← All changes | includes/class-form.php +107 -4 1.6.2 → 1.6.28 View file →

		@@ -28,8 +28,36 @@
28	28	*/
29	29	public $data = null;
30	30
31	31	/**
	32	+ * Derived/formatted stats & metadata used by admin/AJAX/API responses.
	33	+ * Declared explicitly to avoid PHP 8.2 "dynamic property" deprecations.
	34	+ *
	35	+ * @var int
	36	+ */
	37	+ public $entries = 0;
	38	+
	39	+ /**
	40	+ * @var array
	41	+ */
	42	+ public $settings = [];
	43	+
	44	+ /**
	45	+ * @var int
	46	+ */
	47	+ public $views = 0;
	48	+
	49	+ /**
	50	+ * @var int
	51	+ */
	52	+ public $payments = 0;
	53	+
	54	+ /**
	55	+ * @var array
	56	+ */
	57	+ public $author = [];
	58	+
	59	+ /**
32	60	* Form fields
33	61	*
34	62	* @var array
35	63	*/
		@@ -97,9 +125,12 @@
97	125
98	126	$form_fields = [];
99	127
100	128	foreach ( $fields as $key => $content ) {
101		- $field = maybe_unserialize( $content->post_content );
	129	+ // Security fix: Prevent PHP Object Injection by restricting allowed classes
	130	+ $field = is_serialized( $content->post_content )
	131	+ ? @unserialize( $content->post_content, [ 'allowed_classes' => false ] )
	132	+ : $content->post_content;
102	133
103	134	if ( empty( $field['template'] ) ) {
104	135	continue;
105	136	}
		@@ -138,12 +169,16 @@
138	169	$field['enable_no_captcha'] = isset( $field['enable_no_captcha'] ) ? $field['enable_no_captcha'] : '';
139	170	$field['recaptcha_theme'] = isset( $field['recaptcha_theme'] ) ? $field['recaptcha_theme'] : 'light';
140	171	}
141	172
142		- $form_fields[] = apply_filters( 'weforms-get-form-field', $field );
	173	+ // Check if meta_key has changed when saving form compared current entries
	174	+ if ( isset( $field['name'] ) ) {
	175	+ $field['original_name'] = $field['name'];
	176	+ }
	177	+ $form_fields[] = apply_filters( 'weforms-get-form-field', $field, $this->id );
143	178	}
144	179
145		- $this->form_fields = apply_filters( 'weforms-get-form-fields', $form_fields );
	180	+ $this->form_fields = apply_filters( 'weforms-get-form-fields', $form_fields, $this->id );
146	181
147	182	return $this->form_fields;
148	183	}
149	184
		@@ -270,9 +305,9 @@
270	305	public function get_settings() {
271	306	$settings = get_post_meta( $this->id, 'wpuf_form_settings', true );
272	307	$default = weforms_get_default_form_settings();
273	308
274		- return array_merge( $default, $settings );
	309	+ return apply_filters( 'weforms-get-form-settings', array_merge( $default, $settings ), $this->id );
275	310	}
276	311
277	312	/**
278	313	* Check if the form submission is open
		@@ -364,8 +399,76 @@
364	399	* @return \WeForms_Form_Entry_Manager
365	400	*/
366	401	public function entries() {
367	402	return new WeForms_Form_Entry_Manager( $this->id, $this );
	403	+ }
	404	+
	405	+ /**
	406	+ * When a user is editing their form they may change a fields name.
	407	+ * This method will loop through existing entries to match the new field names.
	408	+ *
	409	+ * @since 1.6.9
	410	+ *
	411	+ * @param int $form_id
	412	+ * @param array $form_fields
	413	+ */
	414	+ public function maybe_update_entries( $form_fields ) {
	415	+ $changed_fields = $this->get_changed_fields( $form_fields );
	416	+ // Loop through changed fields and update entries
	417	+ foreach ( $changed_fields as $old => $new) {
	418	+ $updated_fields = $this->rename_field( $old, $new );
	419	+ }
	420	+ }
	421	+
	422	+ /**
	423	+ * When a user is editing their form they may change a fields name.
	424	+ * This method will loop through all fields that have changed.
	425	+ *
	426	+ * @since 1.6.9
	427	+ *
	428	+ * @param int $form_id
	429	+ * @param array $form_fields
	430	+ *
	431	+ * @return array
	432	+ */
	433	+ public function get_changed_fields( $form_fields ) {
	434	+ $changed_fields = array();
	435	+ foreach ( $form_fields as $field ) {
	436	+ // All form fields should have an original name.
	437	+ if ( empty( $field['original_name'] ) ) {
	438	+ continue;
	439	+ }
	440	+ if ( $field['name'] !== $field['original_name'] ) {
	441	+ $changed_fields[$field['original_name']] = $field['name'];
	442	+ } else {
	443	+ continue;
	444	+ }
	445	+ }
	446	+ return $changed_fields;
	447	+
	448	+ }
	449	+
	450	+ /**
	451	+ * When a user changes the field names of a form, the existing entries will need updated.
	452	+ * This method will loop through the existing entries and update them will the new names.
	453	+ *
	454	+ * @since 1.6.9
	455	+ *
	456	+ * @param int $form_id
	457	+ * @param array $form_fields
	458	+ *
	459	+ * @return array
	460	+ */
	461	+ public function rename_field ( $old, $new ) {
	462	+ global $wpdb;
	463	+
	464	+ $entries = weforms_get_form_entries( $this->id );
	465	+
	466	+ foreach ( $entries as $entry ) {
	467	+ $entry_id = $entry->id;
	468	+ $values = weforms_get_entry_meta( $entry_id );
	469	+ $update_keys = $wpdb->update( $wpdb->weforms_entrymeta, array( 'meta_key' => $new ), array( 'meta_key' => $old, 'weforms_entry_id' => $entry_id ) );
	470	+ }
368	471	}
369	472
370	473	/**
371	474	* Get number of form entries