king-addons / includes / widgets / Form_Builder / helpers / Create_Submission.php

Create_Submission.php in King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder 51.1.63, at includes/widgets/Form_Builder/helpers/Create_Submission.php

130 lines 5.0 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons;
4
5	if (!defined('ABSPATH')) {
6	exit;
7	}
8
9	class Create_Submission
10	{
11
12	public function __construct()
13	{
14	add_action('wp_ajax_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
15	add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
16	add_action('save_post', [$this, 'update_submissions_post_meta']);
17	}
18
19	public function add_to_submissions()
20	{
21
22	$nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '';
23
24	if (!wp_verify_nonce($nonce, 'king-addons-js')) {
25	wp_send_json_error(array(
26	'message' => esc_html__('Security check failed.', 'king-addons'),
27	));
28	}
29
30	// Add capability check
31	if (!current_user_can('read')) {
32	wp_send_json_error(array(
33	'message' => esc_html__('Insufficient permissions.', 'king-addons'),
34	));
35	}
36
37	$new = [
38	'post_status' => 'publish',
39	'post_type' => 'king-addons-fb-sub'
40	];
41
42	$post_id = wp_insert_post($new);
43
44	// Security fix: Validate and sanitize form_content before saving to database
45	$form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? wp_unslash($_POST['form_content']) : [];
46
47	foreach ($form_content as $key => $value) {
48	if (!is_array($value) \|\| count($value) < 3) {
49	continue; // Skip malformed fields
50	}
51
52	// Sanitize all form field data before saving
53	$sanitized_key = sanitize_key($key);
54	$sanitized_value = [
55	sanitize_text_field($value[0]), // field type
56	is_array($value[1]) ? array_map('sanitize_text_field', $value[1]) : sanitize_text_field($value[1]), // field value
57	sanitize_text_field($value[2]) // field label
58	];
59
60	update_post_meta($post_id, $sanitized_key, $sanitized_value);
61	}
62
63	$sanitized_form_name = sanitize_text_field(wp_unslash($_POST['form_name'] ?? ''));
64	$sanitized_form_id = sanitize_key(wp_unslash($_POST['form_id'] ?? ''));
65	$sanitized_form_page = sanitize_text_field(wp_unslash($_POST['form_page'] ?? ''));
66	$sanitized_form_page_id = absint($_POST['form_page_id'] ?? 0);
67
68	update_post_meta($post_id, 'king_addons_form_name', $sanitized_form_name);
69	update_post_meta($post_id, 'king_addons_form_id', $sanitized_form_id);
70	update_post_meta($post_id, 'king_addons_form_page', $sanitized_form_page);
71	update_post_meta($post_id, 'king_addons_form_page_id', $sanitized_form_page_id);
72	$user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
73	update_post_meta($post_id, 'king_addons_user_agent', $user_agent);
74	update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP());
75
76	if ($post_id) {
77	wp_send_json_success(array(
78	'action' => 'king_addons_form_builder_submissions',
79	'post_id' => $post_id,
80	'message' => esc_html__('Submission created successfully', 'king-addons'),
81	'status' => 'success'
82	// Security fix: Removed unsanitized form_content from response to prevent XSS
83	));
84	} else {
85	wp_send_json_success(array(
86	'action' => 'king_addons_form_builder_submissions',
87	'post_id' => $post_id,
88	'message' => esc_html__('Submit action failed', 'king-addons'),
89	'status' => 'error'
90	));
91	}
92	}
93
94	public function update_submissions_post_meta($post_id)
95	{
96	// Security fix: Validate nonce and capabilities
97	if (!current_user_can('edit_post', $post_id)) {
98	return;
99	}
100
101	if (isset($_POST['king_addons_submission_changes']) && !empty($_POST['king_addons_submission_changes'])) {
102	// Security fix: Sanitize JSON input and validate structure
103	$raw_changes = sanitize_textarea_field(stripslashes($_POST['king_addons_submission_changes']));
104	$changes = json_decode($raw_changes, true);
105
106	if (!is_array($changes)) {
107	return; // Invalid JSON structure
108	}
109
110	foreach ($changes as $key => $value) {
111	// Security fix: Validate and sanitize keys and values
112	$sanitized_key = sanitize_key($key);
113	if (empty($sanitized_key)) {
114	continue; // Skip invalid keys
115	}
116
117	// Sanitize values based on type
118	if (is_array($value)) {
119	$sanitized_value = array_map('sanitize_text_field', $value);
120	} else {
121	$sanitized_value = sanitize_text_field($value);
122	}
123
124	update_post_meta($post_id, $sanitized_key, $sanitized_value);
125	}
126	}
127	}
128	}
129
130	new Create_Submission();