views-validate.php — Strong Testimonials 3.2.7

strong-testimonials / admin / views-validate.php

strong-testimonials / admin Last commit date

views-validate.php

558 lines

1	<?php
2
3	/**
4	* Validate a View's name.
5	*
6	* @since 2.11.14
7	*
8	* @param $name
9	* @param $view_id
10	*
11	* @return string
12	*/
13	function wpmtst_validate_view_name( $name, $view_id ) {
14	if ( '' === $name ) {
15	$name = "Testimonial View $view_id";
16	} else {
17	$name = sanitize_text_field( stripslashes( $name ) );
18	}
19
20	return $name;
21	}
22
23
24	/**
25	* Sanitize and validate a View.
26	* TODO break down into separate validators
27	*
28	* @since 1.21.0
29	* @since 2.5.7 Strip CSS from CSS Class Names field.
30	* @since 2.10.0 Provide both more_post and more_page.
31	* @since 2.11.0 More slideshow options: effect, slideshow_nav, stretch
32	* @since 2.11.4 more_full_post for manual excerpts
33	* @since 2.11.5 more_page_hook
34	*
35	* @param $input
36	*
37	* @return array
38	*/
39	function wpmtst_sanitize_view( $input ) {
40	ksort( $input );
41
42	$default_view = wpmtst_get_view_default();
43
44	$data = array();
45	$data['mode'] = sanitize_text_field( $input['mode'] );
46
47	$data['form_ajax'] = isset( $input['form_ajax'] ) ? 1 : 0;
48
49	$data = wpmtst_sanitize_view_post_id( $data, $input );
50
51	$data = wpmtst_sanitize_view_template( $data, $input );
52
53	// Category
54	if ( 'form' === $data['mode'] ) {
55	if ( isset( $input['category-form'] ) ) {
56	$data['category'] = sanitize_text_field( implode( ',', $input['category-form'] ) );
57	} else {
58	$data['category'] = '';
59	}
60	} else {
61	if ( 'allcats' === $input['category_all'] ) {
62	$data['category'] = 'all';
63	} elseif ( ! isset( $input['category'] ) ) {
64	$data['category'] = 'all';
65	} elseif ( 'somecats' === $input['category_all'] && ! isset( $input['category'] ) ) {
66	$data['category'] = 'all';
67	} else {
68	$data['category'] = sanitize_text_field( implode( ',', $input['category'] ) );
69	}
70	}
71
72	$data['order'] = sanitize_text_field( $input['order'] );
73
74	// Limit
75	if ( isset( $input['all'] ) && $input['all'] ) {
76	$data['count'] = -1;
77	} else {
78	$data['count'] = (int) sanitize_text_field( $input['count'] );
79	}
80
81	// Pagination
82	$data['pagination'] = isset( $input['pagination'] ) ? 1 : 0;
83	$data['pagination_settings'] = wpmtst_sanitize_view_pagination( $input['pagination_settings'] );
84
85	$data['title'] = isset( $input['title'] ) ? 1 : 'hidden';
86	$data['title_link'] = sanitize_text_field( $input['title_link'] );
87
88	$data['content'] = sanitize_text_field( $input['content'] );
89	$data['excerpt_length'] = (int) sanitize_text_field( $input['excerpt_length'] );
90	$data['use_default_length'] = sanitize_text_field( $input['use_default_length'] );
91	$data['html_content'] = isset( $input['html_content'] ) ? 1 : 0;
92
93	$data = wpmtst_sanitize_view_readmore( $data, $input, $default_view );
94
95	// Thumbnail
96	$data['thumbnail'] = isset( $input['thumbnail'] ) ? 1 : 0;
97	$data['thumbnail_size'] = sanitize_text_field( $input['thumbnail_size'] );
98	$data['thumbnail_width'] = max( 0, sanitize_text_field( $input['thumbnail_width'] ) );
99	$data['thumbnail_height'] = max( 0, sanitize_text_field( $input['thumbnail_height'] ) );
100	$data['lightbox'] = isset( $input['lightbox'] ) ? 1 : 0;
101	$data['lightbox_class'] = sanitize_text_field( $input['lightbox_class'] );
102	$data['gravatar'] = sanitize_text_field( $input['gravatar'] );
103
104	/**
105	* CSS Class Names
106	* This field is being confused with custom CSS rules like `.wpmtst-testimonial { border: none; }`
107	* so strip periods and declarations.
108	*/
109	$data['class'] = sanitize_text_field( trim( preg_replace( '/\{.*?\}\|\./', '', $input['class'] ) ) );
110
111	// Background
112	$data['background'] = wpmtst_get_background_defaults();
113	if ( ! isset( $input['background']['type'] ) ) {
114	$data['background']['type'] = '';
115	} else {
116	$data['background']['type'] = sanitize_text_field( $input['background']['type'] );
117	}
118	$data['background']['color'] = sanitize_hex_color( $input['background']['color'] );
119	$data['background']['gradient1'] = sanitize_hex_color( $input['background']['gradient1'] );
120	$data['background']['gradient2'] = sanitize_hex_color( $input['background']['gradient2'] );
121	$data['background']['preset'] = sanitize_text_field( $input['background']['preset'] );
122
123	// Font color
124	if ( ! isset( $input['font-color']['type'] ) ) {
125	$data['font-color']['type'] = '';
126	} else {
127	$data['font-color']['type'] = sanitize_text_field( $input['font-color']['type'] );
128	}
129	$data['font-color']['color'] = sanitize_hex_color( $input['font-color']['color'] );
130
131	// Layout input may have been disabled by selecting the widget template so no value is posted.
132	if ( ! isset( $input['layout'] ) ) {
133	$data['layout'] = '';
134	} else {
135	// pagination and Masonry are incompatible
136	$data['layout'] = sanitize_text_field( $input['layout'] );
137	if ( isset( $input['pagination'] ) && 'masonry' === $data['layout'] ) {
138	$data['layout'] = '';
139	}
140	}
141
142	$data['column_count'] = sanitize_text_field( $input['column_count'] );
143
144	$data['slideshow_settings'] = wpmtst_sanitize_view_slideshow( $input['slideshow_settings'] );
145
146	if ( isset( $input['client_section'] ) ) {
147	$data['client_section'] = wpmtst_sanitize_view_client_section( $input['client_section'] );
148	} else {
149	$data['client_section'] = null;
150	}
151
152	// Multiple Forms add-on
153	if ( isset( $input['form_id'] ) ) {
154	$data['form_id'] = $input['form_id'];
155	} else {
156	// hidden
157	$data['form_id'] = $input['_form_id'];
158	}
159
160	// Divi Builder
161	$data['divi_builder'] = isset( $input['divi_builder'] ) ? 1 : 0;
162
163	$data = apply_filters( 'wpmtst_sanitized_view', $data, $input );
164	ksort( $data );
165
166	return $data;
167	}
168
169	/**
170	* Read-more options.
171	*
172	* @param $data
173	* @param $input
174	* @param $default_view
175	*
176	* @since 2.33.0 As separate function.
177	*
178	* @return array
179	*/
180	function wpmtst_sanitize_view_readmore( $data, $input, $default_view ) {
181	if ( 'truncated' === $data['content'] \|\| 'excerpt' === $data['content'] ) {
182	$data['more_post'] = 1;
183	} else {
184	$data['more_post'] = 0;
185	}
186	$data['more_post_ellipsis'] = sanitize_text_field( $input['more_post_ellipsis'] );
187	$data['use_default_more'] = ( isset( $input['use_default_more'] ) ) ? $input['use_default_more'] : 0;
188	$data['more_post_text'] = sanitize_text_field( $input['more_post_text'] );
189	$data['less_post_text'] = sanitize_text_field( $input['less_post_text'] );
190
191	/**
192	* Read more in place
193	*
194	* @since 2.33.0
195	*/
196	$data['more_post_in_place'] = isset( $input['more_post_in_place'] ) ? $input['more_post_in_place'] : 0;
197
198	/**
199	* Read more --> post (dependent on more-post-in-place)
200	*/
201	$data['more_full_post'] = sanitize_text_field( $input['more_full_post'] );
202
203	/**
204	* Read more --> page
205	*/
206	if ( isset( $input['more_page'] ) && $input['more_page'] ) {
207
208	// Check the "ID or slug" field first
209	if ( isset( $input['more_page_id2'] ) && ! empty( $input['more_page_id2'] ) ) {
210
211	// is post ID?
212	$id = sanitize_text_field( $input['more_page_id2'] );
213	if ( is_numeric( $id ) ) {
214	if ( ! get_posts(
215	array(
216	'p' => $id,
217	'post_type' => array( 'page', 'post' ),
218	'post_status' => 'publish',
219	)
220	) ) {
221	$id = null;
222	}
223	} else {
224	// is post slug?
225	$target = get_posts(
226	array(
227	'name' => $id,
228	'post_type' => array( 'page', 'post' ),
229	'post_status' => 'publish',
230	)
231	);
232	if ( $target ) {
233	$id = $target[0]->ID;
234	}
235	}
236
237	if ( $id ) {
238	$data['more_page_id'] = $id;
239	unset( $data['more_page_id2'] );
240	}
241	} else {
242
243	if ( $input['more_page_id'] ) {
244	if ( is_numeric( $input['more_page_id'] ) ) {
245	$data['more_page_id'] = (int) sanitize_text_field( $input['more_page_id'] );
246	} else {
247	$data['more_page_id'] = sanitize_text_field( $input['more_page_id'] );
248	}
249	}
250	}
251
252	// Only enable more_page if a page was selected by either method.
253	if ( isset( $data['more_page_id'] ) && $data['more_page_id'] ) {
254	$data['more_page'] = 1;
255	}
256	}
257
258	if ( ! $input['more_page_text'] ) {
259	$data['more_page_text'] = $default_view['more_page_text'];
260	} else {
261	$data['more_page_text'] = sanitize_text_field( $input['more_page_text'] );
262	}
263	$data['more_page_hook'] = sanitize_text_field( $input['more_page_hook'] );
264
265	return $data;
266	}
267
268	/**
269	* Single testimonial
270	*
271	* @since 2.30.0 As separate function.
272	*
273	* @param $data array
274	* @param $input array
275	*
276	* @return array
277	*/
278	function wpmtst_sanitize_view_post_id( $data, $input ) {
279	// Clear single ID if "multiple" selected
280	if ( 'multiple' === $input['select'] ) {
281	$data['id'] = 0; // must be zero not empty or false
282	return $data;
283	}
284
285	// Clear single ID if mode:slideshow selected
286	if ( 'slideshow' === $input['mode'] ) {
287	$data['id'] = 0; // must be zero not empty or false
288	return $data;
289	}
290
291	// Check the "ID or slug" field first
292	if ( ! $input['post_id'] ) {
293	$data['id'] = (int) sanitize_text_field( $input['id'] );
294	return $data;
295	}
296
297	// Is post ID?
298	$id = (int) $input['post_id'];
299	if ( $id ) {
300	$args = array(
301	'p' => $id,
302	'post_type' => 'wpm-testimonial',
303	'post_status' => 'publish',
304	);
305	if ( ! get_posts( $args ) ) {
306	$id = null;
307	}
308	} else {
309	// Is post slug?
310	$args = array(
311	'name' => $input['post_id'],
312	'post_type' => 'wpm-testimonial',
313	'post_status' => 'publish',
314	);
315	$target = get_posts( $args );
316	if ( $target ) {
317	$id = $target[0]->ID;
318	}
319	}
320
321	$data['id'] = $id;
322	$data['post_id'] = '';
323
324	return $data;
325	}
326
327	/**
328	* Sanitize slideshow settings.
329	*
330	* @since 2.28.0
331	*
332	* @param $in
333	*
334	* @return array
335	*/
336	function wpmtst_sanitize_view_pagination( $in ) {
337	$out['type'] = sanitize_text_field( $in['type'] );
338	$out['nav'] = str_replace( ' ', '', sanitize_text_field( $in['nav'] ) );
339	$out['show_all'] = 'on' === $in['show_all'];
340	$out['prev_next'] = wpmtst_sanitize_checkbox( $in, 'prev_next' );
341	$out['prev_text'] = sanitize_text_field( $in['prev_text'] );
342	$out['next_text'] = sanitize_text_field( $in['next_text'] );
343	$out['before_page_number'] = sanitize_text_field( $in['before_page_number'] );
344	$out['after_page_number'] = sanitize_text_field( $in['after_page_number'] );
345
346	/**
347	* Attempt to repair bug from 2.28.2
348	*/
349	if ( isset( $in['end_size'] ) && intval( $in['end_size'] ) ) {
350	$out['end_size'] = (int) sanitize_text_field( $in['end_size'] );
351	} else {
352	$out['end_size'] = 1;
353	}
354
355	if ( isset( $in['mid_size'] ) && intval( $in['mid_size'] ) ) {
356	$out['mid_size'] = (int) sanitize_text_field( $in['mid_size'] );
357	} else {
358	$out['mid_size'] = 2;
359	}
360
361	if ( isset( $in['per_page'] ) && intval( $in['per_page'] ) ) {
362	$out['per_page'] = (int) sanitize_text_field( $in['per_page'] );
363	} else {
364	$out['per_page'] = 5;
365	}
366
367	return $out;
368	}
369
370	/**
371	* Sanitize slideshow settings.
372	*
373	* @param $in
374	* @since 2.15.0
375	*
376	* @return array
377	*/
378	function wpmtst_sanitize_view_slideshow( $in ) {
379	$out = array();
380
381	$out['type'] = sanitize_text_field( $in['type'] );
382
383	// Insert unused defaults.
384	$out['show_single'] = array(
385	'max_slides' => 1,
386	'move_slides' => 1,
387	'margin' => 1,
388	);
389
390	// Save carousel breakpoints.
391	$breakpoints = $in['breakpoints'];
392
393	foreach ( $breakpoints as $key => $breakpoint ) {
394
395	$out['breakpoints'][ $key ]['width'] = intval( sanitize_text_field( $breakpoint['width'] ) );
396
397	$out['breakpoints'][ $key ]['max_slides'] = intval( sanitize_text_field( $breakpoint['max_slides'] ) );
398
399	$out['breakpoints'][ $key ]['move_slides'] = intval( sanitize_text_field( $breakpoint['move_slides'] ) );
400
401	if ( $out['breakpoints'][ $key ]['move_slides'] > $out['breakpoints'][ $key ]['max_slides'] ) {
402	$out['breakpoints'][ $key ]['move_slides'] = $out['breakpoints'][ $key ]['max_slides'];
403	}
404
405	$out['breakpoints'][ $key ]['margin'] = intval( sanitize_text_field( $breakpoint['margin'] ) );
406
407	}
408
409	// Carousel requires horizontal scroll.
410	if ( 'show_multiple' === $out['type'] ) {
411	$out['effect'] = 'horizontal';
412	} else {
413	$out['effect'] = sanitize_text_field( $in['effect'] );
414	}
415
416	$out['pause'] = floatval( sanitize_text_field( $in['pause'] ) );
417	$out['speed'] = floatval( sanitize_text_field( $in['speed'] ) );
418	$out['auto_hover'] = isset( $in['auto_hover'] ) ? 1 : 0;
419	$out['continuous_sliding'] = isset( $in['continuous_sliding'] ) ? 1 : 0;
420	$out['stop_auto_on_click'] = isset( $in['stop_auto_on_click'] ) ? 1 : 0;
421
422	if ( 'dynamic' === $in['height'] ) {
423	$out['adapt_height'] = 1;
424	} else {
425	$out['adapt_height'] = 0;
426	}
427	$out['adapt_height_speed'] = floatval( sanitize_text_field( $in['adapt_height_speed'] ) );
428	$out['stretch'] = isset( $in['stretch'] ) ? 1 : 0;
429
430	// If no navigation, must start automatically.
431	if ( 'none' === $in['pager_type'] && 'none' === $in['controls_type'] ) {
432	$out['auto_start'] = 1;
433	} else {
434	$out['auto_start'] = isset( $in['auto_start'] ) ? 1 : 0;
435	}
436
437	// Controls
438	$out['controls_type'] = sanitize_text_field( $in['controls_type'] );
439	$out['controls_style'] = sanitize_text_field( $in['controls_style'] );
440
441	// Pagination
442	$out['pager_type'] = sanitize_text_field( $in['pager_type'] );
443	$out['pager_style'] = sanitize_text_field( $in['pager_style'] );
444
445	// Position is shared by Controls and Pagination
446	if ( $out['controls_type'] \|\| $out['pager_type'] ) {
447	if ( 'show_multiple' === $out['type'] ) {
448	$out['nav_position'] = 'outside';
449	} else {
450	$out['nav_position'] = sanitize_text_field( $in['nav_position'] );
451	}
452	}
453
454	ksort( $out );
455
456	return $out;
457	}
458
459
460	/**
461	* Sanitize client section (custom fields).
462	*
463	* @param $in
464	* @since 2.17.0
465	*
466	* @return array
467	*/
468	function wpmtst_sanitize_view_client_section( $in ) {
469	$out = array();
470
471	foreach ( $in as $key => $field ) {
472	if ( empty( $field['field'] ) ) {
473	continue;
474	}
475
476	$out[ $key ]['field'] = sanitize_text_field( $field['field'] );
477
478	if ( isset( $field['type'] ) ) {
479	$type = sanitize_text_field( $field['type'] );
480	} else {
481	$type = sanitize_text_field( $field['save-type'] );
482	}
483	$out[ $key ]['type'] = $type;
484
485	$out[ $key ]['before'] = sanitize_text_field( $field['before'] );
486
487	$out[ $key ]['class'] = sanitize_text_field( $field['class'] );
488
489	switch ( $type ) {
490	case 'link':
491	case 'link2':
492	/**
493	* If no URL, change field type to 'text'. This happens when a URL field
494	* (e.g. company_name) is removed from Custom Fields.
495	* @since 2.10.0
496	*/
497	if ( ! isset( $field['url'] ) ) {
498	$out[ $key ]['type'] = 'text';
499	unset( $out[ $key ]['link_text'] );
500	unset( $out[ $key ]['link_text_custom'] );
501	unset( $out[ $key ]['new_tab'] );
502	} else {
503	$out[ $key ]['url'] = sanitize_text_field( $field['url'] );
504
505	$out[ $key ]['link_text'] = isset( $field['link_text'] ) ? sanitize_text_field( $field['link_text'] ) : '';
506
507	$out[ $key ]['link_text_custom'] = isset( $field['link_text_custom'] ) ? sanitize_text_field( $field['link_text_custom'] ) : '';
508
509	$out[ $key ]['new_tab'] = isset( $field['new_tab'] ) ? 1 : 0;
510	}
511	break;
512	case 'date':
513	$format = isset( $field['format'] ) ? sanitize_text_field( $field['format'] ) : '';
514	$out[ $key ]['format'] = $format;
515	break;
516	case 'checkbox':
517	$out[ $key ]['label'] = isset( $field['label'] ) ? sanitize_text_field( $field['label'] ) : 'label';
518	$out[ $key ]['custom_label'] = isset( $field['custom_label'] ) ? sanitize_text_field( $field['custom_label'] ) : '';
519	$out[ $key ]['checked_value'] = isset( $field['checked_value'] ) ? sanitize_text_field( $field['checked_value'] ) : '';
520	$out[ $key ]['checked_value_custom'] = isset( $field['checked_value_custom'] ) ? sanitize_text_field( $field['checked_value_custom'] ) : '';
521	$out[ $key ]['unchecked_value'] = isset( $field['unchecked_value'] ) ? sanitize_text_field( $field['unchecked_value'] ) : '';
522	break;
523	case 'category':
524	$out[ $key ]['category_show'] = isset( $field['category_show'] ) ? sanitize_text_field( $field['category_show'] ) : 'both';
525	break;
526	default:
527	}
528	}
529
530	return $out;
531	}
532
533	/**
534	* Template settings.
535	*
536	* @param $data
537	* @param $input
538	*
539	* @return array
540	*/
541	function wpmtst_sanitize_view_template( $data, $input ) {
542	if ( 'form' === $data['mode'] ) {
543	$data['template'] = isset( $input['form-template'] ) ? sanitize_text_field( $input['form-template'] ) : '';
544	} else {
545	$data['template'] = isset( $input['template'] ) ? sanitize_text_field( $input['template'] ) : '';
546	}
547
548	// To save all template settings:
549	foreach ( $input['template_settings'] as $template => $settings ) {
550	foreach ( $settings as $key => $setting ) {
551	// This does not work for checkboxes yet.
552	$data['template_settings'][ $template ][ $key ] = apply_filters( 'wpmtst_sanitize_view_template_setting', sanitize_text_field( $setting ), $key );
553	}
554	}
555
556	return $data;
557	}
558