userswp / includes / class-validation.php

class-validation.php in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 1.2.51, at includes/class-validation.php

377 lines 15.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Validation related functions
4	*
5	* All UsersWP form validation handled here.
6	*
7	* @since 1.0.0
8	* @author GeoDirectory Team <info@wpgeodirectory.com>
9	*/
10	class UsersWP_Validation {
11
12	/**
13	* Validates the submitted form data.
14	*
15	* @since 1.0.0
16	* @package userswp
17	*
18	* @param array $data Submitted form data
19	* @param string $type Form type.
20	* @param array\|bool $fields Fields applicable for validation.
21	*
22	* @return array\|mixed\|WP_Error Validated form data.
23	*/
24	public function validate_fields($data, $type, $fields = false) {
25
26	$errors = new WP_Error();
27
28	$errors = apply_filters('uwp_validate_fields_before', $errors, $data, $type);
29
30	$error_code = $errors->get_error_code();
31	if (!empty($error_code)) {
32	return $errors;
33	}
34
35	if (!$fields) {
36	global $wpdb;
37	$table_name = uwp_get_table_prefix() . 'uwp_form_fields';
38	if ($type == 'register') {
39	if ( isset( $data['uwp_register_form_id'] ) && ! empty( $data['uwp_register_form_id'] ) ) {
40	$form_id = (int) $data['uwp_register_form_id'];
41	} else {
42	$form_id = 1;
43	}
44	$fields = get_register_validate_form_fields($form_id);
45	} elseif ($type == 'change') {
46	$fields = get_change_validate_form_fields();
47	} elseif ($type == 'account') {
48	$fields = get_account_form_fields();
49	} else {
50	$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' ORDER BY sort_order ASC", array($type)));
51	}
52	}
53
54	$validated_data = array();
55
56	$email_field = uwp_get_custom_field_info('email','account');
57	$email_extra = array();
58	if (isset($email_field->extra_fields) && $email_field->extra_fields != '') {
59	$email_extra = unserialize($email_field->extra_fields);
60	}
61
62	$enable_confirm_email_field = isset($email_extra['confirm_email']) ? $email_extra['confirm_email'] : '0';
63
64	$password_field = uwp_get_custom_field_info('password','account');
65	$enable_password = isset($data['password']) && $password_field->is_active ? 1 : 0;
66	$password_extra = array();
67	if (isset($password_field->extra_fields) && $password_field->extra_fields != '') {
68	$password_extra = unserialize($password_field->extra_fields);
69	}
70
71	$enable_confirm_password_field = isset($password_extra['confirm_password']) ? $password_extra['confirm_password'] : '0';
72
73	$enable_old_password = uwp_get_option('change_enable_old_password', false);
74	$user_id = get_current_user_id();
75	if($user_id && 1 == get_user_meta($user_id, 'is_uwp_social_login_no_password', true)){
76	$enable_old_password = 0;
77	}
78
79	if ($type == 'account' \|\| $type == 'change') {
80	if (!is_user_logged_in()) {
81	$errors->add('not_logged_in', __('<strong>Error</strong>: Permission denied.', 'userswp'));
82	return $errors;
83	}
84	}
85
86	if (!empty($fields)) {
87	foreach ($fields as $field) {
88
89	if (!isset($data[$field->htmlvar_name]) && $field->is_required != 1) {
90	continue;
91	}
92
93
94	if ($type == 'register') {
95
96	if ($enable_password != '1') {
97	if ( ($field->htmlvar_name == 'password') OR ($field->htmlvar_name == 'confirm_password') ) {
98	continue;
99	}
100	}
101
102	if ($enable_confirm_email_field != '1') {
103	if ( $field->htmlvar_name == 'confirm_email' ) {
104	continue;
105	}
106	}
107	}
108
109	$value = isset($data[$field->htmlvar_name]) ? $data[$field->htmlvar_name] : '';
110	$sanitized_value = $value;
111	$sanitized = false;
112
113	// sanitize our default fields
114	switch($field->htmlvar_name) {
115
116	case 'uwp_register_username':
117	case 'username':
118	case 'uwp_login_username':
119	case 'uwp_reset_username':
120	$sanitized_value = sanitize_user($value);
121	$sanitized = true;
122	break;
123
124	case 'uwp_register_first_name':
125	case 'uwp_register_last_name':
126	case 'first_name':
127	case 'last_name':
128	$sanitized_value = sanitize_text_field($value);
129	$sanitized = true;
130	break;
131
132	case 'uwp_register_email':
133	case 'uwp_forgot_email':
134	case 'email':
135	case 'confirm_email':
136	$sanitized_value = sanitize_email($value);
137	$sanitized = true;
138	break;
139
140	}
141
142	if (!$sanitized && !empty($value)) {
143	// sanitize by field type
144	switch($field->field_type) {
145
146	case 'text':
147	$sanitized_value = sanitize_text_field($value);
148	break;
149
150	case 'checkbox':
151	$sanitized_value = sanitize_text_field($value);
152	break;
153
154	case 'textarea':
155	$sanitized_value = sanitize_textarea_field($value);
156	break;
157
158	case 'email':
159	$sanitized_value = sanitize_email($value);
160	break;
161
162	case 'multiselect':
163	$sanitized_value = array_map( 'sanitize_text_field', $value );
164	break;
165
166	case 'datepicker':
167	$sanitized_value = sanitize_text_field($value);
168	$extra_fields = unserialize($field->extra_fields);
169
170	if ($extra_fields['date_format'] == '')
171	$extra_fields['date_format'] = 'yy-mm-dd';
172
173	$date_format = $extra_fields['date_format'];
174
175	if (!empty($sanitized_value)) {
176	$date_value = uwp_date($sanitized_value, 'Y-m-d', $date_format);
177	$sanitized_value = strtotime($date_value);
178	}
179	break;
180
181	case 'editor':
182	$sanitized_value = wp_kses_post( strip_shortcodes( $value ) );
183	break;
184
185	default:
186	$sanitized_value = sanitize_text_field($value);
187
188	}
189	}
190
191	if ($field->is_required == 1 && $sanitized_value == '' && $field->field_type != 'file') {
192	if (isset($GLOBALS['current_screen']) && !is_customize_preview()) {
193	//do nothing since admin edit fields can be empty
194	} else {
195	if ($field->required_msg) {
196	$errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s %s', 'userswp'), $field->site_title, $field->required_msg));
197	return $errors;
198	} else {
199	$errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s cannot be empty.', 'userswp'), $field->site_title));
200	return $errors;
201	}
202	}
203	}
204
205	if ($field->field_type == 'email' && !empty($sanitized_value) && !is_email($sanitized_value)) {
206	$incorrect_email_error_msg = apply_filters('uwp_incorrect_email_error_msg', __('<strong>Error</strong>: The email address isn’t correct.', 'userswp'));
207	$errors->add('invalid_email', $incorrect_email_error_msg);
208	return $errors;
209	}
210
211	//register email
212	if ($type == 'register' && $field->htmlvar_name == 'email' && email_exists($sanitized_value)) {
213	$errors->add('email_exists', __('<strong>Error</strong>: This email is already registered, please choose another one.', 'userswp'));
214	return $errors;
215	}
216
217	//forgot email
218	if ($field->htmlvar_name == 'uwp_forgot_email' && !email_exists($sanitized_value)) {
219	$errors->add('email_exists', __('<strong>Error</strong>: This email doesn\'t exists.', 'userswp'));
220	return $errors;
221	}
222
223	$incorrect_username_error_msg = apply_filters('uwp_incorrect_username_error_msg', __('<strong>Error</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.', 'userswp'));
224
225	// Check the username for register
226	if ('register' == $type && $field->htmlvar_name == 'username') {
227	if (!empty($sanitized_value) && !validate_username($sanitized_value)) {
228	$errors->add('invalid_username', $incorrect_username_error_msg);
229	return $errors;
230	}
231	if (username_exists($sanitized_value)) {
232	$errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
233	return $errors;
234	}
235	$username_length = uwp_get_option( 'register_username_length', 4);
236	$username_length_max = uwp_get_option( 'register_username_length_max', 20);
237
238	if(!empty($sanitized_value) && (strlen($sanitized_value) < $username_length \|\| strlen($sanitized_value) > $username_length_max)) {
239	$errors->add('username_length', sprintf(__('<strong>Error</strong>: Username must be between %s and %s characters.', 'userswp'), $username_length, $username_length_max));
240	return $errors;
241	}
242	}
243
244	// check for the TOS and GDPR validation.
245	if ('register' == $type && ($field->htmlvar_name == 'register_gdpr' \|\| $field->htmlvar_name == 'register_tos' )) {
246
247	if($field->htmlvar_name == 'register_gdpr'){
248	$msg = __('You must read and accept our GDPR policy.', 'userswp');
249	$is_page = uwp_get_option('register_gdpr_page', false);
250	} else {
251	$msg = __('You must accept our terms and conditions.', 'userswp');
252	$is_page = uwp_get_option('register_terms_page', false);
253	}
254
255	if(isset($sanitized_value) && 1 != $sanitized_value && $is_page){
256
257	if ($field->required_msg) {
258	$errors->add('empty_'.$field->htmlvar_name, __($field->required_msg, 'userswp'));
259	return $errors;
260	} else {
261	$errors->add('empty_'.$field->htmlvar_name, $msg);
262	return $errors;
263	}
264	}
265	}
266
267	// Check the username for login
268	if ($type != 'account' && $field->htmlvar_name == 'username') {
269	if (!empty($sanitized_value) && !is_email($sanitized_value) && !validate_username($sanitized_value)) {
270	$errors->add('invalid_username', $incorrect_username_error_msg);
271	return $errors;
272	}
273	}
274
275
276	$validated_data[$field->htmlvar_name] = $sanitized_value;
277
278	}
279	}
280
281	$error_code = $errors->get_error_code();
282	if (!empty($error_code)) {
283	return $errors;
284	}
285
286	if ( $type == 'change' && $enable_old_password == '1' ) {
287	$old_pass = isset($data['old_password']) ? $data['old_password'] : "";
288	//check old password
289	if( empty( $old_pass ) ) {
290	$errors->add( 'empty_password', __( '<strong>Error</strong>: Please enter your old password', 'userswp' ) );
291	return $errors;
292	}
293
294	$user = get_user_by( 'id', get_current_user_id() );
295	if ( !wp_check_password( $old_pass, $user->data->user_pass, $user->ID) ) {
296	$errors->add( 'invalid_password', __( '<strong>Error</strong>: Incorrect old password', 'userswp' ) );
297	return $errors;
298	}
299
300	if( $old_pass == $data['password'] ) {
301	$errors->add( 'invalid_password', __( '<strong>Error</strong>: The old password and the new password are the same', 'userswp' ) );
302	return $errors;
303	}
304
305	}
306
307	if (($type == 'register' && $enable_confirm_email_field == '1')) {
308	//check confirm email
309	if( empty( $data['email'] ) ) {
310	$errors->add( 'empty_email', __( '<strong>Error</strong>: Please enter your Email', 'userswp' ) );
311	return $errors;
312	}
313
314	if( !isset($data['confirm_email']) \|\| empty( $data['confirm_email'] ) ) {
315	$errors->add( 'empty_confirm_email', __( '<strong>Error</strong>: Please fill Confirm Email field', 'userswp' ) );
316	return $errors;
317	}
318
319	if( $data['email'] != $data['confirm_email'] ) {
320	$errors->add( 'email_mismatch', __( '<strong>Error</strong>: Email and Confirm email not match', 'userswp' ) );
321	return $errors;
322	}
323
324	}
325
326	if ($type == 'change' \|\| $type == 'reset' \|\| $type == 'login' \|\| ($type == 'register' && $enable_password == '1')) {
327	//check password
328	if( empty( $data['password'] ) ) {
329	$errors->add( 'empty_password', __( 'Please enter a password', 'userswp' ) );
330	}
331
332	$password_min_length = uwp_get_option( 'register_password_min_length');
333	$password_min_length = !empty($password_min_length) ? (int)$password_min_length : 8;
334
335	$password_max_length = uwp_get_option( 'register_password_max_length');
336	$password_max_length = !empty($password_max_length) ? (int)$password_max_length : 15;
337
338	if ($type != 'login' && (strlen($data['password']) < $password_min_length \|\| strlen($data['password']) > $password_max_length )) {
339	if(strlen($data['password']) > $password_max_length) {
340	$errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or less.', 'userswp'), $password_max_length));
341	} else{
342	$errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or more.', 'userswp'), $password_min_length));
343	}
344	}
345
346	$validated_data['password'] = isset($data['password']) ? $data['password'] : '';
347	}
348
349	$error_code = $errors->get_error_code();
350	if (!empty($error_code)) {
351	return $errors;
352	}
353
354	if (($type == 'register' && $enable_password == '1') \|\| $type == 'reset' \|\| $type == 'change') {
355
356	if (($type == 'register' && $enable_confirm_password_field != '1')) {
357	$validated_data['password'] = $data['password'];
358	} else {
359	//check password
360	if ($data['password'] != $data['confirm_password']) {
361	$errors->add('pass_match', __('<strong>Error</strong>: Passwords do not match.', 'userswp'));
362	}
363
364	$validated_data['password'] = isset($data['password']) ? $data['password'] : '';
365	}
366	}
367
368
369	$error_code = $errors->get_error_code();
370	if (!empty($error_code)) {
371	return $errors;
372	}
373
374	return $validated_data;
375	}
376
377	}