	358	+ public static function sanitizeLogHtml($value)
	359	+ {
	360	+ if (!is_scalar($value)) {
	361	+ return '';
	362	+ }
	363	+
	364	+ return wp_kses((string) $value, [
	365	+ 'br' => [],
	366	+ 'b' => [],
	367	+ 'strong' => [],
	368	+ 'i' => [],
	369	+ 'em' => [],
	370	+ 'code' => [],
	371	+ 'p' => [],
	372	+ 'a' => [
	373	+ 'href' => [],
	374	+ 'title' => [],
	375	+ 'rel' => [],
	376	+ ],
	377	+ ]);
320	378	}
321	379
322	380	public function remove($attributes = [])
323	381	{