| @@ -79,17 +79,9 @@ | ||
| 79 | 79 | foreach ( $post_ids as $post_id ) { |
| 80 | 80 | $post_id = intval( $post_id ); |
| 81 | 81 | $post = get_post( $post_id ); |
| 82 | 82 | $post_meta = get_post_meta( $post_id ); |
| 83 | - | |
| 84 | - // The view counter belongs to this site's traffic, not to the form. These | |
| 85 | - // payloads feed shared starter templates, so shipping it would hand every | |
| 86 | - // importer a stranger's numbers. The import side already refuses the key, | |
| 87 | - // so this is about not exporting it in the first place. | |
| 88 | - if ( is_array( $post_meta ) ) { | |
| 89 | - unset( $post_meta[ \SRFM\Inc\Form_Views::META_KEY ] ); | |
| 90 | - } | |
| 91 | - $posts[] = [ | |
| 83 | + $posts[] = [ | |
| 92 | 84 | 'post' => $post, |
| 93 | 85 | 'post_meta' => $post_meta, |
| 94 | 86 | ]; |
| 95 | 87 | } |
| @@ -247,23 +239,10 @@ | ||
| 247 | 239 | $post_title = sanitize_text_field( $form_data['post']['post_title'] ); |
| 248 | 240 | $post_meta = $form_data['post_meta']; |
| 249 | 241 | $post_type = sanitize_text_field( $form_data['post']['post_type'] ); |
| 250 | 242 | |
| 251 | - // Remove percent-encoded slugs from imported form content. | |
| 252 | - // Non-Latin labels produce broken slugs like %e3%83%95%e3%83%aa | |
| 253 | - // via sanitize_title(). Clearing them lets process_blocks() | |
| 254 | - // regenerate clean block-name-based slugs on save. | |
| 255 | - $cleaned_content = preg_replace( | |
| 256 | - '/"slug":"(%[a-fA-F0-9]{2}[^"]*)"/', | |
| 257 | - '"slug":""', | |
| 258 | - $post_content | |
| 259 | - ); | |
| 260 | - if ( is_string( $cleaned_content ) ) { | |
| 261 | - $post_content = $cleaned_content; | |
| 262 | - } | |
| 243 | + $post_content = addslashes( $post_content ); | |
| 263 | 244 | |
| 264 | - $post_content = wp_slash( $post_content ); | |
| 265 | - | |
| 266 | 245 | // Check if sureforms/form exists in post_content. |
| 267 | 246 | if ( 'sureforms_form' === $post_type ) { |
| 268 | 247 | $new_post = [ |
| 269 | 248 | 'post_title' => $post_title, |
| @@ -294,39 +273,18 @@ | ||
| 294 | 273 | |
| 295 | 274 | $forms_mapping[ $old_id ] = $post_id; |
| 296 | 275 | |
| 297 | 276 | // Update post meta. |
| 298 | - $allowed_keys = $this->get_allowed_import_meta_keys(); | |
| 299 | - $unserialized_meta_keys = $this->get_unserialized_post_metas(); | |
| 300 | - $registered = get_registered_meta_keys( 'post', SRFM_FORMS_POST_TYPE ); | |
| 301 | 277 | foreach ( $post_meta as $meta_key => $meta_value ) { |
| 302 | - // 1. Whitelist check — skip unknown keys from crafted import files. | |
| 303 | - if ( ! in_array( $meta_key, $allowed_keys, true ) ) { | |
| 304 | - continue; | |
| 305 | - } | |
| 306 | - | |
| 307 | - // Note: add_post_meta() internally runs wp_unslash() on the value before | |
| 308 | - // invoking the registered sanitize_callback. Imported values are unslashed, | |
| 309 | - // so without re-slashing, backslashes are stripped — corrupting JSON-string | |
| 310 | - // metas (e.g. _srfm_save_resume, _srfm_conditional_confirmation) whose escaped | |
| 311 | - // quotes (\") then fail json_decode() in their sanitizers, wiping the value to | |
| 312 | - // an empty string. wp_slash() pre-escapes so wp_unslash() restores the original. | |
| 313 | - if ( in_array( $meta_key, $unserialized_meta_keys, true ) ) { | |
| 314 | - // Complex array metas — sanitize_callback registered via register_post_meta() | |
| 315 | - // is automatically invoked by add_post_meta() → update_metadata() pipeline. | |
| 316 | - // When Pro is inactive, some keys may lack a registered callback — apply fallback. | |
| 317 | - if ( empty( $registered[ $meta_key ]['sanitize_callback'] ) ) { | |
| 318 | - $meta_value = Helper::sanitize_by_type( $meta_value ); | |
| 319 | - } | |
| 320 | - add_post_meta( $post_id, $meta_key, wp_slash( $meta_value ) ); | |
| 278 | + // Check if the meta key is one of the unserialized post metas then add it as is. | |
| 279 | + if ( in_array( $meta_key, $this->get_unserialized_post_metas(), true ) ) { | |
| 280 | + add_post_meta( $post_id, $meta_key, $meta_value ); | |
| 321 | 281 | } else { |
| 322 | - // Scalar metas — unwrap single-element arrays produced by get_post_meta(). | |
| 323 | - $raw_value = is_array( $meta_value ) && isset( $meta_value[0] ) ? $meta_value[0] : $meta_value; | |
| 324 | - // Fallback sanitization — skip when a registered callback already handles it. | |
| 325 | - if ( is_string( $raw_value ) && empty( $registered[ $meta_key ]['sanitize_callback'] ) ) { | |
| 326 | - $raw_value = sanitize_text_field( $raw_value ); | |
| 282 | + if ( is_array( $meta_value ) && isset( $meta_value[0] ) ) { | |
| 283 | + add_post_meta( $post_id, $meta_key, $meta_value[0] ); | |
| 284 | + } else { | |
| 285 | + add_post_meta( $post_id, $meta_key, $meta_value ); | |
| 327 | 286 | } |
| 328 | - add_post_meta( $post_id, $meta_key, wp_slash( $raw_value ) ); | |
| 329 | 287 | } |
| 330 | 288 | } |
| 331 | 289 | } else { |
| 332 | 290 | return new \WP_Error( 'import_forms_invalid_post_type', __( 'Unable to import form.', 'sureforms' ) ); |
| @@ -333,64 +291,7 @@ | ||
| 333 | 291 | } |
| 334 | 292 | } |
| 335 | 293 | |
| 336 | 294 | return $forms_mapping; |
| 337 | - } | |
| 338 | - | |
| 339 | - /** | |
| 340 | - * Get the list of meta keys allowed during import. | |
| 341 | - * | |
| 342 | - * Only meta keys present in this list will be written to the DB during import. | |
| 343 | - * Unknown keys from crafted import files are silently ignored. | |
| 344 | - * | |
| 345 | - * @since 2.8.0 | |
| 346 | - * @return array<string> | |
| 347 | - */ | |
| 348 | - private function get_allowed_import_meta_keys(): array { | |
| 349 | - $scalar_metas = [ | |
| 350 | - '_srfm_additional_classes', | |
| 351 | - '_srfm_bg_color', | |
| 352 | - '_srfm_bg_image', | |
| 353 | - '_srfm_bg_type', | |
| 354 | - '_srfm_button_border_radius', | |
| 355 | - '_srfm_captcha_security_type', | |
| 356 | - '_srfm_cover_image', | |
| 357 | - '_srfm_form_container_width', | |
| 358 | - '_srfm_form_custom_css', | |
| 359 | - '_srfm_form_recaptcha', | |
| 360 | - '_srfm_form_restriction', | |
| 361 | - '_srfm_inherit_theme_button', | |
| 362 | - '_srfm_instant_form', | |
| 363 | - '_srfm_is_ai_generated', | |
| 364 | - '_srfm_is_inline_button', | |
| 365 | - '_srfm_single_page_form_title', | |
| 366 | - '_srfm_submit_alignment', | |
| 367 | - '_srfm_submit_alignment_backend', | |
| 368 | - '_srfm_submit_button_text', | |
| 369 | - '_srfm_submit_type', | |
| 370 | - '_srfm_submit_width', | |
| 371 | - '_srfm_submit_width_backend', | |
| 372 | - '_srfm_use_label_as_placeholder', | |
| 373 | - ]; | |
| 374 | - | |
| 375 | - /** | |
| 376 | - * Filter the list of scalar meta keys allowed during import. | |
| 377 | - * | |
| 378 | - * Pro and other extensions can hook into this to add their own scalar meta keys. | |
| 379 | - * | |
| 380 | - * @since 2.8.0 | |
| 381 | - * @param array<string> $scalar_metas List of scalar meta keys. | |
| 382 | - */ | |
| 383 | - $scalar_metas = apply_filters( 'srfm_import_scalar_meta_keys', $scalar_metas ); | |
| 384 | - | |
| 385 | - // Ensure filter consumers cannot inject non-SureForms meta keys. | |
| 386 | - $scalar_metas = array_filter( | |
| 387 | - $scalar_metas, | |
| 388 | - static function ( $key ) { | |
| 389 | - return str_starts_with( $key, '_srfm_' ); | |
| 390 | - } | |
| 391 | - ); | |
| 392 | - | |
| 393 | - return array_merge( $this->get_unserialized_post_metas(), $scalar_metas ); | |
| 394 | 295 | } |
| 395 | 296 | |
| 396 | 297 | } |
