← All changes | includes/class-validation.php +109 -111 1.0.22 → 1.2.38 View file →

		@@ -18,9 +18,9 @@
18	18	* @param array $data Submitted form data
19	19	* @param string $type Form type.
20	20	* @param array|bool $fields Fields applicable for validation.
21	21	*
22		- * @return array|mixed|void|WP_Error Validated form data.
	22	+ * @return array|mixed|WP_Error Validated form data.
23	23	*/
24	24	public function validate_fields($data, $type, $fields = false) {
25	25
26	26	$errors = new WP_Error();
		@@ -31,23 +31,22 @@
31	31	if (!empty($error_code)) {
32	32	return $errors;
33	33	}
34	34
35		-
36	35	if (!$fields) {
37	36	global $wpdb;
38	37	$table_name = uwp_get_table_prefix() . 'uwp_form_fields';
39	38	if ($type == 'register') {
40		- if (isset($data["uwp_role_id"])) {
41		- $role_id = (int) strip_tags(esc_sql($data["uwp_role_id"]));
42		- } else {
43		- $role_id = 0;
44		- }
45		- $fields = get_register_validate_form_fields($role_id);
	39	+ if ( isset( $data['uwp_register_form_id'] ) && ! empty( $data['uwp_register_form_id'] ) ) {
	40	+ $form_id = (int) $data['uwp_register_form_id'];
	41	+ } else {
	42	+ $form_id = 1;
	43	+ }
	44	+ $fields = get_register_validate_form_fields($form_id);
46	45	} elseif ($type == 'change') {
47	46	$fields = get_change_validate_form_fields();
48	47	} elseif ($type == 'account') {
49		- $fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' AND is_register_only_field = '0' AND htmlvar_name != 'uwp_account_password' ORDER BY sort_order ASC", array('account')));
	48	+ $fields = get_account_form_fields();
50	49	} else {
51	50	$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' ORDER BY sort_order ASC", array($type)));
52	51	}
53	52	}
		@@ -53,28 +52,35 @@
53	52	}
54	53
55	54	$validated_data = array();
56	55
57		- $email_field = uwp_get_custom_field_info('uwp_account_email');
	56	+ $email_field = uwp_get_custom_field_info('email','account');
58	57	$email_extra = array();
59	58	if (isset($email_field->extra_fields) && $email_field->extra_fields != '') {
60	59	$email_extra = unserialize($email_field->extra_fields);
61	60	}
	61	+
62	62	$enable_confirm_email_field = isset($email_extra['confirm_email']) ? $email_extra['confirm_email'] : '0';
63	63
64		- $password_field = uwp_get_custom_field_info('uwp_account_password');
65		- $enable_password = $password_field->is_active;
	64	+ $password_field = uwp_get_custom_field_info('password','account');
	65	+ $enable_password = isset($data['password']) && $password_field->is_active ? 1 : 0;
66	66	$password_extra = array();
67	67	if (isset($password_field->extra_fields) && $password_field->extra_fields != '') {
68	68	$password_extra = unserialize($password_field->extra_fields);
69	69	}
	70	+
70	71	$enable_confirm_password_field = isset($password_extra['confirm_password']) ? $password_extra['confirm_password'] : '0';
71	72
72	73	$enable_old_password = uwp_get_option('change_enable_old_password', false);
	74	+ $user_id = get_current_user_id();
	75	+ if($user_id && 1 == get_user_meta($user_id, 'is_uwp_social_login_no_password', true)){
	76	+ $enable_old_password = 0;
	77	+ }
73	78
74	79	if ($type == 'account' || $type == 'change') {
75	80	if (!is_user_logged_in()) {
76	81	$errors->add('not_logged_in', __('<strong>Error</strong>: Permission denied.', 'userswp'));
	82	+ return $errors;
77	83	}
78	84	}
79	85
80	86	if (!empty($fields)) {
		@@ -87,46 +93,22 @@
87	93
88	94	if ($type == 'register') {
89	95
90	96	if ($enable_password != '1') {
91		- if ( ($field->htmlvar_name == 'uwp_account_password') OR ($field->htmlvar_name == 'uwp_account_confirm_password') ) {
	97	+ if ( ($field->htmlvar_name == 'password') OR ($field->htmlvar_name == 'confirm_password') ) {
92	98	continue;
93	99	}
94	100	}
95	101
96	102	if ($enable_confirm_email_field != '1') {
97		- if ( $field->htmlvar_name == 'uwp_account_confirm_email' ) {
	103	+ if ( $field->htmlvar_name == 'confirm_email' ) {
98	104	continue;
99	105	}
100	106	}
101	107	}
102	108
103		-
104		- if (!isset($data[$field->htmlvar_name]) && $field->is_required == 1) {
105		- if (is_admin()) {
106		- //do nothing since admin edit fields can be empty
107		- } else {
108		- if ($field->required_msg) {
109		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' '.$field->required_msg, 'userswp'));
110		- } else {
111		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' cannot be empty.', 'userswp'));
112		- }
113		- }
114		- }
115		-
116		- $error_code = $errors->get_error_code();
117		- if (!empty($error_code)) {
118		- return $errors;
119		- }
120		-
121		-
122	109	$value = isset($data[$field->htmlvar_name]) ? $data[$field->htmlvar_name] : '';
123	110	$sanitized_value = $value;
124		-
125		- if ($field->field_type == 'password') {
126		- continue;
127		- }
128		-
129	111	$sanitized = false;
130	112
131	113	// sanitize our default fields
132	114	switch($field->htmlvar_name) {
		@@ -131,9 +113,9 @@
131	113	// sanitize our default fields
132	114	switch($field->htmlvar_name) {
133	115
134	116	case 'uwp_register_username':
135		- case 'uwp_account_username':
	117	+ case 'username':
136	118	case 'uwp_login_username':
137	119	case 'uwp_reset_username':
138	120	$sanitized_value = sanitize_user($value);
139	121	$sanitized = true;
		@@ -140,10 +122,10 @@
140	122	break;
141	123
142	124	case 'uwp_register_first_name':
143	125	case 'uwp_register_last_name':
144		- case 'uwp_account_first_name':
145		- case 'uwp_account_last_name':
	126	+ case 'first_name':
	127	+ case 'last_name':
146	128	$sanitized_value = sanitize_text_field($value);
147	129	$sanitized = true;
148	130	break;
149	131
		@@ -148,9 +130,10 @@
148	130	break;
149	131
150	132	case 'uwp_register_email':
151	133	case 'uwp_forgot_email':
152		- case 'uwp_account_email':
	134	+ case 'email':
	135	+ case 'confirm_email':
153	136	$sanitized_value = sanitize_email($value);
154	137	$sanitized = true;
155	138	break;
156	139
		@@ -194,8 +177,12 @@
194	177	$sanitized_value = strtotime($date_value);
195	178	}
196	179	break;
197	180
	181	+ case 'editor':
	182	+ $sanitized_value = wp_kses_post( strip_shortcodes( $value ) );
	183	+ break;
	184	+
198	185	default:
199	186	$sanitized_value = sanitize_text_field($value);
200	187
201	188	}
		@@ -200,17 +187,18 @@
200	187
201	188	}
202	189	}
203	190
204		-
205		- if ($field->is_required == 1 && $sanitized_value == '') {
206		- if (is_admin()) {
	191	+ if ($field->is_required == 1 && $sanitized_value == '' && $field->field_type != 'file') {
	192	+ if (isset($GLOBALS['current_screen']) && !is_customize_preview()) {
207	193	//do nothing since admin edit fields can be empty
208	194	} else {
209	195	if ($field->required_msg) {
210		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' '.$field->required_msg, 'userswp'));
	196	+ $errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s %s', 'userswp'), $field->site_title, $field->required_msg));
	197	+ return $errors;
211	198	} else {
212		- $errors->add('empty_'.$field->htmlvar_name, __('<strong>Error</strong>: '.$field->site_title.' cannot be empty.', 'userswp'));
	199	+ $errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s cannot be empty.', 'userswp'), $field->site_title));
	200	+ return $errors;
213	201	}
214	202	}
215	203	}
216	204
		@@ -216,38 +204,72 @@
216	204
217	205	if ($field->field_type == 'email' && !empty($sanitized_value) && !is_email($sanitized_value)) {
218	206	$incorrect_email_error_msg = apply_filters('uwp_incorrect_email_error_msg', __('<strong>Error</strong>: The email address isn&#8217;t correct.', 'userswp'));
219	207	$errors->add('invalid_email', $incorrect_email_error_msg);
	208	+ return $errors;
220	209	}
221	210
222	211	//register email
223		- if ($type == 'register' && $field->htmlvar_name == 'uwp_account_email' && email_exists($sanitized_value)) {
	212	+ if ($type == 'register' && $field->htmlvar_name == 'email' && email_exists($sanitized_value)) {
224	213	$errors->add('email_exists', __('<strong>Error</strong>: This email is already registered, please choose another one.', 'userswp'));
	214	+ return $errors;
225	215	}
226	216
227	217	//forgot email
228	218	if ($field->htmlvar_name == 'uwp_forgot_email' && !email_exists($sanitized_value)) {
229	219	$errors->add('email_exists', __('<strong>Error</strong>: This email doesn\'t exists.', 'userswp'));
	220	+ return $errors;
230	221	}
231	222
232	223	$incorrect_username_error_msg = apply_filters('uwp_incorrect_username_error_msg', __('<strong>Error</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.', 'userswp'));
233	224
234	225	// Check the username for register
235		- if ($field->htmlvar_name == 'uwp_account_username') {
236		- if (!is_admin()) {
237		- if (!validate_username($sanitized_value)) {
238		- $errors->add('invalid_username', $incorrect_username_error_msg);
239		- }
240		- if (username_exists($sanitized_value)) {
241		- $errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
242		- }
	226	+ if ('register' == $type && $field->htmlvar_name == 'username') {
	227	+ if (!empty($sanitized_value) && !validate_username($sanitized_value)) {
	228	+ $errors->add('invalid_username', $incorrect_username_error_msg);
	229	+ return $errors;
243	230	}
	231	+ if (username_exists($sanitized_value)) {
	232	+ $errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
	233	+ return $errors;
	234	+ }
	235	+ $username_length = uwp_get_option( 'register_username_length', 4);
	236	+ $username_length_max = uwp_get_option( 'register_username_length_max', 20);
	237	+
	238	+ if(!empty($sanitized_value) && (strlen($sanitized_value) < $username_length || strlen($sanitized_value) > $username_length_max)) {
	239	+ $errors->add('username_length', sprintf(__('<strong>Error</strong>: Username must be between %s and %s characters.', 'userswp'), $username_length, $username_length_max));
	240	+ return $errors;
	241	+ }
244	242	}
245	243
	244	+ // check for the TOS and GDPR validation.
	245	+ if ('register' == $type && ($field->htmlvar_name == 'register_gdpr' || $field->htmlvar_name == 'register_tos' )) {
	246	+
	247	+ if($field->htmlvar_name == 'register_gdpr'){
	248	+ $msg = __('You must read and accept our GDPR policy.', 'userswp');
	249	+ $is_page = uwp_get_option('register_gdpr_page', false);
	250	+ } else {
	251	+ $msg = __('You must accept our terms and conditions.', 'userswp');
	252	+ $is_page = uwp_get_option('register_terms_page', false);
	253	+ }
	254	+
	255	+ if(isset($sanitized_value) && 1 != $sanitized_value && $is_page){
	256	+
	257	+ if ($field->required_msg) {
	258	+ $errors->add('empty_'.$field->htmlvar_name, __($field->required_msg, 'userswp'));
	259	+ return $errors;
	260	+ } else {
	261	+ $errors->add('empty_'.$field->htmlvar_name, $msg);
	262	+ return $errors;
	263	+ }
	264	+ }
	265	+ }
	266	+
246	267	// Check the username for login
247		- if ($field->htmlvar_name == 'uwp_login_username') {
248		- if (!validate_username($sanitized_value)) {
	268	+ if ($type != 'account' && $field->htmlvar_name == 'username') {
	269	+ if (!empty($sanitized_value) && !is_email($sanitized_value) && !validate_username($sanitized_value)) {
249	270	$errors->add('invalid_username', $incorrect_username_error_msg);
	271	+ return $errors;
250	272	}
251	273	}
252	274
253	275
		@@ -260,46 +282,24 @@
260	282	if (!empty($error_code)) {
261	283	return $errors;
262	284	}
263	285
264		- if ($type == 'login') {
265		- $password_type = 'login';
266		- } elseif ($type == 'reset') {
267		- $password_type = 'reset';
268		- } elseif ($type == 'change') {
269		- $password_type = 'change';
270		- } else {
271		- $password_type = 'account';
272		- }
273		-
274		- if (($type == 'change' && $enable_old_password == '1')) {
275		- //check old password
276		- if( empty( $data['uwp_'.$password_type.'_old_password'] ) ) {
	286	+ if ( $type == 'change' && $enable_old_password == '1' ) {
	287	+ $old_pass = isset($data['old_password']) ? $data['old_password'] : "";
	288	+ //check old password
	289	+ if( empty( $old_pass ) ) {
277	290	$errors->add( 'empty_password', __( '<strong>Error</strong>: Please enter your old password', 'userswp' ) );
278		- }
279		-
280		- $error_code = $errors->get_error_code();
281		- if (!empty($error_code)) {
282	291	return $errors;
283	292	}
284	293
285		- $pass = $data['uwp_'.$password_type.'_old_password'];
286	294	$user = get_user_by( 'id', get_current_user_id() );
287		- if ( !wp_check_password( $pass, $user->data->user_pass, $user->ID) ) {
	295	+ if ( !wp_check_password( $old_pass, $user->data->user_pass, $user->ID) ) {
288	296	$errors->add( 'invalid_password', __( '<strong>Error</strong>: Incorrect old password', 'userswp' ) );
289		- }
290		-
291		- $error_code = $errors->get_error_code();
292		- if (!empty($error_code)) {
293	297	return $errors;
294	298	}
295	299
296		- if( $data['uwp_'.$password_type.'_old_password'] == $data['uwp_'.$password_type.'_password'] ) {
297		- $errors->add( 'invalid_password', __( '<strong>Error</strong>: Old password and new password are same', 'userswp' ) );
298		- }
299		-
300		- $error_code = $errors->get_error_code();
301		- if (!empty($error_code)) {
	300	+ if( $old_pass == $data['password'] ) {
	301	+ $errors->add( 'invalid_password', __( '<strong>Error</strong>: The old password and the new password are the same', 'userswp' ) );
302	302	return $errors;
303	303	}
304	304
305	305	}
		@@ -305,32 +305,20 @@
305	305	}
306	306
307	307	if (($type == 'register' && $enable_confirm_email_field == '1')) {
308	308	//check confirm email
309		- if( empty( $data['uwp_account_email'] ) ) {
	309	+ if( empty( $data['email'] ) ) {
310	310	$errors->add( 'empty_email', __( '<strong>Error</strong>: Please enter your Email', 'userswp' ) );
311		- }
312		-
313		- $error_code = $errors->get_error_code();
314		- if (!empty($error_code)) {
315	311	return $errors;
316	312	}
317	313
318		- if( !isset($data['uwp_account_confirm_email']) || empty( $data['uwp_account_confirm_email'] ) ) {
	314	+ if( !isset($data['confirm_email']) || empty( $data['confirm_email'] ) ) {
319	315	$errors->add( 'empty_confirm_email', __( '<strong>Error</strong>: Please fill Confirm Email field', 'userswp' ) );
320		- }
321		-
322		- $error_code = $errors->get_error_code();
323		- if (!empty($error_code)) {
324	316	return $errors;
325	317	}
326	318
327		- if( $data['uwp_account_email'] != $data['uwp_account_confirm_email'] ) {
	319	+ if( $data['email'] != $data['confirm_email'] ) {
328	320	$errors->add( 'email_mismatch', __( '<strong>Error</strong>: Email and Confirm email not match', 'userswp' ) );
329		- }
330		-
331		- $error_code = $errors->get_error_code();
332		- if (!empty($error_code)) {
333	321	return $errors;
334	322	}
335	323
336	324	}
		@@ -336,17 +324,27 @@
336	324	}
337	325
338	326	if ($type == 'change' || $type == 'reset' || $type == 'login' || ($type == 'register' && $enable_password == '1')) {
339	327	//check password
340		- if( empty( $data['uwp_'.$password_type.'_password'] ) ) {
	328	+ if( empty( $data['password'] ) ) {
341	329	$errors->add( 'empty_password', __( 'Please enter a password', 'userswp' ) );
342	330	}
343	331
344		- if ($type != 'login' && strlen($data['uwp_'.$password_type.'_password']) < 7) {
345		- $errors->add('pass_match', __('ERROR: Password must be 7 characters or more.', 'userswp'));
346		- }
	332	+ $password_min_length = uwp_get_option( 'register_password_min_length');
	333	+ $password_min_length = !empty($password_min_length) ? (int)$password_min_length : 8;
347	334
348		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	335	+ $password_max_length = uwp_get_option( 'register_password_max_length');
	336	+ $password_max_length = !empty($password_max_length) ? (int)$password_max_length : 15;
	337	+
	338	+ if ($type != 'login' && (strlen($data['password']) < $password_min_length || strlen($data['password']) > $password_max_length )) {
	339	+ if(strlen($data['password']) > $password_max_length) {
	340	+ $errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or less.', 'userswp'), $password_max_length));
	341	+ } else{
	342	+ $errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or more.', 'userswp'), $password_min_length));
	343	+ }
	344	+ }
	345	+
	346	+ $validated_data['password'] = isset($data['password']) ? $data['password'] : '';
349	347	}
350	348
351	349	$error_code = $errors->get_error_code();
352	350	if (!empty($error_code)) {
		@@ -355,16 +353,16 @@
355	353
356	354	if (($type == 'register' && $enable_password == '1') || $type == 'reset' || $type == 'change') {
357	355
358	356	if (($type == 'register' && $enable_confirm_password_field != '1')) {
359		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	357	+ $validated_data['password'] = $data['password'];
360	358	} else {
361	359	//check password
362		- if ($data['uwp_'.$password_type.'_password'] != $data['uwp_'.$password_type.'_confirm_password']) {
363		- $errors->add('pass_match', __('ERROR: Passwords do not match.', 'userswp'));
	360	+ if ($data['password'] != $data['confirm_password']) {
	361	+ $errors->add('pass_match', __('<strong>Error</strong>: Passwords do not match.', 'userswp'));
364	362	}
365	363
366		- $validated_data['password'] = $data['uwp_'.$password_type.'_password'];
	364	+ $validated_data['password'] = isset($data['password']) ? $data['password'] : '';
367	365	}
368	366	}
369	367
370	368