← All changes | app/Services/FormBuilder/EditorShortcodeParser.php +65 -62 6.2.7 → 6.2.14 View file →

		@@ -8,14 +8,16 @@
8	8	class EditorShortcodeParser
9	9	{
10	10	/**
11	11	* Available dynamic short codes
	12	+ *
12	13	* @var null
13	14	*/
14	15	private static $dynamicShortcodes = null;
15		-
	16	+
16	17	/**
17	18	* mappings of methods to parse the shortcode
	19	+ *
18	20	* @var array
19	21	*/
20	22	private static $handlers = [
21	23	'ip' => 'parseIp',
		@@ -20,18 +22,18 @@
20	22	private static $handlers = [
21	23	'ip' => 'parseIp',
22	24	'date.m/d/Y' => 'parseDate',
23	25	'date.d/m/Y' => 'parseDate',
24		-
	26	+
25	27	'embed_post.ID' => 'parsePostProperties',
26	28	'embed_post.post_title' => 'parsePostProperties',
27	29	'embed_post.permalink' => 'parsePostProperties',
28	30	'http_referer' => 'parseWPProperties',
29		-
	31	+
30	32	'wp.admin_email' => 'parseWPProperties',
31	33	'wp.site_url' => 'parseWPProperties',
32	34	'wp.site_title' => 'parseWPProperties',
33		-
	35	+
34	36	'user.ID' => 'parseUserProperties',
35	37	'user.display_name' => 'parseUserProperties',
36	38	'user.first_name' => 'parseUserProperties',
37	39	'user.last_name' => 'parseUserProperties',
		@@ -36,16 +38,16 @@
36	38	'user.first_name' => 'parseUserProperties',
37	39	'user.last_name' => 'parseUserProperties',
38	40	'user.user_email' => 'parseUserProperties',
39	41	'user.user_login' => 'parseUserProperties',
40		-
	42	+
41	43	'browser.name' => 'parseBrowserProperties',
42	44	'browser.platform' => 'parseBrowserProperties',
43		-
	45	+
44	46	'get.param_name' => 'parseRequestParam',
45	47	'random_string.param_name' => 'parseRandomString',
46	48	];
47		-
	49	+
48	50	/**
49	51	* Filter dynamic shortcodes in input value
50	52	*
51	53	* @param string $value
		@@ -57,15 +59,15 @@
57	59	if (0 === strpos($value, '{ ')) {
58	60	// it's the css
59	61	return $value;
60	62	}
61		-
	63	+
62	64	if (is_null(static::$dynamicShortcodes)) {
63	65	static::$dynamicShortcodes = fluentFormEditorShortCodes();
64	66	}
65		-
	67	+
66	68	$filteredValue = '';
67		-
	69	+
68	70	foreach (static::parseValue($value) as $handler) {
69	71	if (isset(static::$handlers[$handler])) {
70	72	return call_user_func_array(
71	73	[__CLASS__, static::$handlers[$handler]],
		@@ -71,9 +73,9 @@
71	73	[__CLASS__, static::$handlers[$handler]],
72	74	['{' . $handler . '}', $form]
73	75	);
74	76	}
75		-
	77	+
76	78	if (false !== strpos($handler, 'get.')) {
77	79	return static::parseRequestParam($handler);
78	80	}
79	81	if (false !== strpos($handler, 'random_string.')) {
		@@ -78,9 +80,9 @@
78	80	}
79	81	if (false !== strpos($handler, 'random_string.')) {
80	82	return static::parseRandomString($handler);
81	83	}
82		-
	84	+
83	85	if (false !== strpos($handler, 'user.')) {
84	86	$parsedValue = self::parseUserProperties($handler);
85	87	if (is_array($parsedValue) || is_object($parsedValue)) {
86	88	return '';
		@@ -86,13 +88,13 @@
86	88	return '';
87	89	}
88	90	return esc_html($parsedValue);
89	91	}
90		-
	92	+
91	93	if (false !== strpos($handler, 'date.')) {
92	94	return esc_html(self::parseDate($handler));
93	95	}
94		-
	96	+
95	97	if (false !== strpos($handler, 'embed_post.meta.')) {
96	98	$key = substr(str_replace(['{', '}'], '', $value), 16);
97	99	global $post;
98	100	if ($post) {
		@@ -102,19 +104,20 @@
102	104	}
103	105	}
104	106	return '';
105	107	}
106		-
	108	+
107	109	if (false !== strpos($handler, 'embed_post.')) {
108	110	return self::parsePostProperties($handler, $form);
109	111	}
110		-
	112	+
111	113	if (false !== strpos($handler, 'cookie.')) {
112	114	$scookieProperty = substr($handler, strlen('cookie.'));
113		-
114		- return array_key_exists($scookieProperty, $_COOKIE) ? wp_unslash($_COOKIE[$scookieProperty]) : '';
	115	+ $cookieValue = array_key_exists($scookieProperty, $_COOKIE) ? sanitize_text_field(wp_unslash($_COOKIE[$scookieProperty])) : '';
	116	+
	117	+ return esc_attr($cookieValue);
115	118	}
116		-
	119	+
117	120	if (false !== strpos($handler, 'dynamic.')) {
118	121	$dynamicKey = substr($handler, strlen('dynamic.'));
119	122	// maybe has fallback value
120	123	$dynamicKey = explode('|', $dynamicKey);
		@@ -125,23 +128,23 @@
125	128	}
126	129	if (isset($dynamicKey[0])) {
127	130	$ref = $dynamicKey[0];
128	131	}
129		-
	132	+
130	133	if ('payment_summary' == $ref) {
131	134	return fluentform_sanitize_html('<div class="ff_dynamic_value ff_dynamic_payment_summary" data-ref="payment_summary"><div class="ff_payment_summary"></div><div class="ff_payment_summary_fallback">' . $fallBack . '</div></div>');
132	135	}
133		-
	136	+
134	137	return fluentform_sanitize_html('<span class="ff_dynamic_value" data-ref="' . $ref . '" data-fallback="' . $fallBack . '">' . $fallBack . '</span>');
135	138	}
136		-
	139	+
137	140	// if it's multi line then just return
138	141	if (false !== strpos($handler, PHP_EOL)) { // most probably it's a css
139	142	return '{' . $handler . '}';
140	143	}
141		-
	144	+
142	145	$handlerArray = explode('.', $handler);
143		-
	146	+
144	147	if (count($handlerArray) > 1) {
145	148	// it's a grouped handler
146	149	$group = array_shift($handlerArray);
147	150	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_group_' . $group, '{' . $handler . '}', $form, $handlerArray);
		@@ -146,16 +149,16 @@
146	149	$group = array_shift($handlerArray);
147	150	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_group_' . $group, '{' . $handler . '}', $form, $handlerArray);
148	151	return apply_filters('fluentform/editor_shortcode_callback_group_' . $group, $parsedValue, $form, $handlerArray);
149	152	}
150		-
	153	+
151	154	$parsedValue = apply_filters('fluentform_editor_shortcode_callback_' . $handler, '{' . $handler . '}', $form);
152	155	return apply_filters('fluentform/editor_shortcode_callback_' . $handler, $parsedValue, $form);
153	156	}
154		-
	157	+
155	158	return $filteredValue;
156	159	}
157		-
	160	+
158	161	/**
159	162	* Parse request query param.
160	163	*
161	164	* @param string $value
		@@ -167,20 +170,16 @@
167	170	{
168	171	$exploded = explode('.', $value);
169	172	$param = array_pop($exploded);
170	173	$value = wpFluentForm('request')->get($param);
171		-
172		- if (!$value) {
	174	+
	175	+ if (null === $value || '' === $value) {
173	176	return '';
174	177	}
175		-
176		- if (is_array($value)) {
177		- return esc_attr(implode(', ', $value));
178		- }
179		-
180		- return esc_attr($value);
	178	+
	179	+ return esc_attr(Helper::flattenRequestValue($value));
181	180	}
182		-
	181	+
183	182	/**
184	183	* Parse the curly braced shortcode into array
185	184	*
186	185	* @param string $value
		@@ -196,16 +195,16 @@
196	195	-1,
197	196	PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY
198	197	);
199	198	}
200		-
	199	+
201	200	return $value;
202	201	}
203		-
	202	+
204	203	/**
205	204	* Declare all parsers and must be [private] static methods
206	205	*/
207		-
	206	+
208	207	/**
209	208	* Parse loggedin user properties
210	209	*
211	210	* @param string $value
		@@ -215,13 +214,13 @@
215	214	private static function parseUserProperties($value, $form = null)
216	215	{
217	216	if ($user = wp_get_current_user()) {
218	217	$prop = substr(str_replace(['{', '}'], '', $value), 5);
219		-
	218	+
220	219	if (false !== strpos($prop, 'meta.')) {
221	220	$metaKey = substr($prop, strlen('meta.'));
222	221	$metaKey = sanitize_text_field($metaKey);
223		- if (empty($metaKey)) {
	222	+ if (empty($metaKey) || ShortCodeParser::isDeniedUserProperty($metaKey)) {
224	223	return '';
225	224	}
226	225	$userId = $user->ID;
227	226	$data = get_user_meta($userId, $metaKey, true);
		@@ -230,15 +229,19 @@
230	229	return esc_html($data);
231	230	}
232	231	return esc_html(implode(',', $data));
233	232	}
234		-
	233	+
	234	+ if (ShortCodeParser::isDeniedUserProperty($prop)) {
	235	+ return '';
	236	+ }
	237	+
235	238	return esc_html($user->{$prop});
236	239	}
237		-
	240	+
238	241	return '';
239	242	}
240		-
	243	+
241	244	/**
242	245	* Parse embedded post properties
243	246	*
244	247	* @param string $value
		@@ -250,15 +253,15 @@
250	253	global $post;
251	254	if (!$post) {
252	255	return '';
253	256	}
254		-
	257	+
255	258	$key = $prop = substr(str_replace(['{', '}'], '', $value), 11);
256		-
	259	+
257	260	if (false !== strpos($key, 'author.')) {
258	261	$authorProperty = substr($key, strlen('author.'));
259	262	$authorId = $post->post_author;
260		- if ($authorId) {
	263	+ if ($authorId && !ShortCodeParser::isDeniedUserProperty($authorProperty)) {
261	264	$data = get_the_author_meta($authorProperty, $authorId);
262	265	if (!is_array($data)) {
263	266	return esc_html($data);
264	267	}
		@@ -282,19 +285,19 @@
282	285	}
283	286	return '';
284	287	}
285	288	}
286		-
	289	+
287	290	if ('permalink' == $prop) {
288	291	return site_url(esc_attr(urldecode(wpFluentForm('request')->server('REQUEST_URI'))));
289	292	}
290		-
291		- if (property_exists($post, $prop)) {
	293	+
	294	+ if ('post_password' !== $prop && property_exists($post, $prop)) {
292	295	return esc_html($post->{$prop});
293	296	}
294	297	return '';
295	298	}
296		-
	299	+
297	300	/**
298	301	* Parse WP Properties
299	302	*
300	303	* @param string $value
		@@ -314,12 +317,12 @@
314	317	}
315	318	if ('{http_referer}' == $value) {
316	319	return esc_url(wp_get_referer());
317	320	}
318		-
	321	+
319	322	return '';
320	323	}
321		-
	324	+
322	325	/**
323	326	* Parse browser/user-agent properties
324	327	*
325	328	* @param string $value
		@@ -333,12 +336,12 @@
333	336	return esc_html($browser->getBrowser());
334	337	} elseif ('{browser.platform}' == $value) {
335	338	return esc_html($browser->getPlatform());
336	339	}
337		-
	340	+
338	341	return '';
339	342	}
340		-
	343	+
341	344	/**
342	345	* Parse ip shortcode
343	346	*
344	347	* @param string $value
		@@ -350,9 +353,9 @@
350	353	$rawIp = wpFluentForm('request')->getIp();
351	354	$ip = sanitize_text_field($rawIp);
352	355	return $ip ? esc_html($ip) : $value;
353	356	}
354		-
	357	+
355	358	/**
356	359	* Parse date shortcode
357	360	*
358	361	* @param string $value
		@@ -364,9 +367,9 @@
364	367	$format = substr(str_replace(['}', '{'], '', $value), 5);
365	368	$date = date($format, strtotime(current_time('mysql')));
366	369	return $date ? esc_html($date) : '';
367	370	}
368		-
	371	+
369	372	/**
370	373	* Parse request query param.
371	374	*
372	375	* @param string $value
		@@ -378,20 +381,20 @@
378	381	{
379	382	$exploded = explode('.', $value);
380	383	$param = array_pop($exploded);
381	384	$value = wpFluentForm('request')->get($param);
382		-
	385	+
383	386	if (!$value) {
384	387	return '';
385	388	}
386		-
	389	+
387	390	if (is_array($value)) {
388	391	return sanitize_textarea_field(implode(', ', $value));
389	392	}
390		-
	393	+
391	394	return sanitize_textarea_field($value);
392	395	}
393		-
	396	+
394	397	/**
395	398	* Generate random a string with prefix
396	399	*
397	400	* @param $value
		@@ -402,8 +405,8 @@
402	405	{
403	406	$exploded = explode('.', $value);
404	407	$prefix = array_pop($exploded);
405	408	$value = $prefix . uniqid();
406		-
	409	+
407	410	return esc_html(apply_filters('fluentform/shortcode_parser_callback_random_string', $value, $prefix, new static()));
408	411	}
409	412	}