← All changes | classes/models/FrmSettings.php +353 -79 6.4.2 → trunk View file →

		@@ -4,59 +4,254 @@
4	4	}
5	5
6	6	#[\AllowDynamicProperties]
7	7	class FrmSettings {
	8	+
	9	+ /**
	10	+ * @var string
	11	+ */
8	12	public $option_name = 'frm_options';
	13	+
	14	+ /**
	15	+ * @var int
	16	+ */
9	17	public $menu;
	18	+
	19	+ /**
	20	+ * @var int
	21	+ */
10	22	public $mu_menu;
11		- public $use_html;
12		- public $jquery_css;
13		- public $accordion_js;
	23	+
	24	+ /**
	25	+ * @var int
	26	+ */
14	27	public $fade_form;
15		- public $old_css;
	28	+
	29	+ /**
	30	+ * @var bool
	31	+ */
16	32	public $admin_bar;
17	33
	34	+ /**
	35	+ * @var string
	36	+ */
18	37	public $success_msg;
	38	+
	39	+ /**
	40	+ * @var string
	41	+ */
19	42	public $blank_msg;
	43	+
	44	+ /**
	45	+ * @var string
	46	+ */
20	47	public $unique_msg;
	48	+
	49	+ /**
	50	+ * @var string
	51	+ */
21	52	public $invalid_msg;
	53	+
	54	+ /**
	55	+ * @var string
	56	+ */
22	57	public $failed_msg;
	58	+
	59	+ /**
	60	+ * @var string
	61	+ */
23	62	public $submit_value;
	63	+
	64	+ /**
	65	+ * @var string
	66	+ */
24	67	public $login_msg;
	68	+
	69	+ /**
	70	+ * @var string
	71	+ */
25	72	public $admin_permission;
26	73
	74	+ /**
	75	+ * @var string
	76	+ */
27	77	public $email_to;
	78	+
	79	+ /**
	80	+ * @var string|null
	81	+ */
28	82	public $load_style;
	83	+
	84	+ /**
	85	+ * @var bool|int|null
	86	+ */
29	87	public $custom_style;
30	88
	89	+ /**
	90	+ * @var string|null
	91	+ */
31	92	public $active_captcha;
32		- public $hcaptcha_pubkey;
33		- public $hcaptcha_privkey;
	93	+
	94	+ /**
	95	+ * Settings for reCAPTCHA.
	96	+ */
	97	+
	98	+ /**
	99	+ * @var string|null
	100	+ */
34	101	public $pubkey;
	102	+
	103	+ /**
	104	+ * @var string|null
	105	+ */
35	106	public $privkey;
	107	+
	108	+ /**
	109	+ * @var string|null
	110	+ */
36	111	public $re_lang;
	112	+
	113	+ /**
	114	+ * @var string|null
	115	+ */
37	116	public $re_type;
	117	+
	118	+ /**
	119	+ * @var string
	120	+ */
38	121	public $re_msg;
	122	+
	123	+ /**
	124	+ * @var bool
	125	+ */
39	126	public $re_multi;
40	127
	128	+ /**
	129	+ * @var float|string|null
	130	+ */
	131	+ public $re_threshold;
	132	+
	133	+ /**
	134	+ * Settings for hCaptcha.
	135	+ */
	136	+
	137	+ /**
	138	+ * @var string
	139	+ */
	140	+ public $hcaptcha_pubkey;
	141	+
	142	+ /**
	143	+ * @var string|null
	144	+ */
	145	+ public $hcaptcha_privkey;
	146	+
	147	+ /**
	148	+ * Settings for Turnstile.
	149	+ */
	150	+
	151	+ /**
	152	+ * @var string
	153	+ */
	154	+ public $turnstile_pubkey;
	155	+
	156	+ /**
	157	+ * @var string|null
	158	+ */
	159	+ public $turnstile_privkey;
	160	+
	161	+ /**
	162	+ * @var bool
	163	+ */
41	164	public $no_ips;
	165	+
	166	+ /**
	167	+ * @var string
	168	+ */
42	169	public $custom_header_ip;
	170	+
	171	+ /**
	172	+ * @var int
	173	+ */
43	174	public $current_form = 0;
	175	+
	176	+ /**
	177	+ * @var bool|int
	178	+ */
44	179	public $tracking;
45	180
46	181	/**
	182	+ * @var bool
	183	+ */
	184	+ public $summary_emails;
	185	+
	186	+ /**
	187	+ * @var string
	188	+ */
	189	+ public $summary_emails_recipients;
	190	+
	191	+ /**
	192	+ * @var string|null
	193	+ */
	194	+ public $default_email;
	195	+
	196	+ /**
	197	+ * @var string
	198	+ */
	199	+ public $from_email;
	200	+
	201	+ /**
	202	+ * @var string|null
	203	+ */
	204	+ public $currency;
	205	+
	206	+ /**
47	207	* @since 6.0
48	208	*
49		- * @var string|false|null
	209	+ * @var false|string|null
50	210	*/
51	211	public $custom_css;
52	212
	213	+ /**
	214	+ * @var int
	215	+ */
	216	+ public $honeypot;
	217	+
	218	+ /**
	219	+ * @var bool
	220	+ */
	221	+ public $wp_spam_check;
	222	+
	223	+ /**
	224	+ * @var bool
	225	+ */
	226	+ public $denylist_check;
	227	+
	228	+ /**
	229	+ * @since 6.25.1
	230	+ *
	231	+ * @var int|null 1 if installed after welcome tour update, null otherwise.
	232	+ */
	233	+ public $installed_after_welcome_tour_update;
	234	+
	235	+ /**
	236	+ * @var string
	237	+ */
	238	+ public $disallowed_words;
	239	+
	240	+ /**
	241	+ * @var string
	242	+ */
	243	+ public $allowed_words;
	244	+
	245	+ /**
	246	+ * @param array $args
	247	+ */
53	248	public function __construct( $args = array() ) {
54	249	if ( ! defined( 'ABSPATH' ) ) {
55	250	die( 'You are not allowed to call this page directly.' );
56	251	}
57	252
58		- $settings = get_transient( $this->option_name );
	253	+ $settings = get_option( $this->option_name );
59	254
60	255	if ( ! is_object( $settings ) ) {
61	256	$settings = $this->translate_settings( $settings );
62	257	}
		@@ -70,30 +265,24 @@
70	265
71	266	$this->maybe_filter_for_form( $args );
72	267	}
73	268
	269	+ /**
	270	+ * @param false|object $settings
	271	+ *
	272	+ * @return object
	273	+ */
74	274	private function translate_settings( $settings ) {
75		- if ( $settings ) { //workaround for W3 total cache conflict
	275	+ if ( $settings ) {
	276	+ // Workaround for W3 total cache conflict.
76	277	return unserialize( serialize( $settings ) );
77	278	}
78	279
79		- $settings = get_option( $this->option_name );
80		- if ( is_object( $settings ) ) {
81		- set_transient( $this->option_name, $settings );
	280	+ // If unserializing didn't work.
	281	+ $settings = $this;
82	282
83		- return $settings;
84		- }
	283	+ update_option( $this->option_name, $settings, true );
85	284
86		- // If unserializing didn't work
87		- if ( $settings ) { //workaround for W3 total cache conflict
88		- $settings = unserialize( serialize( $settings ) );
89		- } else {
90		- $settings = $this;
91		- }
92		-
93		- update_option( $this->option_name, $settings );
94		- set_transient( $this->option_name, $settings );
95		-
96	285	return $settings;
97	286	}
98	287
99	288	/**
		@@ -100,37 +289,46 @@
100	289	* @return array
101	290	*/
102	291	public function default_options() {
103	292	return array(
104		- 'menu' => apply_filters( 'frm_default_menu', 'Formidable' ),
105		- 'mu_menu' => 0,
106		- 'use_html' => true,
107		- 'jquery_css' => false,
108		- 'accordion_js' => false,
109		- 'fade_form' => false,
110		- 'old_css' => false,
111		- 'admin_bar' => false,
	293	+ 'menu' => apply_filters( 'frm_default_menu', 'Formidable' ),
	294	+ 'mu_menu' => 0,
	295	+ 'fade_form' => false,
	296	+ 'admin_bar' => false,
112	297
113		- 're_multi' => 1,
	298	+ 're_multi' => 1,
114	299
115		- 'success_msg' => __( 'Your responses were successfully submitted. Thank you!', 'formidable' ),
116		- 'blank_msg' => __( 'This field cannot be blank.', 'formidable' ),
117		- 'unique_msg' => __( 'This value must be unique.', 'formidable' ),
118		- 'invalid_msg' => __( 'There was a problem with your submission. Errors are marked below.', 'formidable' ),
119		- 'failed_msg' => __( 'We\'re sorry. It looks like you\'ve already submitted that.', 'formidable' ),
120		- 'submit_value' => __( 'Submit', 'formidable' ),
121		- 'login_msg' => __( 'You do not have permission to view this form.', 'formidable' ),
122		- 'admin_permission' => __( 'You do not have permission to do that', 'formidable' ),
123		- 'new_tab_msg' => __( 'The page has been opened in a new tab.', 'formidable' ),
	300	+ 'success_msg' => __( 'Your responses were successfully submitted. Thank you!', 'formidable' ),
	301	+ // translators: %s: [field_name] shortcode.
	302	+ 'blank_msg' => sprintf( __( '%s cannot be blank.', 'formidable' ), '[field_name]' ),
	303	+ // translators: %s: [field_name] shortcode.
	304	+ 'unique_msg' => sprintf( __( '%s must be unique.', 'formidable' ), '[field_name]' ),
	305	+ 'invalid_msg' => __( 'There was a problem with your submission. Errors are marked below.', 'formidable' ),
	306	+ 'failed_msg' => __( 'We\'re sorry. It looks like you\'ve already submitted that.', 'formidable' ),
	307	+ 'submit_value' => __( 'Submit', 'formidable' ),
	308	+ 'login_msg' => __( 'You do not have permission to view this form.', 'formidable' ),
	309	+ 'admin_permission' => __( 'You do not have permission to do that', 'formidable' ),
	310	+ 'new_tab_msg' => __( 'The page has been opened in a new tab.', 'formidable' ),
124	311
125		- 'email_to' => '[admin_email]',
126		- 'no_ips' => 0,
127		- 'custom_header_ip' => false, // Use false by default. We show a warning when this is unset. Once global settings have been saved, this gets saved
128		- 'tracking' => FrmAppHelper::pro_is_installed(),
	312	+ 'email_to' => '[admin_email]',
	313	+ 'enable_gdpr' => 0,
	314	+ 'no_gdpr_cookies' => 0,
	315	+ 'no_ips' => 0,
	316	+ 'custom_header_ip' => 0,
	317	+ 'tracking' => FrmAppHelper::pro_is_installed(),
	318	+ // Only enable this by default for the main site.
	319	+ 'summary_emails' => get_current_blog_id() === get_main_site_id(),
	320	+ 'summary_emails_recipients' => '[admin_email]',
129	321
130	322	// Normally custom CSS is a string. A false value is used when nothing has been set.
131	323	// When it is false, we try to use the old custom_key value from the default style's post_content array.
132		- 'custom_css' => false,
	324	+ 'custom_css' => false,
	325	+ 'honeypot' => 1,
	326	+ 'wp_spam_check' => 0,
	327	+ 'denylist_check' => 0,
	328	+ 'disallowed_words' => '',
	329	+ 'allowed_words' => '',
	330	+ 'email_style' => 'classic',
133	331	);
134	332	}
135	333
136	334	/**
		@@ -150,9 +348,10 @@
150	348	$this->fill_with_defaults();
151	349
152	350	if ( is_multisite() && is_admin() ) {
153	351	$mu_menu = get_site_option( 'frm_admin_menu_name' );
154		- if ( $mu_menu && ! empty( $mu_menu ) ) {
	352	+
	353	+ if ( $mu_menu && $mu_menu ) {
155	354	$this->menu = $mu_menu;
156	355	$this->mu_menu = 1;
157	356	}
158	357	}
		@@ -157,17 +356,27 @@
157	356	}
158	357	}
159	358
160	359	$frm_roles = FrmAppHelper::frm_capabilities( 'pro' );
	360	+
161	361	foreach ( $frm_roles as $frm_role => $frm_role_description ) {
162	362	if ( ! isset( $this->$frm_role ) ) {
163	363	$this->$frm_role = 'administrator';
164	364	}
165	365	}
	366	+
	367	+ if ( ! isset( $this->default_email ) ) {
	368	+ $this->default_email = get_option( 'admin_email' );
	369	+ }
	370	+
	371	+ if ( ! isset( $this->currency ) ) {
	372	+ $this->currency = 'USD';
	373	+ }
166	374	}
167	375
168	376	/**
169	377	* @param array $params
	378	+ *
170	379	* @return void
171	380	*/
172	381	public function fill_with_defaults( $params = array() ) {
173	382	$settings = $this->default_options();
		@@ -174,8 +383,9 @@
174	383	$filter_html = ! FrmAppHelper::allow_unfiltered_html();
175	384
176	385	if ( $filter_html ) {
177	386	$filter_keys = array( 'failed_msg', 'blank_msg', 'invalid_msg', 'admin_permission', 'unique_msg', 'success_msg', 'submit_value', 'login_msg', 'menu' );
	387	+
178	388	if ( ! empty( $params['additional_filter_keys'] ) ) {
179	389	$filter_keys = array_merge( $filter_keys, $params['additional_filter_keys'] );
180	390	}
181	391	} else {
		@@ -205,8 +415,9 @@
205	415	*
206	416	* @param mixed $value The unsanitized global setting value.
207	417	* @param string $key The key of the global setting being saved.
208	418	* @param array $filter_keys These keys that are filtered with kses.
	419	+ *
209	420	* @return mixed
210	421	*/
211	422	private function maybe_sanitize_global_setting( $value, $key, $filter_keys ) {
212	423	if ( 'custom_css' === $key ) {
		@@ -213,8 +424,9 @@
213	424	if ( false === $value ) {
214	425	// Avoid changing the false default value to an empty string.
215	426	return $value;
216	427	}
	428	+
217	429	return sanitize_textarea_field( $value );
218	430	}
219	431
220	432	if ( in_array( $key, $filter_keys, true ) ) {
		@@ -231,24 +443,28 @@
231	443	if ( ! isset( $this->active_captcha ) ) {
232	444	$this->active_captcha = 'recaptcha';
233	445	}
234	446
235		- $privkey = '';
236		- $re_lang = '';
	447	+ $privkey = '';
	448	+ $re_lang = '';
237	449
238	450	if ( ! isset( $this->hcaptcha_privkey ) ) {
239	451	$this->hcaptcha_privkey = '';
240	452	}
241	453
	454	+ if ( ! isset( $this->turnstile_privkey ) ) {
	455	+ $this->turnstile_privkey = '';
	456	+ }
	457	+
242	458	if ( ! isset( $this->pubkey ) ) {
243		- // get the options from the database
	459	+ // Get the options from the database.
244	460	$recaptcha_opt = is_multisite() ? get_site_option( 'recaptcha' ) : get_option( 'recaptcha' );
245		- $this->pubkey = isset( $recaptcha_opt['pubkey'] ) ? $recaptcha_opt['pubkey'] : '';
246		- $privkey = isset( $recaptcha_opt['privkey'] ) ? $recaptcha_opt['privkey'] : $privkey;
247		- $re_lang = isset( $recaptcha_opt['re_lang'] ) ? $recaptcha_opt['re_lang'] : $re_lang;
	461	+ $this->pubkey = $recaptcha_opt['pubkey'] ?? '';
	462	+ $privkey = $recaptcha_opt['privkey'] ?? $privkey;
	463	+ $re_lang = $recaptcha_opt['re_lang'] ?? $re_lang;
248	464	}
249	465
250		- if ( ! isset( $this->re_msg ) || empty( $this->re_msg ) ) {
	466	+ if ( ! $this->re_msg ) {
251	467	$this->re_msg = __( 'The CAPTCHA was not entered correctly', 'formidable' );
252	468	}
253	469
254	470	if ( ! isset( $this->privkey ) ) {
		@@ -288,23 +504,30 @@
288	504	* Allow strings to be filtered when a specific form may be displaying them.
289	505	*
290	506	* @since 3.06.01
291	507	*
	508	+ * @param array $args
	509	+ *
292	510	* @return void
293	511	*/
294	512	public function maybe_filter_for_form( $args ) {
295		- if ( isset( $args['current_form'] ) && is_numeric( $args['current_form'] ) ) {
296		- $this->current_form = $args['current_form'];
297		- foreach ( $this->translatable_strings() as $string ) {
298		- $this->{$string} = apply_filters( 'frm_global_setting', $this->{$string}, $string, $this );
299		- $this->{$string} = apply_filters( 'frm_global_' . $string, $this->{$string}, $this );
300		- }
	513	+ if ( ! isset( $args['current_form'] ) || ! is_numeric( $args['current_form'] ) ) {
	514	+ return;
301	515	}
	516	+
	517	+ $this->current_form = $args['current_form'];
	518	+
	519	+ foreach ( $this->translatable_strings() as $string ) {
	520	+ $this->{$string} = apply_filters( 'frm_global_setting', $this->{$string}, $string, $this );
	521	+ $this->{$string} = apply_filters( 'frm_global_' . $string, $this->{$string}, $this );
	522	+ }
302	523	}
303	524
304	525	/**
305	526	* @param array $params
306	527	* @param array $errors
	528	+ *
	529	+ * @return array
307	530	*/
308	531	public function validate( $params, $errors ) {
309	532	return apply_filters( 'frm_validate_settings', $errors, $params );
310	533	}
		@@ -327,31 +550,55 @@
327	550	$this->update_roles( $params );
328	551
329	552	do_action( 'frm_update_settings', $params );
330	553
331		- if ( function_exists( 'get_filesystem_method' ) ) {
332		- // Save styling settings in case fallback setting changes.
333		- $frm_style = new FrmStyle();
334		- $frm_style->update( 'default' );
	554	+ if ( ! function_exists( 'get_filesystem_method' ) ) {
	555	+ return;
335	556	}
	557	+
	558	+ // Save styling settings in case fallback setting changes.
	559	+ $frm_style = new FrmStyle();
	560	+ $frm_style->update( 'default' );
336	561	}
337	562
338	563	/**
	564	+ * @param array $params
	565	+ *
339	566	* @return void
340	567	*/
341	568	private function update_settings( $params ) {
342		- $this->active_captcha = $params['frm_active_captcha'];
343		- $this->hcaptcha_pubkey = trim( $params['frm_hcaptcha_pubkey'] );
344		- $this->hcaptcha_privkey = trim( $params['frm_hcaptcha_privkey'] );
345		- $this->pubkey = trim( $params['frm_pubkey'] );
346		- $this->privkey = trim( $params['frm_privkey'] );
347		- $this->re_type = $params['frm_re_type'];
348		- $this->re_lang = $params['frm_re_lang'];
349		- $this->re_threshold = floatval( $params['frm_re_threshold'] );
350		- $this->load_style = $params['frm_load_style'];
351		- $this->custom_css = $params['frm_custom_css'];
	569	+ $this->active_captcha = $params['frm_active_captcha'];
	570	+ $this->pubkey = trim( $params['frm_pubkey'] );
	571	+ $this->privkey = trim( $params['frm_privkey'] );
	572	+ $this->re_type = $params['frm_re_type'];
	573	+ $this->re_lang = $params['frm_re_lang'];
	574	+ $this->re_threshold = floatval( $params['frm_re_threshold'] );
	575	+ $this->hcaptcha_pubkey = trim( $params['frm_hcaptcha_pubkey'] );
	576	+ $this->hcaptcha_privkey = trim( $params['frm_hcaptcha_privkey'] );
	577	+ $this->turnstile_pubkey = trim( $params['frm_turnstile_pubkey'] );
	578	+ $this->turnstile_privkey = trim( $params['frm_turnstile_privkey'] );
	579	+ $this->load_style = $params['frm_load_style'];
	580	+ $this->custom_css = $params['frm_custom_css'];
	581	+ $this->default_email = $params['frm_default_email'];
	582	+ $this->from_email = $params['frm_from_email'];
	583	+ $this->currency = $params['frm_currency'];
352	584
353		- $checkboxes = array( 'mu_menu', 're_multi', 'use_html', 'jquery_css', 'accordion_js', 'fade_form', 'no_ips', 'custom_header_ip', 'tracking', 'admin_bar' );
	585	+ $checkboxes = array(
	586	+ 'mu_menu',
	587	+ 're_multi',
	588	+ 'fade_form',
	589	+ 'no_ips',
	590	+ 'no_gdpr_cookies',
	591	+ 'enable_gdpr',
	592	+ 'custom_header_ip',
	593	+ 'tracking',
	594	+ 'admin_bar',
	595	+ 'summary_emails',
	596	+ 'honeypot',
	597	+ 'wp_spam_check',
	598	+ 'denylist_check',
	599	+ );
	600	+
354	601	foreach ( $checkboxes as $set ) {
355	602	$this->$set = isset( $params[ 'frm_' . $set ] ) ? absint( $params[ 'frm_' . $set ] ) : 0;
356	603	}
357	604	}
		@@ -356,8 +603,10 @@
356	603	}
357	604	}
358	605
359	606	/**
	607	+ * @param array $params
	608	+ *
360	609	* @return void
361	610	*/
362	611	private function update_roles( $params ) {
363	612	global $wp_roles;
		@@ -363,18 +612,19 @@
363	612	global $wp_roles;
364	613
365	614	$frm_roles = FrmAppHelper::frm_capabilities();
366	615	$roles = get_editable_roles();
	616	+
367	617	foreach ( $frm_roles as $frm_role => $frm_role_description ) {
368		- $this->$frm_role = (array) ( isset( $params[ $frm_role ] ) ? $params[ $frm_role ] : 'administrator' );
	618	+ $this->$frm_role = (array) ( $params[ $frm_role ] ?? 'administrator' );
369	619
370	620	// Make sure administrators always have permissions
371		- if ( ! in_array( 'administrator', $this->$frm_role ) ) {
	621	+ if ( ! in_array( 'administrator', $this->$frm_role, true ) ) {
372	622	array_push( $this->$frm_role, 'administrator' );
373	623	}
374	624
375	625	foreach ( $roles as $role => $details ) {
376		- if ( in_array( $role, $this->$frm_role ) ) {
	626	+ if ( in_array( $role, $this->$frm_role, true ) ) {
377	627	$wp_roles->add_cap( $role, $frm_role );
378	628	} else {
379	629	$wp_roles->remove_cap( $role, $frm_role );
380	630	}
		@@ -379,8 +629,32 @@
379	629	$wp_roles->remove_cap( $role, $frm_role );
380	630	}
381	631	}
382	632	}
	633	+ }
	634	+
	635	+ /**
	636	+ * Updates a single setting with specified sanitization.
	637	+ *
	638	+ * @since 6.9
	639	+ *
	640	+ * @param string $key The setting key to update.
	641	+ * @param mixed $value The new value for the setting.
	642	+ * @param string $sanitize The name of the sanitization function to apply to the new value.
	643	+ *
	644	+ * @return bool True on success, false on failure.
	645	+ */
	646	+ public function update_setting( $key, $value, $sanitize ) {
	647	+ if ( ! property_exists( $this, $key ) || ! is_callable( $sanitize ) ) {
	648	+ // Setting does not exist or sanitization function name is not callable.
	649	+ return false;
	650	+ }
	651	+
	652	+ // Update the property value.
	653	+ FrmAppHelper::sanitize_value( $sanitize, $value );
	654	+ $this->{$key} = $value;
	655	+
	656	+ return true;
383	657	}
384	658
385	659	/**
386	660	* @return void