← All changes | src/functions.php +14 -105 1.7.0 → 1.3.21 View file →

		@@ -77,10 +77,8 @@
77	77	'success' => __( 'Thank you! We will be in touch soon.', 'html-forms' ),
78	78	'invalid_email' => __( 'Sorry, that email address looks invalid.', 'html-forms' ),
79	79	'required_field_missing' => __( 'Please fill in the required fields.', 'html-forms' ),
80	80	'error' => __( 'Oops. An error occurred.', 'html-forms' ),
81		- 'recaptcha_failed' => __( 'reCAPTCHA verification failed. Please try again.', 'html-forms' ),
82		- 'recaptcha_low_score' => __( 'Your submission appears to be spam. Please try again.', 'html-forms' ),
83	81	);
84	82	$default_messages = apply_filters( 'hf_form_default_messages', $default_messages );
85	83	$messages = array();
86	84	foreach ( $post_meta as $meta_key => $meta_values ) {
		@@ -102,49 +100,21 @@
102	100	}
103	101
104	102	/**
105	103	* @param $form_id
106		- * @return int
107		- */
108		-function hf_count_form_submissions( $form_id, $search = '' ) {
109		- global $wpdb;
110		- $table = $wpdb->prefix . 'hf_submissions';
111		- if ( $search !== '' ) {
112		- $result = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$table} s WHERE s.form_id = %d AND s.data LIKE %s;", $form_id, '%' . $wpdb->esc_like( $search ) . '%' ) );
113		- } else {
114		- $result = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$table} s WHERE s.form_id = %d;", $form_id ) );
115		- }
116		- return (int) $result;
117		-}
118		-
119		-/**
120		- * @param $form_id
121	104	* @param array $args
122	105	* @return Submission[]
123	106	*/
124	107	function hf_get_form_submissions( $form_id, array $args = array() ) {
125	108	$default_args = array(
126		- 'offset' => 0,
127		- 'limit' => 1000,
128		- 'orderby' => 'submitted_at',
129		- 'order' => 'DESC',
130		- 'search' => '',
	109	+ 'offset' => 0,
	110	+ 'limit' => 1000,
131	111	);
132		- $args = array_merge( $default_args, $args );
	112	+ $args = array_merge( $default_args, $args );
133	113
134		- $allowed_orderby = array( 'submitted_at', 'id' );
135		- $orderby = in_array( $args['orderby'], $allowed_orderby, true ) ? $args['orderby'] : 'submitted_at';
136		- $order = strtoupper( $args['order'] ) === 'ASC' ? 'ASC' : 'DESC';
137		-
138	114	global $wpdb;
139		- $table = $wpdb->prefix . 'hf_submissions';
140		- if ( $args['search'] !== '' ) {
141		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby and $order are whitelisted above
142		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d AND s.data LIKE %s ORDER BY s.{$orderby} {$order} LIMIT %d, %d;", $form_id, '%' . $wpdb->esc_like( $args['search'] ) . '%', $args['offset'], $args['limit'] ), OBJECT_K );
143		- } else {
144		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby and $order are whitelisted above
145		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d ORDER BY s.{$orderby} {$order} LIMIT %d, %d;", $form_id, $args['offset'], $args['limit'] ), OBJECT_K );
146		- }
	115	+ $table = $wpdb->prefix . 'hf_submissions';
	116	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d ORDER BY s.submitted_at DESC LIMIT %d, %d;", $form_id, $args['offset'], $args['limit'] ), OBJECT_K );
147	117	$submissions = array();
148	118	foreach ( $results as $key => $object ) {
149	119	$submission = Submission::from_object( $object );
150	120	$submissions[ $key ] = $submission;
		@@ -167,15 +137,9 @@
167	137	* @return array
168	138	*/
169	139	function hf_get_settings() {
170	140	$default_settings = array(
171		- 'enable_nonce' => 0,
172	141	'load_stylesheet' => 0,
173		- 'wrapper_tag' => 'p',
174		- 'google_recaptcha' => array(
175		- 'site_key' => '',
176		- 'secret_key' => '',
177		- ),
178	142	);
179	143
180	144	$settings = get_option( 'hf_settings', null );
181	145
		@@ -186,16 +150,8 @@
186	150	}
187	151
188	152	// merge with default settings
189	153	$settings = array_merge( $default_settings, $settings );
190		-
191		- // Ensure nested arrays are properly merged
192		- if ( isset( $default_settings['google_recaptcha'] ) ) {
193		- $settings['google_recaptcha'] = array_merge(
194		- $default_settings['google_recaptcha'],
195		- isset( $settings['google_recaptcha'] ) ? $settings['google_recaptcha'] : array()
196		- );
197		- }
198	154
199	155	/**
200	156	* Filters the global HTML Forms hf_settings
201	157	*
		@@ -285,44 +241,17 @@
285	241	* @param array $data
286	242	* @param Closure|string $escape_function
287	243	* @return string
288	244	*/
289		-function hf_replace_data_variables( $string, Submission $submission, $escape_function = null ) {
290		- $data = ( !empty( $submission->data ) ? $submission->data : array() );
291		- $submission_fields = array( 'HF_TIMESTAMP', 'HF_USER_AGENT', 'HF_IP_ADDRESS', 'HF_REFERRER_URL' );
292		-
	245	+function hf_replace_data_variables( $string, $data = array(), $escape_function = null ) {
293	246	return preg_replace_callback(
294	247	'/\[(.+?)\]/',
295		- function( $matches ) use ( $submission, $submission_fields, $escape_function ) {
	248	+ function( $matches ) use ( $data, $escape_function ) {
296	249	$key = $matches[1];
297		-
298		- if ( in_array( $key, $submission_fields ) ) {
299		- $replacement = '';
300		-
301		- switch ( $key ) {
302		- case 'HF_TIMESTAMP' :
303		- $replacement = $submission->submitted_at;
304		- break;
305		- case 'HF_USER_AGENT' :
306		- $replacement = $submission->user_agent;
307		- break;
308		- case 'HF_IP_ADDRESS' :
309		- $replacement = $submission->ip_address;
310		- break;
311		- case 'HF_REFERRER_URL' :
312		- $replacement = $submission->referer_url;
313		- break;
314		- default :
315		- $replacement = '';
316		- break;
317		- }
318		- } else {
319		- // replace spaces in name with underscores to match PHP requirement for keys in $_POST superglobal
320		- $key = str_replace( ' ', '_', $key );
321		- $replacement = hf_array_get( $submission->data, $key, '' );
322		- $replacement = hf_field_value( $replacement, 0, $escape_function );
323		- }
324		-
	250	+ // replace spaces in name with underscores to match PHP requirement for keys in $_POST superglobal
	251	+ $key = str_replace( ' ', '_', $key );
	252	+ $replacement = hf_array_get( $data, $key, '' );
	253	+ $replacement = hf_field_value( $replacement, 0, $escape_function );
325	254	return $replacement;
326	255	},
327	256	$string
328	257	);
		@@ -344,33 +273,20 @@
344	273	return $value;
345	274	}
346	275
347	276	if ( hf_is_file( $value ) ) {
348		- if ( ! is_array( $value )
349		- || ! isset( $value['name'] )
350		- || ! isset( $value['size'] )
351		- || ! isset( $value['type'] ) ) {
352		- return false;
353		- }
354		-
355		- // Verify attachment exists
356		- if ( isset( $value['attachment_id'] ) && get_post( $value['attachment_id'] ) == null ) {
357		- return __( 'File not found', 'html-forms' );
358		- }
359		-
360	277	$file_url = isset( $value['url'] ) ? $value['url'] : '';
361	278	if ( isset( $value['attachment_id'] ) && apply_filters( 'hf_file_upload_use_direct_links', false ) === false ) {
362	279	$file_url = admin_url( sprintf( 'post.php?action=edit&post=%d', $value['attachment_id'] ) );
363	280	}
364		-
365	281	$short_name = substr( $value['name'], 0, 20 );
366	282	$suffix = strlen( $value['name'] ) > 20 ? '...' : '';
367		- return sprintf( '<a href="%s">%s%s</a> (%s)', esc_url( $file_url ), esc_html( $short_name ), esc_html( $suffix ), hf_human_filesize( $value['size'] ) );
	283	+ return sprintf( '<a href="%s">%s%s</a> (%s)', esc_attr( $file_url ), esc_html( $short_name ), esc_html( $suffix ), hf_human_filesize( $value['size'] ) );
368	284	}
369	285
370	286	if ( hf_is_date( $value ) ) {
371	287	$date_format = get_option( 'date_format' );
372		- return gmdate( $date_format, strtotime( str_replace( '/', '-', $value ) ) );
	288	+ return gmdate( $date_format, strtotime( $value ) );
373	289	}
374	290
375	291	// join array-values with comma
376	292	if ( is_array( $value ) ) {
		@@ -391,13 +307,8 @@
391	307	if ( $escape_function !== null && is_callable( $escape_function ) ) {
392	308	$value = $escape_function( $value );
393	309	}
394	310
395		- // add line breaks, if not string limited to certain length
396		- if ( $limit === 0 ) {
397		- $value = nl2br( $value );
398		- }
399		-
400	311	return $value;
401	312	}
402	313
403	314	/**
		@@ -512,10 +423,8 @@
512	423	function _hf_create_submissions_table() {
513	424	/** @var wpdb */
514	425	global $wpdb;
515	426
516		- $charset_collate = $wpdb->get_charset_collate();
517		-
518	427	// create table for storing submissions
519	428	$table = $wpdb->prefix . 'hf_submissions';
520	429	$wpdb->query(
521	430	"CREATE TABLE IF NOT EXISTS {$table}(
		@@ -525,9 +434,9 @@
525	434	`user_agent` TEXT NULL,
526	435	`ip_address` VARCHAR(255) NULL,
527	436	`referer_url` TEXT NULL,
528	437	`submitted_at` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
529		-) {$charset_collate};"
	438	+) ENGINE=INNODB CHARACTER SET={$wpdb->charset};"
530	439	);
531	440	}
532	441
533	442	function _hf_on_add_user_to_blog( $user_id, $role, $blog_id ) {