hash-form / includes / fields / HashFormFieldHidden.php

HashFormFieldHidden.php in Hash Form – Drag & Drop Form Builder trunk, at includes/fields/HashFormFieldHidden.php

208 lines 7.1 KB

Raw Download Zip

1	<?php
2	defined('ABSPATH') \|\| die();
3
4	class HashFormFieldHidden extends HashFormFieldType {
5
6	protected $type = 'hidden';
7
8	public function field_settings_for_type() {
9	return array(
10	'max_width' => false,
11	'css' => false,
12	'description' => false,
13	'required' => false,
14	'label' => false
15	);
16	}
17
18	protected function extra_field_default_opts() {
19	return array(
20	'value_source' => 'static',
21	'value_param' => '',
22	);
23	}
24
25	/**
26	* Where a hidden field takes its value from.
27	*
28	* Split deliberately, because the two halves do not offer the same promise.
29	* The account and date sources are worked out on the server at submit time
30	* and cannot be influenced by the visitor. The page sources are derived from
31	* the address the form was submitted from, which the browser supplies, so
32	* they are useful for attribution but must not be trusted as proof of
33	* anything. The field description says so in as many words.
34	*/
35	public static function value_sources() {
36	return array(
37	'static' => esc_html__('Fixed value', 'hash-form'),
38	'url_param' => esc_html__('Value from a URL parameter', 'hash-form'),
39	'page_url' => esc_html__('Page address', 'hash-form'),
40	'post_id' => esc_html__('Page or post ID', 'hash-form'),
41	'post_title' => esc_html__('Page or post title', 'hash-form'),
42	'user_email' => esc_html__('Logged in user: email', 'hash-form'),
43	'user_login' => esc_html__('Logged in user: username', 'hash-form'),
44	'user_display_name' => esc_html__('Logged in user: display name', 'hash-form'),
45	'submitted_at' => esc_html__('Date and time of submission', 'hash-form'),
46	);
47	}
48
49	/**
50	* Sources the visitor's browser has a hand in.
51	*/
52	public static function page_sources() {
53	return array('url_param', 'page_url', 'post_id', 'post_title');
54	}
55
56	public static function source_from_options($options) {
57	$options = is_array($options) ? $options : array();
58	$source = isset($options['value_source']) ? $options['value_source'] : 'static';
59
60	return array_key_exists($source, self::value_sources()) ? $source : 'static';
61	}
62
63	/**
64	* The address the form was submitted from.
65	*
66	* Sent alongside the entry by frontend.js. Not the referer header, which on
67	* an admin-ajax request only ever points back at the form's own page.
68	*/
69	private static function submitted_from() {
70	return HashFormHelper::get_post('location', 'esc_url_raw');
71	}
72
73	/**
74	* Resolve the value to store.
75	*
76	* Runs on the server for every source, so what a hidden input carried in the
77	* page is never what gets saved.
78	*/
79	public static function resolve_value($field) {
80	$options = is_array($field) ? $field : (array) $field;
81	$source = self::source_from_options($options);
82
83	if ('static' === $source) {
84	return isset($options['default_value']) ? $options['default_value'] : '';
85	}
86
87	if ('submitted_at' === $source) {
88	return current_time('mysql');
89	}
90
91	if (in_array($source, array('user_email', 'user_login', 'user_display_name'), true)) {
92	$user = wp_get_current_user();
93
94	if (!$user \|\| !$user->ID) {
95	return '';
96	}
97
98	switch ($source) {
99	case 'user_email':
100	return $user->user_email;
101	case 'user_login':
102	return $user->user_login;
103	default:
104	return $user->display_name ? $user->display_name : $user->user_login;
105	}
106	}
107
108	$location = self::submitted_from();
109
110	if (!$location) {
111	return '';
112	}
113
114	if ('page_url' === $source) {
115	return $location;
116	}
117
118	if ('url_param' === $source) {
119	$param = isset($options['value_param']) ? sanitize_key($options['value_param']) : '';
120
121	if (!$param) {
122	return '';
123	}
124
125	$query = wp_parse_url($location, PHP_URL_QUERY);
126
127	if (!$query) {
128	return '';
129	}
130
131	$args = array();
132	wp_parse_str($query, $args);
133
134	return isset($args[$param]) ? sanitize_text_field($args[$param]) : '';
135	}
136
137	// url_to_postid() returns 0 for anything it cannot match, such as an
138	// archive or the front page when that is not a static page.
139	$post_id = url_to_postid($location);
140
141	if (!$post_id) {
142	return '';
143	}
144
145	return ('post_id' === $source) ? (string) $post_id : get_the_title($post_id);
146	}
147
148	public function set_value_before_save($value) {
149	return self::resolve_value(self::flatten_field($this->get_field()));
150	}
151
152	/**
153	* The settings as one flat array.
154	*
155	* get_field_vars() hands back an object keeping its settings under
156	* field_options, while the builder has already flattened them. Both reach
157	* this class, so neither shape can be assumed.
158	*/
159	private static function flatten_field($field) {
160	if (!is_object($field)) {
161	return (array) $field;
162	}
163
164	$options = get_object_vars($field);
165	$nested = isset($options['field_options']) && is_array($options['field_options'])
166	? $options['field_options']
167	: array();
168	unset($options['field_options']);
169
170	return array_merge($options, $nested);
171	}
172
173	protected function input_html() {
174	if (is_admin() && !HashFormHelper::is_preview_page()) {
175	$field = $this->get_field();
176	$source = self::source_from_options($field);
177	?>
178	<label class="hf-editor-field-label">
179	<span class="hf-editor-field-label-text"><?php esc_html_e('Hidden', 'hash-form'); ?></span>
180	</label>
181	<?php if ('static' === $source) { ?>
182	<input type="text" <?php $this->field_attrs(); ?> />
183	<p class="howto">
184	<?php esc_html_e('Note: This field will not show in the form. Enter the value to be hidden.', 'hash-form'); ?>
185	</p>
186	<?php } else {
187	$sources = self::value_sources();
188	?>
189	<input type="text" value="<?php echo esc_attr($sources[$source]); ?>" disabled />
190	<p class="howto">
191	<?php esc_html_e('Note: This field will not show in the form. The value is worked out when the form is submitted.', 'hash-form'); ?>
192	</p>
193	<?php } ?>
194	<?php
195	} else {
196	/*
197	* No value attribute. set_value_before_save() resolves this on the
198	* server and ignores whatever was posted, so printing it into the
199	* page only exposed it for no gain.
200	*/
201	?>
202	<input type="hidden" id="<?php echo esc_attr($this->html_id()); ?>" name="<?php echo esc_attr($this->html_name()); ?>" />
203	<?php
204	}
205	}
206
207	}
208