acf-input-functions.php — Secure Custom Fields 6.5.7

secure-custom-fields / includes / acf-input-functions.php

secure-custom-fields / includes Last commit date

acf-input-functions.php

532 lines

1	<?php
2
3	/**
4	* acf_filter_attrs
5	*
6	* Filters out empty attrs from the provided array.
7	*
8	* @date 11/6/19
9	* @since ACF 5.8.1
10	*
11	* @param array $attrs The array of attrs.
12	* @return array
13	*/
14	function acf_filter_attrs( $attrs ) {
15
16	// Filter out empty attrs but allow "0" values.
17	$filtered = array_filter( $attrs, 'acf_not_empty' );
18
19	// Correct specific attributes (required="required").
20	foreach ( array( 'required', 'readonly', 'disabled', 'multiple' ) as $key ) {
21	unset( $filtered[ $key ] );
22	if ( ! empty( $attrs[ $key ] ) ) {
23	$filtered[ $key ] = $key;
24	}
25	}
26	return $filtered;
27	}
28
29	/**
30	* acf_esc_attrs
31	*
32	* Generated valid HTML from an array of attrs.
33	*
34	* @date 11/6/19
35	* @since ACF 5.8.1
36	*
37	* @param array $attrs The array of attrs.
38	* @return string
39	*/
40	function acf_esc_attrs( $attrs ) {
41	$html = '';
42
43	// Loop over attrs and validate data types.
44	foreach ( $attrs as $k => $v ) {
45
46	// String (but don't trim value).
47	if ( is_string( $v ) && ( $k !== 'value' ) ) {
48	$v = trim( $v );
49
50	// Boolean
51	} elseif ( is_bool( $v ) ) {
52	$v = $v ? 1 : 0;
53
54	// Object
55	} elseif ( is_array( $v ) \|\| is_object( $v ) ) {
56	$v = json_encode( $v );
57	}
58
59	// Generate HTML.
60	$html .= sprintf( ' %s="%s"', esc_attr( $k ), esc_attr( $v ) );
61	}
62
63	// Return trimmed.
64	return trim( $html );
65	}
66
67
68	/**
69	* Sanitizes text content and strips out disallowed HTML.
70	*
71	* This function emulates `wp_kses_post()` with a context of "acf" for extensibility.
72	*
73	* @since ACF 5.9.6
74	*
75	* @param string $string The string to be escaped
76	* @return string\|false
77	*/
78	function acf_esc_html( $string = '' ) {
79
80	if ( ! is_scalar( $string ) ) {
81	return false;
82	}
83
84	return wp_kses( (string) $string, 'acf' );
85	}
86
87	/**
88	* Private callback for the "wp_kses_allowed_html" filter used to return allowed HTML for "acf" context.
89	*
90	* @since ACF 5.9.6
91	*
92	* @param array $tags An array of allowed tags.
93	* @param string $context The context name.
94	* @return array
95	*/
96	function _acf_kses_allowed_html( $tags, $context ) {
97	global $allowedposttags;
98
99	if ( $context === 'acf' ) {
100	return $allowedposttags;
101	}
102	return $tags;
103	}
104
105	add_filter( 'wp_kses_allowed_html', '_acf_kses_allowed_html', 0, 2 );
106
107	/**
108	* acf_html_input
109	*
110	* Returns the HTML of an input.
111	*
112	* @date 13/6/19
113	* @since ACF 5.8.1
114	*
115	* @param array $attrs The array of attrs.
116	* @return string
117	*/
118	// function acf_html_input( $attrs = array() ) {
119	// return sprintf( '<input %s/>', acf_esc_attrs($attrs) );
120	// }
121
122	/**
123	* acf_hidden_input
124	*
125	* Renders the HTML of a hidden input.
126	*
127	* @date 3/02/2014
128	* @since ACF 5.0.0
129	*
130	* @param array $attrs The array of attrs.
131	* @return void echos out value.
132	*/
133	function acf_hidden_input( $attrs = array() ) {
134	echo acf_get_hidden_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
135	}
136
137	/**
138	* acf_get_hidden_input
139	*
140	* Returns the HTML of a hidden input.
141	*
142	* @date 3/02/2014
143	* @since ACF 5.0.0
144	*
145	* @param array $attrs The array of attrs.
146	* @return string
147	*/
148	function acf_get_hidden_input( $attrs = array() ) {
149	return sprintf( '<input type="hidden" %s/>', acf_esc_attrs( $attrs ) );
150	}
151
152	/**
153	* acf_text_input
154	*
155	* Renders the HTML of a text input.
156	*
157	* @date 3/02/2014
158	* @since ACF 5.0.0
159	*
160	* @param array $attrs The array of attrs.
161	* @return void echos out value.
162	*/
163	function acf_text_input( $attrs = array() ) {
164	echo acf_get_text_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
165	}
166
167	/**
168	* acf_get_text_input
169	*
170	* Returns the HTML of a text input.
171	*
172	* @date 3/02/2014
173	* @since ACF 5.0.0
174	*
175	* @param array $attrs The array of attrs.
176	* @return string
177	*/
178	function acf_get_text_input( $attrs = array() ) {
179	$attrs = wp_parse_args(
180	$attrs,
181	array(
182	'type' => 'text',
183	)
184	);
185	if ( isset( $attrs['value'] ) && is_string( $attrs['value'] ) ) {
186	$attrs['value'] = htmlspecialchars( $attrs['value'] );
187	}
188	return sprintf( '<input %s/>', acf_esc_attrs( $attrs ) );
189	}
190
191	/**
192	* acf_file_input
193	*
194	* Renders the HTML of a file input.
195	*
196	* @date 3/02/2014
197	* @since ACF 5.0.0
198	*
199	* @param array $attrs The array of attrs.
200	* @return void echos out value.
201	*/
202	function acf_file_input( $attrs = array() ) {
203	echo acf_get_file_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
204	}
205
206	/**
207	* acf_get_file_input
208	*
209	* Returns the HTML of a file input.
210	*
211	* @date 3/02/2014
212	* @since ACF 5.0.0
213	*
214	* @param array $attrs The array of attrs.
215	* @return string
216	*/
217	function acf_get_file_input( $attrs = array() ) {
218	$field_key = isset( $attrs['key'] ) && is_string( $attrs['key'] ) ? $attrs['key'] : '';
219	$nonce_field = '';
220
221	/**
222	* If we don't have a field key (most likely because this was called by a third-party field),
223	* we have to try to guess the field key based on the field name.
224	*/
225	if ( '' === $field_key ) {
226	$parts = explode( '[', $attrs['name'] );
227	if ( is_array( $parts ) && ! empty( $parts[1] ) ) {
228	// Remove the trailing `]`.
229	$field_key = substr( end( $parts ), 0, -1 );
230	}
231	}
232
233	/**
234	* We only output the nonce if we have a field key, as it's possible to render
235	* the file input without a real field. But, basic uploaders that don't have any
236	* custom logic will likely fail to upload anyway if they don't have a field key.
237	*/
238	if ( '' !== $field_key ) {
239	$nonce_attrs = array(
240	'name' => 'acf[' . $field_key . '_file_nonce]',
241	'value' => wp_create_nonce( 'acf/file_uploader_nonce/' . $field_key ),
242	);
243	$nonce_field = sprintf(
244	'<input type="hidden" %s />',
245	acf_esc_attrs( $nonce_attrs )
246	);
247	}
248
249	return sprintf(
250	'<input type="file" %1$s />%2$s',
251	acf_esc_attrs( $attrs ),
252	$nonce_field
253	);
254	}
255
256	/**
257	* acf_textarea_input
258	*
259	* Renders the HTML of a textarea input.
260	*
261	* @date 3/02/2014
262	* @since ACF 5.0.0
263	*
264	* @param array $attrs The array of attrs.
265	* @return void echos out value.
266	*/
267	function acf_textarea_input( $attrs = array() ) {
268	echo acf_get_textarea_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
269	}
270
271	/**
272	* acf_get_textarea_input
273	*
274	* Returns the HTML of a textarea input.
275	*
276	* @date 3/02/2014
277	* @since ACF 5.0.0
278	*
279	* @param array $attrs The array of attrs.
280	* @return string
281	*/
282	function acf_get_textarea_input( $attrs = array() ) {
283	$value = '';
284	if ( isset( $attrs['value'] ) ) {
285	$value = $attrs['value'];
286	unset( $attrs['value'] );
287	}
288	return sprintf( '<textarea %s>%s</textarea>', acf_esc_attrs( $attrs ), esc_textarea( $value ) );
289	}
290
291	/**
292	* acf_checkbox_input
293	*
294	* Renders the HTML of a checkbox input.
295	*
296	* @date 3/02/2014
297	* @since ACF 5.0.0
298	*
299	* @param array $attrs The array of attrs.
300	* @return void echos out value.
301	*/
302	function acf_checkbox_input( $attrs = array() ) {
303	echo acf_get_checkbox_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
304	}
305
306	/**
307	* acf_get_checkbox_input
308	*
309	* Returns the HTML of a checkbox input.
310	*
311	* @date 3/02/2014
312	* @since ACF 5.0.0
313	*
314	* @param array $attrs The array of attrs.
315	* @return string
316	*/
317	function acf_get_checkbox_input( $attrs = array() ) {
318
319	// Allow radio or checkbox type.
320	$attrs = wp_parse_args(
321	$attrs,
322	array(
323	'type' => 'checkbox',
324	)
325	);
326
327	// Get label.
328	$label = '';
329	if ( isset( $attrs['label'] ) ) {
330	$label = $attrs['label'];
331	unset( $attrs['label'] );
332	}
333
334	// Render.
335	$checked = isset( $attrs['checked'] );
336	return '<label' . ( $checked ? ' class="selected"' : '' ) . '><input ' . acf_esc_attrs( $attrs ) . '/> ' . acf_esc_html( $label ) . '</label>';
337	}
338
339	/**
340	* acf_radio_input
341	*
342	* Renders the HTML of a radio input.
343	*
344	* @date 3/02/2014
345	* @since ACF 5.0.0
346	*
347	* @param array $attrs The array of attrs.
348	* @return void echos out value.
349	*/
350	function acf_radio_input( $attrs = array() ) {
351	echo acf_get_radio_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
352	}
353
354	/**
355	* acf_get_radio_input
356	*
357	* Returns the HTML of a radio input.
358	*
359	* @date 3/02/2014
360	* @since ACF 5.0.0
361	*
362	* @param array $attrs The array of attrs.
363	* @return string
364	*/
365	function acf_get_radio_input( $attrs = array() ) {
366	$attrs['type'] = 'radio';
367	return acf_get_checkbox_input( $attrs );
368	}
369
370	/**
371	* acf_select_input
372	*
373	* Renders the HTML of a select input.
374	*
375	* @date 3/02/2014
376	* @since ACF 5.0.0
377	*
378	* @param array $attrs The array of attrs.
379	* @return void
380	*/
381	function acf_select_input( $attrs = array() ) {
382	echo acf_get_select_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
383	}
384
385	/**
386	* acf_select_input
387	*
388	* Returns the HTML of a select input.
389	*
390	* @date 3/02/2014
391	* @since ACF 5.0.0
392	*
393	* @param array $attrs The array of attrs.
394	* @return string
395	*/
396	function acf_get_select_input( $attrs = array() ) {
397	$value = (array) acf_extract_var( $attrs, 'value' );
398	$choices = (array) acf_extract_var( $attrs, 'choices' );
399	return sprintf(
400	'<select %s>%s</select>',
401	acf_esc_attrs( $attrs ),
402	acf_walk_select_input( $choices, $value )
403	);
404	}
405
406	/**
407	* acf_walk_select_input
408	*
409	* Returns the HTML of a select input's choices.
410	*
411	* @date 27/6/17
412	* @since ACF 5.6.0
413	*
414	* @param array $choices The choices to walk through.
415	* @param array $values The selected choices.
416	* @param array $depth The current walk depth.
417	* @return string
418	*/
419	function acf_walk_select_input( $choices = array(), $values = array(), $depth = 0 ) {
420	$html = '';
421
422	// Sanitize values for 'selected' matching (only once).
423	if ( $depth == 0 ) {
424	$values = array_map( 'esc_attr', $values );
425	}
426
427	// Loop over choices and append to html.
428	if ( $choices ) {
429	foreach ( $choices as $value => $label ) {
430
431	// Multiple (optgroup)
432	if ( is_array( $label ) ) {
433	$html .= sprintf(
434	'<optgroup label="%s">%s</optgroup>',
435	esc_attr( $value ),
436	acf_walk_select_input( $label, $values, $depth + 1 )
437	);
438
439	// single (option)
440	} else {
441	$attrs = array(
442	'value' => $value,
443	);
444
445	// If is selected.
446	$pos = array_search( esc_attr( $value ), $values );
447	if ( $pos !== false ) {
448	$attrs['selected'] = 'selected';
449	$attrs['data-i'] = $pos;
450	}
451	$html .= sprintf( '<option %s>%s</option>', acf_esc_attrs( $attrs ), esc_html( $label ) );
452	}
453	}
454	}
455	return $html;
456	}
457
458	/**
459	* acf_clean_atts
460	*
461	* See acf_filter_attrs().
462	*
463	* @date 3/10/17
464	* @since ACF 5.6.3
465	*
466	* @param array $attrs The array of attrs.
467	* @return string
468	*/
469	function acf_clean_atts( $attrs ) {
470	return acf_filter_attrs( $attrs );
471	}
472
473	/**
474	* acf_esc_atts
475	*
476	* See acf_esc_attrs().
477	*
478	* @date 27/6/17
479	* @since ACF 5.6.0
480	*
481	* @param array $attrs The array of attrs.
482	* @return string
483	*/
484	function acf_esc_atts( $attrs ) {
485	return acf_esc_attrs( $attrs );
486	}
487
488	/**
489	* acf_esc_attr
490	*
491	* @date 13/6/19
492	* @since ACF 5.8.1
493	* @deprecated 5.6.0
494	* @see acf_esc_attrs().
495	*
496	* @param array $attrs The array of attrs.
497	* @return string
498	*/
499	function acf_esc_attr( $attrs ) {
500	return acf_esc_attrs( $attrs );
501	}
502
503	/**
504	* acf_esc_attr_e
505	*
506	* See acf_esc_attrs().
507	*
508	* @date 13/6/19
509	* @since ACF 5.8.1
510	* @deprecated 5.6.0
511	*
512	* @param array $attrs The array of attrs.
513	*/
514	function acf_esc_attr_e( $attrs ) {
515	echo acf_esc_attrs( $attrs );
516	}
517
518	/**
519	* acf_esc_atts_e
520	*
521	* See acf_esc_attrs().
522	*
523	* @date 13/6/19
524	* @since ACF 5.8.1
525	* @deprecated 5.6.0
526	*
527	* @param array $attrs The array of attrs.
528	*/
529	function acf_esc_atts_e( $attrs ) {
530	echo acf_esc_attrs( $attrs );
531	}
532