king-addons / includes / widgets / Form_Builder / helpers / Create_Submission.php

Create_Submission.php in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder 51.1.78, at includes/widgets/Form_Builder/helpers/Create_Submission.php

149 lines 5.6 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons;
4
5	if (!defined('ABSPATH')) {
6	exit;
7	}
8
9	/**
10	* Stores Form Builder submissions from the public AJAX endpoint.
11	*/
12	class Create_Submission
13	{
14
15	/**
16	* Registers submission AJAX hooks and admin meta updates.
17	*/
18	public function __construct()
19	{
20	add_action('wp_ajax_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
21	add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
22	add_action('save_post', [$this, 'update_submissions_post_meta']);
23	}
24
25	/**
26	* Creates a submission post from a public form request.
27	*
28	* Guests are allowed when the nonce is valid and the submitted page ID
29	* belongs to a published Form Builder source page.
30	*
31	* @return void
32	*/
33	public function add_to_submissions()
34	{
35
36	$nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '';
37
38	if (!wp_verify_nonce($nonce, 'king-addons-js')) {
39	wp_send_json_error(array(
40	'message' => esc_html__('Security check failed.', 'king-addons'),
41	));
42	}
43
44	$sanitized_form_page_id = absint($_POST['form_page_id'] ?? 0);
45	if (!Form_Builder_Security::is_valid_submission_page($sanitized_form_page_id)) {
46	wp_send_json_error(array(
47	'message' => esc_html__('Insufficient permissions.', 'king-addons'),
48	));
49	}
50
51	$new = [
52	'post_status' => 'publish',
53	'post_type' => 'king-addons-fb-sub'
54	];
55
56	$post_id = wp_insert_post($new);
57
58	// Security fix: Validate and sanitize form_content before saving to database
59	$form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? wp_unslash($_POST['form_content']) : [];
60
61	foreach ($form_content as $key => $value) {
62	if (!is_array($value) \|\| count($value) < 3) {
63	continue; // Skip malformed fields
64	}
65
66	// Sanitize all form field data before saving
67	$sanitized_key = sanitize_key($key);
68	$sanitized_value = [
69	sanitize_text_field($value[0]), // field type
70	is_array($value[1]) ? array_map('sanitize_text_field', $value[1]) : sanitize_text_field($value[1]), // field value
71	sanitize_text_field($value[2]) // field label
72	];
73
74	update_post_meta($post_id, $sanitized_key, $sanitized_value);
75	}
76
77	$sanitized_form_name = sanitize_text_field(wp_unslash($_POST['form_name'] ?? ''));
78	$sanitized_form_id = sanitize_key(wp_unslash($_POST['form_id'] ?? ''));
79	$sanitized_form_page = sanitize_text_field(wp_unslash($_POST['form_page'] ?? ''));
80
81	update_post_meta($post_id, 'king_addons_form_name', $sanitized_form_name);
82	update_post_meta($post_id, 'king_addons_form_id', $sanitized_form_id);
83	update_post_meta($post_id, 'king_addons_form_page', $sanitized_form_page);
84	update_post_meta($post_id, 'king_addons_form_page_id', $sanitized_form_page_id);
85	$user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
86	update_post_meta($post_id, 'king_addons_user_agent', $user_agent);
87	update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP());
88
89	if ($post_id) {
90	wp_send_json_success(array(
91	'action' => 'king_addons_form_builder_submissions',
92	'post_id' => $post_id,
93	'message' => esc_html__('Submission created successfully', 'king-addons'),
94	'status' => 'success'
95	// Security fix: Removed unsanitized form_content from response to prevent XSS
96	));
97	} else {
98	wp_send_json_success(array(
99	'action' => 'king_addons_form_builder_submissions',
100	'post_id' => $post_id,
101	'message' => esc_html__('Submit action failed', 'king-addons'),
102	'status' => 'error'
103	));
104	}
105	}
106
107	/**
108	* Saves admin edits to an existing submission.
109	*
110	* @param int $post_id Submission post ID.
111	* @return void
112	*/
113	public function update_submissions_post_meta($post_id)
114	{
115	// Security fix: Validate nonce and capabilities
116	if (!current_user_can('edit_post', $post_id)) {
117	return;
118	}
119
120	if (isset($_POST['king_addons_submission_changes']) && !empty($_POST['king_addons_submission_changes'])) {
121	// Security fix: Sanitize JSON input and validate structure
122	$raw_changes = sanitize_textarea_field(stripslashes($_POST['king_addons_submission_changes']));
123	$changes = json_decode($raw_changes, true);
124
125	if (!is_array($changes)) {
126	return; // Invalid JSON structure
127	}
128
129	foreach ($changes as $key => $value) {
130	// Security fix: Validate and sanitize keys and values
131	$sanitized_key = sanitize_key($key);
132	if (empty($sanitized_key)) {
133	continue; // Skip invalid keys
134	}
135
136	// Sanitize values based on type
137	if (is_array($value)) {
138	$sanitized_value = array_map('sanitize_text_field', $value);
139	} else {
140	$sanitized_value = sanitize_text_field($value);
141	}
142
143	update_post_meta($post_id, $sanitized_key, $sanitized_value);
144	}
145	}
146	}
147	}
148
149	new Create_Submission();