class-strong-form.php — Strong Testimonials 2.38

strong-testimonials / includes / class-strong-form.php

strong-testimonials / includes Last commit date

class-strong-form.php

662 lines

1	<?php
2	/**
3	* Class Strong_Testimonials_Form
4	*/
5	class Strong_Testimonials_Form {
6
7	public $form_options;
8
9	public $plugins;
10
11	public $form_values;
12
13	public $form_errors;
14
15	public $captcha;
16
17	/**
18	* Strong_Testimonials_Form constructor.
19	*/
20	public function __construct() {
21	$this->form_options = get_option( 'wpmtst_form_options' );
22	$this->plugins = apply_filters( 'wpmtst_captcha_plugins', get_option( 'wpmtst_captcha_plugins' ) );
23	$this->add_actions();
24	$this->load_captcha();
25	$this->load_honeypots();
26	}
27
28	/**
29	* Add our actions.
30	*/
31	public function add_actions() {
32	add_action( 'init', array( $this, 'process_form' ), 20 );
33
34	add_action( 'wp_ajax_wpmtst_form2', array( $this, 'process_form_ajax' ) );
35	add_action( 'wp_ajax_nopriv_wpmtst_form2', array( $this, 'process_form_ajax' ) );
36	}
37
38	/**
39	* Load Captcha class.
40	*/
41	public function load_captcha() {
42	if ( ! isset( $this->form_options['captcha'] ) \|\| ! $this->form_options['captcha'] ) {
43	return;
44	}
45
46	$slug = $this->form_options['captcha'];
47	if ( ! $slug \|\| ! isset( $this->plugins[ $slug ]['class'] ) ) {
48	return;
49	}
50
51	require_once WPMTST_INC . 'integrations/class-integration-captcha.php';
52
53	$file_name = "class-integration-$slug.php";
54	$file_path = WPMTST_INC . 'integrations/' . $file_name;
55	$class_name = 'Strong_Testimonials_Integration_' . $this->plugins[ $slug ]['class'];
56
57	if ( file_exists( $file_path ) ) {
58	require_once $file_path;
59	}
60
61	if ( class_exists( $class_name ) ) {
62	$this->captcha = new $class_name();
63	add_filter( 'wpmtst_add_captcha', array( $this->captcha, 'add_captcha' ), 20 );
64	add_filter( 'wpmtst_check_captcha', array( $this->captcha, 'check_captcha' ) );
65	}
66
67	}
68
69	/**
70	* Load honeypots.
71	*/
72	public function load_honeypots() {
73	if ( isset( $this->form_options['honeypot_before'] ) && $this->form_options['honeypot_before'] ) {
74	add_action( 'honeypot_before_spam_testimonial', array( $this, 'honeypot_error' ) );
75	}
76
77	if ( isset( $this->form_options['honeypot_after'] ) && $this->form_options['honeypot_after'] ) {
78	add_action( 'honeypot_after_spam_testimonial', array( $this, 'honeypot_error' ) );
79	}
80	}
81
82	/**
83	* Process a form.
84	* Moved to `init` hook for strong_testimonials_view() template function.
85	*
86	* @since 2.3.0
87	*/
88	public function process_form() {
89	if ( wp_doing_ajax() ) {
90	return;
91	}
92
93	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
94	$form_options = get_option( 'wpmtst_form_options' );
95	$success = $this->form_processor();
96	if ( $success ) {
97	switch ( $form_options['success_action'] ) {
98	case 'id':
99	$goback = get_permalink( $form_options['success_redirect_id'] );
100	break;
101	case 'url':
102	$goback = $form_options['success_redirect_url'];
103	break;
104	default:
105	// For non-Ajax forms, the only ways to store the state (successful form submission)
106	// are a query parameter or a cookie.
107	$goback = add_query_arg( 'success', '', wp_get_referer() );
108	}
109	wp_redirect( apply_filters( 'wpmtst_form_redirect_url', $goback ) );
110	exit;
111	}
112	}
113	}
114
115	/**
116	* Ajax form submission handler
117	*/
118	public function process_form_ajax() {
119	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
120	$success = $this->form_processor();
121	if ( $success ) {
122	$return = array(
123	'success' => true,
124	'message' => wpmtst_get_success_message(),
125	);
126	} else {
127	$return = array(
128	'success' => false,
129	'errors' => $this->get_form_errors()
130	);
131	}
132	echo json_encode( $return );
133	}
134
135	wp_die();
136	}
137
138	/**
139	* Store form values.
140	*
141	* @param $form_values
142	*/
143	public function set_form_values( $form_values ) {
144	$this->form_values = $form_values;
145	}
146
147	/**
148	* Return form values.
149	*
150	* @return mixed
151	*/
152	public function get_form_values() {
153	return $this->form_values;
154	}
155
156	/**
157	* Store from errors.
158	*
159	* @param $form_errors
160	*/
161	public function set_form_errors( $form_errors ) {
162	$this->form_errors = $form_errors;
163	}
164
165	/**
166	* Return form errors.
167	*
168	* @return mixed
169	*/
170	public function get_form_errors() {
171	return $this->form_errors;
172	}
173
174	/**
175	* Testimonial form processor.
176	*
177	* @since 1.21.0
178	*/
179	public function form_processor() {
180
181	if ( empty( $_POST ) \|\| ! wp_verify_nonce( $_POST['wpmtst_form_nonce'], 'wpmtst_form_action' ) ) {
182	return false;
183	}
184
185	do_action( 'wpmtst_form_submission' );
186
187	$new_post = stripslashes_deep( $_POST );
188	/**
189	* Trim spaces
190	* @since 2.26.6
191	*/
192	$new_post = wpmtst_trim_array( $new_post );
193
194	add_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
195
196	$form_options = get_option( 'wpmtst_form_options' );
197
198	// Init four arrays: post, post_meta, categories, attachment(s).
199	$testimonial_post = array(
200	'post_status' => $form_options['post_status'],
201	'post_type' => 'wpm-testimonial'
202	);
203	$testimonial_meta = array();
204	$testimonial_cats = array();
205	$testimonial_att = array();
206
207	$form_errors = array();
208
209	// TODO This use of 'custom' is obsolete. The default form is simply the first one in the array.
210	$form_name = isset( $new_post['form_id'] ) ? $new_post['form_id'] : 'custom';
211	$fields = wpmtst_get_form_fields( $form_name );
212
213	if ( $form_options['captcha'] ) {
214	$form_errors = apply_filters( 'wpmtst_check_captcha', $form_errors );
215	}
216
217	if ( $form_options['honeypot_before'] ) {
218	$this->honeypot_before();
219	}
220
221	if ( $form_options['honeypot_after'] ) {
222	$this->honeypot_after();
223	}
224
225	/**
226	* sanitize & validate
227	*/
228	foreach ( $fields as $key => $field ) {
229
230	if ( isset( $field['required'] ) && $field['required'] ) {
231	if ( ( 'file' == $field['input_type'] ) ) {
232	if ( ! isset( $_FILES[ $field['name'] ] ) \|\| ! $_FILES[ $field['name'] ]['size'] ) {
233	$form_errors[ $field['name'] ] = $field['error'];
234	continue;
235	}
236	} elseif ( empty( $new_post[ $field['name'] ] ) ) {
237	$form_errors[ $field['name'] ] = $field['error'];
238	continue;
239	}
240	}
241
242	// Check for callback first.
243	if ( isset( $field['action_input'] ) && $field['action_input'] ) {
244	// Assuming value can be stored as text field
245	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
246	// TODO Register a validator callback
247	}
248	else {
249	switch ( $field['record_type'] ) {
250	case 'post':
251	if ( 'file' == $field['input_type'] ) {
252	$testimonial_att[ $field['name'] ] = array( 'field' => isset( $field['map'] ) ? $field['map'] : 'post' );
253	} elseif ( 'textarea' == $field['input_type'] ) {
254	$testimonial_post[ $field['name'] ] = wpmtst_sanitize_textarea( $new_post[ $field['name'] ] );
255	} else {
256	$testimonial_post[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
257	}
258	break;
259
260	case 'custom':
261	if ( 'email' == $field['input_type'] && $new_post[ $field['name'] ] ) {
262	if ( is_email( $new_post[ $field['name'] ] ) ) {
263	$testimonial_meta[ $field['name'] ] = sanitize_email( $new_post[ $field['name'] ] );
264	}
265	else {
266	$form_errors[ $field['name'] ] = $field['error'];
267	}
268	} elseif ( 'url' == $field['input_type'] ) {
269	// wpmtst_get_website() will prefix with "http://" so don't add that to an empty input
270	if ( $new_post[ $field['name'] ] ) {
271	$testimonial_meta[ $field['name'] ] = esc_url_raw( wpmtst_get_website( $new_post[ $field['name'] ] ) );
272	}
273	} elseif ( 'textarea' == $field['input_type'] ) {
274	$testimonial_post[ $field['name'] ] = wpmtst_sanitize_textarea( $new_post[ $field['name'] ] );
275	} elseif ( 'checkbox' == $field['input_type'] ) {
276	$testimonial_meta[ $field['name'] ] = wpmtst_sanitize_checkbox( $new_post, $field['name'] );
277	} else {
278	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
279	}
280	break;
281
282	case 'optional':
283	if ( 'category' == strtok( $field['input_type'], '-' ) ) {
284	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
285	}
286	elseif ( 'rating' == $field['input_type'] ) {
287	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
288	}
289	else {
290	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
291	}
292	break;
293
294	default:
295	}
296	}
297
298	}
299
300	/**
301	* No missing required fields, carry on.
302	*/
303	if ( ! count( $form_errors ) ) {
304
305	// Special handling: if post_title is not required, create one from post_content
306	if ( ! isset( $testimonial_post['post_title'] ) \|\| ! $testimonial_post['post_title'] ) {
307	$words_array = explode( ' ', $testimonial_post['post_content'] );
308	$five_words = array_slice( $words_array, 0, 5 );
309	$testimonial_post['post_title'] = implode( ' ', $five_words );
310	}
311
312	/**
313	* Validate image attachments and store WP error messages.
314	*/
315	/*
316	* $_FILES = Array
317	* (
318	* [featured_image] => Array
319	* (
320	* [name] => Screenshot.png
321	* [type] => image/png
322	* [tmp_name] => C:\wamp64\tmp\php7EA4.tmp
323	* [error] => 0
324	* [size] => 615273
325	* )
326	* )
327	*/
328	foreach ( $testimonial_att as $name => $atts ) {
329	if ( isset( $_FILES[ $name ] ) && $_FILES[ $name ]['size'] > 1 ) {
330	$file = $_FILES[ $name ];
331
332	// Upload file
333	$overrides = array( 'test_form' => false );
334	$uploaded_file = $this->handle_upload( $file, $overrides );
335	/*
336	* $uploaded_file = Array
337	* (
338	* [file] => string 'M:\wp\strong\site/wp-content/uploads/Lotus8.jpg'
339	* [url] => string 'http://strong.dev/wp-content/uploads/Lotus8.jpg'
340	* [type] => string 'image/jpeg'
341	* )
342	*/
343	if ( isset( $uploaded_file['error'] ) ) {
344	$form_errors[ $name ] = $uploaded_file['error'];
345	break;
346	} else {
347	// Create an attachment
348	$attachment = array(
349	'post_title' => $file['name'],
350	'post_content' => '',
351	'post_type' => 'attachment',
352	'post_parent' => null, // populated after inserting post
353	'post_mime_type' => $file['type'],
354	'guid' => $uploaded_file['url']
355	);
356
357	$testimonial_att[ $name ]['attachment'] = $attachment;
358	$testimonial_att[ $name ]['uploaded_file'] = $uploaded_file;
359	}
360
361	}
362	}
363	}
364
365	/**
366	* No faulty uploads, carry on.
367	*/
368	if ( ! count( $form_errors ) ) {
369
370	// create new testimonial post
371	$testimonial_id = wp_insert_post( apply_filters( 'wpmtst_new_testimonial_post', $testimonial_post ) );
372
373	if ( is_wp_error( $testimonial_id ) ) {
374
375	// TODO report errors in admin
376	$form_errors['post'] = $form_options['messages']['submission-error']['text'];
377
378	} else {
379
380	$testimonial_post['id'] = $testimonial_id;
381
382	/**
383	* Add categories.
384	*
385	* @since 2.17.0 Handle arrays (if using checklist) or strings (if using <select>).
386	* @since 2.19.1 Storing default category (as set in view) in separate hidden field.
387	*/
388
389	if ( $new_post['default_category'] ) {
390	$testimonial_cats = explode( ',', $new_post['default_category'] );
391	}
392
393	if ( $new_post['category'] ) {
394	if ( is_string( $new_post['category'] ) ) {
395	$new_post['category'] = explode( ',', $new_post['category'] );
396	}
397	$testimonial_cats = array_merge( $testimonial_cats, $new_post['category'] );
398	}
399
400	$testimonial_cats = array_map( 'intval', array_unique( $testimonial_cats ) );
401
402	if ( array_filter( $testimonial_cats ) ) {
403	$category_success = wp_set_object_terms( $testimonial_id, $testimonial_cats, 'wpm-testimonial-category' );
404
405	if ( ! $category_success ) {
406	// TODO improve error handling
407	}
408	}
409
410	// save submit date
411	$testimonial_meta['submit_date'] = current_time( 'mysql' );
412
413	/**
414	* Save custom fields.
415	*
416	* @since 2.17.0 Exclude categories.
417	*/
418	$new_meta = array_diff_key( $testimonial_meta, array( 'category' => '' ) );
419	$new_meta = apply_filters( 'wpmtst_new_testimonial_meta', $new_meta );
420	foreach ( $new_meta as $key => $field ) {
421	add_post_meta( $testimonial_id, $key, $field );
422	}
423
424	// save attachments
425	$testimonial_att = apply_filters( 'wpmtst_new_testimonial_attachments', $testimonial_att );
426	foreach ( $testimonial_att as $name => $atts ) {
427	if ( isset( $atts['attachment'] ) ) {
428	$atts['attachment']['post_parent'] = $testimonial_id;
429	$attach_id = wp_insert_attachment( $atts['attachment'], $atts['uploaded_file']['file'], $testimonial_id );
430	$attach_data = wp_generate_attachment_metadata( $attach_id, $atts['uploaded_file']['file'] );
431	$result = wp_update_attachment_metadata( $attach_id, $attach_data );
432	add_post_meta( $testimonial_id, $name, $atts['uploaded_file']['url'] );
433	if ( 'featured_image' == $atts['field'] ) {
434	set_post_thumbnail( $testimonial_id, $attach_id );
435	}
436	}
437	}
438
439	}
440
441	}
442
443	remove_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
444
445	/**
446	* Post inserted successfully, carry on.
447	*/
448	$form_values = array_merge( $testimonial_post, $testimonial_meta );
449
450	ksort( $testimonial_post );
451	ksort( $testimonial_meta );
452	do_action( 'wpmtst_new_testimonial_added', $testimonial_post, $testimonial_meta, $testimonial_cats, $testimonial_att );
453
454	if ( ! count( $form_errors ) ) {
455	// Clear saved form data and errors.
456	$this->set_form_values( null );
457	$this->set_form_errors( null );
458	$this->notify_admin( $form_values, $form_name );
459
460	return true;
461	}
462
463	// Redisplay form with submitted values and error messages.
464	$this->set_form_values( stripslashes_deep( $form_values ) );
465	$this->set_form_errors( $form_errors );
466
467	return false;
468	}
469
470	/**
471	* Honeypot preprocessor
472	*/
473	public function honeypot_before() {
474	if ( isset( $_POST['wpmtst_if_visitor'] ) && ! empty( $_POST['wpmtst_if_visitor'] ) ) {
475	do_action( 'honeypot_before_spam_testimonial', $_POST );
476	}
477	}
478
479	/**
480	* Honeypot preprocessor
481	*/
482	public function honeypot_after() {
483	if ( ! isset ( $_POST['wpmtst_after'] ) ) {
484	do_action( 'honeypot_after_spam_testimonial', $_POST );
485	}
486	}
487
488	/**
489	* Honeypot error
490	*/
491	public function honeypot_error() {
492	$form_options = get_option( 'wpmtst_form_options' );
493	$messages = $form_options['messages'];
494	$part = 'submission-error';
495	if ( isset( $messages[ $part ]['text'] ) ) {
496	$message = apply_filters( 'wpmtst_form_message', $messages['submission-error']['text'], $messages[ $part ] );
497	} else {
498	$message = __( 'Unknown error.', 'strong-testimonials' );
499	}
500	wp_die( $message );
501	}
502
503	/**
504	* Restrict MIME types for security reasons.
505	*
506	* @param $mimes
507	*
508	* @return array
509	*/
510	public function restrict_mime( $mimes ) {
511	$mimes = array(
512	'jpg\|jpeg\|jpe' => 'image/jpeg',
513	'gif' => 'image/gif',
514	'png' => 'image/png',
515	);
516
517	return $mimes;
518	}
519
520	/**
521	* File upload handler
522	*
523	* @param $file_handler
524	* @param $overrides
525	*
526	* @return array
527	*/
528	public function handle_upload( $file_handler, $overrides ) {
529	require_once( ABSPATH . 'wp-admin/includes/image.php' );
530	require_once( ABSPATH . 'wp-admin/includes/file.php' );
531	require_once( ABSPATH . 'wp-admin/includes/media.php' );
532
533	$upload = wp_handle_upload( $file_handler, $overrides );
534
535	return $upload;
536	}
537
538	/**
539	* Send notification email upon testimonial submission.
540	*
541	* @param array $post
542	* @param string $form_name
543	*
544	* @since 1.7.0
545	* @since 2.30.6 Using all form fields (Multiple Forms add-on).
546	* Adding submit_date.
547	* Trimming subject and message strings.
548	*/
549	public function notify_admin( $post, $form_name = 'custom' ) {
550	$form_options = get_option( 'wpmtst_form_options' );
551	if ( ! $form_options['admin_notify'] ) {
552	return;
553	}
554
555	$post['has_image'] = has_post_thumbnail( $post['id'] );
556	$fields = wpmtst_get_all_fields();
557
558	if ( $form_options['sender_site_email'] ) {
559	$sender_email = get_bloginfo( 'admin_email' );
560	}
561	else {
562	$sender_email = $form_options['sender_email'];
563	}
564
565	// Subject line
566	$subject = trim( $form_options['email_subject'] );
567	$subject = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $subject );
568	$subject = str_replace( '%TITLE%', $post['post_title'], $subject );
569	$subject = str_replace( '%STATUS%', $post['post_status'], $subject );
570	$subject = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $subject );
571	$subject = $this->replace_custom_fields( $subject, $fields, $post );
572
573	// Message text
574	$message = rtrim( $form_options['email_message'] );
575	$message = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $message );
576	$message = str_replace( '%TITLE%', $post['post_title'], $message );
577	$message = str_replace( '%CONTENT%', $post['post_content'], $message );
578	$message = str_replace( '%STATUS%', $post['post_status'], $message );
579	$message = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $message );
580	$message = $this->replace_custom_fields( $message, $fields, $post );
581
582	foreach ( $form_options['recipients'] as $recipient ) {
583
584	if ( isset( $recipient['admin_site_email'] ) && $recipient['admin_site_email'] ) {
585	$admin_email = get_bloginfo( 'admin_email' );
586	}
587	else {
588	$admin_email = $recipient['admin_email'];
589	}
590
591	// Mandrill rejects the 'name <email>' format
592	if ( $recipient['admin_name'] && ! $form_options['mail_queue'] ) {
593	$to = sprintf( '%s <%s>', $recipient['admin_name'], $admin_email );
594	}
595	else {
596	$to = sprintf( '%s', $admin_email );
597	}
598
599	// Headers
600	$headers = 'MIME-Version: 1.0' . "\n";
601	$headers .= 'Content-Type: text/plain; charset="' . get_option( 'blog_charset' ) . '"' . "\n";
602	if ( $form_options['sender_name'] ) {
603	$headers .= sprintf( 'From: %s <%s>', $form_options['sender_name'], $sender_email ) . "\n";
604	}
605	else {
606	$headers .= sprintf( 'From: %s', $sender_email ) . "\n";
607	}
608
609	$email = array( 'to' => $to, 'subject' => $subject, 'message' => $message, 'headers' => $headers );
610
611	if ( $form_options['mail_queue'] ) {
612	WPMST()->mail->enqueue_mail( $email );
613	}
614	else {
615	WPMST()->mail->send_mail( $email );
616	}
617
618	} // for each recipient
619	}
620
621	/**
622	* Replace tags for custom fields.
623	*
624	* @param $text
625	* @param $fields
626	* @param $post
627	*
628	* @return string
629	*/
630	private function replace_custom_fields( $text, $fields, $post ) {
631	foreach ( $fields as $field ) {
632	$replace = "({$field['label']} blank)";
633	$post_field = isset( $post[ $field['name'] ] ) ? $post[ $field['name'] ] : false;
634
635	if ( $post_field ) {
636	if ( 'category' == $field['name'] ) {
637	$term = get_term( $post_field, 'wpm-testimonial-category' );
638	if ( $term && ! is_wp_error( $term ) ) {
639	$replace = $term->name;
640	}
641	}
642	elseif ( 'rating' == $field['input_type'] ) {
643	$replace = $post_field . ' ' . _n( 'star', 'stars', $post_field, 'strong-testimonials' );
644	}
645	elseif ( 'checkbox' == $field['input_type'] ) {
646	$replace = $post_field ? 'yes' : 'no';
647	}
648	else {
649	$replace = $post_field;
650	}
651	}
652
653	$replace = apply_filters( 'wpmtst_notification_custom_field_value', $replace, $field, $post );
654	$field_tag = '%' . strtoupper( $field['name'] ) . '%';
655	$text = str_replace( $field_tag, $replace, $text );
656	}
657
658	return $text;
659	}
660
661	}
662