acf-form-functions.php — Secure Custom Fields 6.9.1

secure-custom-fields / includes / acf-form-functions.php

secure-custom-fields / includes Last commit date

acf-form-functions.php

171 lines

1	<?php
2
3	// Register store for form data.
4	acf_register_store( 'form' );
5
6	/**
7	* acf_set_form_data
8	*
9	* Sets data about the current form.
10	*
11	* @date 6/10/13
12	* @since ACF 5.0.0
13	*
14	* @param string $name The store name.
15	* @param array $data Array of data to start the store with.
16	* @return ACF_Data
17	*/
18	function acf_set_form_data( $name = '', $data = false ) {
19	return acf_get_store( 'form' )->set( $name, $data );
20	}
21
22	/**
23	* acf_get_form_data
24	*
25	* Gets data about the current form.
26	*
27	* @date 6/10/13
28	* @since ACF 5.0.0
29	*
30	* @param string $name The store name.
31	* @return mixed
32	*/
33	function acf_get_form_data( $name = '' ) {
34	return acf_get_store( 'form' )->get( $name );
35	}
36
37	/**
38	* acf_form_data
39	*
40	* Called within a form to set important information and render hidden inputs.
41	*
42	* @date 15/10/13
43	* @since ACF 5.0.0
44	*
45	* @return void
46	*/
47	function acf_form_data( $data = array() ) {
48
49	// Apply defaults.
50	$data = wp_parse_args(
51	$data,
52	array(
53
54	/** @type string The current screen (post, user, taxonomy, etc). */
55	'screen' => 'post',
56
57	/** @type int\|string The ID of current post being edited. */
58	'post_id' => 0,
59
60	/** @type bool Enables AJAX validation. */
61	'validation' => true,
62	)
63	);
64
65	// Create nonce using screen.
66	$data['nonce'] = wp_create_nonce( $data['screen'] );
67
68	// Append "changed" input used within "_wp_post_revision_fields" action.
69	$data['changed'] = 0;
70
71	// Set data.
72	acf_set_form_data( $data );
73
74	// Render HTML.
75	?>
76	<div id="acf-form-data" class="acf-hidden">
77	<?php
78
79	// Create hidden inputs from $data
80	foreach ( $data as $name => $value ) {
81	acf_hidden_input(
82	array(
83	'id' => '_acf_' . $name,
84	'name' => '_acf_' . $name,
85	'value' => $value,
86	)
87	);
88	}
89
90	/**
91	* Fires within the #acf-form-data element to add extra HTML.
92	*
93	* @date 15/10/13
94	* @since ACF 5.0.0
95	*
96	* @param array $data The form data.
97	*/
98	do_action( 'acf/form_data', $data );
99	do_action( 'acf/input/form_data', $data );
100
101	?>
102	</div>
103	<?php
104	}
105
106
107	/**
108	* acf_save_post
109	*
110	* Saves the $_POST data.
111	*
112	* @date 15/10/13
113	* @since ACF 5.0.0
114	*
115	* @param integer\|string $post_id The post id.
116	* @param array $values An array of values to override $_POST.
117	* @return boolean True if save was successful.
118	*/
119	function acf_save_post( $post_id = 0, $values = null ) {
120
121	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified elsewhere.
122	// Override $_POST data with $values.
123	if ( $values !== null ) {
124	$_POST['acf'] = $values;
125	}
126
127	// Bail early if no data to save.
128	if ( empty( $_POST['acf'] ) ) {
129	return false;
130	}
131
132	// Set form data (useful in various filters/actions).
133	acf_set_form_data( 'post_id', $post_id );
134
135	// Filter $_POST data for users without the 'unfiltered_html' capability.
136	if ( ! acf_allow_unfiltered_html() ) {
137	$_POST['acf'] = wp_kses_post_deep( $_POST['acf'] );
138	}
139	// phpcs:enable WordPress.Security.NonceVerification.Missing
140
141	// Do generic action.
142	do_action( 'acf/save_post', $post_id );
143
144	// Return true.
145	return true;
146	}
147
148	/**
149	* _acf_do_save_post
150	*
151	* Private function hooked into 'acf/save_post' to actually save the $_POST data.
152	* This allows developers to hook in before and after ACF has actually saved the data.
153	*
154	* @date 11/1/19
155	* @since ACF 5.7.10
156	*
157	* @param integer\|string $post_id The post id.
158	* @return void
159	*/
160	function _acf_do_save_post( $post_id = 0 ) {
161
162	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified elsewhere.
163	if ( ! empty( $_POST['acf'] ) ) {
164	acf_update_values( $_POST['acf'], $post_id ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized by WP when saved.
165	}
166	// phpcs:enable WordPress.Security.NonceVerification.Missing
167	}
168
169	// Run during generic action.
170	add_action( 'acf/save_post', '_acf_do_save_post' );
171