← All changes | src/functions.php +15 -88 trunk → 1.3.34 View file →

		@@ -77,10 +77,8 @@
77	77	'success' => __( 'Thank you! We will be in touch soon.', 'html-forms' ),
78	78	'invalid_email' => __( 'Sorry, that email address looks invalid.', 'html-forms' ),
79	79	'required_field_missing' => __( 'Please fill in the required fields.', 'html-forms' ),
80	80	'error' => __( 'Oops. An error occurred.', 'html-forms' ),
81		- 'recaptcha_failed' => __( 'reCAPTCHA verification failed. Please try again.', 'html-forms' ),
82		- 'recaptcha_low_score' => __( 'Your submission appears to be spam. Please try again.', 'html-forms' ),
83	81	);
84	82	$default_messages = apply_filters( 'hf_form_default_messages', $default_messages );
85	83	$messages = array();
86	84	foreach ( $post_meta as $meta_key => $meta_values ) {
		@@ -104,16 +102,12 @@
104	102	/**
105	103	* @param $form_id
106	104	* @return int
107	105	*/
108		-function hf_count_form_submissions( $form_id, $search = '' ) {
	106	+function hf_count_form_submissions( $form_id ) {
109	107	global $wpdb;
110		- $table = $wpdb->prefix . 'hf_submissions';
111		- if ( $search !== '' ) {
112		- $result = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$table} s WHERE s.form_id = %d AND s.data LIKE %s;", $form_id, '%' . $wpdb->esc_like( $search ) . '%' ) );
113		- } else {
114		- $result = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$table} s WHERE s.form_id = %d;", $form_id ) );
115		- }
	108	+ $table = $wpdb->prefix . 'hf_submissions';
	109	+ $result = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$table} s WHERE s.form_id = %d;", $form_id ) );
116	110	return (int) $result;
117	111	}
118	112
119	113	/**
		@@ -122,29 +116,16 @@
122	116	* @return Submission[]
123	117	*/
124	118	function hf_get_form_submissions( $form_id, array $args = array() ) {
125	119	$default_args = array(
126		- 'offset' => 0,
127		- 'limit' => 1000,
128		- 'orderby' => 'submitted_at',
129		- 'order' => 'DESC',
130		- 'search' => '',
	120	+ 'offset' => 0,
	121	+ 'limit' => 1000,
131	122	);
132		- $args = array_merge( $default_args, $args );
	123	+ $args = array_merge( $default_args, $args );
133	124
134		- $allowed_orderby = array( 'submitted_at', 'id' );
135		- $orderby = in_array( $args['orderby'], $allowed_orderby, true ) ? $args['orderby'] : 'submitted_at';
136		- $order = strtoupper( $args['order'] ) === 'ASC' ? 'ASC' : 'DESC';
137		-
138	125	global $wpdb;
139		- $table = $wpdb->prefix . 'hf_submissions';
140		- if ( $args['search'] !== '' ) {
141		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby and $order are whitelisted above
142		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d AND s.data LIKE %s ORDER BY s.{$orderby} {$order} LIMIT %d, %d;", $form_id, '%' . $wpdb->esc_like( $args['search'] ) . '%', $args['offset'], $args['limit'] ), OBJECT_K );
143		- } else {
144		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $orderby and $order are whitelisted above
145		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d ORDER BY s.{$orderby} {$order} LIMIT %d, %d;", $form_id, $args['offset'], $args['limit'] ), OBJECT_K );
146		- }
	126	+ $table = $wpdb->prefix . 'hf_submissions';
	127	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT s.* FROM {$table} s WHERE s.form_id = %d ORDER BY s.submitted_at DESC LIMIT %d, %d;", $form_id, $args['offset'], $args['limit'] ), OBJECT_K );
147	128	$submissions = array();
148	129	foreach ( $results as $key => $object ) {
149	130	$submission = Submission::from_object( $object );
150	131	$submissions[ $key ] = $submission;
		@@ -167,15 +148,9 @@
167	148	* @return array
168	149	*/
169	150	function hf_get_settings() {
170	151	$default_settings = array(
171		- 'enable_nonce' => 0,
172	152	'load_stylesheet' => 0,
173		- 'wrapper_tag' => 'p',
174		- 'google_recaptcha' => array(
175		- 'site_key' => '',
176		- 'secret_key' => '',
177		- ),
178	153	);
179	154
180	155	$settings = get_option( 'hf_settings', null );
181	156
		@@ -186,16 +161,8 @@
186	161	}
187	162
188	163	// merge with default settings
189	164	$settings = array_merge( $default_settings, $settings );
190		-
191		- // Ensure nested arrays are properly merged
192		- if ( isset( $default_settings['google_recaptcha'] ) ) {
193		- $settings['google_recaptcha'] = array_merge(
194		- $default_settings['google_recaptcha'],
195		- isset( $settings['google_recaptcha'] ) ? $settings['google_recaptcha'] : array()
196		- );
197		- }
198	165
199	166	/**
200	167	* Filters the global HTML Forms hf_settings
201	168	*
		@@ -285,44 +252,17 @@
285	252	* @param array $data
286	253	* @param Closure|string $escape_function
287	254	* @return string
288	255	*/
289		-function hf_replace_data_variables( $string, Submission $submission, $escape_function = null ) {
290		- $data = ( !empty( $submission->data ) ? $submission->data : array() );
291		- $submission_fields = array( 'HF_TIMESTAMP', 'HF_USER_AGENT', 'HF_IP_ADDRESS', 'HF_REFERRER_URL' );
292		-
	256	+function hf_replace_data_variables( $string, $data = array(), $escape_function = null ) {
293	257	return preg_replace_callback(
294	258	'/\[(.+?)\]/',
295		- function( $matches ) use ( $submission, $submission_fields, $escape_function ) {
	259	+ function( $matches ) use ( $data, $escape_function ) {
296	260	$key = $matches[1];
297		-
298		- if ( in_array( $key, $submission_fields ) ) {
299		- $replacement = '';
300		-
301		- switch ( $key ) {
302		- case 'HF_TIMESTAMP' :
303		- $replacement = $submission->submitted_at;
304		- break;
305		- case 'HF_USER_AGENT' :
306		- $replacement = $submission->user_agent;
307		- break;
308		- case 'HF_IP_ADDRESS' :
309		- $replacement = $submission->ip_address;
310		- break;
311		- case 'HF_REFERRER_URL' :
312		- $replacement = $submission->referer_url;
313		- break;
314		- default :
315		- $replacement = '';
316		- break;
317		- }
318		- } else {
319		- // replace spaces in name with underscores to match PHP requirement for keys in $_POST superglobal
320		- $key = str_replace( ' ', '_', $key );
321		- $replacement = hf_array_get( $submission->data, $key, '' );
322		- $replacement = hf_field_value( $replacement, 0, $escape_function );
323		- }
324		-
	261	+ // replace spaces in name with underscores to match PHP requirement for keys in $_POST superglobal
	262	+ $key = str_replace( ' ', '_', $key );
	263	+ $replacement = hf_array_get( $data, $key, '' );
	264	+ $replacement = hf_field_value( $replacement, 0, $escape_function );
325	265	return $replacement;
326	266	},
327	267	$string
328	268	);
		@@ -344,28 +284,15 @@
344	284	return $value;
345	285	}
346	286
347	287	if ( hf_is_file( $value ) ) {
348		- if ( ! is_array( $value )
349		- || ! isset( $value['name'] )
350		- || ! isset( $value['size'] )
351		- || ! isset( $value['type'] ) ) {
352		- return false;
353		- }
354		-
355		- // Verify attachment exists
356		- if ( isset( $value['attachment_id'] ) && get_post( $value['attachment_id'] ) == null ) {
357		- return __( 'File not found', 'html-forms' );
358		- }
359		-
360	288	$file_url = isset( $value['url'] ) ? $value['url'] : '';
361	289	if ( isset( $value['attachment_id'] ) && apply_filters( 'hf_file_upload_use_direct_links', false ) === false ) {
362	290	$file_url = admin_url( sprintf( 'post.php?action=edit&post=%d', $value['attachment_id'] ) );
363	291	}
364		-
365	292	$short_name = substr( $value['name'], 0, 20 );
366	293	$suffix = strlen( $value['name'] ) > 20 ? '...' : '';
367		- return sprintf( '<a href="%s">%s%s</a> (%s)', esc_url( $file_url ), esc_html( $short_name ), esc_html( $suffix ), hf_human_filesize( $value['size'] ) );
	294	+ return sprintf( '<a href="%s">%s%s</a> (%s)', esc_attr( $file_url ), esc_html( $short_name ), esc_html( $suffix ), hf_human_filesize( $value['size'] ) );
368	295	}
369	296
370	297	if ( hf_is_date( $value ) ) {
371	298	$date_format = get_option( 'date_format' );