class-wc-admin-settings.php — WooCommerce 11.1.0

woocommerce / includes / admin / class-wc-admin-settings.php

woocommerce / includes / admin Last commit date

class-wc-admin-settings.php

1108 lines

1	<?php
2	/**
3	* WooCommerce Admin Settings Class
4	*
5	* @package WooCommerce\Admin
6	* @version 3.4.0
7	*/
8
9	use Automattic\Jetpack\Constants;
10
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
16
17	/**
18	* WC_Admin_Settings Class.
19	*/
20	class WC_Admin_Settings {
21
22	/**
23	* Setting pages.
24	*
25	* @var array
26	*/
27	private static $settings = array();
28
29	/**
30	* Error messages.
31	*
32	* @var array
33	*/
34	private static $errors = array();
35
36	/**
37	* Update messages.
38	*
39	* @var array
40	*/
41	private static $messages = array();
42
43	/**
44	* Include the settings page classes.
45	*/
46	public static function get_settings_pages() {
47	if ( empty( self::$settings ) ) {
48	$settings = array();
49
50	include_once __DIR__ . '/settings/class-wc-settings-page.php';
51
52	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-general.php';
53	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-products.php';
54	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-tax.php';
55	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-shipping.php';
56	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-payment-gateways.php';
57	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-accounts.php';
58	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-emails.php';
59	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-integrations.php';
60	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-site-visibility.php';
61	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-point-of-sale.php';
62	$settings[] = include_once __DIR__ . '/settings/class-wc-settings-advanced.php';
63
64	self::$settings = apply_filters( 'woocommerce_get_settings_pages', $settings );
65	add_action(
66	'admin_head',
67	function () {
68	if ( function_exists( 'get_current_screen' ) ) {
69	$screen = get_current_screen();
70	if ( 'woocommerce_page_wc-settings' === $screen->id ) {
71	$screen->remove_help_tabs();
72	}
73	}
74	}
75	);
76	}
77
78	return self::$settings;
79	}
80
81	/**
82	* Save the settings.
83	*/
84	public static function save() {
85	global $current_tab;
86
87	if ( ! current_user_can( 'manage_woocommerce' ) ) {
88	wp_die( esc_html__( 'You do not have permission to save settings.', 'woocommerce' ), 403 );
89	}
90
91	check_admin_referer( 'woocommerce-settings' );
92
93	// Trigger actions.
94	do_action( 'woocommerce_settings_save_' . $current_tab );
95	do_action( 'woocommerce_update_options_' . $current_tab );
96	do_action( 'woocommerce_update_options' );
97
98	self::add_message( __( 'Your settings have been saved.', 'woocommerce' ) );
99	self::check_download_folder_protection();
100
101	// Clear any unwanted data and flush rules.
102	update_option( 'woocommerce_queue_flush_rewrite_rules', 'yes' );
103	WC()->query->init_query_vars();
104	WC()->query->add_endpoints();
105
106	do_action( 'woocommerce_settings_saved' );
107
108	self::maybe_redirect_after_settings_ui_save();
109	}
110
111	/**
112	* Redirect to the requested Settings UI destination after a form-post save.
113	*/
114	private static function maybe_redirect_after_settings_ui_save(): void {
115	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- The settings nonce is verified before this method is called.
116	if ( empty( $_POST['wc_settings_ui_redirect_to'] ) ) {
117	return;
118	}
119
120	$redirect_to = wp_validate_redirect(
121	esc_url_raw(
122	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- The settings nonce is verified before this method is called.
123	wp_unslash( $_POST['wc_settings_ui_redirect_to'] )
124	),
125	''
126	);
127
128	if ( '' === $redirect_to ) {
129	return;
130	}
131
132	wp_safe_redirect( $redirect_to );
133	exit;
134	}
135
136	/**
137	* Add a message.
138	*
139	* @param string $text Message.
140	*/
141	public static function add_message( $text ) {
142	self::$messages[] = $text;
143	}
144
145	/**
146	* Add an error.
147	*
148	* @param string $text Message.
149	*/
150	public static function add_error( $text ) {
151	self::$errors[] = $text;
152	}
153
154	/**
155	* Output messages + errors.
156	*/
157	public static function show_messages() {
158	if ( count( self::$errors ) > 0 ) {
159	foreach ( self::$errors as $error ) {
160	echo '<div id="message" class="error inline"><p><strong>' . esc_html( $error ) . '</strong></p></div>';
161	}
162	} elseif ( count( self::$messages ) > 0 ) {
163	foreach ( self::$messages as $message ) {
164	echo '<div id="message" class="updated inline"><p><strong>' . esc_html( $message ) . '</strong></p></div>';
165	}
166	}
167	}
168
169	/**
170	* Settings page.
171	*
172	* Handles the display of the main woocommerce settings page in admin.
173	*/
174	public static function output() {
175	global $current_section, $current_tab;
176
177	$suffix = Constants::is_true( 'SCRIPT_DEBUG' ) ? '' : '.min';
178
179	do_action( 'woocommerce_settings_start' );
180
181	wp_enqueue_script( 'woocommerce_settings', WC()->plugin_url() . '/assets/js/admin/settings' . $suffix . '.js', array( 'jquery', 'wp-util', 'jquery-ui-datepicker', 'jquery-ui-sortable', 'iris', 'selectWoo' ), WC()->version, true );
182
183	wp_localize_script(
184	'woocommerce_settings',
185	'woocommerce_settings_params',
186	array(
187	'i18n_nav_warning' => __( 'The changes you made will be lost if you navigate away from this page.', 'woocommerce' ),
188	'i18n_moved_up' => __( 'Item moved up', 'woocommerce' ),
189	'i18n_moved_down' => __( 'Item moved down', 'woocommerce' ),
190	'i18n_no_specific_countries_selected' => __( 'Selecting no country / region to sell to prevents from completing the checkout. Continue anyway?', 'woocommerce' ),
191	)
192	);
193
194	// Get tabs for the settings page.
195	$tabs = apply_filters( 'woocommerce_settings_tabs_array', array() );
196
197	include __DIR__ . '/views/html-admin-settings.php';
198	}
199
200	/**
201	* Get a setting from the settings API.
202	*
203	* @param string $option_name Option name.
204	* @param mixed $default Default value.
205	* @return mixed
206	*/
207	public static function get_option( $option_name, $default = '' ) {
208	if ( ! $option_name ) {
209	return $default;
210	}
211
212	// Array value.
213	if ( strstr( $option_name, '[' ) ) {
214
215	parse_str( $option_name, $option_array );
216
217	// Option name is first key.
218	$option_name = current( array_keys( $option_array ) );
219
220	// Get value.
221	$option_values = get_option( $option_name, '' );
222
223	$key = key( $option_array[ $option_name ] );
224
225	if ( isset( $option_values[ $key ] ) ) {
226	$option_value = $option_values[ $key ];
227	} else {
228	$option_value = null;
229	}
230	} else {
231	// Single value.
232	$option_value = get_option( $option_name, null );
233	}
234
235	if ( is_array( $option_value ) ) {
236	$option_value = wp_unslash( $option_value );
237	} elseif ( ! is_null( $option_value ) ) {
238	$option_value = stripslashes( $option_value );
239	}
240
241	return ( null === $option_value ) ? $default : $option_value;
242	}
243
244	/**
245	* Output admin fields.
246	*
247	* Loops through the woocommerce options array and outputs each field.
248	*
249	* @param array[] $options Opens array to output.
250	*/
251	public static function output_fields( $options ) {
252	foreach ( $options as $value ) {
253	if ( ! isset( $value['type'] ) ) {
254	continue;
255	}
256	if ( ! isset( $value['id'] ) ) {
257	$value['id'] = '';
258	}
259
260	// The 'field_name' key can be used when it is useful to specify an input field name that is different
261	// from the input field ID. We use the key 'field_name' because 'name' is already in use for a different
262	// purpose.
263	if ( ! isset( $value['field_name'] ) ) {
264	$value['field_name'] = $value['id'];
265	}
266	if ( ! isset( $value['title'] ) ) {
267	$value['title'] = isset( $value['name'] ) ? $value['name'] : '';
268	}
269	if ( ! isset( $value['class'] ) ) {
270	$value['class'] = '';
271	}
272	if ( ! isset( $value['css'] ) ) {
273	$value['css'] = '';
274	}
275	if ( ! isset( $value['default'] ) ) {
276	$value['default'] = '';
277	}
278	if ( ! isset( $value['desc'] ) ) {
279	$value['desc'] = '';
280	}
281	if ( ! isset( $value['desc_tip'] ) ) {
282	$value['desc_tip'] = false;
283	}
284	if ( ! isset( $value['placeholder'] ) ) {
285	$value['placeholder'] = '';
286	}
287	if ( ! isset( $value['row_class'] ) ) {
288	$value['row_class'] = '';
289	}
290	if ( ! empty( $value['row_class'] ) && substr( $value['row_class'], 0, 16 ) !== 'wc-settings-row-' ) {
291	$value['row_class'] = 'wc-settings-row-' . $value['row_class'];
292	}
293	if ( ! isset( $value['suffix'] ) ) {
294	$value['suffix'] = '';
295	}
296	if ( ! isset( $value['value'] ) ) {
297	$value['value'] = self::get_option( $value['id'], $value['default'] );
298	}
299
300	if ( ! is_null( $value['fixed_value'] ?? null ) ) {
301	$value['value'] = $value['fixed_value'];
302	}
303
304	// Custom attribute handling.
305	$custom_attributes = array();
306
307	if ( ! empty( $value['custom_attributes'] ) && is_array( $value['custom_attributes'] ) ) {
308	foreach ( $value['custom_attributes'] as $attribute => $attribute_value ) {
309	$custom_attributes[] = esc_attr( $attribute ) . '="' . esc_attr( $attribute_value ) . '"';
310	}
311	}
312
313	// Description handling.
314	$field_description = self::get_field_description( $value );
315	$description = $field_description['description'];
316	$tooltip_html = $field_description['tooltip_html'];
317
318	// Switch based on type.
319	switch ( $value['type'] ) {
320
321	// Section Titles.
322	case 'title':
323	if ( ! empty( $value['title'] ) ) {
324	echo '<h2>' . esc_html( $value['title'] ) . '</h2>';
325	}
326	if ( ! empty( $value['desc'] ) ) {
327	echo '<div id="' . esc_attr( sanitize_title( $value['id'] ) ) . '-description">';
328	echo wp_kses_post( wpautop( wptexturize( $value['desc'] ) ) );
329	echo '</div>';
330	}
331	echo '<table class="form-table">' . "\n\n";
332	if ( ! empty( $value['id'] ) ) {
333	do_action( 'woocommerce_settings_' . sanitize_title( $value['id'] ) );
334	}
335	break;
336
337	case 'info':
338	?><tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
339	<th scope="row" class="titledesc"><?php echo esc_html( $value['title'] ); ?></th>
340	<td style="<?php echo esc_attr( $value['css'] ); ?>">
341	<?php
342	echo wp_kses_post( wpautop( wptexturize( $value['text'] ) ) );
343	echo '</td></tr>';
344	break;
345
346	// Notice.
347	case 'notice':
348	$notice_type = $value['notice_type'] ?? 'info';
349	$notice_text = $value['text'] ?? '';
350
351	?>
352	</table>
353	<div class="notice notice-<?php echo esc_attr( $notice_type ); ?> inline">
354	<p><?php echo wp_kses_post( $notice_text ); ?></p>
355	</div>
356	<table class="form-table" role="presentation">
357	<?php
358	break;
359
360	// Section Ends.
361	case 'sectionend':
362	if ( ! empty( $value['id'] ) ) {
363	do_action( 'woocommerce_settings_' . sanitize_title( $value['id'] ) . '_end' );
364	}
365	echo '</table>';
366	if ( ! empty( $value['id'] ) ) {
367	do_action( 'woocommerce_settings_' . sanitize_title( $value['id'] ) . '_after' );
368	}
369	break;
370
371	// Standard text inputs and subtypes like 'number'.
372	case 'text':
373	case 'password':
374	case 'datetime':
375	case 'datetime-local':
376	case 'date':
377	case 'month':
378	case 'time':
379	case 'week':
380	case 'number':
381	case 'email':
382	case 'url':
383	case 'tel':
384	$option_value = $value['value'];
385
386	?>
387	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
388	<th scope="row" class="titledesc">
389	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
390	</th>
391	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
392	<input
393	name="<?php echo esc_attr( $value['field_name'] ); ?>"
394	id="<?php echo esc_attr( $value['id'] ); ?>"
395	type="<?php echo esc_attr( $value['type'] ); ?>"
396	style="<?php echo esc_attr( $value['css'] ); ?>"
397	value="<?php echo esc_attr( $option_value ); ?>"
398	class="<?php echo esc_attr( $value['class'] ); ?>"
399	placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
400	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
401	/><?php echo esc_html( $value['suffix'] ); ?> <?php echo $description; // WPCS: XSS ok. ?>
402	</td>
403	</tr>
404	<?php
405	break;
406
407	// Color picker.
408	case 'color':
409	$option_value = $value['value'];
410
411	?>
412	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
413	<th scope="row" class="titledesc">
414	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
415	</th>
416	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">&lrm;
417	<span class="colorpickpreview" style="background: <?php echo esc_attr( $option_value ); ?>"> </span>
418	<input
419	name="<?php echo esc_attr( $value['field_name'] ); ?>"
420	id="<?php echo esc_attr( $value['id'] ); ?>"
421	type="text"
422	dir="ltr"
423	style="<?php echo esc_attr( $value['css'] ); ?>"
424	value="<?php echo esc_attr( $option_value ); ?>"
425	class="<?php echo esc_attr( $value['class'] ); ?>colorpick"
426	placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
427	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
428	/>&lrm; <?php echo $description; // WPCS: XSS ok. ?>
429	<div id="colorPickerDiv_<?php echo esc_attr( $value['id'] ); ?>" class="colorpickdiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;display:none;"></div>
430	</td>
431	</tr>
432	<?php
433	break;
434
435	// Textarea.
436	case 'textarea':
437	$option_value = $value['value'];
438	$show_desc_at_end = $value['desc_at_end'] ?? false;
439
440	?>
441	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
442	<th scope="row" class="titledesc">
443	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
444	</th>
445	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
446	<?php
447	if ( ! $show_desc_at_end ) {
448	echo wp_kses_post( $description );
449	}
450	?>
451	<textarea
452	name="<?php echo esc_attr( $value['field_name'] ); ?>"
453	id="<?php echo esc_attr( $value['id'] ); ?>"
454	style="<?php echo esc_attr( $value['css'] ); ?>"
455	class="<?php echo esc_attr( $value['class'] ); ?>"
456	placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
457	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
458	><?php echo esc_textarea( $option_value ); // WPCS: XSS ok. ?></textarea>
459	<?php
460	if ( $show_desc_at_end ) {
461	echo wp_kses_post( $description );
462	}
463	?>
464	</td>
465	</tr>
466	<?php
467	break;
468
469	// Select boxes.
470	case 'select':
471	case 'multiselect':
472	$option_value = $value['value'];
473
474	?>
475	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
476	<th scope="row" class="titledesc">
477	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
478	</th>
479	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
480	<select
481	name="<?php echo esc_attr( $value['field_name'] ); ?><?php echo ( 'multiselect' === $value['type'] ) ? '[]' : ''; ?>"
482	id="<?php echo esc_attr( $value['id'] ); ?>"
483	style="<?php echo esc_attr( $value['css'] ); ?>"
484	class="<?php echo esc_attr( $value['class'] ); ?>"
485	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
486	<?php echo 'multiselect' === $value['type'] ? 'multiple="multiple"' : ''; ?>
487	>
488	<?php
489	foreach ( $value['options'] as $key => $val ) {
490	?>
491	<option value="<?php echo esc_attr( $key ); ?>"
492	<?php
493
494	if ( is_array( $option_value ) ) {
495	selected( in_array( (string) $key, $option_value, true ), true );
496	} else {
497	selected( $option_value, (string) $key );
498	}
499
500	?>
501	><?php echo esc_html( $val ); ?></option>
502	<?php
503	}
504	?>
505	</select> <?php echo $description; // WPCS: XSS ok. ?>
506	</td>
507	</tr>
508	<?php
509	break;
510
511	// Radio inputs.
512	case 'radio':
513	$option_value = $value['value'];
514	$disabled_values = $value['disabled'] ?? array();
515	$show_desc_at_end = $value['desc_at_end'] ?? false;
516	// Only build a title ID when the field has a usable ID.
517	$normalized_id = is_scalar( $value['id'] ) ? (string) $value['id'] : '';
518	$radio_title_id = '' !== $normalized_id ? $normalized_id . '-title' : '';
519
520	?>
521	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
522	<th scope="row" class="titledesc">
523	<span class="wc-settings-radio-title">
524	<span<?php echo '' !== $radio_title_id ? ' id="' . esc_attr( $radio_title_id ) . '"' : ''; ?>><?php echo esc_html( $value['title'] ); ?></span>
525	<?php
526	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Built by self::get_field_description(), which passes the tip through wc_help_tip(); that helper sanitizes the tip text and escapes the aria-label.
527	echo $tooltip_html;
528	?>
529	</span>
530	</th>
531	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
532	<fieldset<?php echo '' !== $radio_title_id ? ' aria-labelledby="' . esc_attr( $radio_title_id ) . '"' : ''; ?>>
533	<?php
534	if ( ! $show_desc_at_end ) {
535	echo wp_kses_post( $description );
536	}
537	?>
538	<ul>
539	<?php
540	foreach ( $value['options'] as $key => $val ) {
541	?>
542	<li>
543	<label><input
544	name="<?php echo esc_attr( $value['field_name'] ); ?>"
545	value="<?php echo esc_attr( $key ); ?>"
546	type="radio"
547	<?php
548	if ( in_array( $key, $disabled_values, true ) ) {
549	echo 'disabled'; }
550	?>
551	style="<?php echo esc_attr( $value['css'] ); ?>"
552	class="<?php echo esc_attr( $value['class'] ); ?>"
553	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
554	<?php checked( $key, $option_value ); ?>
555	/> <?php echo esc_html( $val ); ?></label>
556	</li>
557	<?php
558	}
559	if ( $show_desc_at_end ) {
560	echo wp_kses_post( "<p class='description description-thin'>{$description}</p>" );
561	}
562	?>
563	</ul>
564	</fieldset>
565	</td>
566	</tr>
567	<?php
568	break;
569
570	// Checkbox input.
571	case 'checkbox':
572	$option_value = $value['value'];
573	$visibility_class = array();
574
575	if ( ! isset( $value['hide_if_checked'] ) ) {
576	$value['hide_if_checked'] = false;
577	}
578	if ( ! isset( $value['show_if_checked'] ) ) {
579	$value['show_if_checked'] = false;
580	}
581	if ( 'yes' === $value['hide_if_checked'] \|\| 'yes' === $value['show_if_checked'] ) {
582	$visibility_class[] = 'hidden_option';
583	}
584	if ( 'option' === $value['hide_if_checked'] ) {
585	$visibility_class[] = 'hide_options_if_checked';
586	}
587	if ( 'option' === $value['show_if_checked'] ) {
588	$visibility_class[] = 'show_options_if_checked';
589	}
590	if ( $value['row_class'] ) {
591	$visibility_class[] = $value['row_class'];
592	}
593
594	$must_disable = $value['disabled'] ?? false;
595
596	if ( $must_disable ) {
597	$visibility_class[] = 'disabled';
598	}
599
600	$container_class = implode( ' ', $visibility_class );
601	$has_title = isset( $value['title'] ) && '' !== $value['title'];
602	$has_legend = isset( $value['legend'] ) && '' !== $value['legend'];
603
604	if ( ! isset( $value['checkboxgroup'] ) \|\| 'start' === $value['checkboxgroup'] ) {
605	$has_tooltip = isset( $value['tooltip'] ) && '' !== $value['tooltip'];
606
607	$tooltip_container_class = $has_tooltip ? 'with-tooltip' : '';
608	?>
609	<tr class="<?php echo esc_attr( $container_class ); ?>">
610	<th scope="row" class="titledesc"><?php echo esc_html( $value['title'] ); ?></th>
611	<td class="forminp forminp-checkbox <?php echo esc_html( $tooltip_container_class ); ?>">
612	<?php if ( $has_tooltip ) : ?>
613	<span class="help-tooltip"><?php echo wc_help_tip( esc_html( $value['tooltip'] ) ); ?></span>
614	<?php endif; ?>
615	<fieldset>
616	<?php
617	} else {
618	?>
619	<fieldset class="<?php echo esc_attr( $container_class ); ?>">
620	<?php
621	}
622
623	if ( $has_title \|\| $has_legend ) {
624	?>
625	<legend class="<?php echo $has_legend ? '' : 'screen-reader-text'; ?>"><span><?php echo esc_html( $has_legend ? $value['legend'] : $value['title'] ); ?></span></legend>
626	<?php
627	}
628
629	?>
630	<label for="<?php echo esc_attr( $value['id'] ); ?>">
631	<input
632	<?php echo $must_disable ? 'disabled' : ''; ?>
633	name="<?php echo esc_attr( $value['field_name'] ); ?>"
634	id="<?php echo esc_attr( $value['id'] ); ?>"
635	type="checkbox"
636	class="<?php echo esc_attr( isset( $value['class'] ) ? $value['class'] : '' ); ?>"
637	value="1"
638	<?php checked( $option_value, 'yes' ); ?>
639	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
640	/> <?php echo $description; // WPCS: XSS ok. ?>
641	</label> <?php echo $tooltip_html; // WPCS: XSS ok. ?>
642	<?php
643
644	if ( ! isset( $value['checkboxgroup'] ) \|\| 'end' === $value['checkboxgroup'] ) {
645	?>
646	</fieldset>
647	</td>
648	</tr>
649	<?php
650	} else {
651	?>
652	</fieldset>
653	<?php
654	}
655	break;
656
657	// Image width settings. @todo deprecate and remove in 4.0. No longer needed by core.
658	case 'image_width':
659	$image_size = str_replace( '_image_size', '', $value['id'] );
660	$size = wc_get_image_size( $image_size );
661	$width = isset( $size['width'] ) ? $size['width'] : $value['default']['width'];
662	$height = isset( $size['height'] ) ? $size['height'] : $value['default']['height'];
663	$crop = isset( $size['crop'] ) ? $size['crop'] : $value['default']['crop'];
664	$disabled_attr = '';
665	$disabled_message = '';
666
667	if ( has_filter( 'woocommerce_get_image_size_' . $image_size ) ) {
668	$disabled_attr = 'disabled="disabled"';
669	$disabled_message = '<p><small>' . esc_html__( 'The settings of this image size have been disabled because its values are being overwritten by a filter.', 'woocommerce' ) . '</small></p>';
670	}
671
672	?>
673	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
674	<th scope="row" class="titledesc">
675	<label><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html . $disabled_message; // WPCS: XSS ok. ?></label>
676	</th>
677	<td class="forminp image_width_settings">
678
679	<input name="<?php echo esc_attr( $value['field_name'] ); ?>[width]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-width" type="text" size="3" value="<?php echo esc_attr( $width ); ?>" /> × <input name="<?php echo esc_attr( $value['id'] ); ?>[height]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-height" type="text" size="3" value="<?php echo esc_attr( $height ); ?>" />px
680
681	<label><input name="<?php echo esc_attr( $value['field_name'] ); ?>[crop]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-crop" type="checkbox" value="1" <?php checked( 1, $crop ); ?> /> <?php esc_html_e( 'Hard crop?', 'woocommerce' ); ?></label>
682
683	</td>
684	</tr>
685	<?php
686	break;
687
688	// Single page selects.
689	case 'single_select_page':
690	$args = array(
691	'name' => $value['field_name'],
692	'id' => $value['id'],
693	'sort_column' => 'menu_order',
694	'sort_order' => 'ASC',
695	'show_option_none' => ' ',
696	'class' => $value['class'],
697	'echo' => false,
698	'selected' => absint( $value['value'] ),
699	'post_status' => 'publish,private,draft',
700	);
701
702	if ( isset( $value['args'] ) ) {
703	$args = wp_parse_args( $value['args'], $args );
704	}
705
706	?>
707	<tr class="single_select_page <?php echo esc_attr( $value['row_class'] ); ?>">
708	<th scope="row" class="titledesc">
709	<label><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
710	</th>
711	<td class="forminp">
712	<?php echo str_replace( ' id=', " data-placeholder='" . esc_attr__( 'Select a page…', 'woocommerce' ) . "' style='" . $value['css'] . "' class='" . $value['class'] . "' id=", wp_dropdown_pages( $args ) ); // WPCS: XSS ok. ?> <?php echo $description; // WPCS: XSS ok. ?>
713	</td>
714	</tr>
715	<?php
716	break;
717
718	case 'single_select_page_with_search':
719	$option_value = $value['value'];
720	$page = get_post( $option_value );
721
722	if ( ! is_null( $page ) ) {
723	$page = get_post( $option_value );
724	$option_display_name = sprintf(
725	/* translators: 1: page name 2: page ID */
726	__( '%1$s (ID: %2$s)', 'woocommerce' ),
727	$page->post_title,
728	$option_value
729	);
730	}
731	?>
732	<tr class="single_select_page <?php echo esc_attr( $value['row_class'] ); ?>">
733	<th scope="row" class="titledesc">
734	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></label>
735	</th>
736	<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
737	<select
738	name="<?php echo esc_attr( $value['field_name'] ); ?>"
739	id="<?php echo esc_attr( $value['id'] ); ?>"
740	style="<?php echo esc_attr( $value['css'] ); ?>"
741	class="<?php echo esc_attr( $value['class'] ); ?>"
742	<?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
743	data-placeholder="<?php esc_attr_e( 'Search for a page…', 'woocommerce' ); ?>"
744	data-allow_clear="true"
745	data-exclude="<?php echo wc_esc_json( wp_json_encode( $value['args']['exclude'] ) ); ?>"
746	>
747	<option value=""></option>
748	<?php if ( ! is_null( $page ) ) { ?>
749	<option value="<?php echo esc_attr( $option_value ); ?>" selected="selected">
750	<?php echo wp_strip_all_tags( $option_display_name ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
751	</option>
752	<?php } ?>
753	</select> <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
754	</td>
755	</tr>
756	<?php
757	break;
758
759	// Single country selects.
760	case 'single_select_country':
761	$country_setting = (string) $value['value'];
762
763	if ( strstr( $country_setting, ':' ) ) {
764	$country_setting = explode( ':', $country_setting );
765	$country = current( $country_setting );
766	$state = end( $country_setting );
767	} else {
768	$country = $country_setting;
769	$state = '*';
770	}
771	?>
772	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
773	<th scope="row" class="titledesc">
774	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
775	</th>
776	<td class="forminp"><select name="<?php echo esc_attr( $value['field_name'] ); ?>" id="<?php echo esc_attr( $value['id'] ); ?>" style="<?php echo esc_attr( $value['css'] ); ?>" data-placeholder="<?php esc_attr_e( 'Choose a country / region…', 'woocommerce' ); ?>" aria-label="<?php esc_attr_e( 'Country / Region', 'woocommerce' ); ?>" class="wc-enhanced-select">
777	<?php WC()->countries->country_dropdown_options( $country, $state ); ?>
778	</select> <?php echo $description; // WPCS: XSS ok. ?>
779	</td>
780	</tr>
781	<?php
782	break;
783
784	// Country multiselects.
785	case 'multi_select_countries':
786	$selections = (array) $value['value'];
787
788	if ( ! empty( $value['options'] ) ) {
789	$countries = $value['options'];
790	} else {
791	$countries = WC()->countries->countries;
792	}
793
794	asort( $countries );
795	?>
796	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
797	<th scope="row" class="titledesc">
798	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
799	</th>
800	<td class="forminp">
801	<select
802	multiple="multiple"
803	name="<?php echo esc_attr( $value['field_name'] ); ?>[]"
804	id="<?php echo esc_attr( $value['id'] ); ?>"
805	style="width:350px"
806	data-placeholder="<?php esc_attr_e( 'Choose countries / regions…', 'woocommerce' ); ?>"
807	aria-label="<?php esc_attr_e( 'Country / Region', 'woocommerce' ); ?>"
808	class="wc-enhanced-select">
809	<?php
810	if ( ! empty( $countries ) ) {
811	foreach ( $countries as $key => $val ) {
812	echo '<option value="' . esc_attr( $key ) . '"' . wc_selected( $key, $selections ) . '>' . esc_html( $val ) . '</option>'; // WPCS: XSS ok.
813	}
814	}
815	?>
816	</select> <?php echo ( $description ) ? $description : ''; // WPCS: XSS ok. ?> <br /><a class="select_all button" href="#"><?php esc_html_e( 'Select all', 'woocommerce' ); ?></a> <a class="select_none button" href="#"><?php esc_html_e( 'Select none', 'woocommerce' ); ?></a>
817	</td>
818	</tr>
819	<?php
820	break;
821
822	// Days/months/years selector.
823	case 'relative_date_selector':
824	$periods = array(
825	'days' => __( 'Day(s)', 'woocommerce' ),
826	'weeks' => __( 'Week(s)', 'woocommerce' ),
827	'months' => __( 'Month(s)', 'woocommerce' ),
828	'years' => __( 'Year(s)', 'woocommerce' ),
829	);
830	$option_value = wc_parse_relative_date_option( $value['value'] );
831	?>
832	<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
833	<th scope="row" class="titledesc">
834	<label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo $tooltip_html; // WPCS: XSS ok. ?></label>
835	</th>
836	<td class="forminp">
837	<input
838	name="<?php echo esc_attr( $value['field_name'] ); ?>[number]"
839	id="<?php echo esc_attr( $value['id'] ); ?>"
840	type="number"
841	style="width: 80px;"
842	value="<?php echo esc_attr( $option_value['number'] ); ?>"
843	class="<?php echo esc_attr( $value['class'] ); ?>"
844	placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
845	step="1"
846	min="1"
847	<?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
848	/>
849	<select name="<?php echo esc_attr( $value['field_name'] ); ?>[unit]" style="width: auto;">
850	<?php
851	foreach ( $periods as $value => $label ) {
852	echo '<option value="' . esc_attr( $value ) . '"' . selected( $option_value['unit'], $value, false ) . '>' . esc_html( $label ) . '</option>';
853	}
854	?>
855	</select> <?php echo ( $description ) ? $description : ''; // WPCS: XSS ok. ?>
856	</td>
857	</tr>
858	<?php
859	break;
860
861	case 'slotfill_placeholder':
862	?>
863	<div
864	id="<?php echo esc_attr( $value['id'] ); ?>"
865	class="<?php echo esc_attr( $value['class'] ); ?>"
866	>
867	</div>
868	<?php
869	break;
870	// Default: run an action.
871	default:
872	do_action( 'woocommerce_admin_field_' . $value['type'], $value );
873	break;
874	}
875	}
876	}
877
878	/**
879	* Helper function to get the formatted description and tip HTML for a
880	* given form field. Plugins can call this when implementing their own custom
881	* settings types.
882	*
883	* @param array $value The form field value array.
884	* @return array The description and tip as a 2 element array.
885	*/
886	public static function get_field_description( $value ) {
887	$description = '';
888	$tooltip_html = '';
889
890	if ( true === $value['desc_tip'] ) {
891	$tooltip_html = $value['desc'];
892	} elseif ( ! empty( $value['desc_tip'] ) ) {
893	$description = $value['desc'];
894	$tooltip_html = $value['desc_tip'];
895	} elseif ( ! empty( $value['desc'] ) ) {
896	$description = $value['desc'];
897	}
898
899	$desc_at_end = ( isset( $value['desc_at_end'] ) ? $value['desc_at_end'] : false );
900	$error_class = ( ! empty( $value['description_is_error'] ) ) ? 'is-error' : '';
901
902	if ( $description && in_array( $value['type'], array( 'textarea' ), true ) && true !== $desc_at_end ) {
903	$description = '<p class="description ' . $error_class . '" style="margin-top:0;">' . wp_kses_post( $description ) . '</p>';
904	} elseif ( $description && in_array( $value['type'], array( 'radio' ), true ) ) {
905	$description = '<p style="margin-top:0">' . wp_kses_post( $description ) . '</p>';
906	} elseif ( $description && in_array( $value['type'], array( 'checkbox' ), true ) ) {
907	$description = wp_kses_post( $description );
908	} elseif ( $description ) {
909	$description = '<p class="description ' . $error_class . '">' . wp_kses_post( $description ) . '</p>';
910	}
911
912	if ( $tooltip_html && in_array( $value['type'], array( 'checkbox' ), true ) ) {
913	$tooltip_html = '<p class="description ' . $error_class . '">' . $tooltip_html . '</p>';
914	} elseif ( $tooltip_html ) {
915	$tooltip_html = wc_help_tip( $tooltip_html );
916	}
917
918	return array(
919	'description' => $description,
920	'tooltip_html' => $tooltip_html,
921	);
922	}
923
924	/**
925	* Save admin fields.
926	*
927	* Loops through the woocommerce options array and outputs each field.
928	*
929	* @param array $options Options array to output.
930	* @param array $data Optional. Data to use for saving. Defaults to $_POST.
931	* @return bool
932	*/
933	public static function save_fields( $options, $data = null ) {
934	if ( is_null( $data ) ) {
935	$data = $_POST; // WPCS: input var okay, CSRF ok.
936	}
937	if ( empty( $data ) ) {
938	return false;
939	}
940
941	// Options to update will be stored here and saved later.
942	$update_options = array();
943	$autoload_options = array();
944
945	// Loop options and get values to save.
946	foreach ( $options as $option ) {
947	if ( ! isset( $option['id'] ) \|\| ! isset( $option['type'] ) \|\| ( isset( $option['is_option'] ) && false === $option['is_option'] ) ) {
948	continue;
949	}
950
951	$option_name = $option['field_name'] ?? $option['id'];
952
953	// Get posted value.
954	if ( strstr( $option_name, '[' ) ) {
955	parse_str( $option_name, $option_name_array );
956	$option_name = current( array_keys( $option_name_array ) );
957	$setting_name = key( $option_name_array[ $option_name ] );
958	$raw_value = isset( $data[ $option_name ][ $setting_name ] ) ? wp_unslash( $data[ $option_name ][ $setting_name ] ) : null;
959	} else {
960	$setting_name = '';
961	$raw_value = isset( $data[ $option_name ] ) ? wp_unslash( $data[ $option_name ] ) : null;
962	}
963
964	// Format the value based on option type.
965	switch ( $option['type'] ) {
966	case 'checkbox':
967	$value = '1' === $raw_value \|\| 'yes' === $raw_value ? 'yes' : 'no';
968	break;
969	case 'textarea':
970	$value = wp_kses_post( trim( $raw_value ) );
971	break;
972	case 'multiselect':
973	case 'multi_select_countries':
974	$value = array_filter( array_map( 'wc_clean', (array) $raw_value ) );
975	break;
976	case 'image_width':
977	$value = array();
978	if ( isset( $raw_value['width'] ) ) {
979	$value['width'] = wc_clean( $raw_value['width'] );
980	$value['height'] = wc_clean( $raw_value['height'] );
981	$value['crop'] = isset( $raw_value['crop'] ) ? 1 : 0;
982	} else {
983	$value['width'] = $option['default']['width'];
984	$value['height'] = $option['default']['height'];
985	$value['crop'] = $option['default']['crop'];
986	}
987	break;
988	case 'select':
989	$allowed_values = empty( $option['options'] ) ? array() : array_map( 'strval', array_keys( $option['options'] ) );
990	if ( empty( $option['default'] ) && empty( $allowed_values ) ) {
991	$value = null;
992	break;
993	}
994	$default = ( empty( $option['default'] ) ? $allowed_values[0] : $option['default'] );
995	$value = in_array( $raw_value, $allowed_values, true ) ? $raw_value : $default;
996	break;
997	case 'relative_date_selector':
998	$value = wc_parse_relative_date_option( $raw_value );
999	break;
1000	case 'password':
1001	// Non-string or absent → null so the option is skipped, not overwritten.
1002	// Only trim — no wp_strip_all_tags() or wc_clean() which would corrupt
1003	// passwords containing '<' or percent-like sequences.
1004	// $raw_value is already wp_unslash()ed upstream, so no stripslashes() needed.
1005	// Matches WC_Settings_API::validate_password_field() behavior.
1006	$value = is_string( $raw_value ) ? trim( $raw_value ) : null;
1007	break;
1008	default:
1009	$value = wc_clean( $raw_value );
1010	break;
1011	}
1012
1013	/**
1014	* Fire an action when a certain 'type' of field is being saved.
1015	*
1016	* @deprecated 2.4.0 - doesn't allow manipulation of values!
1017	*/
1018	if ( has_action( 'woocommerce_update_option_' . sanitize_title( $option['type'] ) ) ) {
1019	wc_deprecated_function( 'The woocommerce_update_option_X action', '2.4.0', 'woocommerce_admin_settings_sanitize_option filter' );
1020	do_action( 'woocommerce_update_option_' . sanitize_title( $option['type'] ), $option );
1021	continue;
1022	}
1023
1024	/**
1025	* Sanitize the value of an option.
1026	*
1027	* @since 2.4.0
1028	*/
1029	$value = apply_filters( 'woocommerce_admin_settings_sanitize_option', $value, $option, $raw_value );
1030
1031	/**
1032	* Sanitize the value of an option by option name.
1033	*
1034	* @since 2.4.0
1035	*/
1036	$value = apply_filters( "woocommerce_admin_settings_sanitize_option_$option_name", $value, $option, $raw_value );
1037
1038	if ( is_null( $value ) ) {
1039	continue;
1040	}
1041
1042	// Check if option is an array and handle that differently to single values.
1043	if ( $option_name && $setting_name ) {
1044	if ( ! isset( $update_options[ $option_name ] ) ) {
1045	$update_options[ $option_name ] = get_option( $option_name, array() );
1046	}
1047	if ( ! is_array( $update_options[ $option_name ] ) ) {
1048	$update_options[ $option_name ] = array();
1049	}
1050	$update_options[ $option_name ][ $setting_name ] = $value;
1051	} else {
1052	$update_options[ $option_name ] = $value;
1053	}
1054
1055	$autoload_options[ $option_name ] = isset( $option['autoload'] ) ? (bool) $option['autoload'] : true;
1056
1057	/**
1058	* Fire an action before saved.
1059	*
1060	* @deprecated 2.4.0 - doesn't allow manipulation of values!
1061	*/
1062	do_action( 'woocommerce_update_option', $option );
1063	}
1064
1065	// Save all options in our array.
1066	foreach ( $update_options as $name => $value ) {
1067	update_option( $name, $value, $autoload_options[ $name ] ? 'yes' : 'no' );
1068	}
1069
1070	return true;
1071	}
1072
1073	/**
1074	* Checks which method we're using to serve downloads.
1075	*
1076	* If using force or x-sendfile, this ensures the .htaccess is in place.
1077	*/
1078	public static function check_download_folder_protection() {
1079	$upload_dir = wp_get_upload_dir();
1080	$downloads_path = $upload_dir['basedir'] . '/woocommerce_uploads';
1081	$download_method = get_option( 'woocommerce_file_download_method' );
1082	$file_path = $downloads_path . '/.htaccess';
1083	$file_content = 'redirect' === $download_method ? 'Options -Indexes' : 'deny from all';
1084	$create = false;
1085
1086	if ( wp_mkdir_p( $downloads_path ) && ! file_exists( $file_path ) ) {
1087	$create = true;
1088	} else {
1089	$current_content = @file_get_contents( $file_path ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged, WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1090
1091	if ( $current_content !== $file_content ) {
1092	unlink( $file_path );
1093	$create = true;
1094	}
1095	}
1096
1097	if ( $create ) {
1098	$file_handle = @fopen( $file_path, 'wb' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged, WordPress.WP.AlternativeFunctions.file_system_read_fopen
1099	if ( $file_handle ) {
1100	fwrite( $file_handle, $file_content ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_fwrite
1101	fclose( $file_handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_fclose
1102	}
1103	}
1104	}
1105	}
1106
1107	endif;
1108