← All changes | classes/controllers/FrmXMLController.php +22 -113 6.4 → 5.0 View file →

		@@ -4,18 +4,12 @@
4	4	}
5	5
6	6	class FrmXMLController {
7	7
8		- /**
9		- * @return void
10		- */
11	8	public static function menu() {
12	9	add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13	10	}
14	11
15		- /**
16		- * @return void
17		- */
18	12	public static function add_default_templates() {
19	13	if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20	14	// XML import is not enabled on your server
21	15	return;
		@@ -40,34 +34,18 @@
40	34	/**
41	35	* Use the template link to install the XML template
42	36	*
43	37	* @since 3.06
44		- * @return void
45	38	*/
46	39	public static function install_template() {
47	40	FrmAppHelper::permission_check( 'frm_edit_forms' );
48	41	check_ajax_referer( 'frm_ajax', 'nonce' );
49	42
50		- if ( ! function_exists( 'simplexml_load_string' ) ) {
51		- $response = array(
52		- 'message' => __( 'Your server is missing the Simple XML extension. This is required to install a template.', 'formidable' ),
53		- );
54		- echo wp_json_encode( $response );
55		- wp_die();
56		- }
	43	+ $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
57	44
58	45	$form = self::get_posted_form();
59		- $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60	46	self::override_url( $form, $url );
61	47
62		- if ( ! self::validate_xml_url( $url ) ) {
63		- $response = array(
64		- 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65		- );
66		- echo wp_json_encode( $response );
67		- wp_die();
68		- }
69		-
70	48	$response = wp_remote_get( $url );
71	49	$body = wp_remote_retrieve_body( $response );
72	50	$xml = simplexml_load_string( $body );
73	51
		@@ -72,9 +50,9 @@
72	50	$xml = simplexml_load_string( $body );
73	51
74	52	if ( ! $xml ) {
75	53	$response = array(
76		- 'message' => __( 'There was an error reading the form template.', 'formidable' ),
	54	+ 'message' => __( 'There was an error reading the form template', 'formidable' ),
77	55	);
78	56	echo wp_json_encode( $response );
79	57	wp_die();
80	58	}
		@@ -80,10 +58,10 @@
80	58	}
81	59
82	60	self::set_new_form_name( $xml );
83	61
84		- $imported = FrmXMLHelper::import_xml_now( $xml, true );
85		- if ( ! empty( $imported['form_status'] ) ) {
	62	+ $imported = FrmXMLHelper::import_xml_now( $xml );
	63	+ if ( isset( $imported['form_status'] ) && ! empty( $imported['form_status'] ) ) {
86	64	// Get the last form id in case there are child forms.
87	65	end( $imported['form_status'] );
88	66	$form_id = key( $imported['form_status'] );
89	67	$response = array(
		@@ -123,24 +101,9 @@
123	101	wp_die();
124	102	}
125	103
126	104	/**
127		- * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
128		- * This is to make sure that the URL can't be exploited for a SSRF attack.
129		- *
130		- * @since 5.5.5
131		- * @param string $url
132		- *
133		- * @return bool True on success, False on error.
134		- */
135		- private static function validate_xml_url( $url ) {
136		- return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
137		- }
138		-
139		- /**
140	105	* @since 4.06.02
141		- *
142		- * @return mixed
143	106	*/
144	107	private static function get_posted_form() {
145	108	$form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
146	109	if ( empty( $form ) ) {
		@@ -153,10 +116,8 @@
153	116	/**
154	117	* Get a different URL depending on the selection in the form.
155	118	*
156	119	* @since 4.06.02
157		- *
158		- * @return void
159	120	*/
160	121	private static function override_url( $form, &$url ) {
161	122	$selected_form = self::get_selected_in_form( $form, 'form' );
162	123	if ( empty( $selected_form ) ) {
		@@ -172,11 +133,8 @@
172	133	}
173	134
174	135	/**
175	136	* @since 4.06.02
176		- *
177		- * @param string $value
178		- * @param array $form
179	137	*/
180	138	private static function get_selected_in_form( $form, $value = 'form' ) {
181	139	if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
182	140	return $form[ $value ];
		@@ -242,9 +200,8 @@
242	200	*
243	201	* @since 3.06
244	202	*
245	203	* @param object $xml The values included in the XML.
246		- * @return void
247	204	*/
248	205	private static function set_new_form_name( &$xml ) {
249	206	if ( ! isset( $xml->form ) ) {
250	207	return;
		@@ -251,9 +208,9 @@
251	208	}
252	209
253	210	$name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
254	211	$description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
255		- if ( ! $name && ! $description ) {
	212	+ if ( empty( $name ) && empty( $description ) ) {
256	213	return;
257	214	}
258	215
259	216	// Get the main form ID.
		@@ -258,29 +215,26 @@
258	215
259	216	// Get the main form ID.
260	217	$set_name = 0;
261	218	foreach ( $xml->form as $form ) {
262		- if ( empty( $form->parent_form_id ) ) {
263		- $set_name = (int) $form->id;
	219	+ if ( ! isset( $form->parent_form_id ) || empty( $form->parent_form_id ) ) {
	220	+ $set_name = $form->id;
264	221	}
265	222	}
266	223
267	224	foreach ( $xml->form as $form ) {
268	225	// Maybe set the form name if this isn't a child form.
269		- if ( $set_name === (int) $form->id ) {
	226	+ if ( $set_name == $form->id ) {
270	227	$form->name = $name;
271	228	$form->description = $description;
272	229	}
273	230
274	231	// Use a unique key to prevent editing existing form.
275		- $sanitized_form_name = sanitize_title( $form->name );
276		- $form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
	232	+ $name = sanitize_title( $form->name );
	233	+ $form->form_key = FrmAppHelper::get_unique_key( $name, 'frm_forms', 'form_key' );
277	234	}
278	235	}
279	236
280		- /**
281		- * @return void
282		- */
283	237	public static function route() {
284	238	$action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
285	239	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	240	FrmAppHelper::include_svg();
		@@ -285,25 +239,19 @@
285	239	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	240	FrmAppHelper::include_svg();
287	241
288	242	if ( 'import_xml' === $action ) {
289		- self::import_xml();
	243	+ return self::import_xml();
290	244	} elseif ( 'export_xml' === $action ) {
291		- self::export_xml();
	245	+ return self::export_xml();
292	246	} elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
293		- self::form();
	247	+ return self::form();
294	248	}
295	249	}
296	250
297		- /**
298		- * @param string[] $errors
299		- * @param string $message
300		- *
301		- * @return void
302		- */
303	251	public static function form( $errors = array(), $message = '' ) {
304	252	$where = array(
305		- 'status' => array( null, '', 'published' ),
	253	+ 'status' => array( null, '', 'published' ),
306	254	);
307	255	$forms = FrmForm::getAll( $where, 'name' );
308	256
309	257	$export_types = array(
		@@ -325,14 +273,11 @@
325	273	),
326	274	);
327	275	$export_format = apply_filters( 'frm_export_formats', $export_format );
328	276
329		- include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
	277	+ include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
330	278	}
331	279
332		- /**
333		- * @return void
334		- */
335	280	public static function import_xml() {
336	281	$errors = array();
337	282	$message = '';
338	283
		@@ -405,11 +350,8 @@
405	350
406	351	self::form( $errors, $message );
407	352	}
408	353
409		- /**
410		- * @return void
411		- */
412	354	public static function export_xml() {
413	355	$error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
414	356	if ( ! empty( $error ) ) {
415	357	wp_die( esc_html( $error ) );
		@@ -434,15 +376,8 @@
434	376
435	377	wp_die();
436	378	}
437	379
438		- /**
439		- * @param array $args
440		- *
441		- * @psalm-param array{ids?: mixed} $args
442		- *
443		- * @return void
444		- */
445	380	public static function generate_xml( $type, $args = array() ) {
446	381	global $wpdb;
447	382
448	383	self::prepare_types_array( $type );
		@@ -549,14 +484,11 @@
549	484	header( 'Content-Disposition: attachment; filename=' . $filename );
550	485	header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
551	486
552	487	echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
553		- include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
	488	+ include( FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php' );
554	489	}
555	490
556		- /**
557		- * @return void
558		- */
559	491	private static function prepare_types_array( &$type ) {
560	492	$type = (array) $type;
561	493	if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
562	494	// make sure the form is included if there are entries
		@@ -574,12 +506,8 @@
574	506	* Use the nme of the form if only one form is exported.
575	507	*
576	508	* @since 3.06
577	509	*
578		- * @param array $type
579		- * @param array $records
580		- * @param array $args
581		- *
582	510	* @return string
583	511	*/
584	512	private static function get_file_name( $args, $type, $records ) {
585	513	$has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
		@@ -591,10 +519,9 @@
591	519	foreach ( $records['forms'] as $form_id ) {
592	520	$filename = 'form-' . $form_id . '.xml';
593	521	if ( $selected_form_id === $form_id ) {
594	522	$form = FrmForm::getOne( $form_id );
595		- $filename = $form->name !== '' ? $form->name : $form->form_key;
596		- $filename = sanitize_title( $filename ) . '-form.xml';
	523	+ $filename = sanitize_title( $form->name ) . '-form.xml';
597	524	break;
598	525	}
599	526	}
600	527	} else {
		@@ -605,21 +532,11 @@
605	532	}
606	533	$filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
607	534	}
608	535
609		- /**
610		- * @since 5.3
611		- *
612		- * @param string $filename
613		- */
614		- return apply_filters( 'frm_xml_filename', $filename );
	536	+ return $filename;
615	537	}
616	538
617		- /**
618		- * @param array $atts
619		- *
620		- * @return void
621		- */
622	539	public static function generate_csv( $atts ) {
623	540	$form_ids = $atts['ids'];
624	541	if ( empty( $form_ids ) ) {
625	542	wp_die( esc_html__( 'Please select a form', 'formidable' ) );
		@@ -630,10 +547,8 @@
630	547	/**
631	548	* Export to CSV
632	549	*
633	550	* @since 2.0.19
634		- *
635		- * @return void
636	551	*/
637	552	public static function csv( $form_id = false, $search = '', $fid = '' ) {
638	553	FrmAppHelper::permission_check( 'frm_view_entries' );
639	554
		@@ -650,16 +565,11 @@
650	565	}
651	566
652	567	global $wpdb;
653	568
654		- $form = FrmForm::getOne( $form_id );
	569	+ $form = FrmForm::getOne( $form_id );
	570	+ $form_id = $form->id;
655	571
656		- if ( ! $form ) {
657		- esc_html_e( 'Form not found.', 'formidable' );
658		- wp_die();
659		- }
660		-
661		- $form_id = $form->id;
662	572	$form_cols = self::get_fields_for_csv_export( $form_id, $form );
663	573
664	574	$item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
665	575	if ( ! empty( $item_id ) ) {
		@@ -697,9 +607,8 @@
697	607	/**
698	608	* Get the fields that should be included in the CSV export
699	609	*
700	610	* @since 2.0.19
701		- * @since 5.0.16 function went from private to public.
702	611	*
703	612	* @param int $form_id
704	613	* @param object $form
705	614	*
		@@ -704,9 +613,9 @@
704	613	* @param object $form
705	614	*
706	615	* @return array $csv_fields
707	616	*/
708		- public static function get_fields_for_csv_export( $form_id, $form ) {
	617	+ private static function get_fields_for_csv_export( $form_id, $form ) {
709	618	$csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
710	619	$no_export_fields = FrmField::no_save_fields();
711	620	foreach ( $csv_fields as $k => $f ) {
712	621	if ( in_array( $f->type, $no_export_fields, true ) ) {
		@@ -713,9 +622,9 @@
713	622	unset( $csv_fields[ $k ] );
714	623	}
715	624	}
716	625
717		- return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
	626	+ return $csv_fields;
718	627	}
719	628
720	629	public static function allow_mime( $mimes ) {
721	630	if ( ! isset( $mimes['csv'] ) ) {