Installer
3 years ago
AdminNotices.php
3 months ago
AjaxHandler.php
1 day ago
Autologin.php
11 months ago
BlockRegistrations.php
1 year ago
BuddyPressBbPress.php
3 years ago
DisableConcurrentLogins.php
2 years ago
EditUserProfile.php
1 day ago
ExtensionManager.php
1 month ago
FileUploader.php
5 months ago
FormPreviewHandler.php
7 months ago
FormRepository.php
1 year ago
FormShortcodeDefaults.php
3 months ago
GDPR.php
3 years ago
Geolocation.php
3 years ago
GlobalSiteAccess.php
3 years ago
ImageUploader.php
1 year ago
LoginAuth.php
1 year ago
Miscellaneous.php
3 years ago
ModifyRedirectDefaultLinks.php
1 month ago
PPRESS_Session.php
1 year ago
PROFILEPRESS_sql.php
1 year ago
PasswordReset.php
1 year ago
ProfileUrlRewrite.php
4 years ago
RegistrationAuth.php
2 weeks ago
SendEmail.php
1 day ago
ShortcodeThemeFactory.php
5 years ago
UserAvatar.php
1 year ago
UserSignupLocationListingPage.php
3 years ago
UsernameEmailRestrictLogin.php
4 years ago
WPProfileFieldParserTrait.php
1 year ago
WelcomeEmailAfterSignup.php
1 year ago
default-email-template.php
1 year ago
index.php
3 years ago
EditUserProfile.php
471 lines
| 1 | <?php |
| 2 | |
| 3 | namespace ProfilePress\Core\Classes; |
| 4 | |
| 5 | class EditUserProfile |
| 6 | { |
| 7 | public static function get_success_message($form_id = 0, $is_melange = false) |
| 8 | { |
| 9 | $success_message = FormRepository::get_form_meta($form_id, FormRepository::EDIT_PROFILE_TYPE, FormRepository::SUCCESS_MESSAGE); |
| 10 | |
| 11 | if ($is_melange) { |
| 12 | $success_message = FormRepository::get_form_meta($form_id, FormRepository::EDIT_PROFILE_TYPE, FormRepository::MELANGE_EDIT_PROFILE_SUCCESS_MESSAGE); |
| 13 | } |
| 14 | |
| 15 | if (FormRepository::is_drag_drop($form_id, FormRepository::EDIT_PROFILE_TYPE)) { |
| 16 | // Drag and drop do not allow the use of div wrapper. only the message to be shown is entered. |
| 17 | // so here, we are wrapping it in edit profile status div. |
| 18 | if ( ! empty($success_message)) { |
| 19 | $success_message = '<div class="profilepress-edit-profile-status success">' . $success_message . '</div>'; |
| 20 | } |
| 21 | } |
| 22 | |
| 23 | $success_message = ! empty($success_message) ? $success_message : '<div class="profilepress-edit-profile-status success">' . esc_html__('Account was updated successfully.', 'wp-user-avatar') . '</div>'; |
| 24 | |
| 25 | return apply_filters('ppress_edit_profile_success_message', $success_message); |
| 26 | } |
| 27 | |
| 28 | /** |
| 29 | * @param $form_id |
| 30 | * @param $redirect |
| 31 | * @param bool $is_melange |
| 32 | * |
| 33 | * @return mixed|void the edit profile response be it error or success message |
| 34 | */ |
| 35 | public static function process_func($form_id, $redirect, $is_melange = false) |
| 36 | { |
| 37 | $success_message = self::get_success_message($form_id, $is_melange); |
| 38 | |
| 39 | $edit_profile_response = self::update_user_profile($form_id, $redirect); |
| 40 | |
| 41 | if ( ! empty($edit_profile_response) && wp_doing_ajax()) { |
| 42 | $ajax_response = []; |
| 43 | |
| 44 | if (is_string($edit_profile_response)) { |
| 45 | $ajax_response['message'] = '<div class="profilepress-edit-profile-status">' . $edit_profile_response . '</div>'; |
| 46 | } |
| 47 | |
| 48 | if (is_array($edit_profile_response) && $edit_profile_response['status'] == 'success') { |
| 49 | $ajax_response['message'] = wp_kses_post(html_entity_decode($success_message)); |
| 50 | |
| 51 | if ( ! empty($edit_profile_response['avatar_url'])) { |
| 52 | $ajax_response['avatar_url'] = $edit_profile_response['avatar_url']; |
| 53 | } |
| 54 | |
| 55 | if ( ! empty($edit_profile_response['cover_image_url'])) { |
| 56 | $ajax_response['cover_image_url'] = $edit_profile_response['cover_image_url']; |
| 57 | } |
| 58 | } |
| 59 | |
| 60 | if ( ! empty($redirect)) { |
| 61 | $ajax_response['redirect'] = esc_url_raw($redirect); |
| 62 | } |
| 63 | |
| 64 | return $ajax_response; |
| 65 | } |
| 66 | |
| 67 | if ( ! empty($edit_profile_response)) { |
| 68 | return '<div class="profilepress-edit-profile-status">' . $edit_profile_response . '</div>'; |
| 69 | } |
| 70 | } |
| 71 | |
| 72 | public static function get_current_user_id() |
| 73 | { |
| 74 | return get_current_user_id(); |
| 75 | } |
| 76 | |
| 77 | /** |
| 78 | * Update user profile. |
| 79 | * |
| 80 | * @param int $form_id ID of edit profile form |
| 81 | * @param string $redirect URL to redirect to after edit profile. |
| 82 | * |
| 83 | * @return mixed |
| 84 | */ |
| 85 | public static function update_user_profile($form_id, $redirect = '') |
| 86 | { |
| 87 | if (wp_doing_ajax()) { |
| 88 | ppress_verify_ajax_nonce(); |
| 89 | } else { |
| 90 | ppress_verify_nonce(); |
| 91 | } |
| 92 | |
| 93 | $post = $_POST; |
| 94 | |
| 95 | $old_user_data = get_userdata(self::get_current_user_id()); |
| 96 | |
| 97 | /* Validate and add custom validation to edit profile */ |
| 98 | $validation_errors = apply_filters('ppress_edit_profile_validation', '', $form_id); |
| 99 | |
| 100 | if (is_wp_error($validation_errors)) { |
| 101 | return $validation_errors->get_error_message(); |
| 102 | } |
| 103 | |
| 104 | // create an array of acceptable userdata for use by wp_update_user |
| 105 | $valid_userdata = array( |
| 106 | 'eup_username', |
| 107 | 'eup_password', |
| 108 | 'eup_email', |
| 109 | 'eup_email2', |
| 110 | 'eup_website', |
| 111 | 'eup_nickname', |
| 112 | 'eup_display_name', |
| 113 | 'eup_first_name', |
| 114 | 'eup_last_name', |
| 115 | 'eup_bio' |
| 116 | ); |
| 117 | |
| 118 | if (isset($post['eup_email']) && ! is_email($post['eup_email'])) { |
| 119 | return esc_html__('Email address is invalid. Please try again', 'wp-user-avatar'); |
| 120 | } |
| 121 | |
| 122 | if (isset($post['eup_email2']) && ! is_email($post['eup_email2'])) { |
| 123 | return esc_html__('Email address confirmation is invalid. Please try again', 'wp-user-avatar'); |
| 124 | } |
| 125 | |
| 126 | if (isset($post['eup_email2']) && ($post['eup_email'] != $post['eup_email2'])) { |
| 127 | return esc_html__('Email addresses do not match. Please try again', 'wp-user-avatar'); |
| 128 | } |
| 129 | |
| 130 | if (isset($post['eup_password2'])) { |
| 131 | |
| 132 | // if set to false, empty password or empty confirm password field will cause the form not to update the user profile. |
| 133 | // (users have to change their password for the form to update their profile) |
| 134 | if (apply_filters('ppress_allow_empty_password_unchanged', true)) { |
| 135 | if ( ! empty($post['eup_password']) && ! empty($post['eup_password2'])) { |
| 136 | if (($post['eup_password'] != $post['eup_password2'])) { |
| 137 | return esc_html__('Password do not match. Please try again.', 'wp-user-avatar'); |
| 138 | } |
| 139 | } |
| 140 | } else { |
| 141 | if (empty($post['eup_password']) || empty($post['eup_password2'])) { |
| 142 | return esc_html__('Password is empty or do not match. Please try again.', 'wp-user-avatar'); |
| 143 | } |
| 144 | |
| 145 | if (($post['eup_password'] != $post['eup_password2'])) { |
| 146 | return esc_html__('Password do not match. Please try again.', 'wp-user-avatar'); |
| 147 | } |
| 148 | } |
| 149 | } |
| 150 | |
| 151 | // get the escaped data for userdata |
| 152 | $escaped_post_data = self::escaped_post_data($post); |
| 153 | |
| 154 | // get the data for use by update_user_meta |
| 155 | $custom_usermeta = apply_filters('ppress_edit_profile_custom_usermeta', self::custom_usermeta_data($escaped_post_data, $valid_userdata), $form_id); |
| 156 | |
| 157 | // convert the form post data to userdata for use by wp_update_users |
| 158 | $real_userdata = array(); |
| 159 | |
| 160 | $real_userdata['ID'] = self::get_current_user_id(); |
| 161 | |
| 162 | // only process password change if it is specified. |
| 163 | if ( ! empty($post['eup_password'])) { |
| 164 | // never escape password. |
| 165 | $real_userdata['user_pass'] = $post['eup_password']; |
| 166 | } |
| 167 | |
| 168 | if (isset($post['eup_email'])) { |
| 169 | $real_userdata['user_email'] = $escaped_post_data['eup_email']; |
| 170 | } |
| 171 | |
| 172 | if (isset($post['eup_website'])) { |
| 173 | $real_userdata['user_url'] = $escaped_post_data['eup_website']; |
| 174 | } |
| 175 | |
| 176 | if (isset($post['eup_nickname'])) { |
| 177 | $real_userdata['nickname'] = $escaped_post_data['eup_nickname']; |
| 178 | } |
| 179 | |
| 180 | if (isset($post['eup_display_name'])) { |
| 181 | $real_userdata['display_name'] = $escaped_post_data['eup_display_name']; |
| 182 | } |
| 183 | |
| 184 | if (isset($post['eup_first_name'])) { |
| 185 | $real_userdata['first_name'] = $escaped_post_data['eup_first_name']; |
| 186 | } |
| 187 | |
| 188 | if (isset($post['eup_last_name'])) { |
| 189 | $real_userdata['last_name'] = $escaped_post_data['eup_last_name']; |
| 190 | } |
| 191 | |
| 192 | if (isset($post['eup_bio'])) { |
| 193 | $real_userdata['description'] = $escaped_post_data['eup_bio']; |
| 194 | } |
| 195 | |
| 196 | // merge real data(for use by wp_insert_user()) and custom fields data |
| 197 | $user_data = apply_filters('ppress_edit_profile_user_data', array_merge($real_userdata, $custom_usermeta), $form_id); |
| 198 | |
| 199 | /** |
| 200 | * Fires before profile is updated |
| 201 | * |
| 202 | * @param $user_data array user_data of user being updated |
| 203 | * @param $form_id int builder ID |
| 204 | */ |
| 205 | do_action('ppress_before_profile_update', $user_data, $form_id); |
| 206 | |
| 207 | $ajax_response = array(); |
| 208 | |
| 209 | if (isset($_FILES['eup_avatar']['name']) && ! empty($_FILES['eup_avatar']['name'])) { |
| 210 | $upload_avatar = ImageUploader::process($_FILES['eup_avatar']); |
| 211 | |
| 212 | if (is_wp_error($upload_avatar)) { |
| 213 | return $upload_avatar->get_error_message(); |
| 214 | } |
| 215 | |
| 216 | // update custom field |
| 217 | $custom_usermeta['pp_profile_avatar'] = $upload_avatar; |
| 218 | |
| 219 | /** WP User Avatar Adapter STARTS */ |
| 220 | self::delete_deprecated_wp_user_avatar_image(); |
| 221 | /** WP User Avatar Adapter ENDS */ |
| 222 | |
| 223 | if (wp_doing_ajax()) { |
| 224 | $ajax_response['avatar_url'] = PPRESS_AVATAR_UPLOAD_URL . $upload_avatar; |
| 225 | } |
| 226 | } |
| 227 | |
| 228 | if (isset($_FILES['eup_cover_image']['name']) && ! empty($_FILES['eup_cover_image']['name'])) { |
| 229 | |
| 230 | $upload_cover_image = ImageUploader::process($_FILES['eup_cover_image'], ImageUploader::COVER_IMAGE, PPRESS_COVER_IMAGE_UPLOAD_DIR); |
| 231 | |
| 232 | if (is_wp_error($upload_cover_image)) { |
| 233 | return $upload_cover_image->get_error_message(); |
| 234 | } |
| 235 | |
| 236 | $custom_usermeta['pp_profile_cover_image'] = $upload_cover_image; |
| 237 | |
| 238 | if (wp_doing_ajax()) { |
| 239 | $ajax_response['cover_image_url'] = PPRESS_COVER_IMAGE_UPLOAD_URL . $upload_cover_image; |
| 240 | } |
| 241 | } |
| 242 | |
| 243 | // update file uploads |
| 244 | $uploads = FileUploader::init(); |
| 245 | $upload_errors = ''; |
| 246 | foreach ($uploads as $field_key => $uploaded_filename_or_wp_error) { |
| 247 | if (is_wp_error($uploaded_filename_or_wp_error)) { |
| 248 | $upload_errors .= $uploaded_filename_or_wp_error->get_error_message() . '<br/>'; |
| 249 | } |
| 250 | } |
| 251 | |
| 252 | if ( ! empty($upload_errors)) return $upload_errors; |
| 253 | |
| 254 | // we get the old array of stored file for the user |
| 255 | $old = get_user_meta(self::get_current_user_id(), 'pp_uploaded_files', true); |
| 256 | $old = ! empty($old) ? $old : array(); |
| 257 | |
| 258 | // we loop through the array of newly uploaded files and remove any file (un-setting the file array key) |
| 259 | // that isn't be updated i.e if the field is left empty, un-setting it prevent update_user_meta |
| 260 | // fom overriding it. |
| 261 | // we then merge the old and new uploads before saving the data to user meta table. |
| 262 | foreach ($uploads as $key => $value) { |
| 263 | if (empty($value)) { |
| 264 | unset($uploads[$key]); |
| 265 | } |
| 266 | } |
| 267 | |
| 268 | update_user_meta(self::get_current_user_id(), 'pp_uploaded_files', array_merge($old, $uploads)); |
| 269 | |
| 270 | if (is_array($custom_usermeta)) { |
| 271 | |
| 272 | $user_id = self::get_current_user_id(); |
| 273 | |
| 274 | foreach ($custom_usermeta as $key => $value) { |
| 275 | |
| 276 | update_user_meta($user_id, $key, $value); |
| 277 | |
| 278 | // the 'edit_profile' parameter is used to distinguish it from same action hook in RegistrationAuth |
| 279 | do_action('ppress_after_custom_field_update', $key, $value, $user_id, 'edit_profile'); |
| 280 | } |
| 281 | } |
| 282 | |
| 283 | // proceed to profile edit using wp_update_user method which return the new user id |
| 284 | $update_user = wp_update_user($real_userdata); |
| 285 | |
| 286 | if (is_wp_error($update_user)) { |
| 287 | return $update_user->get_error_message(); |
| 288 | } |
| 289 | |
| 290 | if ( ! is_wp_error($update_user)) { |
| 291 | |
| 292 | /** |
| 293 | * Fires after profile is updated |
| 294 | * |
| 295 | * @param array $user_data |
| 296 | * @param int $form_id |
| 297 | * @param \WP_User $old_user_data |
| 298 | */ |
| 299 | do_action('ppress_after_profile_update', $user_data, $form_id, $old_user_data); |
| 300 | |
| 301 | // success flag is used by ajax mode. see self::process_func() |
| 302 | if (wp_doing_ajax()) { |
| 303 | $ajax_response['status'] = 'success'; |
| 304 | |
| 305 | return $ajax_response; |
| 306 | } |
| 307 | |
| 308 | $url = apply_filters('ppress_redirect_after_profile_edit', esc_url_raw(add_query_arg('edit', 'true'))); |
| 309 | |
| 310 | if ( ! empty($redirect)) { |
| 311 | $url = esc_url_raw($redirect); |
| 312 | } |
| 313 | |
| 314 | wp_safe_redirect($url); |
| 315 | exit; |
| 316 | } |
| 317 | |
| 318 | return esc_html__('Something unexpected happened. Please try again', 'wp-user-avatar'); |
| 319 | } |
| 320 | |
| 321 | /** |
| 322 | * Escaped the POST data |
| 323 | * |
| 324 | * @param $post_data array raw post data |
| 325 | * |
| 326 | * @return array |
| 327 | */ |
| 328 | public static function escaped_post_data($post_data) |
| 329 | { |
| 330 | $escaped_post_data = array(); |
| 331 | |
| 332 | foreach ($post_data as $key => $value) { |
| 333 | if ($key == 'eup_submit') { |
| 334 | continue; |
| 335 | } |
| 336 | |
| 337 | if ('eup_bio' == $key) { |
| 338 | $escaped_post_data[$key] = wp_kses_post($value); |
| 339 | } elseif (is_array($value)) { |
| 340 | $escaped_post_data[$key] = array_map('sanitize_text_field', $value); |
| 341 | } else { |
| 342 | $escaped_post_data[$key] = ppress_strip_shortcodes_clean($value); |
| 343 | } |
| 344 | } |
| 345 | |
| 346 | return $escaped_post_data; |
| 347 | } |
| 348 | |
| 349 | /** |
| 350 | * @param $post_data array escaped $_POST Data @see self::escaped_post_data |
| 351 | * |
| 352 | * @param $valid_userdata array userdata valid for wp_update_user |
| 353 | * |
| 354 | * @return array |
| 355 | */ |
| 356 | public static function custom_usermeta_data($post_data, $valid_userdata) |
| 357 | { |
| 358 | $custom_usermeta = array(); |
| 359 | |
| 360 | $valid_custom_usermeta = array_keys(ppress_custom_fields_key_value_pair(true)); |
| 361 | |
| 362 | foreach ($post_data as $key => $value) { |
| 363 | |
| 364 | if ($key == 'eup_submit' || in_array($key, ppress_reserved_field_keys()) || ! in_array($key, $valid_custom_usermeta)) continue; |
| 365 | |
| 366 | if ( ! in_array($key, $valid_userdata)) { |
| 367 | $custom_usermeta[$key] = $value; |
| 368 | } |
| 369 | } |
| 370 | |
| 371 | return $custom_usermeta; |
| 372 | } |
| 373 | |
| 374 | /** |
| 375 | * Remove user avatar and redirect. Triggered when JS is disabled. |
| 376 | */ |
| 377 | public static function remove_user_avatar() |
| 378 | { |
| 379 | self::remove_avatar_core(); |
| 380 | |
| 381 | wp_safe_redirect(esc_url_raw(add_query_arg('edit', 'true'))); |
| 382 | exit; |
| 383 | } |
| 384 | |
| 385 | /** |
| 386 | * Remove user cover photo and redirect. Triggered when JS is disabled. |
| 387 | */ |
| 388 | public static function remove_user_cover_image() |
| 389 | { |
| 390 | self::remove_cover_image(); |
| 391 | wp_safe_redirect(esc_url_raw(add_query_arg('edit', 'true'))); |
| 392 | exit; |
| 393 | } |
| 394 | |
| 395 | /** |
| 396 | * Core function that removes/delete the user's avatar |
| 397 | */ |
| 398 | public static function remove_avatar_core() |
| 399 | { |
| 400 | $avatar_slug = get_user_meta(self::get_current_user_id(), 'pp_profile_avatar', true); |
| 401 | |
| 402 | do_action('ppress_before_avatar_removal', $avatar_slug); |
| 403 | |
| 404 | unlink(PPRESS_AVATAR_UPLOAD_DIR . $avatar_slug); |
| 405 | |
| 406 | $user_id = self::get_current_user_id(); |
| 407 | |
| 408 | // delete the record from DB |
| 409 | delete_user_meta($user_id, 'pp_profile_avatar'); |
| 410 | |
| 411 | /** WP User Avatar Adapter STARTS */ |
| 412 | self::delete_deprecated_wp_user_avatar_image(); |
| 413 | /** WP User Avatar Adapter ENDS */ |
| 414 | |
| 415 | do_action('ppress_after_avatar_removal'); |
| 416 | } |
| 417 | |
| 418 | private static function delete_deprecated_wp_user_avatar_image() |
| 419 | { |
| 420 | /** WP User Avatar Adapter STARTS */ |
| 421 | global $wpdb, $blog_id, $post, $wp_user_avatar; |
| 422 | |
| 423 | $user_id = self::get_current_user_id(); |
| 424 | |
| 425 | if ( ! $wp_user_avatar->wpua_is_author_or_above()) { |
| 426 | // Delete other uploads by user |
| 427 | $q = array( |
| 428 | 'author' => $user_id, |
| 429 | 'post_type' => 'attachment', |
| 430 | 'post_status' => 'inherit', |
| 431 | 'posts_per_page' => '-1', |
| 432 | 'meta_query' => array( |
| 433 | array( |
| 434 | 'key' => '_wp_attachment_wp_user_avatar', |
| 435 | 'value' => "", |
| 436 | 'compare' => '!=' |
| 437 | ) |
| 438 | ) |
| 439 | ); |
| 440 | $avatars_wp_query = new \WP_Query($q); |
| 441 | while ($avatars_wp_query->have_posts()) : $avatars_wp_query->the_post(); |
| 442 | wp_delete_attachment($post->ID); |
| 443 | endwhile; |
| 444 | } |
| 445 | |
| 446 | delete_metadata('post', null, '_wp_attachment_wp_user_avatar', $user_id, true); |
| 447 | delete_user_meta($user_id, $wpdb->get_blog_prefix($blog_id) . 'user_avatar'); |
| 448 | /** WP User Avatar Adapter ENDS */ |
| 449 | } |
| 450 | |
| 451 | /** |
| 452 | * Core function that removes/delete the user's cover photo |
| 453 | * |
| 454 | * @param int $user_id |
| 455 | */ |
| 456 | public static function remove_cover_image($user_id = 0) |
| 457 | { |
| 458 | $user_id = is_int($user_id) && $user_id > 0 ? $user_id : self::get_current_user_id(); |
| 459 | |
| 460 | $slug = get_user_meta($user_id, 'pp_profile_cover_image', true); |
| 461 | |
| 462 | do_action('ppress_before_cover_image_removal', $slug); |
| 463 | |
| 464 | unlink(PPRESS_COVER_IMAGE_UPLOAD_DIR . $slug); |
| 465 | |
| 466 | // delete the record from DB |
| 467 | delete_user_meta($user_id, 'pp_profile_cover_image'); |
| 468 | |
| 469 | do_action('ppress_after_cover_image_removal'); |
| 470 | } |
| 471 | } |