PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.8
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.8
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/controllers/FrmXMLController.php +22 -105 6.266.8 View file →
@@ -40,9 +40,8 @@
40 40 /**
41 41 * Use the template link to install the XML template
42 42 *
43 43 * @since 3.06
44 - *
45 44 * @return void
46 45 */
47 46 public static function install_template() {
48 47 FrmAppHelper::permission_check( 'frm_edit_forms' );
@@ -82,9 +81,8 @@
82 81
83 82 self::set_new_form_name( $xml );
84 83
85 84 $imported = FrmXMLHelper::import_xml_now( $xml, true );
86 -
87 85 if ( ! empty( $imported['form_status'] ) ) {
88 86 // Get the last form id in case there are child forms.
89 87 end( $imported['form_status'] );
90 88 $form_id = key( $imported['form_status'] );
@@ -92,9 +90,8 @@
92 90 'id' => $form_id,
93 91 'redirect' => FrmForm::get_edit_link( $form_id ) . '&new_template=true',
94 92 'success' => 1,
95 93 );
96 -
97 94 if ( ! empty( $imported['imported']['posts'] ) ) {
98 95 // Return the link to the last page created.
99 96 $pages = $imported['posts'];
100 97 }
@@ -103,10 +100,10 @@
103 100 // Create selected pages with the correct shortcodes.
104 101 $pages = self::create_pages_for_import( $form );
105 102 }
106 103
107 - if ( ! empty( $pages ) ) {
108 - $post_id = end( $pages );
104 + if ( isset( $pages ) && ! empty( $pages ) ) {
105 + $post_id = end( $pages );
109 106 $response['redirect'] = get_permalink( $post_id );
110 107 }
111 108 } else {
112 109 if ( isset( $imported['error'] ) ) {
@@ -113,9 +110,8 @@
113 110 $message = $imported['error'];
114 111 } else {
115 112 $message = __( 'There was an error importing form', 'formidable' );
116 113 }
117 -
118 114 $response = array(
119 115 'message' => $message,
120 116 );
121 117
@@ -120,12 +116,9 @@
120 116 );
121 117
122 118 }//end if
123 119
124 - /**
125 - * @since 6.18 Added `url` to the $args.
126 - */
127 - $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported', 'url' ) );
120 + $response = apply_filters( 'frm_xml_response', $response, compact( 'form', 'imported' ) );
128 121
129 122 echo wp_json_encode( $response );
130 123 wp_die();
131 124 }
@@ -134,9 +127,8 @@
134 127 * Make sure that the XML file we're trying to load is in fact an XML file, and that it's coming from our S3 bucket.
135 128 * This is to make sure that the URL can't be exploited for a SSRF attack.
136 129 *
137 130 * @since 5.5.5
138 - *
139 131 * @param string $url
140 132 *
141 133 * @return bool True on success, False on error.
142 134 */
@@ -150,13 +142,11 @@
150 142 * @return mixed
151 143 */
152 144 private static function get_posted_form() {
153 145 $form = FrmAppHelper::get_param( 'form', '', 'post', 'wp_unslash' );
154 -
155 146 if ( empty( $form ) ) {
156 147 return $form;
157 148 }
158 -
159 149 $form = json_decode( $form, true );
160 150 return $form;
161 151 }
162 152
@@ -164,22 +154,17 @@
164 154 * Get a different URL depending on the selection in the form.
165 155 *
166 156 * @since 4.06.02
167 157 *
168 - * @param array $form The posted form values.
169 - * @param string $url The URL to override.
170 - *
171 158 * @return void
172 159 */
173 160 private static function override_url( $form, &$url ) {
174 161 $selected_form = self::get_selected_in_form( $form, 'form' );
175 -
176 162 if ( empty( $selected_form ) ) {
177 163 return;
178 164 }
179 165
180 - $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
181 -
166 + $selected_xml = isset( $form['xml'] ) && isset( $form['xml'][ $selected_form ] ) ? $form['xml'][ $selected_form ] : '';
182 167 if ( empty( $selected_xml ) || strpos( $selected_xml, 'http' ) !== 0 ) {
183 168 return;
184 169 }
185 170
@@ -190,13 +175,11 @@
190 175 * @since 4.06.02
191 176 *
192 177 * @param array $form
193 178 * @param string $value
194 - *
195 - * @return string
196 179 */
197 180 private static function get_selected_in_form( $form, $value = 'form' ) {
198 - if ( ! empty( $form ) && ! empty( $form[ $value ] ) ) {
181 + if ( ! empty( $form ) && isset( $form[ $value ] ) && ! empty( $form[ $value ] ) ) {
199 182 return $form[ $value ];
200 183 }
201 184
202 185 return '';
@@ -206,20 +189,19 @@
206 189 * @since 4.06.02
207 190 *
208 191 * @param array $form The posted form values.
209 192 *
210 - * @return array|null The array of created pages.
193 + * @return array The array of created pages.
211 194 */
212 195 private static function create_pages_for_import( $form ) {
213 - if ( empty( $form['pages'] ) ) {
214 - return null;
196 + if ( ! isset( $form['pages'] ) || empty( $form['pages'] ) ) {
197 + return;
215 198 }
216 199
217 - $form_key = self::get_selected_in_form( $form, 'form' );
200 + $form_key = self::get_selected_in_form( $form, 'form' );
218 201 $view_keys = self::get_selected_in_form( $form, 'view' );
219 202
220 203 $page_ids = array();
221 -
222 204 foreach ( (array) $form['pages'] as $for => $name ) {
223 205 if ( empty( $name ) ) {
224 206 // Don't create a page if no title is given.
225 207 continue;
@@ -228,9 +210,9 @@
228 210 if ( $for === 'view' ) {
229 211 $item_key = is_array( $view_keys ) ? $view_keys[ $form_key ] : $view_keys;
230 212 $shortcode = '[display-frm-data id=%1$s filter=limited]';
231 213 } elseif ( $for === 'form' ) {
232 - $item_key = $form_key;
214 + $item_key = $form_key;
233 215 $shortcode = '[formidable id=%1$s]';
234 216 } else {
235 217 $item_key = self::get_selected_in_form( $form, 'form' );
236 218 $shortcode = '[' . esc_html( $for ) . ' id=%1$s]';
@@ -260,9 +242,8 @@
260 242 *
261 243 * @since 3.06
262 244 *
263 245 * @param object $xml The values included in the XML.
264 - *
265 246 * @return void
266 247 */
267 248 private static function set_new_form_name( &$xml ) {
268 249 if ( ! isset( $xml->form ) ) {
@@ -270,9 +251,8 @@
270 251 }
271 252
272 253 $name = FrmAppHelper::get_param( 'name', '', 'post', 'sanitize_text_field' );
273 254 $description = FrmAppHelper::get_param( 'desc', '', 'post', 'sanitize_textarea_field' );
274 -
275 255 if ( ! $name && ! $description ) {
276 256 return;
277 257 }
278 258
@@ -277,9 +257,8 @@
277 257 }
278 258
279 259 // Get the main form ID.
280 260 $set_name = 0;
281 -
282 261 foreach ( $xml->form as $form ) {
283 262 if ( empty( $form->parent_form_id ) ) {
284 263 $set_name = (int) $form->id;
285 264 }
@@ -322,9 +301,9 @@
322 301 * @return void
323 302 */
324 303 public static function form( $errors = array(), $message = '' ) {
325 304 $where = array(
326 - 'status' => array( null, '', 'published' ),
305 + 'status' => array( null, '', 'published' ),
327 306 );
328 307 $forms = FrmForm::getAll( $where, 'name' );
329 308
330 309 $export_types = array(
@@ -357,9 +336,8 @@
357 336 $errors = array();
358 337 $message = '';
359 338
360 339 $permission_error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'import-xml', 'import-xml-nonce' );
361 -
362 340 if ( false !== $permission_error ) {
363 341 $errors[] = $permission_error;
364 342 self::form( $errors );
365 343
@@ -365,11 +343,9 @@
365 343
366 344 return;
367 345 }
368 346
369 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
370 347 $has_file = ! empty( $_FILES['frm_import_file'] ) && ! empty( $_FILES['frm_import_file']['name'] ) && ! empty( $_FILES['frm_import_file']['size'] ) && (int) $_FILES['frm_import_file']['size'] > 0;
371 -
372 348 if ( ! $has_file ) {
373 349 $errors[] = __( 'Oops, you didn\'t select a file.', 'formidable' );
374 350 self::form( $errors );
375 351
@@ -375,9 +351,9 @@
375 351
376 352 return;
377 353 }
378 354
379 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
355 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
380 356 $file = isset( $_FILES['frm_import_file']['tmp_name'] ) ? sanitize_option( 'upload_path', $_FILES['frm_import_file']['tmp_name'] ) : '';
381 357
382 358 if ( ! is_uploaded_file( $file ) ) {
383 359 unset( $file );
@@ -395,12 +371,11 @@
395 371 ),
396 372 );
397 373 $export_format = apply_filters( 'frm_export_formats', $export_format );
398 374
399 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing
375 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
400 376 $file_type = sanitize_option( 'upload_path', $_FILES['frm_import_file']['name'] );
401 377 $file_type = strtolower( pathinfo( $file_type, PATHINFO_EXTENSION ) );
402 -
403 378 if ( 'xml' !== $file_type && isset( $export_format[ $file_type ] ) ) {
404 379 // allow other file types to be imported
405 380 do_action( 'frm_before_import_' . $file_type );
406 381
@@ -433,9 +408,8 @@
433 408 * @return void
434 409 */
435 410 public static function export_xml() {
436 411 $error = FrmAppHelper::permission_nonce_error( 'frm_edit_forms', 'export-xml', 'export-xml-nonce' );
437 -
438 412 if ( ! empty( $error ) ) {
439 413 wp_die( esc_html( $error ) );
440 414 }
441 415
@@ -459,10 +433,10 @@
459 433 wp_die();
460 434 }
461 435
462 436 /**
463 - * @param array<string>|string $type
464 - * @param array $args
437 + * @param string[] $type
438 + * @param array $args
465 439 *
466 440 * @psalm-param array{ids?: mixed} $args
467 441 *
468 442 * @return void
@@ -471,15 +445,8 @@
471 445 global $wpdb;
472 446
473 447 self::prepare_types_array( $type );
474 448
475 - if ( ! is_array( $type ) ) {
476 - // This shouldn't be possible.
477 - // It is cast to array in prepare_types_array.
478 - // This is just for static analysis.
479 - return;
480 - }
481 -
482 449 $tables = array(
483 450 'items' => $wpdb->prefix . 'frm_items',
484 451 'forms' => $wpdb->prefix . 'frm_forms',
485 452 'posts' => $wpdb->posts,
@@ -522,9 +489,8 @@
522 489 break;
523 490 case 'actions':
524 491 $select = $table . '.ID';
525 492 $where['post_type'] = FrmFormActionsController::$action_post_type;
526 -
527 493 if ( ! empty( $args['ids'] ) ) {
528 494 $where['menu_order'] = $args['ids'];
529 495 }
530 496 break;
@@ -539,12 +505,10 @@
539 505 $frm_style = new FrmStyle();
540 506 $default_style = $frm_style->get_default_style();
541 507 $form_ids = $args['ids'];
542 508 $style_ids = array();
543 -
544 509 foreach ( $form_ids as $form_id ) {
545 510 $form_data = FrmForm::getOne( $form_id );
546 -
547 511 // For forms that have not been updated while running 2.0, check if custom_style is set.
548 512 if ( isset( $form_data->options['custom_style'] ) ) {
549 513 if ( 1 === absint( $form_data->options['custom_style'] ) ) {
550 514 $style_ids[] = $default_style->ID;
@@ -553,9 +517,8 @@
553 517 }
554 518 }
555 519 unset( $form_id, $form_data );
556 520 }
557 -
558 521 $select = $table . '.ID';
559 522 $where['post_type'] = 'frm_styles';
560 523
561 524 // Only export selected styles.
@@ -578,9 +541,9 @@
578 541 $records[ $tb_type ] = FrmDb::get_col( $table . $join, $where, $select );
579 542 unset( $tb_type );
580 543 }//end foreach
581 544
582 - $filename = self::get_file_name( $args, $records );
545 + $filename = self::get_file_name( $args, $type, $records );
583 546
584 547 header( 'Content-Description: File Transfer' );
585 548 header( 'Content-Disposition: attachment; filename=' . $filename );
586 549 header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
@@ -589,46 +552,18 @@
589 552 include FrmAppHelper::plugin_path() . '/classes/views/xml/xml.php';
590 553 }
591 554
592 555 /**
593 - * Returns an array that has parent term slugs for the terms provided.
594 - *
595 - * @since 6.8.3
596 - *
597 - * @param array $terms
598 - *
599 - * @return array
600 - */
601 - public static function get_parent_terms_slugs( $terms ) {
602 - $parent_term_ids = array_filter( array_unique( wp_list_pluck( $terms, 'parent' ) ) );
603 - $parent_slugs = array();
604 -
605 - if ( ! $parent_term_ids ) {
606 - return $parent_slugs;
607 - }
608 -
609 - $results = FrmDb::get_results( 'terms', array( 'term_id' => $parent_term_ids ), 'term_id, slug' );
610 - $parent_slugs = wp_list_pluck( $results, 'slug', 'term_id' );
611 -
612 - return $parent_slugs;
613 - }
614 -
615 - /**
616 - * Prepare the types array.
617 - *
618 - * @param array<string>|string $type
619 - *
620 556 * @return void
621 557 */
622 558 private static function prepare_types_array( &$type ) {
623 559 $type = (array) $type;
624 -
625 - if ( ! in_array( 'forms', $type, true ) && ( in_array( 'items', $type, true ) || in_array( 'posts', $type, true ) ) ) {
560 + if ( ! in_array( 'forms', $type ) && ( in_array( 'items', $type ) || in_array( 'posts', $type ) ) ) {
626 561 // make sure the form is included if there are entries
627 562 $type[] = 'forms';
628 563 }
629 564
630 - if ( in_array( 'forms', $type, true ) ) {
565 + if ( in_array( 'forms', $type ) ) {
631 566 // include actions with forms
632 567 $type[] = 'actions';
633 568 }
634 569 }
@@ -639,15 +574,15 @@
639 574 *
640 575 * @since 3.06
641 576 *
642 577 * @param array $args
578 + * @param array $type
643 579 * @param array $records
644 580 *
645 581 * @return string
646 582 */
647 - private static function get_file_name( $args, $records ) {
648 - $has_one_form = ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
649 -
583 + private static function get_file_name( $args, $type, $records ) {
584 + $has_one_form = isset( $records['forms'] ) && ! empty( $records['forms'] ) && count( $args['ids'] ) === 1;
650 585 if ( $has_one_form ) {
651 586 // one form is being exported
652 587 $selected_form_id = reset( $args['ids'] );
653 588 $filename = 'form-' . $selected_form_id . '.xml';
@@ -653,9 +588,8 @@
653 588 $filename = 'form-' . $selected_form_id . '.xml';
654 589
655 590 foreach ( $records['forms'] as $form_id ) {
656 591 $filename = 'form-' . $form_id . '.xml';
657 -
658 592 if ( $selected_form_id === $form_id ) {
659 593 $form = FrmForm::getOne( $form_id );
660 594 $filename = $form->name !== '' ? $form->name : $form->form_key;
661 595 $filename = sanitize_title( $filename ) . '-form.xml';
@@ -667,9 +601,8 @@
667 601
668 602 if ( ! empty( $sitename ) ) {
669 603 $sitename .= '.';
670 604 }
671 -
672 605 $filename = $sitename . 'formidable.' . gmdate( 'Y-m-d' ) . '.xml';
673 606 }//end if
674 607
675 608 /**
@@ -686,9 +619,8 @@
686 619 * @return void
687 620 */
688 621 public static function generate_csv( $atts ) {
689 622 $form_ids = $atts['ids'];
690 -
691 623 if ( empty( $form_ids ) ) {
692 624 wp_die( esc_html__( 'Please select a form', 'formidable' ) );
693 625 }
694 626 self::csv( reset( $form_ids ) );
@@ -698,12 +630,8 @@
698 630 * Export to CSV
699 631 *
700 632 * @since 2.0.19
701 633 *
702 - * @param false|int|string $form_id
703 - * @param string $search
704 - * @param string $fid
705 - *
706 634 * @return void
707 635 */
708 636 public static function csv( $form_id = false, $search = '', $fid = '' ) {
709 637 FrmAppHelper::permission_check( 'frm_view_entries' );
@@ -714,14 +642,10 @@
714 642 $fid = FrmAppHelper::get_param( 'fid', '', 'get', 'sanitize_text_field' );
715 643 }
716 644
717 645 // Remove time limit to execute this function.
718 - if ( function_exists( 'set_time_limit' ) ) {
719 - set_time_limit( 0 );
720 - }
721 -
646 + set_time_limit( 0 );
722 647 $mem_limit = str_replace( 'M', '', ini_get( 'memory_limit' ) );
723 -
724 648 if ( (int) $mem_limit < 256 ) {
725 649 wp_raise_memory_limit();
726 650 }
727 651
@@ -737,9 +661,8 @@
737 661 $form_id = $form->id;
738 662 $form_cols = self::get_fields_for_csv_export( $form_id, $form );
739 663
740 664 $item_id = FrmAppHelper::get_param( 'item_id', 0, 'get', 'sanitize_text_field' );
741 -
742 665 if ( ! empty( $item_id ) ) {
743 666 $item_id = explode( ',', $item_id );
744 667 }
745 668
@@ -784,9 +707,8 @@
784 707 */
785 708 public static function get_fields_for_csv_export( $form_id, $form ) {
786 709 $csv_fields = FrmField::get_all_for_form( $form_id, '', 'include', 'include' );
787 710 $no_export_fields = FrmField::no_save_fields();
788 -
789 711 foreach ( $csv_fields as $k => $f ) {
790 712 if ( in_array( $f->type, $no_export_fields, true ) ) {
791 713 unset( $csv_fields[ $k ] );
792 714 }
@@ -794,13 +716,8 @@
794 716
795 717 return apply_filters( 'frm_fields_for_csv_export', $csv_fields, compact( 'form' ) );
796 718 }
797 719
798 - /**
799 - * @param array $mimes
800 - *
801 - * @return array
802 - */
803 720 public static function allow_mime( $mimes ) {
804 721 if ( ! isset( $mimes['csv'] ) ) {
805 722 // allow csv files
806 723 $mimes['csv'] = 'text/csv';