← All changes | classes/controllers/FrmXMLController.php +8 -85 6.3 → 5.4 View file →

		@@ -4,18 +4,12 @@
4	4	}
5	5
6	6	class FrmXMLController {
7	7
8		- /**
9		- * @return void
10		- */
11	8	public static function menu() {
12	9	add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13	10	}
14	11
15		- /**
16		- * @return void
17		- */
18	12	public static function add_default_templates() {
19	13	if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20	14	// XML import is not enabled on your server
21	15	return;
		@@ -40,34 +34,18 @@
40	34	/**
41	35	* Use the template link to install the XML template
42	36	*
43	37	* @since 3.06
44		- * @return void
45	38	*/
46	39	public static function install_template() {
47	40	FrmAppHelper::permission_check( 'frm_edit_forms' );
48	41	check_ajax_referer( 'frm_ajax', 'nonce' );
49	42
50		- if ( ! function_exists( 'simplexml_load_string' ) ) {
51		- $response = array(
52		- 'message' => __( 'Your server is missing the Simple XML extension. This is required to install a template.', 'formidable' ),
53		- );
54		- echo wp_json_encode( $response );
55		- wp_die();
56		- }
	43	+ $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
57	44
58	45	$form = self::get_posted_form();
59		- $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60	46	self::override_url( $form, $url );
61	47
62		- if ( ! self::validate_xml_url( $url ) ) {
63		- $response = array(
64		- 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65		- );
66		- echo wp_json_encode( $response );
67		- wp_die();
68		- }
69		-
70	48	$response = wp_remote_get( $url );
71	49	$body = wp_remote_retrieve_body( $response );
72	50	$xml = simplexml_load_string( $body );
73	51
		@@ -72,9 +50,9 @@
72	50	$xml = simplexml_load_string( $body );
73	51
74	52	if ( ! $xml ) {
75	53	$response = array(
76		- 'message' => __( 'There was an error reading the form template.', 'formidable' ),
	54	+ 'message' => __( 'There was an error reading the form template', 'formidable' ),
77	55	);
78	56	echo wp_json_encode( $response );
79	57	wp_die();
80	58	}
		@@ -123,24 +101,9 @@
123	101	wp_die();
124	102	}
125	103
126	104	/**
127		- * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
128		- * This is to make sure that the URL can't be exploited for a SSRF attack.
129		- *
130		- * @since 5.5.5
131		- * @param string $url
132		- *
133		- * @return bool True on success, False on error.
134		- */
135		- private static function validate_xml_url( $url ) {
136		- return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
137		- }
138		-
139		- /**
140	105	* @since 4.06.02
141		- *
142		- * @return mixed
143	106	*/
144	107	private static function get_posted_form() {
145	108	$form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
146	109	if ( empty( $form ) ) {
		@@ -153,10 +116,8 @@
153	116	/**
154	117	* Get a different URL depending on the selection in the form.
155	118	*
156	119	* @since 4.06.02
157		- *
158		- * @return void
159	120	*/
160	121	private static function override_url( $form, &$url ) {
161	122	$selected_form = self::get_selected_in_form( $form, 'form' );
162	123	if ( empty( $selected_form ) ) {
		@@ -172,11 +133,8 @@
172	133	}
173	134
174	135	/**
175	136	* @since 4.06.02
176		- *
177		- * @param string $value
178		- * @param array $form
179	137	*/
180	138	private static function get_selected_in_form( $form, $value = 'form' ) {
181	139	if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
182	140	return $form[ $value ];
		@@ -276,11 +234,8 @@
276	234	$form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
277	235	}
278	236	}
279	237
280		- /**
281		- * @return void
282		- */
283	238	public static function route() {
284	239	$action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
285	240	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	241	FrmAppHelper::include_svg();
		@@ -285,25 +240,19 @@
285	240	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	241	FrmAppHelper::include_svg();
287	242
288	243	if ( 'import_xml' === $action ) {
289		- self::import_xml();
	244	+ return self::import_xml();
290	245	} elseif ( 'export_xml' === $action ) {
291		- self::export_xml();
	246	+ return self::export_xml();
292	247	} elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
293		- self::form();
	248	+ return self::form();
294	249	}
295	250	}
296	251
297		- /**
298		- * @param string[] $errors
299		- * @param string $message
300		- *
301		- * @return void
302		- */
303	252	public static function form( $errors = array(), $message = '' ) {
304	253	$where = array(
305		- 'status' => array( null, '', 'published' ),
	254	+ 'status' => array( null, '', 'published' ),
306	255	);
307	256	$forms = FrmForm::getAll( $where, 'name' );
308	257
309	258	$export_types = array(
		@@ -325,14 +274,11 @@
325	274	),
326	275	);
327	276	$export_format = apply_filters( 'frm_export_formats', $export_format );
328	277
329		- include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
	278	+ include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
330	279	}
331	280
332		- /**
333		- * @return void
334		- */
335	281	public static function import_xml() {
336	282	$errors = array();
337	283	$message = '';
338	284
		@@ -405,11 +351,8 @@
405	351
406	352	self::form( $errors, $message );
407	353	}
408	354
409		- /**
410		- * @return void
411		- */
412	355	public static function export_xml() {
413	356	$error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
414	357	if ( ! empty( $error ) ) {
415	358	wp_die( esc_html( $error ) );
		@@ -434,15 +377,8 @@
434	377
435	378	wp_die();
436	379	}
437	380
438		- /**
439		- * @param array $args
440		- *
441		- * @psalm-param array{ids?: mixed} $args
442		- *
443		- * @return void
444		- */
445	381	public static function generate_xml( $type, $args = array() ) {
446	382	global $wpdb;
447	383
448	384	self::prepare_types_array( $type );
		@@ -552,11 +488,8 @@
552	488	echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
553	489	include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
554	490	}
555	491
556		- /**
557		- * @return void
558		- */
559	492	private static function prepare_types_array( &$type ) {
560	493	$type = (array) $type;
561	494	if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
562	495	// make sure the form is included if there are entries
		@@ -576,10 +509,8 @@
576	509	* @since 3.06
577	510	*
578	511	* @param array $type
579	512	* @param array $records
580		- * @param array $args
581		- *
582	513	* @return string
583	514	*/
584	515	private static function get_file_name( $args, $type, $records ) {
585	516	$has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
		@@ -591,10 +522,9 @@
591	522	foreach ( $records['forms'] as $form_id ) {
592	523	$filename = 'form-' . $form_id . '.xml';
593	524	if ( $selected_form_id === $form_id ) {
594	525	$form = FrmForm::getOne( $form_id );
595		- $filename = $form->name !== '' ? $form->name : $form->form_key;
596		- $filename = sanitize_title( $filename ) . '-form.xml';
	526	+ $filename = sanitize_title( $form->name ) . '-form.xml';
597	527	break;
598	528	}
599	529	}
600	530	} else {
		@@ -613,13 +543,8 @@
613	543	*/
614	544	return apply_filters( 'frm_xml_filename', $filename );
615	545	}
616	546
617		- /**
618		- * @param array $atts
619		- *
620		- * @return void
621		- */
622	547	public static function generate_csv( $atts ) {
623	548	$form_ids = $atts['ids'];
624	549	if ( empty( $form_ids ) ) {
625	550	wp_die( esc_html__( 'Please select a form', 'formidable' ) );
		@@ -630,10 +555,8 @@
630	555	/**
631	556	* Export to CSV
632	557	*
633	558	* @since 2.0.19
634		- *
635		- * @return void
636	559	*/
637	560	public static function csv( $form_id = false, $search = '', $fid = '' ) {
638	561	FrmAppHelper::permission_check( 'frm_view_entries' );
639	562