← All changes | includes/class-validation.php +113 -114 1.0.13 → 1.2.11 View file →

		@@ -18,9 +18,9 @@
18	18	* @param array $data Submitted form data
19	19	* @param string $type Form type.
20	20	* @param array|bool $fields Fields applicable for validation.
21	21	*
22		- * @return array|mixed|void|WP_Error Validated form data.
	22	+ * @return array|mixed|WP_Error Validated form data.
23	23	*/
24	24	public function validate_fields($data, $type, $fields = false) {
25	25
26	26	$errors = new WP_Error();
		@@ -31,53 +31,56 @@
31	31	if (!empty($error_code)) {
32	32	return $errors;
33	33	}
34	34
35		-
36	35	if (!$fields) {
37	36	global $wpdb;
38	37	$table_name = uwp_get_table_prefix() . 'uwp_form_fields';
39	38	if ($type == 'register') {
40		- if (isset($data["uwp_role_id"])) {
41		- $role_id = (int) strip_tags(esc_sql($data["uwp_role_id"]));
42		- } else {
43		- $role_id = 0;
44		- }
45		- $fields = get_register_validate_form_fields($role_id);
	39	+ if ( isset( $data['uwp_register_form_id'] ) && ! empty( $data['uwp_register_form_id'] ) ) {
	40	+ $form_id = (int) $data['uwp_register_form_id'];
	41	+ } else {
	42	+ $form_id = 1;
	43	+ }
	44	+ $fields = get_register_validate_form_fields($form_id);
46	45	} elseif ($type == 'change') {
47	46	$fields = get_change_validate_form_fields();
48	47	} elseif ($type == 'account') {
49		- $fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' AND is_register_only_field = '0' ORDER BY sort_order ASC", array('account')));
	48	+ $fields = get_account_form_fields();
50	49	} else {
51	50	$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' ORDER BY sort_order ASC", array($type)));
52	51	}
53	52	}
54	53
55		-
56	54	$validated_data = array();
57	55
58		-
59		-
60		- $email_field = uwp_get_custom_field_info('uwp_account_email');
	56	+ $email_field = uwp_get_custom_field_info('email','account');
61	57	$email_extra = array();
62	58	if (isset($email_field->extra_fields) && $email_field->extra_fields != '') {
63	59	$email_extra = unserialize($email_field->extra_fields);
64	60	}
	61	+
65	62	$enable_confirm_email_field = isset($email_extra['confirm_email']) ? $email_extra['confirm_email'] : '0';
66	63
67		- $password_field = uwp_get_custom_field_info('uwp_account_password');
68		- $enable_password = $password_field->is_active;
	64	+ $password_field = uwp_get_custom_field_info('password','account');
	65	+ $enable_password = isset($data['password']) && $password_field->is_active ? 1 : 0;
69	66	$password_extra = array();
70	67	if (isset($password_field->extra_fields) && $password_field->extra_fields != '') {
71	68	$password_extra = unserialize($password_field->extra_fields);
72	69	}
	70	+
73	71	$enable_confirm_password_field = isset($password_extra['confirm_password']) ? $password_extra['confirm_password'] : '0';
74	72
75	73	$enable_old_password = uwp_get_option('change_enable_old_password', false);
	74	+ $user_id = get_current_user_id();
	75	+ if($user_id && 1 == get_user_meta($user_id, 'is_uwp_social_login_no_password', true)){
	76	+ $enable_old_password = 0;
	77	+ }
76	78
77	79	if ($type == 'account' || $type == 'change') {
78	80	if (!is_user_logged_in()) {
79	81	$errors->add('not_logged_in', __('<strong>Error</strong>: Permission denied.', 'userswp'));
	82	+ return $errors;
80	83	}
81	84	}
82	85
83	86	if (!empty($fields)) {
		@@ -90,46 +93,22 @@
90	93
91	94	if ($type == 'register') {
92	95
93	96	if ($enable_password != '1') {
94		- if ( ($field->htmlvar_name == 'uwp_account_password') OR ($field->htmlvar_name == 'uwp_account_confirm_password') ) {
	97	+ if ( ($field->htmlvar_name == 'password') OR ($field->htmlvar_name == 'confirm_password') ) {
95	98	continue;
96	99	}
97	100	}
98	101
99	102	if ($enable_confirm_email_field != '1') {
100		- if ( $field->htmlvar_name == 'uwp_account_confirm_email' ) {
	103	+ if ( $field->htmlvar_name == 'confirm_email' ) {
101	104	continue;
102	105	}
103	106	}
104	107	}
105	108
106		-
107		- if (!isset($data[$field->htmlvar_name]) && $field->is_required == 1) {
108		- if (is_admin()) {
109		- //do nothing since admin edit fields can be empty
110		- } else {
111		- if ($field->required_msg) {
112		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' '.$field->required_msg, 'userswp'));
113		- } else {
114		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' cannot be empty.', 'userswp'));
115		- }
116		- }
117		- }
118		-
119		- $error_code = $errors->get_error_code();
120		- if (!empty($error_code)) {
121		- return $errors;
122		- }
123		-
124		-
125	109	$value = isset($data[$field->htmlvar_name]) ? $data[$field->htmlvar_name] : '';
126	110	$sanitized_value = $value;
127		-
128		- if ($field->field_type == 'password') {
129		- continue;
130		- }
131		-
132	111	$sanitized = false;
133	112
134	113	// sanitize our default fields
135	114	switch($field->htmlvar_name) {
		@@ -134,9 +113,9 @@
134	113	// sanitize our default fields
135	114	switch($field->htmlvar_name) {
136	115
137	116	case 'uwp_register_username':
138		- case 'uwp_account_username':
	117	+ case 'username':
139	118	case 'uwp_login_username':
140	119	case 'uwp_reset_username':
141	120	$sanitized_value = sanitize_user($value);
142	121	$sanitized = true;
		@@ -143,10 +122,10 @@
143	122	break;
144	123
145	124	case 'uwp_register_first_name':
146	125	case 'uwp_register_last_name':
147		- case 'uwp_account_first_name':
148		- case 'uwp_account_last_name':
	126	+ case 'first_name':
	127	+ case 'last_name':
149	128	$sanitized_value = sanitize_text_field($value);
150	129	$sanitized = true;
151	130	break;
152	131
		@@ -151,9 +130,10 @@
151	130	break;
152	131
153	132	case 'uwp_register_email':
154	133	case 'uwp_forgot_email':
155		- case 'uwp_account_email':
	134	+ case 'email':
	135	+ case 'confirm_email':
156	136	$sanitized_value = sanitize_email($value);
157	137	$sanitized = true;
158	138	break;
159	139
		@@ -170,8 +150,12 @@
170	150	case 'checkbox':
171	151	$sanitized_value = sanitize_text_field($value);
172	152	break;
173	153
	154	+ case 'textarea':
	155	+ $sanitized_value = sanitize_textarea_field($value);
	156	+ break;
	157	+
174	158	case 'email':
175	159	$sanitized_value = sanitize_email($value);
176	160	break;
177	161
		@@ -193,8 +177,12 @@
193	177	$sanitized_value = strtotime($date_value);
194	178	}
195	179	break;
196	180
	181	+ case 'editor':
	182	+ $sanitized_value = wp_kses_post( strip_shortcodes( $value ) );
	183	+ break;
	184	+
197	185	default:
198	186	$sanitized_value = sanitize_text_field($value);
199	187
200	188	}
		@@ -199,17 +187,18 @@
199	187
200	188	}
201	189	}
202	190
203		-
204		- if ($field->is_required == 1 && $sanitized_value == '') {
205		- if (is_admin()) {
	191	+ if ($field->is_required == 1 && $sanitized_value == '' && $field->field_type != 'file') {
	192	+ if (isset($GLOBALS['current_screen']) && !is_customize_preview()) {
206	193	//do nothing since admin edit fields can be empty
207	194	} else {
208	195	if ($field->required_msg) {
209		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' '.$field->required_msg, 'userswp'));
	196	+ $errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s %s', 'userswp'), $field->site_title, $field->required_msg));
	197	+ return $errors;
210	198	} else {
211		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' cannot be empty.', 'userswp'));
	199	+ $errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s cannot be empty.', 'userswp'), $field->site_title));
	200	+ return $errors;
212	201	}
213	202	}
214	203	}
215	204
		@@ -215,38 +204,72 @@
215	204
216	205	if ($field->field_type == 'email' && !empty($sanitized_value) && !is_email($sanitized_value)) {
217	206	$incorrect_email_error_msg = apply_filters('uwp_incorrect_email_error_msg', __('<strong>Error</strong>: The email address isn&#8217;t correct.', 'userswp'));
218	207	$errors->add('invalid_email', $incorrect_email_error_msg);
	208	+ return $errors;
219	209	}
220	210
221	211	//register email
222		- if ($type == 'register' && $field->htmlvar_name == 'uwp_account_email' && email_exists($sanitized_value)) {
	212	+ if ($type == 'register' && $field->htmlvar_name == 'email' && email_exists($sanitized_value)) {
223	213	$errors->add('email_exists', __('<strong>Error</strong>: This email is already registered, please choose another one.', 'userswp'));
	214	+ return $errors;
224	215	}
225	216
226	217	//forgot email
227	218	if ($field->htmlvar_name == 'uwp_forgot_email' && !email_exists($sanitized_value)) {
228	219	$errors->add('email_exists', __('<strong>Error</strong>: This email doesn\'t exists.', 'userswp'));
	220	+ return $errors;
229	221	}
230	222
231	223	$incorrect_username_error_msg = apply_filters('uwp_incorrect_username_error_msg', __('<strong>Error</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.', 'userswp'));
232	224
233	225	// Check the username for register
234		- if ($field->htmlvar_name == 'uwp_account_username') {
235		- if (!is_admin()) {
236		- if (!validate_username($sanitized_value)) {
237		- $errors->add('invalid_username', $incorrect_username_error_msg);
238		- }
239		- if (username_exists($sanitized_value)) {
240		- $errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
241		- }
	226	+ if ('register' == $type && $field->htmlvar_name == 'username') {
	227	+ if (!empty($sanitized_value) && !validate_username($sanitized_value)) {
	228	+ $errors->add('invalid_username', $incorrect_username_error_msg);
	229	+ return $errors;
242	230	}
	231	+ if (username_exists($sanitized_value)) {
	232	+ $errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
	233	+ return $errors;
	234	+ }
	235	+ $username_length = uwp_get_option( 'register_username_length');
	236	+ $username_length = !empty($username_length) ? (int)$username_length : 4;
	237	+
	238	+ if(!empty($sanitized_value) && strlen($sanitized_value) < $username_length) {
	239	+ $errors->add('username_length', sprintf(__('<strong>Error</strong>: Username must be %s characters or more.', 'userswp'), $username_length));
	240	+ return $errors;
	241	+ }
243	242	}
244	243
	244	+ // check for the TOS and GDPR validation.
	245	+ if ('register' == $type && ($field->htmlvar_name == 'register_gdpr' || $field->htmlvar_name == 'register_tos' )) {
	246	+
	247	+ if($field->htmlvar_name == 'register_gdpr'){
	248	+ $msg = __('You must read and accept our GDPR policy.', 'userswp');
	249	+ $is_page = uwp_get_option('register_gdpr_page', false);
	250	+ } else {
	251	+ $msg = __('You must accept our terms and conditions.', 'userswp');
	252	+ $is_page = uwp_get_option('register_terms_page', false);
	253	+ }
	254	+
	255	+ if(isset($sanitized_value) && 1 != $sanitized_value && $is_page){
	256	+
	257	+ if ($field->required_msg) {
	258	+ $errors->add('empty_'.$field->htmlvar_name, __($field->required_msg, 'userswp'));
	259	+ return $errors;
	260	+ } else {
	261	+ $errors->add('empty_'.$field->htmlvar_name, $msg);
	262	+ return $errors;
	263	+ }
	264	+ }
	265	+ }
	266	+
245	267	// Check the username for login
246		- if ($field->htmlvar_name == 'uwp_login_username') {
247		- if (!validate_username($sanitized_value)) {
	268	+ if ($type != 'account' && $field->htmlvar_name == 'username') {
	269	+ if (!empty($sanitized_value) && !is_email($sanitized_value) && !validate_username($sanitized_value)) {
248	270	$errors->add('invalid_username', $incorrect_username_error_msg);
	271	+ return $errors;
249	272	}
250	273	}
251	274
252	275
		@@ -259,46 +282,24 @@
259	282	if (!empty($error_code)) {
260	283	return $errors;
261	284	}
262	285
263		- if ($type == 'login') {
264		- $password_type = 'login';
265		- } elseif ($type == 'reset') {
266		- $password_type = 'reset';
267		- } elseif ($type == 'change') {
268		- $password_type = 'change';
269		- } else {
270		- $password_type = 'account';
271		- }
272		-
273		- if (($type == 'change' && $enable_old_password == '1')) {
274		- //check old password
275		- if( empty( $data['uwp_'.$password_type.'_old_password'] ) ) {
	286	+ if ( $type == 'change' && $enable_old_password == '1' ) {
	287	+ $old_pass = isset($data['old_password']) ? $data['old_password'] : "";
	288	+ //check old password
	289	+ if( empty( $old_pass ) ) {
276	290	$errors->add( 'empty_password', __( '<strong>Error</strong>: Please enter your old password', 'userswp' ) );
277		- }
278		-
279		- $error_code = $errors->get_error_code();
280		- if (!empty($error_code)) {
281	291	return $errors;
282	292	}
283	293
284		- $pass = $data['uwp_'.$password_type.'_old_password'];
285	294	$user = get_user_by( 'id', get_current_user_id() );
286		- if ( !wp_check_password( $pass, $user->data->user_pass, $user->ID) ) {
	295	+ if ( !wp_check_password( $old_pass, $user->data->user_pass, $user->ID) ) {
287	296	$errors->add( 'invalid_password', __( '<strong>Error</strong>: Incorrect old password', 'userswp' ) );
288		- }
289		-
290		- $error_code = $errors->get_error_code();
291		- if (!empty($error_code)) {
292	297	return $errors;
293	298	}
294	299
295		- if( $data['uwp_'.$password_type.'_old_password'] == $data['uwp_'.$password_type.'_password'] ) {
296		- $errors->add( 'invalid_password', __( '<strong>Error</strong>: Old password and new password are same', 'userswp' ) );
297		- }
298		-
299		- $error_code = $errors->get_error_code();
300		- if (!empty($error_code)) {
	300	+ if( $old_pass == $data['password'] ) {
	301	+ $errors->add( 'invalid_password', __( '<strong>Error</strong>: The old password and the new password are the same', 'userswp' ) );
301	302	return $errors;
302	303	}
303	304
304	305	}
		@@ -304,32 +305,20 @@
304	305	}
305	306
306	307	if (($type == 'register' && $enable_confirm_email_field == '1')) {
307	308	//check confirm email
308		- if( empty( $data['uwp_account_email'] ) ) {
	309	+ if( empty( $data['email'] ) ) {
309	310	$errors->add( 'empty_email', __( '<strong>Error</strong>: Please enter your Email', 'userswp' ) );
310		- }
311		-
312		- $error_code = $errors->get_error_code();
313		- if (!empty($error_code)) {
314	311	return $errors;
315	312	}
316	313
317		- if( !isset($data['uwp_account_confirm_email']) || empty( $data['uwp_account_confirm_email'] ) ) {
	314	+ if( !isset($data['confirm_email']) || empty( $data['confirm_email'] ) ) {
318	315	$errors->add( 'empty_confirm_email', __( '<strong>Error</strong>: Please fill Confirm Email field', 'userswp' ) );
319		- }
320		-
321		- $error_code = $errors->get_error_code();
322		- if (!empty($error_code)) {
323	316	return $errors;
324	317	}
325	318
326		- if( $data['uwp_account_email'] != $data['uwp_account_confirm_email'] ) {
	319	+ if( $data['email'] != $data['confirm_email'] ) {
327	320	$errors->add( 'email_mismatch', __( '<strong>Error</strong>: Email and Confirm email not match', 'userswp' ) );
328		- }
329		-
330		- $error_code = $errors->get_error_code();
331		- if (!empty($error_code)) {
332	321	return $errors;
333	322	}
334	323
335	324	}
		@@ -335,17 +324,27 @@
335	324	}
336	325
337	326	if ($type == 'change' || $type == 'reset' || $type == 'login' || ($type == 'register' && $enable_password == '1')) {
338	327	//check password
339		- if( empty( $data['uwp_'.$password_type.'_password'] ) ) {
	328	+ if( empty( $data['password'] ) ) {
340	329	$errors->add( 'empty_password', __( 'Please enter a password', 'userswp' ) );
341	330	}
342	331
343		- if ($type != 'login' && strlen($data['uwp_'.$password_type.'_password']) < 7) {
344		- $errors->add('pass_match', __('ERROR: Password must be 7 characters or more.', 'userswp'));
345		- }
	332	+ $password_min_length = uwp_get_option( 'register_password_min_length');
	333	+ $password_min_length = !empty($password_min_length) ? (int)$password_min_length : 8;
346	334
347		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	335	+ $password_max_length = uwp_get_option( 'register_password_max_length');
	336	+ $password_max_length = !empty($password_max_length) ? (int)$password_max_length : 15;
	337	+
	338	+ if ($type != 'login' && (strlen($data['password']) < $password_min_length || strlen($data['password']) > $password_max_length )) {
	339	+ if(strlen($data['password']) > $password_max_length) {
	340	+ $errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or less.', 'userswp'), $password_max_length));
	341	+ } else{
	342	+ $errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or more.', 'userswp'), $password_min_length));
	343	+ }
	344	+ }
	345	+
	346	+ $validated_data['password'] = isset($data['password']) ? $data['password'] : '';
348	347	}
349	348
350	349	$error_code = $errors->get_error_code();
351	350	if (!empty($error_code)) {
		@@ -354,16 +353,16 @@
354	353
355	354	if (($type == 'register' && $enable_password == '1') || $type == 'reset' || $type == 'change') {
356	355
357	356	if (($type == 'register' && $enable_confirm_password_field != '1')) {
358		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	357	+ $validated_data['password'] = $data['password'];
359	358	} else {
360	359	//check password
361		- if ($data['uwp_'.$password_type.'_password'] != $data['uwp_'.$password_type.'_confirm_password']) {
362		- $errors->add('pass_match', __('ERROR: Passwords do not match.', 'userswp'));
	360	+ if ($data['password'] != $data['confirm_password']) {
	361	+ $errors->add('pass_match', __('<strong>Error</strong>: Passwords do not match.', 'userswp'));
363	362	}
364	363
365		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	364	+ $validated_data['password'] = isset($data['password']) ? $data['password'] : '';
366	365	}
367	366	}
368	367
369	368