tablepress / classes / class-export.php

class-export.php in TablePress – Tables in WordPress made easy 2.4, at classes/class-export.php

230 lines 6.8 KB

Raw Download Zip

1	<?php
2	/**
3	* TablePress Table Export Class
4	*
5	* @package TablePress
6	* @subpackage Export/Import
7	* @author Tobias Bäthge
8	* @since 1.0.0
9	*/
10
11	// Prohibit direct script loading.
12	defined( 'ABSPATH' ) \|\| die( 'No direct script access allowed!' );
13
14	/**
15	* TablePress Table Export Class
16	*
17	* @package TablePress
18	* @subpackage Export/Import
19	* @author Tobias Bäthge
20	* @since 1.0.0
21	*/
22	class TablePress_Export {
23
24	/**
25	* File/Data Formats that are available for the export.
26	*
27	* @since 1.0.0
28	* @var array<string, string>
29	*/
30	public $export_formats = array();
31
32	/**
33	* Delimiters for the CSV export.
34	*
35	* @since 1.0.0
36	* @var array<string, string>
37	*/
38	public $csv_delimiters = array();
39
40	/**
41	* Whether ZIP archive support is available in the PHP installation on the server.
42	*
43	* @since 1.0.0
44	* @var bool
45	*/
46	public $zip_support_available = false;
47
48	/**
49	* Initialize the Export class.
50	*
51	* @since 1.0.0
52	*/
53	public function __construct() {
54	// Initiate here, because function call not possible outside a class method.
55	$this->export_formats = array(
56	'csv' => __( 'CSV - Character-Separated Values', 'tablepress' ),
57	'html' => __( 'HTML - Hypertext Markup Language', 'tablepress' ),
58	'json' => __( 'JSON - JavaScript Object Notation', 'tablepress' ),
59	);
60	$this->csv_delimiters = array(
61	';' => __( '; (semicolon)', 'tablepress' ),
62	',' => __( ', (comma)', 'tablepress' ),
63	'tab' => __( '\t (tabulator)', 'tablepress' ),
64	);
65
66	if ( class_exists( 'ZipArchive', false ) ) {
67	$this->zip_support_available = true;
68	}
69	}
70
71	/**
72	* Export a table.
73	*
74	* @since 1.0.0
75	*
76	* @param array<string, mixed> $table Table to be exported.
77	* @param string $export_format Format for the export ('csv', 'html', 'json').
78	* @param string $csv_delimiter Delimiter for CSV export.
79	* @return string Exported table (only data for CSV and HTML, full tables (including options) for JSON).
80	*/
81	public function export_table( array $table, string $export_format, string $csv_delimiter ): string {
82	switch ( $export_format ) {
83	case 'csv':
84	$output = '';
85	if ( 'tab' === $csv_delimiter ) {
86	$csv_delimiter = "\t";
87	}
88	foreach ( $table['data'] as $row_idx => $row ) {
89	$csv_row = array();
90	foreach ( $row as $column_idx => $cell_content ) {
91	$csv_row[] = $this->csv_wrap_and_escape( $cell_content, $csv_delimiter );
92	}
93	$output .= implode( $csv_delimiter, $csv_row );
94	$output .= "\n";
95	}
96	break;
97	case 'html':
98	$num_rows = count( $table['data'] );
99	$last_row_idx = $num_rows - 1;
100	$thead = '';
101	$tfoot = '';
102	$tbody = array();
103
104	foreach ( $table['data'] as $row_idx => $row ) {
105	// First row, need to check for head (but only if at least two rows).
106	if ( 0 === $row_idx && $table['options']['table_head'] && $num_rows > 1 ) {
107	$thead = $this->html_render_row( $row, 'th' );
108	continue;
109	}
110	// Last row, need to check for footer (but only if at least two rows).
111	if ( $last_row_idx === $row_idx && $table['options']['table_foot'] && $num_rows > 1 ) {
112	$tfoot = $this->html_render_row( $row, 'th' );
113	continue;
114	}
115	// Neither first nor last row (with respective head/foot enabled), so render as body row.
116	$tbody[] = $this->html_render_row( $row, 'td' );
117	}
118
119	// <thead>, <tfoot>, and <tbody> tags.
120	if ( ! empty( $thead ) ) {
121	$thead = "\t<thead>\n{$thead}\t</thead>\n";
122	}
123	if ( ! empty( $tfoot ) ) {
124	$tfoot = "\t<tfoot>\n{$tfoot}\t</tfoot>\n";
125	}
126	$tbody = "\t<tbody>\n" . implode( '', $tbody ) . "\t</tbody>\n";
127
128	$output = "<table>\n" . $thead . $tfoot . $tbody . "</table>\n";
129	break;
130	case 'json':
131	$output = wp_json_encode( $table, TABLEPRESS_JSON_OPTIONS );
132	if ( false === $output ) {
133	$output = '';
134	}
135	break;
136	default:
137	$output = '';
138	}
139
140	return $output;
141	}
142
143	/**
144	* Wrap and escape a cell for CSV export.
145	*
146	* @since 1.0.0
147	*
148	* @param string $cell_content Content of a cell.
149	* @param string $delimiter CSV delimiter character.
150	* @return string Wrapped string for CSV export.
151	*/
152	protected function csv_wrap_and_escape( string $cell_content, string $delimiter ): string {
153	// Return early if the cell is empty. No escaping or wrapping is needed then.
154	if ( '' === $cell_content ) {
155	return $cell_content;
156	}
157
158	// Escape potentially dangerous functions that could be used for CSV injection attacks in external spreadsheet software.
159	$active_content_triggers = array( '=', '+', '-', '@' );
160	if ( in_array( $cell_content[0], $active_content_triggers, true ) ) {
161	$functions_to_escape = array(
162	'cmd\|',
163	'rundll32',
164	'DDE(',
165	'IMPORTXML(',
166	'IMPORTFEED(',
167	'IMPORTHTML(',
168	'IMPORTRANGE(',
169	'IMPORTDATA(',
170	'IMAGE(',
171	'HYPERLINK(',
172	'WEBSERVICE(',
173	);
174	foreach ( $functions_to_escape as $function ) {
175	if ( false !== stripos( $cell_content, $function ) ) {
176	$cell_content = "'" . $cell_content; // Prepend a ' to indicate that the cell format is a text string.
177	break;
178	}
179	}
180	}
181
182	// Escape CSV delimiter for RegExp (e.g. '\|').
183	$delimiter = preg_quote( $delimiter, '#' );
184	if ( 1 === preg_match( '#' . $delimiter . '\|"\|\n\|\r#i', $cell_content ) \|\| str_starts_with( $cell_content, ' ' ) \|\| str_ends_with( $cell_content, ' ' ) ) {
185	// Escape single " as double "".
186	$cell_content = str_replace( '"', '""', $cell_content );
187	// Wrap string in "".
188	$cell_content = '"' . $cell_content . '"';
189	}
190
191	return $cell_content;
192	}
193
194	/**
195	* Generate the HTML of a row.
196	*
197	* @since 1.0.0
198	*
199	* @param string[] $row Cells of the row to be rendered.
200	* @param string $tag HTML tag to use for the cells (td or th).
201	* @return string HTML code for the row.
202	*/
203	protected function html_render_row( array $row, string $tag ): string {
204	$output = "\t\t<tr>\n";
205	array_walk( $row, array( $this, 'html_wrap_and_escape' ), $tag );
206	$output .= implode( '', $row );
207	$output .= "\t\t</tr>\n";
208	return $output;
209	}
210
211	/**
212	* Wrap and escape a cell for HTML export.
213	*
214	* @since 1.0.0
215	*
216	* @param string $cell_content Content of a cell.
217	* @param int $column_idx Column index, or -1 if omitted. Unused, but defined to be able to use function as callback in array_walk().
218	* @param string $html_tag HTML tag that shall be used for the cell.
219	*/
220	protected function html_wrap_and_escape( string &$cell_content, int $column_idx, string $html_tag ): void {
221	/*
222	* Replace any & with & that is not already an encoded entity (from function htmlentities2 in WP 2.8).
223	* A complete htmlentities2() or htmlspecialchars() would encode <HTML> tags, which we don't want.
224	*/
225	$cell_content = preg_replace( '/&(?![A-Za-z]{0,4}\w{2,3};\|#[0-9]{2,4};)/', '&', $cell_content );
226	$cell_content = "\t\t\t<{$html_tag}>{$cell_content}</{$html_tag}>\n";
227	}
228
229	} // class TablePress_Export
230