PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.0
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.0
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +36 -164 6.266.0 View file →
@@ -4,21 +4,15 @@
4 4 }
5 5
6 6 class FrmXMLController {
7 7
8 - /**
9 - * @return void
10 - */
11 8 public static function menu() {
12 9 add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13 10 }
14 11
15 - /**
16 - * @return void
17 - */
18 12 public static function add_default_templates() {
19 13 if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20 - // XML import is not enabled on your server.
14 + // XML import is not enabled on your server
21 15 return;
22 16 }
23 17
24 18 $set_err = libxml_use_internal_errors( true );
@@ -40,9 +34,8 @@
40 34 /**
41 35 * Use the template link to install the XML template
42 36 *
43 37 * @since 3.06
44 - *
45 38 * @return void
46 39 */
47 40 public static function install_template() {
48 41 FrmAppHelper::permission_check( 'frm_edit_forms' );
@@ -82,9 +75,8 @@
82 75
83 76 self::set_new_form_name( $xml );
84 77
85 78 $imported = FrmXMLHelper::import_xml_now( $xml, true );
86 -
87 79 if ( ! empty( $imported['form_status'] ) ) {
88 80 // Get the last form id in case there are child forms.
89 81 end( $imported['form_status'] );
90 82 $form_id = key( $imported['form_status'] );
@@ -89,12 +81,11 @@
89 81 end( $imported['form_status'] );
90 82 $form_id = key( $imported['form_status'] );
91 83 $response = array(
92 84 'id' => $form_id,
93 - 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
85 + 'redirect' => FrmForm::get_edit_link( $form_id ),
94 86 'success' => 1,
95 87 );
96 -
97 88 if ( ! empty( $imported['imported']['posts'] ) ) {
98 89 // Return the link to the last page created.
99 90 $pages = $imported['posts'];
100 91 }
@@ -103,10 +94,10 @@
103 94 // Create selected pages with the correct shortcodes.
104 95 $pages = self::create_pages_for_import( $form );
105 96 }
106 97
107 - if ( ! empty( $pages ) ) {
108 - $post_id = end( $pages );
98 + if ( isset( $pages ) && ! empty( $pages ) ) {
99 + $post_id = end( $pages );
109 100 $response['redirect'] = get_permalink( $post_id );
110 101 }
111 102 } else {
112 103 if ( isset( $imported['error'] ) ) {
@@ -113,19 +104,15 @@
113 104 $message = $imported['error'];
114 105 } else {
115 106 $message = __( 'There was an error importing form', 'formidable' );
116 107 }
117 -
118 108 $response = array(
119 109 'message' => $message,
120 110 );
121 111
122 - }//end if
112 + }
123 113
124 - /**
125 - * @since 6.18 Added `url` to the $args.
126 - */
127 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
114 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
128 115
129 116 echo wp_json_encode( $response );
130 117 wp_die();
131 118 }
@@ -134,9 +121,8 @@
134 121 * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
135 122 * This is to make sure that the URL can't be exploited for a SSRF attack.
136 123 *
137 124 * @since 5.5.5
138 - *
139 125 * @param string $url
140 126 *
141 127 * @return bool True on success, False on error.
142 128 */
@@ -150,13 +136,11 @@
150 136 * @return mixed
151 137 */
152 138 private static function get_posted_form() {
153 139 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
154 -
155 140 if ( empty( $form ) ) {
156 141 return $form;
157 142 }
158 -
159 143 $form = json_decode( $form, true );
160 144 return $form;
161 145 }
162 146
@@ -163,23 +147,16 @@
163 147 /**
164 148 * Get a different URL depending on the selection in the form.
165 149 *
166 150 * @since 4.06.02
167 - *
168 - * @param array $form The posted form values.
169 - * @param string $url The URL to override.
170 - *
171 - * @return void
172 151 */
173 152 private static function override_url( $form, &$url ) {
174 153 $selected_form = self::get_selected_in_form( $form, 'form' );
175 -
176 154 if ( empty( $selected_form ) ) {
177 155 return;
178 156 }
179 157
180 - $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
181 -
158 + $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
182 159 if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
183 160 return;
184 161 }
185 162
@@ -187,16 +164,11 @@
187 164 }
188 165
189 166 /**
190 167 * @since 4.06.02
191 - *
192 - * @param array $form
193 - * @param string $value
194 - *
195 - * @return string
196 168 */
197 169 private static function get_selected_in_form( $form, $value = 'form' ) {
198 - if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
170 + if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
199 171 return $form[ $value ];
200 172 }
201 173
202 174 return '';
@@ -206,20 +178,19 @@
206 178 * @since 4.06.02
207 179 *
208 180 * @param array $form The posted form values.
209 181 *
210 - * @return array|null The array of created pages.
182 + * @return array The array of created pages.
211 183 */
212 184 private static function create_pages_for_import( $form ) {
213 - if ( empty( $form['pages'] ) ) {
214 - return null;
185 + if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
186 + return;
215 187 }
216 188
217 - $form_key = self::get_selected_in_form( $form, 'form' );
189 + $form_key = self::get_selected_in_form( $form, 'form' );
218 190 $view_keys = self::get_selected_in_form( $form, 'view' );
219 191
220 192 $page_ids = array();
221 -
222 193 foreach ( (array) $form['pages'] as $for => $name ) {
223 194 if ( empty( $name ) ) {
224 195 // Don't create a page if no title is given.
225 196 continue;
@@ -228,9 +199,9 @@
228 199 if ( $for === 'view' ) {
229 200 $item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
230 201 $shortcode = '[display-frm-data id=%1$s filter=limited]';
231 202 } elseif ( $for === 'form' ) {
232 - $item_key = $form_key;
203 + $item_key = $form_key;
233 204 $shortcode = '[formidable id=%1$s]';
234 205 } else {
235 206 $item_key = self::get_selected_in_form( $form, 'form' );
236 207 $shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
@@ -247,9 +218,9 @@
247 218 'post_type' => 'page',
248 219 'post_content' => sprintf( $shortcode, $item_key ),
249 220 )
250 221 );
251 - }//end foreach
222 + }
252 223
253 224 return $page_ids;
254 225 }
255 226
@@ -260,9 +231,8 @@
260 231 *
261 232 * @since 3.06
262 233 *
263 234 * @param object $xml The values included in the XML.
264 - *
265 235 * @return void
266 236 */
267 237 private static function set_new_form_name( &$xml ) {
268 238 if ( ! isset( $xml->form ) ) {
@@ -270,9 +240,8 @@
270 240 }
271 241
272 242 $name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
273 243 $description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
274 -
275 244 if ( ! $name && ! $description ) {
276 245 return;
277 246 }
278 247
@@ -277,9 +246,8 @@
277 246 }
278 247
279 248 // Get the main form ID.
280 249 $set_name = 0;
281 -
282 250 foreach ( $xml->form as $form ) {
283 251 if ( empty( $form->parent_form_id ) ) {
284 252 $set_name = (int) $form->id;
285 253 }
@@ -297,11 +265,8 @@
297 265 $form->form_key = FrmAppHelper::get_unique_key( $sanitized_form_name, 'frm_forms', 'form_key' );
298 266 }
299 267 }
300 268
301 - /**
302 - * @return void
303 - */
304 269 public static function route() {
305 270 $action = isset( $_REQUEST['frm_action'] ) ? 'frm_action' : 'action';
306 271 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
307 272 FrmAppHelper::include_svg();
@@ -306,25 +271,19 @@
306 271 $action = FrmAppHelper::get_param( $action, '', 'get', 'sanitize_title' );
307 272 FrmAppHelper::include_svg();
308 273
309 274 if ( 'import_xml' === $action ) {
310 - self::import_xml();
275 + return self::import_xml();
311 276 } elseif ( 'export_xml' === $action ) {
312 - self::export_xml();
277 + return self::export_xml();
313 278 } elseif ( apply_filters( 'frm_xml_route', true, $action ) ) {
314 - self::form();
279 + return self::form();
315 280 }
316 281 }
317 282
318 - /**
319 - * @param string[] $errors
320 - * @param string $message
321 - *
322 - * @return void
323 - */
324 283 public static function form( $errors = array(), $message = '' ) {
325 284 $where = array(
326 - 'status' => array( null, '', 'published' ),
285 + 'status' => array( null, '', 'published' ),
327 286 );
328 287 $forms = FrmForm::getAll( $where, 'name' );
329 288
330 289 $export_types = array(
@@ -346,20 +305,16 @@
346 305 ),
347 306 );
348 307 $export_format = apply_filters( 'frm_export_formats', $export_format );
349 308
350 - include FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php';
309 + include( FrmAppHelper::plugin_path() . '/classes/views/xml/import_form.php' );
351 310 }
352 311
353 - /**
354 - * @return void
355 - */
356 312 public static function import_xml() {
357 313 $errors = array();
358 314 $message = '';
359 315
360 316 $permission_error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'import-xml', 'import-xml-nonce' );
361 -
362 317 if ( false !== $permission_error ) {
363 318 $errors[] = $permission_error;
364 319 self::form( $errors );
365 320
@@ -365,11 +320,9 @@
365 320
366 321 return;
367 322 }
368 323
369 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
370 - $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
371 -
324 + $has_file = isset( $_FILES ) && isset( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
372 325 if ( ! $has_file ) {
373 326 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
374 327 self::form( $errors );
375 328
@@ -375,9 +328,9 @@
375 328
376 329 return;
377 330 }
378 331
379 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
332 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
380 333 $file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
381 334
382 335 if ( ! is_uploaded_file( $file ) ) {
383 336 unset( $file );
@@ -386,8 +339,10 @@
386 339
387 340 return;
388 341 }
389 342
343 + //add_filter('upload_mimes', 'FrmXMLController::allow_mime');
344 +
390 345 $export_format = array(
391 346 'xml' => array(
392 347 'name' => 'XML',
393 348 'support' => 'forms',
@@ -395,12 +350,11 @@
395 350 ),
396 351 );
397 352 $export_format = apply_filters( 'frm_export_formats', $export_format );
398 353
399 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
354 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
400 355 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
401 356 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
402 -
403 357 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
404 358 // allow other file types to be imported
405 359 do_action( 'frm_before_import_' . $file_type );
406 360
@@ -428,14 +382,10 @@
428 382
429 383 self::form( $errors, $message );
430 384 }
431 385
432 - /**
433 - * @return void
434 - */
435 386 public static function export_xml() {
436 387 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
437 -
438 388 if ( ! empty( $error ) ) {
439 389 wp_die( esc_html( $error ) );
440 390 }
441 391
@@ -458,28 +408,13 @@
458 408
459 409 wp_die();
460 410 }
461 411
462 - /**
463 - * @param array<string>|string $type
464 - * @param array $args
465 - *
466 - * @psalm-param array{ids?: mixed} $args
467 - *
468 - * @return void
469 - */
470 412 public static function generate_xml( $type, $args = array() ) {
471 413 global $wpdb;
472 414
473 415 self::prepare_types_array( $type );
474 416
475 - if ( ! is_array( $type ) ) {
476 - // This shouldn't be possible.
477 - // It is cast to array in prepare_types_array.
478 - // This is just for static analysis.
479 - return;
480 - }
481 -
482 417 $tables = array(
483 418 'items' => $wpdb->prefix . 'frm_items',
484 419 'forms' => $wpdb->prefix . 'frm_forms',
485 420 'posts' => $wpdb->posts,
@@ -508,9 +443,9 @@
508 443 $query_vars = array();
509 444
510 445 switch ( $tb_type ) {
511 446 case 'forms':
512 - // Add forms.
447 + //add forms
513 448 if ( $args['ids'] ) {
514 449 $where[] = array(
515 450 'or' => 1,
516 451 $table . '.id' => $args['ids'],
@@ -522,9 +457,8 @@
522 457 break;
523 458 case 'actions':
524 459 $select = $table . '.ID';
525 460 $where['post_type'] = FrmFormActionsController::$action_post_type;
526 -
527 461 if ( ! empty( $args['ids'] ) ) {
528 462 $where['menu_order'] = $args['ids'];
529 463 }
530 464 break;
@@ -539,12 +473,10 @@
539 473 $frm_style = new FrmStyle();
540 474 $default_style = $frm_style->get_default_style();
541 475 $form_ids = $args['ids'];
542 476 $style_ids = array();
543 -
544 477 foreach ( $form_ids as $form_id ) {
545 478 $form_data = FrmForm::getOne( $form_id );
546 -
547 479 // For forms that have not been updated while running 2.0, check if custom_style is set.
548 480 if ( isset( $form_data->options['custom_style'] ) ) {
549 481 if ( 1 === absint( $form_data->options['custom_style'] ) ) {
550 482 $style_ids[] = $default_style->ID;
@@ -553,9 +485,8 @@
553 485 }
554 486 }
555 487 unset( $form_id, $form_data );
556 488 }
557 -
558 489 $select = $table . '.ID';
559 490 $where['post_type'] = 'frm_styles';
560 491
561 492 // Only export selected styles.
@@ -572,15 +503,15 @@
572 503 $where['pm.meta_value >'] = 1;
573 504 } else {
574 505 $where['pm.meta_value'] = $args['ids'];
575 506 }
576 - }//end switch
507 + }
577 508
578 509 $records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
579 510 unset( $tb_type );
580 - }//end foreach
511 + }
581 512
582 - $filename = self::get_file_name( $args, $records );
513 + $filename = self::get_file_name( $args, $type, $records );
583 514
584 515 header( 'Content-Description: File Transfer' );
585 516 header( 'Content-Disposition: attachment; filename=' . $filename );
586 517 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
@@ -588,47 +519,16 @@
588 519 echo '<?xml version="1.0" encoding="' . esc_attr( get_bloginfo( 'charset' ) ) . "\" ?>\n";
589 520 include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
590 521 }
591 522
592 - /**
593 - * Returns an array that has parent term slugs for the terms provided.
594 - *
595 - * @since 6.8.3
596 - *
597 - * @param array $terms
598 - *
599 - * @return array
600 - */
601 - public static function get_parent_terms_slugs( $terms ) {
602 - $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
603 - $parent_slugs = array();
604 -
605 - if ( ! $parent_term_ids ) {
606 - return $parent_slugs;
607 - }
608 -
609 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
610 - $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
611 -
612 - return $parent_slugs;
613 - }
614 -
615 - /**
616 - * Prepare the types array.
617 - *
618 - * @param array<string>|string $type
619 - *
620 - * @return void
621 - */
622 523 private static function prepare_types_array( &$type ) {
623 524 $type = (array) $type;
624 -
625 - if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
525 + if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
626 526 // make sure the form is included if there are entries
627 527 $type[] = 'forms';
628 528 }
629 529
630 - if ( in_array( 'forms', $type, true ) ) {
530 + if ( in_array( 'forms', $type ) ) {
631 531 // include actions with forms
632 532 $type[] = 'actions';
633 533 }
634 534 }
@@ -638,16 +538,14 @@
638 538 * Use the nme of the form if only one form is exported.
639 539 *
640 540 * @since 3.06
641 541 *
642 - * @param array $args
542 + * @param array $type
643 543 * @param array $records
644 - *
645 544 * @return string
646 545 */
647 - private static function get_file_name( $args, $records ) {
648 - $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
649 -
546 + private static function get_file_name( $args, $type, $records ) {
547 + $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
650 548 if ( $has_one_form ) {
651 549 // one form is being exported
652 550 $selected_form_id = reset( $args['ids'] );
653 551 $filename = 'form-' . $selected_form_id . '.xml';
@@ -653,9 +551,8 @@
653 551 $filename = 'form-' . $selected_form_id . '.xml';
654 552
655 553 foreach ( $records['forms'] as $form_id ) {
656 554 $filename = 'form-' . $form_id . '.xml';
657 -
658 555 if ( $selected_form_id === $form_id ) {
659 556 $form = FrmForm::getOne( $form_id );
660 557 $filename = $form->name !== '' ? $form->name : $form->form_key;
661 558 $filename = sanitize_title( $filename ) . '-form.xml';
@@ -667,11 +564,10 @@
667 564
668 565 if ( ! empty( $sitename ) ) {
669 566 $sitename .= '.';
670 567 }
671 -
672 568 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
673 - }//end if
569 + }
674 570
675 571 /**
676 572 * @since 5.3
677 573 *
@@ -679,16 +575,10 @@
679 575 */
680 576 return apply_filters( 'frm_xml_filename', $filename );
681 577 }
682 578
683 - /**
684 - * @param array $atts
685 - *
686 - * @return void
687 - */
688 579 public static function generate_csv( $atts ) {
689 580 $form_ids = $atts['ids'];
690 -
691 581 if ( empty( $form_ids ) ) {
692 582 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
693 583 }
694 584 self::csv( reset( $form_ids ) );
@@ -697,14 +587,8 @@
697 587 /**
698 588 * Export to CSV
699 589 *
700 590 * @since 2.0.19
701 - *
702 - * @param false|int|string $form_id
703 - * @param string $search
704 - * @param string $fid
705 - *
706 - * @return void
707 591 */
708 592 public static function csv( $form_id = false, $search = '', $fid = '' ) {
709 593 FrmAppHelper::permission_check( 'frm_view_entries' );
710 594
@@ -713,15 +597,10 @@
713 597 $search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
714 598 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
715 599 }
716 600
717 - // Remove time limit to execute this function.
718 - if ( function_exists( 'set_time_limit' ) ) {
719 - set_time_limit( 0 );
720 - }
721 -
601 + set_time_limit( 0 ); //Remove time limit to execute this function
722 602 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
723 -
724 603 if ( (int) $mem_limit < 256 ) {
725 604 wp_raise_memory_limit();
726 605 }
727 606
@@ -737,9 +616,8 @@
737 616 $form_id = $form->id;
738 617 $form_cols = self::get_fields_for_csv_export( $form_id, $form );
739 618
740 619 $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
741 -
742 620 if ( ! empty( $item_id ) ) {
743 621 $item_id = explode( ',', $item_id );
744 622 }
745 623
@@ -776,9 +654,9 @@
776 654 *
777 655 * @since 2.0.19
778 656 * @since 5.0.16 function went from private to public.
779 657 *
780 - * @param int $form_id
658 + * @param int $form_id
781 659 * @param object $form
782 660 *
783 661 * @return array $csv_fields
784 662 */
@@ -784,9 +662,8 @@
784 662 */
785 663 public static function get_fields_for_csv_export( $form_id, $form ) {
786 664 $csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
787 665 $no_export_fields = FrmField::no_save_fields();
788 -
789 666 foreach ( $csv_fields as $k => $f ) {
790 667 if ( in_array( $f->type, $no_export_fields, true ) ) {
791 668 unset( $csv_fields[ $k ] );
792 669 }
@@ -794,13 +671,8 @@
794 671
795 672 return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
796 673 }
797 674
798 - /**
799 - * @param array $mimes
800 - *
801 - * @return array
802 - */
803 675 public static function allow_mime( $mimes ) {
804 676 if ( ! isset( $mimes['csv'] ) ) {
805 677 // allow csv files
806 678 $mimes['csv'] = 'text/csv';