← All changes | admin/settings/class-formbuilder.php +21 -29 trunk → 1.2.43 View file →

		@@ -1106,9 +1106,8 @@
1106	1106	$form_id = self::get_form_id();
1107	1107	?>
1108	1108	<input type="hidden" name="form_type" id="form_type" value="<?php echo esc_attr( $form_type ); ?>"/>
1109	1109	<input type="hidden" name="manage_field_type" class="manage_field_type" value="custom_fields">
1110		- <input type="hidden" name="uwp_create_field_nonce" class="uwp_create_field_nonce" value="<?php echo wp_create_nonce( 'uwp_create_field_nonce' ); ?>"/>
1111	1110	<ul class="core uwp-tabs-selected uwp_form_extras ps-0 list-group">
1112	1111	<?php
1113	1112	// Retrieve fields saved with form id 0.
1114	1113	if ( $form_id === 1 ) {
		@@ -1215,14 +1214,14 @@
1215	1214	<div class="flex-fill font-weight-bold fw-bold">
1216	1215	<?php if ( $field_type == 'fieldset' ) { ?>
1217	1216	<i class="fas fa-long-arrow-alt-left " aria-hidden="true"></i>
1218	1217	<i class="fas fa-long-arrow-alt-right " aria-hidden="true"></i>
1219		- <b><?php echo esc_html( __( 'Fieldset:', 'userswp' ) ); ?></b>
1220		- <span class="field-type float-end text-end small"><?php echo ' (' . esc_html( $field_site_title ) . ')'; ?></span>
	1218	+ <b><?php echo esc_html( uwp_ucwords( __( 'Fieldset:', 'userswp' ) ) ); ?></b>
	1219	+ <span class="field-type float-end text-end small"><?php echo ' (' . esc_html( uwp_ucwords( $field_site_title ) ) . ')'; ?></span>
1221	1220	<?php } else { ?>
1222	1221	<?php echo $field_icon; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
1223		- <b><?php echo esc_html( ' ' . $field_site_title ); ?></b>
1224		- <span class="field-type float-end text-end small"><?php echo ' (' . esc_html( ucfirst( $field_type_name ) ) . ')'; ?></span>
	1222	+ <b><?php echo esc_html( uwp_ucwords( ' ' . $field_site_title ) ); ?></b>
	1223	+ <span class="field-type float-end text-end small"><?php echo ' (' . esc_html( uwp_ucwords( $field_type_name ) ) . ')'; ?></span>
1225	1224	<?php } ?>
1226	1225	</div>
1227	1226	<div class="dd-handle ui-sortable-handle">
1228	1227	<?php if ( $can_delete ) { ?>
		@@ -1472,19 +1471,20 @@
1472	1471	}
1473	1472
1474	1473	// is_public
1475	1474	if ( has_filter( "uwp_builder_is_public_{$field_type}" ) ) {
	1475	+
1476	1476	echo apply_filters( "uwp_builder_is_public_{$field_type}", '', $result_str, $cf, $field_info ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	1477	+
1477	1478	} else {
1478	1479	$value = '';
1479		-
1480	1480	if ( isset( $field_info->is_public ) ) {
1481		- $value = (int) $field_info->is_public;
1482		- } elseif ( isset( $cf['defaults']['is_public'] ) && ( $cf['defaults']['is_public'] || $cf['defaults']['is_public'] === '0' || $cf['defaults']['is_public'] === 0 ) ) {
1483		- $value = (int) $cf['defaults']['is_public'];
	1481	+ $value = esc_attr( $field_info->is_public );
	1482	+ } elseif ( isset( $cf['defaults']['is_public'] ) && $cf['defaults']['is_public'] ) {
	1483	+ $value = $cf['defaults']['is_public'];
1484	1484	}
1485	1485
1486		- aui()->select(
	1486	+ echo aui()->select(
1487	1487	array(
1488	1488	'id' => 'is_public',
1489	1489	'name' => 'is_public',
1490	1490	'label_type' => 'top',
		@@ -1492,16 +1492,16 @@
1492	1492	'class' => ' mw-100',
1493	1493	'options' => array(
1494	1494	'1' => __( 'Yes', 'userswp' ),
1495	1495	'0' => __( 'No', 'userswp' ),
1496		- '2' => __( 'Let User Decide', 'userswp' )
	1496	+ '2' => __( 'Let User Decide', 'userswp' ),
1497	1497	),
1498	1498	'label' => __( 'Is Public', 'userswp' ) . uwp_help_tip( __( 'If no is selected then the field will not be visible to other users.', 'userswp' ) ),
1499	1499	'value' => $value,
1500		- 'wrap_class' => uwp_advanced_toggle_class()
1501		- ),
1502		- true
	1500	+ 'wrap_class' => uwp_advanced_toggle_class(),
	1501	+ )
1503	1502	);
	1503	+
1504	1504	}
1505	1505
1506	1506	// default_value
1507	1507	if ( has_filter( "uwp_builder_default_value_{$field_type}" ) ) {
		@@ -1817,9 +1817,9 @@
1817	1817	'label_type' => 'top',
1818	1818	'label' => __( 'Validation Pattern', 'userswp' ) . uwp_help_tip( __( 'Enter regex expression for HTML5 pattern validation.', 'userswp' ) ),
1819	1819	'type' => 'text',
1820	1820	'wrap_class' => uwp_advanced_toggle_class(),
1821		- 'value' => wp_slash( $value ), // Keep slashes
	1821	+ 'value' => addslashes_gpc( $value ), // Keep slashes
1822	1822	)
1823	1823	);
1824	1824
1825	1825	$value = '';
		@@ -1851,9 +1851,8 @@
1851	1851	$extras_table_name = uwp_get_table_prefix() . 'uwp_form_extras';
1852	1852	$form_id = self::get_form_id()
1853	1853	?>
1854	1854	<input type="hidden" name="manage_field_type" class="manage_field_type" value="register">
1855		- <input type="hidden" name="uwp_create_field_nonce" class="uwp_create_field_nonce" value="<?php echo wp_create_nonce( 'uwp_create_field_nonce' ); ?>"/>
1856	1855	<ul class="core uwp_form_extras uwp-tabs-selected ps-0 list-group ">
1857	1856	<?php
1858	1857
1859	1858	$fields = $wpdb->get_results(
		@@ -1912,8 +1911,9 @@
1912	1911	}
1913	1912	}
1914	1913	$field_info = stripslashes_deep( $field_info ); // strip slashes
1915	1914	}
	1915	+ $field_site_name = sanitize_title( $field_site_name );
1916	1916
1917	1917	if ( isset( $request['form_type'] ) ) {
1918	1918	$form_type = esc_attr( $request['form_type'] );
1919	1919	} else {
		@@ -1956,10 +1956,9 @@
1956	1956	$nonce = wp_create_nonce( 'uwp_form_extras_nonce' . $result_str );
1957	1957	?>
1958	1958	<div class=" flex-fill font-weight-bold fw-bold">
1959	1959	<?php echo $field_icon; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
1960		- <b><?php echo ' ' . esc_html( $field_site_name ); ?></b>
1961		- <span class="field-type float-end text-end small"><?php echo ' (' . esc_html( ucfirst( $field_type ) ) . ')'; ?></span>
	1960	+ <b><?php echo esc_html( uwp_ucwords( ' ' . $field_site_name ) ); ?></b>
1962	1961	</div>
1963	1962	<div class="dd-handle ui-sortable-handle">
1964	1963	<?php if ( isset( $htmlvar_name ) && ! in_array( $htmlvar_name, $no_actions ) ) { ?>
1965	1964	<i class="far fa-trash-alt text-danger ml-2 ms-2 c-pointer" id="delete-16"
		@@ -2522,12 +2521,9 @@
2522	2521	}
2523	2522
2524	2523	/* ------- check nonce field ------- */
2525	2524	if ( isset( $_REQUEST['update'] ) && $_REQUEST['update'] == 'update' && isset( $_REQUEST['create_field'] ) && isset( $_REQUEST['manage_field_type'] ) && $_REQUEST['manage_field_type'] == 'custom_fields' ) {
2526		- if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'uwp_create_field_nonce' ) ) {
2527		- return;
2528		- }
2529		- echo $this->set_field_order( $field_ids, $form_id ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	2525	+ echo $this->set_field_order( $field_ids, $form_id ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
2530	2526	}
2531	2527
2532	2528	/* ---- Show field form in admin ---- */
2533	2529	if ( $field_type != '' && $field_id != '' && $field_action == 'new' && isset( $_REQUEST['create_field'] ) && isset( $_REQUEST['manage_field_type'] ) && $_REQUEST['manage_field_type'] == 'custom_fields' ) {
		@@ -2555,9 +2551,9 @@
2555	2551	} else {
2556	2552	$tags = '';
2557	2553	}
2558	2554
2559		- if ( $tags != 'skip_field' && !empty( $_REQUEST[ $pkey ] ) ) {
	2555	+ if ( $tags != 'skip_field' ) {
2560	2556	$_REQUEST[ $pkey ] = strip_tags( $_REQUEST[ $pkey ], $tags );
2561	2557	}
2562	2558	}
2563	2559
		@@ -3214,14 +3210,10 @@
3214	3210	$form_id = isset( $_REQUEST['form_id'] ) ? sanitize_text_field( $_REQUEST['form_id'] ) : 1;
3215	3211	$field_id = isset( $_REQUEST['field_id'] ) ? trim( sanitize_text_field( $_REQUEST['field_id'] ), '_' ) : '';
3216	3212	$field_action = isset( $_REQUEST['field_ins_upd'] ) ? sanitize_text_field( $_REQUEST['field_ins_upd'] ) : '';
3217	3213
3218		- /* ------- update order of fields ------- */
3219		- if ( isset( $_REQUEST['update'] ) && $_REQUEST['update'] == 'update' && isset( $_REQUEST['_wpnonce'] )) {
3220		- if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'uwp_create_field_nonce' ) ) {
3221		- return;
3222		- }
3223		-
	3214	+ /* ------- check nonce field ------- */
	3215	+ if ( isset( $_REQUEST['update'] ) && $_REQUEST['update'] == 'update' ) {
3224	3216	$field_ids = array();
3225	3217	if ( ! empty( $_REQUEST['licontainer'] ) && is_array( $_REQUEST['licontainer'] ) ) {
3226	3218	foreach ( $_REQUEST['licontainer'] as $lic_id ) {
3227	3219	$field_ids[] = sanitize_text_field( $lic_id );