← All changes | inc/generate-form-markup.php +101 -36 2.12.5 → 2.12.8 View file →

		@@ -24,8 +24,16 @@
24	24	class Generate_Form_Markup {
25	25	use Get_Instance;
26	26
27	27	/**
	28	+ * Query arg marking an editor visit as arriving from the front-end "Edit Form"
	29	+ * pill, so the click can be attributed without any front-end JavaScript.
	30	+ *
	31	+ * @since 2.12.6
	32	+ */
	33	+ public const EDIT_FORM_BUTTON_SOURCE_ARG = 'srfm_edit_src';
	34	+
	35	+ /**
28	36	* Current block attributes for the form being rendered.
29	37	* Used by child blocks (like inline button) to access parent form's embed styling.
30	38	*
31	39	* @var array<string,mixed>
		@@ -530,11 +538,30 @@
530	538	}
531	539	}
532	540	}
533	541
534		- $page_break_settings = defined( 'SRFM_PRO_VER' ) && apply_filters( 'srfm_use_page_break_layout', true ) ? get_post_meta( $id, '_srfm_page_break_settings', true ) : [];
535		- $page_break_settings = ! empty( $page_break_settings ) && is_array( $page_break_settings ) ? $page_break_settings : [];
536		- $is_page_break = ! empty( $page_break_settings ) ? $page_break_settings['is_page_break'] : false;
	542	+ $page_break_settings = defined( 'SRFM_PRO_VER' ) && apply_filters( 'srfm_use_page_break_layout', true ) ? get_post_meta( $id, '_srfm_page_break_settings', true ) : [];
	543	+ $page_break_settings = ! empty( $page_break_settings ) && is_array( $page_break_settings ) ? $page_break_settings : [];
	544	+ $is_page_break = ! empty( $page_break_settings ) ? $page_break_settings['is_page_break'] : false;
	545	+ // Auto-advance is read here rather than in Pro's button renderer because
	546	+ // save & resume replaces that whole container through the
	547	+ // srfm_page_break_buttons_html filter, which would drop the attributes.
	548	+ // The form tag is rendered exactly once and is already how both step
	549	+ // runtimes receive their per-form settings (form-id, ajaxurl,
	550	+ // data-submit-token).
	551	+ //
	552	+ // Two stored settings rather than one because the two layouts are
	553	+ // mutually exclusive: Pro filters srfm_use_page_break_layout to false
	554	+ // when the conversational layout is on, so $page_break_settings is
	555	+ // empty there and its editor panel is hidden. Each layout keeps the
	556	+ // toggle with the rest of its own settings, and only one can apply.
	557	+ $conversational_settings = defined( 'SRFM_PRO_VER' ) ? get_post_meta( $id, '_srfm_conversational_form', true ) : [];
	558	+ $conversational_settings = ! empty( $conversational_settings ) && is_array( $conversational_settings ) ? $conversational_settings : [];
	559	+ $is_conversational = ! empty( $conversational_settings['is_cf_enabled'] );
	560	+ $active_step_settings = $is_conversational ? $conversational_settings : ( $is_page_break ? $page_break_settings : [] );
	561	+ $auto_advance_key = $is_conversational ? 'cf_auto_advance' : 'auto_advance';
	562	+ $auto_advance = ! empty( $active_step_settings[ $auto_advance_key ] );
	563	+ $auto_advance_hide_next = $auto_advance && ! empty( $active_step_settings[ $auto_advance_key . '_hide_next' ] );
537	564	$page_break_progress_type = ! empty( $page_break_settings ) ? $page_break_settings['progress_indicator_type'] : 'none';
538	565	$form_confirmation = get_post_meta( $id, '_srfm_form_confirmation' );
539	566	$confirmation_type = '';
540	567	$submission_action = '';
		@@ -854,12 +881,25 @@
854	881	self::$current_block_attrs = [];
855	882	return ob_get_clean();
856	883	}
857	884	$submit_token = Submit_Token::generate( (int) $id );
	885	+ // Separately namespaced from the submission token: this one is only good
	886	+ // for incrementing a view counter, so scraping it from the page buys an
	887	+ // attacker nothing beyond what the beacon already does, and it cannot be
	888	+ // replayed against the submit endpoint.
	889	+ $view_token = Submit_Token::generate( (int) $id, Submit_Token::NAMESPACE_VIEW );
858	890
	891	+ // Admin-only shortcut into the form editor. Emitted here, immediately
	892	+ // above the <form>, so it occupies its own row in normal flow and can
	893	+ // never overlap a field. Already inside the `.srfm-form-container`
	894	+ // branch, so a zero-block form (no container) never reaches here and
	895	+ // cannot emit an orphaned pill. Works for every embed method (block,
	896	+ // shortcode, widget) because they all render through this function.
	897	+ self::render_edit_form_button( (int) $id );
	898	+
859	899	?>
860	900	<form method="post" enctype="multipart/form-data" id="srfm-form-<?php echo esc_attr( Helper::get_string_value( $id ) ); ?>" class="srfm-form <?php echo esc_attr( 'sureforms_form' === $post_type ? 'srfm-single-form ' : '' ); ?>"
861		- form-id="<?php echo esc_attr( Helper::get_string_value( $id ) ); ?>" after-submission="<?php echo esc_attr( $submission_action ); ?>" message-type="<?php echo esc_attr( $confirmation_type ? $confirmation_type : 'same page' ); ?>" success-url="<?php echo esc_attr( $success_url ? $success_url : '' ); ?>" ajaxurl="<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>" data-submit-token="<?php echo esc_attr( $submit_token ); ?>"
	901	+ form-id="<?php echo esc_attr( Helper::get_string_value( $id ) ); ?>" after-submission="<?php echo esc_attr( $submission_action ); ?>" message-type="<?php echo esc_attr( $confirmation_type ? $confirmation_type : 'same page' ); ?>" success-url="<?php echo esc_attr( $success_url ? $success_url : '' ); ?>" ajaxurl="<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>" data-submit-token="<?php echo esc_attr( $submit_token ); ?>" data-view-token="<?php echo esc_attr( $view_token ); ?>"<?php echo $auto_advance ? ' data-srfm-auto-advance="1"' : ''; ?><?php echo $auto_advance_hide_next ? ' data-srfm-hide-next="1"' : ''; ?>
862	902	>
863	903	<?php
864	904	// Submission security is handled via the HMAC token in data-submit-token.
865	905	$global_setting_options = get_option( 'srfm_security_settings_options' );
		@@ -979,20 +1019,8 @@
979	1019	<div class="srfm-single-form srfm-success-box in-page">
980	1020	<div aria-live="polite" aria-atomic="true" role="alert" id="srfm-success-message-page-<?php echo esc_attr( Helper::get_string_value( $id ) ); ?>" class="srfm-success-box-description"></div>
981	1021	</div>
982	1022	<?php
983		- // Admin-only shortcut into the form editor, overlaid at the top-right of
984		- // the embedded form. Rendered only for users who can edit THIS form, so
985		- // it is fully absent from the DOM for everyone else and, being absolutely
986		- // positioned, never affects the layout or submission for regular
987		- // visitors. Works for every embed method (block, shortcode, widget)
988		- // because they all render through this function. Gated on the same
989		- // condition as the `.srfm-form-container` open above, so a zero-block
990		- // form (no container) never emits an orphaned, unpositioned pill.
991		- if ( '' !== $id && 0 !== $block_count ) {
992		- self::render_edit_form_button( (int) $id );
993		- }
994		-
995	1023	// Add preview script for real-time styling updates from block editor.
996	1024	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a preview context, nonce not required.
997	1025	if ( isset( $_GET['form_preview'] ) && 'true' === $_GET['form_preview'] && isset( $container_id ) ) {
998	1026	self::enqueue_preview_styling_script( $container_id );
		@@ -1329,12 +1357,21 @@
1329	1357
1330	1358	/**
1331	1359	* Print the admin-only "Edit Form" shortcut on an embedded form.
1332	1360	*
1333		- * Renders a small pill link overlaid at the top-right of the form container
1334		- * (Elementor/Beaver-Builder style) that opens the block editor for this form.
1335		- * Being absolutely positioned, it never affects the form's layout.
	1361	+ * Renders a small pill link that opens the block editor for this form, on its
	1362	+ * own right-aligned row directly above the form.
1336	1363	*
	1364	+ * It sits in normal flow rather than being absolutely positioned over the
	1365	+ * form's top-right corner, which is what it used to do. An overlay can only
	1366	+ * avoid the fields when the container happens to have enough top padding —
	1367	+ * with the default theme styling it landed on top of the first row's last
	1368	+ * field (#3062). Flow layout cannot overlap anything by construction, at any
	1369	+ * width, with any theme. The cost is that the form shifts down by the pill's
	1370	+ * height, which happens only for users who can edit the form; the markup and
	1371	+ * its styles remain entirely absent from the DOM for everyone else, so no
	1372	+ * regular visitor sees a layout change.
	1373	+ *
1337	1374	* Admin-only by construction: the `sureforms_form` CPT registers with
1338	1375	* `map_meta_cap => false`, so `edit_post` collapses to a blanket
1339	1376	* `manage_options` check with no per-post component — an editor never sees the
1340	1377	* pill on any form. For every other viewer the markup and its styles are
		@@ -1389,9 +1426,23 @@
1389	1426	}
1390	1427
1391	1428	// Page-builder editor canvases render the form directly (not over REST),
1392	1429	// where their own element-edit handles would collide with the pill.
1393		- if ( class_exists( '\Elementor\Plugin' ) && \Elementor\Plugin::$instance->editor->is_edit_mode() ) {
	1430	+ // `$instance` is checked as well as the class name: Elementor declares
	1431	+ // `public static $instance = null` and only populates it on boot, so the
	1432	+ // class can exist while the singleton is still null. Dereferencing it then
	1433	+ // is a fatal Error, not a warning, and guarding only on class_exists() left
	1434	+ // that reachable — test-generate-form-markup.php hit it. The bundled stub
	1435	+ // types $instance as non-nullable, which is why PHPStan reads the isset()
	1436	+ // as redundant and has to be told otherwise.
	1437	+ //
	1438	+ // ->editor is checked for the same reason one level down: Elementor assigns it
	1439	+ // in init_components() on `init`, while the singleton itself is created on
	1440	+ // `plugins_loaded`. Between those two hooks $instance is set and ->editor is
	1441	+ // still null, so checking only the singleton reproduces the original fatal a
	1442	+ // property later.
	1443	+ // @phpstan-ignore-next-line -- Stub disagrees with runtime; see above.
	1444	+ if ( class_exists( '\Elementor\Plugin' ) && isset( \Elementor\Plugin::$instance->editor ) && \Elementor\Plugin::$instance->editor->is_edit_mode() ) {
1394	1445	return;
1395	1446	}
1396	1447	if ( function_exists( 'bricks_is_builder' ) && bricks_is_builder() ) {
1397	1448	return;
		@@ -1408,14 +1459,24 @@
1408	1459	if ( ! apply_filters( 'srfm_show_edit_form_button', true, $form_id ) ) {
1409	1460	return;
1410	1461	}
1411	1462
1412		- $edit_link = get_edit_post_link( $form_id );
	1463	+ $edit_link = get_edit_post_link( $form_id, 'raw' );
1413	1464
1414	1465	if ( empty( $edit_link ) ) {
1415	1466	return;
1416	1467	}
1417	1468
	1469	+ // Attribution marker read back by Admin::maybe_track_edit_form_button_click()
	1470	+ // when the editor loads. Added before the filter below so an integration that
	1471	+ // replaces the link wholesale drops the marker with it, rather than having our
	1472	+ // query arg appended to a third-party URL.
	1473	+ // 'url' context, not the default 'display': the latter returns &amp;-escaped
	1474	+ // separators, and feeding those to add_query_arg() only round-trips because
	1475	+ // build_query() happens to re-emit the mangled `amp;action` key verbatim. The
	1476	+ // raw form has no such dependency, and esc_url() below still escapes on output.
	1477	+ $edit_link = add_query_arg( self::EDIT_FORM_BUTTON_SOURCE_ARG, 'embed', $edit_link );
	1478	+
1418	1479	/**
1419	1480	* Filter the target of the admin "Edit Form" shortcut.
1420	1481	*
1421	1482	* @param string $edit_link Editor URL for the form.
		@@ -1438,13 +1499,15 @@
1438	1499	wp_add_inline_style( $style_handle, self::get_edit_form_button_css() );
1439	1500	}
1440	1501	wp_enqueue_style( $style_handle );
1441	1502	?>
1442		- <a class="srfm-edit-form-btn" href="<?php echo esc_url( $edit_link ); ?>" target="_blank" rel="noopener noreferrer">
1443		- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"></path><path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4Z"></path></svg>
1444		- <span><?php esc_html_e( 'Edit Form', 'sureforms' ); ?></span>
1445		- <span class="screen-reader-text"><?php esc_html_e( '(opens in a new tab)', 'sureforms' ); ?></span>
1446		- </a>
	1503	+ <div class="srfm-edit-form-btn-wrap">
	1504	+ <a class="srfm-edit-form-btn" href="<?php echo esc_url( $edit_link ); ?>" target="_blank" rel="noopener noreferrer">
	1505	+ <svg width="20" height="20" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"></path><path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4Z"></path></svg>
	1506	+ <span><?php esc_html_e( 'Edit Form', 'sureforms' ); ?></span>
	1507	+ <span class="screen-reader-text"><?php esc_html_e( '(opens in a new tab)', 'sureforms' ); ?></span>
	1508	+ </a>
	1509	+ </div>
1447	1510	<?php
1448	1511	}
1449	1512
1450	1513	/**
		@@ -1449,25 +1512,27 @@
1449	1512
1450	1513	/**
1451	1514	* Stylesheet for the admin "Edit Form" pill (#3029).
1452	1515	*
1453		- * `position: relative` on the container is scoped to the `srfm-styling-none`
1454		- * case: with default styling on, the shipped CSS already sets it, so a global
1455		- * rule here would only risk overriding a site that deliberately set it static.
1456		- * Offsets use a small positive inset (`inset-inline-end`) so the pill sits
1457		- * inside the box — no mobile horizontal overflow — and is RTL-correct.
	1516	+ * The wrapper is a flow-level flex row rather than an absolute overlay, so the
	1517	+ * pill reserves its own space and cannot cover a field (#3062). `justify-content`
	1518	+ * uses the logical `flex-end`, which follows the writing direction and is
	1519	+ * therefore RTL-correct without a separate rule.
1458	1520	*
	1521	+ * No `position: relative` on the container any more: that rule existed solely to
	1522	+ * be the positioning context for the old overlay.
	1523	+ *
1459	1524	* @return string
1460	1525	* @since 2.12.4
1461	1526	*/
1462	1527	private static function get_edit_form_button_css() {
1463	1528	return '
1464		- .srfm-form-container.srfm-styling-none { position: relative; }
	1529	+ .srfm-edit-form-btn-wrap {
	1530	+ display: flex;
	1531	+ justify-content: flex-end;
	1532	+ margin-block-end: 8px;
	1533	+ }
1465	1534	.srfm-edit-form-btn {
1466		- position: absolute;
1467		- top: 8px;
1468		- inset-inline-end: 8px;
1469		- z-index: 5;
1470	1535	display: inline-flex;
1471	1536	align-items: center;
1472	1537	gap: 6px;
1473	1538	padding: 6px 12px;