← All changes | includes/class-notification.php +87 -20 1.6.4 → 1.6.23 View file →

		@@ -120,8 +120,41 @@
120	120	// content type to text/html
121	121	$headers[] = 'Content-Type: text/html; charset=UTF-8';
122	122	$email_body = apply_filters( 'weforms_email_message', $this->get_formatted_body( $message ), $notification['message'], $headers );
123	123
	124	+ /**
	125	+ * Added the display style to the safe styles during wp_kses_post().
	126	+ * WP kses post removes the display css property that we need when formatting the Checkbox and Multiple Choice Grids.
	127	+ * This function will only run during the notification process.
	128	+ *
	129	+ * @since 1.6.17
	130	+ */
	131	+ add_filter( 'safe_style_css', function( $styles ) {
	132	+ $styles[] = 'display';
	133	+ return $styles;
	134	+ } );
	135	+
	136	+ /**
	137	+ * Added the input tag to the allowed html during wp_kses_post().
	138	+ * WP kses post removes the input tag that we need when formatting the Checkbox and Multiple Choice Grids.
	139	+ * The $message variable is formatted during the entry creation process. The values from the form are sanitized to avoid
	140	+ * any issues with malicious inputs.
	141	+ *
	142	+ * This function is only used during the notification process.
	143	+ *
	144	+ * @since 1.6.17
	145	+ */
	146	+ add_filter( 'wp_kses_allowed_html', function( $html ) {
	147	+ $html['input'] = array(
	148	+ 'class' => array(),
	149	+ 'name' => array(),
	150	+ 'type' => array(),
	151	+ 'value' => array(),
	152	+ 'checked' => array(),
	153	+ 'disabled' => array(),
	154	+ );
	155	+ return $html;
	156	+ } );
124	157	weforms()->emailer->send( $to, $subject, wp_kses_post( htmlspecialchars_decode( $email_body ) ) , $headers );
125	158	}
126	159
127	160	/**
		@@ -396,9 +429,9 @@
396	429	return get_permalink( $this->args['page_id'] );
397	430	break;
398	431
399	432	case 'url_referer':
400		- return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
	433	+ return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
401	434	break;
402	435
403	436	case 'url_login':
404	437	return wp_login_url();
		@@ -462,34 +495,66 @@
462	495	}
463	496	}
464	497
465	498	/**
466		- * Parse out the custom fields with entry meta values
	499	+ * Parse out the custom fields with options or values. Since the options are what is stored, options may need to be
	500	+ * used to find the value from the field settings.
467	501	*
468		- * @param string $text
	502	+ * For example, let's say we have the following options:
	503	+ * DEPARTMENT / EMAIL
	504	+ * Support / support@example.com
	505	+ * Sales / sales@example.com
469	506	*
470		- * @return string
	507	+ * Users need the ability to pass {field:department} and get "Support",
	508	+ * and {value:department} to get support@email.com
	509	+ *
	510	+ * @param string $text The text to parse.
	511	+ * @param int $entry_id The entry ID. Optional. Default null if tags to be replaced are on the frontend.
	512	+ *
	513	+ * @return string $text The parsed text.
471	514	*/
472		- public static function replace_field_tags( $text, $entry_id ) {
473		- $pattern = '/{field:(\w*)}/';
	515	+ public static function replace_field_tags( $text, $entry_id = null ) {
	516	+ // Validate data.
	517	+ if ( empty( $text ) || !isset( $entry_id ) ) {
	518	+ return;
	519	+ }
474	520
475		- preg_match_all( $pattern, $text, $matches );
	521	+ // Users looking for {field:something} or {value:something}, determine which one.
	522	+ $is_field = preg_match_all( '/{field:(\w*)}/', $text, $matches_field );
	523	+ $is_value = preg_match_all( '/{value:(\w*)}/', $text, $matches_value );
476	524
477		- // bail out if nothing found to be replaced
478		- if ( !$matches ) {
479		- return $text;
	525	+ if ( $is_field ) {
	526	+ $meta_keys = $matches_field[1];
	527	+ // Create an array of meta values to replace.
	528	+ $meta_values = array();
	529	+ foreach ( $meta_keys as $meta_key ) {
	530	+ $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
	531	+ // Add values to the array.
	532	+ array_push( $meta_values, $meta_value );
	533	+ if ( is_array( $meta_value ) ) {
	534	+ $meta_value = implode( WeForms::$field_separator, $meta_value );
	535	+ }
	536	+ }
	537	+ // $text may include HTML tags, only replace tag that was matched. Replace all matches.
	538	+ $text = str_replace( $matches_field[0], $meta_values, $text );
480	539	}
481		-
482		- foreach ( $matches[1] as $index => $meta_key ) {
483		- $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
484		-
485		- if ( is_array( $meta_value ) ) {
486		- $meta_value = implode( WeForms::$field_separator, $meta_value );
	540	+ if ( $is_value ) {
	541	+ $meta_keys = $matches_value[1];
	542	+ // Create an array of modified values to replace.
	543	+ $modified_values = array();
	544	+ foreach ( $meta_keys as $meta_key ) {
	545	+ $form_field_values = WeForms_Form_Entry::get_form( $entry_id )->get_field_values()[ $meta_key ]['options'];
	546	+ $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
	547	+ $modified_value = array_search( $meta_value, $form_field_values );
	548	+ // Add values to the array.
	549	+ array_push( $modified_values, $modified_value );
	550	+ if ( is_array( $modified_value ) ) {
	551	+ $modified_value = implode( WeForms::$field_separator, $modified_value );
	552	+ }
487	553	}
488		-
489		- $text = str_replace( $matches[0][$index], $meta_value, $text );
	554	+ // $text may include HTML tags, only replace tag that was matched.
	555	+ $text = str_replace( $matches_value[0], $modified_values, $text );
490	556	}
491		-
492	557	return $text;
493	558	}
494	559
495	560	/**
		@@ -647,9 +712,9 @@
647	712	$table .= '</tr>';
648	713	$table .= '<tr class="field-value">';
649	714	$table .= '<td>';
650	715
651		- if ( in_array( $value['type'], [ 'multiple_select', 'checkbox_field' ] ) ) {
	716	+ if ( in_array( $value['type'], array( 'multiple_select', 'checkbox_field' ) ) ) {
652	717	$field_value = is_array( $field_value ) ? $field_value : [];
653	718
654	719	if ( $field_value ) {
655	720	$table .= '<ul>';
		@@ -660,8 +725,10 @@
660	725	$table .= '</ul>';
661	726	} else {
662	727	$table .= '&mdash;';
663	728	}
	729	+ } elseif ( in_array( $value['type'], array( 'google_map' ) ) ) {
	730	+ $table .= $field_value['address'];
664	731	} else {
665	732	$table .= $field_value;
666	733	}
667	734