html-forms / trunk / src / Forms.php

Forms.php in HTML Forms – Simple WordPress Forms Plugin 1.0, at trunk/src/Forms.php

258 lines 8.0 KB

Raw Download Zip

1	<?php
2
3	namespace HTML_Forms;
4
5	class Forms
6	{
7
8	/**
9	* @var string
10	*/
11	private $plugin_file;
12
13	/**
14	* @var array
15	*/
16	private $settings;
17
18	/**
19	* Forms constructor.
20	*
21	* @param string $plugin_file
22	* @param array $settings
23	*/
24	public function __construct($plugin_file, array $settings )
25	{
26	$this->plugin_file = $plugin_file;
27	$this->settings = $settings;
28	}
29
30	public function hook()
31	{
32	add_action('init', array($this, 'register'));
33	add_action('init', array($this, 'listen'));
34	add_action('wp_enqueue_scripts', array($this, 'assets'));
35	}
36
37	public function register()
38	{
39	// register post type
40	register_post_type('html-form', array(
41	'labels' => array(
42	'name' => 'HTML Forms',
43	'singular_name' => 'HTML Form',
44	),
45	'public' => false
46	)
47	);
48
49	add_shortcode('hf_form', array($this, 'shortcode'));
50
51	// enable shortcodes in text widgets
52	add_filter( 'widget_text', 'shortcode_unautop' );
53	add_filter( 'widget_text', 'do_shortcode', 11 );
54	}
55
56	public function assets()
57	{
58	$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
59	wp_enqueue_script('html-forms', plugins_url('assets/js/public'. $suffix .'.js', $this->plugin_file), array(), HTML_FORMS_VERSION, true);
60	wp_localize_script('html-forms', 'hf_js_vars', array(
61	'ajax_url' => admin_url('admin-ajax.php'),
62	));
63
64	if( $this->settings['load_stylesheet'] ) {
65	wp_enqueue_style( 'html-forms', plugins_url( 'assets/css/forms' . $suffix . '.css', $this->plugin_file ), array(), HTML_FORMS_VERSION );
66	}
67	}
68
69	/**
70	* @param Form $form
71	* @param array $data
72	* @return string
73	*/
74	private function validate_form(Form $form, array $data)
75	{
76	$honeypot_key = sprintf( '_hf_h%d', $form->ID );
77	if( ! isset( $data[$honeypot_key] ) \|\| $data[$honeypot_key] !== "" ) {
78	return 'spam';
79	}
80
81	/**
82	* This filter allows you to perform your own form validation.
83	*
84	* Return a non-empty string if you want to raise an error.
85	* Error codes with a specific error message are: "required_field_missing", "invalid_email", and "error"
86	*
87	* @param string $error_code
88	* @param Form $form
89	* @param array $data
90	*/
91	$error = apply_filters( 'hf_validate_form', '', $form, $data );
92	if( ! empty( $error ) ) {
93	return $error;
94	}
95
96	$required_fields = $form->get_required_fields();
97	foreach ($required_fields as $field_name) {
98	$value = hf_array_get( $data, $field_name );
99	if ( empty( $value ) ) {
100	return 'required_field_missing';
101	}
102	}
103
104	$email_fields = $form->get_email_fields();
105	foreach ($email_fields as $field_name) {
106	$value = hf_array_get( $data, $field_name );
107	if ( ! empty( $value ) && ! is_email( $value ) ) {
108	return 'invalid_email';
109	}
110	}
111
112	// all good: no errors!
113	return '';
114	}
115
116	public function sanitize( $value )
117	{
118	if (is_string($value)) {
119	// strip all HTML tags & whitespace
120	$value = trim(strip_tags($value));
121
122	// convert & back to &
123	$value = html_entity_decode($value, ENT_NOQUOTES);
124	} elseif (is_array($value)) {
125	$new_value = array();
126	foreach($value as $key => $sub_value) {
127	// skip empty values
128	if(empty($sub_value)) {
129	continue;
130	}
131
132	// sanitize key
133	$key = trim(strip_tags($key));
134
135	// sanitize sub value
136	$new_value[$key] = $this->sanitize($sub_value);
137	}
138	$value = $new_value;
139	} elseif (is_object($value)) {
140	$vars = get_object_vars($value);
141	$new_value = new \StdClass();
142	foreach ($vars as $key => $sub_value) {
143	// skip empty values
144	if(empty($sub_value)) {
145	continue;
146	}
147
148	// sanitize key
149	$key = trim(strip_tags($key));
150
151	// sanitize sub value
152	$new_value->{$key} = $this->sanitize($sub_value);
153	}
154	$value = $new_value;
155	}
156
157	return $value;
158	}
159
160	public function listen() {
161	// only respond to AJAX requests with _hf_form_id set.
162	if (empty($_POST['_hf_form_id'])
163	\|\| empty( $_SERVER['HTTP_X_REQUESTED_WITH'] )
164	\|\| strtolower( $_SERVER['HTTP_X_REQUESTED_WITH'] ) !== strtolower( 'XMLHttpRequest' ) ) {
165	return;
166	}
167
168	$data = $_POST;
169	$form_id = (int) $data['_hf_form_id'];
170	$form = hf_get_form($form_id);
171	$error_code = $this->validate_form($form, $data);
172
173	if (empty( $error_code ) ) {
174
175	// filter out all field names starting with _
176	$data = array_filter( $data, function( $k ) {
177	return ! empty( $k ) && $k[0] !== '_';
178	}, ARRAY_FILTER_USE_KEY );
179
180	// strip slashes
181	$data = stripslashes_deep( $data );
182
183	// sanitize data: strip tags etc.
184	$data = $this->sanitize( $data );
185
186	// save form submission
187	$submission = new Submission();
188	$submission->form_id = $form_id;
189	$submission->data = $data;
190	$submission->ip_address = sanitize_text_field( $_SERVER['REMOTE_ADDR'] );
191	$submission->user_agent = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] );
192	$submission->referer_url = sanitize_text_field( $_SERVER['HTTP_REFERER'] );
193	$submission->save();
194
195	// process form actions
196	foreach( $form->settings['actions'] as $action_settings ) {
197	/**
198	* Processes the specified form action and passes related data.
199	*
200	* @param array $action_settings
201	* @param Submission $submission
202	* @param Form $form
203	*/
204	do_action('hf_process_form_action_' . $action_settings['type'], $action_settings, $submission, $form );
205	}
206
207	/**
208	* General purpose hook after all form actions have been processed.
209	*
210	* @param Submission $submission
211	* @param Form $form
212	*/
213	do_action( 'hf_form_success', $submission, $form );
214
215	$response = array(
216	'message' => array(
217	'type' => 'success',
218	'text' => $form->messages['success'],
219	),
220	'hide_form' => (bool)$form->settings['hide_after_success'],
221	);
222
223	if (!empty($form->settings['redirect_url'])) {
224	$response['redirect_url'] = $form->settings['redirect_url'];
225	}
226	} else {
227	$response = array(
228	'message' => array(
229	'type' => 'warning',
230	'text' => isset( $form->messages[ $error_code ] ) ? $form->messages[ $error_code ] : $form->messages['error'],
231	),
232	'error' => $error_code,
233	);
234
235	/**
236	* General purpose hook for when a form error occurred
237	*
238	* @param string $error_code
239	* @param Form $form
240	* @param array $data
241	*/
242	do_action( 'hf_form_error', $error_code, $form, $data );
243	}
244
245	send_origin_headers();
246	send_nosniff_header();
247	nocache_headers();
248
249	wp_send_json($response, 200);
250	exit;
251	}
252
253	public function shortcode($attributes = array(), $content = '')
254	{
255	$form = hf_get_form($attributes['slug']);
256	return $form . $content;
257	}
258	}