PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.16
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.16
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/FrmField.php +463 -142 6.46.16 View file →
@@ -4,214 +4,231 @@
4 4 }
5 5
6 6 class FrmField {
7 7
8 - public static $use_cache = true;
8 + public static $use_cache = true;
9 9 public static $transient_size = 200;
10 10
11 11 public static function field_selection() {
12 - $frm_settings = FrmAppHelper::get_settings();
13 - $active_captcha = $frm_settings->active_captcha;
14 - if ( ! FrmFieldCaptcha::should_show_captcha() ) {
15 - $captcha_name = 'Captcha';
16 - } elseif ( $active_captcha === 'recaptcha' ) {
17 - $captcha_name = 'reCAPTCHA';
18 - } else {
19 - $captcha_name = 'hCaptcha';
20 - }
21 12 $fields = array(
22 - 'text' => array(
13 + 'text' => array(
23 14 'name' => __( 'Text', 'formidable' ),
24 15 'icon' => 'frm_icon_font frm_text2_icon',
25 16 ),
26 - 'textarea' => array(
17 + 'textarea' => array(
27 18 'name' => __( 'Paragraph', 'formidable' ),
28 19 'icon' => 'frm_icon_font frm_paragraph_icon',
29 20 ),
30 - 'checkbox' => array(
21 + 'checkbox' => array(
31 22 'name' => __( 'Checkboxes', 'formidable' ),
32 23 'icon' => 'frm_icon_font frm_check_square_icon',
33 24 ),
34 - 'radio' => array(
25 + 'radio' => array(
35 26 'name' => __( 'Radio Buttons', 'formidable' ),
36 27 'icon' => 'frm_icon_font frm_radio_checked_icon',
37 28 ),
38 - 'select' => array(
29 + 'select' => array(
39 30 'name' => __( 'Dropdown', 'formidable' ),
40 31 'icon' => 'frm_icon_font frm_caret_square_down_icon',
41 32 ),
42 - 'email' => array(
33 + 'email' => array(
43 34 'name' => __( 'Email', 'formidable' ),
44 35 'icon' => 'frm_icon_font frm_email_icon',
45 36 ),
46 - 'url' => array(
37 + 'url' => array(
47 38 'name' => __( 'Website/URL', 'formidable' ),
48 39 'icon' => 'frm_icon_font frm_link_icon',
49 40 ),
50 - 'number' => array(
41 + 'number' => array(
51 42 'name' => __( 'Number', 'formidable' ),
52 43 'icon' => 'frm_icon_font frm_hashtag_icon',
53 44 ),
54 - 'name' => array(
45 + 'name' => array(
55 46 'name' => __( 'Name', 'formidable' ),
56 47 'icon' => 'frm_icon_font frm_user_name_icon',
57 48 ),
58 - 'phone' => array(
49 + 'phone' => array(
59 50 'name' => __( 'Phone', 'formidable' ),
60 51 'icon' => 'frm_icon_font frm_phone_icon',
61 52 ),
62 - 'html' => array(
53 + 'html' => array(
63 54 'name' => __( 'HTML', 'formidable' ),
64 55 'icon' => 'frm_icon_font frm_code_icon',
65 56 ),
66 - 'hidden' => array(
57 + 'hidden' => array(
67 58 'name' => __( 'Hidden', 'formidable' ),
68 59 'icon' => 'frm_icon_font frm_eye_slash_icon',
69 60 ),
70 - 'user_id' => array(
61 + 'user_id' => array(
71 62 'name' => __( 'User ID', 'formidable' ),
72 63 'icon' => 'frm_icon_font frm_user_icon',
73 64 ),
74 - 'captcha' => array(
75 - 'name' => $captcha_name,
65 + 'captcha' => array(
66 + 'name' => self::get_captcha_field_name(),
76 67 'icon' => 'frm_icon_font frm_shield_check_icon',
77 68 ),
69 + 'credit_card' => array(
70 + 'name' => __( 'Payment', 'formidable' ),
71 + 'icon' => 'frm_icon_font frm_credit_card_icon',
72 + ),
73 + FrmSubmitHelper::FIELD_TYPE => array(
74 + 'name' => __( 'Submit', 'formidable' ),
75 + 'hide' => true,
76 + ),
78 77 );
79 78
79 + /**
80 + * @param array $fields
81 + */
80 82 return apply_filters( 'frm_available_fields', $fields );
81 83 }
82 84
85 + /**
86 + * Get the name of the Captcha field based on the global Captcha setting.
87 + *
88 + * @return string
89 + */
90 + private static function get_captcha_field_name() {
91 + return 'Captcha';
92 + }
93 +
83 94 public static function pro_field_selection() {
84 95 $images_url = FrmAppHelper::plugin_url() . '/images/';
85 96 $fields = array(
86 - 'file' => array(
87 - 'name' => __( 'File Upload', 'formidable' ),
88 - 'icon' => 'frm_icon_font frm_upload_icon',
89 - 'message' => 'Add file uploads to save time and cut down on back-and-forth. Upgrade to Pro to get Upload fields and more.',
97 + 'file' => array(
98 + 'name' => __( 'File Upload', 'formidable' ),
99 + 'icon' => 'frm_icon_font frm_upload_icon',
100 + 'message' => __( 'Add file uploads to save time and cut down on back-and-forth. Upgrade to Pro to get Upload fields and more.', 'formidable' ),
90 101 ),
91 - 'rte' => array(
102 + 'ranking' => array(),
103 + 'rte' => array(
92 104 'name' => __( 'Rich Text', 'formidable' ),
93 105 'icon' => 'frm_icon_font frm_align_right_icon',
94 106 ),
95 - 'date' => array(
107 + 'date' => array(
96 108 'name' => __( 'Date', 'formidable' ),
97 109 'icon' => 'frm_icon_font frm_calendar_icon',
98 110 ),
99 - 'time' => array(
111 + 'time' => array(
100 112 'name' => __( 'Time', 'formidable' ),
101 113 'icon' => 'frm_icon_font frm_clock_icon',
102 114 ),
103 - 'scale' => array(
104 - 'name' => __( 'Scale', 'formidable' ),
105 - 'icon' => 'frm_icon_font frm_linear_scale_icon',
106 - 'message' => 'Add a set of radio buttons with whatever range you choose. <img src="' . esc_attr( $images_url ) . 'scale_field.png" alt="Scale Field" />',
115 + 'scale' => array(
116 + 'name' => __( 'Scale', 'formidable' ),
117 + 'icon' => 'frm_icon_font frm_linear_scale_icon',
118 + 'message' => esc_html__( 'Add a set of radio buttons with whatever range you choose.', 'formidable' ) . '<img src="' . esc_url( $images_url ) . 'scale_field.png" alt="' . esc_attr__( 'Scale Field', 'formidable' ) . '" />',
107 119 ),
108 - 'star' => array(
120 + 'star' => array(
109 121 'name' => __( 'Star Rating', 'formidable' ),
110 122 'icon' => 'frm_icon_font frm_star_icon',
111 123 ),
112 - 'range' => array(
124 + 'range' => array(
113 125 'name' => __( 'Slider', 'formidable' ),
114 126 'icon' => 'frm_icon_font frm_code_commit_icon',
115 127 ),
116 - 'toggle' => array(
128 + 'toggle' => array(
117 129 'name' => __( 'Toggle', 'formidable' ),
118 130 'icon' => 'frm_icon_font frm_toggle_on_icon',
119 131 ),
120 - 'data' => array(
121 - 'name' => __( 'Dynamic', 'formidable' ),
122 - 'icon' => 'frm_icon_font frm_sitemap_icon',
123 - 'message' => 'Create relationships between multiple forms. You can link a member to a team, a rating to a product, a comment to a submission, and much more.',
132 + 'data' => array(
133 + 'name' => __( 'Dynamic', 'formidable' ),
134 + 'icon' => 'frm_icon_font frm_sitemap_icon',
135 + 'message' => __( 'Create relationships between multiple forms. You can link a member to a team, a rating to a product, a comment to a submission, and much more.', 'formidable' ),
124 136 ),
125 - 'lookup' => array(
126 - 'name' => __( 'Lookup', 'formidable' ),
127 - 'icon' => 'frm_icon_font frm_search_icon',
128 - 'message' => 'Filter the options in the next field and automatically add values to other fields. Upgrade to Pro to get Lookup fields and more. <img src="' . esc_attr( $images_url ) . 'look-up_year-make-model.gif" alt="cascading lookup fields" />',
137 + 'lookup' => array(
138 + 'name' => __( 'Lookup', 'formidable' ),
139 + 'icon' => 'frm_icon_font frm_search_icon',
140 + 'message' => esc_html__( 'Filter the options in the next field and automatically add values to other fields. Upgrade to Pro to get Lookup fields and more.', 'formidable' ) . ' <img src="' . esc_url( $images_url ) . 'look-up_year-make-model.gif" alt="' . esc_attr__( 'cascading lookup fields', 'formidable' ) . '" />',
129 141 ),
130 - 'divider|repeat' => array(
131 - 'name' => __( 'Repeater', 'formidable' ),
132 - 'icon' => 'frm_icon_font frm_repeater_icon',
133 - 'message' => 'Allow your visitors to add new sets of fields while filling out forms. Increase conversions while saving building time and server resources. <img src="' . esc_attr( $images_url ) . 'repeatable-section_frontend.gif" alt="Dynamically Add Form Fields with repeatable sections" />',
142 + 'divider|repeat' => array(
143 + 'name' => __( 'Repeater', 'formidable' ),
144 + 'icon' => 'frm_icon_font frm_repeater_icon',
145 + 'message' => esc_html__( 'Allow your visitors to add new sets of fields while filling out forms. Increase conversions while saving building time and server resources.', 'formidable' ) . ' <img src="' . esc_url( $images_url ) . 'repeatable-section_frontend.gif" alt="' . esc_attr__( 'Dynamically Add Form Fields with repeatable sections', 'formidable' ) . '" />',
134 146 ),
135 - 'end_divider' => array(
147 + 'end_divider' => array(
136 148 'name' => __( 'Section Buttons', 'formidable' ),
137 149 'switch_from' => 'divider',
138 150 ),
139 - 'divider' => array(
151 + 'divider' => array(
140 152 'name' => __( 'Section', 'formidable' ),
141 153 'icon' => 'frm_icon_font frm_header_icon',
142 154 ),
143 - 'break' => array(
144 - 'name' => __( 'Page Break', 'formidable' ),
145 - 'icon' => 'frm_icon_font frm_page_break_icon',
146 - 'message' => 'Get multi-paged forms with progress bars. Did you know you can upgrade to PRO to unlock multi-step forms with more awesome features?',
155 + 'break' => array(
156 + 'name' => __( 'Page Break', 'formidable' ),
157 + 'icon' => 'frm_icon_font frm_page_break_icon',
158 + 'message' => __( 'Get multi-paged forms with progress bars. Did you know you can upgrade to PRO to unlock multi-step forms with more awesome features?', 'formidable' ),
147 159 ),
148 - 'form' => array(
160 + 'form' => array(
149 161 'name' => __( 'Embed Form', 'formidable' ),
150 162 'icon' => 'frm_icon_font frm_file_text_icon',
151 163 ),
152 - 'likert' => array(
164 + 'likert' => array(
153 165 'name' => __( 'Likert Scale', 'formidable' ),
154 166 'icon' => 'frm_icon_font frm_likert_scale frm_show_upgrade',
155 167 'addon' => 'surveys',
156 168 ),
157 - 'nps' => array(
169 + 'nps' => array(
158 170 'name' => __( 'NPS', 'formidable' ),
159 171 'icon' => 'frm_icon_font frm_nps frm_show_upgrade',
160 172 'addon' => 'surveys',
161 173 ),
162 - 'password' => array(
174 + 'password' => array(
163 175 'name' => __( 'Password', 'formidable' ),
164 176 'icon' => 'frm_icon_font frm_lock_open_icon',
165 177 ),
166 - 'tag' => array(
178 + 'tag' => array(
167 179 'name' => __( 'Tags', 'formidable' ),
168 180 'icon' => 'frm_icon_font frm_price_tags_icon',
169 181 ),
170 - 'credit_card' => array(
171 - 'name' => __( 'Credit Card', 'formidable' ),
172 - 'icon' => 'frm_icon_font frm_credit_card_icon frm_show_upgrade',
173 - 'addon' => 'stripe',
182 + // This is no longer a Pro field, but without this here, Pro triggers "undefined index" notices.
183 + // Right now it leaves a gap. Maybe we can skip anything without a name or something.
184 + 'credit_card' => array(
185 + 'name' => '',
186 + 'icon' => '',
174 187 ),
175 - 'address' => array(
188 + 'address' => array(
176 189 'name' => __( 'Address', 'formidable' ),
177 190 'icon' => 'frm_icon_font frm_location_icon',
178 191 ),
179 - 'summary' => array(
180 - 'name' => __( 'Summary', 'formidable' ),
181 - 'icon' => 'frm_icon_font frm_file_text_icon',
182 - 'message' => 'Allow visitors to review their responses before a form is submitted. Upgrade to Pro to get Summary fields and more.',
192 + 'summary' => array(
193 + 'name' => __( 'Summary', 'formidable' ),
194 + 'icon' => 'frm_icon_font frm_file_text_icon',
195 + 'message' => __( 'Allow visitors to review their responses before a form is submitted. Upgrade to Pro to get Summary fields and more.', 'formidable' ),
183 196 ),
184 - 'signature' => array(
197 + 'signature' => array(
185 198 'name' => __( 'Signature', 'formidable' ),
186 199 'icon' => 'frm_icon_font frm_signature_icon frm_show_upgrade',
187 200 'addon' => 'signature',
188 201 ),
189 - 'ai' => array(
190 - 'name' => __( 'AI', 'formidable' ),
191 - 'icon' => 'frm_icon_font frm_eye_icon frm_show_upgrade',
192 - 'addon' => 'ai',
193 - 'message' => 'Streamline workflows and reclaim valuable time with the power of AI. You can effortlessly respond to your visitors in real-time with ChatGPT as your automated assistant. Upgrade to Pro and unlock AI-powered fields.',
202 + 'ai' => array(
203 + 'name' => __( 'AI', 'formidable' ),
204 + 'icon' => 'frm_icon_font frm_eye_icon frm_show_upgrade',
205 + 'addon' => 'ai',
206 + 'message' => __( 'Streamline workflows and reclaim valuable time with the power of AI. You can effortlessly respond to your visitors in real-time with ChatGPT as your automated assistant. Upgrade to Pro and unlock AI-powered fields.', 'formidable' ),
194 207 ),
195 208 'ssa-appointment' => array(
196 209 'name' => __( 'Appointment', 'formidable' ),
197 210 'icon' => 'frm_icon_font frm_calendar_icon frm_show_upgrade',
198 211 'require' => 'Simply Schedule Appointments',
199 - 'message' => 'Appointment fields are an integration with <a href="https://simplyscheduleappointments.com/meet/formidable/">Simply Schedule Appointments</a>. Get started now to schedule appointments directly from your forms.
200 - <img src="' . esc_attr( $images_url ) . 'appointments.png" alt="Scheduling" />',
212 + 'message' => sprintf(
213 + /* translators: %1$s: Link opening HTML, %2$s: Link tag closing */
214 + esc_html__( 'Appointment fields are an integration with %1$sSimply Schedule Appointments%2$s. Get started now to schedule appointments directly from your forms.', 'formidable' ),
215 + '<a href="https://simplyscheduleappointments.com/meet/formidable/">',
216 + '</a>'
217 + ) . '<img src="' . esc_url( $images_url ) . 'appointments.png" alt="' . esc_attr__( 'Scheduling', 'formidable' ) . '" />',
201 218 'link' => 'https://simplyscheduleappointments.com/meet/formidable/',
202 219 ),
203 - 'product' => array(
220 + 'product' => array(
204 221 'name' => __( 'Product', 'formidable' ),
205 222 'icon' => 'frm_icon_font frm_product_icon',
206 223 'section' => 'pricing',
207 224 ),
208 - 'quantity' => array(
225 + 'quantity' => array(
209 226 'name' => __( 'Quantity', 'formidable' ),
210 227 'icon' => 'frm_icon_font frm_quantity_icon',
211 228 'section' => 'pricing',
212 229 ),
213 - 'total' => array(
230 + 'total' => array(
214 231 'name' => __( 'Total', 'formidable' ),
215 232 'icon' => 'frm_icon_font frm_total_icon',
216 233 'section' => 'pricing',
217 234 ),
@@ -216,8 +233,21 @@
216 233 'section' => 'pricing',
217 234 ),
218 235 );
219 236
237 + if ( self::include_ranking_fields() ) {
238 + $fields['ranking'] = array(
239 + 'name' => __( 'Ranking', 'formidable' ),
240 + 'icon' => 'frm_icon_font frm_chart_bar_icon frm_show_upgrade',
241 + 'message' => __( 'Now you can effortlessly gather insights, preferences, and opinions by allowing users to rank options.', 'formidable' ),
242 + 'upsell_image' => esc_url( $images_url ) . 'ranking-field.svg',
243 + 'addon' => 'surveys',
244 + 'is_new' => self::field_is_new( 'ranking' ),
245 + );
246 + } else {
247 + unset( $fields['ranking'] );
248 + }
249 +
220 250 if ( ! FrmAppHelper::show_new_feature( 'ai' ) ) {
221 251 unset( $fields['ai'] );
222 252 }
223 253
@@ -230,9 +260,102 @@
230 260 return apply_filters( 'frm_pro_available_fields', $fields );
231 261 }
232 262
233 263 /**
264 + * Check if we should show ranking fields in the builder.
265 + * This is based on the active version coming from our API data.
266 + * If Surveys v1.1 is not released yet, we don't want to display ranking fields yet.
267 + *
268 + * @since 6.8.3
269 + *
270 + * @return bool
271 + */
272 + private static function include_ranking_fields() {
273 + if ( class_exists( 'FrmSurveys\models\fields\Ranking' ) ) {
274 + // Always return true if Ranking fields exist.
275 + return true;
276 + }
277 +
278 + $plugin = 'formidable-surveys/formidable-surveys.php';
279 + $expected_version = '1.1';
280 +
281 + return self::installed_plugin_meets_version( $plugin, $expected_version ) || self::api_meets_version( $plugin, $expected_version );
282 + }
283 +
284 + /**
285 + * @since 6.8.3
286 + *
287 + * @param string $plugin
288 + * @param string $expected_version
289 + * @return bool
290 + */
291 + private static function installed_plugin_meets_version( $plugin, $expected_version ) {
292 + $installed_version = self::get_installed_version( $plugin );
293 + return $installed_version && version_compare( $installed_version, $expected_version, '>=' );
294 + }
295 +
296 + /**
297 + * @since 6.8.3
298 + *
299 + * @param string $plugin
300 + * @return false|string String version. False if the plugin is not installed.
301 + */
302 + private static function get_installed_version( $plugin ) {
303 + if ( ! function_exists( 'get_plugins' ) ) {
304 + require_once ABSPATH . 'wp-admin/includes/plugin.php';
305 + }
306 + $plugins = get_plugins();
307 + if ( isset( $plugins[ $plugin ] ) && ! empty( $plugins[ $plugin ]['Version'] ) ) {
308 + return $plugins[ $plugin ]['Version'];
309 + }
310 + return false;
311 + }
312 +
313 + /**
314 + * @since 6.8.3
315 + *
316 + * @param string $plugin
317 + * @param string $expected_version
318 + * @return bool
319 + */
320 + private static function api_meets_version( $plugin, $expected_version ) {
321 + $api = new FrmFormApi();
322 + $addons = $api->get_api_info();
323 + $matches = wp_list_filter( $addons, array( 'plugin' => $plugin ) );
324 + if ( ! $matches ) {
325 + return false;
326 + }
327 +
328 + $match = reset( $matches );
329 + if ( empty( $match['new_version'] ) ) {
330 + return false;
331 + }
332 +
333 + $api_version = $match['new_version'];
334 + return version_compare( $api_version, $expected_version, '>=' );
335 + }
336 +
337 + /**
338 + * Consider a field new for 90 days after the release date.
339 + *
340 + * @since 6.8.3
341 + *
342 + * @param string $type
343 + * @return bool
344 + */
345 + private static function field_is_new( $type ) {
346 + if ( 'ranking' === $type ) {
347 + $ranking_release_date = '2024-03-12';
348 + $three_months_after_release = gmdate( 'Y-m-d', strtotime( $ranking_release_date . ' + 90 days' ) );
349 + return gmdate( 'Y-m-d' ) < $three_months_after_release;
350 + }
351 + return false;
352 + }
353 +
354 + /**
234 355 * @since 4.0
356 + *
357 + * @return array
235 358 */
236 359 public static function all_field_selection() {
237 360 $pro_field_selection = self::pro_field_selection();
238 361 return array_merge( $pro_field_selection, self::field_selection() );
@@ -237,8 +360,15 @@
237 360 $pro_field_selection = self::pro_field_selection();
238 361 return array_merge( $pro_field_selection, self::field_selection() );
239 362 }
240 363
364 + /**
365 + * Create a field.
366 + *
367 + * @param array $values
368 + * @param bool $return
369 + * @return false|int
370 + */
241 371 public static function create( $values, $return = true ) {
242 372 global $wpdb, $frm_duplicate_ids;
243 373
244 374 $new_values = array();
@@ -276,30 +406,32 @@
276 406 unset( $k, $v );
277 407 }
278 408
279 409 $query_results = $wpdb->insert( $wpdb->prefix . 'frm_fields', $new_values );
280 - $new_id = 0;
281 - if ( $query_results ) {
282 - self::delete_form_transient( $new_values['form_id'] );
283 - $new_id = $wpdb->insert_id;
410 +
411 + if ( ! $query_results ) {
412 + return false;
284 413 }
285 414
415 + self::delete_form_transient( $new_values['form_id'] );
416 + $new_id = $wpdb->insert_id;
417 +
286 418 if ( ! $return ) {
287 419 return false;
288 420 }
289 421
290 - if ( $query_results ) {
291 - if ( isset( $values['id'] ) ) {
292 - $frm_duplicate_ids[ $values['id'] ] = $new_id;
293 - }
422 + if ( isset( $values['id'] ) ) {
423 + $frm_duplicate_ids[ $values['id'] ] = $new_id;
424 + }
294 425
295 - return $new_id;
296 - } else {
297 - return false;
298 - }
426 + return $new_id;
299 427 }
300 428
301 429 /**
430 + * Maybe filter HTML in field options data.
431 + * HTML is only filtered when unsafe HTML is disallowed.
432 + * See FrmAppHelper::allow_unfiltered_html.
433 + *
302 434 * @since 5.0.08
303 435 *
304 436 * @param array $options
305 437 * @return array
@@ -304,12 +436,82 @@
304 436 * @param array $options
305 437 * @return array
306 438 */
307 439 private static function maybe_filter_options( $options ) {
308 - return FrmAppHelper::maybe_filter_array( $options, array( 'custom_html' ) );
440 + $options = FrmAppHelper::maybe_filter_array( $options, array( 'custom_html' ) );
441 +
442 + if ( ! empty( $options['custom_html'] ) ) {
443 + $options['custom_html'] = self::maybe_filter_custom_html_input_attributes( $options['custom_html'] );
444 + }
445 +
446 + if ( ! empty( $options['classes'] ) ) {
447 + $options['classes'] = implode( ' ', array_map( 'FrmFormsHelper::sanitize_layout_class', explode( ' ', $options['classes'] ) ) );
448 + }
449 +
450 + return $options;
309 451 }
310 452
311 453 /**
454 + * Prevent users who do not have permission to insert JavaScript attributes in input elements.
455 + * This is triggered when a field is updated.
456 + *
457 + * @since 6.11.2
458 + *
459 + * @param string $html
460 + * @return string
461 + */
462 + private static function maybe_filter_custom_html_input_attributes( $html ) {
463 + if ( FrmAppHelper::allow_unfiltered_html() ) {
464 + return $html;
465 + }
466 +
467 + $pattern = get_shortcode_regex( array( 'input' ) );
468 + return preg_replace_callback(
469 + "/$pattern/",
470 + /**
471 + * @param array $match Shortcode data.
472 + * @return string
473 + */
474 + function ( $match ) {
475 + $attr = shortcode_parse_atts( $match[3] );
476 +
477 + if ( ! is_array( $attr ) ) {
478 + // In old versions of WordPress (older than 6.5), this might not be an array.
479 + return '[input]';
480 + }
481 +
482 + $safe_atts = array();
483 + foreach ( $attr as $attr_key => $att ) {
484 + if ( ! is_numeric( $attr_key ) ) {
485 + // opt=1 without parentheses for example is mapped like 'opt' => 1.
486 + $key = $attr_key;
487 + $value = $att;
488 + } else {
489 + // Some data is mapped like 0 => 'placeholder="Placeholder"'.
490 + $split = explode( '=', $att, 2 );
491 + if ( 2 !== count( $split ) ) {
492 + continue;
493 + }
494 + $key = trim( $split[0] );
495 + $value = trim( $split[1], '"' );
496 + }
497 +
498 + if ( FrmAppHelper::input_key_is_safe( $key, 'update' ) ) {
499 + $safe_atts[ $key ] = $value;
500 + }
501 + }
502 +
503 + if ( ! $safe_atts ) {
504 + return '[input]';
505 + }
506 +
507 + return '[input ' . FrmAppHelper::array_to_html_params( $safe_atts ) . ']';
508 + },
509 + $html
510 + );
511 + }
512 +
513 + /**
312 514 * Process the field duplication.
313 515 *
314 516 * @since 5.0.05
315 517 */
@@ -400,11 +602,16 @@
400 602 $new_id = self::create( $values );
401 603 $frm_duplicate_ids[ $field->id ] = $new_id;
402 604 $frm_duplicate_ids[ $field->field_key ] = $new_id;
403 605 unset( $field );
404 - }
606 + }//end foreach
405 607 }
406 608
609 + /**
610 + * @param int|string $id
611 + * @param array $values
612 + * @return false|int
613 + */
407 614 public static function update( $id, $values ) {
408 615 global $wpdb;
409 616
410 617 $id = absint( $id );
@@ -420,10 +627,22 @@
420 627
421 628 self::preserve_format_option_backslashes( $values );
422 629
423 630 if ( isset( $values['type'] ) ) {
424 - $values = apply_filters( 'frm_clean_' . $values['type'] . '_field_options_before_update', $values );
631 + if ( 'dropdown' === $values['type'] ) {
632 + // To avoid conflicts with security plugins the value "dropdown" is sent for select fields.
633 + // This is because "select" gets matched for SQL injection attempts.
634 + $values['type'] = 'select';
635 + }
425 636
637 + /**
638 + * @since 6.9 The Field ID param was added.
639 + *
640 + * @param array $values
641 + * @param int $id Field ID.
642 + */
643 + $values = apply_filters( 'frm_clean_' . $values['type'] . '_field_options_before_update', $values, $id );
644 +
426 645 if ( $values['type'] === 'hidden' && isset( $values['field_options'] ) && isset( $values['field_options']['clear_on_focus'] ) ) {
427 646 // don't keep the old placeholder setting for hidden fields
428 647 $values['field_options']['clear_on_focus'] = 0;
429 648 }
@@ -470,9 +689,9 @@
470 689 * Keep backslashes in the phone format option
471 690 *
472 691 * @since 2.0.8
473 692 *
474 - * @param $values array - pass by reference
693 + * @param array $values Pass by reference.
475 694 */
476 695 private static function preserve_format_option_backslashes( &$values ) {
477 696 if ( isset( $values['field_options']['format'] ) ) {
478 697 $values['field_options']['format'] = FrmAppHelper::preserve_backslashes( $values['field_options']['format'] );
@@ -516,8 +735,11 @@
516 735 }
517 736
518 737 /**
519 738 * If $field is numeric, get the field object
739 + *
740 + * @param int|object|string $field
741 + * @return void
520 742 */
521 743 public static function maybe_get_field( &$field ) {
522 744 if ( ! is_object( $field ) ) {
523 745 $field = self::getOne( $field );
@@ -524,10 +746,10 @@
524 746 }
525 747 }
526 748
527 749 /**
528 - * @param string|int $id The field id or key.
529 - * @param bool $filter When true, run the frm_field filter.
750 + * @param int|string $id The field id or key.
751 + * @param bool $filter When true, run the frm_field filter.
530 752 */
531 753 public static function getOne( $id, $filter = false ) {
532 754 if ( empty( $id ) ) {
533 755 return null;
@@ -573,10 +795,10 @@
573 795
574 796 /**
575 797 * Get the field type by key or id
576 798 *
577 - * @param int|string The field id or key
578 - * @param mixed $col The name of the column in the fields database table
799 + * @param int|string $id The field id or key.
800 + * @param mixed $col The name of the column in the fields database table.
579 801 */
580 802 public static function get_type( $id, $col = 'type' ) {
581 803 $field = FrmDb::check_cache( $id, 'frm_field' );
582 804 if ( $field ) {
@@ -592,8 +814,14 @@
592 814
593 815 return $type;
594 816 }
595 817
818 + /**
819 + * @param int|string $form_id
820 + * @param string $type
821 + * @param int|string $limit
822 + * @param string $inc_sub
823 + */
596 824 public static function get_all_types_in_form( $form_id, $type, $limit = '', $inc_sub = 'exclude' ) {
597 825 if ( ! $form_id ) {
598 826 return array();
599 827 }
@@ -613,9 +841,9 @@
613 841 continue;
614 842 }
615 843
616 844 $fields[ $result->id ] = $result;
617 - $count ++;
845 + ++$count;
618 846 if ( $limit == 1 ) {
619 847 $fields = $result;
620 848 break;
621 849 }
@@ -627,9 +855,9 @@
627 855 unset( $result );
628 856 }
629 857
630 858 return wp_unslash( $fields );
631 - }
859 + }//end if
632 860
633 861 self::$use_cache = false;
634 862
635 863 $where = array(
@@ -643,8 +871,15 @@
643 871
644 872 return $results;
645 873 }
646 874
875 + /**
876 + * @param int|string $form_id
877 + * @param int|string $limit
878 + * @param string $inc_embed
879 + * @param string $inc_repeat
880 + * @return array
881 + */
647 882 public static function get_all_for_form( $form_id, $limit = '', $inc_embed = 'exclude', $inc_repeat = 'include' ) {
648 883 if ( ! (int) $form_id ) {
649 884 return array();
650 885 }
@@ -657,9 +892,9 @@
657 892
658 893 $fields = array();
659 894 $count = 0;
660 895 foreach ( $results as $result ) {
661 - $count ++;
896 + ++$count;
662 897 $fields[ $result->id ] = $result;
663 898 if ( ! empty( $limit ) && $count >= $limit ) {
664 899 break;
665 900 }
@@ -688,12 +923,12 @@
688 923 /**
689 924 * If repeating fields should be included, adjust $where accordingly
690 925 *
691 926 * @param string $inc_repeat
692 - * @param array $where - pass by reference
927 + * @param array $where Pass by reference.
693 928 */
694 929 private static function maybe_include_repeating_fields( $inc_repeat, &$where ) {
695 - if ( $inc_repeat == 'include' ) {
930 + if ( $inc_repeat === 'include' ) {
696 931 $form_id = $where['fi.form_id'];
697 932 $where[] = array(
698 933 'or' => 1,
699 934 'fi.form_id' => $form_id,
@@ -708,9 +943,9 @@
708 943 if ( 'include' != $inc_embed || $no_sub_forms ) {
709 944 return;
710 945 }
711 946
712 - $form_fields = $results;
947 + $form_fields = $results;
713 948 $should_get_subforms = ( $type !== 'all' && $type !== 'form' && ! empty( $form_id ) );
714 949 if ( $should_get_subforms ) {
715 950 $form_fields = self::get_all_types_in_form( $form_id, 'form' );
716 951 }
@@ -720,9 +955,9 @@
720 955 if ( 'form' != $field->type || ! isset( $field->field_options['form_select'] ) ) {
721 956 continue;
722 957 }
723 958
724 - if ( $type == 'all' ) {
959 + if ( $type === 'all' ) {
725 960 $sub_fields = self::get_all_for_form( $field->field_options['form_select'] );
726 961 } else {
727 962 $sub_fields = self::get_all_types_in_form( $field->field_options['form_select'], $type );
728 963 }
@@ -727,9 +962,9 @@
727 962 $sub_fields = self::get_all_types_in_form( $field->field_options['form_select'], $type );
728 963 }
729 964
730 965 if ( ! empty( $sub_fields ) ) {
731 - $index = $k + $index_offset;
966 + $index = $k + $index_offset;
732 967 $index_offset += count( $sub_fields );
733 968 array_splice( $results, $index, 0, $sub_fields );
734 969 }
735 970 unset( $field, $sub_fields );
@@ -769,9 +1004,9 @@
769 1004
770 1005 $limit = FrmDb::esc_limit( $limit );
771 1006
772 1007 $query = "SELECT fi.*, fr.name as form_name FROM {$table_name} fi LEFT OUTER JOIN {$form_table_name} fr ON fi.form_id=fr.id";
773 - $query_type = ( $limit == ' LIMIT 1' || $limit == 1 ) ? 'row' : 'results';
1008 + $query_type = $limit === ' LIMIT 1' || $limit == 1 ? 'row' : 'results';
774 1009
775 1010 if ( is_array( $where ) ) {
776 1011 $args = array(
777 1012 'order_by' => $order_by,
@@ -781,9 +1016,9 @@
781 1016 } else {
782 1017 // if the query is not an array, then it has already been prepared
783 1018 $query .= FrmDb::prepend_and_or_where( ' WHERE ', $where ) . $order_by . $limit;
784 1019
785 - $function_name = ( $query_type == 'row' ) ? 'get_row' : 'get_results';
1020 + $function_name = $query_type === 'row' ? 'get_row' : 'get_results';
786 1021 $results = $wpdb->$function_name( $query );
787 1022 }
788 1023 unset( $where );
789 1024
@@ -799,8 +1034,10 @@
799 1034 */
800 1035 private static function format_field_results( &$results ) {
801 1036 if ( is_array( $results ) ) {
802 1037 foreach ( $results as $r_key => $result ) {
1038 + self::add_slashes_to_format_before_setting_field_cache( $result );
1039 +
803 1040 FrmDb::set_cache( $result->id, $result, 'frm_field' );
804 1041 FrmDb::set_cache( $result->field_key, $result, 'frm_field' );
805 1042
806 1043 self::prepare_options( $result );
@@ -818,8 +1055,26 @@
818 1055 }
819 1056 }
820 1057
821 1058 /**
1059 + * When $result->field_options is an array and not a serialized string there is only a single backslash.
1060 + * Cached results are unslashed in FrmField::getAll, so we need to make sure that the cached object has an extra backslash.
1061 + * Otherwise the backslash is stripped away on load.
1062 + *
1063 + * @since 6.15
1064 + *
1065 + * @param stdClass $result
1066 + * @return void
1067 + */
1068 + private static function add_slashes_to_format_before_setting_field_cache( $result ) {
1069 + if ( ! isset( $result->field_options ) || ! is_array( $result->field_options ) || empty( $result->field_options['format'] ) ) {
1070 + return;
1071 + }
1072 +
1073 + $result->field_options['format'] = addslashes( $result->field_options['format'] );
1074 + }
1075 +
1076 + /**
822 1077 * Unserialize all the serialized field data
823 1078 *
824 1079 * @since 2.0
825 1080 */
@@ -835,9 +1090,9 @@
835 1090 }
836 1091 }
837 1092
838 1093 /**
839 - * If a form has too many fields, thay won't all save into a single transient.
1094 + * If a form has too many fields, they won't all save into a single transient.
840 1095 * We'll break them into groups of 200
841 1096 *
842 1097 * @since 2.0.1
843 1098 */
@@ -861,9 +1116,9 @@
861 1116 $fields = array_merge( $fields, $next_fields );
862 1117
863 1118 if ( count( $next_fields ) >= self::$transient_size ) {
864 1119 // if this transient is full, check for another
865 - $next ++;
1120 + ++$next;
866 1121 self::get_next_transient( $fields, $base_name, $next );
867 1122 }
868 1123 }
869 1124 }
@@ -889,18 +1144,25 @@
889 1144
890 1145 return;
891 1146 }
892 1147
893 - $next ++;
1148 + ++$next;
894 1149 }
895 1150 }
896 1151
1152 + /**
1153 + * @param string $type
1154 + * @return bool
1155 + */
897 1156 public static function is_no_save_field( $type ) {
898 - return in_array( $type, self::no_save_fields() );
1157 + return in_array( $type, self::no_save_fields(), true );
899 1158 }
900 1159
1160 + /**
1161 + * @return string[]
1162 + */
901 1163 public static function no_save_fields() {
902 - return array( 'divider', 'end_divider', 'captcha', 'break', 'html', 'form', 'summary' );
1164 + return array( 'divider', 'end_divider', 'captcha', 'break', 'html', 'form', 'summary', FrmSubmitHelper::FIELD_TYPE );
903 1165 }
904 1166
905 1167 /**
906 1168 * Check if this field can hold an array of values
@@ -908,9 +1170,9 @@
908 1170 * @since 2.0.9
909 1171 *
910 1172 * @param array|object $field
911 1173 *
912 - * @return boolean
1174 + * @return bool
913 1175 */
914 1176 public static function is_field_with_multiple_values( $field ) {
915 1177 if ( ! $field ) {
916 1178 return false;
@@ -919,9 +1181,9 @@
919 1181 $field_type = self::get_original_field_type( $field );
920 1182
921 1183 $is_multi_value_field = (
922 1184 self::is_checkbox( $field ) ||
923 - $field_type == 'address' ||
1185 + $field_type === 'address' ||
924 1186 self::is_multiple_select( $field )
925 1187 );
926 1188
927 1189 return $is_multi_value_field;
@@ -928,8 +1190,9 @@
928 1190 }
929 1191
930 1192 /**
931 1193 * @since 3.0
1194 + * @param array|object $field
932 1195 * @return string
933 1196 */
934 1197 public static function get_field_type( $field ) {
935 1198 return is_array( $field ) ? $field['type'] : $field->type;
@@ -943,9 +1206,10 @@
943 1206 $field_type = self::get_field_type( $field );
944 1207 $original_type = self::get_option( $field, 'original_type' );
945 1208
946 1209 if ( ! empty( $original_type ) && $original_type != $field_type ) {
947 - $field_type = $original_type; // check the original type for arrays
1210 + // Check the original type for arrays.
1211 + $field_type = $original_type;
948 1212 }
949 1213
950 1214 return $field_type;
951 1215 }
@@ -953,9 +1217,9 @@
953 1217 /**
954 1218 * Check if this is a multiselect dropdown field
955 1219 *
956 1220 * @since 2.0.9
957 - * @return boolean
1221 + * @return bool
958 1222 */
959 1223 public static function is_multiple_select( $field ) {
960 1224 $field_type = self::get_field_type( $field );
961 1225 $is_multiple = self::is_option_true( $field, 'multiple' ) && self::is_field_type( $field, 'select' ) && $field_type !== 'hidden';
@@ -967,63 +1231,104 @@
967 1231 * Check if a field is read only. Read only can be set in the field options,
968 1232 * but disabled with the shortcode options
969 1233 *
970 1234 * @since 2.0.9
1235 + *
1236 + * @param array|object $field
1237 + * @return bool
971 1238 */
972 1239 public static function is_read_only( $field ) {
973 1240 global $frm_vars;
974 -
975 - return ( self::is_option_true( $field, 'read_only' ) && ( ! isset( $frm_vars['readonly'] ) || $frm_vars['readonly'] != 'disabled' ) );
1241 + return self::is_option_true( $field, 'read_only' ) && ( ! isset( $frm_vars['readonly'] ) || $frm_vars['readonly'] !== 'disabled' );
976 1242 }
977 1243
978 1244 /**
979 1245 * @since 2.0.9
1246 + *
1247 + * @param array $field
1248 + * @return bool
980 1249 */
981 1250 public static function is_required( $field ) {
982 - $required = ( $field['required'] != '0' );
983 - $required = apply_filters( 'frm_is_field_required', $required, $field );
1251 + $required = $field['required'] != '0';
984 1252
1253 + /**
1254 + * @param bool $required
1255 + * @param array $field
1256 + */
1257 + $required = (bool) apply_filters( 'frm_is_field_required', $required, $field );
1258 +
985 1259 return $required;
986 1260 }
987 1261
988 1262 /**
989 1263 * @since 2.0.9
1264 + *
1265 + * @param array|object $field
1266 + * @param string $option
1267 + * @return bool
990 1268 */
991 1269 public static function is_option_true( $field, $option ) {
992 1270 if ( is_array( $field ) ) {
993 1271 return self::is_option_true_in_array( $field, $option );
994 - } else {
995 - return self::is_option_true_in_object( $field, $option );
996 1272 }
1273 + return self::is_option_true_in_object( $field, $option );
997 1274 }
998 1275
999 1276 /**
1000 1277 * @since 2.0.9
1278 + *
1279 + * @param array|object $field
1280 + * @param string $option
1281 + * @return bool
1001 1282 */
1002 1283 public static function is_option_empty( $field, $option ) {
1003 1284 if ( is_array( $field ) ) {
1004 1285 return self::is_option_empty_in_array( $field, $option );
1005 - } else {
1006 - return self::is_option_empty_in_object( $field, $option );
1007 1286 }
1287 + return self::is_option_empty_in_object( $field, $option );
1008 1288 }
1009 1289
1290 + /**
1291 + * @param array $field
1292 + * @param string $option
1293 + * @return bool
1294 + */
1010 1295 public static function is_option_true_in_array( $field, $option ) {
1011 - return isset( $field[ $option ] ) && $field[ $option ];
1296 + return ! empty( $field[ $option ] );
1012 1297 }
1013 1298
1299 + /**
1300 + * @param object $field
1301 + * @param string $option
1302 + * @return bool
1303 + */
1014 1304 public static function is_option_true_in_object( $field, $option ) {
1015 1305 return isset( $field->field_options[ $option ] ) && $field->field_options[ $option ];
1016 1306 }
1017 1307
1308 + /**
1309 + * @param array $field
1310 + * @param string $option
1311 + * @return bool
1312 + */
1018 1313 public static function is_option_empty_in_array( $field, $option ) {
1019 - return ! isset( $field[ $option ] ) || empty( $field[ $option ] );
1314 + return empty( $field[ $option ] );
1020 1315 }
1021 1316
1317 + /**
1318 + * @param object $field
1319 + * @param string $option
1320 + * @return bool
1321 + */
1022 1322 public static function is_option_empty_in_object( $field, $option ) {
1023 - return ! isset( $field->field_options[ $option ] ) || empty( $field->field_options[ $option ] );
1323 + return empty( $field->field_options[ $option ] );
1024 1324 }
1025 1325
1326 + /**
1327 + * @param stdClass $field
1328 + * @param string $option
1329 + * @return bool
1330 + */
1026 1331 public static function is_option_value_in_object( $field, $option ) {
1027 1332 return isset( $field->field_options[ $option ] ) && $field->field_options[ $option ] != '';
1028 1333 }
1029 1334
@@ -1028,8 +1333,12 @@
1028 1333 }
1029 1334
1030 1335 /**
1031 1336 * @since 2.0.18
1337 + *
1338 + * @param array|object $field
1339 + * @param string $option
1340 + * @return mixed
1032 1341 */
1033 1342 public static function get_option( $field, $option ) {
1034 1343 if ( is_array( $field ) ) {
1035 1344 $option = self::get_option_in_array( $field, $option );
@@ -1039,10 +1348,14 @@
1039 1348
1040 1349 return $option;
1041 1350 }
1042 1351
1352 + /**
1353 + * @param array $field
1354 + * @param string $option
1355 + * @return mixed
1356 + */
1043 1357 public static function get_option_in_array( $field, $option ) {
1044 -
1045 1358 if ( isset( $field[ $option ] ) ) {
1046 1359 $this_option = $field[ $option ];
1047 1360 } elseif ( isset( $field['field_options'] ) && is_array( $field['field_options'] ) && isset( $field['field_options'][ $option ] ) ) {
1048 1361 $this_option = $field['field_options'][ $option ];
@@ -1052,8 +1365,13 @@
1052 1365
1053 1366 return $this_option;
1054 1367 }
1055 1368
1369 + /**
1370 + * @param object $field
1371 + * @param string $option
1372 + * @return mixed
1373 + */
1056 1374 public static function get_option_in_object( $field, $option ) {
1057 1375 return isset( $field->field_options[ $option ] ) ? $field->field_options[ $option ] : '';
1058 1376 }
1059 1377
@@ -1058,17 +1376,20 @@
1058 1376 }
1059 1377
1060 1378 /**
1061 1379 * @since 2.0.09
1380 + *
1381 + * @param array|object $field
1382 + * @return bool
1062 1383 */
1063 1384 public static function is_repeating_field( $field ) {
1064 1385 if ( is_array( $field ) ) {
1065 - $is_repeating_field = ( 'divider' == $field['type'] );
1386 + $is_repeating_field = ( 'divider' === $field['type'] );
1066 1387 } else {
1067 - $is_repeating_field = ( 'divider' == $field->type );
1388 + $is_repeating_field = ( 'divider' === $field->type );
1068 1389 }
1069 1390
1070 - return ( $is_repeating_field && self::is_option_true( $field, 'repeat' ) );
1391 + return $is_repeating_field && self::is_option_true( $field, 'repeat' );
1071 1392 }
1072 1393
1073 1394 /**
1074 1395 * @param string $key
@@ -1083,9 +1404,9 @@
1083 1404
1084 1405 /**
1085 1406 * @param string $id
1086 1407 *
1087 - * @return null|string
1408 + * @return string|null
1088 1409 */
1089 1410 public static function get_key_by_id( $id ) {
1090 1411 return FrmDb::get_var( 'frm_fields', array( 'id' => $id ), 'field_key' );
1091 1412 }
@@ -1092,9 +1413,9 @@
1092 1413
1093 1414 public static function is_image( $field ) {
1094 1415 $type = self::get_field_type( $field );
1095 1416
1096 - return ( $type == 'url' && self::get_option( $field, 'show_image' ) );
1417 + return ( $type === 'url' && self::get_option( $field, 'show_image' ) );
1097 1418 }
1098 1419
1099 1420 /**
1100 1421 * Check if field is radio or Dynamic radio
@@ -1102,9 +1423,9 @@
1102 1423 * @since 3.0
1103 1424 *
1104 1425 * @param array|object $field
1105 1426 *
1106 - * @return boolean true if field type is radio or Dynamic radio
1427 + * @return bool true if field type is radio or Dynamic radio
1107 1428 */
1108 1429 public static function is_radio( $field ) {
1109 1430 return self::is_field_type( $field, 'radio' );
1110 1431 }
@@ -1115,9 +1436,9 @@
1115 1436 * @since 3.0
1116 1437 *
1117 1438 * @param array|object $field
1118 1439 *
1119 - * @return boolean true if field type is checkbox or Dynamic checkbox
1440 + * @return bool true if field type is checkbox or Dynamic checkbox
1120 1441 */
1121 1442 public static function is_checkbox( $field ) {
1122 1443 return self::is_field_type( $field, 'checkbox' );
1123 1444 }
@@ -1127,11 +1448,11 @@
1127 1448 *
1128 1449 * @since 3.0
1129 1450 *
1130 1451 * @param array|object $field
1131 - * @param string $is_type Options include radio, checkbox, text
1452 + * @param string $is_type Options include radio, checkbox, text.
1132 1453 *
1133 - * @return boolean true if field type is checkbox or Dynamic checkbox
1454 + * @return bool true if field type is checkbox or Dynamic checkbox
1134 1455 */
1135 1456 public static function is_field_type( $field, $is_type ) {
1136 1457 $field_type = self::get_original_field_type( $field );
1137 1458 $data_type = self::get_option( $field, 'data_type' );