← All changes | classes/helpers/FrmFieldsHelper.php +25 -116 6.3.1 → 5.0.08 View file →

		@@ -123,9 +123,9 @@
123	123	* @param object $field
124	124	* @param array $values
125	125	*/
126	126	private static function fill_default_field_opts( $field, array &$values ) {
127		- $check_post = FrmAppHelper::is_admin_page() && $_POST && isset( $_POST['field_options'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	127	+ $check_post = FrmAppHelper::is_admin_page() && $_POST && isset( $_POST['field_options'] );
128	128
129	129	$defaults = self::get_default_field_options_from_field( $field, $values );
130	130	if ( ! $check_post ) {
131	131	$defaults['required_indicator'] = '';
		@@ -158,9 +158,9 @@
158	158	if ( '' == $field_array['blank'] && '1' === $field_array['required'] ) {
159	159	$field_array['blank'] = $frm_settings->blank_msg;
160	160	}
161	161
162		- if ( '' === $field_array['invalid'] ) {
	162	+ if ( '' == $field_array['invalid'] ) {
163	163	if ( 'captcha' === $field->type ) {
164	164	$field_array['invalid'] = $frm_settings->re_msg;
165	165	} else {
166	166	/* translators: %s: Field name */
		@@ -179,20 +179,22 @@
179	179	* @param string $setting
180	180	* @param mixed $value
181	181	*/
182	182	private static function get_posted_field_setting( $setting, &$value ) {
183		- if ( ! isset( $_POST['field_options'][ $setting ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	183	+ if ( ! isset( $_POST['field_options'][ $setting ] ) ) {
184	184	return;
185	185	}
186	186
187	187	if ( strpos( $setting, 'html' ) !== false ) {
188	188	// Strip slashes from HTML but not regex or script tags.
189		- $value = wp_unslash( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
	189	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	190	+ $value = wp_unslash( $_POST['field_options'][ $setting ] );
190	191	} elseif ( strpos( $setting, 'format_' ) === 0 ) {
191	192	// TODO: Remove stripslashes on output, and use on input only.
192		- $value = sanitize_text_field( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
	193	+ $value = sanitize_text_field( $_POST['field_options'][ $setting ] ); // WPCS: sanitization ok.
193	194	} else {
194		- $value = wp_unslash( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
	195	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	196	+ $value = wp_unslash( $_POST['field_options'][ $setting ] );
195	197	FrmAppHelper::sanitize_value( 'wp_kses_post', $value );
196	198	}
197	199	}
198	200
		@@ -745,9 +747,8 @@
745	747	$atts['tag'] = $tag;
746	748	$replace_with = self::get_value_for_shortcode( $atts );
747	749
748	750	if ( $replace_with !== null ) {
749		- $replace_with = self::trigger_shortcode_atts( $replace_with, $atts );
750	751	self::sanitize_embedded_shortcodes( compact( 'entry' ), $replace_with );
751	752	$content = str_replace( $shortcodes[0][ $short_key ], $replace_with, $content );
752	753	}
753	754
		@@ -757,56 +758,8 @@
757	758	return $content;
758	759	}
759	760
760	761	/**
761		- * @param string $replace_with
762		- * @param array $atts
763		- * @return string
764		- */
765		- private static function trigger_shortcode_atts( $replace_with, $atts ) {
766		- $supported_atts = array( 'remove_accents', 'sanitize', 'sanitize_url' );
767		- $included_atts = array_intersect( $supported_atts, array_keys( $atts ) );
768		- foreach ( $included_atts as $included_att ) {
769		- if ( '0' === $atts[ $included_att ] ) {
770		- // Skip any option that uses 0 so sanitize_url=0 does not encode.
771		- continue;
772		- }
773		- $function = 'atts_' . $included_att;
774		- $replace_with = self::$function( $replace_with, $atts );
775		- }
776		- return $replace_with;
777		- }
778		-
779		- /**
780		- * Converts all accent characters to ASCII characters.
781		- *
782		- * @since x.x
783		- *
784		- * @param string $replace_with The text to remove accents from.
785		- *
786		- * @return string
787		- */
788		- public static function atts_remove_accents( $replace_with ) {
789		- return remove_accents( $replace_with );
790		- }
791		-
792		- /**
793		- * @param string $replace_with
794		- * @return string
795		- */
796		- private static function atts_sanitize( $replace_with ) {
797		- return sanitize_title_with_dashes( $replace_with );
798		- }
799		-
800		- /**
801		- * @param string $replace_with
802		- * @return string
803		- */
804		- private static function atts_sanitize_url( $replace_with ) {
805		- return urlencode( $replace_with );
806		- }
807		-
808		- /**
809	762	* Prevent shortcodes in fields from being processed
810	763	*
811	764	* @since 3.01.02
812	765	*
		@@ -888,11 +841,11 @@
888	841	if ( empty( $field ) ) {
889	842	return null;
890	843	}
891	844
892		- if ( isset( $atts['show'] ) && $atts['show'] === 'field_label' ) {
	845	+ if ( isset( $atts['show'] ) && $atts['show'] == 'field_label' ) {
893	846	$replace_with = $field->name;
894		- } elseif ( isset( $atts['show'] ) && $atts['show'] === 'description' ) {
	847	+ } elseif ( isset( $atts['show'] ) && $atts['show'] == 'description' ) {
895	848	$replace_with = $field->description;
896	849	} else {
897	850	$replace_with = FrmEntryMeta::get_meta_value( $atts['entry'], $field->id );
898	851	$string_value = $replace_with;
		@@ -1132,26 +1085,24 @@
1132	1085	}
1133	1086
1134	1087	// Check posted vals before checking saved values
1135	1088	// For fields inside repeating sections - note, don't check if $pointer is true because it will often be zero
1136		- if ( $parent && isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1089	+ if ( $parent && isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ) {
1137	1090	if ( FrmField::is_field_with_multiple_values( $field ) ) {
1138		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
1139	1091	$other_val = isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ][ $opt_key ] ) ? sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ][ $opt_key ] ) ) : '';
1140	1092	} else {
1141		- $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1093	+ $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) );
1142	1094	}
1143	1095
1144	1096	return $other_val;
1145	1097
1146		- } elseif ( isset( $field['id'] ) && isset( $_POST['item_meta']['other'][ $field['id'] ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1098	+ } elseif ( isset( $field['id'] ) && isset( $_POST['item_meta']['other'][ $field['id'] ] ) ) {
1147	1099	// For normal fields
1148	1100
1149	1101	if ( FrmField::is_field_with_multiple_values( $field ) ) {
1150		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
1151	1102	$other_val = isset( $_POST['item_meta']['other'][ $field['id'] ][ $opt_key ] ) ? sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ][ $opt_key ] ) ) : '';
1152	1103	} else {
1153		- $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1104	+ $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ] ) );
1154	1105	}
1155	1106
1156	1107	return $other_val;
1157	1108	}
		@@ -1156,9 +1107,9 @@
1156	1107	return $other_val;
1157	1108	}
1158	1109
1159	1110	// For checkboxes
1160		- if ( $field['type'] === 'checkbox' && is_array( $field['value'] ) ) {
	1111	+ if ( $field['type'] == 'checkbox' && is_array( $field['value'] ) ) {
1161	1112	// Check if there is an "other" val in saved value and make sure the
1162	1113	// "other" val is not equal to the Other checkbox option
1163	1114	if ( isset( $field['value'][ $opt_key ] ) && $field['options'][ $opt_key ] != $field['value'][ $opt_key ] ) {
1164	1115	$other_val = $field['value'][ $opt_key ];
		@@ -1352,24 +1303,16 @@
1352	1303	$replace[] = '[if ' . $old . ' ';
1353	1304	$replace_with[] = '[if ' . $new . ' ';
1354	1305	$replace[] = '[/if ' . $old . ']';
1355	1306	$replace_with[] = '[/if ' . $new . ']';
1356		- $replace[] = '[\/if ' . $old . ']';
1357		- $replace_with[] = '[\/if ' . $new . ']';
1358	1307	$replace[] = '[foreach ' . $old . ']';
1359	1308	$replace_with[] = '[foreach ' . $new . ']';
1360	1309	$replace[] = '[/foreach ' . $old . ']';
1361	1310	$replace_with[] = '[/foreach ' . $new . ']';
1362		- $replace[] = '[\/foreach ' . $old . ']';
1363		- $replace_with[] = '[\/foreach ' . $new . ']';
1364	1311	$replace[] = '[' . $old . ']';
1365	1312	$replace_with[] = '[' . $new . ']';
1366	1313	$replace[] = '[' . $old . ' ';
1367	1314	$replace_with[] = '[' . $new . ' ';
1368		- $replace[] = 'field_id="' . $old . '"';
1369		- $replace_with[] = 'field_id="' . $new . '"';
1370		- $replace[] = 'field_id=\"' . $old . '\"';
1371		- $replace_with[] = 'field_id=\"' . $new . '\"';
1372	1315	unset( $old, $new );
1373	1316	}
1374	1317	if ( is_array( $val ) ) {
1375	1318	foreach ( $val as $k => $v ) {
		@@ -1716,10 +1659,10 @@
1716	1659	* Gets bulk prefilled options.
1717	1660	*
1718	1661	* @since 5.0.04 Add `$include_class` param.
1719	1662	*
1720		- * @param array $prepop Bulk options.
1721		- * @param array|false $include_class Include the class in the bulk options.
	1663	+ * @param array $prepop Bulk options.
	1664	+ * @param array $include_class Include the class in the bulk options.
1722	1665	*/
1723	1666	public static function get_bulk_prefilled_opts( array &$prepop, $include_class = false ) {
1724	1667	// Countries.
1725	1668	$countries = self::get_countries();
		@@ -1860,11 +1803,9 @@
1860	1803	}
1861	1804
1862	1805	/**
1863	1806	* @since 4.04
1864		- *
1865	1807	* @param array $args
1866		- * @return void
1867	1808	*/
1868	1809	public static function show_add_field_buttons( $args ) {
1869	1810	$field_key = $args['field_key'];
1870	1811	$field_type = $args['field_type'];
		@@ -1906,29 +1847,15 @@
1906	1847	$upgrade_message = FrmAppHelper::kses( $field_type['message'], array( 'a', 'img' ) );
1907	1848	}
1908	1849	}
1909	1850
1910		- $li_params = array(
1911		- 'class' => 'frmbutton frm6 ' . $args['no_allow_class'] . $single_no_allow . ' frm_t' . str_replace( '|', '-', $field_key ),
1912		- 'id' => $field_key,
1913		- 'data-upgrade' => $upgrade_label,
1914		- 'data-link' => $link,
1915		- 'data-medium' => 'builder',
1916		- 'data-oneclick' => $install_data,
1917		- 'data-content' => $field_key,
1918		- 'data-requires' => $requires,
1919		- );
1920		-
1921		- if ( $upgrade_message ) {
1922		- $li_params['data-message'] = $upgrade_message;
1923		- }
1924	1851	?>
1925		- <li <?php FrmAppHelper::array_to_html_params( $li_params, true ); ?>>
	1852	+ <li class="frmbutton frm6 <?php echo esc_attr( $args['no_allow_class'] . $single_no_allow . ' frm_t' . str_replace( '|', '-', $field_key ) ); ?>" id="<?php echo esc_attr( $field_key ); ?>" data-upgrade="<?php echo esc_attr( $upgrade_label ); ?>" data-message="<?php echo esc_attr( $upgrade_message ); ?>" data-link="<?php echo esc_attr( $link ); ?>" data-medium="builder" data-oneclick="<?php echo esc_attr( $install_data ); ?>" data-content="<?php echo esc_attr( $field_key ); ?>" data-requires="<?php echo esc_attr( $requires ); ?>">
1926	1853	<?php
1927	1854	if ( $run_filter ) {
1928	1855	$field_label = apply_filters( 'frmpro_field_links', $field_label, $args['id'], $field_key );
1929	1856	}
1930		- echo FrmAppHelper::kses( $field_label, array( 'a', 'i', 'span', 'use', 'svg' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	1857	+ echo FrmAppHelper::kses( $field_label, array( 'a', 'i', 'span', 'use', 'svg' ) ); // WPCS: XSS ok.
1931	1858	?>
1932	1859	</li>
1933	1860	<?php
1934	1861	}
		@@ -2067,23 +1994,8 @@
2067	1994	return $custom_attrs;
2068	1995	}
2069	1996
2070	1997	/**
2071		- * Maybe adjust a field value based on type.
2072		- * Some types require unserializing an array (@see self::field_type_requires_unserialize).
2073		- *
2074		- * @since 6.2
2075		- *
2076		- * @param mixed $value
2077		- * @param string $field_type
2078		- * @return void
2079		- */
2080		- public static function prepare_field_value( &$value, $field_type ) {
2081		- $field_object = FrmFieldFactory::get_field_type( $field_type );
2082		- $value = $field_object->maybe_decode_value( $value );
2083		- }
2084		-
2085		- /**
2086	1998	* @deprecated 4.0
2087	1999	*/
2088	2000	public static function show_icon_link_js( $atts ) {
2089	2001	_deprecated_function( __METHOD__, '4.0' );
		@@ -2142,13 +2054,13 @@
2142	2054	/**
2143	2055	* @deprecated 3.0
2144	2056	* @codeCoverageIgnore
2145	2057	*
2146		- * @param string $html
2147		- * @param array $field
2148		- * @param array $errors
2149		- * @param object|false $form
2150		- * @param array $args
	2058	+ * @param string $html
	2059	+ * @param array $field
	2060	+ * @param array $errors
	2061	+ * @param object $form
	2062	+ * @param array $args
2151	2063	*
2152	2064	* @return string
2153	2065	*/
2154	2066	public static function replace_shortcodes( $html, $field, $errors = array(), $form = false, $args = array() ) {
		@@ -2163,13 +2075,10 @@
2163	2075	return FrmDeprecated::get_default_field_opts( $type, $field, $limit );
2164	2076	}
2165	2077
2166	2078	/**
2167		- * @deprecated 2.02.07 This is still referenced in the Highrise add on as of v1.06.
	2079	+ * @deprecated 2.02.07
2168	2080	* @codeCoverageIgnore
2169		- *
2170		- * @param array $args
2171		- * @return string
2172	2081	*/
2173	2082	public static function dropdown_categories( $args ) {
2174	2083	return FrmDeprecated::dropdown_categories( $args );
2175	2084	}