| 1 |
<?php |
| 2 |
// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean |
| 3 |
// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. |
| 4 |
|
| 5 |
/** |
| 6 |
* Add extra profile fields for users in admin |
| 7 |
* |
| 8 |
* @author PropertyHive |
| 9 |
* @category Admin |
| 10 |
* @package PropertyHive/Admin |
| 11 |
* @version 1.0.0 |
| 12 |
*/ |
| 13 |
|
| 14 |
if ( ! defined( 'ABSPATH' ) ) { |
| 15 |
exit; // Exit if accessed directly |
| 16 |
} |
| 17 |
|
| 18 |
if ( ! class_exists( 'PH_Admin_Profile', false ) ) : |
| 19 |
|
| 20 |
/** |
| 21 |
* PH_Admin_Profile Class. |
| 22 |
*/ |
| 23 |
// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Admin_Profile; preserving the existing PH_* class name is required for plugin and extension compatibility. |
| 24 |
class PH_Admin_Profile { |
| 25 |
|
| 26 |
/** |
| 27 |
* Hook in tabs. |
| 28 |
*/ |
| 29 |
public function __construct() { |
| 30 |
add_action( 'show_user_profile', array( $this, 'extra_user_meta_fields' ) ); |
| 31 |
add_action( 'edit_user_profile', array( $this, 'extra_user_meta_fields' ) ); |
| 32 |
|
| 33 |
add_action( 'personal_options_update', array( $this, 'save_extra_user_meta_fields' ) ); |
| 34 |
add_action( 'edit_user_profile_update', array( $this, 'save_extra_user_meta_fields' ) ); |
| 35 |
} |
| 36 |
|
| 37 |
/** |
| 38 |
* Get fields for the edit user pages. |
| 39 |
* |
| 40 |
* @return array Fields to display which are filtered through propertyhive_user_meta_fields before being returned |
| 41 |
*/ |
| 42 |
public function get_user_meta_fields() { |
| 43 |
|
| 44 |
$args = array( |
| 45 |
'post_type' => 'office', |
| 46 |
'nopaging' => true, |
| 47 |
'orderby' => 'post_title', |
| 48 |
'order' => 'ASC', |
| 49 |
); |
| 50 |
|
| 51 |
$offices = array(); |
| 52 |
|
| 53 |
$offices_query = new WP_Query( $args ); |
| 54 |
|
| 55 |
if ( $offices_query->have_posts() ) |
| 56 |
{ |
| 57 |
while ( $offices_query->have_posts() ) |
| 58 |
{ |
| 59 |
$offices_query->the_post(); |
| 60 |
|
| 61 |
$offices[get_the_ID()] = get_the_title(); |
| 62 |
} |
| 63 |
} |
| 64 |
wp_reset_postdata(); |
| 65 |
|
| 66 |
$fields = array( |
| 67 |
'office_id' => array( |
| 68 |
'label' => __( 'Office', 'propertyhive' ), |
| 69 |
'description' => '', |
| 70 |
'type' => 'select', |
| 71 |
'options' => array( '' => __( 'Select an office', 'propertyhive' ) ) + $offices, |
| 72 |
), |
| 73 |
'telephone_number' => array( |
| 74 |
'label' => __( 'Telephone Number', 'propertyhive' ), |
| 75 |
'description' => '', |
| 76 |
'type' => 'text', |
| 77 |
), |
| 78 |
'photo_attachment_id' => array( |
| 79 |
'label' => __( 'Photo', 'propertyhive' ), |
| 80 |
'description' => '', |
| 81 |
'type' => 'image', |
| 82 |
), |
| 83 |
); |
| 84 |
|
| 85 |
$user = wp_get_current_user(); |
| 86 |
$roles = (array)$user->roles; |
| 87 |
|
| 88 |
$fields['crm_only_mode'] = array( |
| 89 |
'label' => __( 'Property Hive-Only Mode', 'propertyhive' ), |
| 90 |
'description' => __( 'Enabling this option will remove all top level WordPress menu items leaving just Property Hive options making it easier to navigate and use as a CRM', 'propertyhive' ), |
| 91 |
'type' => in_array('administrator', $roles) ? 'checkbox' : 'hidden', |
| 92 |
); |
| 93 |
|
| 94 |
$show_fields = array( |
| 95 |
'negotiator' => array( |
| 96 |
'title' => __( 'Property Hive Negotiator Details', 'propertyhive' ), |
| 97 |
'fields' => $fields, |
| 98 |
), |
| 99 |
); |
| 100 |
|
| 101 |
$show_fields = apply_filters( 'propertyhive_user_meta_fields', $show_fields ); |
| 102 |
|
| 103 |
return $show_fields; |
| 104 |
} |
| 105 |
|
| 106 |
/** |
| 107 |
* Show fields on edit user pages. |
| 108 |
* |
| 109 |
* @param WP_User $user |
| 110 |
*/ |
| 111 |
public function extra_user_meta_fields( $user ) { |
| 112 |
|
| 113 |
if ( ! current_user_can( 'manage_propertyhive' ) ) { |
| 114 |
return; |
| 115 |
} |
| 116 |
|
| 117 |
$user_meta = get_userdata($user->ID); |
| 118 |
$user_roles = $user_meta->roles; |
| 119 |
|
| 120 |
if ( ! in_array("administrator", $user_roles) && ! in_array("editor", $user_roles) ) { |
| 121 |
return; |
| 122 |
} |
| 123 |
|
| 124 |
$show_fields = $this->get_user_meta_fields(); |
| 125 |
|
| 126 |
foreach ( $show_fields as $fieldset_key => $fieldset ) : |
| 127 |
?> |
| 128 |
<h2><?php echo esc_html($fieldset['title']); ?></h2> |
| 129 |
<table class="form-table" id="<?php echo esc_attr( 'fieldset-' . $fieldset_key ); ?>"> |
| 130 |
<?php foreach ( $fieldset['fields'] as $key => $field ) : ?> |
| 131 |
<?php |
| 132 |
if ( ! empty( $field['type'] ) && 'hidden' === $field['type'] ) |
| 133 |
{ |
| 134 |
?> |
| 135 |
<input type="hidden" name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $this->get_user_meta( $user->ID, $key ) != '' ? $this->get_user_meta( $user->ID, $key ) : ( isset( $field['default'] ) ? $field['default'] : '' ) ); ?>" /> |
| 136 |
<?php |
| 137 |
} |
| 138 |
else |
| 139 |
{ |
| 140 |
?> |
| 141 |
<tr> |
| 142 |
<th> |
| 143 |
<label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $field['label'] ); ?></label> |
| 144 |
</th> |
| 145 |
<td> |
| 146 |
<?php if ( ! empty( $field['type'] ) && 'select' === $field['type'] ) : ?> |
| 147 |
<select name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" class="<?php echo ( isset($field['class']) ? esc_attr($field['class']) : '' ); ?>" style="width: 25em;"> |
| 148 |
<?php |
| 149 |
$selected = esc_attr( get_user_meta( $user->ID, $key, true ) ); |
| 150 |
foreach ( $field['options'] as $option_key => $option_value ) : |
| 151 |
?> |
| 152 |
<option value="<?php echo esc_attr( $option_key ); ?>" <?php selected( $selected, $option_key, true ); ?>><?php echo esc_html( $option_value ); ?></option> |
| 153 |
<?php endforeach; ?> |
| 154 |
</select> |
| 155 |
<?php elseif ( ! empty( $field['type'] ) && 'checkbox' === $field['type'] ) : ?> |
| 156 |
<input type="checkbox" name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" value="1" class="<?php echo isset($field['class']) ? esc_attr( $field['class'] ) : ''; ?>" <?php checked( (int) get_user_meta( $user->ID, $key, true ), 1, true ); ?> /> |
| 157 |
<?php elseif ( ! empty( $field['type'] ) && 'color' === $field['type'] ) : ?> |
| 158 |
<input type="color" name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $this->get_user_meta( $user->ID, $key ) != '' ? $this->get_user_meta( $user->ID, $key ) : ( isset( $field['default'] ) ? $field['default'] : '' ) ); ?>" class="<?php echo esc_attr( $field['class'] ); ?>" /> |
| 159 |
<?php elseif ( ! empty( $field['type'] ) && 'button' === $field['type'] ) : ?> |
| 160 |
<button type="button" id="<?php echo esc_attr( $key ); ?>" class="button <?php echo esc_attr( $field['class'] ); ?>"><?php echo esc_html( $field['text'] ); ?></button> |
| 161 |
<?php elseif ( ! empty( $field['type'] ) && 'image' === $field['type'] ) : ?> |
| 162 |
<input type="hidden" name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" class="photo-attachment-id" value="<?php echo esc_attr( $this->get_user_meta( $user->ID, $key ) ); ?>" /> |
| 163 |
<div class="photo-attachment-image"> |
| 164 |
<?php if ( !empty($this->get_user_meta( $user->ID, $key )) ) { echo wp_get_attachment_image( $this->get_user_meta( $user->ID, $key ), 'thumbnail'); } ?> |
| 165 |
</div> |
| 166 |
<div class="wp-media-buttons"> |
| 167 |
<button class="button propertyhive-add-media" id="propertyhive-add-media"><?php echo esc_html(__('Select', 'propertyhive')); ?></button> |
| 168 |
</div> |
| 169 |
<script> |
| 170 |
|
| 171 |
var file_frame; |
| 172 |
|
| 173 |
jQuery(document).ready(function() |
| 174 |
{ |
| 175 |
jQuery('body').on('click', '.propertyhive-add-media', function( event ){ |
| 176 |
|
| 177 |
event.preventDefault(); |
| 178 |
|
| 179 |
// If the media frame already exists, reopen it. |
| 180 |
if ( file_frame ) { |
| 181 |
file_frame.open(); |
| 182 |
return; |
| 183 |
} |
| 184 |
|
| 185 |
// Create the media frame. |
| 186 |
file_frame = wp.media.frames.file_frame = wp.media({ |
| 187 |
multiple: false |
| 188 |
}); |
| 189 |
|
| 190 |
// When an image is selected, run a callback. |
| 191 |
file_frame.on( 'select', function() { |
| 192 |
var selection = file_frame.state().get('selection'); |
| 193 |
|
| 194 |
selection.map( function( attachment ) { |
| 195 |
|
| 196 |
attachment = attachment.toJSON(); |
| 197 |
|
| 198 |
jQuery('#<?php echo esc_attr( $key ); ?>').val(attachment.id); |
| 199 |
|
| 200 |
var photo_html = '<img src="' + attachment.url + '" style="max-width:150px; max-height:150px;" alt=""></li>'; |
| 201 |
|
| 202 |
jQuery('.photo-attachment-image').html(photo_html); |
| 203 |
}); |
| 204 |
}); |
| 205 |
|
| 206 |
// Finally, open the modal |
| 207 |
file_frame.open(); |
| 208 |
}); |
| 209 |
}); |
| 210 |
</script> |
| 211 |
<?php else: ?> |
| 212 |
<input type="text" name="<?php echo esc_attr( $key ); ?>" id="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $this->get_user_meta( $user->ID, $key ) ); ?>" class="<?php echo ( ! empty( $field['class'] ) ? esc_attr( $field['class'] ) : 'regular-text' ); ?>" /> |
| 213 |
<?php endif; ?> |
| 214 |
<p class="description"><?php echo wp_kses_post( $field['description'] ); ?></p> |
| 215 |
</td> |
| 216 |
</tr> |
| 217 |
<?php |
| 218 |
} |
| 219 |
?> |
| 220 |
<?php endforeach; ?> |
| 221 |
</table> |
| 222 |
<?php |
| 223 |
endforeach; |
| 224 |
} |
| 225 |
|
| 226 |
/** |
| 227 |
* Save Address Fields on edit user pages. |
| 228 |
* |
| 229 |
* @param int $user_id User ID of the user being saved |
| 230 |
*/ |
| 231 |
public function save_extra_user_meta_fields( $user_id ) { |
| 232 |
|
| 233 |
if ( ! current_user_can( 'manage_propertyhive' ) || ! current_user_can( 'edit_user', $user_id ) ) { |
| 234 |
return; |
| 235 |
} |
| 236 |
|
| 237 |
if ( ! isset( $_POST['_wpnonce'] ) || ! is_string( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'update-user_' . $user_id ) ) { |
| 238 |
return; |
| 239 |
} |
| 240 |
|
| 241 |
$user_meta = get_userdata($user_id); |
| 242 |
if ( ! $user_meta ) { return; } |
| 243 |
$user_roles = $user_meta->roles; |
| 244 |
|
| 245 |
if ( ! in_array("administrator", $user_roles) && ! in_array("editor", $user_roles) ) { |
| 246 |
return; |
| 247 |
} |
| 248 |
|
| 249 |
$save_fields = $this->get_user_meta_fields(); |
| 250 |
|
| 251 |
foreach ( $save_fields as $fieldset ) { |
| 252 |
|
| 253 |
foreach ( $fieldset['fields'] as $key => $field ) { |
| 254 |
|
| 255 |
if ( isset( $field['type'] ) && 'checkbox' === $field['type'] ) { |
| 256 |
update_user_meta( $user_id, $key, isset( $_POST[ $key ] ) ); |
| 257 |
} elseif ( isset( $_POST[ $key ] ) ) { |
| 258 |
if ( isset( $field['type'] ) && in_array( $field['type'], array( 'text', 'hidden', 'color', 'image', 'select' ), true ) && ! is_scalar( $_POST[ $key ] ) ) { |
| 259 |
continue; |
| 260 |
} |
| 261 |
// Metadata APIs expect slashed values; preserve literal backslashes after sanitizing. |
| 262 |
update_user_meta( $user_id, $key, wp_slash( ph_clean( wp_unslash( $_POST[ $key ] ) ) ) ); |
| 263 |
} |
| 264 |
} |
| 265 |
} |
| 266 |
} |
| 267 |
|
| 268 |
/** |
| 269 |
* Get user meta for a given key, with fallbacks to core user info for pre-existing fields. |
| 270 |
* |
| 271 |
* @param int $user_id User ID of the user being edited |
| 272 |
* @param string $key Key for user meta field |
| 273 |
* @return string |
| 274 |
*/ |
| 275 |
protected function get_user_meta( $user_id, $key ) { |
| 276 |
$value = get_user_meta( $user_id, $key, true ); |
| 277 |
|
| 278 |
return $value; |
| 279 |
} |
| 280 |
} |
| 281 |
|
| 282 |
endif; |
| 283 |
|
| 284 |
return new PH_Admin_Profile(); |
| 285 |
|
