← All changes | front-end/class-formbuilder.php +32 -16 3.16.4 → 4.0.3 View file →

		@@ -38,8 +38,16 @@
38	38	if( $this->args['form_name'] != 'unspecified' ){
39	39	$this->args['ID'] = Profile_Builder_Form_Creator::wppb_get_form_id_from_form_name( $this->args['form_name'], $this->args['form_type'] );
40	40	}
41	41
	42	+ /* Let add-ons finalise the form args once ID/form_name are resolved.
	43	+ The form-builder hooks this (wppb_fb_resolve_default_form_id) to point
	44	+ a shortcode with no form specified (empty ID) at the configured
	45	+ default form CPT, so [wppb-register] / [wppb-edit-profile] render the
	46	+ default form. Must run before the wppb_change_form_fields filter below
	47	+ (multiple-forms reads $this->args['ID'] to pick the per-form list). */
	48	+ $this->args = apply_filters( 'wppb_form_args_after_init', $this->args );
	49	+
42	50	global $wppb_shortcode_on_front;
43	51	$wppb_shortcode_on_front = true;
44	52
45	53	global $wppb_register_edit_profile_shortcode_on_front;
		@@ -159,9 +167,9 @@
159	167	$role_in_arg = get_role( $this->args['role'] );
160	168	if( !empty( $role_in_arg->capabilities['manage_options'] ) || !empty( $role_in_arg->capabilities['remove_users'] ) ){
161	169	if( !current_user_can( 'manage_options' ) || !current_user_can( 'remove_users' ) ){
162	170	$this->args['role'] = get_option('default_role');
163		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_user_role_message', '<p class="alert wppb-error" id="wppb_form_general_message">'.__( 'The role of the created user set to the default role. Only an administrator can register a user with the role assigned to this form.', 'profile-builder').'</p>' ) );
	171	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_user_role_message', '<p class="alert wppb-error" id="wppb_form_general_message" role="alert">'.__( 'The role of the created user set to the default role. Only an administrator can register a user with the role assigned to this form.', 'profile-builder').'</p>' ) );
164	172	}
165	173	}
166	174	}
167	175	}
		@@ -193,9 +201,9 @@
193	201	$registration = apply_filters ( 'wppb_register_setting_override', true );//used to be get_option( 'users_can_register' )
194	202
195	203	if ( !is_user_logged_in() ){
196	204	if ( !$registration )
197		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Only an administrator can add new users.', 'profile-builder')).'</p>' ) );
	205	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Only an administrator can add new users.', 'profile-builder')).'</p>' ) );
198	206
199	207	elseif ( $registration ){
200	208	$this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '' ) );
201	209	}
		@@ -203,12 +211,12 @@
203	211	}else{
204	212	$current_user_capability = apply_filters ( 'wppb_registration_user_capability', 'create_users' );
205	213
206	214	if ( current_user_can( $current_user_capability ) && $registration )
207		- $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Users can register themselves or you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
	215	+ $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Users can register themselves or you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
208	216
209	217	elseif ( current_user_can( $current_user_capability ) && !$registration )
210		- $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.esc_html(__( 'Users cannot currently register themselves, but you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
	218	+ $this->wppb_form_content( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.esc_html(__( 'Users cannot currently register themselves, but you can manually create users here.', 'profile-builder')). '<img src="'.WPPB_PLUGIN_URL.'assets/images/pencil_delete.png" title="'.esc_attr(__( 'This message is only visible by administrators', 'profile-builder' )).'"/>' . '</p>' ) );
211	219
212	220	elseif ( !current_user_can( $current_user_capability ) ){
213	221	global $user_ID;
214	222
		@@ -226,15 +234,15 @@
226	234	// CHECK FOR REDIRECT
227	235	$this->args['logout_redirect_url'] = wppb_get_redirect_url( $this->args['redirect_priority'], 'after_logout', $this->args['logout_redirect_url'], $userdata );
228	236	$this->args['logout_redirect_url'] = apply_filters( 'wppb_after_logout_redirect_url', $this->args['logout_redirect_url'] );
229	237
230		- echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message">'.sprintf( __( "You are currently logged in as %1s. You don't need another account. %2s", 'profile-builder' ), '<a href="'.get_author_posts_url( $user_ID ).'" title="'.$display_name.'">'.$display_name.'</a>', '<a href="'.wp_logout_url( $this->args['logout_redirect_url'] ).'" title="'.__( 'Log out of this account.', 'profile-builder' ).'">'.__( 'Logout', 'profile-builder' ).' &raquo;</a>' ).'</p>', $user_ID ) );
	238	+ echo wp_kses_post( apply_filters( 'wppb_register_pre_form_message', '<p class="alert" id="wppb_register_pre_form_message" role="alert">'.sprintf( __( "You are currently logged in as %1s. You don't need another account. %2s", 'profile-builder' ), '<a href="'.get_author_posts_url( $user_ID ).'" title="'.$display_name.'">'.$display_name.'</a>', '<a href="'.wp_logout_url( $this->args['logout_redirect_url'] ).'" title="'.__( 'Log out of this account.', 'profile-builder' ).'">'.__( 'Logout', 'profile-builder' ).' &raquo;</a>' ).'</p>', $user_ID ) );
231	239	}
232	240	}
233	241
234	242	}elseif ( $this->args['form_type'] == 'edit_profile' ){
235	243	if ( !is_user_logged_in() )
236		- echo wp_kses_post( apply_filters( 'wppb_edit_profile_user_not_logged_in_message', '<p class="warning" id="wppb_edit_profile_user_not_logged_in_message">'.esc_html(__( 'You must be logged in to edit your profile.', 'profile-builder' )) .'</p>' ) );
	244	+ echo wp_kses_post( apply_filters( 'wppb_edit_profile_user_not_logged_in_message', '<p class="warning" id="wppb_edit_profile_user_not_logged_in_message" role="alert">'.esc_html(__( 'You must be logged in to edit your profile.', 'profile-builder' )) .'</p>' ) );
237	245
238	246	elseif ( is_user_logged_in() )
239	247	$this->wppb_form_content( apply_filters( 'wppb_edit_profile_logged_in_user_message', '' ) );
240	248
		@@ -258,11 +266,16 @@
258	266	if ( isset( $wppb_general_settings['emailConfirmation'] ) && ( $wppb_general_settings['emailConfirmation'] == 'yes' ) && !$should_bypass_ec ) {
259	267	return $redirect_old;
260	268	}
261	269
	270	+ // Reject failed registrations
	271	+ if ( is_wp_error( $user_id ) ) {
	272	+ return $redirect_old;
	273	+ }
	274	+
262	275	$user_id = absint( $user_id );
263	276
264		- if ( ! $user_id || is_wp_error( $user_id ) ) {
	277	+ if ( ! $user_id ) {
265	278	return $redirect_old;
266	279	}
267	280
268	281	$user = get_userdata( $user_id );
		@@ -286,9 +299,9 @@
286	299
287	300	/* define redirect location */
288	301	if( $this->args['redirect_activated'] == 'No' ) {
289	302	if( isset( $_POST['_wp_http_referer'] ) ) {
290		- $redirect = esc_url_raw($_POST['_wp_http_referer']);
	303	+ $redirect = wppb_sanitize_request_url( $_POST['_wp_http_referer'] );
291	304	} else {
292	305	$redirect = home_url();
293	306	}
294	307	}
		@@ -370,11 +383,14 @@
370	383	$user_id = $this->wppb_save_form_values( $_REQUEST );
371	384
372	385	do_action( 'wppb_after_saving_form_values',$_REQUEST, $this->args );
373	386
374		- if( ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] ) && ( isset( $_POST['action'] ) && $_POST['action'] === $this->args['form_type'] ) ) {
	387	+ if( $this->args['form_type'] == 'register' && is_wp_error( $user_id ) ) {
	388	+ // Failed registration: show the error and re-render the form so the user can retry.
	389	+ echo $message . wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error" role="alert">'. esc_html__( 'Something went wrong while creating the user account, please try again.', 'profile-builder' ) .'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */
	390	+ } elseif( ( isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' === $_SERVER['REQUEST_METHOD'] ) && ( isset( $_POST['action'] ) && $_POST['action'] === $this->args['form_type'] ) ) {
375	391
376		- $form_message_tpl_start = apply_filters( 'wppb_form_message_tpl_start', '<p class="alert wppb-success" id="wppb_form_general_message">' );
	392	+ $form_message_tpl_start = apply_filters( 'wppb_form_message_tpl_start', '<p class="alert wppb-success" id="wppb_form_general_message" role="alert">' );
377	393	$form_message_tpl_end = apply_filters( 'wppb_form_message_tpl_end', '</p>' );
378	394
379	395	if( ! current_user_can( 'manage_options' ) && $this->args['form_type'] != 'edit_profile' && isset( $_POST['custom_field_user_role'] ) ) {
380	396	$user_role = sanitize_text_field($_POST['custom_field_user_role']);
		@@ -464,9 +480,9 @@
464	480
465	481	}
466	482
467	483	}else
468		- echo $message. wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error">'.esc_html(__( 'There was an error in the submitted form', 'profile-builder' )).'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped above */
	484	+ echo $message. wp_kses_post( apply_filters( 'wppb_general_top_error_message', '<p id="wppb_form_general_message" class="wppb-error" role="alert">'.esc_html(__( 'There was an error in the submitted form', 'profile-builder' )).'</p>' ) ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped above */
469	485
470	486	}else
471	487	echo $message; /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ /* properly escaped when created */
472	488
		@@ -504,9 +520,9 @@
504	520	$wppb_form_class .= ' wppb-edit-user';
505	521	$wppb_form_class .= $wppb_user_role_class;
506	522
507	523	?>
508		- <form enctype="multipart/form-data" method="post" id="<?php echo esc_attr( apply_filters( 'wppb_form_id', $wppb_form_id, $this ) ); ?>" class="<?php echo esc_attr( apply_filters( 'wppb_form_class', $wppb_form_class, $this ) ) . ( $this->args['ajax'] == 'true' ? ' wppb-ajax-form' : ''); ?>" action="<?php echo esc_url( apply_filters( 'wppb_form_action', wppb_curpageurl(), $this->args ) ); ?>">
	524	+ <form enctype="multipart/form-data" method="post" novalidate id="<?php echo esc_attr( apply_filters( 'wppb_form_id', $wppb_form_id, $this ) ); ?>" class="<?php echo esc_attr( apply_filters( 'wppb_form_class', $wppb_form_class, $this ) ) . ( $this->args['ajax'] == 'true' ? ' wppb-ajax-form' : ''); ?>" action="<?php echo esc_url( apply_filters( 'wppb_form_action', wppb_curpageurl(), $this->args ) ); ?>">
509	525	<?php
510	526	do_action( 'wppb_form_args_before_output', $this->args );
511	527	$this->args = apply_filters( 'wppb_filter_form_args_before_output', $this->args );
512	528
		@@ -541,11 +557,11 @@
541	557	$wppb_module_settings = get_option( 'wppb_module_settings' );
542	558
543	559	if( isset( $wppb_module_settings['wppb_customRedirect'] ) && $wppb_module_settings['wppb_customRedirect'] == 'show' ) {
544	560	if( isset( $_POST['wppb_referer_url'] ) )
545		- $referer = esc_url_raw( $_POST['wppb_referer_url'] );
	561	+ $referer = wppb_sanitize_request_url( $_POST['wppb_referer_url'] );
546	562	elseif( isset( $_SERVER['HTTP_REFERER'] ) )
547		- $referer = esc_url_raw( $_SERVER['HTTP_REFERER'] );
	563	+ $referer = wppb_sanitize_request_url( $_SERVER['HTTP_REFERER'] );
548	564	else
549	565	$referer = '';
550	566
551	567	echo '<input type="hidden" name="wppb_referer_url" value="'. esc_attr( $referer ).'"/>';
		@@ -667,9 +683,9 @@
667	683	if( $user_data ) {
668	684	$user_data->remove_all_caps();
669	685
670	686	foreach ($userdata['role'] as $role) {
671		- if ($role !== 'administrator' || $role !== 'super-admin')//make sure this doesn't happen for any reason
	687	+ if ($role !== 'administrator' && $role !== 'super-admin')//make sure this doesn't happen for any reason
672	688	$user_data->add_role($role);
673	689	}
674	690	}
675	691
		@@ -762,9 +778,9 @@
762	778	if( !empty( $field['meta-name'] ) && ( ! isset( $field['field'] ) || 'Default - Biographical Info' !== $field['field'] ) ){
763	779	if ( ! array_key_exists( $field['meta-name'], $global_request ) ) {
764	780	$posted_value = '';
765	781	} elseif( in_array( $field['field'], array( 'URL' ), true ) ) {
766		- $posted_value = esc_url_raw( $global_request[ $field['meta-name'] ] );
	782	+ $posted_value = wppb_sanitize_request_url( $global_request[ $field['meta-name'] ] );
767	783	} elseif( in_array( $field['field'], array( 'Textarea' ), true ) ){
768	784	$meta_value = sanitize_textarea_field( wp_unslash( $global_request[ $field['meta-name'] ] ) );
769	785
770	786	if( apply_filters( 'wppb_form_field_textarea_escape_on_save', false ) )