class-strong-testimonials-form.php — Strong Testimonials 3.2.8

strong-testimonials / includes / class-strong-testimonials-form.php

strong-testimonials / includes Last commit date

class-strong-testimonials-form.php

626 lines

1	<?php
2	/**
3	* Class Strong_Testimonials_Form
4	*/
5	class Strong_Testimonials_Form {
6
7	const TAB_NAME = 'fields';
8
9	public $form_options;
10
11	public $form_values;
12
13	public $form_errors;
14
15	/**
16	* Strong_Testimonials_Form constructor.
17	*/
18	public function __construct() {
19	$this->form_options = get_option( 'wpmtst_form_options' );
20	$this->add_actions();
21	}
22
23	/**
24	* Add our actions.
25	*/
26	public function add_actions() {
27	add_action( 'init', array( $this, 'process_form' ), 20 );
28	//add_action( 'wpmtst_register_form_settings', array( $this, 'register_settings' ) );
29	add_action( 'wpmtst_form_tabs', array( $this, 'register_tab' ), 1, 2 );
30	add_filter( 'wpmtst_form_callbacks', array( $this, 'register_fields_page' ) );
31	add_action( 'wp_ajax_wpmtst_form2', array( $this, 'process_form_ajax' ) );
32	add_action( 'wp_ajax_nopriv_wpmtst_form2', array( $this, 'process_form_ajax' ) );
33	}
34
35	/**
36	* Register fields tab.
37	*
38	* @param $active_tab
39	* @param $url
40	*/
41	public function register_tab( $active_tab, $url ) {
42	printf(
43	'<a href="%s" class="nav-tab %s">%s</a>',
44	esc_url( add_query_arg( 'tab', self::TAB_NAME, $url ) ),
45	esc_attr( self::TAB_NAME === $active_tab ? 'nav-tab-active' : '' ),
46	esc_html__( 'Fields', 'strong-testimonials' )
47	);
48	}
49
50	/**
51	* Register fields page.
52	*
53	* @param $pages
54	*
55	* @return mixed
56	*/
57	public function register_fields_page( $pages ) {
58	$pages[ self::TAB_NAME ] = 'wpmtst_form_admin';
59
60	return $pages;
61	}
62
63	/**
64	* Process a form.
65	* Moved to `init` hook for strong_testimonials_view() template function.
66	*
67	* @since 2.3.0
68	*/
69	public function process_form() {
70	if ( wp_doing_ajax() ) {
71	return;
72	}
73
74	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
75	$form_options = get_option( 'wpmtst_form_options' );
76	$success = $this->form_processor();
77	if ( $success ) {
78	switch ( $form_options['success_action'] ) {
79	case 'id':
80	$goback = get_permalink( $form_options['success_redirect_id'] );
81	break;
82	case 'url':
83	$goback = $form_options['success_redirect_url'];
84	break;
85	default:
86	// For non-Ajax forms, the only ways to store the state (successful form submission)
87	// are a query parameter or a cookie.
88	$goback = add_query_arg( 'success', isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0, wp_get_referer() );
89	$goback = add_query_arg(
90	array(
91	'success' => '',
92	'formid' => isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0,
93	),
94	wp_get_referer()
95	);
96	}
97	wp_redirect( apply_filters( 'wpmtst_form_redirect_url', $goback ) );
98	exit;
99	}
100	}
101	}
102
103	/**
104	* Ajax form submission handler
105	*/
106	public function process_form_ajax() {
107	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
108	$success = $this->form_processor();
109	if ( $success ) {
110	$return = array(
111	'success' => true,
112	'message' => wpmtst_get_success_message(),
113	);
114	} else {
115	$return = array(
116	'success' => false,
117	'errors' => $this->get_form_errors(),
118	);
119	}
120	echo json_encode( $return );
121	}
122
123	wp_die();
124	}
125
126	/**
127	* Store form values.
128	*
129	* @param $form_values
130	*/
131	public function set_form_values( $form_values ) {
132	$this->form_values = $form_values;
133	}
134
135	/**
136	* Return form values.
137	*
138	* @return mixed
139	*/
140	public function get_form_values() {
141	return $this->form_values;
142	}
143
144	/**
145	* Store from errors.
146	*
147	* @param $form_errors
148	*/
149	public function set_form_errors( $form_errors ) {
150	$this->form_errors = $form_errors;
151	}
152
153	/**
154	* Return form errors.
155	*
156	* @return mixed
157	*/
158	public function get_form_errors() {
159	return $this->form_errors;
160	}
161
162	/**
163	* Testimonial form processor.
164	*
165	* @since 1.21.0
166	*/
167	public function form_processor() {
168
169	if ( empty( $_POST ) \|\| ! wp_verify_nonce( $_POST['wpmtst_form_nonce'], 'wpmtst_form_action' ) ) {
170	return false;
171	}
172
173	if ( ! isset( $_POST['form_id'] ) \|\| ! isset( $_POST['view_id'] ) \|\| empty( wpmtst_get_view( absint( $_POST['view_id'] ) ) ) ) {
174	return false;
175	}
176
177	do_action( 'wpmtst_form_submission' );
178
179	$new_post = stripslashes_deep( $_POST );
180	/**
181	* Trim spaces
182	* @since 2.26.6
183	*/
184	$new_post = wpmtst_trim_array( $new_post );
185
186	add_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
187
188	$form_options = get_option( 'wpmtst_form_options' );
189
190	// Init four arrays: post, post_meta, categories, attachment(s).
191	$testimonial_post = array(
192	'post_status' => $form_options['post_status'],
193	'post_type' => 'wpm-testimonial',
194	);
195	$testimonial_meta = array();
196	$testimonial_cats = array();
197	$testimonial_att = array();
198
199	$form_errors = array();
200
201	// TODO This use of 'custom' is obsolete. The default form is simply the first one in the array.
202	$form_name = isset( $new_post['form_id'] ) ? $new_post['form_id'] : 'custom';
203	$fields = wpmtst_get_form_fields( $form_name );
204
205	$form_errors = apply_filters( 'wpmtst_form_additional_checks', $form_errors );
206
207	/**
208	* sanitize & validate
209	*/
210	foreach ( $fields as $key => $field ) {
211
212	$new_post = apply_filters( 'before_field_sanitize', $new_post, $field );
213
214	if ( isset( $field['required'] ) && $field['required'] && isset( $field['name'] ) ) {
215	if ( ( 'file' === $field['input_type'] ) ) {
216	if ( ! isset( $_FILES[ $field['name'] ] ) \|\| ! isset( $_FILES[ $field['name'] ]['size'] ) \|\| ! $_FILES[ $field['name'] ]['size'] ) {
217	$form_errors[ $field['name'] ] = $field['error'];
218	continue;
219	}
220	} elseif ( empty( $new_post[ $field['name'] ] ) ) {
221	$form_errors[ $field['name'] ] = $field['error'];
222	continue;
223	}
224	}
225
226	// Check for callback first.
227	if ( isset( $field['action_input'] ) && $field['action_input'] ) {
228	// Assuming value can be stored as text field
229	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
230	// TODO Register a validator callback
231	} else {
232	switch ( $field['record_type'] ) {
233	case 'post':
234	if ( 'file' === $field['input_type'] ) {
235	$testimonial_att[ $field['name'] ] = array( 'field' => isset( $field['map'] ) ? $field['map'] : 'post' );
236	} elseif ( 'textarea' === $field['input_type'] ) {
237	$testimonial_post[ $field['name'] ] = wpmtst_sanitize_textarea( $new_post[ $field['name'] ] );
238	} else {
239	$testimonial_post[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
240	}
241	break;
242
243	case 'custom':
244	if ( 'email' === $field['input_type'] && $new_post[ $field['name'] ] ) {
245	if ( is_email( $new_post[ $field['name'] ] ) ) {
246	$testimonial_meta[ $field['name'] ] = sanitize_email( $new_post[ $field['name'] ] );
247	} else {
248	$form_errors[ $field['name'] ] = $field['error'];
249	}
250	} elseif ( 'url' === $field['input_type'] ) {
251	// wpmtst_get_website() will prefix with "http://" so don't add that to an empty input
252	if ( $new_post[ $field['name'] ] ) {
253	$testimonial_meta[ $field['name'] ] = esc_url_raw( wpmtst_get_website( $new_post[ $field['name'] ] ) );
254	}
255	} elseif ( 'textarea' === $field['input_type'] ) {
256	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
257	} elseif ( 'checkbox' === $field['input_type'] ) {
258	$testimonial_meta[ $field['name'] ] = wpmtst_sanitize_checkbox( $new_post, $field['name'] );
259	} else {
260	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
261	}
262	break;
263
264	case 'optional':
265	if ( 'category' === strtok( $field['input_type'], '-' ) ) {
266	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
267	} elseif ( 'rating' === $field['input_type'] ) {
268	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
269	} else {
270	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
271	}
272	break;
273
274	default:
275	}
276	}
277	}
278
279	/**
280	* No missing required fields, carry on.
281	*/
282	if ( ! count( $form_errors ) ) {
283
284	// Special handling: if post_title is not required, create one from post_content
285	if ( ! isset( $testimonial_post['post_title'] ) \|\| ! $testimonial_post['post_title'] ) {
286	if ( isset( $testimonial_post['post_content'] ) ) {
287	$words_array = explode( ' ', $testimonial_post['post_content'] );
288	$five_words = array_slice( $words_array, 0, 5 );
289	$testimonial_post['post_title'] = implode( ' ', $five_words );
290	} else {
291	$testimonial_post['post_title'] = esc_html__( '(no title)', 'strong-testimonials' );
292	$testimonial_post['post_content'] = '';
293	}
294	}
295
296	/**
297	* Validate image attachments and store WP error messages.
298	*/
299	/*
300	* $_FILES = Array
301	* (
302	* [featured_image] => Array
303	* (
304	* [name] => Screenshot.png
305	* [type] => image/png
306	* [tmp_name] => C:\wamp64\tmp\php7EA4.tmp
307	* [error] => 0
308	* [size] => 615273
309	* )
310	* )
311	*/
312	foreach ( $testimonial_att as $name => $atts ) {
313	if ( isset( $_FILES[ $name ] ) && isset( $_FILES[ $name ]['size'] ) && $_FILES[ $name ]['size'] > 1 ) {
314	$file = $_FILES[ $name ]; // phpcs:ignore sanitized under
315
316	// Upload file
317	$overrides = array( 'test_form' => false );
318	$uploaded_file = $this->handle_upload( $file, $overrides );
319	/*
320	* $uploaded_file = Array
321	* (
322	* [file] => string 'M:\wp\strong\site/wp-content/uploads/Lotus8.jpg'
323	* [url] => string 'http://strong.dev/wp-content/uploads/Lotus8.jpg'
324	* [type] => string 'image/jpeg'
325	* )
326	*/
327	if ( isset( $uploaded_file['error'] ) ) {
328	$form_errors[ $name ] = $uploaded_file['error'];
329	break;
330	} else {
331	// Create an attachment
332	$attachment = array(
333	'post_title' => sanitize_file_name( wp_unslash( $file['name'] ) ),
334	'post_content' => '',
335	'post_type' => 'attachment',
336	'post_parent' => null, // populated after inserting post
337	'post_mime_type' => sanitize_text_field( $file['type'] ),
338	'guid' => $uploaded_file['url'],
339	);
340
341	$testimonial_att[ $name ]['attachment'] = $attachment;
342	$testimonial_att[ $name ]['uploaded_file'] = $uploaded_file;
343	}
344	}
345	}
346	}
347
348	/**
349	* No faulty uploads, carry on.
350	*/
351	if ( ! count( $form_errors ) ) {
352
353	// create new testimonial post
354	$testimonial_id = wp_insert_post( apply_filters( 'wpmtst_new_testimonial_post', $testimonial_post ) );
355
356	if ( is_wp_error( $testimonial_id ) ) {
357
358	// TODO report errors in admin
359	$form_errors['post'] = $form_options['messages']['submission-error']['text'];
360	} else {
361	$testimonial_post['id'] = $testimonial_id;
362
363	/**
364	* Add categories.
365	*
366	* @since 2.17.0 Handle arrays (if using checklist) or strings (if using <select>).
367	* @since 2.19.1 Storing default category (as set in view) in separate hidden field.
368	*/
369
370	if ( $new_post['default_category'] ) {
371	$testimonial_cats = explode( ',', $new_post['default_category'] );
372	}
373
374	if ( $new_post['category'] ) {
375	if ( is_string( $new_post['category'] ) ) {
376	$new_post['category'] = explode( ',', $new_post['category'] );
377	}
378	$testimonial_cats = array_merge( $testimonial_cats, $new_post['category'] );
379	}
380
381	$testimonial_cats = array_map( 'intval', array_unique( $testimonial_cats ) );
382
383	if ( array_filter( $testimonial_cats ) ) {
384	$category_success = wp_set_object_terms( $testimonial_id, $testimonial_cats, 'wpm-testimonial-category' );
385
386	if ( ! $category_success ) {
387	// TODO improve error handling
388	}
389	}
390
391	// save submit date
392	$testimonial_meta['submit_date'] = current_time( 'mysql' );
393
394	/**
395	* Save custom fields.
396	*
397	* @since 2.17.0 Exclude categories.
398	*/
399	$new_meta = array_diff_key( $testimonial_meta, array( 'category' => '' ) );
400	$new_meta = apply_filters( 'wpmtst_new_testimonial_meta', $new_meta );
401	foreach ( $new_meta as $key => $field ) {
402	add_post_meta( $testimonial_id, $key, $field );
403	}
404
405	// save attachments
406	$testimonial_att = apply_filters( 'wpmtst_new_testimonial_attachments', $testimonial_att );
407	foreach ( $testimonial_att as $name => $atts ) {
408	if ( isset( $atts['attachment'] ) ) {
409	$atts['attachment']['post_parent'] = $testimonial_id;
410	$attach_id = wp_insert_attachment( $atts['attachment'], $atts['uploaded_file']['file'], $testimonial_id );
411	$attach_data = wp_generate_attachment_metadata( $attach_id, $atts['uploaded_file']['file'] );
412	$result = wp_update_attachment_metadata( $attach_id, $attach_data );
413	add_post_meta( $testimonial_id, $name, $atts['uploaded_file']['url'] );
414	if ( 'featured_image' === $atts['field'] ) {
415	set_post_thumbnail( $testimonial_id, $attach_id );
416	}
417	}
418	}
419	}
420	}
421
422	remove_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
423
424	/**
425	* Post inserted successfully, carry on.
426	*/
427	$form_values = array_merge( $testimonial_post, $testimonial_meta );
428
429	ksort( $testimonial_post );
430	ksort( $testimonial_meta );
431	do_action( 'wpmtst_new_testimonial_added', $testimonial_post, $testimonial_meta, $testimonial_cats, $testimonial_att );
432
433	if ( ! count( $form_errors ) ) {
434	// Clear saved form data and errors.
435	$this->set_form_values( null );
436	$this->set_form_errors( null );
437	$this->notify_admin( $form_values, $form_name );
438	do_action( 'wpmtst_new_testimonial_submit', $form_values, $form_name );
439
440	return true;
441	}
442
443	// Redisplay form with submitted values and error messages.
444	$this->set_form_values( stripslashes_deep( $form_values ) );
445	$this->set_form_errors( $form_errors );
446
447	return false;
448	}
449
450	/**
451	* Restrict MIME types for security reasons.
452	*
453	* @param $mimes
454	*
455	* @return array
456	*/
457	public function restrict_mime( $mimes ) {
458	$mimes = array(
459	'jpg\|jpeg\|jpe' => 'image/jpeg',
460	'gif' => 'image/gif',
461	'png' => 'image/png',
462	);
463
464	return $mimes;
465	}
466
467	/**
468	* File upload handler
469	*
470	* @param $file_handler
471	* @param $overrides
472	*
473	* @return array
474	*/
475	public function handle_upload( $file_handler, $overrides ) {
476	require_once ABSPATH . 'wp-admin/includes/image.php';
477	require_once ABSPATH . 'wp-admin/includes/file.php';
478	require_once ABSPATH . 'wp-admin/includes/media.php';
479
480	$upload = wp_handle_upload( $file_handler, $overrides );
481
482	return $upload;
483	}
484
485	/**
486	* Send notification email upon testimonial submission.
487	*
488	* @param array $post
489	* @param string $form_name
490	*
491	* @since 1.7.0
492	* @since 2.30.6 Using all form fields (Multiple Forms add-on).
493	* Adding submit_date.
494	* Trimming subject and message strings.
495	*/
496	public function notify_admin( $post, $form_name = 'custom' ) {
497
498	$form_options = apply_filters( 'wpmtst_notify_admin_form_options', get_option( 'wpmtst_form_options' ), $post, $form_name );
499
500	if ( ! $form_options['admin_notify'] ) {
501	return;
502	}
503
504	$post['has_image'] = has_post_thumbnail( $post['id'] );
505	$fields = wpmtst_get_all_fields();
506
507	if ( $form_options['sender_site_email'] ) {
508	$sender_email = get_bloginfo( 'admin_email' );
509	} else {
510	$sender_email = $form_options['sender_email'];
511	}
512
513	// Subject line
514	$subject = trim( $form_options['email_subject'] );
515	$subject = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $subject );
516	$subject = str_replace( '%TITLE%', $post['post_title'], $subject );
517	$subject = str_replace( '%STATUS%', $post['post_status'], $subject );
518	$subject = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $subject );
519	$subject = $this->replace_custom_fields( $subject, $fields, $post );
520
521	// Message text
522	$message = rtrim( $form_options['email_message'] );
523	$message = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $message );
524	$message = str_replace( '%TITLE%', $post['post_title'], $message );
525	$message = str_replace( '%CONTENT%', $post['post_content'], $message );
526	$message = str_replace( '%STATUS%', $post['post_status'], $message );
527	$message = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $message );
528	$message = $this->replace_custom_fields( $message, $fields, $post );
529
530	foreach ( $form_options['recipients'] as $recipient ) {
531	if ( isset( $recipient['admin_site_email'] ) && $recipient['admin_site_email'] ) {
532	$admin_email = get_bloginfo( 'admin_email' );
533	} else {
534	$admin_email = $recipient['admin_email'];
535	}
536
537	// Mandrill rejects the 'name <email>' format
538	if ( $recipient['admin_name'] && ! $form_options['mail_queue'] ) {
539	$to = sprintf( '%s <%s>', $recipient['admin_name'], $admin_email );
540	} else {
541	$to = sprintf( '%s', $admin_email );
542	}
543
544	// Headers
545	$headers = 'Content-Type: text/html; charset="' . get_option( 'blog_charset' ) . '"' . "\n";
546	if ( $form_options['sender_name'] ) {
547	$headers .= sprintf( 'From: %s <%s>', $form_options['sender_name'], $sender_email ) . "\n";
548	} else {
549	$headers .= sprintf( 'From: %s', $sender_email ) . "\n";
550	}
551
552	$email = array(
553	'to' => $to,
554	'subject' => $subject,
555	'message' => $message,
556	'headers' => $headers,
557	);
558
559	if ( $form_options['mail_queue'] ) {
560	WPMST()->mail->enqueue_mail( $email );
561	} else {
562	WPMST()->mail->send_mail( $email );
563	}
564	} // for each recipient
565	}
566
567	/**
568	* Replace tags for custom fields.
569	*
570	* @param $text
571	* @param $fields
572	* @param $post
573	*
574	* @return string
575	*/
576	public static function replace_custom_fields( $text, $fields, $post ) {
577	foreach ( $fields as $field ) {
578	$replace = "({$field['label']} blank)";
579	$post_field = isset( $post[ $field['name'] ] ) ? $post[ $field['name'] ] : false;
580
581	if ( $post_field ) {
582	if ( 'category' === $field['name'] ) {
583	$term = get_term( $post_field, 'wpm-testimonial-category' );
584	if ( $term && ! is_wp_error( $term ) ) {
585	$replace = $term->name;
586	}
587	} elseif ( 'rating' === $field['input_type'] ) {
588	$replace = $post_field . ' ' . _n( 'star', 'stars', $post_field, 'strong-testimonials' );
589	} elseif ( 'checkbox' === $field['input_type'] ) {
590	$replace = $post_field ? 'yes' : 'no';
591	} else {
592	$replace = $post_field;
593	}
594	}
595
596	$replace = apply_filters( 'wpmtst_notification_custom_field_value', $replace, $field, $post );
597	$field_tag = '%' . strtoupper( $field['name'] ) . '%';
598	$text = str_replace( $field_tag, $replace, $text );
599	}
600
601	return $text;
602	}
603
604	private function is_form_in_any_view( $form_id ) {
605	$views = wpmtst_get_views();
606
607	if ( empty( $views ) ) {
608	return false;
609	}
610
611	foreach ( $views as $view ) {
612	if ( empty( $view['value'] ) ) {
613	continue;
614	}
615
616	$form_view = maybe_unserialize( $view['value'] );
617
618	if ( is_array( $form_view ) && isset( $form_view['form_id'] ) && absint( $form_view['form_id'] ) === absint( $form_id ) ) {
619	return true;
620	}
621	}
622
623	return false;
624	}
625	}
626