class-strong-testimonials-form.php — Strong Testimonials 3.3.2

strong-testimonials / includes / class-strong-testimonials-form.php

strong-testimonials / includes Last commit date

class-strong-testimonials-form.php

629 lines

1	<?php
2	/**
3	* Class Strong_Testimonials_Form
4	*/
5	class Strong_Testimonials_Form {
6
7	const TAB_NAME = 'fields';
8
9	public $form_options;
10
11	public $form_values;
12
13	public $form_errors;
14
15	/**
16	* Strong_Testimonials_Form constructor.
17	*/
18	public function __construct() {
19	$this->form_options = get_option( 'wpmtst_form_options' );
20	$this->add_actions();
21	}
22
23	/**
24	* Add our actions.
25	*/
26	public function add_actions() {
27	add_action( 'init', array( $this, 'process_form' ), 200 );
28	//add_action( 'wpmtst_register_form_settings', array( $this, 'register_settings' ) );
29	add_action( 'wpmtst_form_tabs', array( $this, 'register_tab' ), 1, 2 );
30	add_filter( 'wpmtst_form_callbacks', array( $this, 'register_fields_page' ) );
31	add_action( 'wp_ajax_wpmtst_form2', array( $this, 'process_form_ajax' ) );
32	add_action( 'wp_ajax_nopriv_wpmtst_form2', array( $this, 'process_form_ajax' ) );
33	}
34
35	/**
36	* Register fields tab.
37	*
38	* @param $active_tab
39	* @param $url
40	*/
41	public function register_tab( $active_tab, $url ) {
42	printf(
43	'<a href="%s" class="nav-tab %s">%s</a>',
44	esc_url( add_query_arg( 'tab', self::TAB_NAME, $url ) ),
45	esc_attr( self::TAB_NAME === $active_tab ? 'nav-tab-active' : '' ),
46	esc_html__( 'Fields', 'strong-testimonials' )
47	);
48	}
49
50	/**
51	* Register fields page.
52	*
53	* @param $pages
54	*
55	* @return mixed
56	*/
57	public function register_fields_page( $pages ) {
58	$pages[ self::TAB_NAME ] = 'wpmtst_form_admin';
59
60	return $pages;
61	}
62
63	/**
64	* Process a form.
65	* Moved to `init` hook for strong_testimonials_view() template function.
66	*
67	* @since 2.3.0
68	*/
69	public function process_form() {
70	if ( wp_doing_ajax() ) {
71	return;
72	}
73
74	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
75	$form_options = get_option( 'wpmtst_form_options' );
76	$success = $this->form_processor();
77	if ( $success ) {
78	switch ( $form_options['success_action'] ) {
79	case 'id':
80	$goback = get_permalink( $form_options['success_redirect_id'] );
81	break;
82	case 'url':
83	$goback = $form_options['success_redirect_url'];
84	break;
85	default:
86	// For non-Ajax forms, the only ways to store the state (successful form submission)
87	// are a query parameter or a cookie.
88	$goback = add_query_arg( 'success', isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0, wp_get_referer() );
89	$goback = add_query_arg(
90	array(
91	'success' => '',
92	'formid' => isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0,
93	),
94	wp_get_referer()
95	);
96	}
97	wp_redirect( apply_filters( 'wpmtst_form_redirect_url', $goback ) );
98	exit;
99	}
100	}
101	}
102
103	/**
104	* Ajax form submission handler
105	*/
106	public function process_form_ajax() {
107	if ( isset( $_POST['wpmtst_form_nonce'] ) ) {
108	$success = $this->form_processor();
109	if ( $success ) {
110	$return = array(
111	'success' => true,
112	'message' => wpmtst_get_success_message(),
113	);
114	} else {
115	$return = array(
116	'success' => false,
117	'errors' => $this->get_form_errors(),
118	);
119	}
120	echo json_encode( $return );
121	}
122
123	wp_die();
124	}
125
126	/**
127	* Store form values.
128	*
129	* @param $form_values
130	*/
131	public function set_form_values( $form_values ) {
132	$this->form_values = $form_values;
133	}
134
135	/**
136	* Return form values.
137	*
138	* @return mixed
139	*/
140	public function get_form_values() {
141	return $this->form_values;
142	}
143
144	/**
145	* Store from errors.
146	*
147	* @param $form_errors
148	*/
149	public function set_form_errors( $form_errors ) {
150	$this->form_errors = $form_errors;
151	}
152
153	/**
154	* Return form errors.
155	*
156	* @return mixed
157	*/
158	public function get_form_errors() {
159	return $this->form_errors;
160	}
161
162	/**
163	* Testimonial form processor.
164	*
165	* @since 1.21.0
166	*/
167	public function form_processor() {
168
169	if ( empty( $_POST ) \|\| ! wp_verify_nonce( $_POST['wpmtst_form_nonce'], 'wpmtst_form_action' ) ) {
170	return false;
171	}
172
173	if ( ! isset( $_POST['form_id'] ) \|\| ! isset( $_POST['view_id'] ) \|\| empty( wpmtst_get_view( absint( $_POST['view_id'] ) ) ) ) {
174	return false;
175	}
176
177	do_action( 'wpmtst_form_submission' );
178
179	$new_post = stripslashes_deep( $_POST );
180	/**
181	* Trim spaces
182	* @since 2.26.6
183	*/
184	$new_post = wpmtst_trim_array( $new_post );
185
186	add_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
187
188	$form_options = get_option( 'wpmtst_form_options' );
189
190	// Init four arrays: post, post_meta, categories, attachment(s).
191	$testimonial_post = array(
192	'post_status' => $form_options['post_status'],
193	'post_type' => 'wpm-testimonial',
194	);
195	$testimonial_meta = array();
196	$testimonial_cats = array();
197	$testimonial_att = array();
198
199	$form_errors = array();
200
201	// TODO This use of 'custom' is obsolete. The default form is simply the first one in the array.
202	$form_name = isset( $new_post['form_id'] ) ? $new_post['form_id'] : 'custom';
203	$fields = wpmtst_get_form_fields( $form_name );
204
205	$form_errors = apply_filters( 'wpmtst_form_additional_checks', $form_errors );
206
207	/**
208	* sanitize & validate
209	*/
210	foreach ( $fields as $key => $field ) {
211
212	$new_post = apply_filters( 'before_field_sanitize', $new_post, $field );
213
214	if ( isset( $field['required'] ) && $field['required'] && isset( $field['name'] ) ) {
215	if ( ( 'file' === $field['input_type'] ) ) {
216	if ( ! isset( $_FILES[ $field['name'] ] ) \|\| ! isset( $_FILES[ $field['name'] ]['size'] ) \|\| ! $_FILES[ $field['name'] ]['size'] ) {
217	$form_errors[ $field['name'] ] = $field['error'];
218	continue;
219	}
220	} elseif ( empty( $new_post[ $field['name'] ] ) ) {
221	$form_errors[ $field['name'] ] = $field['error'];
222	continue;
223	}
224	}
225
226	// Check for callback first.
227	if ( isset( $field['action_input'] ) && $field['action_input'] ) {
228	// Assuming value can be stored as text field
229	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
230	// TODO Register a validator callback
231	} else {
232	switch ( $field['record_type'] ) {
233	case 'post':
234	if ( 'file' === $field['input_type'] ) {
235	$testimonial_att[ $field['name'] ] = array( 'field' => isset( $field['map'] ) ? $field['map'] : 'post' );
236	} elseif ( 'textarea' === $field['input_type'] ) {
237	$testimonial_post[ $field['name'] ] = wpmtst_sanitize_textarea( $new_post[ $field['name'] ] );
238	} else {
239	$testimonial_post[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
240	}
241	break;
242
243	case 'custom':
244	if ( 'email' === $field['input_type'] && $new_post[ $field['name'] ] ) {
245	if ( is_email( $new_post[ $field['name'] ] ) ) {
246	$testimonial_meta[ $field['name'] ] = sanitize_email( $new_post[ $field['name'] ] );
247	} else {
248	$form_errors[ $field['name'] ] = $field['error'];
249	}
250	} elseif ( 'url' === $field['input_type'] ) {
251	// wpmtst_get_website() will prefix with "http://" so don't add that to an empty input
252	if ( $new_post[ $field['name'] ] ) {
253	$testimonial_meta[ $field['name'] ] = esc_url_raw( wpmtst_get_website( $new_post[ $field['name'] ] ) );
254	}
255	} elseif ( 'textarea' === $field['input_type'] ) {
256	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
257	} elseif ( 'checkbox' === $field['input_type'] ) {
258	$testimonial_meta[ $field['name'] ] = wpmtst_sanitize_checkbox( $new_post, $field['name'] );
259	} else {
260	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
261	}
262	break;
263
264	case 'optional':
265	if ( ! isset( $new_post[ $field['name'] ] ) ) {
266	break;
267	}
268	if ( 'category' === strtok( $field['input_type'], '-' ) ) {
269	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
270	} elseif ( 'rating' === $field['input_type'] ) {
271	$testimonial_meta[ $field['name'] ] = $new_post[ $field['name'] ];
272	} else {
273	$testimonial_meta[ $field['name'] ] = sanitize_text_field( $new_post[ $field['name'] ] );
274	}
275	break;
276
277	default:
278	}
279	}
280	}
281
282	/**
283	* No missing required fields, carry on.
284	*/
285	if ( ! count( $form_errors ) ) {
286
287	// Special handling: if post_title is not required, create one from post_content
288	if ( ! isset( $testimonial_post['post_title'] ) \|\| ! $testimonial_post['post_title'] ) {
289	if ( isset( $testimonial_post['post_content'] ) ) {
290	$words_array = explode( ' ', $testimonial_post['post_content'] );
291	$five_words = array_slice( $words_array, 0, 5 );
292	$testimonial_post['post_title'] = implode( ' ', $five_words );
293	} else {
294	$testimonial_post['post_title'] = esc_html__( '(no title)', 'strong-testimonials' );
295	$testimonial_post['post_content'] = '';
296	}
297	}
298
299	/**
300	* Validate image attachments and store WP error messages.
301	*/
302	/*
303	* $_FILES = Array
304	* (
305	* [featured_image] => Array
306	* (
307	* [name] => Screenshot.png
308	* [type] => image/png
309	* [tmp_name] => C:\wamp64\tmp\php7EA4.tmp
310	* [error] => 0
311	* [size] => 615273
312	* )
313	* )
314	*/
315	foreach ( $testimonial_att as $name => $atts ) {
316	if ( isset( $_FILES[ $name ] ) && isset( $_FILES[ $name ]['size'] ) && $_FILES[ $name ]['size'] > 1 ) {
317	$file = $_FILES[ $name ]; // phpcs:ignore sanitized under
318
319	// Upload file
320	$overrides = array( 'test_form' => false );
321	$uploaded_file = $this->handle_upload( $file, $overrides );
322	/*
323	* $uploaded_file = Array
324	* (
325	* [file] => string 'M:\wp\strong\site/wp-content/uploads/Lotus8.jpg'
326	* [url] => string 'http://strong.dev/wp-content/uploads/Lotus8.jpg'
327	* [type] => string 'image/jpeg'
328	* )
329	*/
330	if ( isset( $uploaded_file['error'] ) ) {
331	$form_errors[ $name ] = $uploaded_file['error'];
332	break;
333	} else {
334	// Create an attachment
335	$attachment = array(
336	'post_title' => sanitize_file_name( wp_unslash( $file['name'] ) ),
337	'post_content' => '',
338	'post_type' => 'attachment',
339	'post_parent' => null, // populated after inserting post
340	'post_mime_type' => sanitize_text_field( $file['type'] ),
341	'guid' => $uploaded_file['url'],
342	);
343
344	$testimonial_att[ $name ]['attachment'] = $attachment;
345	$testimonial_att[ $name ]['uploaded_file'] = $uploaded_file;
346	}
347	}
348	}
349	}
350
351	/**
352	* No faulty uploads, carry on.
353	*/
354	if ( ! count( $form_errors ) ) {
355
356	// create new testimonial post
357	$testimonial_id = wp_insert_post( apply_filters( 'wpmtst_new_testimonial_post', $testimonial_post ) );
358
359	if ( is_wp_error( $testimonial_id ) ) {
360
361	// TODO report errors in admin
362	$form_errors['post'] = $form_options['messages']['submission-error']['text'];
363	} else {
364	$testimonial_post['id'] = $testimonial_id;
365
366	/**
367	* Add categories.
368	*
369	* @since 2.17.0 Handle arrays (if using checklist) or strings (if using <select>).
370	* @since 2.19.1 Storing default category (as set in view) in separate hidden field.
371	*/
372
373	if ( $new_post['default_category'] ) {
374	$testimonial_cats = explode( ',', $new_post['default_category'] );
375	}
376
377	if ( $new_post['category'] ) {
378	if ( is_string( $new_post['category'] ) ) {
379	$new_post['category'] = explode( ',', $new_post['category'] );
380	}
381	$testimonial_cats = array_merge( $testimonial_cats, $new_post['category'] );
382	}
383
384	$testimonial_cats = array_map( 'intval', array_unique( $testimonial_cats ) );
385
386	if ( array_filter( $testimonial_cats ) ) {
387	$category_success = wp_set_object_terms( $testimonial_id, $testimonial_cats, 'wpm-testimonial-category' );
388
389	if ( ! $category_success ) {
390	// TODO improve error handling
391	}
392	}
393
394	// save submit date
395	$testimonial_meta['submit_date'] = current_time( 'mysql' );
396
397	/**
398	* Save custom fields.
399	*
400	* @since 2.17.0 Exclude categories.
401	*/
402	$new_meta = array_diff_key( $testimonial_meta, array( 'category' => '' ) );
403	$new_meta = apply_filters( 'wpmtst_new_testimonial_meta', $new_meta );
404	foreach ( $new_meta as $key => $field ) {
405	add_post_meta( $testimonial_id, $key, $field );
406	}
407
408	// save attachments
409	$testimonial_att = apply_filters( 'wpmtst_new_testimonial_attachments', $testimonial_att );
410	foreach ( $testimonial_att as $name => $atts ) {
411	if ( isset( $atts['attachment'] ) ) {
412	$atts['attachment']['post_parent'] = $testimonial_id;
413	$attach_id = wp_insert_attachment( $atts['attachment'], $atts['uploaded_file']['file'], $testimonial_id );
414	$attach_data = wp_generate_attachment_metadata( $attach_id, $atts['uploaded_file']['file'] );
415	$result = wp_update_attachment_metadata( $attach_id, $attach_data );
416	add_post_meta( $testimonial_id, $name, $atts['uploaded_file']['url'] );
417	if ( 'featured_image' === $atts['field'] ) {
418	set_post_thumbnail( $testimonial_id, $attach_id );
419	}
420	}
421	}
422	}
423	}
424
425	remove_filter( 'upload_mimes', array( $this, 'restrict_mime' ) );
426
427	/**
428	* Post inserted successfully, carry on.
429	*/
430	$form_values = array_merge( $testimonial_post, $testimonial_meta );
431
432	ksort( $testimonial_post );
433	ksort( $testimonial_meta );
434	do_action( 'wpmtst_new_testimonial_added', $testimonial_post, $testimonial_meta, $testimonial_cats, $testimonial_att );
435
436	if ( ! count( $form_errors ) ) {
437	// Clear saved form data and errors.
438	$this->set_form_values( null );
439	$this->set_form_errors( null );
440	$this->notify_admin( $form_values, $form_name );
441	do_action( 'wpmtst_new_testimonial_submit', $form_values, $form_name );
442
443	return true;
444	}
445
446	// Redisplay form with submitted values and error messages.
447	$this->set_form_values( stripslashes_deep( $form_values ) );
448	$this->set_form_errors( $form_errors );
449
450	return false;
451	}
452
453	/**
454	* Restrict MIME types for security reasons.
455	*
456	* @param $mimes
457	*
458	* @return array
459	*/
460	public function restrict_mime( $mimes ) {
461	$mimes = array(
462	'jpg\|jpeg\|jpe' => 'image/jpeg',
463	'gif' => 'image/gif',
464	'png' => 'image/png',
465	);
466
467	return $mimes;
468	}
469
470	/**
471	* File upload handler
472	*
473	* @param $file_handler
474	* @param $overrides
475	*
476	* @return array
477	*/
478	public function handle_upload( $file_handler, $overrides ) {
479	require_once ABSPATH . 'wp-admin/includes/image.php';
480	require_once ABSPATH . 'wp-admin/includes/file.php';
481	require_once ABSPATH . 'wp-admin/includes/media.php';
482
483	$upload = wp_handle_upload( $file_handler, $overrides );
484
485	return $upload;
486	}
487
488	/**
489	* Send notification email upon testimonial submission.
490	*
491	* @param array $post
492	* @param string $form_name
493	*
494	* @since 1.7.0
495	* @since 2.30.6 Using all form fields (Multiple Forms add-on).
496	* Adding submit_date.
497	* Trimming subject and message strings.
498	*/
499	public function notify_admin( $post, $form_name = 'custom' ) {
500
501	$form_options = apply_filters( 'wpmtst_notify_admin_form_options', get_option( 'wpmtst_form_options' ), $post, $form_name );
502
503	if ( ! $form_options['admin_notify'] ) {
504	return;
505	}
506
507	$post['has_image'] = has_post_thumbnail( $post['id'] );
508	$fields = wpmtst_get_all_fields();
509
510	if ( $form_options['sender_site_email'] ) {
511	$sender_email = get_bloginfo( 'admin_email' );
512	} else {
513	$sender_email = $form_options['sender_email'];
514	}
515
516	// Subject line
517	$subject = trim( $form_options['email_subject'] );
518	$subject = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $subject );
519	$subject = str_replace( '%TITLE%', $post['post_title'], $subject );
520	$subject = str_replace( '%STATUS%', $post['post_status'], $subject );
521	$subject = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $subject );
522	$subject = $this->replace_custom_fields( $subject, $fields, $post );
523
524	// Message text
525	$message = rtrim( $form_options['email_message'] );
526	$message = str_replace( '%BLOGNAME%', get_bloginfo( 'name' ), $message );
527	$message = str_replace( '%TITLE%', $post['post_title'], $message );
528	$message = str_replace( '%CONTENT%', $post['post_content'], $message );
529	$message = str_replace( '%STATUS%', $post['post_status'], $message );
530	$message = str_replace( '%SUBMIT_DATE%', $post['submit_date'], $message );
531	$message = $this->replace_custom_fields( $message, $fields, $post );
532
533	foreach ( $form_options['recipients'] as $recipient ) {
534	if ( isset( $recipient['admin_site_email'] ) && $recipient['admin_site_email'] ) {
535	$admin_email = get_bloginfo( 'admin_email' );
536	} else {
537	$admin_email = $recipient['admin_email'];
538	}
539
540	// Mandrill rejects the 'name <email>' format
541	if ( $recipient['admin_name'] && ! $form_options['mail_queue'] ) {
542	$to = sprintf( '%s <%s>', $recipient['admin_name'], $admin_email );
543	} else {
544	$to = sprintf( '%s', $admin_email );
545	}
546
547	// Headers
548	$headers = 'Content-Type: text/html; charset="' . get_option( 'blog_charset' ) . '"' . "\n";
549	if ( $form_options['sender_name'] ) {
550	$headers .= sprintf( 'From: %s <%s>', $form_options['sender_name'], $sender_email ) . "\n";
551	} else {
552	$headers .= sprintf( 'From: %s', $sender_email ) . "\n";
553	}
554
555	$email = array(
556	'to' => $to,
557	'subject' => $subject,
558	'message' => $message,
559	'headers' => $headers,
560	);
561
562	if ( $form_options['mail_queue'] ) {
563	WPMST()->mail->enqueue_mail( $email );
564	} else {
565	WPMST()->mail->send_mail( $email );
566	}
567	} // for each recipient
568	}
569
570	/**
571	* Replace tags for custom fields.
572	*
573	* @param $text
574	* @param $fields
575	* @param $post
576	*
577	* @return string
578	*/
579	public static function replace_custom_fields( $text, $fields, $post ) {
580	foreach ( $fields as $field ) {
581	$replace = "({$field['label']} blank)";
582	$post_field = isset( $post[ $field['name'] ] ) ? $post[ $field['name'] ] : false;
583
584	if ( $post_field ) {
585	if ( 'category' === $field['name'] ) {
586	$term = get_term( $post_field, 'wpm-testimonial-category' );
587	if ( $term && ! is_wp_error( $term ) ) {
588	$replace = $term->name;
589	}
590	} elseif ( 'rating' === $field['input_type'] ) {
591	$replace = $post_field . ' ' . _n( 'star', 'stars', $post_field, 'strong-testimonials' );
592	} elseif ( 'checkbox' === $field['input_type'] ) {
593	$replace = $post_field ? 'yes' : 'no';
594	} else {
595	$replace = $post_field;
596	}
597	}
598
599	$replace = apply_filters( 'wpmtst_notification_custom_field_value', $replace, $field, $post );
600	$field_tag = '%' . strtoupper( $field['name'] ) . '%';
601	$text = str_replace( $field_tag, $replace, $text );
602	}
603
604	return $text;
605	}
606
607	private function is_form_in_any_view( $form_id ) {
608	$views = wpmtst_get_views();
609
610	if ( empty( $views ) ) {
611	return false;
612	}
613
614	foreach ( $views as $view ) {
615	if ( empty( $view['value'] ) ) {
616	continue;
617	}
618
619	$form_view = maybe_unserialize( $view['value'] );
620
621	if ( is_array( $form_view ) && isset( $form_view['form_id'] ) && absint( $form_view['form_id'] ) === absint( $form_id ) ) {
622	return true;
623	}
624	}
625
626	return false;
627	}
628	}
629