← All changes | classes/helpers/FrmFieldsHelper.php +31 -144 6.4.1 → 5.0.08 View file →

		@@ -123,9 +123,9 @@
123	123	* @param object $field
124	124	* @param array $values
125	125	*/
126	126	private static function fill_default_field_opts( $field, array &$values ) {
127		- $check_post = FrmAppHelper::is_admin_page() && $_POST && isset( $_POST['field_options'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	127	+ $check_post = FrmAppHelper::is_admin_page() && $_POST && isset( $_POST['field_options'] );
128	128
129	129	$defaults = self::get_default_field_options_from_field( $field, $values );
130	130	if ( ! $check_post ) {
131	131	$defaults['required_indicator'] = '';
		@@ -158,9 +158,9 @@
158	158	if ( '' == $field_array['blank'] && '1' === $field_array['required'] ) {
159	159	$field_array['blank'] = $frm_settings->blank_msg;
160	160	}
161	161
162		- if ( '' === $field_array['invalid'] ) {
	162	+ if ( '' == $field_array['invalid'] ) {
163	163	if ( 'captcha' === $field->type ) {
164	164	$field_array['invalid'] = $frm_settings->re_msg;
165	165	} else {
166	166	/* translators: %s: Field name */
		@@ -179,20 +179,22 @@
179	179	* @param string $setting
180	180	* @param mixed $value
181	181	*/
182	182	private static function get_posted_field_setting( $setting, &$value ) {
183		- if ( ! isset( $_POST['field_options'][ $setting ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	183	+ if ( ! isset( $_POST['field_options'][ $setting ] ) ) {
184	184	return;
185	185	}
186	186
187	187	if ( strpos( $setting, 'html' ) !== false ) {
188	188	// Strip slashes from HTML but not regex or script tags.
189		- $value = wp_unslash( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
	189	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	190	+ $value = wp_unslash( $_POST['field_options'][ $setting ] );
190	191	} elseif ( strpos( $setting, 'format_' ) === 0 ) {
191	192	// TODO: Remove stripslashes on output, and use on input only.
192		- $value = sanitize_text_field( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
	193	+ $value = sanitize_text_field( $_POST['field_options'][ $setting ] ); // WPCS: sanitization ok.
193	194	} else {
194		- $value = wp_unslash( $_POST['field_options'][ $setting ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
	195	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	196	+ $value = wp_unslash( $_POST['field_options'][ $setting ] );
195	197	FrmAppHelper::sanitize_value( 'wp_kses_post', $value );
196	198	}
197	199	}
198	200
		@@ -491,14 +493,9 @@
491	493	return FrmFieldsController::check_label( $opt );
492	494	}
493	495
494	496	/**
495		- * Shows the inline modal.
496		- *
497	497	* @since 4.0
498		- * @since 6.4.1 Added `inside_class` in the arguments.
499		- *
500		- * @param array $args The arguments.
501	498	*/
502	499	public static function inline_modal( $args ) {
503	500	$defaults = array(
504	501	'id' => '',
		@@ -506,9 +503,8 @@
506	503	'show' => 0,
507	504	'callback' => array(),
508	505	'args' => array(),
509	506	'title' => '',
510		- 'inside_class' => 'inside',
511	507	);
512	508	$args = array_merge( $defaults, $args );
513	509
514	510	include( FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/inline-modal.php' );
		@@ -751,9 +747,8 @@
751	747	$atts['tag'] = $tag;
752	748	$replace_with = self::get_value_for_shortcode( $atts );
753	749
754	750	if ( $replace_with !== null ) {
755		- $replace_with = self::trigger_shortcode_atts( $replace_with, $atts );
756	751	self::sanitize_embedded_shortcodes( compact( 'entry' ), $replace_with );
757	752	$content = str_replace( $shortcodes[0][ $short_key ], $replace_with, $content );
758	753	}
759	754
		@@ -763,56 +758,8 @@
763	758	return $content;
764	759	}
765	760
766	761	/**
767		- * @param string $replace_with
768		- * @param array $atts
769		- * @return string
770		- */
771		- private static function trigger_shortcode_atts( $replace_with, $atts ) {
772		- $supported_atts = array( 'remove_accents', 'sanitize', 'sanitize_url' );
773		- $included_atts = array_intersect( $supported_atts, array_keys( $atts ) );
774		- foreach ( $included_atts as $included_att ) {
775		- if ( '0' === $atts[ $included_att ] ) {
776		- // Skip any option that uses 0 so sanitize_url=0 does not encode.
777		- continue;
778		- }
779		- $function = 'atts_' . $included_att;
780		- $replace_with = self::$function( $replace_with, $atts );
781		- }
782		- return $replace_with;
783		- }
784		-
785		- /**
786		- * Converts all accent characters to ASCII characters.
787		- *
788		- * @since 6.3.1
789		- *
790		- * @param string $replace_with The text to remove accents from.
791		- *
792		- * @return string
793		- */
794		- public static function atts_remove_accents( $replace_with ) {
795		- return remove_accents( $replace_with );
796		- }
797		-
798		- /**
799		- * @param string $replace_with
800		- * @return string
801		- */
802		- private static function atts_sanitize( $replace_with ) {
803		- return sanitize_title_with_dashes( $replace_with );
804		- }
805		-
806		- /**
807		- * @param string $replace_with
808		- * @return string
809		- */
810		- private static function atts_sanitize_url( $replace_with ) {
811		- return urlencode( $replace_with );
812		- }
813		-
814		- /**
815	762	* Prevent shortcodes in fields from being processed
816	763	*
817	764	* @since 3.01.02
818	765	*
		@@ -894,11 +841,11 @@
894	841	if ( empty( $field ) ) {
895	842	return null;
896	843	}
897	844
898		- if ( isset( $atts['show'] ) && $atts['show'] === 'field_label' ) {
	845	+ if ( isset( $atts['show'] ) && $atts['show'] == 'field_label' ) {
899	846	$replace_with = $field->name;
900		- } elseif ( isset( $atts['show'] ) && $atts['show'] === 'description' ) {
	847	+ } elseif ( isset( $atts['show'] ) && $atts['show'] == 'description' ) {
901	848	$replace_with = $field->description;
902	849	} else {
903	850	$replace_with = FrmEntryMeta::get_meta_value( $atts['entry'], $field->id );
904	851	$string_value = $replace_with;
		@@ -1138,26 +1085,24 @@
1138	1085	}
1139	1086
1140	1087	// Check posted vals before checking saved values
1141	1088	// For fields inside repeating sections - note, don't check if $pointer is true because it will often be zero
1142		- if ( $parent && isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1089	+ if ( $parent && isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ) {
1143	1090	if ( FrmField::is_field_with_multiple_values( $field ) ) {
1144		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
1145	1091	$other_val = isset( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ][ $opt_key ] ) ? sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ][ $opt_key ] ) ) : '';
1146	1092	} else {
1147		- $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1093	+ $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta'][ $parent ][ $pointer ]['other'][ $field['id'] ] ) );
1148	1094	}
1149	1095
1150	1096	return $other_val;
1151	1097
1152		- } elseif ( isset( $field['id'] ) && isset( $_POST['item_meta']['other'][ $field['id'] ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1098	+ } elseif ( isset( $field['id'] ) && isset( $_POST['item_meta']['other'][ $field['id'] ] ) ) {
1153	1099	// For normal fields
1154	1100
1155	1101	if ( FrmField::is_field_with_multiple_values( $field ) ) {
1156		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
1157	1102	$other_val = isset( $_POST['item_meta']['other'][ $field['id'] ][ $opt_key ] ) ? sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ][ $opt_key ] ) ) : '';
1158	1103	} else {
1159		- $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	1104	+ $other_val = sanitize_text_field( wp_unslash( $_POST['item_meta']['other'][ $field['id'] ] ) );
1160	1105	}
1161	1106
1162	1107	return $other_val;
1163	1108	}
		@@ -1162,9 +1107,9 @@
1162	1107	return $other_val;
1163	1108	}
1164	1109
1165	1110	// For checkboxes
1166		- if ( $field['type'] === 'checkbox' && is_array( $field['value'] ) ) {
	1111	+ if ( $field['type'] == 'checkbox' && is_array( $field['value'] ) ) {
1167	1112	// Check if there is an "other" val in saved value and make sure the
1168	1113	// "other" val is not equal to the Other checkbox option
1169	1114	if ( isset( $field['value'][ $opt_key ] ) && $field['options'][ $opt_key ] != $field['value'][ $opt_key ] ) {
1170	1115	$other_val = $field['value'][ $opt_key ];
		@@ -1358,24 +1303,16 @@
1358	1303	$replace[] = '[if ' . $old . ' ';
1359	1304	$replace_with[] = '[if ' . $new . ' ';
1360	1305	$replace[] = '[/if ' . $old . ']';
1361	1306	$replace_with[] = '[/if ' . $new . ']';
1362		- $replace[] = '[\/if ' . $old . ']';
1363		- $replace_with[] = '[\/if ' . $new . ']';
1364	1307	$replace[] = '[foreach ' . $old . ']';
1365	1308	$replace_with[] = '[foreach ' . $new . ']';
1366	1309	$replace[] = '[/foreach ' . $old . ']';
1367	1310	$replace_with[] = '[/foreach ' . $new . ']';
1368		- $replace[] = '[\/foreach ' . $old . ']';
1369		- $replace_with[] = '[\/foreach ' . $new . ']';
1370	1311	$replace[] = '[' . $old . ']';
1371	1312	$replace_with[] = '[' . $new . ']';
1372	1313	$replace[] = '[' . $old . ' ';
1373	1314	$replace_with[] = '[' . $new . ' ';
1374		- $replace[] = 'field_id="' . $old . '"';
1375		- $replace_with[] = 'field_id="' . $new . '"';
1376		- $replace[] = 'field_id=\"' . $old . '\"';
1377		- $replace_with[] = 'field_id=\"' . $new . '\"';
1378	1315	unset( $old, $new );
1379	1316	}
1380	1317	if ( is_array( $val ) ) {
1381	1318	foreach ( $val as $k => $v ) {
		@@ -1722,10 +1659,10 @@
1722	1659	* Gets bulk prefilled options.
1723	1660	*
1724	1661	* @since 5.0.04 Add `$include_class` param.
1725	1662	*
1726		- * @param array $prepop Bulk options.
1727		- * @param array|false $include_class Include the class in the bulk options.
	1663	+ * @param array $prepop Bulk options.
	1664	+ * @param array $include_class Include the class in the bulk options.
1728	1665	*/
1729	1666	public static function get_bulk_prefilled_opts( array &$prepop, $include_class = false ) {
1730	1667	// Countries.
1731	1668	$countries = self::get_countries();
		@@ -1866,11 +1803,9 @@
1866	1803	}
1867	1804
1868	1805	/**
1869	1806	* @since 4.04
1870		- *
1871	1807	* @param array $args
1872		- * @return void
1873	1808	*/
1874	1809	public static function show_add_field_buttons( $args ) {
1875	1810	$field_key = $args['field_key'];
1876	1811	$field_type = $args['field_type'];
		@@ -1912,29 +1847,15 @@
1912	1847	$upgrade_message = FrmAppHelper::kses( $field_type['message'], array( 'a', 'img' ) );
1913	1848	}
1914	1849	}
1915	1850
1916		- $li_params = array(
1917		- 'class' => 'frmbutton frm6 ' . $args['no_allow_class'] . $single_no_allow . ' frm_t' . str_replace( '|', '-', $field_key ),
1918		- 'id' => $field_key,
1919		- 'data-upgrade' => $upgrade_label,
1920		- 'data-link' => $link,
1921		- 'data-medium' => 'builder',
1922		- 'data-oneclick' => $install_data,
1923		- 'data-content' => $field_key,
1924		- 'data-requires' => $requires,
1925		- );
1926		-
1927		- if ( $upgrade_message ) {
1928		- $li_params['data-message'] = $upgrade_message;
1929		- }
1930	1851	?>
1931		- <li <?php FrmAppHelper::array_to_html_params( $li_params, true ); ?>>
	1852	+ <li class="frmbutton frm6 <?php echo esc_attr( $args['no_allow_class'] . $single_no_allow . ' frm_t' . str_replace( '|', '-', $field_key ) ); ?>" id="<?php echo esc_attr( $field_key ); ?>" data-upgrade="<?php echo esc_attr( $upgrade_label ); ?>" data-message="<?php echo esc_attr( $upgrade_message ); ?>" data-link="<?php echo esc_attr( $link ); ?>" data-medium="builder" data-oneclick="<?php echo esc_attr( $install_data ); ?>" data-content="<?php echo esc_attr( $field_key ); ?>" data-requires="<?php echo esc_attr( $requires ); ?>">
1932	1853	<?php
1933	1854	if ( $run_filter ) {
1934	1855	$field_label = apply_filters( 'frmpro_field_links', $field_label, $args['id'], $field_key );
1935	1856	}
1936		- echo FrmAppHelper::kses( $field_label, array( 'a', 'i', 'span', 'use', 'svg' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	1857	+ echo FrmAppHelper::kses( $field_label, array( 'a', 'i', 'span', 'use', 'svg' ) ); // WPCS: XSS ok.
1937	1858	?>
1938	1859	</li>
1939	1860	<?php
1940	1861	}
		@@ -1946,25 +1867,8 @@
1946	1867	*
1947	1868	* @param array $field Field data.
1948	1869	*/
1949	1870	public static function show_radio_display_format( $field ) {
1950		- $options = self::get_display_format_options( $field );
1951		-
1952		- $args = self::get_display_format_args( $field, $options );
1953		-
1954		- include FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/radio-display-format.php';
1955		- }
1956		-
1957		- /**
1958		- * Creates an array that contains variables used for display format options setting.
1959		- *
1960		- * @since 6.3.2
1961		- *
1962		- * @param array $field The field.
1963		- *
1964		- * @return array
1965		- */
1966		- public static function get_display_format_options( $field ) {
1967	1871	$options = array(
1968	1872	'0' => array(
1969	1873	'text' => __( 'Simple', 'formidable' ),
1970	1874	'svg' => 'frm_simple_radio',
		@@ -1992,13 +1896,14 @@
1992	1896	*
1993	1897	* @since 5.0.04
1994	1898	*
1995	1899	* @param array $options Options.
1996		- * @param array $field
1997	1900	*/
1998		- $options = apply_filters( 'frm_' . $field['type'] . '_display_format_options', $options, $field );
	1901	+ $options = apply_filters( 'frm_radio_display_format_options', $options );
1999	1902
2000		- return $options;
	1903	+ $args = self::get_display_format_args( $field, $options );
	1904	+
	1905	+ include FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/radio-display-format.php';
2001	1906	}
2002	1907
2003	1908	/**
2004	1909	* Gets display format arguments to pass to the images_dropdown() method.
		@@ -2008,9 +1913,9 @@
2008	1913	* @param array $field Field data.
2009	1914	* @param array $options Options array.
2010	1915	* @return array
2011	1916	*/
2012		- public static function get_display_format_args( $field, $options ) {
	1917	+ private static function get_display_format_args( $field, $options ) {
2013	1918	$args = array(
2014	1919	'selected' => '0',
2015	1920	'options' => array(),
2016	1921	'name' => 'field_options[image_options_' . $field['id'] . ']',
		@@ -2028,9 +1933,9 @@
2028	1933	*
2029	1934	* @param array $args Arguments.
2030	1935	* @param array $method_args The arguments from the method. Contains `field`, `options`.
2031	1936	*/
2032		- return apply_filters( 'frm_' . $field['type'] . '_display_format_args', $args, compact( 'field', 'options' ) );
	1937	+ return apply_filters( 'frm_radio_display_format_args', $args, compact( 'field', 'options' ) );
2033	1938	}
2034	1939
2035	1940	/**
2036	1941	* @since 5.0.04
		@@ -2089,23 +1994,8 @@
2089	1994	return $custom_attrs;
2090	1995	}
2091	1996
2092	1997	/**
2093		- * Maybe adjust a field value based on type.
2094		- * Some types require unserializing an array (@see self::field_type_requires_unserialize).
2095		- *
2096		- * @since 6.2
2097		- *
2098		- * @param mixed $value
2099		- * @param string $field_type
2100		- * @return void
2101		- */
2102		- public static function prepare_field_value( &$value, $field_type ) {
2103		- $field_object = FrmFieldFactory::get_field_type( $field_type );
2104		- $value = $field_object->maybe_decode_value( $value );
2105		- }
2106		-
2107		- /**
2108	1998	* @deprecated 4.0
2109	1999	*/
2110	2000	public static function show_icon_link_js( $atts ) {
2111	2001	_deprecated_function( __METHOD__, '4.0' );
		@@ -2164,13 +2054,13 @@
2164	2054	/**
2165	2055	* @deprecated 3.0
2166	2056	* @codeCoverageIgnore
2167	2057	*
2168		- * @param string $html
2169		- * @param array $field
2170		- * @param array $errors
2171		- * @param object|false $form
2172		- * @param array $args
	2058	+ * @param string $html
	2059	+ * @param array $field
	2060	+ * @param array $errors
	2061	+ * @param object $form
	2062	+ * @param array $args
2173	2063	*
2174	2064	* @return string
2175	2065	*/
2176	2066	public static function replace_shortcodes( $html, $field, $errors = array(), $form = false, $args = array() ) {
		@@ -2185,13 +2075,10 @@
2185	2075	return FrmDeprecated::get_default_field_opts( $type, $field, $limit );
2186	2076	}
2187	2077
2188	2078	/**
2189		- * @deprecated 2.02.07 This is still referenced in the Highrise add on as of v1.06.
	2079	+ * @deprecated 2.02.07
2190	2080	* @codeCoverageIgnore
2191		- *
2192		- * @param array $args
2193		- * @return string
2194	2081	*/
2195	2082	public static function dropdown_categories( $args ) {
2196	2083	return FrmDeprecated::dropdown_categories( $args );
2197	2084	}