← All changes | classes/controllers/FrmXMLController.php +8 -76 6.3.1 → 5.5.4 View file →

		@@ -4,18 +4,12 @@
4	4	}
5	5
6	6	class FrmXMLController {
7	7
8		- /**
9		- * @return void
10		- */
11	8	public static function menu() {
12	9	add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13	10	}
14	11
15		- /**
16		- * @return void
17		- */
18	12	public static function add_default_templates() {
19	13	if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20	14	// XML import is not enabled on your server
21	15	return;
		@@ -54,20 +48,13 @@
54	48	echo wp_json_encode( $response );
55	49	wp_die();
56	50	}
57	51
	52	+ $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
	53	+
58	54	$form = self::get_posted_form();
59		- $url = FrmAppHelper::get_param( 'xml', '', 'post', 'esc_url_raw' );
60	55	self::override_url( $form, $url );
61	56
62		- if ( ! self::validate_xml_url( $url ) ) {
63		- $response = array(
64		- 'message' => __( 'The template you are trying to install could not be validated.', 'formidable' ),
65		- );
66		- echo wp_json_encode( $response );
67		- wp_die();
68		- }
69		-
70	57	$response = wp_remote_get( $url );
71	58	$body = wp_remote_retrieve_body( $response );
72	59	$xml = simplexml_load_string( $body );
73	60
		@@ -123,24 +110,9 @@
123	110	wp_die();
124	111	}
125	112
126	113	/**
127		- * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
128		- * This is to make sure that the URL can't be exploited for a SSRF attack.
129		- *
130		- * @since 5.5.5
131		- * @param string $url
132		- *
133		- * @return bool True on success, False on error.
134		- */
135		- private static function validate_xml_url( $url ) {
136		- return FrmAppHelper::validate_url_is_in_s3_bucket( $url, 'xml' );
137		- }
138		-
139		- /**
140	114	* @since 4.06.02
141		- *
142		- * @return mixed
143	115	*/
144	116	private static function get_posted_form() {
145	117	$form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
146	118	if ( empty( $form ) ) {
		@@ -153,10 +125,8 @@
153	125	/**
154	126	* Get a different URL depending on the selection in the form.
155	127	*
156	128	* @since 4.06.02
157		- *
158		- * @return void
159	129	*/
160	130	private static function override_url( $form, &$url ) {
161	131	$selected_form = self::get_selected_in_form( $form, 'form' );
162	132	if ( empty( $selected_form ) ) {
		@@ -172,11 +142,8 @@
172	142	}
173	143
174	144	/**
175	145	* @since 4.06.02
176		- *
177		- * @param string $value
178		- * @param array $form
179	146	*/
180	147	private static function get_selected_in_form( $form, $value = 'form' ) {
181	148	if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
182	149	return $form[ $value ];
		@@ -276,11 +243,8 @@
276	243	$form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
277	244	}
278	245	}
279	246
280		- /**
281		- * @return void
282		- */
283	247	public static function route() {
284	248	$action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
285	249	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	250	FrmAppHelper::include_svg();
		@@ -285,25 +249,19 @@
285	249	$action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
286	250	FrmAppHelper::include_svg();
287	251
288	252	if ( 'import_xml' === $action ) {
289		- self::import_xml();
	253	+ return self::import_xml();
290	254	} elseif ( 'export_xml' === $action ) {
291		- self::export_xml();
	255	+ return self::export_xml();
292	256	} elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
293		- self::form();
	257	+ return self::form();
294	258	}
295	259	}
296	260
297		- /**
298		- * @param string[] $errors
299		- * @param string $message
300		- *
301		- * @return void
302		- */
303	261	public static function form( $errors = array(), $message = '' ) {
304	262	$where = array(
305		- 'status' => array( null, '', 'published' ),
	263	+ 'status' => array( null, '', 'published' ),
306	264	);
307	265	$forms = FrmForm::getAll( $where, 'name' );
308	266
309	267	$export_types = array(
		@@ -325,14 +283,11 @@
325	283	),
326	284	);
327	285	$export_format = apply_filters( 'frm_export_formats', $export_format );
328	286
329		- include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
	287	+ include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
330	288	}
331	289
332		- /**
333		- * @return void
334		- */
335	290	public static function import_xml() {
336	291	$errors = array();
337	292	$message = '';
338	293
		@@ -405,11 +360,8 @@
405	360
406	361	self::form( $errors, $message );
407	362	}
408	363
409		- /**
410		- * @return void
411		- */
412	364	public static function export_xml() {
413	365	$error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
414	366	if ( ! empty( $error ) ) {
415	367	wp_die( esc_html( $error ) );
		@@ -434,15 +386,8 @@
434	386
435	387	wp_die();
436	388	}
437	389
438		- /**
439		- * @param array $args
440		- *
441		- * @psalm-param array{ids?: mixed} $args
442		- *
443		- * @return void
444		- */
445	390	public static function generate_xml( $type, $args = array() ) {
446	391	global $wpdb;
447	392
448	393	self::prepare_types_array( $type );
		@@ -552,11 +497,8 @@
552	497	echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
553	498	include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
554	499	}
555	500
556		- /**
557		- * @return void
558		- */
559	501	private static function prepare_types_array( &$type ) {
560	502	$type = (array) $type;
561	503	if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
562	504	// make sure the form is included if there are entries
		@@ -576,10 +518,8 @@
576	518	* @since 3.06
577	519	*
578	520	* @param array $type
579	521	* @param array $records
580		- * @param array $args
581		- *
582	522	* @return string
583	523	*/
584	524	private static function get_file_name( $args, $type, $records ) {
585	525	$has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
		@@ -591,10 +531,9 @@
591	531	foreach ( $records['forms'] as $form_id ) {
592	532	$filename = 'form-' . $form_id . '.xml';
593	533	if ( $selected_form_id === $form_id ) {
594	534	$form = FrmForm::getOne( $form_id );
595		- $filename = $form->name !== '' ? $form->name : $form->form_key;
596		- $filename = sanitize_title( $filename ) . '-form.xml';
	535	+ $filename = sanitize_title( $form->name ) . '-form.xml';
597	536	break;
598	537	}
599	538	}
600	539	} else {
		@@ -613,13 +552,8 @@
613	552	*/
614	553	return apply_filters( 'frm_xml_filename', $filename );
615	554	}
616	555
617		- /**
618		- * @param array $atts
619		- *
620		- * @return void
621		- */
622	556	public static function generate_csv( $atts ) {
623	557	$form_ids = $atts['ids'];
624	558	if ( empty( $form_ids ) ) {
625	559	wp_die( esc_html__( 'Please select a form', 'formidable' ) );
		@@ -630,10 +564,8 @@
630	564	/**
631	565	* Export to CSV
632	566	*
633	567	* @since 2.0.19
634		- *
635		- * @return void
636	568	*/
637	569	public static function csv( $form_id = false, $search = '', $fid = '' ) {
638	570	FrmAppHelper::permission_check( 'frm_view_entries' );
639	571