PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 5.5.3
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v5.5.3
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +39 -131 6.255.5.3 View file →
@@ -4,21 +4,15 @@
4 4 }
5 5
6 6 class FrmXMLController {
7 7
8 - /**
9 - * @return void
10 - */
11 8 public static function menu() {
12 9 add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13 10 }
14 11
15 - /**
16 - * @return void
17 - */
18 12 public static function add_default_templates() {
19 13 if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20 - // XML import is not enabled on your server.
14 + // XML import is not enabled on your server
21 15 return;
22 16 }
23 17
24 18 $set_err = libxml_use_internal_errors( true );
@@ -54,20 +48,13 @@
54 48 echo wp_json_encode( $response );
55 49 wp_die();
56 50 }
57 51
52 + $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
53 +
58 54 $form = self::get_posted_form();
59 - $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60 55 self::override_url( $form, $url );
61 56
62 - if ( ! self::validate_xml_url( $url ) ) {
63 - $response = array(
64 - 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65 - );
66 - echo wp_json_encode( $response );
67 - wp_die();
68 - }
69 -
70 57 $response = wp_remote_get( $url );
71 58 $body = wp_remote_retrieve_body( $response );
72 59 $xml = simplexml_load_string( $body );
73 60
@@ -87,9 +74,9 @@
87 74 end( $imported['form_status'] );
88 75 $form_id = key( $imported['form_status'] );
89 76 $response = array(
90 77 'id' => $form_id,
91 - 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
78 + 'redirect' => FrmForm::get_edit_link( $form_id ),
92 79 'success' => 1,
93 80 );
94 81 if ( ! empty( $imported['imported']['posts'] ) ) {
95 82 // Return the link to the last page created.
@@ -100,10 +87,10 @@
100 87 // Create selected pages with the correct shortcodes.
101 88 $pages = self::create_pages_for_import( $form );
102 89 }
103 90
104 - if ( ! empty( $pages ) ) {
105 - $post_id = end( $pages );
91 + if ( isset( $pages ) && ! empty( $pages ) ) {
92 + $post_id = end( $pages );
106 93 $response['redirect'] = get_permalink( $post_id );
107 94 }
108 95 } else {
109 96 if ( isset( $imported['error'] ) ) {
@@ -114,14 +101,11 @@
114 101 $response = array(
115 102 'message' => $message,
116 103 );
117 104
118 - }//end if
105 + }
119 106
120 - /**
121 - * @since 6.18 Added `url` to the $args.
122 - */
123 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
107 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
124 108
125 109 echo wp_json_encode( $response );
126 110 wp_die();
127 111 }
@@ -126,24 +110,9 @@
126 110 wp_die();
127 111 }
128 112
129 113 /**
130 - * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
131 - * This is to make sure that the URL can't be exploited for a SSRF attack.
132 - *
133 - * @since 5.5.5
134 - * @param string $url
135 - *
136 - * @return bool True on success, False on error.
137 - */
138 - private static function validate_xml_url( $url ) {
139 - return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
140 - }
141 -
142 - /**
143 114 * @since 4.06.02
144 - *
145 - * @return mixed
146 115 */
147 116 private static function get_posted_form() {
148 117 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
149 118 if ( empty( $form ) ) {
@@ -156,10 +125,8 @@
156 125 /**
157 126 * Get a different URL depending on the selection in the form.
158 127 *
159 128 * @since 4.06.02
160 - *
161 - * @return void
162 129 */
163 130 private static function override_url( $form, &$url ) {
164 131 $selected_form = self::get_selected_in_form( $form, 'form' );
165 132 if ( empty( $selected_form ) ) {
@@ -165,9 +132,9 @@
165 132 if ( empty( $selected_form ) ) {
166 133 return;
167 134 }
168 135
169 - $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
136 + $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
170 137 if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
171 138 return;
172 139 }
173 140
@@ -175,14 +142,11 @@
175 142 }
176 143
177 144 /**
178 145 * @since 4.06.02
179 - *
180 - * @param array $form
181 - * @param string $value
182 146 */
183 147 private static function get_selected_in_form( $form, $value = 'form' ) {
184 - if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
148 + if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
185 149 return $form[ $value ];
186 150 }
187 151
188 152 return '';
@@ -191,16 +155,17 @@
191 155 /**
192 156 * @since 4.06.02
193 157 *
194 158 * @param array $form The posted form values.
195 - * @return array|null The array of created pages.
159 + *
160 + * @return array The array of created pages.
196 161 */
197 162 private static function create_pages_for_import( $form ) {
198 - if ( empty( $form['pages'] ) ) {
199 - return null;
163 + if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
164 + return;
200 165 }
201 166
202 - $form_key = self::get_selected_in_form( $form, 'form' );
167 + $form_key = self::get_selected_in_form( $form, 'form' );
203 168 $view_keys = self::get_selected_in_form( $form, 'view' );
204 169
205 170 $page_ids = array();
206 171 foreach ( (array) $form['pages'] as $for => $name ) {
@@ -212,9 +177,9 @@
212 177 if ( $for === 'view' ) {
213 178 $item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
214 179 $shortcode = '[display-frm-data id=%1$s filter=limited]';
215 180 } elseif ( $for === 'form' ) {
216 - $item_key = $form_key;
181 + $item_key = $form_key;
217 182 $shortcode = '[formidable id=%1$s]';
218 183 } else {
219 184 $item_key = self::get_selected_in_form( $form, 'form' );
220 185 $shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
@@ -231,9 +196,9 @@
231 196 'post_type' => 'page',
232 197 'post_content' => sprintf( $shortcode, $item_key ),
233 198 )
234 199 );
235 - }//end foreach
200 + }
236 201
237 202 return $page_ids;
238 203 }
239 204
@@ -278,11 +243,8 @@
278 243 $form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
279 244 }
280 245 }
281 246
282 - /**
283 - * @return void
284 - */
285 247 public static function route() {
286 248 $action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
287 249 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288 250 FrmAppHelper::include_svg();
@@ -287,22 +249,16 @@
287 249 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
288 250 FrmAppHelper::include_svg();
289 251
290 252 if ( 'import_xml' === $action ) {
291 - self::import_xml();
253 + return self::import_xml();
292 254 } elseif ( 'export_xml' === $action ) {
293 - self::export_xml();
255 + return self::export_xml();
294 256 } elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
295 - self::form();
257 + return self::form();
296 258 }
297 259 }
298 260
299 - /**
300 - * @param string[] $errors
301 - * @param string $message
302 - *
303 - * @return void
304 - */
305 261 public static function form( $errors = array(), $message = '' ) {
306 262 $where = array(
307 263 'status' => array( null, '', 'published' ),
308 264 );
@@ -327,14 +283,11 @@
327 283 ),
328 284 );
329 285 $export_format = apply_filters( 'frm_export_formats', $export_format );
330 286
331 - include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
287 + include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
332 288 }
333 289
334 - /**
335 - * @return void
336 - */
337 290 public static function import_xml() {
338 291 $errors = array();
339 292 $message = '';
340 293
@@ -345,10 +298,9 @@
345 298
346 299 return;
347 300 }
348 301
349 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
350 - $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
302 + $has_file = isset( $_FILES ) && isset( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
351 303 if ( ! $has_file ) {
352 304 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
353 305 self::form( $errors );
354 306
@@ -354,9 +306,9 @@
354 306
355 307 return;
356 308 }
357 309
358 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
310 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
359 311 $file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
360 312
361 313 if ( ! is_uploaded_file( $file ) ) {
362 314 unset( $file );
@@ -365,8 +317,10 @@
365 317
366 318 return;
367 319 }
368 320
321 + //add_filter('upload_mimes', 'FrmXMLController::allow_mime');
322 +
369 323 $export_format = array(
370 324 'xml' => array(
371 325 'name' => 'XML',
372 326 'support' => 'forms',
@@ -374,9 +328,9 @@
374 328 ),
375 329 );
376 330 $export_format = apply_filters( 'frm_export_formats', $export_format );
377 331
378 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
332 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
379 333 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
380 334 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
381 335 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
382 336 // allow other file types to be imported
@@ -406,11 +360,8 @@
406 360
407 361 self::form( $errors, $message );
408 362 }
409 363
410 - /**
411 - * @return void
412 - */
413 364 public static function export_xml() {
414 365 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
415 366 if ( ! empty( $error ) ) {
416 367 wp_die( esc_html( $error ) );
@@ -435,16 +386,8 @@
435 386
436 387 wp_die();
437 388 }
438 389
439 - /**
440 - * @param string[] $type
441 - * @param array $args
442 - *
443 - * @psalm-param array{ids?: mixed} $args
444 - *
445 - * @return void
446 - */
447 390 public static function generate_xml( $type, $args = array() ) {
448 391 global $wpdb;
449 392
450 393 self::prepare_types_array( $type );
@@ -478,9 +421,9 @@
478 421 $query_vars = array();
479 422
480 423 switch ( $tb_type ) {
481 424 case 'forms':
482 - // Add forms.
425 + //add forms
483 426 if ( $args['ids'] ) {
484 427 $where[] = array(
485 428 'or' => 1,
486 429 $table . '.id' => $args['ids'],
@@ -538,15 +481,15 @@
538 481 $where['pm.meta_value >'] = 1;
539 482 } else {
540 483 $where['pm.meta_value'] = $args['ids'];
541 484 }
542 - }//end switch
485 + }
543 486
544 487 $records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
545 488 unset( $tb_type );
546 - }//end foreach
489 + }
547 490
548 - $filename = self::get_file_name( $args, $records );
491 + $filename = self::get_file_name( $args, $type, $records );
549 492
550 493 header( 'Content-Description: File Transfer' );
551 494 header( 'Content-Disposition: attachment; filename=' . $filename );
552 495 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
@@ -554,40 +497,16 @@
554 497 echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
555 498 include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
556 499 }
557 500
558 - /**
559 - * Returns an array that has parent term slugs for the terms provided.
560 - *
561 - * @since 6.8.3
562 - * @param array $terms
563 - * @return array
564 - */
565 - public static function get_parent_terms_slugs( $terms ) {
566 - $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
567 - $parent_slugs = array();
568 -
569 - if ( ! $parent_term_ids ) {
570 - return $parent_slugs;
571 - }
572 -
573 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
574 - $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
575 -
576 - return $parent_slugs;
577 - }
578 -
579 - /**
580 - * @return void
581 - */
582 501 private static function prepare_types_array( &$type ) {
583 502 $type = (array) $type;
584 - if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
503 + if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
585 504 // make sure the form is included if there are entries
586 505 $type[] = 'forms';
587 506 }
588 507
589 - if ( in_array( 'forms', $type, true ) ) {
508 + if ( in_array( 'forms', $type ) ) {
590 509 // include actions with forms
591 510 $type[] = 'actions';
592 511 }
593 512 }
@@ -597,14 +516,14 @@
597 516 * Use the nme of the form if only one form is exported.
598 517 *
599 518 * @since 3.06
600 519 *
601 - * @param array $args
520 + * @param array $type
602 521 * @param array $records
603 522 * @return string
604 523 */
605 - private static function get_file_name( $args, $records ) {
606 - $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
524 + private static function get_file_name( $args, $type, $records ) {
525 + $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
607 526 if ( $has_one_form ) {
608 527 // one form is being exported
609 528 $selected_form_id = reset( $args['ids'] );
610 529 $filename = 'form-' . $selected_form_id . '.xml';
@@ -612,10 +531,9 @@
612 531 foreach ( $records['forms'] as $form_id ) {
613 532 $filename = 'form-' . $form_id . '.xml';
614 533 if ( $selected_form_id === $form_id ) {
615 534 $form = FrmForm::getOne( $form_id );
616 - $filename = $form->name !== '' ? $form->name : $form->form_key;
617 - $filename = sanitize_title( $filename ) . '-form.xml';
535 + $filename = sanitize_title( $form->name ) . '-form.xml';
618 536 break;
619 537 }
620 538 }
621 539 } else {
@@ -624,9 +542,9 @@
624 542 if ( ! empty( $sitename ) ) {
625 543 $sitename .= '.';
626 544 }
627 545 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
628 - }//end if
546 + }
629 547
630 548 /**
631 549 * @since 5.3
632 550 *
@@ -634,13 +552,8 @@
634 552 */
635 553 return apply_filters( 'frm_xml_filename', $filename );
636 554 }
637 555
638 - /**
639 - * @param array $atts
640 - *
641 - * @return void
642 - */
643 556 public static function generate_csv( $atts ) {
644 557 $form_ids = $atts['ids'];
645 558 if ( empty( $form_ids ) ) {
646 559 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
@@ -651,10 +564,8 @@
651 564 /**
652 565 * Export to CSV
653 566 *
654 567 * @since 2.0.19
655 - *
656 - * @return void
657 568 */
658 569 public static function csv( $form_id = false, $search = '', $fid = '' ) {
659 570 FrmAppHelper::permission_check( 'frm_view_entries' );
660 571
@@ -663,12 +574,9 @@
663 574 $search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
664 575 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
665 576 }
666 577
667 - // Remove time limit to execute this function.
668 - if ( function_exists( 'set_time_limit' ) ) {
669 - set_time_limit( 0 );
670 - }
578 + set_time_limit( 0 ); //Remove time limit to execute this function
671 579 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
672 580 if ( (int) $mem_limit < 256 ) {
673 581 wp_raise_memory_limit();
674 582 }
@@ -723,9 +631,9 @@
723 631 *
724 632 * @since 2.0.19
725 633 * @since 5.0.16 function went from private to public.
726 634 *
727 - * @param int $form_id
635 + * @param int $form_id
728 636 * @param object $form
729 637 *
730 638 * @return array $csv_fields
731 639 */