PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 5.0
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v5.0
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +52 -167 6.255.0 View file →
@@ -4,21 +4,15 @@
4 4 }
5 5
6 6 class FrmXMLController {
7 7
8 - /**
9 - * @return void
10 - */
11 8 public static function menu() {
12 9 add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13 10 }
14 11
15 - /**
16 - * @return void
17 - */
18 12 public static function add_default_templates() {
19 13 if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20 - // XML import is not enabled on your server.
14 + // XML import is not enabled on your server
21 15 return;
22 16 }
23 17
24 18 $set_err = libxml_use_internal_errors( true );
@@ -40,34 +34,18 @@
40 34 /**
41 35 * Use the template link to install the XML template
42 36 *
43 37 * @since 3.06
44 - * @return void
45 38 */
46 39 public static function install_template() {
47 40 FrmAppHelper::permission_check( 'frm_edit_forms' );
48 41 check_ajax_referer( 'frm_ajax', 'nonce' );
49 42
50 - if ( ! function_exists( 'simplexml_load_string' ) ) {
51 - $response = array(
52 - 'message' => __( 'Your server is missing the Simple XML extension. This is required to install a template.', 'formidable' ),
53 - );
54 - echo wp_json_encode( $response );
55 - wp_die();
56 - }
43 + $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
57 44
58 45 $form = self::get_posted_form();
59 - $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60 46 self::override_url( $form, $url );
61 47
62 - if ( ! self::validate_xml_url( $url ) ) {
63 - $response = array(
64 - 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65 - );
66 - echo wp_json_encode( $response );
67 - wp_die();
68 - }
69 -
70 48 $response = wp_remote_get( $url );
71 49 $body = wp_remote_retrieve_body( $response );
72 50 $xml = simplexml_load_string( $body );
73 51
@@ -72,9 +50,9 @@
72 50 $xml = simplexml_load_string( $body );
73 51
74 52 if ( ! $xml ) {
75 53 $response = array(
76 - 'message' => __( 'There was an error reading the form template.', 'formidable' ),
54 + 'message' => __( 'There was an error reading the form template', 'formidable' ),
77 55 );
78 56 echo wp_json_encode( $response );
79 57 wp_die();
80 58 }
@@ -80,16 +58,16 @@
80 58 }
81 59
82 60 self::set_new_form_name( $xml );
83 61
84 - $imported = FrmXMLHelper::import_xml_now( $xml, true );
85 - if ( ! empty( $imported['form_status'] ) ) {
62 + $imported = FrmXMLHelper::import_xml_now( $xml );
63 + if ( isset( $imported['form_status'] ) && ! empty( $imported['form_status'] ) ) {
86 64 // Get the last form id in case there are child forms.
87 65 end( $imported['form_status'] );
88 66 $form_id = key( $imported['form_status'] );
89 67 $response = array(
90 68 'id' => $form_id,
91 - 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
69 + 'redirect' => FrmForm::get_edit_link( $form_id ),
92 70 'success' => 1,
93 71 );
94 72 if ( ! empty( $imported['imported']['posts'] ) ) {
95 73 // Return the link to the last page created.
@@ -100,10 +78,10 @@
100 78 // Create selected pages with the correct shortcodes.
101 79 $pages = self::create_pages_for_import( $form );
102 80 }
103 81
104 - if ( ! empty( $pages ) ) {
105 - $post_id = end( $pages );
82 + if ( isset( $pages ) && ! empty( $pages ) ) {
83 + $post_id = end( $pages );
106 84 $response['redirect'] = get_permalink( $post_id );
107 85 }
108 86 } else {
109 87 if ( isset( $imported['error'] ) ) {
@@ -114,14 +92,11 @@
114 92 $response = array(
115 93 'message' => $message,
116 94 );
117 95
118 - }//end if
96 + }
119 97
120 - /**
121 - * @since 6.18 Added `url` to the $args.
122 - */
123 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
98 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
124 99
125 100 echo wp_json_encode( $response );
126 101 wp_die();
127 102 }
@@ -126,24 +101,9 @@
126 101 wp_die();
127 102 }
128 103
129 104 /**
130 - * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
131 - * This is to make sure that the URL can't be exploited for a SSRF attack.
132 - *
133 - * @since 5.5.5
134 - * @param string $url
135 - *
136 - * @return bool True on success, False on error.
137 - */
138 - private static function validate_xml_url( $url ) {
139 - return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
140 - }
141 -
142 - /**
143 105 * @since 4.06.02
144 - *
145 - * @return mixed
146 106 */
147 107 private static function get_posted_form() {
148 108 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
149 109 if ( empty( $form ) ) {
@@ -156,10 +116,8 @@
156 116 /**
157 117 * Get a different URL depending on the selection in the form.
158 118 *
159 119 * @since 4.06.02
160 - *
161 - * @return void
162 120 */
163 121 private static function override_url( $form, &$url ) {
164 122 $selected_form = self::get_selected_in_form( $form, 'form' );
165 123 if ( empty( $selected_form ) ) {
@@ -165,9 +123,9 @@
165 123 if ( empty( $selected_form ) ) {
166 124 return;
167 125 }
168 126
169 - $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
127 + $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
170 128 if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
171 129 return;
172 130 }
173 131
@@ -175,14 +133,11 @@
175 133 }
176 134
177 135 /**
178 136 * @since 4.06.02
179 - *
180 - * @param array $form
181 - * @param string $value
182 137 */
183 138 private static function get_selected_in_form( $form, $value = 'form' ) {
184 - if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
139 + if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
185 140 return $form[ $value ];
186 141 }
187 142
188 143 return '';
@@ -191,16 +146,17 @@
191 146 /**
192 147 * @since 4.06.02
193 148 *
194 149 * @param array $form The posted form values.
195 - * @return array|null The array of created pages.
150 + *
151 + * @return array The array of created pages.
196 152 */
197 153 private static function create_pages_for_import( $form ) {
198 - if ( empty( $form['pages'] ) ) {
199 - return null;
154 + if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
155 + return;
200 156 }
201 157
202 - $form_key = self::get_selected_in_form( $form, 'form' );
158 + $form_key = self::get_selected_in_form( $form, 'form' );
203 159 $view_keys = self::get_selected_in_form( $form, 'view' );
204 160
205 161 $page_ids = array();
206 162 foreach ( (array) $form['pages'] as $for => $name ) {
@@ -212,9 +168,9 @@
212 168 if ( $for === 'view' ) {
213 169 $item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
214 170 $shortcode = '[display-frm-data id=%1$s filter=limited]';
215 171 } elseif ( $for === 'form' ) {
216 - $item_key = $form_key;
172 + $item_key = $form_key;
217 173 $shortcode = '[formidable id=%1$s]';
218 174 } else {
219 175 $item_key = self::get_selected_in_form( $form, 'form' );
220 176 $shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
@@ -231,9 +187,9 @@
231 187 'post_type' => 'page',
232 188 'post_content' => sprintf( $shortcode, $item_key ),
233 189 )
234 190 );
235 - }//end foreach
191 + }
236 192
237 193 return $page_ids;
238 194 }
239 195
@@ -244,9 +200,8 @@
244 200 *
245 201 * @since 3.06
246 202 *
247 203 * @param object $xml The values included in the XML.
248 - * @return void
249 204 */
250 205 private static function set_new_form_name( &$xml ) {
251 206 if ( ! isset( $xml->form ) ) {
252 207 return;
@@ -253,9 +208,9 @@
253 208 }
254 209
255 210 $name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
256 211 $description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
257 - if ( ! $name && ! $description ) {
212 + if ( empty( $name ) && empty( $description ) ) {
258 213 return;
259 214 }
260 215
261 216 // Get the main form ID.
@@ -260,29 +215,26 @@
260 215
261 216 // Get the main form ID.
262 217 $set_name = 0;
263 218 foreach ( $xml->form as $form ) {
264 - if ( empty( $form->parent_form_id ) ) {
265 - $set_name = (int) $form->id;
219 + if ( ! isset( $form->parent_form_id ) || empty( $form->parent_form_id ) ) {
220 + $set_name = $form->id;
266 221 }
267 222 }
268 223
269 224 foreach ( $xml->form as $form ) {
270 225 // Maybe set the form name if this isn't a child form.
271 - if ( $set_name === (int) $form->id ) {
226 + if ( $set_name == $form->id ) {
272 227 $form->name = $name;
273 228 $form->description = $description;
274 229 }
275 230
276 231 // Use a unique key to prevent editing existing form.
277 - $sanitized_form_name = sanitize_title( $form->name );
278 - $form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
232 + $name = sanitize_title( $form->name );
233 + $form->form_key = FrmAppHelper::get_unique_key( $name, 'frm_forms', 'form_key' );
279 234 }
280 235 }
281 236
282 - /**
283 - * @return void
284 - */
285 237 public static function route() {
286 238 $action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
287 239 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288 240 FrmAppHelper::include_svg();
@@ -287,22 +239,16 @@
287 239 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288 240 FrmAppHelper::include_svg();
289 241
290 242 if ( 'import_xml' === $action ) {
291 - self::import_xml();
243 + return self::import_xml();
292 244 } elseif ( 'export_xml' === $action ) {
293 - self::export_xml();
245 + return self::export_xml();
294 246 } elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
295 - self::form();
247 + return self::form();
296 248 }
297 249 }
298 250
299 - /**
300 - * @param string[] $errors
301 - * @param string $message
302 - *
303 - * @return void
304 - */
305 251 public static function form( $errors = array(), $message = '' ) {
306 252 $where = array(
307 253 'status' => array( null, '', 'published' ),
308 254 );
@@ -327,14 +273,11 @@
327 273 ),
328 274 );
329 275 $export_format = apply_filters( 'frm_export_formats', $export_format );
330 276
331 - include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
277 + include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
332 278 }
333 279
334 - /**
335 - * @return void
336 - */
337 280 public static function import_xml() {
338 281 $errors = array();
339 282 $message = '';
340 283
@@ -345,10 +288,9 @@
345 288
346 289 return;
347 290 }
348 291
349 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
350 - $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
292 + $has_file = isset( $_FILES ) && isset( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
351 293 if ( ! $has_file ) {
352 294 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
353 295 self::form( $errors );
354 296
@@ -354,9 +296,9 @@
354 296
355 297 return;
356 298 }
357 299
358 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
300 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
359 301 $file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
360 302
361 303 if ( ! is_uploaded_file( $file ) ) {
362 304 unset( $file );
@@ -365,8 +307,10 @@
365 307
366 308 return;
367 309 }
368 310
311 + //add_filter('upload_mimes', 'FrmXMLController::allow_mime');
312 +
369 313 $export_format = array(
370 314 'xml' => array(
371 315 'name' => 'XML',
372 316 'support' => 'forms',
@@ -374,9 +318,9 @@
374 318 ),
375 319 );
376 320 $export_format = apply_filters( 'frm_export_formats', $export_format );
377 321
378 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
322 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
379 323 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
380 324 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
381 325 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
382 326 // allow other file types to be imported
@@ -406,11 +350,8 @@
406 350
407 351 self::form( $errors, $message );
408 352 }
409 353
410 - /**
411 - * @return void
412 - */
413 354 public static function export_xml() {
414 355 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
415 356 if ( ! empty( $error ) ) {
416 357 wp_die( esc_html( $error ) );
@@ -435,16 +376,8 @@
435 376
436 377 wp_die();
437 378 }
438 379
439 - /**
440 - * @param string[] $type
441 - * @param array $args
442 - *
443 - * @psalm-param array{ids?: mixed} $args
444 - *
445 - * @return void
446 - */
447 380 public static function generate_xml( $type, $args = array() ) {
448 381 global $wpdb;
449 382
450 383 self::prepare_types_array( $type );
@@ -478,9 +411,9 @@
478 411 $query_vars = array();
479 412
480 413 switch ( $tb_type ) {
481 414 case 'forms':
482 - // Add forms.
415 + //add forms
483 416 if ( $args['ids'] ) {
484 417 $where[] = array(
485 418 'or' => 1,
486 419 $table . '.id' => $args['ids'],
@@ -538,15 +471,15 @@
538 471 $where['pm.meta_value >'] = 1;
539 472 } else {
540 473 $where['pm.meta_value'] = $args['ids'];
541 474 }
542 - }//end switch
475 + }
543 476
544 477 $records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
545 478 unset( $tb_type );
546 - }//end foreach
479 + }
547 480
548 - $filename = self::get_file_name( $args, $records );
481 + $filename = self::get_file_name( $args, $type, $records );
549 482
550 483 header( 'Content-Description: File Transfer' );
551 484 header( 'Content-Disposition: attachment; filename=' . $filename );
552 485 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
@@ -551,43 +484,19 @@
551 484 header( 'Content-Disposition: attachment; filename=' . $filename );
552 485 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
553 486
554 487 echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
555 - include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
488 + include( FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php' );
556 489 }
557 490
558 - /**
559 - * Returns an array that has parent term slugs for the terms provided.
560 - *
561 - * @since 6.8.3
562 - * @param array $terms
563 - * @return array
564 - */
565 - public static function get_parent_terms_slugs( $terms ) {
566 - $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
567 - $parent_slugs = array();
568 -
569 - if ( ! $parent_term_ids ) {
570 - return $parent_slugs;
571 - }
572 -
573 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
574 - $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
575 -
576 - return $parent_slugs;
577 - }
578 -
579 - /**
580 - * @return void
581 - */
582 491 private static function prepare_types_array( &$type ) {
583 492 $type = (array) $type;
584 - if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
493 + if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
585 494 // make sure the form is included if there are entries
586 495 $type[] = 'forms';
587 496 }
588 497
589 - if ( in_array( 'forms', $type, true ) ) {
498 + if ( in_array( 'forms', $type ) ) {
590 499 // include actions with forms
591 500 $type[] = 'actions';
592 501 }
593 502 }
@@ -597,14 +506,12 @@
597 506 * Use the nme of the form if only one form is exported.
598 507 *
599 508 * @since 3.06
600 509 *
601 - * @param array $args
602 - * @param array $records
603 510 * @return string
604 511 */
605 - private static function get_file_name( $args, $records ) {
606 - $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
512 + private static function get_file_name( $args, $type, $records ) {
513 + $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
607 514 if ( $has_one_form ) {
608 515 // one form is being exported
609 516 $selected_form_id = reset( $args['ids'] );
610 517 $filename = 'form-' . $selected_form_id . '.xml';
@@ -612,10 +519,9 @@
612 519 foreach ( $records['forms'] as $form_id ) {
613 520 $filename = 'form-' . $form_id . '.xml';
614 521 if ( $selected_form_id === $form_id ) {
615 522 $form = FrmForm::getOne( $form_id );
616 - $filename = $form->name !== '' ? $form->name : $form->form_key;
617 - $filename = sanitize_title( $filename ) . '-form.xml';
523 + $filename = sanitize_title( $form->name ) . '-form.xml';
618 524 break;
619 525 }
620 526 }
621 527 } else {
@@ -624,23 +530,13 @@
624 530 if ( ! empty( $sitename ) ) {
625 531 $sitename .= '.';
626 532 }
627 533 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
628 - }//end if
534 + }
629 535
630 - /**
631 - * @since 5.3
632 - *
633 - * @param string $filename
634 - */
635 - return apply_filters( 'frm_xml_filename', $filename );
536 + return $filename;
636 537 }
637 538
638 - /**
639 - * @param array $atts
640 - *
641 - * @return void
642 - */
643 539 public static function generate_csv( $atts ) {
644 540 $form_ids = $atts['ids'];
645 541 if ( empty( $form_ids ) ) {
646 542 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
@@ -651,10 +547,8 @@
651 547 /**
652 548 * Export to CSV
653 549 *
654 550 * @since 2.0.19
655 - *
656 - * @return void
657 551 */
658 552 public static function csv( $form_id = false, $search = '', $fid = '' ) {
659 553 FrmAppHelper::permission_check( 'frm_view_entries' );
660 554
@@ -663,12 +557,9 @@
663 557 $search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
664 558 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
665 559 }
666 560
667 - // Remove time limit to execute this function.
668 - if ( function_exists( 'set_time_limit' ) ) {
669 - set_time_limit( 0 );
670 - }
561 + set_time_limit( 0 ); //Remove time limit to execute this function
671 562 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
672 563 if ( (int) $mem_limit < 256 ) {
673 564 wp_raise_memory_limit();
674 565 }
@@ -674,16 +565,11 @@
674 565 }
675 566
676 567 global $wpdb;
677 568
678 - $form = FrmForm::getOne( $form_id );
569 + $form = FrmForm::getOne( $form_id );
570 + $form_id = $form->id;
679 571
680 - if ( ! $form ) {
681 - esc_html_e( 'Form not found.', 'formidable' );
682 - wp_die();
683 - }
684 -
685 - $form_id = $form->id;
686 572 $form_cols = self::get_fields_for_csv_export( $form_id, $form );
687 573
688 574 $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
689 575 if ( ! empty( $item_id ) ) {
@@ -721,16 +607,15 @@
721 607 /**
722 608 * Get the fields that should be included in the CSV export
723 609 *
724 610 * @since 2.0.19
725 - * @since 5.0.16 function went from private to public.
726 611 *
727 - * @param int $form_id
612 + * @param int $form_id
728 613 * @param object $form
729 614 *
730 615 * @return array $csv_fields
731 616 */
732 - public static function get_fields_for_csv_export( $form_id, $form ) {
617 + private static function get_fields_for_csv_export( $form_id, $form ) {
733 618 $csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
734 619 $no_export_fields = FrmField::no_save_fields();
735 620 foreach ( $csv_fields as $k => $f ) {
736 621 if ( in_array( $f->type, $no_export_fields, true ) ) {
@@ -737,9 +622,9 @@
737 622 unset( $csv_fields[ $k ] );
738 623 }
739 624 }
740 625
741 - return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
626 + return $csv_fields;
742 627 }
743 628
744 629 public static function allow_mime( $mimes ) {
745 630 if ( ! isset( $mimes['csv'] ) ) {