← All changes | classes/controllers/FrmXMLController.php +39 -140 6.25 → 5.3 View file →

		@@ -4,21 +4,15 @@
4	4	}
5	5
6	6	class FrmXMLController {
7	7
8		- /**
9		- * @return void
10		- */
11	8	public static function menu() {
12	9	add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13	10	}
14	11
15		- /**
16		- * @return void
17		- */
18	12	public static function add_default_templates() {
19	13	if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20		- // XML import is not enabled on your server.
	14	+ // XML import is not enabled on your server
21	15	return;
22	16	}
23	17
24	18	$set_err = libxml_use_internal_errors( true );
		@@ -40,34 +34,18 @@
40	34	/**
41	35	* Use the template link to install the XML template
42	36	*
43	37	* @since 3.06
44		- * @return void
45	38	*/
46	39	public static function install_template() {
47	40	FrmAppHelper::permission_check( 'frm_edit_forms' );
48	41	check_ajax_referer( 'frm_ajax', 'nonce' );
49	42
50		- if ( ! function_exists( 'simplexml_load_string' ) ) {
51		- $response = array(
52		- 'message' => __( 'Your server is missing the Simple XML extension. This is required to install a template.', 'formidable' ),
53		- );
54		- echo wp_json_encode( $response );
55		- wp_die();
56		- }
	43	+ $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
57	44
58	45	$form = self::get_posted_form();
59		- $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60	46	self::override_url( $form, $url );
61	47
62		- if ( ! self::validate_xml_url( $url ) ) {
63		- $response = array(
64		- 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65		- );
66		- echo wp_json_encode( $response );
67		- wp_die();
68		- }
69		-
70	48	$response = wp_remote_get( $url );
71	49	$body = wp_remote_retrieve_body( $response );
72	50	$xml = simplexml_load_string( $body );
73	51
		@@ -72,9 +50,9 @@
72	50	$xml = simplexml_load_string( $body );
73	51
74	52	if ( ! $xml ) {
75	53	$response = array(
76		- 'message' => __( 'There was an error reading the form template.', 'formidable' ),
	54	+ 'message' => __( 'There was an error reading the form template', 'formidable' ),
77	55	);
78	56	echo wp_json_encode( $response );
79	57	wp_die();
80	58	}
		@@ -87,9 +65,9 @@
87	65	end( $imported['form_status'] );
88	66	$form_id = key( $imported['form_status'] );
89	67	$response = array(
90	68	'id' => $form_id,
91		- 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
	69	+ 'redirect' => FrmForm::get_edit_link( $form_id ),
92	70	'success' => 1,
93	71	);
94	72	if ( ! empty( $imported['imported']['posts'] ) ) {
95	73	// Return the link to the last page created.
		@@ -100,10 +78,10 @@
100	78	// Create selected pages with the correct shortcodes.
101	79	$pages = self::create_pages_for_import( $form );
102	80	}
103	81
104		- if ( ! empty( $pages ) ) {
105		- $post_id = end( $pages );
	82	+ if ( isset( $pages ) && ! empty( $pages ) ) {
	83	+ $post_id = end( $pages );
106	84	$response['redirect'] = get_permalink( $post_id );
107	85	}
108	86	} else {
109	87	if ( isset( $imported['error'] ) ) {
		@@ -114,14 +92,11 @@
114	92	$response = array(
115	93	'message' => $message,
116	94	);
117	95
118		- }//end if
	96	+ }
119	97
120		- /**
121		- * @since 6.18 Added `url` to the $args.
122		- */
123		- $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
	98	+ $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
124	99
125	100	echo wp_json_encode( $response );
126	101	wp_die();
127	102	}
		@@ -126,24 +101,9 @@
126	101	wp_die();
127	102	}
128	103
129	104	/**
130		- * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
131		- * This is to make sure that the URL can't be exploited for a SSRF attack.
132		- *
133		- * @since 5.5.5
134		- * @param string $url
135		- *
136		- * @return bool True on success, False on error.
137		- */
138		- private static function validate_xml_url( $url ) {
139		- return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
140		- }
141		-
142		- /**
143	105	* @since 4.06.02
144		- *
145		- * @return mixed
146	106	*/
147	107	private static function get_posted_form() {
148	108	$form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
149	109	if ( empty( $form ) ) {
		@@ -156,10 +116,8 @@
156	116	/**
157	117	* Get a different URL depending on the selection in the form.
158	118	*
159	119	* @since 4.06.02
160		- *
161		- * @return void
162	120	*/
163	121	private static function override_url( $form, &$url ) {
164	122	$selected_form = self::get_selected_in_form( $form, 'form' );
165	123	if ( empty( $selected_form ) ) {
		@@ -165,9 +123,9 @@
165	123	if ( empty( $selected_form ) ) {
166	124	return;
167	125	}
168	126
169		- $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
	127	+ $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
170	128	if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
171	129	return;
172	130	}
173	131
		@@ -175,14 +133,11 @@
175	133	}
176	134
177	135	/**
178	136	* @since 4.06.02
179		- *
180		- * @param array $form
181		- * @param string $value
182	137	*/
183	138	private static function get_selected_in_form( $form, $value = 'form' ) {
184		- if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
	139	+ if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
185	140	return $form[ $value ];
186	141	}
187	142
188	143	return '';
		@@ -191,16 +146,17 @@
191	146	/**
192	147	* @since 4.06.02
193	148	*
194	149	* @param array $form The posted form values.
195		- * @return array|null The array of created pages.
	150	+ *
	151	+ * @return array The array of created pages.
196	152	*/
197	153	private static function create_pages_for_import( $form ) {
198		- if ( empty( $form['pages'] ) ) {
199		- return null;
	154	+ if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
	155	+ return;
200	156	}
201	157
202		- $form_key = self::get_selected_in_form( $form, 'form' );
	158	+ $form_key = self::get_selected_in_form( $form, 'form' );
203	159	$view_keys = self::get_selected_in_form( $form, 'view' );
204	160
205	161	$page_ids = array();
206	162	foreach ( (array) $form['pages'] as $for => $name ) {
		@@ -212,9 +168,9 @@
212	168	if ( $for === 'view' ) {
213	169	$item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
214	170	$shortcode = '[display-frm-data id=%1$s filter=limited]';
215	171	} elseif ( $for === 'form' ) {
216		- $item_key = $form_key;
	172	+ $item_key = $form_key;
217	173	$shortcode = '[formidable id=%1$s]';
218	174	} else {
219	175	$item_key = self::get_selected_in_form( $form, 'form' );
220	176	$shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
		@@ -231,9 +187,9 @@
231	187	'post_type' => 'page',
232	188	'post_content' => sprintf( $shortcode, $item_key ),
233	189	)
234	190	);
235		- }//end foreach
	191	+ }
236	192
237	193	return $page_ids;
238	194	}
239	195
		@@ -278,11 +234,8 @@
278	234	$form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
279	235	}
280	236	}
281	237
282		- /**
283		- * @return void
284		- */
285	238	public static function route() {
286	239	$action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
287	240	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288	241	FrmAppHelper::include_svg();
		@@ -287,22 +240,16 @@
287	240	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288	241	FrmAppHelper::include_svg();
289	242
290	243	if ( 'import_xml' === $action ) {
291		- self::import_xml();
	244	+ return self::import_xml();
292	245	} elseif ( 'export_xml' === $action ) {
293		- self::export_xml();
	246	+ return self::export_xml();
294	247	} elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
295		- self::form();
	248	+ return self::form();
296	249	}
297	250	}
298	251
299		- /**
300		- * @param string[] $errors
301		- * @param string $message
302		- *
303		- * @return void
304		- */
305	252	public static function form( $errors = array(), $message = '' ) {
306	253	$where = array(
307	254	'status' => array( null, '', 'published' ),
308	255	);
		@@ -327,14 +274,11 @@
327	274	),
328	275	);
329	276	$export_format = apply_filters( 'frm_export_formats', $export_format );
330	277
331		- include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
	278	+ include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
332	279	}
333	280
334		- /**
335		- * @return void
336		- */
337	281	public static function import_xml() {
338	282	$errors = array();
339	283	$message = '';
340	284
		@@ -345,10 +289,9 @@
345	289
346	290	return;
347	291	}
348	292
349		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
350		- $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
	293	+ $has_file = isset( $_FILES ) && isset( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
351	294	if ( ! $has_file ) {
352	295	$errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
353	296	self::form( $errors );
354	297
		@@ -354,9 +297,9 @@
354	297
355	298	return;
356	299	}
357	300
358		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
	301	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
359	302	$file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
360	303
361	304	if ( ! is_uploaded_file( $file ) ) {
362	305	unset( $file );
		@@ -365,8 +308,10 @@
365	308
366	309	return;
367	310	}
368	311
	312	+ //add_filter('upload_mimes', 'FrmXMLController::allow_mime');
	313	+
369	314	$export_format = array(
370	315	'xml' => array(
371	316	'name' => 'XML',
372	317	'support' => 'forms',
		@@ -374,9 +319,9 @@
374	319	),
375	320	);
376	321	$export_format = apply_filters( 'frm_export_formats', $export_format );
377	322
378		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
	323	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
379	324	$file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
380	325	$file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
381	326	if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
382	327	// allow other file types to be imported
		@@ -406,11 +351,8 @@
406	351
407	352	self::form( $errors, $message );
408	353	}
409	354
410		- /**
411		- * @return void
412		- */
413	355	public static function export_xml() {
414	356	$error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
415	357	if ( ! empty( $error ) ) {
416	358	wp_die( esc_html( $error ) );
		@@ -435,16 +377,8 @@
435	377
436	378	wp_die();
437	379	}
438	380
439		- /**
440		- * @param string[] $type
441		- * @param array $args
442		- *
443		- * @psalm-param array{ids?: mixed} $args
444		- *
445		- * @return void
446		- */
447	381	public static function generate_xml( $type, $args = array() ) {
448	382	global $wpdb;
449	383
450	384	self::prepare_types_array( $type );
		@@ -478,9 +412,9 @@
478	412	$query_vars = array();
479	413
480	414	switch ( $tb_type ) {
481	415	case 'forms':
482		- // Add forms.
	416	+ //add forms
483	417	if ( $args['ids'] ) {
484	418	$where[] = array(
485	419	'or' => 1,
486	420	$table . '.id' => $args['ids'],
		@@ -538,15 +472,15 @@
538	472	$where['pm.meta_value >'] = 1;
539	473	} else {
540	474	$where['pm.meta_value'] = $args['ids'];
541	475	}
542		- }//end switch
	476	+ }
543	477
544	478	$records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
545	479	unset( $tb_type );
546		- }//end foreach
	480	+ }
547	481
548		- $filename = self::get_file_name( $args, $records );
	482	+ $filename = self::get_file_name( $args, $type, $records );
549	483
550	484	header( 'Content-Description: File Transfer' );
551	485	header( 'Content-Disposition: attachment; filename=' . $filename );
552	486	header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
		@@ -554,40 +488,16 @@
554	488	echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
555	489	include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
556	490	}
557	491
558		- /**
559		- * Returns an array that has parent term slugs for the terms provided.
560		- *
561		- * @since 6.8.3
562		- * @param array $terms
563		- * @return array
564		- */
565		- public static function get_parent_terms_slugs( $terms ) {
566		- $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
567		- $parent_slugs = array();
568		-
569		- if ( ! $parent_term_ids ) {
570		- return $parent_slugs;
571		- }
572		-
573		- $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
574		- $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
575		-
576		- return $parent_slugs;
577		- }
578		-
579		- /**
580		- * @return void
581		- */
582	492	private static function prepare_types_array( &$type ) {
583	493	$type = (array) $type;
584		- if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
	494	+ if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
585	495	// make sure the form is included if there are entries
586	496	$type[] = 'forms';
587	497	}
588	498
589		- if ( in_array( 'forms', $type, true ) ) {
	499	+ if ( in_array( 'forms', $type ) ) {
590	500	// include actions with forms
591	501	$type[] = 'actions';
592	502	}
593	503	}
		@@ -597,14 +507,14 @@
597	507	* Use the nme of the form if only one form is exported.
598	508	*
599	509	* @since 3.06
600	510	*
601		- * @param array $args
	511	+ * @param array $type
602	512	* @param array $records
603	513	* @return string
604	514	*/
605		- private static function get_file_name( $args, $records ) {
606		- $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
	515	+ private static function get_file_name( $args, $type, $records ) {
	516	+ $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
607	517	if ( $has_one_form ) {
608	518	// one form is being exported
609	519	$selected_form_id = reset( $args['ids'] );
610	520	$filename = 'form-' . $selected_form_id . '.xml';
		@@ -612,10 +522,9 @@
612	522	foreach ( $records['forms'] as $form_id ) {
613	523	$filename = 'form-' . $form_id . '.xml';
614	524	if ( $selected_form_id === $form_id ) {
615	525	$form = FrmForm::getOne( $form_id );
616		- $filename = $form->name !== '' ? $form->name : $form->form_key;
617		- $filename = sanitize_title( $filename ) . '-form.xml';
	526	+ $filename = sanitize_title( $form->name ) . '-form.xml';
618	527	break;
619	528	}
620	529	}
621	530	} else {
		@@ -624,9 +533,9 @@
624	533	if ( ! empty( $sitename ) ) {
625	534	$sitename .= '.';
626	535	}
627	536	$filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
628		- }//end if
	537	+ }
629	538
630	539	/**
631	540	* @since 5.3
632	541	*
		@@ -634,13 +543,8 @@
634	543	*/
635	544	return apply_filters( 'frm_xml_filename', $filename );
636	545	}
637	546
638		- /**
639		- * @param array $atts
640		- *
641		- * @return void
642		- */
643	547	public static function generate_csv( $atts ) {
644	548	$form_ids = $atts['ids'];
645	549	if ( empty( $form_ids ) ) {
646	550	wp_die( esc_html__( 'Please select a form', 'formidable' ) );
		@@ -651,10 +555,8 @@
651	555	/**
652	556	* Export to CSV
653	557	*
654	558	* @since 2.0.19
655		- *
656		- * @return void
657	559	*/
658	560	public static function csv( $form_id = false, $search = '', $fid = '' ) {
659	561	FrmAppHelper::permission_check( 'frm_view_entries' );
660	562
		@@ -663,12 +565,9 @@
663	565	$search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
664	566	$fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
665	567	}
666	568
667		- // Remove time limit to execute this function.
668		- if ( function_exists( 'set_time_limit' ) ) {
669		- set_time_limit( 0 );
670		- }
	569	+ set_time_limit( 0 ); //Remove time limit to execute this function
671	570	$mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
672	571	if ( (int) $mem_limit < 256 ) {
673	572	wp_raise_memory_limit();
674	573	}
		@@ -723,9 +622,9 @@
723	622	*
724	623	* @since 2.0.19
725	624	* @since 5.0.16 function went from private to public.
726	625	*
727		- * @param int $form_id
	626	+ * @param int $form_id
728	627	* @param object $form
729	628	*
730	629	* @return array $csv_fields
731	630	*/