PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.2.3
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.2.3
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +36 -119 6.266.2.3 View file →
@@ -16,9 +16,9 @@
16 16 * @return void
17 17 */
18 18 public static function add_default_templates() {
19 19 if ( FrmXMLHelper::check_if_libxml_disable_entity_loader_exists() ) {
20 - // XML import is not enabled on your server.
20 + // XML import is not enabled on your server
21 21 return;
22 22 }
23 23
24 24 $set_err = libxml_use_internal_errors( true );
@@ -40,9 +40,8 @@
40 40 /**
41 41 * Use the template link to install the XML template
42 42 *
43 43 * @since 3.06
44 - *
45 44 * @return void
46 45 */
47 46 public static function install_template() {
48 47 FrmAppHelper::permission_check( 'frm_edit_forms' );
@@ -82,9 +81,8 @@
82 81
83 82 self::set_new_form_name( $xml );
84 83
85 84 $imported = FrmXMLHelper::import_xml_now( $xml, true );
86 -
87 85 if ( ! empty( $imported['form_status'] ) ) {
88 86 // Get the last form id in case there are child forms.
89 87 end( $imported['form_status'] );
90 88 $form_id = key( $imported['form_status'] );
@@ -89,12 +87,11 @@
89 87 end( $imported['form_status'] );
90 88 $form_id = key( $imported['form_status'] );
91 89 $response = array(
92 90 'id' => $form_id,
93 - 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
91 + 'redirect' => FrmForm::get_edit_link( $form_id ),
94 92 'success' => 1,
95 93 );
96 -
97 94 if ( ! empty( $imported['imported']['posts'] ) ) {
98 95 // Return the link to the last page created.
99 96 $pages = $imported['posts'];
100 97 }
@@ -103,10 +100,10 @@
103 100 // Create selected pages with the correct shortcodes.
104 101 $pages = self::create_pages_for_import( $form );
105 102 }
106 103
107 - if ( ! empty( $pages ) ) {
108 - $post_id = end( $pages );
104 + if ( isset( $pages ) && ! empty( $pages ) ) {
105 + $post_id = end( $pages );
109 106 $response['redirect'] = get_permalink( $post_id );
110 107 }
111 108 } else {
112 109 if ( isset( $imported['error'] ) ) {
@@ -113,19 +110,15 @@
113 110 $message = $imported['error'];
114 111 } else {
115 112 $message = __( 'There was an error importing form', 'formidable' );
116 113 }
117 -
118 114 $response = array(
119 115 'message' => $message,
120 116 );
121 117
122 - }//end if
118 + }
123 119
124 - /**
125 - * @since 6.18 Added `url` to the $args.
126 - */
127 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
120 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
128 121
129 122 echo wp_json_encode( $response );
130 123 wp_die();
131 124 }
@@ -134,9 +127,8 @@
134 127 * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
135 128 * This is to make sure that the URL can't be exploited for a SSRF attack.
136 129 *
137 130 * @since 5.5.5
138 - *
139 131 * @param string $url
140 132 *
141 133 * @return bool True on success, False on error.
142 134 */
@@ -150,13 +142,11 @@
150 142 * @return mixed
151 143 */
152 144 private static function get_posted_form() {
153 145 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
154 -
155 146 if ( empty( $form ) ) {
156 147 return $form;
157 148 }
158 -
159 149 $form = json_decode( $form, true );
160 150 return $form;
161 151 }
162 152
@@ -164,22 +154,17 @@
164 154 * Get a different URL depending on the selection in the form.
165 155 *
166 156 * @since 4.06.02
167 157 *
168 - * @param array $form The posted form values.
169 - * @param string $url The URL to override.
170 - *
171 158 * @return void
172 159 */
173 160 private static function override_url( $form, &$url ) {
174 161 $selected_form = self::get_selected_in_form( $form, 'form' );
175 -
176 162 if ( empty( $selected_form ) ) {
177 163 return;
178 164 }
179 165
180 - $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
181 -
166 + $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
182 167 if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
183 168 return;
184 169 }
185 170
@@ -188,15 +173,13 @@
188 173
189 174 /**
190 175 * @since 4.06.02
191 176 *
192 - * @param array $form
193 177 * @param string $value
194 - *
195 - * @return string
178 + * @param array $form
196 179 */
197 180 private static function get_selected_in_form( $form, $value = 'form' ) {
198 - if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
181 + if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
199 182 return $form[ $value ];
200 183 }
201 184
202 185 return '';
@@ -206,20 +189,19 @@
206 189 * @since 4.06.02
207 190 *
208 191 * @param array $form The posted form values.
209 192 *
210 - * @return array|null The array of created pages.
193 + * @return array The array of created pages.
211 194 */
212 195 private static function create_pages_for_import( $form ) {
213 - if ( empty( $form['pages'] ) ) {
214 - return null;
196 + if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
197 + return;
215 198 }
216 199
217 - $form_key = self::get_selected_in_form( $form, 'form' );
200 + $form_key = self::get_selected_in_form( $form, 'form' );
218 201 $view_keys = self::get_selected_in_form( $form, 'view' );
219 202
220 203 $page_ids = array();
221 -
222 204 foreach ( (array) $form['pages'] as $for => $name ) {
223 205 if ( empty( $name ) ) {
224 206 // Don't create a page if no title is given.
225 207 continue;
@@ -228,9 +210,9 @@
228 210 if ( $for === 'view' ) {
229 211 $item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
230 212 $shortcode = '[display-frm-data id=%1$s filter=limited]';
231 213 } elseif ( $for === 'form' ) {
232 - $item_key = $form_key;
214 + $item_key = $form_key;
233 215 $shortcode = '[formidable id=%1$s]';
234 216 } else {
235 217 $item_key = self::get_selected_in_form( $form, 'form' );
236 218 $shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
@@ -247,9 +229,9 @@
247 229 'post_type' => 'page',
248 230 'post_content' => sprintf( $shortcode, $item_key ),
249 231 )
250 232 );
251 - }//end foreach
233 + }
252 234
253 235 return $page_ids;
254 236 }
255 237
@@ -260,9 +242,8 @@
260 242 *
261 243 * @since 3.06
262 244 *
263 245 * @param object $xml The values included in the XML.
264 - *
265 246 * @return void
266 247 */
267 248 private static function set_new_form_name( &$xml ) {
268 249 if ( ! isset( $xml->form ) ) {
@@ -270,9 +251,8 @@
270 251 }
271 252
272 253 $name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
273 254 $description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
274 -
275 255 if ( ! $name && ! $description ) {
276 256 return;
277 257 }
278 258
@@ -277,9 +257,8 @@
277 257 }
278 258
279 259 // Get the main form ID.
280 260 $set_name = 0;
281 -
282 261 foreach ( $xml->form as $form ) {
283 262 if ( empty( $form->parent_form_id ) ) {
284 263 $set_name = (int) $form->id;
285 264 }
@@ -316,15 +295,15 @@
316 295 }
317 296
318 297 /**
319 298 * @param string[] $errors
320 - * @param string $message
299 + * @param string $message
321 300 *
322 301 * @return void
323 302 */
324 303 public static function form( $errors = array(), $message = '' ) {
325 304 $where = array(
326 - 'status' => array( null, '', 'published' ),
305 + 'status' => array( null, '', 'published' ),
327 306 );
328 307 $forms = FrmForm::getAll( $where, 'name' );
329 308
330 309 $export_types = array(
@@ -357,9 +336,8 @@
357 336 $errors = array();
358 337 $message = '';
359 338
360 339 $permission_error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'import-xml', 'import-xml-nonce' );
361 -
362 340 if ( false !== $permission_error ) {
363 341 $errors[] = $permission_error;
364 342 self::form( $errors );
365 343
@@ -365,11 +343,9 @@
365 343
366 344 return;
367 345 }
368 346
369 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
370 - $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
371 -
347 + $has_file = isset( $_FILES ) && isset( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
372 348 if ( ! $has_file ) {
373 349 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
374 350 self::form( $errors );
375 351
@@ -375,9 +351,9 @@
375 351
376 352 return;
377 353 }
378 354
379 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
355 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
380 356 $file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
381 357
382 358 if ( ! is_uploaded_file( $file ) ) {
383 359 unset( $file );
@@ -386,8 +362,10 @@
386 362
387 363 return;
388 364 }
389 365
366 + //add_filter('upload_mimes', 'FrmXMLController::allow_mime');
367 +
390 368 $export_format = array(
391 369 'xml' => array(
392 370 'name' => 'XML',
393 371 'support' => 'forms',
@@ -395,12 +373,11 @@
395 373 ),
396 374 );
397 375 $export_format = apply_filters( 'frm_export_formats', $export_format );
398 376
399 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
377 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
400 378 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
401 379 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
402 -
403 380 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
404 381 // allow other file types to be imported
405 382 do_action( 'frm_before_import_' . $file_type );
406 383
@@ -433,9 +410,8 @@
433 410 * @return void
434 411 */
435 412 public static function export_xml() {
436 413 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
437 -
438 414 if ( ! empty( $error ) ) {
439 415 wp_die( esc_html( $error ) );
440 416 }
441 417
@@ -459,10 +435,9 @@
459 435 wp_die();
460 436 }
461 437
462 438 /**
463 - * @param array<string>|string $type
464 - * @param array $args
439 + * @param array $args
465 440 *
466 441 * @psalm-param array{ids?: mixed} $args
467 442 *
468 443 * @return void
@@ -471,15 +446,8 @@
471 446 global $wpdb;
472 447
473 448 self::prepare_types_array( $type );
474 449
475 - if ( ! is_array( $type ) ) {
476 - // This shouldn't be possible.
477 - // It is cast to array in prepare_types_array.
478 - // This is just for static analysis.
479 - return;
480 - }
481 -
482 450 $tables = array(
483 451 'items' => $wpdb->prefix . 'frm_items',
484 452 'forms' => $wpdb->prefix . 'frm_forms',
485 453 'posts' => $wpdb->posts,
@@ -508,9 +476,9 @@
508 476 $query_vars = array();
509 477
510 478 switch ( $tb_type ) {
511 479 case 'forms':
512 - // Add forms.
480 + //add forms
513 481 if ( $args['ids'] ) {
514 482 $where[] = array(
515 483 'or' => 1,
516 484 $table . '.id' => $args['ids'],
@@ -522,9 +490,8 @@
522 490 break;
523 491 case 'actions':
524 492 $select = $table . '.ID';
525 493 $where['post_type'] = FrmFormActionsController::$action_post_type;
526 -
527 494 if ( ! empty( $args['ids'] ) ) {
528 495 $where['menu_order'] = $args['ids'];
529 496 }
530 497 break;
@@ -539,12 +506,10 @@
539 506 $frm_style = new FrmStyle();
540 507 $default_style = $frm_style->get_default_style();
541 508 $form_ids = $args['ids'];
542 509 $style_ids = array();
543 -
544 510 foreach ( $form_ids as $form_id ) {
545 511 $form_data = FrmForm::getOne( $form_id );
546 -
547 512 // For forms that have not been updated while running 2.0, check if custom_style is set.
548 513 if ( isset( $form_data->options['custom_style'] ) ) {
549 514 if ( 1 === absint( $form_data->options['custom_style'] ) ) {
550 515 $style_ids[] = $default_style->ID;
@@ -553,9 +518,8 @@
553 518 }
554 519 }
555 520 unset( $form_id, $form_data );
556 521 }
557 -
558 522 $select = $table . '.ID';
559 523 $where['post_type'] = 'frm_styles';
560 524
561 525 // Only export selected styles.
@@ -572,15 +536,15 @@
572 536 $where['pm.meta_value >'] = 1;
573 537 } else {
574 538 $where['pm.meta_value'] = $args['ids'];
575 539 }
576 - }//end switch
540 + }
577 541
578 542 $records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
579 543 unset( $tb_type );
580 - }//end foreach
544 + }
581 545
582 - $filename = self::get_file_name( $args, $records );
546 + $filename = self::get_file_name( $args, $type, $records );
583 547
584 548 header( 'Content-Description: File Transfer' );
585 549 header( 'Content-Disposition: attachment; filename=' . $filename );
586 550 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
@@ -589,46 +553,18 @@
589 553 include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
590 554 }
591 555
592 556 /**
593 - * Returns an array that has parent term slugs for the terms provided.
594 - *
595 - * @since 6.8.3
596 - *
597 - * @param array $terms
598 - *
599 - * @return array
600 - */
601 - public static function get_parent_terms_slugs( $terms ) {
602 - $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
603 - $parent_slugs = array();
604 -
605 - if ( ! $parent_term_ids ) {
606 - return $parent_slugs;
607 - }
608 -
609 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
610 - $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
611 -
612 - return $parent_slugs;
613 - }
614 -
615 - /**
616 - * Prepare the types array.
617 - *
618 - * @param array<string>|string $type
619 - *
620 557 * @return void
621 558 */
622 559 private static function prepare_types_array( &$type ) {
623 560 $type = (array) $type;
624 -
625 - if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
561 + if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
626 562 // make sure the form is included if there are entries
627 563 $type[] = 'forms';
628 564 }
629 565
630 - if ( in_array( 'forms', $type, true ) ) {
566 + if ( in_array( 'forms', $type ) ) {
631 567 // include actions with forms
632 568 $type[] = 'actions';
633 569 }
634 570 }
@@ -638,16 +574,16 @@
638 574 * Use the nme of the form if only one form is exported.
639 575 *
640 576 * @since 3.06
641 577 *
578 + * @param array $type
579 + * @param array $records
642 580 * @param array $args
643 - * @param array $records
644 581 *
645 582 * @return string
646 583 */
647 - private static function get_file_name( $args, $records ) {
648 - $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
649 -
584 + private static function get_file_name( $args, $type, $records ) {
585 + $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
650 586 if ( $has_one_form ) {
651 587 // one form is being exported
652 588 $selected_form_id = reset( $args['ids'] );
653 589 $filename = 'form-' . $selected_form_id . '.xml';
@@ -653,9 +589,8 @@
653 589 $filename = 'form-' . $selected_form_id . '.xml';
654 590
655 591 foreach ( $records['forms'] as $form_id ) {
656 592 $filename = 'form-' . $form_id . '.xml';
657 -
658 593 if ( $selected_form_id === $form_id ) {
659 594 $form = FrmForm::getOne( $form_id );
660 595 $filename = $form->name !== '' ? $form->name : $form->form_key;
661 596 $filename = sanitize_title( $filename ) . '-form.xml';
@@ -667,11 +602,10 @@
667 602
668 603 if ( ! empty( $sitename ) ) {
669 604 $sitename .= '.';
670 605 }
671 -
672 606 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
673 - }//end if
607 + }
674 608
675 609 /**
676 610 * @since 5.3
677 611 *
@@ -686,9 +620,8 @@
686 620 * @return void
687 621 */
688 622 public static function generate_csv( $atts ) {
689 623 $form_ids = $atts['ids'];
690 -
691 624 if ( empty( $form_ids ) ) {
692 625 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
693 626 }
694 627 self::csv( reset( $form_ids ) );
@@ -698,12 +631,8 @@
698 631 * Export to CSV
699 632 *
700 633 * @since 2.0.19
701 634 *
702 - * @param false|int|string $form_id
703 - * @param string $search
704 - * @param string $fid
705 - *
706 635 * @return void
707 636 */
708 637 public static function csv( $form_id = false, $search = '', $fid = '' ) {
709 638 FrmAppHelper::permission_check( 'frm_view_entries' );
@@ -713,15 +642,10 @@
713 642 $search = FrmAppHelper::get_param( ( isset( $_REQUEST['s'] ) ? 's' : 'search' ), '', 'get', 'sanitize_text_field' );
714 643 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
715 644 }
716 645
717 - // Remove time limit to execute this function.
718 - if ( function_exists( 'set_time_limit' ) ) {
719 - set_time_limit( 0 );
720 - }
721 -
646 + set_time_limit( 0 ); //Remove time limit to execute this function
722 647 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
723 -
724 648 if ( (int) $mem_limit < 256 ) {
725 649 wp_raise_memory_limit();
726 650 }
727 651
@@ -737,9 +661,8 @@
737 661 $form_id = $form->id;
738 662 $form_cols = self::get_fields_for_csv_export( $form_id, $form );
739 663
740 664 $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
741 -
742 665 if ( ! empty( $item_id ) ) {
743 666 $item_id = explode( ',', $item_id );
744 667 }
745 668
@@ -776,9 +699,9 @@
776 699 *
777 700 * @since 2.0.19
778 701 * @since 5.0.16 function went from private to public.
779 702 *
780 - * @param int $form_id
703 + * @param int $form_id
781 704 * @param object $form
782 705 *
783 706 * @return array $csv_fields
784 707 */
@@ -784,9 +707,8 @@
784 707 */
785 708 public static function get_fields_for_csv_export( $form_id, $form ) {
786 709 $csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
787 710 $no_export_fields = FrmField::no_save_fields();
788 -
789 711 foreach ( $csv_fields as $k => $f ) {
790 712 if ( in_array( $f->type, $no_export_fields, true ) ) {
791 713 unset( $csv_fields[ $k ] );
792 714 }
@@ -794,13 +716,8 @@
794 716
795 717 return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
796 718 }
797 719
798 - /**
799 - * @param array $mimes
800 - *
801 - * @return array
802 - */
803 720 public static function allow_mime( $mimes ) {
804 721 if ( ! isset( $mimes['csv'] ) ) {
805 722 // allow csv files
806 723 $mimes['csv'] = 'text/csv';