PluginProbe
TablePress – Tables in WordPress made easy / 3.0
TablePress – Tables in WordPress made easy v3.0
3.3.4 3.3.3 3.3.2 3.3.1 trunk 1.12 1.14 1.9.2 2.0.4 2.1.7 2.1.8 2.2 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.3 2.3.1 2.3.2 2.4 2.4.1 2.4.2 2.4.3 2.4.4 All 44 releases
tablepress / controllers / controller-admin.php

controller-admin.php in TablePress – Tables in WordPress made easy 3.0, at controllers/controller-admin.php

1,489 lines 63.7 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 /**
3 * Admin Controller for TablePress with the functionality for the non-AJAX backend
4 *
5 * @package TablePress
6 * @subpackage Controllers
7 * @author Tobias Bäthge
8 * @since 1.0.0
9 */
10
11 // Prohibit direct script loading.
12 defined( 'ABSPATH' ) || die( 'No direct script access allowed!' );
13
14 /**
15 * Admin Controller class, extends Base Controller Class
16 *
17 * @package TablePress
18 * @subpackage Controllers
19 * @author Tobias Bäthge
20 * @since 1.0.0
21 */
22 class TablePress_Admin_Controller extends TablePress_Controller {
23
24 /**
25 * Page hooks (i.e. names) WordPress uses for the TablePress admin screens,
26 * populated in add_admin_menu_entry().
27 *
28 * @since 1.0.0
29 * @var string[]
30 */
31 protected array $page_hooks = array();
32
33 /**
34 * Actions that have a view and admin menu or nav tab menu entry.
35 *
36 * @since 1.0.0
37 * @var array<string, array<string, bool|string>>
38 */
39 protected array $view_actions = array();
40
41 /**
42 * Instance of the TablePress Admin View that is rendered.
43 *
44 * @since 1.0.0
45 */
46 protected \TablePress_View $view;
47
48 /**
49 * Initialize the Admin Controller, determine location the admin menu, set up actions.
50 *
51 * @since 1.0.0
52 */
53 public function __construct() {
54 parent::__construct();
55
56 // Handler for changing the number of shown tables in the list of tables (via WP List Table class).
57 add_filter( 'set_screen_option_tablepress_list_per_page', array( $this, 'save_list_tables_screen_option' ), 10, 3 );
58
59 add_action( 'admin_menu', array( $this, 'add_admin_menu_entry' ) );
60 add_action( 'admin_init', array( $this, 'add_admin_actions' ) );
61
62 add_action( 'enqueue_block_editor_assets', array( $this, 'enqueue_block_editor_assets' ) );
63 add_action( 'enqueue_block_assets', array( $this, 'enqueue_block_assets' ) );
64 }
65
66 /**
67 * Handler for changing the number of shown tables in the list of tables (via WP List Table class).
68 *
69 * @since 1.0.0
70 *
71 * @param mixed $screen_option Current value of the filter (probably bool false).
72 * @param string $option Option in which the setting is stored.
73 * @param int $value Current value of the setting.
74 * @return int Changed value of the setting
75 */
76 public function save_list_tables_screen_option( /* mixed */ $screen_option, string $option, int $value ): int {
77 return $value;
78 }
79
80 /**
81 * Add admin screens to the correct place in the admin menu.
82 *
83 * @since 1.0.0
84 */
85 public function add_admin_menu_entry(): void {
86 // Callback for all menu entries.
87 $callback = array( $this, 'show_admin_page' );
88 /**
89 * Filters the TablePress admin menu entry name.
90 *
91 * @since 1.0.0
92 *
93 * @param string $entry_name The admin menu entry name. Default "TablePress".
94 */
95 $admin_menu_entry_name = apply_filters( 'tablepress_admin_menu_entry_name', 'TablePress' );
96
97 $this->init_view_actions();
98 $min_access_cap = $this->view_actions['list']['required_cap'];
99
100 if ( TablePress::$controller->is_top_level_page ) {
101 $icon_url = 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgdmlld0JveD0iLTMyIC0zMiA2NCA2NCIgZmlsbD0iI2ZmZiI+PHBhdGggZD0iTTAtMjUuODU0aC0yNS44NTR2NTEuNzA4aDUxLjcwOFYwSDIxdjIxaC00MnYtNDJIMFoiLz48cGF0aCBkPSJNLTE4LTE4aDEwdjEwaC0xMHpNLTE4LTVoMTBWNWgtMTB6TS01LTVINVY1SC01ek0tMTggOGgxMHYxMGgtMTB6TS01IDhINXYxMEgtNXpNOCA4aDEwdjEwSDh6TTUtMzFoNi4xOHY2LjE4SDV6TTE5LTI1aDYuMTh2Ni4xOEgxOXpNMC0xNWgzLjgydjMuODJIMHpNMTAtMjBoMy44MnYzLjgySDEwek0yNS0xMmgzLjgydjMuODJIMjV6TTgtMTNoMTB2MTBIOHoiLz48L3N2Zz4=';
102 switch ( TablePress::$controller->parent_page ) {
103 case 'top':
104 $position = 3; // Position of Dashboard + 1.
105 break;
106 case 'bottom':
107 $position = isset( $GLOBALS['_wp_last_utility_menu'] ) ? ++$GLOBALS['_wp_last_utility_menu'] : 80;
108 break;
109 case 'middle':
110 default:
111 $position = isset( $GLOBALS['_wp_last_object_menu'] ) ? ++$GLOBALS['_wp_last_object_menu'] : 25;
112 break;
113 }
114 // Prevent overwriting existing menu entries.
115 while ( isset( $GLOBALS['menu'][ $position ] ) ) {
116 ++$position;
117 }
118 add_menu_page( 'TablePress', $admin_menu_entry_name, $min_access_cap, 'tablepress', $callback, $icon_url, $position ); // @phpstan-ignore argument.type
119 foreach ( $this->view_actions as $action => $entry ) {
120 if ( ! $entry['show_entry'] ) {
121 continue;
122 }
123 $slug = 'tablepress';
124 if ( 'list' !== $action ) {
125 $slug .= '_' . $action;
126 }
127 // @phpstan-ignore argument.type, argument.type
128 $page_hook = add_submenu_page( 'tablepress', sprintf( __( '%1$s &lsaquo; %2$s', 'tablepress' ), $entry['page_title'], 'TablePress' ), $entry['admin_menu_title'], $entry['required_cap'], $slug, $callback );
129 if ( false !== $page_hook ) {
130 $this->page_hooks[] = $page_hook;
131 }
132 }
133 } else {
134 // @phpstan-ignore argument.type
135 $page_hook = add_submenu_page( TablePress::$controller->parent_page, 'TablePress', $admin_menu_entry_name, $min_access_cap, 'tablepress', $callback );
136 if ( false !== $page_hook ) {
137 $this->page_hooks[] = $page_hook;
138 }
139 }
140 }
141
142 /**
143 * Set up handlers for user actions in the backend that exceed plain viewing.
144 *
145 * @since 1.0.0
146 */
147 public function add_admin_actions(): void {
148 // Register the callbacks for processing action requests.
149 $post_actions = array( 'list', 'add', 'options', 'export', 'import' );
150 $get_actions = array( 'hide_message', 'delete_table', 'copy_table', 'preview_table', 'editor_button_thickbox', 'uninstall_tablepress' );
151 foreach ( $post_actions as $action ) {
152 add_action( "admin_post_tablepress_{$action}", array( $this, "handle_post_action_{$action}" ) );
153 }
154 foreach ( $get_actions as $action ) {
155 add_action( "admin_post_tablepress_{$action}", array( $this, "handle_get_action_{$action}" ) );
156 }
157
158 // Register callbacks to trigger load behavior for admin pages.
159 foreach ( $this->page_hooks as $page_hook ) {
160 add_action( "load-{$page_hook}", array( $this, 'load_admin_page' ) );
161 }
162
163 /**
164 * Filters whether the legacy editor button should be loaded on the post editing screen.
165 *
166 * @since 2.1.0
167 *
168 * @param bool $load_button Whether to load the legacy editor button. Default true.
169 */
170 if ( apply_filters( 'tablepress_add_legacy_editor_button', true ) ) {
171 $pages_with_editor_button = array( 'post.php', 'post-new.php' );
172 foreach ( $pages_with_editor_button as $editor_page ) {
173 add_action( "load-{$editor_page}", array( $this, 'add_editor_buttons' ) );
174 }
175 }
176
177 if ( ! is_network_admin() && ! is_user_admin() ) {
178 add_action( 'admin_bar_menu', array( $this, 'add_wp_admin_bar_new_content_menu_entry' ), 71 );
179 }
180
181 add_action( 'load-plugins.php', array( $this, 'plugins_page' ) );
182 }
183
184 /**
185 * Loads additional JavaScript code for the TablePress table block (in the block editor context).
186 *
187 * @since 2.2.0
188 */
189 public function enqueue_block_editor_assets(): void {
190 /*
191 * Register the `react-jsx-runtime` polyfill, if it is not already registered.
192 * This is needed as a polyfill for WP < 6.6, and can be removed once WP 6.6 is the minimum requirement for TablePress.
193 */
194 if ( ! wp_script_is( 'react-jsx-runtime', 'registered' ) ) {
195 wp_register_script( 'react-jsx-runtime', plugins_url( 'admin/js/react-jsx-runtime.min.js', TABLEPRESS__FILE__ ), array( 'react' ), TablePress::version, true );
196 }
197
198 // Add table information for the block editor to the page.
199 $handle = generate_block_asset_handle( 'tablepress/table', 'editorScript' );
200 $data = $this->get_block_editor_data();
201 wp_add_inline_script( $handle, $data, 'before' );
202 }
203
204 /**
205 * Loads additional CSS code for the TablePress table block (inside the block editor iframe).
206 *
207 * @since 2.2.0
208 */
209 public function enqueue_block_assets(): void {
210 // Load the TablePress default CSS and the user's "Custom CSS" in the block editor iframe.
211 if ( is_admin() ) {
212 TablePress::$controller->enqueue_css();
213 }
214 }
215
216 /**
217 * Gets the inline data that is referenced by the Block Editor JavaScript code for the TablePress blocks.
218 *
219 * @since 2.0.0
220 *
221 * @return string JavaScript code for the Block Editor.
222 */
223 protected function get_block_editor_data(): string {
224 $tables = array();
225 // Load all table IDs without priming the post meta cache, as table options/visibility are not needed.
226 $table_ids = TablePress::$model_table->load_all( false );
227 foreach ( $table_ids as $table_id ) {
228 // Load table, without table data, options, and visibility settings.
229 $table = TablePress::$model_table->load( $table_id, false, false );
230
231 // Skip tables that could not be loaded.
232 if ( is_wp_error( $table ) ) {
233 continue;
234 }
235
236 if ( '' === trim( $table['name'] ) ) {
237 $table['name'] = __( '(no name)', 'tablepress' );
238 }
239 $tables[ $table_id ] = esc_html( $table['name'] );
240 }
241
242 /**
243 * Filters the list of table IDs and names that is passed to the block editor, and is then used in the dropdown of the TablePress table block.
244 *
245 * @since 2.0.0
246 *
247 * @param array<string, string> $tables List of table names, the table ID is the array key.
248 */
249 $tables = apply_filters( 'tablepress_block_editor_tables_list', $tables );
250
251 $tables = wp_json_encode( $tables, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES );
252 if ( false === $tables ) {
253 // JSON encoding failed, return an error object. Use a prefixed "_error" key to avoid conflicts with intentionally added "error" keys.
254 $tables = '{ "_error": "The data could not be encoded to JSON!" }';
255 }
256 // Print the JSON data inside a `JSON.parse()` call in JS for speed gains, with necessary escaping of `\` and `'`.
257 $tables = str_replace( array( '\\', "'" ), array( '\\\\', "\'" ), $tables );
258
259 $shortcode = esc_js( TablePress::$shortcode );
260
261 $template = TablePress::$model_table->get_table_template();
262 $template = wp_json_encode( $template['options'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES );
263 if ( false === $template ) {
264 // JSON encoding failed, return an error object. Use a prefixed "_error" key to avoid conflicts with intentionally added "error" keys.
265 $template = '{ "_error": "The data could not be encoded to JSON!" }';
266 }
267 // Print the JSON data inside a `JSON.parse()` call in JS for speed gains, with necessary escaping of `\` and `'`.
268 $template = str_replace( array( '\\', "'" ), array( '\\\\', "\'" ), $template );
269
270 /**
271 * Filters whether the table block preview should be loaded via a <ServerSideRender> in the block editor.
272 *
273 * @since 2.0.0
274 *
275 * @param bool $load_block_preview Whether the table block preview should be loaded.
276 */
277 $load_block_preview = apply_filters( 'tablepress_show_block_editor_preview', true );
278 $load_block_preview = (bool) $load_block_preview ? 'true' : 'false';
279
280 $url = '';
281 if ( current_user_can( 'tablepress_list_tables' ) ) {
282 $url = TablePress::url( array( 'action' => 'list' ) );
283 }
284
285 return <<<JS
286 // Ensure the global `tp` object exists.
287 window.tp = window.tp || {};
288 tp.url = '{$url}';
289 tp.load_block_preview = {$load_block_preview};
290 tp.table = {};
291 tp.table.shortcode = '{$shortcode}';
292 tp.table.template = JSON.parse( '{$template}' );
293 tp.tables = JSON.parse( '{$tables}' );
294 JS;
295 }
296
297 /**
298 * Register actions to add "Table" button to "HTML editor" and "Visual editor" toolbars.
299 *
300 * @since 1.0.0
301 */
302 public function add_editor_buttons(): void {
303 if ( ! current_user_can( 'tablepress_list_tables' ) ) {
304 return;
305 }
306
307 // Only load the toolbar integration if the Block Editor is not used.
308 if ( TablePress::site_uses_block_editor() ) {
309 return;
310 }
311
312 add_thickbox(); // The files are usually already loaded by media upload functions.
313 $admin_page = TablePress::load_class( 'TablePress_Admin_Page', 'class-admin-page-helper.php', 'classes' );
314 $admin_page->enqueue_script(
315 'quicktags-button',
316 array( 'quicktags', 'media-upload' ),
317 array(
318 'editor_button' => array(
319 'caption' => __( 'Table', 'tablepress' ),
320 'title' => __( 'Insert a TablePress table', 'tablepress' ),
321 'thickbox_title' => __( 'Insert a TablePress table', 'tablepress' ),
322 'thickbox_url' => TablePress::url( array( 'action' => 'editor_button_thickbox' ), true, 'admin-post.php' ),
323 ),
324 ),
325 );
326
327 // TinyMCE integration.
328 if ( user_can_richedit() ) {
329 add_filter( 'mce_external_plugins', array( $this, 'add_tinymce_plugin' ) );
330 add_filter( 'mce_buttons', array( $this, 'add_tinymce_button' ) );
331 }
332 }
333
334 /**
335 * Adds the "Table" button to the TinyMCE toolbar.
336 *
337 * @since 1.0.0
338 *
339 * @param string[] $buttons Current set of buttons in the TinyMCE toolbar.
340 * @return string[] Extended set of buttons in the TinyMCE toolbar, including the "Table" button.
341 */
342 public function add_tinymce_button( array $buttons ): array {
343 $buttons[] = 'tablepress_insert_table';
344 return $buttons;
345 }
346
347 /**
348 * Registers the "Table" button plugin for the TinyMCE editor.
349 *
350 * @since 1.0.0
351 *
352 * @param array<string, string> $plugins Current set of registered TinyMCE plugins.
353 * @return array<string, string> Extended set of registered TinyMCE plugins, including the "Table" button plugin.
354 */
355 public function add_tinymce_plugin( array $plugins ): array {
356 $plugins['tablepress_tinymce'] = plugins_url( 'admin/js/build/tinymce-button.js', TABLEPRESS__FILE__ );
357 return $plugins;
358 }
359
360 /**
361 * Add "TablePress Table" entry to "New" dropdown menu in the WP Admin Bar.
362 *
363 * @since 1.0.0
364 *
365 * @param WP_Admin_Bar $wp_admin_bar The current WP Admin Bar object.
366 */
367 public function add_wp_admin_bar_new_content_menu_entry( WP_Admin_Bar $wp_admin_bar ): void {
368 if ( ! current_user_can( 'tablepress_add_tables' ) ) {
369 return;
370 }
371
372 // Don't load TablePress assets on the Freemius opt-in/activation screen.
373 if ( tb_tp_fs()->is_activation_mode() && tb_tp_fs()->is_activation_page() ) {
374 return;
375 }
376
377 $wp_admin_bar->add_menu( array(
378 'parent' => 'new-content',
379 'id' => 'new-tablepress-table',
380 'title' => __( 'TablePress Table', 'tablepress' ),
381 'href' => TablePress::url( array( 'action' => 'add' ) ),
382 ) );
383 }
384
385 /**
386 * Handle actions for loading of Plugins page.
387 *
388 * @since 1.0.0
389 */
390 public function plugins_page(): void {
391 // Add additional links on Plugins page.
392 add_filter( 'plugin_action_links_' . TABLEPRESS_BASENAME, array( $this, 'add_plugin_action_links' ) );
393 add_filter( 'plugin_row_meta', array( $this, 'add_plugin_row_meta' ), 10, 2 );
394 $incompatible_superseded_extensions = array(
395 'tablepress-datatables-alphabetsearch/tablepress-datatables-alphabetsearch.php',
396 'tablepress-datatables-column-filter-widgets/tablepress-datatables-column-filter-widgets.php',
397 'tablepress-datatables-columnfilter/tablepress-datatables-columnfilter.php',
398 'tablepress-datatables-fixedcolumns/tablepress-datatables-fixedcolumns.php',
399 'tablepress-datatables-row-details/tablepress-datatables-row-details.php',
400 'tablepress-datatables-rowgroup/tablepress-datatables-rowgroup.php',
401 'tablepress-responsive-tables/tablepress-responsive-tables.php',
402 );
403 foreach ( $incompatible_superseded_extensions as $plugin_file ) {
404 add_action( "after_plugin_row_{$plugin_file}", array( $this, 'add_superseded_extension_meta_row' ), 10, 3 );
405 }
406 }
407
408 /**
409 * Add links to the TablePress entry in the "Plugin" column on the Plugins page.
410 *
411 * @since 1.0.0
412 *
413 * @param string[] $links List of links to print in the "Plugin" column on the Plugins page.
414 * @return string[] Extended list of links to print in the "Plugin" column on the Plugins page.
415 */
416 public function add_plugin_action_links( array $links ): array {
417 if ( current_user_can( 'tablepress_list_tables' ) ) {
418 $links[] = '<a href="' . esc_url( TablePress::url() ) . '">' . __( 'Plugin page', 'tablepress' ) . '</a>';
419 }
420 return $links;
421 }
422
423 /**
424 * Add links to the TablePress entry in the "Description" column on the Plugins page.
425 *
426 * @since 1.0.0
427 *
428 * @param string[] $links List of links to print in the "Description" column on the Plugins page.
429 * @param string $file Name of the plugin.
430 * @return string[] Extended list of links to print in the "Description" column on the Plugins page.
431 */
432 public function add_plugin_row_meta( array $links, string $file ): array {
433 if ( TABLEPRESS_BASENAME === $file ) {
434 $links[] = '<a href="https://tablepress.org/faq/" title="' . esc_attr__( 'Frequently Asked Questions', 'tablepress' ) . '">' . __( 'FAQ', 'tablepress' ) . '</a>';
435 $links[] = '<a href="https://tablepress.org/documentation/">' . __( 'Documentation', 'tablepress' ) . '</a>';
436 $links[] = '<a href="https://tablepress.org/support/">' . __( 'Support', 'tablepress' ) . '</a>';
437 if ( ! TABLEPRESS_IS_PLAYGROUND_PREVIEW && tb_tp_fs()->is_free_plan() ) {
438 $links[] = '<a href="https://tablepress.org/premium/?utm_source=plugin&utm_medium=textlink&utm_content=plugins-screen" title="' . esc_attr__( 'Check out the Premium version of TablePress!', 'tablepress' ) . '"><strong>' . __( 'Go Premium', 'tablepress' ) . '</strong></a>';
439 }
440 }
441 return $links;
442 }
443
444 /**
445 * Prints a superseded extension notice below certain TablePress Extension plugins' meta rows on the "Plugins" screen.
446 *
447 * @since 2.4.1
448 *
449 * @param string $plugin_file Path to the plugin file relative to the plugins directory.
450 * @param array<int, string|string[]|bool> $plugin_data An array of plugin data.
451 * @param string $status Status filter currently applied to the plugin list.
452 */
453 public function add_superseded_extension_meta_row( string $plugin_file, array $plugin_data, string $status ): void {
454 if ( ! is_plugin_active( $plugin_file ) ) {
455 return;
456 }
457 ?>
458 <tr class="plugin-update-tr active">
459 <td colspan="<?php echo esc_attr( $GLOBALS['wp_list_table']->get_column_count() ); ?>" class="plugin-update colspanchange">
460 <div class="update-message notice inline notice-error notice-alt">
461 <?php
462 if ( tb_tp_fs()->is_free_plan() ) {
463 echo '<p style="font-size:14px;">';
464 _e( 'This TablePress Extension was retired.', 'tablepress' );
465 echo ' ';
466 _e( '<strong>The plugin does no longer work with TablePress 3</strong> and will no longer receive updates or support!', 'tablepress' );
467 echo '<br>';
468 _e( 'Keeping it activated can lead to errors on your website!', 'tablepress' );
469 echo ' <strong>' . sprintf( __( '<a href="%s">Find out what you can do to continue using its features!</a>', 'tablepress' ), 'https://tablepress.org/upgrade-extensions/?utm_source=plugin&utm_medium=textlink&utm_content=plugins-list-table' ) . '</strong>';
470 echo '</p>';
471 }
472 ?>
473 <style>
474 /* Remove the separator line between the plugin's and the notice's table row. */
475 .plugins .active[data-plugin="<?php echo $plugin_file; ?>"] th,
476 .plugins .active[data-plugin="<?php echo $plugin_file; ?>"] td {
477 box-shadow: none;
478 }
479 /* Hide the plugin update row for the Extension as those won't work anymore anyways. */
480 .plugins .plugin-update-tr[data-plugin="<?php echo $plugin_file; ?>"] {
481 display: none;
482 }
483 </style>
484 </div>
485 </td>
486 </tr>
487 <?php
488 }
489
490 /**
491 * Prepare the rendering of an admin screen, by determining the current action, loading necessary data and initializing the view.
492 *
493 * @since 1.0.0
494 */
495 public function load_admin_page(): void {
496 // Determine the action from either the GET parameter (for sub-menu entries, and the main admin menu entry).
497 $action = ( ! empty( $_GET['action'] ) ) ? $_GET['action'] : 'list'; // Default action is list.
498 if ( TablePress::$controller->is_top_level_page ) {
499 // Or, for sub-menu entry of an admin menu "TablePress" entry, get it from the "page" GET parameter.
500 if ( 'tablepress' !== $_GET['page'] ) {
501 // Actions that are top-level entries, but don't have an action GET parameter (action is after last _ in string).
502 $action = substr( $_GET['page'], 11 ); // $_GET['page'] has the format 'tablepress_{$action}'
503 }
504 }
505
506 // Check if action is a supported action, and whether the user is allowed to access this screen.
507 if ( ! isset( $this->view_actions[ $action ] ) || ! current_user_can( $this->view_actions[ $action ]['required_cap'] ) ) { // @phpstan-ignore argument.type (The array value for the capability is always a string.)
508 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
509 }
510
511 // Don't load TablePress assets on the Freemius opt-in/activation screen.
512 if ( tb_tp_fs()->is_activation_mode() && tb_tp_fs()->is_activation_page() ) {
513 return;
514 }
515
516 // Changes current screen ID and pagenow variable in JS, to enable automatic meta box JS handling.
517 set_current_screen( "tablepress_{$action}" );
518
519 /*
520 * Set the `$typenow` global to the current CPT ourselves, as `WP_Screen::get()` does not determine the CPT correctly.
521 * This is necessary as the WP Admin Menu can otherwise highlight wrong entries, see https://github.com/TablePress/TablePress/issues/24.
522 */
523 if ( isset( $_GET['post_type'] ) && post_type_exists( $_GET['post_type'] ) ) {
524 $GLOBALS['typenow'] = $_GET['post_type']; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
525 }
526
527 // Pre-define some view data.
528 $data = array(
529 'view_actions' => $this->view_actions,
530 'message' => ( ! empty( $_GET['message'] ) ) ? $_GET['message'] : false,
531 'error_details' => ( ! empty( $_GET['error_details'] ) ) ? $_GET['error_details'] : '',
532 'site_uses_block_editor' => TablePress::site_uses_block_editor(),
533 );
534
535 // Depending on the action, load more necessary data for the corresponding view.
536 switch ( $action ) {
537 case 'list':
538 $data['table_id'] = ( ! empty( $_GET['table_id'] ) ) ? $_GET['table_id'] : false;
539 // Prime the post meta cache for cached loading of last_editor.
540 $data['table_ids'] = TablePress::$model_table->load_all( true );
541 $data['messages']['donation_nag'] = $this->maybe_show_donation_message();
542 $data['messages']['first_visit'] = ! $data['messages']['donation_nag'] && TablePress::$model_options->get( 'message_first_visit' );
543 $data['messages']['plugin_update'] = TablePress::$model_options->get( 'message_plugin_update' );
544 $data['messages']['superseded_extensions'] = current_user_can( 'manage_options' ) && TablePress::$model_options->get( 'message_superseded_extensions' );
545 $data['table_count'] = count( $data['table_ids'] );
546 break;
547 case 'about':
548 $data['first_activation'] = TablePress::$model_options->get( 'first_activation' );
549 break;
550 case 'options':
551 /*
552 * Maybe try saving "Custom CSS" to a file:
553 * (called here, as the credentials form posts to this handler again, due to how `request_filesystem_credentials()` works)
554 */
555 if ( isset( $_GET['item'] ) && 'save_custom_css' === $_GET['item'] ) {
556 TablePress::check_nonce( 'options', $_GET['item'] ); // Nonce check here, as we don't have an explicit handler, and even viewing the screen needs to be checked.
557 $action = 'options_custom_css'; // To load a different view.
558 // Try saving "Custom CSS" to a file, otherwise this gets the HTML for the credentials form.
559 $tablepress_css = TablePress::load_class( 'TablePress_CSS', 'class-css.php', 'classes' );
560 $result = $tablepress_css->save_custom_css_to_file_plugin_options( TablePress::$model_options->get( 'custom_css' ), TablePress::$model_options->get( 'custom_css_minified' ) );
561 if ( is_string( $result ) ) {
562 $data['credentials_form'] = $result; // This will only be called if the save function doesn't do a redirect.
563 } elseif ( true === $result ) {
564 /*
565 * At this point, saving was successful, so enable usage of CSS in files again,
566 * and also increase the "Custom CSS" version number (for cache busting).
567 */
568 TablePress::$model_options->update( array(
569 'use_custom_css_file' => true,
570 'custom_css_version' => TablePress::$model_options->get( 'custom_css_version' ) + 1,
571 ) );
572 TablePress::redirect( array( 'action' => 'options', 'message' => 'success_save' ) );
573 } else { // Leaves only $result === false.
574 TablePress::redirect( array( 'action' => 'options', 'message' => 'success_save_error_custom_css' ) );
575 }
576 break;
577 }
578 $data['frontend_options']['use_custom_css'] = TablePress::$model_options->get( 'use_custom_css' );
579 $data['frontend_options']['custom_css'] = TablePress::$model_options->get( 'custom_css' );
580 $data['user_options']['parent_page'] = TablePress::$controller->parent_page;
581 break;
582 case 'edit':
583 if ( empty( $_GET['table_id'] ) ) {
584 TablePress::redirect( array( 'action' => 'list', 'message' => 'error_no_table' ) );
585 }
586 // Load table, with table data, options, and visibility settings.
587 $data['table'] = TablePress::$model_table->load( $_GET['table_id'], true, true );
588 if ( is_wp_error( $data['table'] ) ) {
589 TablePress::redirect( array( 'action' => 'list', 'message' => 'error_load_table', 'error_details' => TablePress::get_wp_error_string( $data['table'] ) ) );
590 }
591 if ( ! current_user_can( 'tablepress_edit_table', $_GET['table_id'] ) ) {
592 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
593 }
594 break;
595 case 'export':
596 // Load all table IDs without priming the post meta cache, as table options/visibility are not needed.
597 $table_ids = TablePress::$model_table->load_all( false );
598 $data['tables'] = array();
599 foreach ( $table_ids as $table_id ) {
600 if ( ! current_user_can( 'tablepress_export_table', $table_id ) ) {
601 continue;
602 }
603 // Load table, without table data, options, and visibility settings.
604 $table = TablePress::$model_table->load( $table_id, false, false );
605
606 // Skip tables that could not be loaded.
607 if ( is_wp_error( $table ) ) {
608 continue;
609 }
610
611 $data['tables'][ $table['id'] ] = $table['name'];
612 }
613 $data['tables_count'] = TablePress::$model_table->count_tables();
614 $data['export_ids'] = ( ! empty( $_GET['table_id'] ) ) ? explode( ',', $_GET['table_id'] ) : array();
615 $exporter = TablePress::load_class( 'TablePress_Export', 'class-export.php', 'classes' );
616 $data['zip_support_available'] = $exporter->zip_support_available;
617 $data['export_formats'] = $exporter->export_formats;
618 $data['csv_delimiters'] = $exporter->csv_delimiters;
619 $data['export_format'] = ( ! empty( $_GET['export_format'] ) ) ? $_GET['export_format'] : 'csv';
620 $data['csv_delimiter'] = ( ! empty( $_GET['csv_delimiter'] ) ) ? $_GET['csv_delimiter'] : _x( ',', 'Default CSV delimiter in the translated language (";", ",", or "tab")', 'tablepress' );
621 break;
622 case 'import':
623 // Load all table IDs without priming the post meta cache, as table options/visibility are not needed.
624 $table_ids = TablePress::$model_table->load_all( false );
625 $data['tables'] = array();
626 foreach ( $table_ids as $table_id ) {
627 if ( ! current_user_can( 'tablepress_edit_table', $table_id ) ) {
628 continue;
629 }
630 // Load table, without table data, options, and visibility settings.
631 $table = TablePress::$model_table->load( $table_id, false, false );
632
633 // Skip tables that could not be loaded.
634 if ( is_wp_error( $table ) ) {
635 continue;
636 }
637
638 $data['tables'][ $table['id'] ] = $table['name'];
639 }
640 $data['table_ids'] = $table_ids; // Backward compatibility for the retired "Table Auto Update" Extension, which still relies on this variable name.
641 $data['tables_count'] = TablePress::$model_table->count_tables();
642 $importer = TablePress::load_class( 'TablePress_Import', 'class-import.php', 'classes' );
643 $data['import_type'] = ( ! empty( $_GET['import_type'] ) ) ? $_GET['import_type'] : 'add';
644 $data['import_existing_table'] = ( ! empty( $_GET['import_existing_table'] ) ) ? $_GET['import_existing_table'] : '';
645 $data['import_source'] = ( ! empty( $_GET['import_source'] ) ) ? $_GET['import_source'] : 'file-upload';
646 $data['import_url'] = ( ! empty( $_GET['import_url'] ) ) ? wp_unslash( $_GET['import_url'] ) : 'https://';
647 $data['import_server'] = ( ! empty( $_GET['import_server'] ) ) ? wp_unslash( $_GET['import_server'] ) : ABSPATH;
648 $data['import_form-field'] = ( ! empty( $_GET['import_form-field'] ) ) ? wp_unslash( $_GET['import_form-field'] ) : '';
649 $data['legacy_import'] = ( ! empty( $_GET['legacy_import'] ) ) ? $_GET['legacy_import'] : 'false';
650 break;
651 }
652
653 /**
654 * Filters the data that is passed to the current TablePress View.
655 *
656 * @since 1.0.0
657 *
658 * @param array<string, mixed> $data Data for the view.
659 * @param string $action The current action for the view.
660 */
661 $data = apply_filters( 'tablepress_view_data', $data, $action );
662
663 // Prepare and initialize the view.
664 $this->view = TablePress::load_view( $action, $data );
665 }
666
667 /**
668 * Render the view that has been initialized in load_admin_page() (called by WordPress when the actual page content is needed).
669 *
670 * @since 1.0.0
671 */
672 public function show_admin_page(): void {
673 $this->view->render();
674 }
675
676 /**
677 * Decides whether a message about Premium versions (previously, about donations) shall be shown on the "All Tables" screen, depending on passed days since installation and whether it was shown before.
678 *
679 * @since 1.0.0
680 *
681 * @return bool Whether the message shall be shown on the "All Tables" screen.
682 */
683 protected function maybe_show_donation_message(): bool {
684 // Only show the message to plugin admins.
685 if ( ! current_user_can( 'tablepress_edit_options' ) ) {
686 return false;
687 }
688
689 if ( ! TablePress::$model_options->get( 'message_donation_nag' ) ) {
690 return false;
691 }
692
693 // Determine, how long has the plugin been installed.
694 $seconds_installed = time() - TablePress::$model_options->get( 'first_activation' );
695 return ( $seconds_installed > MONTH_IN_SECONDS / 2 );
696 }
697
698 /**
699 * Init list of actions that have a view with their titles/names/caps.
700 *
701 * @since 1.0.0
702 */
703 protected function init_view_actions(): void {
704 $this->view_actions = array(
705 'list' => array(
706 'show_entry' => true,
707 'page_title' => __( 'All Tables', 'tablepress' ),
708 'admin_menu_title' => __( 'All Tables', 'tablepress' ),
709 'nav_tab_title' => __( 'All Tables', 'tablepress' ),
710 'required_cap' => 'tablepress_list_tables',
711 ),
712 'add' => array(
713 'show_entry' => true,
714 'page_title' => __( 'Add New Table', 'tablepress' ),
715 'admin_menu_title' => __( 'Add New Table', 'tablepress' ),
716 'nav_tab_title' => __( 'Add New', 'tablepress' ),
717 'required_cap' => 'tablepress_add_tables',
718 ),
719 'edit' => array(
720 'show_entry' => false,
721 'page_title' => __( 'Edit Table', 'tablepress' ),
722 'admin_menu_title' => '',
723 'nav_tab_title' => '',
724 'required_cap' => 'tablepress_edit_tables',
725 ),
726 'import' => array(
727 'show_entry' => true,
728 'page_title' => __( 'Import a Table', 'tablepress' ),
729 'admin_menu_title' => __( 'Import a Table', 'tablepress' ),
730 'nav_tab_title' => _x( 'Import', 'navigation bar', 'tablepress' ),
731 'required_cap' => 'tablepress_import_tables',
732 ),
733 'export' => array(
734 'show_entry' => true,
735 'page_title' => __( 'Export a Table', 'tablepress' ),
736 'admin_menu_title' => __( 'Export a Table', 'tablepress' ),
737 'nav_tab_title' => _x( 'Export', 'navigation bar', 'tablepress' ),
738 'required_cap' => 'tablepress_export_tables',
739 ),
740 'options' => array(
741 'show_entry' => true,
742 'page_title' => __( 'Plugin Options', 'tablepress' ),
743 'admin_menu_title' => __( 'Plugin Options', 'tablepress' ),
744 'nav_tab_title' => __( 'Plugin Options', 'tablepress' ),
745 'required_cap' => 'tablepress_access_options_screen',
746 ),
747 'about' => array(
748 'show_entry' => true,
749 'page_title' => __( 'About', 'tablepress' ),
750 'admin_menu_title' => __( 'About TablePress', 'tablepress' ),
751 'nav_tab_title' => __( 'About', 'tablepress' ),
752 'required_cap' => 'tablepress_access_about_screen',
753 ),
754 );
755
756 /**
757 * Filters the available TablePres Views/Actions and their parameters.
758 *
759 * @since 1.0.0
760 *
761 * @param array<string, array<string, bool|string>> $view_actions The available Views/Actions and their parameters.
762 */
763 $this->view_actions = apply_filters( 'tablepress_admin_view_actions', $this->view_actions );
764 }
765
766 /*
767 * HTTP POST actions.
768 */
769
770 /**
771 * Handle Bulk Actions (Copy, Export, Delete) on "All Tables" list screen.
772 *
773 * @since 1.0.0
774 */
775 public function handle_post_action_list(): void {
776 TablePress::check_nonce( 'list' );
777
778 if ( isset( $_POST['bulk-action-selector-top'] ) && '-1' !== $_POST['bulk-action-selector-top'] ) {
779 $bulk_action = $_POST['bulk-action-selector-top'];
780 } elseif ( isset( $_POST['bulk-action-selector-bottom'] ) && '-1' !== $_POST['bulk-action-selector-bottom'] ) {
781 $bulk_action = $_POST['bulk-action-selector-bottom'];
782 } else {
783 $bulk_action = false;
784 }
785
786 if ( ! in_array( $bulk_action, array( 'copy', 'export', 'delete' ), true ) ) {
787 TablePress::redirect( array( 'action' => 'list', 'message' => 'error_bulk_action_invalid' ) );
788 }
789
790 if ( empty( $_POST['table'] ) || ! is_array( $_POST['table'] ) ) {
791 TablePress::redirect( array( 'action' => 'list', 'message' => 'error_no_selection' ) );
792 }
793
794 $tables = wp_unslash( $_POST['table'] );
795
796 $no_success = array(); // To store table IDs that failed.
797
798 switch ( $bulk_action ) {
799 case 'copy':
800 foreach ( $tables as $table_id ) {
801 if ( current_user_can( 'tablepress_copy_table', $table_id ) ) {
802 $copy_table_id = TablePress::$model_table->copy( $table_id );
803 if ( is_wp_error( $copy_table_id ) ) {
804 $no_success[] = $table_id;
805 }
806 } else {
807 $no_success[] = $table_id;
808 }
809 }
810 break;
811 case 'export':
812 /*
813 * Cap check is done on redirect target page.
814 * To export, redirect to "Export" screen, with selected table IDs.
815 */
816 $table_ids = implode( ',', $tables );
817 TablePress::redirect( array( 'action' => 'export', 'table_id' => $table_ids ) );
818 // break; // unreachable.
819 case 'delete':
820 foreach ( $tables as $table_id ) {
821 if ( current_user_can( 'tablepress_delete_table', $table_id ) ) {
822 $deleted = TablePress::$model_table->delete( $table_id );
823 if ( is_wp_error( $deleted ) ) {
824 $no_success[] = $table_id;
825 }
826 } else {
827 $no_success[] = $table_id;
828 }
829 }
830 break;
831 }
832
833 if ( 0 !== count( $no_success ) ) { // @todo maybe pass this information to the view?
834 $message = "error_{$bulk_action}_not_all_tables";
835 } else {
836 $plural = ( count( $tables ) > 1 ) ? '_plural' : '';
837 $message = "success_{$bulk_action}{$plural}";
838 }
839
840 /*
841 * Slightly more complex redirect method, to account for sort, search, and pagination in the WP_List_Table on the List View,
842 * but only if this action succeeds, to have everything fresh in the event of an error.
843 */
844 $sendback = wp_get_referer();
845 if ( ! $sendback ) {
846 $sendback = TablePress::url( array( 'action' => 'list', 'message' => $message ) );
847 } else {
848 $sendback = remove_query_arg( array( 'action', 'message', 'table_id' ), $sendback );
849 $sendback = add_query_arg( array( 'action' => 'list', 'message' => $message ), $sendback );
850 }
851 wp_redirect( $sendback );
852 exit;
853 }
854
855 /**
856 * Add a table, according to the parameters on the "Add new Table" screen.
857 *
858 * @since 1.0.0
859 */
860 public function handle_post_action_add(): void {
861 TablePress::check_nonce( 'add' );
862
863 if ( ! current_user_can( 'tablepress_add_tables' ) ) {
864 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
865 }
866
867 if ( empty( $_POST['table'] ) || ! is_array( $_POST['table'] ) ) {
868 TablePress::redirect( array( 'action' => 'add', 'message' => 'error_add', 'error_details' => 'The HTTP POST data is empty.' ) );
869 }
870
871 $add_table = wp_unslash( $_POST['table'] );
872
873 // Perform confidence checks of posted data.
874 $name = $add_table['name'] ?? '';
875 $description = $add_table['description'] ?? '';
876 if ( ! isset( $add_table['rows'], $add_table['columns'] ) ) {
877 TablePress::redirect( array( 'action' => 'add', 'message' => 'error_add', 'error_details' => 'The HTTP POST data does not contain the table size.' ) );
878 }
879
880 $num_rows = absint( $add_table['rows'] );
881 $num_columns = absint( $add_table['columns'] );
882 if ( 0 === $num_rows || 0 === $num_columns ) {
883 TablePress::redirect( array( 'action' => 'add', 'message' => 'error_add', 'error_details' => 'The table size is invalid.' ) );
884 }
885
886 // Create a new table array with information from the posted data.
887 $new_table = array(
888 'name' => $name,
889 'description' => $description,
890 'data' => array_fill( 0, $num_rows, array_fill( 0, $num_columns, '' ) ),
891 'visibility' => array(
892 'rows' => array_fill( 0, $num_rows, 1 ),
893 'columns' => array_fill( 0, $num_columns, 1 ),
894 ),
895 );
896 // Merge this data into an empty table template.
897 $table = TablePress::$model_table->prepare_table( TablePress::$model_table->get_table_template(), $new_table, false );
898 if ( is_wp_error( $table ) ) {
899 TablePress::redirect( array( 'action' => 'add', 'message' => 'error_add', 'error_details' => TablePress::get_wp_error_string( $table ) ) );
900 }
901
902 // Add the new table (and get its first ID).
903 $table_id = TablePress::$model_table->add( $table );
904 if ( is_wp_error( $table_id ) ) {
905 TablePress::redirect( array( 'action' => 'add', 'message' => 'error_add', 'error_details' => TablePress::get_wp_error_string( $table_id ) ) );
906 }
907
908 TablePress::redirect( array( 'action' => 'edit', 'table_id' => $table_id, 'message' => 'success_add' ) );
909 }
910
911 /**
912 * Save changed "Plugin Options".
913 *
914 * @since 1.0.0
915 */
916 public function handle_post_action_options(): void {
917 TablePress::check_nonce( 'options' );
918
919 if ( ! current_user_can( 'tablepress_access_options_screen' ) ) {
920 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
921 }
922
923 if ( empty( $_POST['options'] ) || ! is_array( $_POST['options'] ) ) {
924 TablePress::redirect( array( 'action' => 'options', 'message' => 'error_save' ) );
925 }
926
927 $posted_options = wp_unslash( $_POST['options'] );
928
929 // Valid new options that will be merged into existing ones.
930 $new_options = array();
931
932 // Check each posted option value, and (maybe) add it to the new options.
933 if ( ! empty( $posted_options['admin_menu_parent_page'] ) && '-' !== $posted_options['admin_menu_parent_page'] ) {
934 $new_options['admin_menu_parent_page'] = $posted_options['admin_menu_parent_page'];
935 // Re-init parent information, as `TablePress::redirect()` URL might be wrong otherwise.
936 /** This filter is documented in classes/class-controller.php */
937 TablePress::$controller->parent_page = apply_filters( 'tablepress_admin_menu_parent_page', $posted_options['admin_menu_parent_page'] );
938 TablePress::$controller->is_top_level_page = in_array( TablePress::$controller->parent_page, array( 'top', 'middle', 'bottom' ), true );
939 }
940
941 // Custom CSS can only be saved if the user is allowed to do so.
942 $update_custom_css_files = false;
943 if ( current_user_can( 'tablepress_edit_options' ) ) {
944 // Checkbox.
945 $new_options['use_custom_css'] = ( isset( $posted_options['use_custom_css'] ) && 'true' === $posted_options['use_custom_css'] );
946
947 if ( isset( $posted_options['custom_css'] ) ) {
948 $new_options['custom_css'] = $posted_options['custom_css'];
949
950 $tablepress_css = TablePress::load_class( 'TablePress_CSS', 'class-css.php', 'classes' );
951
952 if ( '' !== $new_options['custom_css'] ) {
953 // Update "Custom CSS" to use DataTables 2 variants instead of old DataTables 1.x CSS classes.
954 $new_options['custom_css'] = TablePress::convert_datatables_api_data( $new_options['custom_css'] );
955 // Sanitize and tidy up Custom CSS.
956 $new_options['custom_css'] = $tablepress_css->sanitize_css( $new_options['custom_css'] );
957 // Minify Custom CSS.
958 $new_options['custom_css_minified'] = $tablepress_css->minify_css( $new_options['custom_css'] );
959 } else {
960 $new_options['custom_css_minified'] = '';
961 }
962
963 // Maybe update CSS files as well.
964 $custom_css_file_contents = $tablepress_css->load_custom_css_from_file( 'normal' );
965 if ( false === $custom_css_file_contents ) {
966 $custom_css_file_contents = '';
967 }
968 // Don't write to file if it already has the desired content.
969 if ( $new_options['custom_css'] !== $custom_css_file_contents ) {
970 $update_custom_css_files = true;
971 // Set to false again. As it was set here, it will be set true again, if file saving succeeds.
972 $new_options['use_custom_css_file'] = false;
973 }
974 }
975 }
976
977 // Save gathered new options (will be merged into existing ones), and flush caches of caching plugins, to make sure that the new Custom CSS is used.
978 if ( ! empty( $new_options ) ) {
979 TablePress::$model_options->update( $new_options );
980 TablePress::$model_table->_flush_caching_plugins_caches();
981 }
982
983 if ( $update_custom_css_files ) { // Capability check is performed above.
984 TablePress::redirect( array( 'action' => 'options', 'item' => 'save_custom_css' ), true );
985 }
986
987 TablePress::redirect( array( 'action' => 'options', 'message' => 'success_save' ) );
988 }
989
990 /**
991 * Export selected tables.
992 *
993 * @since 1.0.0
994 */
995 public function handle_post_action_export(): void {
996 TablePress::check_nonce( 'export' );
997
998 if ( ! current_user_can( 'tablepress_export_tables' ) ) {
999 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1000 }
1001
1002 if ( empty( $_POST['export'] ) || ! is_array( $_POST['export'] ) ) {
1003 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_export', 'error_details' => 'The HTTP POST data is empty.' ) );
1004 }
1005
1006 $export = wp_unslash( $_POST['export'] );
1007
1008 if ( empty( $export['tables_list'] ) ) {
1009 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_export', 'error_details' => 'The HTTP POST data does not contain tables.' ) );
1010 }
1011
1012 /** @var TablePress_Export $exporter */ // phpcs:ignore Generic.Commenting.DocComment.MissingShort
1013 $exporter = TablePress::load_class( 'TablePress_Export', 'class-export.php', 'classes' );
1014
1015 if ( empty( $export['format'] ) || ! isset( $exporter->export_formats[ $export['format'] ] ) ) {
1016 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_export', 'error_details' => 'The export format is invalid.' ) );
1017 }
1018 if ( empty( $export['csv_delimiter'] ) ) {
1019 // Set a value, so that the variable exists.
1020 $export['csv_delimiter'] = '';
1021 }
1022 if ( 'csv' === $export['format'] && ! isset( $exporter->csv_delimiters[ $export['csv_delimiter'] ] ) ) {
1023 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_export', 'error_details' => 'The CSV delimiter is invalid.' ) );
1024 }
1025
1026 $tables = explode( ',', $export['tables_list'] );
1027
1028 // Determine if ZIP file support is available.
1029 if ( $exporter->zip_support_available
1030 && ( ( isset( $export['zip_file'] ) && 'true' === $export['zip_file'] ) || count( $tables ) > 1 ) ) {
1031 // Export to ZIP only if ZIP is desired or if more than one table were selected (mandatory then).
1032 $export_to_zip = true;
1033 } else {
1034 $export_to_zip = false;
1035 }
1036
1037 if ( ! $export_to_zip ) {
1038 // Exporting without a ZIP file is only possible for one table, so take the first one.
1039 if ( ! current_user_can( 'tablepress_export_table', $tables[0] ) ) {
1040 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1041 }
1042 // Load table, with table data, options, and visibility settings.
1043 $table = TablePress::$model_table->load( $tables[0], true, true );
1044 if ( is_wp_error( $table ) ) {
1045 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_load_table', 'export_format' => $export['format'], 'csv_delimiter' => $export['csv_delimiter'], 'error_details' => TablePress::get_wp_error_string( $table ) ) );
1046 }
1047 if ( isset( $table['is_corrupted'] ) && $table['is_corrupted'] ) {
1048 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_table_corrupted', 'export_format' => $export['format'], 'csv_delimiter' => $export['csv_delimiter'] ) );
1049 }
1050 $download_filename = sprintf( '%1$s-%2$s-%3$s.%4$s', $table['id'], $table['name'], wp_date( 'Y-m-d' ), $export['format'] );
1051 /**
1052 * Filters the download filename of the exported table.
1053 *
1054 * @since 2.0.0
1055 *
1056 * @param string $download_filename The download filename of exported table.
1057 * @param string $table_id Table ID of the exported table.
1058 * @param string $table_name Table name of the exported table.
1059 * @param string $export_format Format for the export ('csv', 'html', 'json', 'zip').
1060 * @param bool $export_to_zip Whether the export is to a ZIP file (of multiple export files).
1061 */
1062 $download_filename = apply_filters( 'tablepress_export_filename', $download_filename, $table['id'], $table['name'], $export['format'], $export_to_zip );
1063 $download_filename = sanitize_file_name( $download_filename );
1064 // Export the table.
1065 $export_data = $exporter->export_table( $table, $export['format'], $export['csv_delimiter'] );
1066 /**
1067 * Filters the exported table data.
1068 *
1069 * @since 1.6.0
1070 *
1071 * @param string $export_data The exported table data.
1072 * @param array<string, mixed> $table Table to be exported.
1073 * @param string $export_format Format for the export ('csv', 'html', 'json').
1074 * @param string $csv_delimiter Delimiter for CSV export.
1075 */
1076 $export_data = apply_filters( 'tablepress_export_data', $export_data, $table, $export['format'], $export['csv_delimiter'] );
1077 $download_data = $export_data;
1078 } else {
1079 // Zipping can use a lot of memory and execution time, but not this much hopefully.
1080 wp_raise_memory_limit( 'admin' );
1081 if ( function_exists( 'set_time_limit' ) ) {
1082 @set_time_limit( 300 ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1083 }
1084
1085 $zip_file = new ZipArchive();
1086 $download_filename = sprintf( 'tablepress-export-%1$s-%2$s.zip', wp_date( 'Y-m-d-H-i-s' ), $export['format'] );
1087 /** This filter is documented in controllers/controller-admin.php */
1088 $download_filename = apply_filters( 'tablepress_export_filename', $download_filename, '', '', $export['format'], $export_to_zip );
1089 $download_filename = sanitize_file_name( $download_filename );
1090 $full_filename = wp_tempnam( $download_filename );
1091 if ( true !== $zip_file->open( $full_filename, ZipArchive::OVERWRITE ) ) {
1092 @unlink( $full_filename ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1093 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_create_zip_file', 'export_format' => $export['format'], 'csv_delimiter' => $export['csv_delimiter'], 'error_details' => 'The ZIP file could not be opened for writing.' ) );
1094 }
1095
1096 foreach ( $tables as $table_id ) {
1097 // Don't export tables for which the user doesn't have the necessary export rights.
1098 if ( ! current_user_can( 'tablepress_export_table', $table_id ) ) {
1099 continue;
1100 }
1101 // Load table, with table data, options, and visibility settings.
1102 $table = TablePress::$model_table->load( $table_id, true, true );
1103 // Don't export if the table could not be loaded.
1104 if ( is_wp_error( $table ) ) {
1105 continue;
1106 }
1107 // Don't export if the table is corrupted.
1108 if ( isset( $table['is_corrupted'] ) && $table['is_corrupted'] ) {
1109 continue;
1110 }
1111 $export_data = $exporter->export_table( $table, $export['format'], $export['csv_delimiter'] );
1112 /** This filter is documented in controllers/controller-admin.php */
1113 $export_data = apply_filters( 'tablepress_export_data', $export_data, $table, $export['format'], $export['csv_delimiter'] );
1114 $export_filename = sprintf( '%1$s-%2$s-%3$s.%4$s', $table['id'], $table['name'], wp_date( 'Y-m-d' ), $export['format'] );
1115 /** This filter is documented in controllers/controller-admin.php */
1116 $export_filename = apply_filters( 'tablepress_export_filename', $export_filename, $table['id'], $table['name'], $export['format'], $export_to_zip );
1117 $export_filename = sanitize_file_name( $export_filename );
1118 $zip_file->addFromString( $export_filename, $export_data );
1119 }
1120
1121 // If something went wrong, or no files were added to the ZIP file, bail out.
1122 // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
1123 if ( ZipArchive::ER_OK !== $zip_file->status || 0 === $zip_file->numFiles ) {
1124 $zip_file->close();
1125 @unlink( $full_filename ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1126 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_create_zip_file', 'export_format' => $export['format'], 'csv_delimiter' => $export['csv_delimiter'], 'error_details' => 'The ZIP file could not be written or is empty.' ) );
1127 }
1128 $zip_file->close();
1129
1130 // Load contents of the ZIP file, to send it as a download.
1131 $download_data = file_get_contents( $full_filename );
1132 if ( false === $download_data ) {
1133 @unlink( $full_filename ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1134 TablePress::redirect( array( 'action' => 'export', 'message' => 'error_create_zip_file', 'export_format' => $export['format'], 'csv_delimiter' => $export['csv_delimiter'], 'error_details' => 'The ZIP file content could not be read.' ) );
1135 }
1136 @unlink( $full_filename ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1137 }
1138
1139 // Send download headers for export file.
1140 header( 'Content-Description: File Transfer' );
1141 header( 'Content-Type: application/octet-stream' );
1142 header( "Content-Disposition: attachment; filename=\"{$download_filename}\"" );
1143 header( 'Content-Transfer-Encoding: binary' );
1144 header( 'Expires: 0' );
1145 header( 'Cache-Control: must-revalidate' );
1146 header( 'Pragma: public' );
1147 header( 'Content-Length: ' . strlen( $download_data ) );
1148 // $filetype = text/csv, text/html, application/json
1149 // header( 'Content-Type: ' . $filetype. '; charset=' . get_option( 'blog_charset' ) );
1150 @ob_end_clean(); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
1151 flush();
1152 echo $download_data;
1153 exit;
1154 }
1155
1156 /**
1157 * Import data from existing source (Upload, URL, Server, Direct input).
1158 *
1159 * @since 1.0.0
1160 */
1161 public function handle_post_action_import(): void {
1162 TablePress::check_nonce( 'import' );
1163
1164 if ( ! current_user_can( 'tablepress_import_tables' ) ) {
1165 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1166 }
1167
1168 if ( empty( $_POST['import'] ) || ! is_array( $_POST['import'] ) ) {
1169 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'The HTTP POST data is empty.' ) );
1170 }
1171
1172 $import_config = wp_unslash( $_POST['import'] );
1173
1174 if ( empty( $import_config['source'] ) ) {
1175 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'The HTTP POST does not contain an import configuration.' ) );
1176 }
1177
1178 // For security reasons, the "server" source is only available for super admins on multisite and admins on single sites.
1179 if ( 'server' === $import_config['source'] ) {
1180 if ( ! is_super_admin() && ! ( ! is_multisite() && current_user_can( 'manage_options' ) ) ) {
1181 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'You do not have the required access rights.' ) );
1182 }
1183 }
1184
1185 // For security reasons, the "url" source is only available admins and editors via a custom capability.
1186 if ( 'url' === $import_config['source'] ) {
1187 if ( ! current_user_can( 'tablepress_import_tables_url' ) ) {
1188 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'You do not have the required access rights.' ) );
1189 }
1190 }
1191
1192 // Move file upload data to the main import configuration.
1193 $import_config['file-upload'] = $_FILES['import_file_upload'] ?? null;
1194
1195 // Check if the source data for the chosen import source is defined.
1196 if ( empty( $import_config[ $import_config['source'] ] ) ) {
1197 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'The HTTP POST data does not contain an import source.' ) );
1198 }
1199
1200 // Set default values for non-essential configuration variables.
1201 if ( ! isset( $import_config['type'] ) ) {
1202 $import_config['type'] = 'add';
1203 }
1204 if ( ! isset( $import_config['existing_table'] ) ) {
1205 $import_config['existing_table'] = '';
1206 }
1207
1208 $import_config['legacy_import'] = ( isset( $import_config['legacy_import'] ) && 'true' === $import_config['legacy_import'] );
1209
1210 $importer = TablePress::load_class( 'TablePress_Import', 'class-import.php', 'classes' );
1211 $import = $importer->run( $import_config );
1212
1213 if ( is_wp_error( $import ) || 0 < count( $import['errors'] ) ) {
1214 $redirect_parameters = array(
1215 'action' => 'import',
1216 'message' => 'error_import',
1217 'import_type' => $import_config['type'],
1218 'import_existing_table' => $import_config['existing_table'],
1219 'import_source' => $import_config['source'],
1220 'legacy_import' => $import_config['legacy_import'],
1221 );
1222 if ( in_array( $import_config['source'], array( 'url', 'server' ), true ) ) {
1223 $redirect_parameters[ "import_{$import_config['source']}" ] = $import_config[ $import_config['source'] ];
1224 }
1225 if ( is_wp_error( $import ) ) {
1226 $redirect_parameters['error_details'] = TablePress::get_wp_error_string( $import );
1227 } elseif ( 0 < count( $import['errors'] ) ) {
1228 $wp_error_strings = array();
1229 foreach ( $import['errors'] as $file ) {
1230 $wp_error_strings[] = TablePress::get_wp_error_string( $file->error );
1231 }
1232 $redirect_parameters['error_details'] = implode( ', ', $wp_error_strings );
1233 }
1234 TablePress::redirect( $redirect_parameters );
1235 }
1236
1237 // At this point, there were no import errors.
1238 if ( count( $import['tables'] ) > 1 ) {
1239 TablePress::redirect( array( 'action' => 'list', 'message' => 'success_import' ) );
1240 } elseif ( 1 === count( $import['tables'] ) ) {
1241 TablePress::redirect( array( 'action' => 'edit', 'table_id' => $import['tables'][0]['id'], 'message' => 'success_import' ) );
1242 } else {
1243 TablePress::redirect( array( 'action' => 'import', 'message' => 'error_import', 'error_details' => 'The number of imported tables is invalid.' ) );
1244 }
1245 }
1246
1247 /*
1248 * HTTP GET actions.
1249 */
1250
1251 /**
1252 * Hide a header message on an admin screen.
1253 *
1254 * @since 1.0.0
1255 */
1256 public function handle_get_action_hide_message(): void {
1257 $message_item = ! empty( $_GET['item'] ) ? $_GET['item'] : '';
1258 TablePress::check_nonce( 'hide_message', $message_item );
1259
1260 if ( ! current_user_can( 'tablepress_list_tables' ) ) {
1261 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1262 }
1263
1264 TablePress::$model_options->update( "message_{$message_item}", false );
1265
1266 $return = ! empty( $_GET['return'] ) ? $_GET['return'] : 'list';
1267 TablePress::redirect( array( 'action' => $return ) );
1268 }
1269
1270 /**
1271 * Delete a table.
1272 *
1273 * @since 1.0.0
1274 */
1275 public function handle_get_action_delete_table(): void {
1276 $table_id = ( ! empty( $_GET['item'] ) ) ? $_GET['item'] : false;
1277 TablePress::check_nonce( 'delete_table', $table_id );
1278
1279 $return = ! empty( $_GET['return'] ) ? $_GET['return'] : 'list';
1280 $return_item = ! empty( $_GET['return_item'] ) ? $_GET['return_item'] : false;
1281
1282 // The nonce check should actually catch this already.
1283 if ( false === $table_id ) {
1284 TablePress::redirect( array( 'action' => $return, 'message' => 'error_delete', 'table_id' => $return_item ) );
1285 }
1286
1287 if ( ! current_user_can( 'tablepress_delete_table', $table_id ) ) {
1288 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1289 }
1290
1291 $deleted = TablePress::$model_table->delete( $table_id );
1292 if ( is_wp_error( $deleted ) ) {
1293 TablePress::redirect( array( 'action' => $return, 'message' => 'error_delete', 'table_id' => $return_item, 'error_details' => TablePress::get_wp_error_string( $deleted ) ) );
1294 }
1295
1296 /*
1297 * Slightly more complex redirect method, to account for sort, search, and pagination in the WP_List_Table on the List View,
1298 * but only if this action succeeds, to have everything fresh in the event of an error.
1299 */
1300 $sendback = wp_get_referer();
1301 if ( ! $sendback ) {
1302 $sendback = TablePress::url( array( 'action' => 'list', 'message' => 'success_delete', 'table_id' => $return_item ) );
1303 } else {
1304 $sendback = remove_query_arg( array( 'action', 'message', 'table_id' ), $sendback );
1305 $sendback = add_query_arg( array( 'action' => 'list', 'message' => 'success_delete', 'table_id' => $return_item ), $sendback );
1306 }
1307 wp_redirect( $sendback );
1308 exit;
1309 }
1310
1311 /**
1312 * Copy a table.
1313 *
1314 * @since 1.0.0
1315 */
1316 public function handle_get_action_copy_table(): void {
1317 $table_id = ( ! empty( $_GET['item'] ) ) ? $_GET['item'] : false;
1318 TablePress::check_nonce( 'copy_table', $table_id );
1319
1320 $return = ! empty( $_GET['return'] ) ? $_GET['return'] : 'list';
1321 $return_item = ! empty( $_GET['return_item'] ) ? $_GET['return_item'] : false;
1322
1323 // The nonce check should actually catch this already.
1324 if ( false === $table_id ) {
1325 TablePress::redirect( array( 'action' => $return, 'message' => 'error_copy', 'table_id' => $return_item ) );
1326 }
1327
1328 if ( ! current_user_can( 'tablepress_copy_table', $table_id ) ) {
1329 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1330 }
1331
1332 $copy_table_id = TablePress::$model_table->copy( $table_id );
1333 if ( is_wp_error( $copy_table_id ) ) {
1334 TablePress::redirect( array( 'action' => $return, 'message' => 'error_copy', 'table_id' => $return_item, 'error_details' => TablePress::get_wp_error_string( $copy_table_id ) ) );
1335 }
1336 $return_item = $copy_table_id;
1337
1338 /*
1339 * Slightly more complex redirect method, to account for sort, search, and pagination in the WP_List_Table on the List View,
1340 * but only if this action succeeds, to have everything fresh in the event of an error.
1341 */
1342 $sendback = wp_get_referer();
1343 if ( ! $sendback ) {
1344 $sendback = TablePress::url( array( 'action' => $return, 'message' => 'success_copy', 'table_id' => $return_item ) );
1345 } else {
1346 $sendback = remove_query_arg( array( 'action', 'message', 'table_id' ), $sendback );
1347 $sendback = add_query_arg( array( 'action' => $return, 'message' => 'success_copy', 'table_id' => $return_item ), $sendback );
1348 }
1349 wp_redirect( $sendback );
1350 exit;
1351 }
1352
1353 /**
1354 * Preview a table.
1355 *
1356 * @since 1.0.0
1357 */
1358 public function handle_get_action_preview_table(): void {
1359 $table_id = ( ! empty( $_GET['item'] ) ) ? $_GET['item'] : false;
1360 TablePress::check_nonce( 'preview_table', $table_id );
1361
1362 // Nonce check should actually catch this already.
1363 if ( false === $table_id ) {
1364 wp_die( __( 'The preview could not be loaded.', 'tablepress' ), __( 'Preview', 'tablepress' ) );
1365 }
1366
1367 if ( ! current_user_can( 'tablepress_preview_table', $table_id ) ) {
1368 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1369 }
1370
1371 // Load table, with table data, options, and visibility settings.
1372 $table = TablePress::$model_table->load( $table_id, true, true );
1373 if ( is_wp_error( $table ) ) {
1374 wp_die( __( 'The table could not be loaded.', 'tablepress' ), __( 'Preview', 'tablepress' ) );
1375 }
1376
1377 // Sanitize all table data to remove unsafe HTML from the preview output, if the user is not allowed to work with unfiltered HTML.
1378 if ( ! current_user_can( 'unfiltered_html' ) ) {
1379 $table = TablePress::$model_table->sanitize( $table );
1380 }
1381
1382 // Create a render class instance.
1383 $_render = TablePress::load_class( 'TablePress_Render', 'class-render.php', 'classes' );
1384 // Merge desired options with default render options (see TablePress_Controller_Frontend::shortcode_table()).
1385 $default_render_options = $_render->get_default_render_options();
1386 /** This filter is documented in controllers/controller-frontend.php */
1387 $default_render_options = apply_filters( 'tablepress_shortcode_table_default_shortcode_atts', $default_render_options );
1388 $render_options = shortcode_atts( $default_render_options, $table['options'] );
1389 /** This filter is documented in controllers/controller-frontend.php */
1390 $render_options = apply_filters( 'tablepress_shortcode_table_shortcode_atts', $render_options );
1391 $render_options['html_id'] = "tablepress-{$table['id']}";
1392 $render_options['block_preview'] = true;
1393 $_render->set_input( $table, $render_options );
1394 $view_data = array(
1395 'table_id' => $table_id,
1396 'head_html' => $_render->get_preview_css(),
1397 'body_html' => $_render->get_output( 'html' ),
1398 'site_uses_block_editor' => TablePress::site_uses_block_editor(),
1399 );
1400
1401 $custom_css = TablePress::$model_options->get( 'custom_css' );
1402 $use_custom_css = ( TablePress::$model_options->get( 'use_custom_css' ) && '' !== $custom_css );
1403 if ( $use_custom_css ) {
1404 $view_data['head_html'] .= "<style>\n{$custom_css}\n</style>\n";
1405 }
1406
1407 // Prepare, initialize, and render the view.
1408 $this->view = TablePress::load_view( 'preview_table', $view_data );
1409 $this->view->render();
1410 }
1411
1412 /**
1413 * Shows a list of tables in the Editor toolbar Thickbox (opened by TinyMCE or Quicktags button).
1414 *
1415 * @since 1.0.0
1416 */
1417 public function handle_get_action_editor_button_thickbox(): void {
1418 TablePress::check_nonce( 'editor_button_thickbox' );
1419
1420 if ( ! current_user_can( 'tablepress_list_tables' ) ) {
1421 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1422 }
1423
1424 $view_data = array(
1425 // Load all table IDs without priming the post meta cache, as table options/visibility are not needed.
1426 'table_ids' => TablePress::$model_table->load_all( false ),
1427 );
1428
1429 set_current_screen( 'tablepress_editor_button_thickbox' );
1430
1431 // Prepare, initialize, and render the view.
1432 $this->view = TablePress::load_view( 'editor_button_thickbox', $view_data );
1433 $this->view->render();
1434 }
1435
1436 /**
1437 * Uninstall TablePress, and delete all tables and options.
1438 *
1439 * @since 1.0.0
1440 */
1441 public function handle_get_action_uninstall_tablepress(): void {
1442 TablePress::check_nonce( 'uninstall_tablepress' );
1443
1444 $plugin = TABLEPRESS_BASENAME;
1445
1446 if ( ! current_user_can( 'deactivate_plugin', $plugin ) || ! current_user_can( 'tablepress_edit_options' ) || ! current_user_can( 'tablepress_delete_tables' ) || is_plugin_active_for_network( $plugin ) ) {
1447 wp_die( __( 'Sorry, you are not allowed to access this page.', 'default' ), 403 );
1448 }
1449
1450 // Deactivate TablePress for the site (but not for the network).
1451 deactivate_plugins( $plugin, false, false );
1452 update_option( 'recently_activated', array( $plugin => time() ) + (array) get_option( 'recently_activated', array() ) );
1453
1454 // Delete all tables, "Custom CSS" files, and options.
1455 TablePress::$model_table->delete_all();
1456 $tablepress_css = TablePress::load_class( 'TablePress_CSS', 'class-css.php', 'classes' );
1457 $css_files_deleted = $tablepress_css->delete_custom_css_files();
1458 TablePress::$model_options->remove_access_capabilities();
1459
1460 TablePress::$model_table->destroy();
1461 TablePress::$model_options->destroy();
1462
1463 $output = '<strong>' . __( 'TablePress was uninstalled successfully.', 'tablepress' ) . '</strong><br><br>';
1464 $output .= __( 'All tables, data, and options were deleted.', 'tablepress' );
1465 if ( is_multisite() ) {
1466 $output .= ' ' . __( 'You may now ask the network admin to delete the plugin&#8217;s folder <code>tablepress</code> from the server, if no other site in the network uses it.', 'tablepress' );
1467 } else {
1468 $output .= ' ' . __( 'You may now manually delete the plugin&#8217;s folder <code>tablepress</code> from the <code>plugins</code> directory on your server or use the &#8220;Delete&#8221; link for TablePress on the WordPress &#8220;Plugins&#8221; page.', 'tablepress' );
1469 }
1470 if ( $css_files_deleted ) {
1471 $output .= ' ' . __( 'Your TablePress &#8220;Custom CSS&#8221; files have been deleted automatically.', 'tablepress' );
1472 } else { // phpcs:ignore Universal.ControlStructures.DisallowLonelyIf.Found
1473 if ( is_multisite() ) {
1474 $output .= ' ' . __( 'Please also ask him to delete your TablePress &#8220;Custom CSS&#8221; files from the server.', 'tablepress' );
1475 } else {
1476 $output .= ' ' . __( 'You may now also delete your TablePress &#8220;Custom CSS&#8221; files in the <code>wp-content</code> folder.', 'tablepress' );
1477 }
1478 }
1479 $output .= "</p>\n<p>";
1480 if ( ! is_multisite() || is_super_admin() ) {
1481 $output .= '<a class="button" href="' . esc_url( admin_url( 'plugins.php' ) ) . '">' . __( 'Go to &#8220;Plugins&#8221; page', 'tablepress' ) . '</a> ';
1482 }
1483 $output .= '<a class="button" href="' . esc_url( admin_url( 'index.php' ) ) . '">' . __( 'Go to Dashboard', 'tablepress' ) . '</a>';
1484
1485 wp_die( $output, __( 'Uninstall TablePress', 'tablepress' ), array( 'response' => 200, 'back_link' => false ) );
1486 }
1487
1488 } // class TablePress_Admin_Controller
1489