| @@ -53,20 +53,20 @@ | ||
| 53 | 53 | |
| 54 | 54 | class Wordpress_Creation_Kit_PB{ |
| 55 | 55 | |
| 56 | 56 | private $defaults = array( |
| 57 | - 'metabox_id' => '', | |
| 58 | - 'metabox_title' => 'Meta Box', | |
| 59 | - 'post_type' => 'post', | |
| 60 | - 'meta_name' => '', | |
| 61 | - 'meta_array' => array(), | |
| 62 | - 'page_template' => '', | |
| 63 | - 'post_id' => '', | |
| 64 | - 'single' => false, | |
| 57 | + 'metabox_id' => '', | |
| 58 | + 'metabox_title' => 'Meta Box', | |
| 59 | + 'post_type' => 'post', | |
| 60 | + 'meta_name' => '', | |
| 61 | + 'meta_array' => array(), | |
| 62 | + 'page_template' => '', | |
| 63 | + 'post_id' => '', | |
| 64 | + 'single' => false, | |
| 65 | 65 | 'unserialize_fields' => false, |
| 66 | - 'sortable' => true, | |
| 67 | - 'context' => 'post_meta', | |
| 68 | - 'mb_context' => 'normal' | |
| 66 | + 'sortable' => true, | |
| 67 | + 'context' => 'post_meta', | |
| 68 | + 'mb_context' => 'normal' | |
| 69 | 69 | ); |
| 70 | 70 | private $args; |
| 71 | 71 | |
| 72 | 72 | |
| @@ -95,8 +95,9 @@ | ||
| 95 | 95 | add_action("wp_ajax_wck_remove_meta".$this->args['meta_name'], array( &$this, 'wck_remove_meta') ); |
| 96 | 96 | add_action("wp_ajax_wck_reorder_meta".$this->args['meta_name'], array( &$this, 'wck_reorder_meta') ); |
| 97 | 97 | |
| 98 | 98 | add_action('add_meta_boxes', array( &$this, 'wck_add_metabox') ); |
| 99 | + add_action('wck_add_meta_boxes', array( &$this, 'wck_add_metabox') ); | |
| 99 | 100 | |
| 100 | 101 | /* For single forms we save them the old fashion way */ |
| 101 | 102 | if( $this->args['single'] ){ |
| 102 | 103 | add_action('save_post', array($this, 'wck_save_single_metabox'), 10, 2); |
| @@ -117,11 +118,19 @@ | ||
| 117 | 118 | global $pb_wck_pages_hooknames; |
| 118 | 119 | |
| 119 | 120 | if( $this->args['context'] == 'post_meta' ){ |
| 120 | 121 | if( $this->args['post_id'] == '' && $this->args['page_template'] == '' ){ |
| 121 | - add_meta_box($this->args['metabox_id'], $this->args['metabox_title'], array( &$this, 'wck_content' ), $this->args['post_type'], $this->args['mb_context'], 'high', array( 'meta_name' => $this->args['meta_name'], 'meta_array' => $this->args['meta_array']) ); | |
| 122 | + | |
| 123 | + $priority = 'high'; | |
| 124 | + | |
| 125 | + if( !empty( $this->args['meta_name'] ) && in_array( $this->args['meta_name'], array( 'wppb_ul_settings_query', 'wppb_ul_csv_download_settings', 'wppb_rf_progress_bar_settings', 'wppb_epf_progress_bar_settings' ) ) ){ | |
| 126 | + $priority = 'low'; | |
| 127 | + } | |
| 128 | + | |
| 129 | + add_meta_box($this->args['metabox_id'], $this->args['metabox_title'], array( &$this, 'wck_content' ), $this->args['post_type'], $this->args['mb_context'], $priority, array( 'meta_name' => $this->args['meta_name'], 'meta_array' => $this->args['meta_array']) ); | |
| 122 | 130 | /* add class to meta box */ |
| 123 | 131 | add_filter( "postbox_classes_".$this->args['post_type']."_".$this->args['metabox_id'], array( &$this, 'wck_add_metabox_classes' ) ); |
| 132 | + | |
| 124 | 133 | } |
| 125 | 134 | else{ |
| 126 | 135 | if( !empty( $_GET['post'] ) ) |
| 127 | 136 | $post_id = filter_var( $_GET['post'], FILTER_SANITIZE_NUMBER_INT ); |
| @@ -185,9 +194,9 @@ | ||
| 185 | 194 | $post_id = ''; |
| 186 | 195 | |
| 187 | 196 | |
| 188 | 197 | |
| 189 | -// //output the add form or themes metabox content | |
| 198 | + // output the add form or themes metabox content | |
| 190 | 199 | if ($metabox['id'] == 'wppb-ul-themes-settings' ) { |
| 191 | 200 | echo $metabox['args']['meta_array']; //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped |
| 192 | 201 | } |
| 193 | 202 | else self::create_add_form($metabox['args']['meta_array'], $metabox['args']['meta_name'], $post); |
| @@ -234,14 +243,14 @@ | ||
| 234 | 243 | else |
| 235 | 244 | $single_prefix = ''; |
| 236 | 245 | |
| 237 | 246 | $context_slug = !empty($context) ? $context . '_' : ''; |
| 238 | - $label_for = $context_slug . $single_prefix . esc_attr( Wordpress_Creation_Kit_PB::wck_generate_slug( $details['title'], $details ) ); | |
| 247 | + $label_for = esc_attr( Wordpress_Creation_Kit_PB::wck_generate_slug( $details['title'], $details ) ); | |
| 239 | 248 | if ( $details['type'] === 'checkbox' && !empty( $details['options'] ) && count( $details['options'] ) == 1 ) { |
| 240 | 249 | $label_for = $label_for . '_yes'; |
| 241 | 250 | } |
| 242 | 251 | |
| 243 | - $element .= '<label class="cozmoslabs-form-field-label" for="'. $label_for .'" class="field-label">'. apply_filters( "wck_label_{$meta}_". Wordpress_Creation_Kit_PB::wck_generate_slug( $details['title'], $details ), ucfirst($details['title']) ); | |
| 252 | + $element .= '<label class="cozmoslabs-form-field-label" for="'. $label_for .'">'. apply_filters( "wck_label_{$meta}_". Wordpress_Creation_Kit_PB::wck_generate_slug( $details['title'], $details ), ucfirst($details['title']) ); | |
| 244 | 253 | if( !empty( $details['required'] ) && $details['required'] ) |
| 245 | 254 | $element .= '<span class="required">*</span>'; |
| 246 | 255 | $element .= '</label>'; |
| 247 | 256 | |
| @@ -595,9 +604,9 @@ | ||
| 595 | 604 | foreach($optgroup['options'] as $group_option ){ |
| 596 | 605 | |
| 597 | 606 | if( !is_array( $group_option ) ) |
| 598 | 607 | $select_options[] = $group_option; |
| 599 | - | |
| 608 | + | |
| 600 | 609 | } |
| 601 | 610 | } |
| 602 | 611 | |
| 603 | 612 | $field_details['options'] = $select_options; |
| @@ -767,9 +776,9 @@ | ||
| 767 | 776 | |
| 768 | 777 | if( !empty( $values ) ){ |
| 769 | 778 | foreach( $values as $key => $value ){ |
| 770 | 779 | if( array_key_exists( $key, $required_fields ) && apply_filters( "wck_required_test_{$meta}_{$key}", empty( $value ), $value, $id ) ){ |
| 771 | - $required_message .= apply_filters( "wck_required_message_{$meta}_{$key}", __( "Please enter a value for the required field ", "profile-builder" ) . "$required_fields[$key] \n", $value ); | |
| 780 | + $required_message .= apply_filters( "wck_required_message_{$meta}_{$key}", __( "Please enter a value for the required field ", "profile-builder" ) . "<strong>$required_fields[$key]</strong><br>", $value ); | |
| 772 | 781 | $required_fields_with_errors[] = $key; |
| 773 | 782 | } |
| 774 | 783 | } |
| 775 | 784 | } |
| @@ -824,18 +833,21 @@ | ||
| 824 | 833 | |
| 825 | 834 | /* ajax add a reccord to the meta */ |
| 826 | 835 | function wck_add_meta(){ |
| 827 | 836 | check_ajax_referer( "wck-add-meta" ); |
| 837 | + | |
| 828 | 838 | if( !empty( $_POST['meta'] ) ) |
| 829 | 839 | $meta = sanitize_text_field( $_POST['meta'] ); |
| 830 | 840 | else |
| 831 | 841 | $meta = ''; |
| 842 | + | |
| 832 | 843 | if( !empty( $_POST['id'] ) ) |
| 833 | 844 | $id = absint($_POST['id']); |
| 834 | 845 | else |
| 835 | 846 | $id = ''; |
| 847 | + | |
| 836 | 848 | if( !empty( $_POST['values'] ) && is_array( $_POST['values'] ) ) |
| 837 | - $values = array_map( 'wppb_sanitize_value', $_POST['values'] );//phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 849 | + $values = $this->wck_sanitize_associative_array( $_POST['values'] ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- we sanitize with our own function | |
| 838 | 850 | else |
| 839 | 851 | $values = array(); |
| 840 | 852 | |
| 841 | 853 | // Security checks |
| @@ -847,8 +859,13 @@ | ||
| 847 | 859 | $values = apply_filters( "wck_add_meta_filter_values_{$meta}", $values ); |
| 848 | 860 | |
| 849 | 861 | /* check required fields */ |
| 850 | 862 | $errors = self::wck_test_required( $this->args['meta_array'], $meta, $values, $id ); |
| 863 | + | |
| 864 | + if ( empty( $errors ) ) { | |
| 865 | + $errors = self::wck_maybe_add_extra_errors( $this->args['meta_array'], $meta, $values, $id ); | |
| 866 | + } | |
| 867 | + | |
| 851 | 868 | if( $errors != '' ){ |
| 852 | 869 | header( 'Content-type: application/json' ); |
| 853 | 870 | die( json_encode( $errors ) ); |
| 854 | 871 | } |
| @@ -882,17 +899,17 @@ | ||
| 882 | 899 | else if ( $this->args['context'] == 'option' ) |
| 883 | 900 | update_option( apply_filters( 'wck_option_meta' , $meta, $results ), wp_unslash( $results ) ); |
| 884 | 901 | |
| 885 | 902 | /* if unserialize_fields is true add for each entry separate post meta for every element of the form */ |
| 886 | - if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 903 | + // if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 887 | 904 | |
| 888 | - $meta_suffix = count( $results ); | |
| 889 | - if( !empty( $values ) ){ | |
| 890 | - foreach( $values as $name => $value ){ | |
| 891 | - update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 892 | - } | |
| 893 | - } | |
| 894 | - } | |
| 905 | + // $meta_suffix = count( $results ); | |
| 906 | + // if( !empty( $values ) ){ | |
| 907 | + // foreach( $values as $name => $value ){ | |
| 908 | + // update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 909 | + // } | |
| 910 | + // } | |
| 911 | + // } | |
| 895 | 912 | |
| 896 | 913 | $entry_list = $this->wck_refresh_list( $meta, $id ); |
| 897 | 914 | $add_form = $this->wck_add_form( $meta, $id ); |
| 898 | 915 | |
| @@ -903,22 +920,26 @@ | ||
| 903 | 920 | |
| 904 | 921 | /* ajax update a reccord in the meta */ |
| 905 | 922 | function wck_update_meta(){ |
| 906 | 923 | check_ajax_referer( "wck-update-entry" ); |
| 924 | + | |
| 907 | 925 | if( !empty( $_POST['meta'] ) ) |
| 908 | 926 | $meta = sanitize_text_field( $_POST['meta'] ); |
| 909 | 927 | else |
| 910 | 928 | $meta = ''; |
| 929 | + | |
| 911 | 930 | if( !empty( $_POST['id'] ) ) |
| 912 | 931 | $id = absint($_POST['id']); |
| 913 | 932 | else |
| 914 | 933 | $id = ''; |
| 934 | + | |
| 915 | 935 | if( isset( $_POST['element_id'] ) ) |
| 916 | 936 | $element_id = absint( $_POST['element_id'] ); |
| 917 | 937 | else |
| 918 | 938 | $element_id = 0; |
| 919 | - if( !empty( $_POST['values'] ) && is_array( $_POST['values']) ) | |
| 920 | - $values = array_map( 'wppb_sanitize_value', $_POST['values'] ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 939 | + | |
| 940 | + if( !empty( $_POST['values'] ) && is_array( $_POST['values'] ) ) | |
| 941 | + $values = $this->wck_sanitize_associative_array( $_POST['values'] ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- we sanitize with our own function | |
| 921 | 942 | else |
| 922 | 943 | $values = array(); |
| 923 | 944 | |
| 924 | 945 | // Security checks |
| @@ -956,17 +977,17 @@ | ||
| 956 | 977 | else if ( $this->args['context'] == 'option' ) |
| 957 | 978 | update_option( apply_filters( 'wck_option_meta' , $meta, $results, $element_id ), wp_unslash( $results ) ); |
| 958 | 979 | |
| 959 | 980 | /* if unserialize_fields is true update the coresponding post metas for every element of the form */ |
| 960 | - if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 981 | + // if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 961 | 982 | |
| 962 | - $meta_suffix = $element_id + 1; | |
| 963 | - if( !empty( $values ) ){ | |
| 964 | - foreach( $values as $name => $value ){ | |
| 965 | - update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 966 | - } | |
| 967 | - } | |
| 968 | - } | |
| 983 | + // $meta_suffix = $element_id + 1; | |
| 984 | + // if( !empty( $values ) ){ | |
| 985 | + // foreach( $values as $name => $value ){ | |
| 986 | + // update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 987 | + // } | |
| 988 | + // } | |
| 989 | + // } | |
| 969 | 990 | |
| 970 | 991 | $entry_content = $this->wck_refresh_entry( $meta, $id, $element_id ); |
| 971 | 992 | |
| 972 | 993 | header( 'Content-type: application/json' ); |
| @@ -975,8 +996,12 @@ | ||
| 975 | 996 | |
| 976 | 997 | /* ajax to refresh the meta content | or used in other function to return the */ |
| 977 | 998 | /* this is used in Repeater Fields as an ajax action so we have to keep it dual purpose */ |
| 978 | 999 | function wck_refresh_list( $meta = '', $id = '' ){ |
| 1000 | + | |
| 1001 | + if( !current_user_can( 'manage_options' ) ) | |
| 1002 | + die(); | |
| 1003 | + | |
| 979 | 1004 | if( isset( $_POST['meta'] ) ) |
| 980 | 1005 | $meta = sanitize_text_field( $_POST['meta'] ); |
| 981 | 1006 | |
| 982 | 1007 | if( isset( $_POST['id'] ) ) |
| @@ -1028,10 +1053,14 @@ | ||
| 1028 | 1053 | |
| 1029 | 1054 | /* ajax to show the update form */ |
| 1030 | 1055 | function wck_show_update_form(){ |
| 1031 | 1056 | check_ajax_referer( "wck-edit-entry" ); |
| 1032 | - $meta = isset( $_POST['meta'] ) ? sanitize_text_field( $_POST['meta'] ) : ''; | |
| 1033 | - $id = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : ''; | |
| 1057 | + | |
| 1058 | + if( !current_user_can( 'manage_options' ) ) | |
| 1059 | + die(); | |
| 1060 | + | |
| 1061 | + $meta = isset( $_POST['meta'] ) ? sanitize_text_field( $_POST['meta'] ) : ''; | |
| 1062 | + $id = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : ''; | |
| 1034 | 1063 | $element_id = isset( $_POST['element_id'] ) ? absint( $_POST['element_id'] ) : ''; |
| 1035 | 1064 | |
| 1036 | 1065 | do_action( "wck_before_adding_form_{$meta}", $id, $element_id ); |
| 1037 | 1066 | |
| @@ -1090,33 +1119,33 @@ | ||
| 1090 | 1119 | |
| 1091 | 1120 | |
| 1092 | 1121 | /* TODO: optimize so that it updates from the deleted element forward */ |
| 1093 | 1122 | /* if unserialize_fields is true delete the coresponding post metas */ |
| 1094 | - if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 1123 | + // if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 1095 | 1124 | |
| 1096 | - $meta_suffix = 1; | |
| 1125 | + // $meta_suffix = 1; | |
| 1097 | 1126 | |
| 1098 | - if( !empty( $results ) ){ | |
| 1099 | - foreach( $results as $result ){ | |
| 1100 | - foreach ( $result as $name => $value){ | |
| 1101 | - update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 1102 | - } | |
| 1103 | - $meta_suffix++; | |
| 1104 | - } | |
| 1105 | - } | |
| 1127 | + // if( !empty( $results ) ){ | |
| 1128 | + // foreach( $results as $result ){ | |
| 1129 | + // foreach ( $result as $name => $value){ | |
| 1130 | + // update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 1131 | + // } | |
| 1132 | + // $meta_suffix++; | |
| 1133 | + // } | |
| 1134 | + // } | |
| 1106 | 1135 | |
| 1107 | - if( count( $results ) == 0 ) | |
| 1108 | - $results = $old_results; | |
| 1136 | + // if( count( $results ) == 0 ) | |
| 1137 | + // $results = $old_results; | |
| 1109 | 1138 | |
| 1110 | - if( !empty( $results ) ){ | |
| 1111 | - foreach( $results as $result ){ | |
| 1112 | - foreach ( $result as $name => $value){ | |
| 1113 | - delete_post_meta( $id, $meta.'_'.$name.'_'.$meta_suffix ); | |
| 1114 | - } | |
| 1115 | - break; | |
| 1116 | - } | |
| 1117 | - } | |
| 1118 | - } | |
| 1139 | + // if( !empty( $results ) ){ | |
| 1140 | + // foreach( $results as $result ){ | |
| 1141 | + // foreach ( $result as $name => $value){ | |
| 1142 | + // delete_post_meta( $id, $meta.'_'.$name.'_'.$meta_suffix ); | |
| 1143 | + // } | |
| 1144 | + // break; | |
| 1145 | + // } | |
| 1146 | + // } | |
| 1147 | + // } | |
| 1119 | 1148 | |
| 1120 | 1149 | $entry_list = $this->wck_refresh_list( $meta, $id ); |
| 1121 | 1150 | $add_form = $this->wck_add_form( $meta, $id ); |
| 1122 | 1151 | |
| @@ -1173,21 +1202,21 @@ | ||
| 1173 | 1202 | update_option( apply_filters( 'wck_option_meta' , $meta, $results, $element_id ), wp_unslash( $results ) ); |
| 1174 | 1203 | |
| 1175 | 1204 | |
| 1176 | 1205 | /* if unserialize_fields is true reorder all the coresponding post metas */ |
| 1177 | - if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 1206 | + // if( $this->args['unserialize_fields'] && $this->args['context'] == 'post_meta' ){ | |
| 1178 | 1207 | |
| 1179 | - $meta_suffix = 1; | |
| 1180 | - if( !empty( $new_results ) ){ | |
| 1181 | - foreach( $new_results as $result ){ | |
| 1182 | - foreach ( $result as $name => $value){ | |
| 1183 | - update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 1184 | - } | |
| 1185 | - $meta_suffix++; | |
| 1186 | - } | |
| 1187 | - } | |
| 1208 | + // $meta_suffix = 1; | |
| 1209 | + // if( !empty( $new_results ) ){ | |
| 1210 | + // foreach( $new_results as $result ){ | |
| 1211 | + // foreach ( $result as $name => $value){ | |
| 1212 | + // update_post_meta($id, $meta.'_'.$name.'_'.$meta_suffix, $value); | |
| 1213 | + // } | |
| 1214 | + // $meta_suffix++; | |
| 1215 | + // } | |
| 1216 | + // } | |
| 1188 | 1217 | |
| 1189 | - } | |
| 1218 | + // } | |
| 1190 | 1219 | |
| 1191 | 1220 | $entry_list = $this->wck_refresh_list( $meta, $id ); |
| 1192 | 1221 | header( 'Content-type: application/json' ); |
| 1193 | 1222 | die( json_encode( array( 'entry_list' => $entry_list ) ) ); |
| @@ -1218,12 +1247,14 @@ | ||
| 1218 | 1247 | |
| 1219 | 1248 | if( !empty( $_POST ) ){ |
| 1220 | 1249 | /* for single metaboxes we save a hidden input that contains the meta_name attr as a key so we need to search for it */ |
| 1221 | 1250 | foreach( $_POST as $request_key => $request_value ){ |
| 1251 | + $request_key = sanitize_text_field( $request_key ); | |
| 1252 | + | |
| 1222 | 1253 | if( strpos( $request_key, '_wckmetaname_' ) !== false && strpos( $request_key, '#wck' ) !== false ){ |
| 1223 | 1254 | /* found it so now retrieve the meta_name from the key formatted _wckmetaname_actuaname#wck */ |
| 1224 | 1255 | $request_key = str_replace( '_wckmetaname_', '', $request_key ); |
| 1225 | - $meta_name = sanitize_text_field( str_replace( '#wck', '', $request_key ) ); | |
| 1256 | + $meta_name = str_replace( '#wck', '', $request_key ); | |
| 1226 | 1257 | /* we have it so go through only on the WCK object instance that has this meta_name */ |
| 1227 | 1258 | if( $this->args['meta_name'] == $meta_name ){ |
| 1228 | 1259 | |
| 1229 | 1260 | /* get the meta values from the $_POST and store them in an array */ |
| @@ -1230,18 +1261,23 @@ | ||
| 1230 | 1261 | $meta_values = array(); |
| 1231 | 1262 | if( !empty( $this->args['meta_array'] ) ){ |
| 1232 | 1263 | foreach ($this->args['meta_array'] as $meta_field){ |
| 1233 | 1264 | /* in the $_POST the names for the fields are prefixed with the meta_name for the single metaboxes in case there are multiple metaboxes that contain fields wit hthe same name */ |
| 1234 | - $single_field_name = $this->args['meta_name'] .'_'. Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'],$meta_field ); | |
| 1235 | - if (isset($_POST[$single_field_name])) { | |
| 1265 | + $field_slug = Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field ); | |
| 1266 | + $single_field_name = $this->args['meta_name'] .'_'. $field_slug; | |
| 1267 | + | |
| 1268 | + if ( isset( $_POST[$single_field_name] ) ) { | |
| 1236 | 1269 | /* checkbox needs to be stored as string not array */ |
| 1237 | - if( $meta_field['type'] == 'checkbox' ) | |
| 1238 | - $_POST[$single_field_name] = implode( ', ', $_POST[$single_field_name] );//phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 1270 | + if( $meta_field['type'] == 'checkbox' ){ | |
| 1271 | + if( is_array($_POST[$single_field_name]) ) | |
| 1272 | + $_POST[$single_field_name] = implode(', ', $this->wck_sanitize_value( $_POST[$single_field_name], $field_slug ) ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- we sanitize with our own function | |
| 1273 | + else | |
| 1274 | + $_POST[$single_field_name] = $this->wck_sanitize_value( $_POST[$single_field_name], $field_slug ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- we sanitize with our own function | |
| 1275 | + } | |
| 1239 | 1276 | |
| 1240 | - $meta_values[Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field )] = wppb_sanitize_value( $_POST[$single_field_name] ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 1241 | - } | |
| 1242 | - else | |
| 1243 | - $meta_values[Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field )] = ''; | |
| 1277 | + $meta_values[$field_slug] = $this->wck_sanitize_value( $_POST[$single_field_name], $field_slug ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- we sanitize with our own function | |
| 1278 | + } else | |
| 1279 | + $meta_values[$field_slug] = ''; | |
| 1244 | 1280 | } |
| 1245 | 1281 | } |
| 1246 | 1282 | |
| 1247 | 1283 | /* test if we have errors for the required fields */ |
| @@ -1257,17 +1293,18 @@ | ||
| 1257 | 1293 | $wck_single_forms_errors[] = $errors; |
| 1258 | 1294 | } |
| 1259 | 1295 | else { |
| 1260 | 1296 | /* no errors so we can save */ |
| 1261 | - update_post_meta($post_id, $meta_name, array($meta_values)); | |
| 1297 | + update_post_meta( $post_id, $meta_name, array( $meta_values ) ); | |
| 1298 | + | |
| 1262 | 1299 | /* handle unserialized fields */ |
| 1263 | - if ($this->args['unserialize_fields']) { | |
| 1264 | - if (!empty($this->args['meta_array'])) { | |
| 1265 | - foreach ($this->args['meta_array'] as $meta_field) { | |
| 1266 | - update_post_meta($post_id, $meta_name . '_' . Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field ) . '_1', array_map( 'wppb_sanitize_value', $_POST[$this->args['meta_name'] . '_' . Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field )] ) ); //phpcs:ignore | |
| 1267 | - } | |
| 1268 | - } | |
| 1269 | - } | |
| 1300 | + // if ( $this->args['unserialize_fields'] ) { | |
| 1301 | + // if (!empty($this->args['meta_array'])) { | |
| 1302 | + // foreach ($this->args['meta_array'] as $meta_field) { | |
| 1303 | + // update_post_meta($post_id, $meta_name . '_' . Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field ) . '_1', array_map( 'wppb_sanitize_value', $_POST[$this->args['meta_name'] . '_' . Wordpress_Creation_Kit_PB::wck_generate_slug( $meta_field['title'], $meta_field )] ) ); //phpcs:ignore | |
| 1304 | + // } | |
| 1305 | + // } | |
| 1306 | + // } | |
| 1270 | 1307 | } |
| 1271 | 1308 | break; |
| 1272 | 1309 | } |
| 1273 | 1310 | } |
| @@ -1327,9 +1364,26 @@ | ||
| 1327 | 1364 | echo '<script type="text/javascript">alert("'. str_replace( '%0A', '\n', esc_js( urldecode( base64_decode( $_GET['wckerrormessages'] ) ) ) ) .'")</script>';//phpcs:ignore |
| 1328 | 1365 | } |
| 1329 | 1366 | } |
| 1330 | 1367 | |
| 1368 | + static function wck_maybe_add_extra_errors( $meta_array, $meta, $values, $id ){ | |
| 1331 | 1369 | |
| 1370 | + if( strpos( $meta, 'wppb_cr_' ) === false ) | |
| 1371 | + return ''; | |
| 1372 | + | |
| 1373 | + $license_status = wppb_get_serial_number_status(); | |
| 1374 | + | |
| 1375 | + if( $license_status == 'missing' ){ | |
| 1376 | + return array( 'error' => sprintf( __( 'Please %1$senter your license key%2$s first, to add new custom redirects.', 'profile-builder' ), '<a href="' . admin_url( 'admin.php?page=profile-builder-general-settings' ) . '">', '</a>' ) ); | |
| 1377 | + } else if( $license_status !== 'valid' ){ | |
| 1378 | + return array( 'error' => sprintf( __( 'You need an active license to add new custom redirects. <br>%1$sRenew%2$s or %3$spurchase a new one here%4$s.', 'profile-builder' ), '<a href="https://www.cozmoslabs.com/account/?utm_source=pb-redirects&utm_medium=client-site&utm_campaign=pb-expired-license">', '</a>', '<a href="https://www.cozmoslabs.com/wordpress-profile-builder/?utm_source=pb-redirects&utm_medium=client-site&utm_campaign=pb-redirects-addon#pricing" target="_blank">', '</a>' ) ); | |
| 1379 | + } | |
| 1380 | + | |
| 1381 | + return ''; | |
| 1382 | + | |
| 1383 | + } | |
| 1384 | + | |
| 1385 | + | |
| 1332 | 1386 | /** |
| 1333 | 1387 | * The function used to generate slugs in WCK |
| 1334 | 1388 | * |
| 1335 | 1389 | * @since 1.1.1 |
| @@ -1361,9 +1415,9 @@ | ||
| 1361 | 1415 | if( !empty( $values ) ) |
| 1362 | 1416 | $value_attr = $values[$i]; |
| 1363 | 1417 | else |
| 1364 | 1418 | $value_attr = $option; |
| 1365 | - | |
| 1419 | + | |
| 1366 | 1420 | if( !empty( $option['disabled'] ) && $option['disabled'] == true ){ |
| 1367 | 1421 | $disabled = ' disabled'; |
| 1368 | 1422 | } |
| 1369 | 1423 | } |
| @@ -1397,16 +1451,21 @@ | ||
| 1397 | 1451 | // title is set only for disabled options to let users know those fields are available in a paid version |
| 1398 | 1452 | if( !empty( $disabled ) ){ |
| 1399 | 1453 | if( isset( $value_attr['field_name'] ) && $value_attr['field_name'] == 'Subscription Plans' ) |
| 1400 | 1454 | $title = esc_attr( __( 'Install the free Paid Member Subscriptions plugin to get access this field.', 'profile-builder' ) ); |
| 1455 | + elseif ( isset( $value_attr['field_name'] ) && $value_attr['field_name'] == 'Additional Map' ) | |
| 1456 | + $title = esc_attr( __( 'A Map field must be created first.', 'profile-builder' ) ); | |
| 1401 | 1457 | else |
| 1402 | 1458 | $title = esc_attr( __( 'This field is available in our paid plans.', 'profile-builder' ) ); |
| 1403 | 1459 | } |
| 1404 | 1460 | |
| 1405 | - if( isset( $value_attr['field_name'] ) ) | |
| 1461 | + if( isset( $value_attr['field_name'] ) ) { | |
| 1406 | 1462 | $optionOutput = '<option value="" '. esc_attr( $disabled ) . ( !empty( $disabled ) ? ' title="'. $title .'"' : '' ) . ' >'. esc_html( $label ) .'</option>'; |
| 1407 | - else | |
| 1408 | - $optionOutput = '<option value="'. esc_attr( $value_attr ) .'" '. selected( $value_attr, $current_value, false ) . ( !empty( $disabled ) ? ' title="'. $title .'"' : '' ) . ' >'. esc_html( $label ) .'</option>'; | |
| 1463 | + } else if ( is_array( $current_value ) ) { | |
| 1464 | + $is_selected = in_array( $value_attr, $current_value ) ? 'selected="selected" ' : ''; | |
| 1465 | + $optionOutput = '<option value="'. esc_attr( $value_attr ) .'" '. $is_selected . ( !empty( $disabled ) ? ' title="'. $title .'"' : '' ) . ' >'. esc_html( $label ) .'</option>'; | |
| 1466 | + } else | |
| 1467 | + $optionOutput = '<option value="'. esc_attr( $value_attr ) .'" '. selected( strip_tags( $value_attr ), $current_value, false ) . ( !empty( $disabled ) ? ' title="'. $title .'"' : '' ) . ' >'. esc_html( $label ) .'</option>'; | |
| 1409 | 1468 | |
| 1410 | 1469 | return $optionOutput; |
| 1411 | 1470 | } |
| 1412 | 1471 | |
| @@ -1415,8 +1474,71 @@ | ||
| 1415 | 1474 | if (is_array($v)) return true; |
| 1416 | 1475 | } |
| 1417 | 1476 | return false; |
| 1418 | 1477 | } |
| 1478 | + | |
| 1479 | + function wck_sanitize_associative_array( $associative_array ){ | |
| 1480 | + $sanitized_associative_array = array(); | |
| 1481 | + | |
| 1482 | + foreach ( $associative_array as $meta_name => $value) { | |
| 1483 | + $sanitized_associative_array[$meta_name] = $this->wck_sanitize_value($value, $meta_name); | |
| 1484 | + } | |
| 1485 | + | |
| 1486 | + return $sanitized_associative_array; | |
| 1487 | + } | |
| 1488 | + | |
| 1489 | + function wck_sanitize_value( $value, $meta_name = false ){ | |
| 1490 | + | |
| 1491 | + if( apply_filters( 'wck_pre_sanitize_value', false, $meta_name ) ){ | |
| 1492 | + return apply_filters( 'wck_sanitize_value', $value, $meta_name ); | |
| 1493 | + } | |
| 1494 | + | |
| 1495 | + $is_wysiwyg_field = false; | |
| 1496 | + $is_textarea_field = false; | |
| 1497 | + $is_query_compare = false; | |
| 1498 | + | |
| 1499 | + if( !empty( $meta_name ) && !empty( $this->args['meta_array'] ) ){ | |
| 1500 | + | |
| 1501 | + foreach( $this->args['meta_array'] as $field ){ | |
| 1502 | + | |
| 1503 | + if( $field['slug'] === $meta_name && $field['type'] === 'wysiwyg editor' ) | |
| 1504 | + $is_wysiwyg_field = true; | |
| 1505 | + | |
| 1506 | + if( $field['slug'] === $meta_name && $field['type'] === 'textarea' ) | |
| 1507 | + $is_textarea_field = true; | |
| 1508 | + | |
| 1509 | + if( $meta_name === 'query-compare' && $field['slug'] === $meta_name ) | |
| 1510 | + $is_query_compare = true; | |
| 1511 | + | |
| 1512 | + } | |
| 1513 | + | |
| 1514 | + } | |
| 1515 | + | |
| 1516 | + if( is_array( $value ) ) { | |
| 1517 | + $sanitized_array = array(); | |
| 1518 | + | |
| 1519 | + foreach ($value as $element) { | |
| 1520 | + if( $is_wysiwyg_field ) | |
| 1521 | + $sanitized_array[] = wp_kses_post( $element ); | |
| 1522 | + elseif( $is_textarea_field ) | |
| 1523 | + $sanitized_array[] = wp_kses_post( $element ); | |
| 1524 | + else | |
| 1525 | + $sanitized_array[] = sanitize_text_field( $element ); | |
| 1526 | + } | |
| 1527 | + | |
| 1528 | + return $sanitized_array; | |
| 1529 | + } | |
| 1530 | + else{ | |
| 1531 | + if( $is_wysiwyg_field ) | |
| 1532 | + return wp_kses_post( $value ); | |
| 1533 | + elseif( $is_textarea_field ) | |
| 1534 | + return wp_kses_post( $value ); | |
| 1535 | + elseif( $is_query_compare ) | |
| 1536 | + return in_array( $value, array( '=', '!=', '>', '>=', '<', '<=', 'LIKE', 'NOT LIKE', 'IN', 'NOT IN', 'BETWEEN', 'NOT BETWEEN', 'EXISTS', 'NOT EXISTS' ), true ) ? $value : '='; | |
| 1537 | + else | |
| 1538 | + return sanitize_text_field( $value ); | |
| 1539 | + } | |
| 1540 | + } | |
| 1419 | 1541 | } |
| 1420 | 1542 | |
| 1421 | 1543 | |
| 1422 | 1544 | /* |
| @@ -1539,9 +1661,13 @@ | ||
| 1539 | 1661 | * Do action 'add_meta_boxes'. This hook isn't executed by default on a admin page so we have to add it. |
| 1540 | 1662 | */ |
| 1541 | 1663 | function wck_settings_page_add_meta_boxes() { |
| 1542 | 1664 | global $post; |
| 1543 | - do_action( 'add_meta_boxes', $this->hookname, $post ); | |
| 1665 | + | |
| 1666 | + if( empty( $post ) || empty( $post->ID ) ) | |
| 1667 | + do_action( 'wck_add_meta_boxes', $this->hookname, $post ); | |
| 1668 | + else | |
| 1669 | + do_action( 'add_meta_boxes', $this->hookname, $post ); | |
| 1544 | 1670 | } |
| 1545 | 1671 | |
| 1546 | 1672 | /** |
| 1547 | 1673 | * Loads the JavaScript files required for managing the meta boxes on the theme settings |
| @@ -1612,10 +1738,12 @@ | ||
| 1612 | 1738 | <?php wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); ?> |
| 1613 | 1739 | |
| 1614 | 1740 | <?php do_action( 'wck_before_meta_boxes', $this->hookname ); ?> |
| 1615 | 1741 | |
| 1616 | - <div class="metabox-holder"> | |
| 1617 | - <div class="wck-post-body <?php echo ( $this->hookname === 'profile-builder_page_user-email-customizer' || $this->hookname === 'profile-builder_page_admin-email-customizer' ) ? 'cozmoslabs-email-customizer-section' : '' ?>"> | |
| 1742 | + <?php $is_email_customizer_page = $this->hookname === 'profile-builder_page_user-email-customizer' || $this->hookname === 'profile-builder_page_admin-email-customizer'; ?> | |
| 1743 | + | |
| 1744 | + <div class="metabox-holder <?php echo $is_email_customizer_page ? 'cozmoslabs-settings-container' : '' ?>"> | |
| 1745 | + <div class="wck-post-body <?php echo $is_email_customizer_page ? 'cozmoslabs-email-customizer-section cozmoslabs-settings' : '' ?>"> | |
| 1618 | 1746 | <div class="post-box-container column-1 normal"> |
| 1619 | 1747 | <?php do_action( 'wck_before_column1_metabox_content', $this->hookname ); ?> |
| 1620 | 1748 | <?php do_meta_boxes( $this->hookname, 'normal', null ); ?> |
| 1621 | 1749 | <?php do_action( 'wck_after_column1_metabox_content', $this->hookname ); ?> |
| @@ -1625,9 +1753,9 @@ | ||
| 1625 | 1753 | <?php do_meta_boxes( $this->hookname, 'advanced', null ); ?> |
| 1626 | 1754 | <?php do_action( 'wck_after_column3_metabox_content', $this->hookname ); ?> |
| 1627 | 1755 | </div> |
| 1628 | 1756 | </div> |
| 1629 | - <div class="post-box-container column-2 side"><?php do_meta_boxes( $this->hookname, 'side', null ); ?></div> | |
| 1757 | + <div class="post-box-container column-2 side <?php echo $is_email_customizer_page ? 'cozmoslabs-submit' : '' ?>"><?php do_meta_boxes( $this->hookname, 'side', null ); ?></div> | |
| 1630 | 1758 | |
| 1631 | 1759 | </div> |
| 1632 | 1760 | |
| 1633 | 1761 | <?php do_action( 'wck_after_meta_boxes', $this->hookname ); ?> |
