← All changes | front-end/class-formbuilder.php +51 -32 3.16.1 → 4.0.3 View file →

		@@ -38,8 +38,16 @@
38	38	if( $this->args['form_name'] != 'unspecified' ){
39	39	$this->args['ID'] = Profile_Builder_Form_Creator::wppb_get_form_id_from_form_name( $this->args['form_name'], $this->args['form_type'] );
40	40	}
41	41
	42	+ /* Let add-ons finalise the form args once ID/form_name are resolved.
	43	+ The form-builder hooks this (wppb_fb_resolve_default_form_id) to point
	44	+ a shortcode with no form specified (empty ID) at the configured
	45	+ default form CPT, so [wppb-register] / [wppb-edit-profile] render the
	46	+ default form. Must run before the wppb_change_form_fields filter below
	47	+ (multiple-forms reads $this->args['ID'] to pick the per-form list). */
	48	+ $this->args = apply_filters( 'wppb_form_args_after_init', $this->args );
	49	+
42	50	global $wppb_shortcode_on_front;
43	51	$wppb_shortcode_on_front = true;
44	52
45	53	global $wppb_register_edit_profile_shortcode_on_front;
		@@ -159,9 +167,9 @@
159	167	$role_in_arg = get_role( $this->args['role'] );
160	168	if( !empty( $role_in_arg->capabilities['manage_options'] ) || !empty( $role_in_arg->capabilities['remove_users'] ) ){
161	169	if( !current_user_can( 'manage_options' ) || !current_user_can( 'remove_users' ) ){
162	170	$this->args['role'] = get_option('default_role');
163		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_user_role_message', '<p class="alert wppb-error" id="wppb_form_general_message">'.__( 'The role of the created user set to the default role. Only an administrator can register a user with the role assigned to this form.', 'profile-builder').'</p>' ) );
	171	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_user_role_message', '<p class="alert wppb-error" id="wppb_form_general_message" role="alert">'.__( 'The role of the created user set to the default role. Only an administrator can register a user with the role assigned to this form.', 'profile-builder').'</p>' ) );
164	172	}
165	173	}
166	174	}
167	175	}
		@@ -193,9 +201,9 @@
193	201	$registration = apply_filters ( 'wppb_register_setting_override', true );//used to be get_option( 'users_can_register' )
194	202
195	203	if ( !is_user_logged_in() ){
196	204	if ( !$registration )
197		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Only an administrator can add new users.', 'profile-builder')).'</p>' ) );
	205	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Only an administrator can add new users.', 'profile-builder')).'</p>' ) );
198	206
199	207	elseif ( $registration ){
200	208	$this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '' ) );
201	209	}
		@@ -203,12 +211,12 @@
203	211	}else{
204	212	$current_user_capability = apply_filters ( 'wppb_registration_user_capability', 'create_users' );
205	213
206	214	if ( current_user_can( $current_user_capability ) && $registration )
207		- $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Users can register themselves or you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
	215	+ $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Users can register themselves or you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
208	216
209	217	elseif ( current_user_can( $current_user_capability ) && !$registration )
210		- $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Users cannot currently register themselves, but you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
	218	+ $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Users cannot currently register themselves, but you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
211	219
212	220	elseif ( !current_user_can( $current_user_capability ) ){
213	221	global $user_ID;
214	222
		@@ -226,15 +234,15 @@
226	234	// CHECK FOR REDIRECT
227	235	$this->args['logout_redirect_url'] = wppb_get_redirect_url( $this->args['redirect_priority'], 'after_logout', $this->args['logout_redirect_url'], $userdata );
228	236	$this->args['logout_redirect_url'] = apply_filters( 'wppb_after_logout_redirect_url', $this->args['logout_redirect_url'] );
229	237
230		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.sprintf( __( "You are currently logged in as %1s. You don't need another account. %2s", 'profile-builder' ), '<a href="'.get_author_posts_url( $user_ID ).'" title="'.$display_name.'">'.$display_name.'</a>', '<a href="'.wp_logout_url( $this->args['logout_redirect_url'] ).'" title="'.__( 'Log out of this account.', 'profile-builder' ).'">'.__( 'Logout', 'profile-builder' ).' &raquo;</a>' ).'</p>', $user_ID ) );
	238	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.sprintf( __( "You are currently logged in as %1s. You don't need another account. %2s", 'profile-builder' ), '<a href="'.get_author_posts_url( $user_ID ).'" title="'.$display_name.'">'.$display_name.'</a>', '<a href="'.wp_logout_url( $this->args['logout_redirect_url'] ).'" title="'.__( 'Log out of this account.', 'profile-builder' ).'">'.__( 'Logout', 'profile-builder' ).' &raquo;</a>' ).'</p>', $user_ID ) );
231	239	}
232	240	}
233	241
234	242	}elseif ( $this->args['form_type'] == 'edit_profile' ){
235	243	if ( !is_user_logged_in() )
236		- echo wp_kses_post( apply_filters( 'wppb_edit_profile_user_not_logged_in_message', '<p class="warning" id="wppb_edit_profile_user_not_logged_in_message">'.esc_html(__( 'You must be logged in to edit your profile.', 'profile-builder' )) .'</p>' ) );
	244	+ echo wp_kses_post( apply_filters( 'wppb_edit_profile_user_not_logged_in_message', '<p class="warning" id="wppb_edit_profile_user_not_logged_in_message" role="alert">'.esc_html(__( 'You must be logged in to edit your profile.', 'profile-builder' )) .'</p>' ) );
237	245
238	246	elseif ( is_user_logged_in() )
239	247	$this->wppb_form_content( apply_filters( 'wppb_edit_profile_logged_in_user_message', '' ) );
240	248
		@@ -242,9 +250,9 @@
242	250	}
243	251	}
244	252
245	253	// Function used to automatically log in a user after register if that option is set on yes in register form settings
246		- function wppb_log_in_user( $redirect, $redirect_old ) {
	254	+ function wppb_log_in_user( $redirect, $redirect_old, $user_id ) {
247	255	if( is_user_logged_in() ) {
248	256	return;
249	257	}
250	258
		@@ -258,19 +266,25 @@
258	266	if ( isset( $wppb_general_settings['emailConfirmation'] ) && ( $wppb_general_settings['emailConfirmation'] == 'yes' ) && !$should_bypass_ec ) {
259	267	return $redirect_old;
260	268	}
261	269
262		- /* get user id */
263		- if( empty( $_POST['email'] ) )
264		- return;
	270	+ // Reject failed registrations
	271	+ if ( is_wp_error( $user_id ) ) {
	272	+ return $redirect_old;
	273	+ }
265	274
266		- $user = get_user_by( 'email', trim( sanitize_email( $_POST['email'] ) ) );
	275	+ $user_id = absint( $user_id );
267	276
268		- if( !$user )
269		- return;
	277	+ if ( ! $user_id ) {
	278	+ return $redirect_old;
	279	+ }
270	280
271		- $nonce = wp_create_nonce( 'autologin-'. $user->ID .'-'. (int)( time() / 60 ) );
	281	+ $user = get_userdata( $user_id );
272	282
	283	+ if ( ! $user ) {
	284	+ return $redirect_old;
	285	+ }
	286	+
273	287	if ( wppb_get_admin_approval_option_value() === 'yes' ) {
274	288	if( !empty( $wppb_general_settings['adminApprovalOnUserRole'] ) ) {
275	289	foreach ($user->roles as $role) {
276	290	if ( in_array( $role, $wppb_general_settings['adminApprovalOnUserRole'] ) ) {
		@@ -285,9 +299,9 @@
285	299
286	300	/* define redirect location */
287	301	if( $this->args['redirect_activated'] == 'No' ) {
288	302	if( isset( $_POST['_wp_http_referer'] ) ) {
289		- $redirect = esc_url_raw($_POST['_wp_http_referer']);
	303	+ $redirect = wppb_sanitize_request_url( $_POST['_wp_http_referer'] );
290	304	} else {
291	305	$redirect = home_url();
292	306	}
293	307	}
		@@ -296,9 +310,9 @@
296	310	$redirect = wppb_curpageurl();
297	311
298	312	$redirect = apply_filters( 'wppb_login_after_reg_redirect_url', $redirect, $this );
299	313
300		- $redirect = add_query_arg( array( 'autologin' => 'true', 'uid' => $user->ID, '_wpnonce' => $nonce ), $redirect );
	314	+ $redirect = add_query_arg( wppb_get_autologin_query_args( $user_id ), $redirect );
301	315
302	316	// CHECK FOR REDIRECT
303	317	if( $this->args['redirect_activated'] == 'No' || ( empty( $this->args['redirect_delay'] ) || $this->args['redirect_delay'] == '0' ) ) {
304	318	$redirect = wppb_build_redirect( $redirect, 0, 'register', $this->args );
		@@ -369,11 +383,14 @@
369	383	$user_id = $this->wppb_save_form_values( $_REQUEST );
370	384
371	385	do_action( 'wppb_after_saving_form_values',$_REQUEST, $this->args );
372	386
373		- if( ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] ) && ( isset( $_POST['action'] ) && $_POST['action'] === $this->args['form_type'] ) ) {
	387	+ if( $this->args['form_type'] == 'register' && is_wp_error( $user_id ) ) {
	388	+ // Failed registration: show the error and re-render the form so the user can retry.
	389	+ echo $message . wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error" role="alert">'. esc_html__( 'Something went wrong while creating the user account, please try again.', 'profile-builder' ) .'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */
	390	+ } elseif( ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] ) && ( isset( $_POST['action'] ) && $_POST['action'] === $this->args['form_type'] ) ) {
374	391
375		- $form_message_tpl_start = apply_filters( 'wppb_form_message_tpl_start', '<p class="alert wppb-success" id="wppb_form_general_message">' );
	392	+ $form_message_tpl_start = apply_filters( 'wppb_form_message_tpl_start', '<p class="alert wppb-success" id="wppb_form_general_message" role="alert">' );
376	393	$form_message_tpl_end = apply_filters( 'wppb_form_message_tpl_end', '</p>' );
377	394
378	395	if( ! current_user_can( 'manage_options' ) && $this->args['form_type'] != 'edit_profile' && isset( $_POST['custom_field_user_role'] ) ) {
379	396	$user_role = sanitize_text_field($_POST['custom_field_user_role']);
		@@ -435,9 +452,9 @@
435	452	$redirect = $this->wppb_get_redirect( 'register', 'after_registration', $account_name, $user_role );
436	453
437	454	// using case-insensitive string comparison to allow for both 'Yes' and 'yes'
438	455	if( strcasecmp($this->args['login_after_register'], 'Yes') == 0 ) {
439		- $redirect = $this->wppb_log_in_user( $this->args['redirect_url'], $redirect );
	456	+ $redirect = $this->wppb_log_in_user( $this->args['redirect_url'], $redirect, $user_id );
440	457	}
441	458
442	459	echo $form_message_tpl_start . wp_kses_post( $wppb_register_success_message ) . $form_message_tpl_end . $redirect; /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped above */
443	460
		@@ -463,9 +480,9 @@
463	480
464	481	}
465	482
466	483	}else
467		- echo $message. wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error">'.esc_html(__( 'There was an error in the submitted form', 'profile-builder' )).'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped above */
	484	+ echo $message. wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error" role="alert">'.esc_html(__( 'There was an error in the submitted form', 'profile-builder' )).'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped above */
468	485
469	486	}else
470	487	echo $message; /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped when created */
471	488
		@@ -503,9 +520,9 @@
503	520	$wppb_form_class .= ' wppb-edit-user';
504	521	$wppb_form_class .= $wppb_user_role_class;
505	522
506	523	?>
507		- <form enctype="multipart/form-data" method="post" id="<?php echo esc_attr( apply_filters( 'wppb_form_id', $wppb_form_id, $this ) ); ?>" class="<?php echo esc_attr( apply_filters( 'wppb_form_class', $wppb_form_class, $this ) ) . ( $this->args['ajax'] == 'true' ? ' wppb-ajax-form' : ''); ?>" action="<?php echo esc_url( apply_filters( 'wppb_form_action', wppb_curpageurl(), $this->args ) ); ?>">
	524	+ <form enctype="multipart/form-data" method="post" novalidate id="<?php echo esc_attr( apply_filters( 'wppb_form_id', $wppb_form_id, $this ) ); ?>" class="<?php echo esc_attr( apply_filters( 'wppb_form_class', $wppb_form_class, $this ) ) . ( $this->args['ajax'] == 'true' ? ' wppb-ajax-form' : ''); ?>" action="<?php echo esc_url( apply_filters( 'wppb_form_action', wppb_curpageurl(), $this->args ) ); ?>">
508	525	<?php
509	526	do_action( 'wppb_form_args_before_output', $this->args );
510	527	$this->args = apply_filters( 'wppb_filter_form_args_before_output', $this->args );
511	528
		@@ -540,11 +557,11 @@
540	557	$wppb_module_settings = get_option( 'wppb_module_settings' );
541	558
542	559	if( isset( $wppb_module_settings['wppb_customRedirect'] ) && $wppb_module_settings['wppb_customRedirect'] == 'show' ) {
543	560	if( isset( $_POST['wppb_referer_url'] ) )
544		- $referer = esc_url_raw( $_POST['wppb_referer_url'] );
	561	+ $referer = wppb_sanitize_request_url( $_POST['wppb_referer_url'] );
545	562	elseif( isset( $_SERVER['HTTP_REFERER'] ) )
546		- $referer = esc_url_raw( $_SERVER['HTTP_REFERER'] );
	563	+ $referer = wppb_sanitize_request_url( $_SERVER['HTTP_REFERER'] );
547	564	else
548	565	$referer = '';
549	566
550	567	echo '<input type="hidden" name="wppb_referer_url" value="'. esc_attr( $referer ).'"/>';
		@@ -666,9 +683,9 @@
666	683	if( $user_data ) {
667	684	$user_data->remove_all_caps();
668	685
669	686	foreach ($userdata['role'] as $role) {
670		- if ($role !== 'administrator' || $role !== 'super-admin')//make sure this doesn't happen for any reason
	687	+ if ($role !== 'administrator' && $role !== 'super-admin')//make sure this doesn't happen for any reason
671	688	$user_data->add_role($role);
672	689	}
673	690	}
674	691
		@@ -761,9 +778,9 @@
761	778	if( !empty( $field['meta-name'] ) && ( ! isset( $field['field'] ) || 'Default - Biographical Info' !== $field['field'] ) ){
762	779	if ( ! array_key_exists( $field['meta-name'], $global_request ) ) {
763	780	$posted_value = '';
764	781	} elseif( in_array( $field['field'], array( 'URL' ), true ) ) {
765		- $posted_value = esc_url_raw( $global_request[ $field['meta-name'] ] );
	782	+ $posted_value = wppb_sanitize_request_url( $global_request[ $field['meta-name'] ] );
766	783	} elseif( in_array( $field['field'], array( 'Textarea' ), true ) ){
767	784	$meta_value = sanitize_textarea_field( wp_unslash( $global_request[ $field['meta-name'] ] ) );
768	785
769	786	if( apply_filters( 'wppb_form_field_textarea_escape_on_save', false ) )
		@@ -942,20 +959,22 @@
942	959
943	960	/* set action for automatic login after registration */
944	961	add_action( 'init', 'wppb_autologin_after_registration' );
945	962	function wppb_autologin_after_registration(){
946		- if( isset( $_GET['autologin'] ) && isset( $_GET['uid'] ) && isset( $_REQUEST['_wpnonce'] ) ){
947		- $uid = absint( $_GET['uid'] );
	963	+ if( isset( $_GET['autologin'] ) && isset( $_REQUEST['_wpnonce'] ) ){
	964	+ $nonce = sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) );
	965	+ $uid = wppb_get_autologin_user_id( $nonce, false );
948	966
949	967	$arr_params = array( 'autologin', 'uid', '_wpnonce' );
950	968	$current_page_url = remove_query_arg( $arr_params, wppb_curpageurl() );
951	969
952		- if ( ! ( wp_verify_nonce( sanitize_text_field( $_REQUEST['_wpnonce'] ) , 'autologin-'.$uid.'-'.(int)( time() / 60 ) ) || wp_verify_nonce( sanitize_text_field( $_REQUEST['_wpnonce'] ) , 'autologin-'.$uid.'-'.(int)( time() / 60 - 1 ) ) ) ){
	970	+ if ( ! $uid || ! get_userdata( $uid ) || ! wppb_verify_autologin_nonce( $nonce, $uid ) ) {
953	971	wp_redirect( $current_page_url );
954	972	exit;
955		- } else {
956		- wp_set_auth_cookie( $uid );
957		- wp_redirect( $current_page_url );
958		- exit;
959	973	}
	974	+
	975	+ wppb_get_autologin_user_id( $nonce, true );
	976	+ wp_set_auth_cookie( $uid );
	977	+ wp_redirect( $current_page_url );
	978	+ exit;
960	979	}
961	980	}