userswp / includes / class-validation.php

class-validation.php in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 1.2.61, at includes/class-validation.php

380 lines 16.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Validation related functions
4	*
5	* All UsersWP form validation handled here.
6	*
7	* @since 1.0.0
8	* @author GeoDirectory Team <info@wpgeodirectory.com>
9	*/
10	class UsersWP_Validation {
11
12	/**
13	* Validates the submitted form data.
14	*
15	* @since 1.0.0
16	* @package userswp
17	*
18	* @param array $data Submitted form data
19	* @param string $type Form type.
20	* @param array\|bool $fields Fields applicable for validation.
21	*
22	* @return array\|mixed\|WP_Error Validated form data.
23	*/
24	public function validate_fields($data, $type, $fields = false) {
25
26	$errors = new WP_Error();
27
28	$errors = apply_filters('uwp_validate_fields_before', $errors, $data, $type);
29
30	$error_code = $errors->get_error_code();
31	if (!empty($error_code)) {
32	return $errors;
33	}
34
35	if (!$fields) {
36	global $wpdb;
37	$table_name = uwp_get_table_prefix() . 'uwp_form_fields';
38	if ($type == 'register') {
39	if ( isset( $data['uwp_register_form_id'] ) && ! empty( $data['uwp_register_form_id'] ) ) {
40	$form_id = (int) $data['uwp_register_form_id'];
41	} else {
42	$form_id = 1;
43	}
44	$fields = get_register_validate_form_fields($form_id);
45	} elseif ($type == 'change') {
46	$fields = get_change_validate_form_fields();
47	} elseif ($type == 'account') {
48	$fields = get_account_form_fields();
49	} else {
50	$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $table_name . " WHERE form_type = %s AND field_type != 'fieldset' AND field_type != 'file' AND is_active = '1' ORDER BY sort_order ASC", array($type)));
51	}
52	}
53
54	$validated_data = array();
55
56	$email_field = uwp_get_custom_field_info('email','account');
57	$email_extra = array();
58	if (isset($email_field->extra_fields) && $email_field->extra_fields != '') {
59	$email_extra = unserialize($email_field->extra_fields);
60	}
61
62	$enable_confirm_email_field = isset($email_extra['confirm_email']) ? $email_extra['confirm_email'] : '0';
63
64	$password_field = uwp_get_custom_field_info('password','account');
65	$enable_password = isset($data['password']) && $password_field->is_active ? 1 : 0;
66	$password_extra = array();
67	if (isset($password_field->extra_fields) && $password_field->extra_fields != '') {
68	$password_extra = unserialize($password_field->extra_fields);
69	}
70
71	$enable_confirm_password_field = isset($password_extra['confirm_password']) ? $password_extra['confirm_password'] : '0';
72
73	$enable_old_password = uwp_get_option('change_enable_old_password', false);
74	$user_id = get_current_user_id();
75	if($user_id && 1 == get_user_meta($user_id, 'is_uwp_social_login_no_password', true)){
76	$enable_old_password = 0;
77	}
78
79	if ($type == 'account' \|\| $type == 'change') {
80	if (!is_user_logged_in()) {
81	$errors->add('not_logged_in', __('<strong>Error</strong>: Permission denied.', 'userswp'));
82	return $errors;
83	}
84	}
85
86	if (!empty($fields)) {
87	foreach ($fields as $field) {
88
89	if (!isset($data[$field->htmlvar_name]) && $field->is_required != 1) {
90	continue;
91	}
92
93
94	if ($type == 'register') {
95
96	if ($enable_password != '1') {
97	if ( ($field->htmlvar_name == 'password') OR ($field->htmlvar_name == 'confirm_password') ) {
98	continue;
99	}
100	}
101
102	if ($enable_confirm_email_field != '1') {
103	if ( $field->htmlvar_name == 'confirm_email' ) {
104	continue;
105	}
106	}
107	}
108
109	$value = isset($data[$field->htmlvar_name]) ? $data[$field->htmlvar_name] : '';
110	$sanitized_value = $value;
111	$sanitized = false;
112
113	// sanitize our default fields
114	switch($field->htmlvar_name) {
115
116	case 'uwp_register_username':
117	case 'username':
118	case 'uwp_login_username':
119	case 'uwp_reset_username':
120	$sanitized_value = sanitize_user($value);
121	$sanitized = true;
122	break;
123
124	case 'uwp_register_first_name':
125	case 'uwp_register_last_name':
126	case 'first_name':
127	case 'last_name':
128	$sanitized_value = sanitize_text_field($value);
129	$sanitized = true;
130	break;
131
132	case 'uwp_register_email':
133	case 'uwp_forgot_email':
134	case 'email':
135	case 'confirm_email':
136	$sanitized_value = sanitize_email($value);
137	$sanitized = true;
138	break;
139
140	}
141
142	if (!$sanitized && !empty($value)) {
143	// sanitize by field type
144	switch($field->field_type) {
145
146	case 'text':
147	$sanitized_value = sanitize_text_field($value);
148	break;
149
150	case 'checkbox':
151	$sanitized_value = sanitize_text_field($value);
152	break;
153
154	case 'textarea':
155	$sanitized_value = sanitize_textarea_field($value);
156	break;
157
158	case 'email':
159	$sanitized_value = sanitize_email($value);
160	break;
161
162	case 'multiselect':
163	$sanitized_value = array_map( 'sanitize_text_field', $value );
164	break;
165
166	case 'datepicker':
167	$sanitized_value = sanitize_text_field($value);
168	$extra_fields = unserialize($field->extra_fields);
169
170	if ($extra_fields['date_format'] == '')
171	$extra_fields['date_format'] = 'yy-mm-dd';
172
173	$date_format = $extra_fields['date_format'];
174
175	if (!empty($sanitized_value)) {
176	$date_value = uwp_date($sanitized_value, 'Y-m-d', $date_format);
177	$sanitized_value = strtotime($date_value);
178	}
179	break;
180
181	case 'editor':
182	$sanitized_value = wp_kses_post( strip_shortcodes( $value ) );
183	break;
184
185	case 'url':
186	$sanitized_value = sanitize_url( wp_unslash( $value ) );
187	break;
188
189	default:
190	$sanitized_value = sanitize_text_field($value);
191	}
192	}
193
194	if ($field->is_required == 1 && $sanitized_value == '' && $field->field_type != 'file') {
195	if (isset($GLOBALS['current_screen']) && !is_customize_preview()) {
196	//do nothing since admin edit fields can be empty
197	} else {
198	if ($field->required_msg) {
199	$errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s %s', 'userswp'), $field->site_title, $field->required_msg));
200	return $errors;
201	} else {
202	$errors->add('empty_'.$field->htmlvar_name, sprintf(__('<strong>Error</strong>: %s cannot be empty.', 'userswp'), $field->site_title));
203	return $errors;
204	}
205	}
206	}
207
208	if ($field->field_type == 'email' && !empty($sanitized_value) && !is_email($sanitized_value)) {
209	$incorrect_email_error_msg = apply_filters('uwp_incorrect_email_error_msg', __('<strong>Error</strong>: The email address isn’t correct.', 'userswp'));
210	$errors->add('invalid_email', $incorrect_email_error_msg);
211	return $errors;
212	}
213
214	//register email
215	if ($type == 'register' && $field->htmlvar_name == 'email' && email_exists($sanitized_value)) {
216	$errors->add('email_exists', __('<strong>Error</strong>: This email is already registered, please choose another one.', 'userswp'));
217	return $errors;
218	}
219
220	//forgot email
221	if ($field->htmlvar_name == 'uwp_forgot_email' && !email_exists($sanitized_value)) {
222	$errors->add('email_exists', __('<strong>Error</strong>: This email doesn\'t exists.', 'userswp'));
223	return $errors;
224	}
225
226	$incorrect_username_error_msg = apply_filters('uwp_incorrect_username_error_msg', __('<strong>Error</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.', 'userswp'));
227
228	// Check the username for register
229	if ('register' == $type && $field->htmlvar_name == 'username') {
230	if (!empty($sanitized_value) && !validate_username($sanitized_value)) {
231	$errors->add('invalid_username', $incorrect_username_error_msg);
232	return $errors;
233	}
234	if (username_exists($sanitized_value)) {
235	$errors->add('username_exists', __('<strong>Error</strong>: This username is already registered. Please choose another one.', 'userswp'));
236	return $errors;
237	}
238	$username_length = uwp_get_option( 'register_username_length', 4);
239	$username_length_max = uwp_get_option( 'register_username_length_max', 20);
240
241	if(!empty($sanitized_value) && (strlen($sanitized_value) < $username_length \|\| strlen($sanitized_value) > $username_length_max)) {
242	$errors->add('username_length', sprintf(__('<strong>Error</strong>: Username must be between %s and %s characters.', 'userswp'), $username_length, $username_length_max));
243	return $errors;
244	}
245	}
246
247	// check for the TOS and GDPR validation.
248	if ('register' == $type && ($field->htmlvar_name == 'register_gdpr' \|\| $field->htmlvar_name == 'register_tos' )) {
249
250	if($field->htmlvar_name == 'register_gdpr'){
251	$msg = __('You must read and accept our GDPR policy.', 'userswp');
252	$is_page = uwp_get_option('register_gdpr_page', false);
253	} else {
254	$msg = __('You must accept our terms and conditions.', 'userswp');
255	$is_page = uwp_get_option('register_terms_page', false);
256	}
257
258	if(isset($sanitized_value) && 1 != $sanitized_value && $is_page){
259
260	if ($field->required_msg) {
261	$errors->add('empty_'.$field->htmlvar_name, __($field->required_msg, 'userswp'));
262	return $errors;
263	} else {
264	$errors->add('empty_'.$field->htmlvar_name, $msg);
265	return $errors;
266	}
267	}
268	}
269
270	// Check the username for login
271	if ($type != 'account' && $field->htmlvar_name == 'username') {
272	if (!empty($sanitized_value) && !is_email($sanitized_value) && !validate_username($sanitized_value)) {
273	$errors->add('invalid_username', $incorrect_username_error_msg);
274	return $errors;
275	}
276	}
277
278
279	$validated_data[$field->htmlvar_name] = $sanitized_value;
280
281	}
282	}
283
284	$error_code = $errors->get_error_code();
285	if (!empty($error_code)) {
286	return $errors;
287	}
288
289	if ( $type == 'change' && $enable_old_password == '1' ) {
290	$old_pass = isset($data['old_password']) ? $data['old_password'] : "";
291	//check old password
292	if( empty( $old_pass ) ) {
293	$errors->add( 'empty_password', __( '<strong>Error</strong>: Please enter your old password', 'userswp' ) );
294	return $errors;
295	}
296
297	$user = get_user_by( 'id', get_current_user_id() );
298	if ( !wp_check_password( $old_pass, $user->data->user_pass, $user->ID) ) {
299	$errors->add( 'invalid_password', __( '<strong>Error</strong>: Incorrect old password', 'userswp' ) );
300	return $errors;
301	}
302
303	if( $old_pass == $data['password'] ) {
304	$errors->add( 'invalid_password', __( '<strong>Error</strong>: The old password and the new password are the same', 'userswp' ) );
305	return $errors;
306	}
307
308	}
309
310	if (($type == 'register' && $enable_confirm_email_field == '1')) {
311	//check confirm email
312	if( empty( $data['email'] ) ) {
313	$errors->add( 'empty_email', __( '<strong>Error</strong>: Please enter your Email', 'userswp' ) );
314	return $errors;
315	}
316
317	if( !isset($data['confirm_email']) \|\| empty( $data['confirm_email'] ) ) {
318	$errors->add( 'empty_confirm_email', __( '<strong>Error</strong>: Please fill Confirm Email field', 'userswp' ) );
319	return $errors;
320	}
321
322	if( $data['email'] != $data['confirm_email'] ) {
323	$errors->add( 'email_mismatch', __( '<strong>Error</strong>: Email and Confirm email not match', 'userswp' ) );
324	return $errors;
325	}
326
327	}
328
329	if ($type == 'change' \|\| $type == 'reset' \|\| $type == 'login' \|\| ($type == 'register' && $enable_password == '1')) {
330	//check password
331	if( empty( $data['password'] ) ) {
332	$errors->add( 'empty_password', __( 'Please enter a password', 'userswp' ) );
333	}
334
335	$password_min_length = uwp_get_option( 'register_password_min_length');
336	$password_min_length = !empty($password_min_length) ? (int)$password_min_length : 8;
337
338	$password_max_length = uwp_get_option( 'register_password_max_length');
339	$password_max_length = !empty($password_max_length) ? (int)$password_max_length : 15;
340
341	if ($type != 'login' && (strlen($data['password']) < $password_min_length \|\| strlen($data['password']) > $password_max_length )) {
342	if(strlen($data['password']) > $password_max_length) {
343	$errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or less.', 'userswp'), $password_max_length));
344	} else{
345	$errors->add('pass_match', sprintf(__('<strong>Error</strong>: Password must be %s characters or more.', 'userswp'), $password_min_length));
346	}
347	}
348
349	$validated_data['password'] = isset($data['password']) ? $data['password'] : '';
350	}
351
352	$error_code = $errors->get_error_code();
353	if (!empty($error_code)) {
354	return $errors;
355	}
356
357	if (($type == 'register' && $enable_password == '1') \|\| $type == 'reset' \|\| $type == 'change') {
358
359	if (($type == 'register' && $enable_confirm_password_field != '1')) {
360	$validated_data['password'] = $data['password'];
361	} else {
362	//check password
363	if ($data['password'] != $data['confirm_password']) {
364	$errors->add('pass_match', __('<strong>Error</strong>: Passwords do not match.', 'userswp'));
365	}
366
367	$validated_data['password'] = isset($data['password']) ? $data['password'] : '';
368	}
369	}
370
371
372	$error_code = $errors->get_error_code();
373	if (!empty($error_code)) {
374	return $errors;
375	}
376
377	return $validated_data;
378	}
379
380	}