PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.16
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.16
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +58 -100 6.336.16 View file →
@@ -8,9 +8,9 @@
8 8 /**
9 9 * @return void
10 10 */
11 11 public static function menu() {
12 - add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
12 + add_submenu_page( 'formidable', 'Formidable | ' . __( 'Import/Export', 'formidable' ), __( 'Import/Export', 'formidable' ), 'frm_edit_forms', 'formidable-import', 'FrmXMLController::route' );
13 13 }
14 14
15 15 /**
16 16 * @return void
@@ -22,10 +22,11 @@
22 22 }
23 23
24 24 $set_err = libxml_use_internal_errors( true );
25 25 $loader = FrmXMLHelper::maybe_libxml_disable_entity_loader( true );
26 - $files = apply_filters( 'frm_default_templates_files', array() );
27 26
27 + $files = apply_filters( 'frm_default_templates_files', array() );
28 +
28 29 foreach ( (array) $files as $file ) {
29 30 FrmXMLHelper::import_xml( $file );
30 31 unset( $file );
31 32 }
@@ -39,9 +40,8 @@
39 40 /**
40 41 * Use the template link to install the XML template
41 42 *
42 43 * @since 3.06
43 - *
44 44 * @return void
45 45 */
46 46 public static function install_template() {
47 47 FrmAppHelper::permission_check( 'frm_edit_forms' );
@@ -81,24 +81,23 @@
81 81
82 82 self::set_new_form_name( $xml );
83 83
84 84 $imported = FrmXMLHelper::import_xml_now( $xml, true );
85 -
86 85 if ( ! empty( $imported['form_status'] ) ) {
87 86 // Get the last form id in case there are child forms.
88 - $form_id = array_key_last( $imported['form_status'] );
87 + end( $imported['form_status'] );
88 + $form_id = key( $imported['form_status'] );
89 89 $response = array(
90 90 'id' => $form_id,
91 91 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
92 92 'success' => 1,
93 93 );
94 -
95 94 if ( ! empty( $imported['imported']['posts'] ) ) {
96 95 // Return the link to the last page created.
97 96 $pages = $imported['posts'];
98 97 }
99 98
100 - if ( $form ) {
99 + if ( ! empty( $form ) ) {
101 100 // Create selected pages with the correct shortcodes.
102 101 $pages = self::create_pages_for_import( $form );
103 102 }
104 103
@@ -106,18 +105,20 @@
106 105 $post_id = end( $pages );
107 106 $response['redirect'] = get_permalink( $post_id );
108 107 }
109 108 } else {
110 - $message = $imported['error'] ?? __( 'There was an error importing form', 'formidable' );
109 + if ( isset( $imported['error'] ) ) {
110 + $message = $imported['error'];
111 + } else {
112 + $message = __( 'There was an error importing form', 'formidable' );
113 + }
111 114 $response = array(
112 115 'message' => $message,
113 116 );
117 +
114 118 }//end if
115 119
116 - /**
117 - * @since 6.18 Added `url` to the $args.
118 - */
119 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
120 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
120 121
121 122 echo wp_json_encode( $response );
122 123 wp_die();
123 124 }
@@ -126,9 +127,8 @@
126 127 * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
127 128 * This is to make sure that the URL can't be exploited for a SSRF attack.
128 129 *
129 130 * @since 5.5.5
130 - *
131 131 * @param string $url
132 132 *
133 133 * @return bool True on success, False on error.
134 134 */
@@ -142,9 +142,13 @@
142 142 * @return mixed
143 143 */
144 144 private static function get_posted_form() {
145 145 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
146 - return $form ? json_decode( $form, true ) : $form;
146 + if ( empty( $form ) ) {
147 + return $form;
148 + }
149 + $form = json_decode( $form, true );
150 + return $form;
147 151 }
148 152
149 153 /**
150 154 * Get a different URL depending on the selection in the form.
@@ -150,23 +154,18 @@
150 154 * Get a different URL depending on the selection in the form.
151 155 *
152 156 * @since 4.06.02
153 157 *
154 - * @param array $form The posted form values.
155 - * @param string $url The URL to override.
156 - *
157 158 * @return void
158 159 */
159 160 private static function override_url( $form, &$url ) {
160 161 $selected_form = self::get_selected_in_form( $form, 'form' );
161 -
162 - if ( ! $selected_form ) {
162 + if ( empty( $selected_form ) ) {
163 163 return;
164 164 }
165 165
166 166 $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
167 -
168 - if ( ! $selected_xml || ! str_starts_with( $selected_xml, 'http' ) ) {
167 + if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
169 168 return;
170 169 }
171 170
172 171 $url = $selected_xml;
@@ -176,13 +175,11 @@
176 175 * @since 4.06.02
177 176 *
178 177 * @param array $form
179 178 * @param string $value
180 - *
181 - * @return array|string
182 179 */
183 180 private static function get_selected_in_form( $form, $value = 'form' ) {
184 - if ( $form && ! empty( $form[ $value ] ) ) {
181 + if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
185 182 return $form[ $value ];
186 183 }
187 184
188 185 return '';
@@ -191,9 +188,8 @@
191 188 /**
192 189 * @since 4.06.02
193 190 *
194 191 * @param array $form The posted form values.
195 - *
196 192 * @return array|null The array of created pages.
197 193 */
198 194 private static function create_pages_for_import( $form ) {
199 195 if ( empty( $form['pages'] ) ) {
@@ -201,12 +197,12 @@
201 197 }
202 198
203 199 $form_key = self::get_selected_in_form( $form, 'form' );
204 200 $view_keys = self::get_selected_in_form( $form, 'view' );
205 - $page_ids = array();
206 201
202 + $page_ids = array();
207 203 foreach ( (array) $form['pages'] as $for => $name ) {
208 - if ( ! $name ) {
204 + if ( empty( $name ) ) {
209 205 // Don't create a page if no title is given.
210 206 continue;
211 207 }
212 208
@@ -245,9 +241,8 @@
245 241 *
246 242 * @since 3.06
247 243 *
248 244 * @param object $xml The values included in the XML.
249 - *
250 245 * @return void
251 246 */
252 247 private static function set_new_form_name( &$xml ) {
253 248 if ( ! isset( $xml->form ) ) {
@@ -255,9 +250,8 @@
255 250 }
256 251
257 252 $name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
258 253 $description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
259 -
260 254 if ( ! $name && ! $description ) {
261 255 return;
262 256 }
263 257
@@ -262,9 +256,8 @@
262 256 }
263 257
264 258 // Get the main form ID.
265 259 $set_name = 0;
266 -
267 260 foreach ( $xml->form as $form ) {
268 261 if ( empty( $form->parent_form_id ) ) {
269 262 $set_name = (int) $form->id;
270 263 }
@@ -338,12 +331,12 @@
338 331 /**
339 332 * @return void
340 333 */
341 334 public static function import_xml() {
342 - $errors = array();
343 - $message = '';
335 + $errors = array();
336 + $message = '';
337 +
344 338 $permission_error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'import-xml', 'import-xml-nonce' );
345 -
346 339 if ( false !== $permission_error ) {
347 340 $errors[] = $permission_error;
348 341 self::form( $errors );
349 342
@@ -349,11 +342,10 @@
349 342
350 343 return;
351 344 }
352 345
353 - // phpcs:ignore WordPress.Security.NonceVerification.Missing, SlevomatCodingStandard.Files.LineLength.LineTooLong
346 + // phpcs:ignore WordPress.Security.NonceVerification.Missing
354 347 $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
355 -
356 348 if ( ! $has_file ) {
357 349 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
358 350 self::form( $errors );
359 351
@@ -382,11 +374,10 @@
382 374
383 375 // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
384 376 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
385 377 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
386 -
387 378 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
388 - // Allow other file types to be imported
379 + // allow other file types to be imported
389 380 do_action( 'frm_before_import_' . $file_type );
390 381
391 382 return;
392 383 }
@@ -400,9 +391,10 @@
400 391 }
401 392
402 393 $set_err = libxml_use_internal_errors( true );
403 394 $loader = FrmXMLHelper::maybe_libxml_disable_entity_loader( true );
404 - $result = FrmXMLHelper::import_xml( $file );
395 +
396 + $result = FrmXMLHelper::import_xml( $file );
405 397 FrmXMLHelper::parse_message( $result, $message, $errors );
406 398
407 399 unset( $file );
408 400
@@ -416,10 +408,9 @@
416 408 * @return void
417 409 */
418 410 public static function export_xml() {
419 411 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
420 -
421 - if ( $error ) {
412 + if ( ! empty( $error ) ) {
422 413 wp_die( esc_html( $error ) );
423 414 }
424 415
425 416 $ids = FrmAppHelper::get_post_param( 'frm_export_forms', array(), 'sanitize_text_field' );
@@ -426,9 +417,9 @@
426 417 $type = FrmAppHelper::get_post_param( 'type', array(), 'sanitize_text_field' );
427 418 $format = FrmAppHelper::get_post_param( 'format', 'xml', 'sanitize_title' );
428 419
429 420 if ( ! headers_sent() && ! $type ) {
430 - wp_safe_redirect( esc_url_raw( admin_url( 'admin.php?page=formidable-import' ) ) );
421 + wp_redirect( esc_url_raw( admin_url( 'admin.php?page=formidable-import' ) ) );
431 422 die();
432 423 }
433 424
434 425 if ( 'xml' === $format ) {
@@ -442,27 +433,20 @@
442 433 wp_die();
443 434 }
444 435
445 436 /**
446 - * @param array<string>|string $type
447 - * @param array $args
437 + * @param string[] $type
438 + * @param array $args
448 439 *
449 440 * @psalm-param array{ids?: mixed} $args
450 441 *
451 442 * @return void
452 443 */
453 - public static function generate_xml( $type, $args = array() ) { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
444 + public static function generate_xml( $type, $args = array() ) {
454 445 global $wpdb;
455 446
456 447 self::prepare_types_array( $type );
457 448
458 - if ( ! is_array( $type ) ) {
459 - // This shouldn't be possible.
460 - // It is cast to array in prepare_types_array.
461 - // This is just for static analysis.
462 - return;
463 - }
464 -
465 449 $tables = array(
466 450 'items' => $wpdb->prefix . 'frm_items',
467 451 'forms' => $wpdb->prefix . 'frm_forms',
468 452 'posts' => $wpdb->posts,
@@ -475,9 +459,9 @@
475 459 );
476 460 $args = wp_parse_args( $args, $defaults );
477 461
478 462 // Make sure ids are numeric.
479 - if ( is_array( $args['ids'] ) && $args['ids'] ) {
463 + if ( is_array( $args['ids'] ) && ! empty( $args['ids'] ) ) {
480 464 $args['ids'] = array_filter( $args['ids'], 'is_numeric' );
481 465 }
482 466
483 467 $records = array();
@@ -482,11 +466,12 @@
482 466
483 467 $records = array();
484 468
485 469 foreach ( $type as $tb_type ) {
486 - $where = array();
487 - $join = '';
488 - $table = $tables[ $tb_type ];
470 + $where = array();
471 + $join = '';
472 + $table = $tables[ $tb_type ];
473 +
489 474 $select = $table . '.id';
490 475 $query_vars = array();
491 476
492 477 switch ( $tb_type ) {
@@ -504,9 +489,8 @@
504 489 break;
505 490 case 'actions':
506 491 $select = $table . '.ID';
507 492 $where['post_type'] = FrmFormActionsController::$action_post_type;
508 -
509 493 if ( ! empty( $args['ids'] ) ) {
510 494 $where['menu_order'] = $args['ids'];
511 495 }
512 496 break;
@@ -521,12 +505,10 @@
521 505 $frm_style = new FrmStyle();
522 506 $default_style = $frm_style->get_default_style();
523 507 $form_ids = $args['ids'];
524 508 $style_ids = array();
525 -
526 509 foreach ( $form_ids as $form_id ) {
527 510 $form_data = FrmForm::getOne( $form_id );
528 -
529 511 // For forms that have not been updated while running 2.0, check if custom_style is set.
530 512 if ( isset( $form_data->options['custom_style'] ) ) {
531 513 if ( 1 === absint( $form_data->options['custom_style'] ) ) {
532 514 $style_ids[] = $default_style->ID;
@@ -535,14 +517,13 @@
535 517 }
536 518 }
537 519 unset( $form_id, $form_data );
538 520 }
539 -
540 521 $select = $table . '.ID';
541 522 $where['post_type'] = 'frm_styles';
542 523
543 524 // Only export selected styles.
544 - if ( $style_ids ) {
525 + if ( ! empty( $style_ids ) ) {
545 526 $where['ID'] = $style_ids;
546 527 }
547 528 break;
548 529 default:
@@ -574,11 +555,9 @@
574 555 /**
575 556 * Returns an array that has parent term slugs for the terms provided.
576 557 *
577 558 * @since 6.8.3
578 - *
579 559 * @param array $terms
580 - *
581 560 * @return array
582 561 */
583 562 public static function get_parent_terms_slugs( $terms ) {
584 563 $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
@@ -587,30 +566,26 @@
587 566 if ( ! $parent_term_ids ) {
588 567 return $parent_slugs;
589 568 }
590 569
591 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
570 + $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
571 + $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
592 572
593 - return wp_list_pluck( $results, 'slug', 'term_id' );
573 + return $parent_slugs;
594 574 }
595 575
596 576 /**
597 - * Prepare the types array.
598 - *
599 - * @param array<string>|string $type
600 - *
601 577 * @return void
602 578 */
603 579 private static function prepare_types_array( &$type ) {
604 580 $type = (array) $type;
605 -
606 581 if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
607 - // Make sure the form is included if there are entries
582 + // make sure the form is included if there are entries
608 583 $type[] = 'forms';
609 584 }
610 585
611 586 if ( in_array( 'forms', $type, true ) ) {
612 - // Include actions with forms
587 + // include actions with forms
613 588 $type[] = 'actions';
614 589 }
615 590 }
616 591
@@ -621,22 +596,19 @@
621 596 * @since 3.06
622 597 *
623 598 * @param array $args
624 599 * @param array $records
625 - *
626 600 * @return string
627 601 */
628 602 private static function get_file_name( $args, $records ) {
629 603 $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
630 -
631 604 if ( $has_one_form ) {
632 - // One form is being exported
605 + // one form is being exported
633 606 $selected_form_id = reset( $args['ids'] );
634 607 $filename = 'form-' . $selected_form_id . '.xml';
635 608
636 609 foreach ( $records['forms'] as $form_id ) {
637 610 $filename = 'form-' . $form_id . '.xml';
638 -
639 611 if ( $selected_form_id === $form_id ) {
640 612 $form = FrmForm::getOne( $form_id );
641 613 $filename = $form->name !== '' ? $form->name : $form->form_key;
642 614 $filename = sanitize_title( $filename ) . '-form.xml';
@@ -645,12 +617,11 @@
645 617 }
646 618 } else {
647 619 $sitename = sanitize_key( get_bloginfo( 'name' ) );
648 620
649 - if ( $sitename ) {
621 + if ( ! empty( $sitename ) ) {
650 622 $sitename .= '.';
651 623 }
652 -
653 624 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
654 625 }//end if
655 626
656 627 /**
@@ -667,10 +638,9 @@
667 638 * @return void
668 639 */
669 640 public static function generate_csv( $atts ) {
670 641 $form_ids = $atts['ids'];
671 -
672 - if ( ! $form_ids ) {
642 + if ( empty( $form_ids ) ) {
673 643 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
674 644 }
675 645 self::csv( reset( $form_ids ) );
676 646 }
@@ -679,12 +649,8 @@
679 649 * Export to CSV
680 650 *
681 651 * @since 2.0.19
682 652 *
683 - * @param false|int|string $form_id
684 - * @param string $search
685 - * @param string $fid
686 - *
687 653 * @return void
688 654 */
689 655 public static function csv( $form_id = false, $search = '', $fid = '' ) {
690 656 FrmAppHelper::permission_check( 'frm_view_entries' );
@@ -690,9 +656,9 @@
690 656 FrmAppHelper::permission_check( 'frm_view_entries' );
691 657
692 658 if ( ! $form_id ) {
693 659 $form_id = FrmAppHelper::get_param( 'form', '', 'get', 'sanitize_text_field' );
694 - $search = FrmAppHelper::get_param( isset( $_REQUEST['s'] ) ? 's' : 'search', '', 'get', 'sanitize_text_field' );
660 + $search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
695 661 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
696 662 }
697 663
698 664 // Remove time limit to execute this function.
@@ -698,11 +664,9 @@
698 664 // Remove time limit to execute this function.
699 665 if ( function_exists( 'set_time_limit' ) ) {
700 666 set_time_limit( 0 );
701 667 }
702 -
703 668 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
704 -
705 669 if ( (int) $mem_limit < 256 ) {
706 670 wp_raise_memory_limit();
707 671 }
708 672
@@ -716,11 +680,11 @@
716 680 }
717 681
718 682 $form_id = $form->id;
719 683 $form_cols = self::get_fields_for_csv_export( $form_id, $form );
720 - $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
721 684
722 - if ( $item_id ) {
685 + $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
686 + if ( ! empty( $item_id ) ) {
723 687 $item_id = explode( ',', $item_id );
724 688 }
725 689
726 690 $query = array(
@@ -741,12 +705,12 @@
741 705
742 706 $entry_ids = FrmDb::get_col( $wpdb->prefix . 'frm_items it', $query );
743 707 unset( $query );
744 708
745 - if ( $entry_ids ) {
709 + if ( empty( $entry_ids ) ) {
710 + esc_html_e( 'There are no entries for that form.', 'formidable' );
711 + } else {
746 712 FrmCSVExportHelper::generate_csv( compact( 'form', 'entry_ids', 'form_cols' ) );
747 - } else {
748 - esc_html_e( 'There are no entries for that form.', 'formidable' );
749 713 }
750 714
751 715 wp_die();
752 716 }
@@ -759,14 +723,13 @@
759 723 *
760 724 * @param int $form_id
761 725 * @param object $form
762 726 *
763 - * @return array CSV fields.
727 + * @return array $csv_fields
764 728 */
765 729 public static function get_fields_for_csv_export( $form_id, $form ) {
766 730 $csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
767 731 $no_export_fields = FrmField::no_save_fields();
768 -
769 732 foreach ( $csv_fields as $k => $f ) {
770 733 if ( in_array( $f->type, $no_export_fields, true ) ) {
771 734 unset( $csv_fields[ $k ] );
772 735 }
@@ -774,21 +737,16 @@
774 737
775 738 return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
776 739 }
777 740
778 - /**
779 - * @param array $mimes
780 - *
781 - * @return array
782 - */
783 741 public static function allow_mime( $mimes ) {
784 742 if ( ! isset( $mimes['csv'] ) ) {
785 - // Allow csv files
743 + // allow csv files
786 744 $mimes['csv'] = 'text/csv';
787 745 }
788 746
789 747 if ( ! isset( $mimes['xml'] ) ) {
790 - // Allow xml
748 + // allow xml
791 749 $mimes['xml'] = 'text/xml';
792 750 }
793 751
794 752 return $mimes;