← All changes | includes/functions.php +33 -0 3.6.5.1 → 3.6.6 View file →

		@@ -15,8 +15,11 @@
15	15	);
16	16
17	17	jet_form_builder()->get_modules()->install( new JFB_Modules\Cli\Module() );
18	18	jet_form_builder()->get_modules()->install( new JFB_Modules\Framework\Module() );
	19	+
	20	+ // Auto-run outstanding DB migrations after a plugin update (see class docblock).
	21	+ \Jet_Form_Builder\Migrations\Auto_Migrator::instance()->init_hooks();
19	22	}
20	23
21	24	function jet_form_builder() {
22	25	return Jet_Form_Builder\Plugin::instance();
		@@ -91,8 +94,38 @@
91	94	* @return mixed|string
92	95	*/
93	96	function jet_fb_parse_dynamic( string $value ) {
94	97	return ( new \Jet_Form_Builder\Presets\Types\Dynamic_Preset() )->parse_json( $value );
	98	+}
	99	+
	100	+/**
	101	+ * Same as jet_fb_parse_dynamic(), but declares the string as coming from a
	102	+ * trusted, admin-authored origin - the form's own post meta / block
	103	+ * attributes, which require `edit_post` on the form to write.
	104	+ *
	105	+ * Only that makes an explicit `restricted: false` in the preset honoured, the
	106	+ * way the editor's "Restrict access" toggle promises. Use it ONLY where the
	107	+ * value provably comes from the stored form and never from the request:
	108	+ *
	109	+ * - validation rules (modules/validation/rules-controller.php)
	110	+ * - date min/max (includes/classes/date-tools.php)
	111	+ * - conditional blocks(includes/blocks/conditional-block/...)
	112	+ * - action conditions (includes/actions/conditions/condition-instance.php)
	113	+ * - dynamic value (includes/blocks/dynamic-value.php)
	114	+ *
	115	+ * Anything parsing a submitted field value (Rich_Content) must keep using
	116	+ * jet_fb_parse_dynamic(), where the flag is ignored and the permission check
	117	+ * always runs. See issues-tracker #20359.
	118	+ *
	119	+ * @param string $value
	120	+ *
	121	+ * @return mixed|string
	122	+ */
	123	+function jet_fb_parse_dynamic_trusted( string $value ) {
	124	+ $preset = new \Jet_Form_Builder\Presets\Types\Dynamic_Preset();
	125	+ $preset->trust_restriction_flag( true );
	126	+
	127	+ return $preset->parse_json( $value );
95	128	}
96	129
97	130	function jet_fb_parse_macro( $content ): string {
98	131	return jet_fb_handler()->parser->parse_macros( $content );