tablepress / classes / class-export.php

class-export.php in TablePress – Tables in WordPress made easy 2.1.8, at classes/class-export.php

228 lines 6.7 KB

Raw Download Zip

1	<?php
2	/**
3	* TablePress Table Export Class
4	*
5	* @package TablePress
6	* @subpackage Export/Import
7	* @author Tobias Bäthge
8	* @since 1.0.0
9	*/
10
11	// Prohibit direct script loading.
12	defined( 'ABSPATH' ) \|\| die( 'No direct script access allowed!' );
13
14	/**
15	* TablePress Table Export Class
16	*
17	* @package TablePress
18	* @subpackage Export/Import
19	* @author Tobias Bäthge
20	* @since 1.0.0
21	*/
22	class TablePress_Export {
23
24	/**
25	* File/Data Formats that are available for the export.
26	*
27	* @since 1.0.0
28	* @var array
29	*/
30	public $export_formats = array();
31
32	/**
33	* Delimiters for the CSV export.
34	*
35	* @since 1.0.0
36	* @var array
37	*/
38	public $csv_delimiters = array();
39
40	/**
41	* Whether ZIP archive support is available in the PHP installation on the server.
42	*
43	* @since 1.0.0
44	* @var bool
45	*/
46	public $zip_support_available = false;
47
48	/**
49	* Initialize the Export class.
50	*
51	* @since 1.0.0
52	*/
53	public function __construct() {
54	// Initiate here, because function call not possible outside a class method.
55	$this->export_formats = array(
56	'csv' => __( 'CSV - Character-Separated Values', 'tablepress' ),
57	'html' => __( 'HTML - Hypertext Markup Language', 'tablepress' ),
58	'json' => __( 'JSON - JavaScript Object Notation', 'tablepress' ),
59	);
60	$this->csv_delimiters = array(
61	';' => __( '; (semicolon)', 'tablepress' ),
62	',' => __( ', (comma)', 'tablepress' ),
63	'tab' => __( '\t (tabulator)', 'tablepress' ),
64	);
65
66	/** This filter is documented in the WordPress function unzip_file() in wp-admin/includes/file.php */
67	if ( class_exists( 'ZipArchive', false ) && apply_filters( 'unzip_file_use_ziparchive', true ) ) {
68	$this->zip_support_available = true;
69	}
70	}
71
72	/**
73	* Export a table.
74	*
75	* @since 1.0.0
76	*
77	* @param array $table Table to be exported.
78	* @param string $export_format Format for the export ('csv', 'html', 'json').
79	* @param string $csv_delimiter Delimiter for CSV export.
80	* @return string Exported table (only data for CSV and HTML, full tables (including options) for JSON).
81	*/
82	public function export_table( array $table, $export_format, $csv_delimiter ) {
83	switch ( $export_format ) {
84	case 'csv':
85	$output = '';
86	if ( 'tab' === $csv_delimiter ) {
87	$csv_delimiter = "\t";
88	}
89	foreach ( $table['data'] as $row_idx => $row ) {
90	$csv_row = array();
91	foreach ( $row as $column_idx => $cell_content ) {
92	$csv_row[] = $this->csv_wrap_and_escape( $cell_content, $csv_delimiter );
93	}
94	$output .= implode( $csv_delimiter, $csv_row );
95	$output .= "\n";
96	}
97	break;
98	case 'html':
99	$num_rows = count( $table['data'] );
100	$last_row_idx = $num_rows - 1;
101	$thead = '';
102	$tfoot = '';
103	$tbody = array();
104
105	foreach ( $table['data'] as $row_idx => $row ) {
106	// First row, need to check for head (but only if at least two rows).
107	if ( 0 === $row_idx && $table['options']['table_head'] && $num_rows > 1 ) {
108	$thead = $this->html_render_row( $row, 'th' );
109	continue;
110	}
111	// Last row, need to check for footer (but only if at least two rows).
112	if ( $last_row_idx === $row_idx && $table['options']['table_foot'] && $num_rows > 1 ) {
113	$tfoot = $this->html_render_row( $row, 'th' );
114	continue;
115	}
116	// Neither first nor last row (with respective head/foot enabled), so render as body row.
117	$tbody[] = $this->html_render_row( $row, 'td' );
118	}
119
120	// <thead>, <tfoot>, and <tbody> tags.
121	if ( ! empty( $thead ) ) {
122	$thead = "\t<thead>\n{$thead}\t</thead>\n";
123	}
124	if ( ! empty( $tfoot ) ) {
125	$tfoot = "\t<tfoot>\n{$tfoot}\t</tfoot>\n";
126	}
127	$tbody = "\t<tbody>\n" . implode( '', $tbody ) . "\t</tbody>\n";
128
129	$output = "<table>\n" . $thead . $tfoot . $tbody . "</table>\n";
130	break;
131	case 'json':
132	$output = wp_json_encode( $table, TABLEPRESS_JSON_OPTIONS );
133	break;
134	default:
135	$output = '';
136	}
137
138	return $output;
139	}
140
141	/**
142	* Wrap and escape a cell for CSV export.
143	*
144	* @since 1.0.0
145	*
146	* @param string $cell_content Content of a cell.
147	* @param string $delimiter CSV delimiter character.
148	* @return string Wrapped string for CSV export.
149	*/
150	protected function csv_wrap_and_escape( $cell_content, $delimiter ) {
151	// Return early if the cell is empty. No escaping or wrapping is needed then.
152	if ( '' === $cell_content ) {
153	return $cell_content;
154	}
155
156	// Escape potentially dangerous functions that could be used for CSV injection attacks in external spreadsheet software.
157	$active_content_triggers = array( '=', '+', '-', '@' );
158	if ( in_array( $cell_content[0], $active_content_triggers, true ) ) {
159	$functions_to_escape = array(
160	'cmd\|',
161	'rundll32',
162	'DDE(',
163	'IMPORTXML(',
164	'IMPORTFEED(',
165	'IMPORTHTML(',
166	'IMPORTRANGE(',
167	'IMPORTDATA(',
168	'IMAGE(',
169	'HYPERLINK(',
170	'WEBSERVICE(',
171	);
172	foreach ( $functions_to_escape as $function ) {
173	if ( false !== stripos( $cell_content, $function ) ) {
174	$cell_content = "'" . $cell_content; // Prepend a ' to indicate that the cell format is a text string.
175	break;
176	}
177	}
178	}
179
180	// Escape CSV delimiter for RegExp (e.g. '\|').
181	$delimiter = preg_quote( $delimiter, '#' );
182	if ( 1 === preg_match( '#' . $delimiter . '\|"\|\n\|\r#i', $cell_content ) \|\| ' ' === $cell_content[0] \|\| ' ' === substr( $cell_content, -1 ) ) {
183	// Escape single " as double "".
184	$cell_content = str_replace( '"', '""', $cell_content );
185	// Wrap string in "".
186	$cell_content = '"' . $cell_content . '"';
187	}
188
189	return $cell_content;
190	}
191
192	/**
193	* Generate the HTML of a row.
194	*
195	* @since 1.0.0
196	*
197	* @param array $row Cells of the row to be rendered.
198	* @param string $tag HTML tag to use for the cells (td or th).
199	* @return string HTML code for the row.
200	*/
201	protected function html_render_row( array $row, $tag ) {
202	$output = "\t\t<tr>\n";
203	array_walk( $row, array( $this, 'html_wrap_and_escape' ), $tag );
204	$output .= implode( '', $row );
205	$output .= "\t\t</tr>\n";
206	return $output;
207	}
208
209	/**
210	* Wrap and escape a cell for HTML export.
211	*
212	* @since 1.0.0
213	*
214	* @param string $cell_content Content of a cell.
215	* @param int\|null $column_idx Column index, or null if omitted. Unused, but defined to be able to use function as callback in array_walk().
216	* @param string $html_tag HTML tag that shall be used for the cell.
217	*/
218	protected function html_wrap_and_escape( &$cell_content, $column_idx, $html_tag ) {
219	/*
220	* Replace any & with & that is not already an encoded entity (from function htmlentities2 in WP 2.8).
221	* A complete htmlentities2() or htmlspecialchars() would encode <HTML> tags, which we don't want.
222	*/
223	$cell_content = preg_replace( '/&(?![A-Za-z]{0,4}\w{2,3};\|#[0-9]{2,4};)/', '&', $cell_content );
224	$cell_content = "\t\t\t<{$html_tag}>{$cell_content}</{$html_tag}>\n";
225	}
226
227	} // class TablePress_Export
228