validation.php — Secure Custom Fields 6.4.0-beta2

secure-custom-fields / includes / validation.php

secure-custom-fields / includes Last commit date

validation.php

354 lines

1	<?php
2
3	if ( ! defined( 'ABSPATH' ) ) {
4	exit; // Exit if accessed directly
5	}
6
7	if ( ! class_exists( 'acf_validation' ) ) :
8	#[AllowDynamicProperties]
9	class acf_validation {
10
11
12	/**
13	* This function will setup the class functionality
14	*
15	* @type function
16	* @date 5/03/2014
17	* @since 5.0.0
18	*
19	* @param n/a
20	* @return n/a
21	*/
22	function __construct() {
23
24	// vars
25	$this->errors = array();
26
27	// ajax
28	add_action( 'wp_ajax_acf/validate_save_post', array( $this, 'ajax_validate_save_post' ) );
29	add_action( 'wp_ajax_nopriv_acf/validate_save_post', array( $this, 'ajax_validate_save_post' ) );
30	add_action( 'acf/validate_save_post', array( $this, 'acf_validate_save_post' ), 5 );
31	}
32
33
34	/**
35	* This function will add an error message for a field
36	*
37	* @type function
38	* @date 25/11/2013
39	* @since 5.0.0
40	*
41	* @param $input (string) name attribute of DOM elmenet
42	* @param $message (string) error message
43	* @return $post_id (int)
44	*/
45	function add_error( $input, $message ) {
46
47	// add to array
48	$this->errors[] = array(
49	'input' => $input,
50	'message' => $message,
51	);
52	}
53
54
55	/**
56	* This function will return an error for a given input
57	*
58	* @type function
59	* @date 5/03/2016
60	* @since 5.3.2
61	*
62	* @param $input (string) name attribute of DOM elmenet
63	* @return (mixed)
64	*/
65	function get_error( $input ) {
66
67	// bail early if no errors
68	if ( empty( $this->errors ) ) {
69	return false;
70	}
71
72	// loop
73	foreach ( $this->errors as $error ) {
74	if ( $error['input'] === $input ) {
75	return $error;
76	}
77	}
78
79	// return
80	return false;
81	}
82
83
84	/**
85	* This function will return validation errors
86	*
87	* @type function
88	* @date 25/11/2013
89	* @since 5.0.0
90	*
91	* @param n/a
92	* @return (array\|boolean)
93	*/
94	function get_errors() {
95
96	// bail early if no errors
97	if ( empty( $this->errors ) ) {
98	return false;
99	}
100
101	// return
102	return $this->errors;
103	}
104
105
106	/**
107	* This function will remove all errors
108	*
109	* @type function
110	* @date 4/03/2016
111	* @since 5.3.2
112	*
113	* @param n/a
114	* @return n/a
115	*/
116	function reset_errors() {
117
118	$this->errors = array();
119	}
120
121	/**
122	* Validates $_POST data via AJAX prior to save.
123	*
124	* @since 5.0.9
125	*
126	* @return void
127	*/
128	public function ajax_validate_save_post() {
129	if ( ! acf_verify_ajax() ) {
130	wp_send_json_success(
131	array(
132	'valid' => 0,
133	'errors' => array(
134	array(
135	'input' => false,
136	'message' => __( 'ACF was unable to perform validation due to an invalid security nonce being provided.', 'acf' ),
137	),
138	),
139	)
140	);
141	}
142
143	$json = array(
144	'valid' => 1,
145	'errors' => 0,
146	);
147
148	if ( acf_validate_save_post() ) {
149	wp_send_json_success( $json );
150	}
151
152	$json['valid'] = 0;
153	$json['errors'] = acf_get_validation_errors();
154
155	wp_send_json_success( $json );
156	}
157
158	/**
159	* Loops over $_POST data and validates ACF values.
160	*
161	* @since 5.4.0
162	*/
163	public function acf_validate_save_post() {
164	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified elsewhere.
165	$post_type = acf_request_arg( 'post_type', false );
166	$screen = acf_request_arg( '_acf_screen', false );
167
168	if ( in_array( $screen, array( 'post_type', 'taxonomy', 'ui_options_page' ), true ) && in_array( $post_type, array( 'acf-post-type', 'acf-taxonomy', 'acf-ui-options-page' ), true ) ) {
169	acf_validate_internal_post_type_values( $post_type );
170	} elseif ( acf_request_arg( 'acf_ui_options_page' ) ) {
171	acf_validate_internal_post_type_values( 'acf-ui-options-page' );
172	} else {
173	// Bail early if no matching $_POST.
174	if ( empty( $_POST['acf'] ) ) {
175	return;
176	}
177
178	acf_validate_values( $_POST['acf'], 'acf' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
179	}
180	// phpcs:enable WordPress.Security.NonceVerification.Missing
181	}
182	}
183
184	// initialize
185	acf()->validation = new acf_validation();
186	endif; // class_exists check
187
188
189	/**
190	* Public functions
191	*
192	* alias of acf()->validation->function()
193	*
194	* @type function
195	* @date 6/10/13
196	* @since 5.0.0
197	*
198	* @param n/a
199	* @return n/a
200	*/
201	function acf_add_validation_error( $input, $message = '' ) {
202
203	return acf()->validation->add_error( $input, $message );
204	}
205
206	function acf_get_validation_errors() {
207
208	return acf()->validation->get_errors();
209	}
210
211	function acf_get_validation_error() {
212
213	return acf()->validation->get_error( $input );
214	}
215
216	function acf_reset_validation_errors() {
217
218	return acf()->validation->reset_errors();
219	}
220
221
222	/**
223	* This function will validate $_POST data and add errors
224	*
225	* @type function
226	* @date 25/11/2013
227	* @since 5.0.0
228	*
229	* @param $show_errors (boolean) if true, errors will be shown via a wp_die screen
230	* @return (boolean)
231	*/
232	function acf_validate_save_post( $show_errors = false ) {
233
234	// action
235	do_action( 'acf/validate_save_post' );
236
237	// vars
238	$errors = acf_get_validation_errors();
239
240	// bail early if no errors
241	if ( ! $errors ) {
242	return true;
243	}
244
245	// show errors
246	if ( $show_errors ) {
247	$message = '<h2>' . __( 'Validation failed', 'acf' ) . '</h2>';
248	$message .= '<ul>';
249	foreach ( $errors as $error ) {
250	$message .= '<li>' . $error['message'] . '</li>';
251	}
252	$message .= '</ul>';
253
254	// die
255	wp_die( acf_esc_html( $message ), esc_html__( 'Validation failed', 'acf' ) );
256	}
257
258	// return
259	return false;
260	}
261
262
263	/**
264	* This function will validate an array of field values
265	*
266	* @type function
267	* @date 6/10/13
268	* @since 5.0.0
269	*
270	* @param values (array)
271	* @param $input_prefix (string)
272	* @return n/a
273	*/
274	function acf_validate_values( $values, $input_prefix = '' ) {
275
276	// bail early if empty
277	if ( empty( $values ) ) {
278	return;
279	}
280
281	// loop
282	foreach ( $values as $key => $value ) {
283
284	// vars
285	$field = acf_get_field( $key );
286	$input = $input_prefix . '[' . $key . ']';
287
288	// bail early if not found
289	if ( ! $field ) {
290	continue;
291	}
292
293	// validate
294	acf_validate_value( $value, $field, $input );
295	}
296	}
297
298
299	/**
300	* This function will validate a field's value
301	*
302	* @type function
303	* @date 6/10/13
304	* @since 5.0.0
305	*
306	* @param n/a
307	* @return n/a
308	*/
309	function acf_validate_value( $value, $field, $input ) {
310
311	// vars
312	$valid = true;
313	$message = sprintf( __( '%s value is required', 'acf' ), $field['label'] );
314
315	// valid
316	if ( $field['required'] ) {
317
318	// valid is set to false if the value is empty, but allow 0 as a valid value
319	if ( empty( $value ) && ! is_numeric( $value ) ) {
320	$valid = false;
321	}
322	}
323
324	/**
325	* Filters whether the value is valid.
326	*
327	* @date 28/09/13
328	* @since 5.0.0
329	*
330	* @param bool $valid The valid status. Return a string to display a custom error message.
331	* @param mixed $value The value.
332	* @param array $field The field array.
333	* @param string $input The input element's name attribute.
334	*/
335	$valid = apply_filters( "acf/validate_value/type={$field['type']}", $valid, $value, $field, $input );
336	$valid = apply_filters( "acf/validate_value/name={$field['_name']}", $valid, $value, $field, $input );
337	$valid = apply_filters( "acf/validate_value/key={$field['key']}", $valid, $value, $field, $input );
338	$valid = apply_filters( 'acf/validate_value', $valid, $value, $field, $input );
339
340	// allow $valid to be a custom error message
341	if ( ! empty( $valid ) && is_string( $valid ) ) {
342	$message = $valid;
343	$valid = false;
344	}
345
346	if ( ! $valid ) {
347	acf_add_validation_error( $input, $message );
348	return false;
349	}
350
351	// return
352	return true;
353	}
354