← All changes
|
includes/admin/tools/import/class-give-import-donations.php
+164
-120
2.3.2
→
4.17.0
View file →
| @@ -38,9 +38,9 @@ | ||
| 38 | 38 | * @since |
| 39 | 39 | * @access private |
| 40 | 40 | * @var |
| 41 | 41 | */ |
| 42 | - static private $instance; | |
| 42 | + private static $instance; | |
| 43 | 43 | |
| 44 | 44 | /** |
| 45 | 45 | * Importing donation per page. |
| 46 | 46 | * |
| @@ -109,11 +109,10 @@ | ||
| 109 | 109 | return; |
| 110 | 110 | } |
| 111 | 111 | |
| 112 | 112 | // Do not render main import tools page. |
| 113 | - remove_action( 'give_admin_field_tools_import', array( 'Give_Settings_Import', 'render_import_field', ) ); | |
| 113 | + remove_action( 'give_admin_field_tools_import', array( 'Give_Settings_Import', 'render_import_field' ) ); | |
| 114 | 114 | |
| 115 | - | |
| 116 | 115 | // Render donation import page |
| 117 | 116 | add_action( 'give_admin_field_tools_import', array( $this, 'render_page' ) ); |
| 118 | 117 | |
| 119 | 118 | // Print the HTML. |
| @@ -153,10 +152,10 @@ | ||
| 153 | 152 | public function submit() { |
| 154 | 153 | wp_nonce_field( 'give-save-settings', '_give-save-settings' ); |
| 155 | 154 | ?> |
| 156 | 155 | <input type="hidden" class="import-step" id="import-step" name="step" |
| 157 | - value="<?php echo $this->get_step(); ?>"/> | |
| 158 | - <input type="hidden" class="importer-type" value="<?php echo $this->importer_type; ?>"/> | |
| 156 | + value="<?php echo esc_attr($this->get_step()); ?>"/> | |
| 157 | + <input type="hidden" class="importer-type" value="<?php echo esc_attr($this->importer_type); ?>"/> | |
| 159 | 158 | <?php |
| 160 | 159 | } |
| 161 | 160 | |
| 162 | 161 | /** |
| @@ -171,10 +170,10 @@ | ||
| 171 | 170 | $this->render_progress(); |
| 172 | 171 | ?> |
| 173 | 172 | <section> |
| 174 | 173 | <table |
| 175 | - class="widefat export-options-table give-table <?php echo "step-{$step}"; ?> <?php echo( 1 === $step && ! empty( $this->is_csv_valid ) ? 'give-hidden' : '' ); ?> " | |
| 176 | - id="<?php echo "step-{$step}"; ?>"> | |
| 174 | + class="widefat export-options-table give-table <?php echo esc_attr("step-{$step}"); ?> <?php echo esc_attr(( 1 === $step && ! empty( $this->is_csv_valid ) ? 'give-hidden' : '' )); ?> " | |
| 175 | + id="<?php echo esc_attr("step-{$step}"); ?>"> | |
| 177 | 176 | <tbody> |
| 178 | 177 | <?php |
| 179 | 178 | switch ( $step ) { |
| 180 | 179 | case 1: |
| @@ -196,19 +195,19 @@ | ||
| 196 | 195 | ?> |
| 197 | 196 | <tr valign="top"> |
| 198 | 197 | <th> |
| 199 | 198 | <input type="submit" |
| 200 | - class="button button-primary button-large button-secondary <?php echo "step-{$step}"; ?>" | |
| 199 | + class="button button-primary button-large button-secondary <?php echo esc_attr("step-{$step}"); ?>" | |
| 201 | 200 | id="recount-stats-submit" |
| 202 | 201 | value=" |
| 203 | - <?php | |
| 204 | - /** | |
| 205 | - * Filter to modify donation importer submit button text. | |
| 206 | - * | |
| 207 | - * @since 2.1 | |
| 208 | - */ | |
| 209 | - echo apply_filters( 'give_import_donation_submit_button_text', __( 'Submit', 'give' ) ); | |
| 210 | - ?> | |
| 202 | + <?php | |
| 203 | + /** | |
| 204 | + * Filter to modify donation importer submit button text. | |
| 205 | + * | |
| 206 | + * @since 2.1 | |
| 207 | + */ | |
| 208 | + echo esc_attr(apply_filters( 'give_import_donation_submit_button_text', __( 'Submit', 'give' ) )); | |
| 209 | + ?> | |
| 211 | 210 | "/> |
| 212 | 211 | </th> |
| 213 | 212 | <th> |
| 214 | 213 | <?php |
| @@ -232,11 +231,13 @@ | ||
| 232 | 231 | |
| 233 | 232 | /** |
| 234 | 233 | * Show success notice |
| 235 | 234 | * |
| 235 | + * @since 2.25.3 Add nonce check. | |
| 236 | 236 | * @since 1.8.14 |
| 237 | 237 | */ |
| 238 | 238 | public function import_success() { |
| 239 | + check_admin_referer('give_donation_import_success'); | |
| 239 | 240 | |
| 240 | 241 | $delete_csv = ( ! empty( $_GET['delete_csv'] ) ? absint( $_GET['delete_csv'] ) : false ); |
| 241 | 242 | $csv = ( ! empty( $_GET['csv'] ) ? absint( $_GET['csv'] ) : false ); |
| 242 | 243 | if ( ! empty( $delete_csv ) && ! empty( $csv ) ) { |
| @@ -246,34 +247,34 @@ | ||
| 246 | 247 | $report = give_import_donation_report(); |
| 247 | 248 | |
| 248 | 249 | $report_html = array( |
| 249 | 250 | 'duplicate_donor' => array( |
| 250 | - __( '%s duplicate %s detected', 'give' ), | |
| 251 | - __( '%s duplicate %s detected', 'give' ), | |
| 251 | + __( '%1$s duplicate %2$s detected', 'give' ), | |
| 252 | + __( '%1$s duplicate %2$s detected', 'give' ), | |
| 252 | 253 | __( 'donor', 'give' ), |
| 253 | 254 | __( 'donors', 'give' ), |
| 254 | 255 | ), |
| 255 | 256 | 'create_donor' => array( |
| 256 | - __( '%s %s created', 'give' ), | |
| 257 | - __( '%s %s will be created', 'give' ), | |
| 257 | + __( '%1$s %2$s created', 'give' ), | |
| 258 | + __( '%1$s %2$s will be created', 'give' ), | |
| 258 | 259 | __( 'donor', 'give' ), |
| 259 | 260 | __( 'donors', 'give' ), |
| 260 | 261 | ), |
| 261 | 262 | 'create_form' => array( |
| 262 | - __( '%s donation %s created', 'give' ), | |
| 263 | - __( '%s donation %s will be created', 'give' ), | |
| 263 | + __( '%1$s donation %2$s created', 'give' ), | |
| 264 | + __( '%1$s donation %2$s will be created', 'give' ), | |
| 264 | 265 | __( 'form', 'give' ), |
| 265 | 266 | __( 'forms', 'give' ), |
| 266 | 267 | ), |
| 267 | 268 | 'duplicate_donation' => array( |
| 268 | - __( '%s duplicate %s detected', 'give' ), | |
| 269 | - __( '%s duplicate %s detected', 'give' ), | |
| 269 | + __( '%1$s duplicate %2$s detected', 'give' ), | |
| 270 | + __( '%1$s duplicate %2$s detected', 'give' ), | |
| 270 | 271 | __( 'donation', 'give' ), |
| 271 | 272 | __( 'donations', 'give' ), |
| 272 | 273 | ), |
| 273 | 274 | 'create_donation' => array( |
| 274 | - __( '%s %s imported', 'give' ), | |
| 275 | - __( '%s %s will be imported', 'give' ), | |
| 275 | + __( '%1$s %2$s imported', 'give' ), | |
| 276 | + __( '%1$s %2$s will be imported', 'give' ), | |
| 276 | 277 | __( 'donation', 'give' ), |
| 277 | 278 | __( 'donations', 'give' ), |
| 278 | 279 | ), |
| 279 | 280 | ); |
| @@ -315,9 +316,8 @@ | ||
| 315 | 316 | 'tab' => 'import', |
| 316 | 317 | ); |
| 317 | 318 | if ( $success ) { |
| 318 | 319 | |
| 319 | - | |
| 320 | 320 | if ( $dry_run ) { |
| 321 | 321 | $query_arg = array( |
| 322 | 322 | 'post_type' => 'give_forms', |
| 323 | 323 | 'page' => 'give-tools', |
| @@ -351,9 +351,9 @@ | ||
| 351 | 351 | ?> |
| 352 | 352 | |
| 353 | 353 | <p> |
| 354 | 354 | <a class="button button-large button-secondary" |
| 355 | - href="<?php echo add_query_arg( $query_arg, admin_url( 'edit.php' ) ); ?>"><?php echo $text; ?></a> | |
| 355 | + href="<?php echo esc_url( add_query_arg( $query_arg, admin_url( 'edit.php' ) ) ); ?>"><?php echo $text; ?></a> | |
| 356 | 356 | </p> |
| 357 | 357 | </th> |
| 358 | 358 | </tr> |
| 359 | 359 | <?php |
| @@ -385,10 +385,10 @@ | ||
| 385 | 385 | |
| 386 | 386 | ?> |
| 387 | 387 | <tr valign="top" class="give-import-dropdown"> |
| 388 | 388 | <th colspan="2"> |
| 389 | - <h2 id="give-import-title"><?php _e( 'Importing', 'give' ) ?></h2> | |
| 390 | - <p class="give-field-description"><?php _e( 'Your donations are now being imported...', 'give' ) ?></p> | |
| 389 | + <h2 id="give-import-title"><?php _e( 'Importing', 'give' ); ?></h2> | |
| 390 | + <p class="give-field-description"><?php _e( 'Your donations are now being imported...', 'give' ); ?></p> | |
| 391 | 391 | </th> |
| 392 | 392 | </tr> |
| 393 | 393 | |
| 394 | 394 | <tr valign="top" class="give-import-dropdown"> |
| @@ -395,25 +395,25 @@ | ||
| 395 | 395 | <th colspan="2"> |
| 396 | 396 | <span class="spinner is-active"></span> |
| 397 | 397 | <div class="give-progress" |
| 398 | 398 | data-current="1" |
| 399 | - data-total_ajax="<?php echo absint( $total_ajax ); ?>" | |
| 400 | - data-start="<?php echo absint( $index_start ); ?>" | |
| 401 | - data-end="<?php echo absint( $index_end ); ?>" | |
| 402 | - data-next="<?php echo absint( $next ); ?>" | |
| 403 | - data-total="<?php echo absint( $total ); ?>" | |
| 404 | - data-per_page="<?php echo absint( self::$per_page ); ?>"> | |
| 399 | + data-total_ajax="<?php echo esc_attr(absint( $total_ajax )); ?>" | |
| 400 | + data-start="<?php echo esc_attr(absint( $index_start )); ?>" | |
| 401 | + data-end="<?php echo esc_attr(absint( $index_end )); ?>" | |
| 402 | + data-next="<?php echo esc_attr(absint( $next )); ?>" | |
| 403 | + data-total="<?php echo esc_attr(absint( $total )); ?>" | |
| 404 | + data-per_page="<?php echo esc_attr(absint( self::$per_page )); ?>"> | |
| 405 | 405 | |
| 406 | - <div style="width: <?php echo (float) $current_percentage; ?>%"></div> | |
| 406 | + <div style="width: <?php echo esc_attr((float) $current_percentage); ?>%"></div> | |
| 407 | 407 | </div> |
| 408 | 408 | <input type="hidden" value="3" name="step"> |
| 409 | 409 | <input type="hidden" value='<?php echo esc_attr( maybe_serialize( $_REQUEST['mapto'] ) ); ?>' name="mapto" class="mapto"> |
| 410 | - <input type="hidden" value="<?php echo $csv; ?>" name="csv" class="csv"> | |
| 410 | + <input type="hidden" value="<?php echo esc_attr($csv); ?>" name="csv" class="csv"> | |
| 411 | 411 | <input type="hidden" value="<?php echo esc_attr( $_REQUEST['mode'] ); ?>" name="mode" class="mode"> |
| 412 | 412 | <input type="hidden" value="<?php echo esc_attr( $_REQUEST['create_user'] ); ?>" name="create_user" class="create_user"> |
| 413 | 413 | <input type="hidden" value="<?php echo esc_attr( $_REQUEST['delete_csv'] ); ?>" name="delete_csv" class="delete_csv"> |
| 414 | 414 | <input type="hidden" value="<?php echo esc_attr( $delimiter ); ?>" name="delimiter"> |
| 415 | - <input type="hidden" value="<?php echo absint( $_REQUEST['dry_run'] ); ?>" name="dry_run"> | |
| 415 | + <input type="hidden" value="<?php echo esc_attr(absint( $_REQUEST['dry_run']) ); ?>" name="dry_run"> | |
| 416 | 416 | <input type="hidden" value='<?php echo esc_attr( maybe_serialize( self::get_importer( $csv, 0, $delimiter ) ) ); ?>' name="main_key" class="main_key"> |
| 417 | 417 | </th> |
| 418 | 418 | </tr> |
| 419 | 419 | <?php |
| @@ -454,8 +454,16 @@ | ||
| 454 | 454 | * |
| 455 | 455 | * @since 1.8.14 |
| 456 | 456 | */ |
| 457 | 457 | public function render_dropdown() { |
| 458 | + if (!$this->is_nonce_valid()) { | |
| 459 | + Give_Admin_Settings::add_error( 'give-import-csv', __( 'Something went wrong.', 'give' ) ); | |
| 460 | + ?> | |
| 461 | + <input type="hidden" name="csv_not_valid" class="csv_not_valid" value="<?php echo esc_attr(give_import_page_url()); ?>"/> | |
| 462 | + <?php | |
| 463 | + wp_die(); | |
| 464 | + } | |
| 465 | + | |
| 458 | 466 | $csv = (int) $_GET['csv']; |
| 459 | 467 | $delimiter = ( ! empty( $_GET['delimiter'] ) ? give_clean( $_GET['delimiter'] ) : 'csv' ); |
| 460 | 468 | |
| 461 | 469 | // TO check if the CSV files that is being add is valid or not if not then redirect to first step again |
| @@ -461,19 +469,19 @@ | ||
| 461 | 469 | // TO check if the CSV files that is being add is valid or not if not then redirect to first step again |
| 462 | 470 | if ( ! $this->is_valid_csv( $csv ) ) { |
| 463 | 471 | $url = give_import_page_url(); |
| 464 | 472 | ?> |
| 465 | - <input type="hidden" name="csv_not_valid" class="csv_not_valid" value="<?php echo $url; ?>"/> | |
| 473 | + <input type="hidden" name="csv_not_valid" class="csv_not_valid" value="<?php echo esc_attr($url); ?>"/> | |
| 466 | 474 | <?php |
| 467 | 475 | } else { |
| 468 | 476 | ?> |
| 469 | 477 | <tr valign="top" class="give-import-dropdown"> |
| 470 | 478 | <th colspan="2"> |
| 471 | - <h2 id="give-import-title"><?php _e( 'Map CSV fields to donations', 'give' ) ?></h2> | |
| 479 | + <h2 id="give-import-title"><?php _e( 'Map CSV fields to donations', 'give' ); ?></h2> | |
| 472 | 480 | |
| 473 | - <p class="give-import-donation-required-fields-title"><?php _e( 'Required Fields' ); ?></p> | |
| 481 | + <p class="give-import-donation-required-fields-title"><?php _e( 'Required Fields', 'give' ); ?></p> | |
| 474 | 482 | |
| 475 | - <p class="give-field-description"><?php _e( 'These fields are required for the import to submitted' ); ?></p> | |
| 483 | + <p class="give-field-description"><?php _e( 'These fields are required for the import to submitted', 'give' ); ?></p> | |
| 476 | 484 | |
| 477 | 485 | <ul class="give-import-donation-required-fields"> |
| 478 | 486 | <li class="give-import-donation-required-email" |
| 479 | 487 | title="Please configure all required fields to start the import process."> |
| @@ -515,9 +523,9 @@ | ||
| 515 | 523 | </span> |
| 516 | 524 | </li> |
| 517 | 525 | </ul> |
| 518 | 526 | |
| 519 | - <p class="give-field-description"><?php _e( 'Select fields from your CSV file to map against donations fields or to ignore during import.', 'give' ) ?></p> | |
| 527 | + <p class="give-field-description"><?php _e( 'Select fields from your CSV file to map against donations fields or to ignore during import.', 'give' ); ?></p> | |
| 520 | 528 | </th> |
| 521 | 529 | </tr> |
| 522 | 530 | |
| 523 | 531 | <tr valign="top" class="give-import-dropdown"> |
| @@ -525,18 +533,21 @@ | ||
| 525 | 533 | <th><b><?php _e( 'Map to field', 'give' ); ?></b></th> |
| 526 | 534 | </tr> |
| 527 | 535 | |
| 528 | 536 | <?php |
| 529 | - $raw_key = $this->get_importer( $csv, 0, $delimiter ); | |
| 537 | + | |
| 538 | + $selectedOptions = []; // Initialize the tracking array for selected options | |
| 539 | + | |
| 540 | + $raw_key = $this->get_importer( $csv, 0, $delimiter ); | |
| 530 | 541 | $mapto = (array) ( isset( $_REQUEST['mapto'] ) ? $_REQUEST['mapto'] : array() ); |
| 531 | 542 | |
| 532 | 543 | foreach ( $raw_key as $index => $value ) { |
| 533 | 544 | ?> |
| 534 | - <tr valign="top" class="give-import-option"> | |
| 535 | - <th><?php echo $value; ?></th> | |
| 545 | + <tr valign="middle" class="give-import-option"> | |
| 546 | + <th><?php echo esc_html($value); ?></th> | |
| 536 | 547 | <th> |
| 537 | 548 | <?php |
| 538 | - $this->get_columns( $index, $value, $mapto ); | |
| 549 | + $this->get_columns( $index, $value, $mapto, $selectedOptions ); | |
| 539 | 550 | ?> |
| 540 | 551 | </th> |
| 541 | 552 | </tr> |
| 542 | 553 | <?php |
| @@ -572,33 +583,34 @@ | ||
| 572 | 583 | * |
| 573 | 584 | * @param string $index |
| 574 | 585 | * @param bool $value |
| 575 | 586 | * @param array $mapto |
| 587 | + * @param array $selectedOptions | |
| 576 | 588 | * |
| 577 | 589 | * @return void |
| 578 | 590 | */ |
| 579 | - private function get_columns( $index, $value = false, $mapto = array() ) { | |
| 591 | + private function get_columns( $index, $value = false, $mapto = array(), &$selectedOptions = array() ) { | |
| 580 | 592 | $default = give_import_default_options(); |
| 581 | 593 | $current_mapto = (string) ( ! empty( $mapto[ $index ] ) ? $mapto[ $index ] : '' ); |
| 582 | 594 | ?> |
| 583 | - <select name="mapto[<?php echo $index; ?>]"> | |
| 584 | - <?php $this->get_dropdown_option_html( $default, $current_mapto, $value ); ?> | |
| 595 | + <select name="mapto[<?php echo esc_attr($index); ?>]"> | |
| 596 | + <?php $this->get_dropdown_option_html( $default, $current_mapto, $value, $selectedOptions ); ?> | |
| 585 | 597 | |
| 586 | 598 | <optgroup label="<?php _e( 'Donations', 'give' ); ?>"> |
| 587 | 599 | <?php |
| 588 | - $this->get_dropdown_option_html( give_import_donations_options(), $current_mapto, $value ); | |
| 600 | + $this->get_dropdown_option_html( give_import_donations_options(), $current_mapto, $value, $selectedOptions ); | |
| 589 | 601 | ?> |
| 590 | 602 | </optgroup> |
| 591 | 603 | |
| 592 | 604 | <optgroup label="<?php _e( 'Donors', 'give' ); ?>"> |
| 593 | 605 | <?php |
| 594 | - $this->get_dropdown_option_html( give_import_donor_options(), $current_mapto, $value ); | |
| 606 | + $this->get_dropdown_option_html( give_import_donor_options(), $current_mapto, $value, $selectedOptions ); | |
| 595 | 607 | ?> |
| 596 | 608 | </optgroup> |
| 597 | 609 | |
| 598 | 610 | <optgroup label="<?php _e( 'Forms', 'give' ); ?>"> |
| 599 | 611 | <?php |
| 600 | - $this->get_dropdown_option_html( give_import_donation_form_options(), $current_mapto, $value ); | |
| 612 | + $this->get_dropdown_option_html( give_import_donation_form_options(), $current_mapto, $value, $selectedOptions ); | |
| 601 | 613 | ?> |
| 602 | 614 | </optgroup> |
| 603 | 615 | |
| 604 | 616 | <?php |
| @@ -619,46 +631,53 @@ | ||
| 619 | 631 | * |
| 620 | 632 | * @since 1.8.15 |
| 621 | 633 | * @access public |
| 622 | 634 | * |
| 623 | - * @param array $options | |
| 635 | + * @param array $options | |
| 624 | 636 | * @param string $current_mapto |
| 625 | - * @param bool $value | |
| 637 | + * @param bool $value | |
| 638 | + * @param array $selectedOptions | |
| 626 | 639 | * |
| 627 | 640 | * @return void |
| 628 | 641 | */ |
| 629 | - public function get_dropdown_option_html( $options, $current_mapto, $value = false ) { | |
| 642 | + public function get_dropdown_option_html( $options, $current_mapto, $value = false, &$selectedOptions = array() ) { | |
| 643 | + foreach ( $options as $option => $option_value ) { | |
| 644 | + $ignore = array(); | |
| 645 | + if ( isset( $option_value['ignore'] ) && is_array( $option_value['ignore'] ) ) { | |
| 646 | + $ignore = $option_value['ignore']; | |
| 647 | + unset( $option_value['ignore'] ); | |
| 648 | + } | |
| 630 | 649 | |
| 631 | - foreach ( $options as $option => $option_value ) { | |
| 632 | - $ignore = array(); | |
| 633 | - if ( isset( $option_value['ignore'] ) && is_array( $option_value['ignore'] ) ) { | |
| 634 | - $ignore = $option_value['ignore']; | |
| 635 | - unset( $option_value['ignore'] ); | |
| 636 | - } | |
| 650 | + $option_value_texts = (array) $option_value; | |
| 651 | + $option_text = $option_value_texts[0]; | |
| 637 | 652 | |
| 638 | - $option_value_texts = (array) $option_value; | |
| 639 | - $option_text = $option_value_texts[0]; | |
| 653 | + // Initialize selected as false | |
| 654 | + $selected = false; | |
| 640 | 655 | |
| 641 | - $checked = ( ( $current_mapto === $option ) ? 'selected' : false ); | |
| 642 | - if ( empty( $checked ) && ! in_array( $value, $ignore ) ) { | |
| 643 | - foreach ( $option_value_texts as $option_value_text ) { | |
| 644 | - $checked = $this->selected( $option_value_text, $value ); | |
| 645 | - if ( $checked ) { | |
| 646 | - break; | |
| 647 | - } | |
| 648 | - } | |
| 649 | - } | |
| 656 | + // If current field matches option and it's not already selected, mark as selected | |
| 657 | + if ( $current_mapto === $option && !in_array($option, $selectedOptions) ) { | |
| 658 | + $selected = 'selected'; | |
| 659 | + $selectedOptions[] = $option; // Add to selected options | |
| 660 | + } else { | |
| 661 | + // Check against option value texts if not already selected | |
| 662 | + if ( ! in_array( $value, $ignore ) && !in_array($option, $selectedOptions) ) { | |
| 663 | + foreach ( $option_value_texts as $option_value_text ) { | |
| 664 | + $selected = $this->selected( $option_value_text, $value ); | |
| 665 | + if ( $selected ) { | |
| 666 | + $selectedOptions[] = $option; // Add to selected options | |
| 667 | + break; | |
| 668 | + } | |
| 669 | + } | |
| 670 | + } | |
| 671 | + } | |
| 672 | + ?> | |
| 673 | + <option value="<?php echo esc_attr($option); ?>" <?php echo esc_html($selected); ?> ><?php echo esc_html($option_text); ?></option> | |
| 674 | + <?php | |
| 675 | + } | |
| 676 | + } | |
| 650 | 677 | |
| 651 | - echo sprintf( | |
| 652 | - '<option value="%1$s" %2$s >%3$s</option>', | |
| 653 | - $option, | |
| 654 | - $checked, | |
| 655 | - $option_text | |
| 656 | - ); | |
| 657 | - } | |
| 658 | - } | |
| 659 | 678 | |
| 660 | - /** | |
| 679 | + /** | |
| 661 | 680 | * Get column count of csv file. |
| 662 | 681 | * |
| 663 | 682 | * @since 1.8.14 |
| 664 | 683 | * |
| @@ -702,9 +721,9 @@ | ||
| 702 | 721 | * Get the CSV fields title from the CSV. |
| 703 | 722 | * |
| 704 | 723 | * @since 1.8.14 |
| 705 | 724 | * |
| 706 | - * @param (int) $file_id | |
| 725 | + * @param (int) $file_id | |
| 707 | 726 | * @param int $index |
| 708 | 727 | * @param string $delimiter |
| 709 | 728 | * |
| 710 | 729 | * @return array|bool $raw_data title of the CSV file fields |
| @@ -759,18 +778,18 @@ | ||
| 759 | 778 | public function render_progress() { |
| 760 | 779 | $step = $this->get_step(); |
| 761 | 780 | ?> |
| 762 | 781 | <ol class="give-progress-steps"> |
| 763 | - <li class="<?php echo( 1 === $step ? 'active' : '' ); ?>"> | |
| 782 | + <li class="<?php echo esc_attr( 1 === $step ? 'active' : '' ); ?>"> | |
| 764 | 783 | <?php _e( 'Upload CSV file', 'give' ); ?> |
| 765 | 784 | </li> |
| 766 | - <li class="<?php echo( 2 === $step ? 'active' : '' ); ?>"> | |
| 785 | + <li class="<?php echo esc_attr( 2 === $step ? 'active' : '' ); ?>"> | |
| 767 | 786 | <?php _e( 'Column mapping', 'give' ); ?> |
| 768 | 787 | </li> |
| 769 | - <li class="<?php echo( 3 === $step ? 'active' : '' ); ?>"> | |
| 788 | + <li class="<?php echo esc_attr( 3 === $step ? 'active' : '' ); ?>"> | |
| 770 | 789 | <?php _e( 'Import', 'give' ); ?> |
| 771 | 790 | </li> |
| 772 | - <li class="<?php echo( 4 === $step ? 'active' : '' ); ?>"> | |
| 791 | + <li class="<?php echo esc_attr( 4 === $step ? 'active' : '' ); ?>"> | |
| 773 | 792 | <?php _e( 'Done!', 'give' ); ?> |
| 774 | 793 | </li> |
| 775 | 794 | </ol> |
| 776 | 795 | <?php |
| @@ -854,21 +873,27 @@ | ||
| 854 | 873 | * @since 1.8.14 |
| 855 | 874 | * @return void |
| 856 | 875 | */ |
| 857 | 876 | public function render_media_csv() { |
| 858 | - add_filter( 'give_import_donation_submit_button_text', array( | |
| 859 | - $this, | |
| 860 | - 'give_import_donation_submit_text_render_media_csv' | |
| 861 | - ) ); | |
| 862 | - add_action( 'give_import_donation_submit_button', array( | |
| 863 | - $this, | |
| 864 | - 'give_import_donation_submit_button_render_media_csv' | |
| 865 | - ) ); | |
| 877 | + add_filter( | |
| 878 | + 'give_import_donation_submit_button_text', | |
| 879 | + array( | |
| 880 | + $this, | |
| 881 | + 'give_import_donation_submit_text_render_media_csv', | |
| 882 | + ) | |
| 883 | + ); | |
| 884 | + add_action( | |
| 885 | + 'give_import_donation_submit_button', | |
| 886 | + array( | |
| 887 | + $this, | |
| 888 | + 'give_import_donation_submit_button_render_media_csv', | |
| 889 | + ) | |
| 890 | + ); | |
| 866 | 891 | ?> |
| 867 | 892 | <tr valign="top"> |
| 868 | 893 | <th colspan="2"> |
| 869 | - <h2 id="give-import-title"><?php _e( 'Import donations from a CSV file', 'give' ) ?></h2> | |
| 870 | - <p class="give-field-description"><?php _e( 'This tool allows you to import or add donation data to your give form(s) via a CSV file.', 'give' ) ?></p> | |
| 894 | + <h2 id="give-import-title"><?php _e( 'Import donations from a CSV file', 'give' ); ?></h2> | |
| 895 | + <p class="give-field-description"><?php _e( 'This tool allows you to import or add donation data to your give form(s) via a CSV file.', 'give' ); ?></p> | |
| 871 | 896 | </th> |
| 872 | 897 | </tr> |
| 873 | 898 | <?php |
| 874 | 899 | $csv = ( isset( $_POST['csv'] ) ? give_clean( $_POST['csv'] ) : '' ); |
| @@ -907,9 +932,12 @@ | ||
| 907 | 932 | array( |
| 908 | 933 | 'id' => 'csv', |
| 909 | 934 | 'name' => __( 'Choose a CSV file:', 'give' ), |
| 910 | 935 | 'type' => 'file', |
| 911 | - 'attributes' => array( 'editing' => 'false', 'library' => 'text' ), | |
| 936 | + 'attributes' => array( | |
| 937 | + 'editing' => 'false', | |
| 938 | + 'library' => 'text', | |
| 939 | + ), | |
| 912 | 940 | 'description' => $csv_description, |
| 913 | 941 | 'fvalue' => 'url', |
| 914 | 942 | 'default' => $csv, |
| 915 | 943 | ), |
| @@ -978,9 +1006,9 @@ | ||
| 978 | 1006 | Give_Admin_Settings::output_fields( $settings, 'give_settings' ); |
| 979 | 1007 | } else { |
| 980 | 1008 | ?> |
| 981 | 1009 | <input type="hidden" name="is_csv_valid" class="is_csv_valid" |
| 982 | - value="<?php echo $this->is_csv_valid; ?>"> | |
| 1010 | + value="<?php echo esc_attr($this->is_csv_valid); ?>"> | |
| 983 | 1011 | <?php |
| 984 | 1012 | } |
| 985 | 1013 | } |
| 986 | 1014 | |
| @@ -989,8 +1017,11 @@ | ||
| 989 | 1017 | * |
| 990 | 1018 | * @since 1.8.14 |
| 991 | 1019 | */ |
| 992 | 1020 | public function save() { |
| 1021 | + if (!$this->is_nonce_valid()){ | |
| 1022 | + wp_die(); | |
| 1023 | + } | |
| 993 | 1024 | // Get the current step. |
| 994 | 1025 | $step = $this->get_step(); |
| 995 | 1026 | |
| 996 | 1027 | // Validation for first step. |
| @@ -998,27 +1029,32 @@ | ||
| 998 | 1029 | $csv_id = absint( $_POST['csv_id'] ); |
| 999 | 1030 | |
| 1000 | 1031 | if ( $this->is_valid_csv( $csv_id, esc_url( $_POST['csv'] ) ) ) { |
| 1001 | 1032 | |
| 1002 | - $url = give_import_page_url( (array) apply_filters( 'give_import_step_two_url', array( | |
| 1003 | - 'step' => '2', | |
| 1004 | - 'importer-type' => $this->importer_type, | |
| 1005 | - 'csv' => $csv_id, | |
| 1006 | - 'delimiter' => isset( $_REQUEST['delimiter'] ) ? give_clean( $_REQUEST['delimiter'] ) : 'csv', | |
| 1007 | - 'mode' => empty( $_POST['mode'] ) ? | |
| 1008 | - '0' : | |
| 1009 | - ( give_is_setting_enabled( give_clean( $_POST['mode'] ) ) ? '1' : '0' ), | |
| 1010 | - 'create_user' => empty( $_POST['create_user'] ) ? | |
| 1011 | - '0' : | |
| 1012 | - ( give_is_setting_enabled( give_clean( $_POST['create_user'] ) ) ? '1' : '0' ), | |
| 1013 | - 'delete_csv' => empty( $_POST['delete_csv'] ) ? | |
| 1014 | - '1' : | |
| 1015 | - ( give_is_setting_enabled( give_clean( $_POST['delete_csv'] ) ) ? '1' : '0' ), | |
| 1016 | - 'per_page' => isset( $_POST['per_page'] ) ? absint( $_POST['per_page'] ) : self::$per_page, | |
| 1017 | - 'dry_run' => isset( $_POST['dry_run'] ) ? absint( $_POST['dry_run'] ) : 0, | |
| 1018 | - ) ) ); | |
| 1033 | + $url = give_import_page_url( | |
| 1034 | + (array) apply_filters( | |
| 1035 | + 'give_import_step_two_url', | |
| 1036 | + array( | |
| 1037 | + 'step' => '2', | |
| 1038 | + 'importer-type' => $this->importer_type, | |
| 1039 | + 'csv' => $csv_id, | |
| 1040 | + 'delimiter' => isset( $_REQUEST['delimiter'] ) ? give_clean( $_REQUEST['delimiter'] ) : 'csv', | |
| 1041 | + 'mode' => empty( $_POST['mode'] ) ? | |
| 1042 | + '0' : | |
| 1043 | + ( give_is_setting_enabled( give_clean( $_POST['mode'] ) ) ? '1' : '0' ), | |
| 1044 | + 'create_user' => empty( $_POST['create_user'] ) ? | |
| 1045 | + '0' : | |
| 1046 | + ( give_is_setting_enabled( give_clean( $_POST['create_user'] ) ) ? '1' : '0' ), | |
| 1047 | + 'delete_csv' => empty( $_POST['delete_csv'] ) ? | |
| 1048 | + '1' : | |
| 1049 | + ( give_is_setting_enabled( give_clean( $_POST['delete_csv'] ) ) ? '1' : '0' ), | |
| 1050 | + 'per_page' => isset( $_POST['per_page'] ) ? absint( $_POST['per_page'] ) : self::$per_page, | |
| 1051 | + 'dry_run' => isset( $_POST['dry_run'] ) ? absint( $_POST['dry_run'] ) : 0, | |
| 1052 | + ) | |
| 1053 | + ) | |
| 1054 | + ); | |
| 1019 | 1055 | |
| 1020 | - $this->is_csv_valid = $url; | |
| 1056 | + $this->is_csv_valid = wp_nonce_url($url, 'give-save-settings', '_give-save-settings'); | |
| 1021 | 1057 | } |
| 1022 | 1058 | } |
| 1023 | 1059 | } |
| 1024 | 1060 | |
| @@ -1078,11 +1114,19 @@ | ||
| 1078 | 1114 | * @return bool |
| 1079 | 1115 | */ |
| 1080 | 1116 | private function is_donations_import_page() { |
| 1081 | 1117 | return 'import' === give_get_current_setting_tab() && |
| 1082 | - isset( $_GET['importer-type'] ) && | |
| 1083 | - $this->importer_type === give_clean( $_GET['importer-type'] ); | |
| 1118 | + isset( $_GET['importer-type'] ) && | |
| 1119 | + $this->importer_type === give_clean( $_GET['importer-type'] ); | |
| 1084 | 1120 | } |
| 1121 | + | |
| 1122 | + /** | |
| 1123 | + * @since 2.25.2 | |
| 1124 | + */ | |
| 1125 | + private function is_nonce_valid() | |
| 1126 | + { | |
| 1127 | + return !empty($_REQUEST['_give-save-settings']) && wp_verify_nonce($_REQUEST['_give-save-settings'], 'give-save-settings'); | |
| 1128 | + } | |
| 1085 | 1129 | } |
| 1086 | 1130 | |
| 1087 | 1131 | Give_Import_Donations::get_instance()->setup(); |
| 1088 | 1132 | } |