suredonation / inc / duplicate-form.php

duplicate-form.php in SureDonation – Donation Forms, Fundraising Campaigns & Donor Management trunk, at inc/duplicate-form.php

223 lines 6.3 KB

Raw Download Zip

1	<?php
2	/**
3	* SureDonation form duplication.
4	*
5	* @package SureDonation
6	* @since 0.0.1
7	*/
8
9	namespace SureDonation\Inc;
10
11	use SureDonation\Inc\Post_Types\Donation_Form;
12	use SureDonation\Inc\Traits\Get_Instance;
13
14	// Exit if accessed directly.
15	if ( ! defined( 'ABSPATH' ) ) {
16	exit;
17	}
18
19	/**
20	* Duplicate Form Class.
21	*
22	* @since 0.0.1
23	*/
24	class Duplicate_Form {
25	use Get_Instance;
26
27	/**
28	* Duplicate a form with all its metadata.
29	*
30	* @param int $form_id Form ID to duplicate.
31	* @param string $title_suffix Suffix to append to title. Default ' (Copy)'.
32	* @return array<string, mixed>\|\WP_Error Result with new form ID or error.
33	* @since 0.0.1
34	*/
35	public function duplicate_form( $form_id, $title_suffix = ' (Copy)' ) {
36	$form_id = intval( $form_id );
37	if ( $form_id <= 0 ) {
38	return new \WP_Error(
39	'invalid_form_id',
40	__( 'Invalid form ID provided.', 'suredonation' ),
41	[ 'status' => 400 ]
42	);
43	}
44
45	$source_form = get_post( $form_id );
46
47	if ( ! $source_form ) {
48	return new \WP_Error(
49	'form_not_found',
50	__( 'Source form not found.', 'suredonation' ),
51	[ 'status' => 404 ]
52	);
53	}
54
55	if ( Donation_Form::POST_TYPE !== $source_form->post_type ) {
56	return new \WP_Error(
57	'invalid_post_type',
58	__( 'The specified post is not a donation form.', 'suredonation' ),
59	[ 'status' => 400 ]
60	);
61	}
62
63	$post_meta = get_post_meta( $form_id );
64	$new_title = $this->generate_unique_title( $source_form->post_title, $title_suffix );
65
66	// wp_insert_post() internally calls wp_unslash() which removes backslashes.
67	// Use wp_slash() to preserve unicode escapes in block attributes.
68	$new_post_args = [
69	'post_title' => $new_title,
70	'post_content' => wp_slash( $source_form->post_content ),
71	'post_status' => 'draft',
72	'post_type' => Donation_Form::POST_TYPE,
73	'post_author' => get_current_user_id(),
74	];
75
76	$new_form_id = wp_insert_post( $new_post_args );
77
78	if ( ! is_int( $new_form_id ) \|\| $new_form_id <= 0 ) {
79	return new \WP_Error(
80	'duplication_failed',
81	__( 'Failed to create duplicate form.', 'suredonation' ),
82	[ 'status' => 500 ]
83	);
84	}
85
86	// Update formId in Gutenberg blocks.
87	$updated_content = $this->update_block_form_ids( $source_form->post_content, $form_id, $new_form_id );
88
89	wp_update_post(
90	[
91	'ID' => $new_form_id,
92	'post_content' => wp_slash( $updated_content ),
93	]
94	);
95
96	// Copy all post meta.
97	if ( is_array( $post_meta ) ) {
98	foreach ( $post_meta as $meta_key => $meta_values ) {
99	if ( ! is_string( $meta_key ) ) {
100	continue;
101	}
102
103	// Skip WordPress internal meta keys.
104	if ( '_edit_lock' === $meta_key \|\| '_edit_last' === $meta_key ) {
105	continue;
106	}
107
108	if ( is_array( $meta_values ) && isset( $meta_values[0] ) ) {
109	$raw_meta_value = $meta_values[0];
110	// The is_serialized() guard preserves maybe_unserialize()'s pass-through for non-serialized values.
111	// Serialized objects are intentionally NOT rehydrated (allowed_classes=false): object-valued meta would
112	// copy as __PHP_Incomplete_Class, but suredonation_form meta is only arrays/scalars/JSON, so none exists.
113	if ( is_serialized( $raw_meta_value ) ) {
114	// allowed_classes=false blocks PHP object injection (CWE-502) when rehydrating copied meta; @ suppresses notices on malformed input.
115	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize, WordPress.PHP.NoSilencedErrors.Discouraged -- hardened native unserialize with class instantiation disabled.
116	$meta_value = @unserialize( $raw_meta_value, [ 'allowed_classes' => false ] );
117	} else {
118	$meta_value = $raw_meta_value;
119	}
120	add_post_meta( $new_form_id, $meta_key, $meta_value );
121	}
122	}
123	}
124
125	/**
126	* Fires after a donation form has been duplicated.
127	*
128	* @param int $new_form_id New form ID.
129	* @param int $form_id Original form ID.
130	* @since 0.0.1
131	*/
132	do_action( 'suredonation_after_form_duplicated', $new_form_id, $form_id );
133
134	$edit_url = admin_url( 'post.php?post=' . $new_form_id . '&action=edit' );
135
136	return [
137	'success' => true,
138	'original_form_id' => $form_id,
139	'new_form_id' => $new_form_id,
140	'new_form_title' => $new_title,
141	'edit_url' => $edit_url,
142	];
143	}
144
145	/**
146	* Handle duplicate form REST API request.
147	*
148	* @param \WP_REST_Request $request Full details about the request.
149	* @return \WP_REST_Response\|\WP_Error Response object on success, or WP_Error on failure.
150	* @since 0.0.1
151	*/
152	public function handle_duplicate_form_rest( $request ) {
153	$form_id = absint( $request->get_param( 'form_id' ) );
154	$title_suffix = sanitize_text_field( $request->get_param( 'title_suffix' ) );
155
156	$result = $this->duplicate_form( $form_id, $title_suffix );
157
158	if ( is_wp_error( $result ) ) {
159	return $result;
160	}
161
162	return new \WP_REST_Response( $result, 200 );
163	}
164
165	/**
166	* Generate unique title by appending suffix.
167	*
168	* @param string $base_title Original form title.
169	* @param string $suffix Suffix to append.
170	* @return string Unique title.
171	* @since 0.0.1
172	*/
173	private function generate_unique_title( $base_title, $suffix = ' (Copy)' ) {
174	$new_title = $base_title . $suffix;
175	$counter = 2;
176
177	while ( $this->title_exists( $new_title ) ) {
178	$new_title = $base_title . $suffix . ' ' . $counter;
179	++$counter;
180	}
181
182	return $new_title;
183	}
184
185	/**
186	* Check if a form title already exists.
187	*
188	* @param string $title Title to check.
189	* @return bool True if title exists.
190	* @since 0.0.1
191	*/
192	private function title_exists( $title ) {
193	global $wpdb;
194
195	$query = $wpdb->prepare(
196	"SELECT ID FROM {$wpdb->posts} WHERE post_title = %s AND post_type = %s AND post_status != 'trash' LIMIT 1",
197	$title,
198	Donation_Form::POST_TYPE
199	);
200
201	$existing = $wpdb->get_var( $query ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
202
203	return ! empty( $existing );
204	}
205
206	/**
207	* Update formId in Gutenberg blocks.
208	*
209	* @param string $content Post content with blocks.
210	* @param int $old_id Original form ID.
211	* @param int $new_id New form ID.
212	* @return string Updated content.
213	* @since 0.0.1
214	*/
215	private function update_block_form_ids( $content, $old_id, $new_id ) {
216	return str_replace(
217	'"formId":' . intval( $old_id ),
218	'"formId":' . intval( $new_id ),
219	$content
220	);
221	}
222	}
223