Skip to content
6 changes: 6 additions & 0 deletions includes/Ajax/Frontend_Form_Ajax.php
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ class Frontend_Form_Ajax {
public function submit_post() {
check_ajax_referer( 'wpuf_form_add' );
add_filter( 'wpuf_form_fields', [ $this, 'add_field_settings' ] );

// Initialize WooCommerce hooks for proper attribute display
if ( method_exists( $this, 'init_woocommerce_hooks' ) ) {
$this->init_woocommerce_hooks();
}

@header( 'Content-Type: application/json; charset=' . get_option( 'blog_charset' ) );

$form_id = isset( $_POST['form_id'] ) ? intval( wp_unslash( $_POST['form_id'] ) ) : 0;
Expand Down
5 changes: 5 additions & 0 deletions includes/Frontend/Frontend_Form.php
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,11 @@
add_action( 'wpuf_guest_post_email_verified', [ $this, 'send_mail_to_admin_after_guest_mail_verified' ] );

$this->set_wp_post_types();

Check failure on line 23 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Whitespace found at end of line
// Initialize WooCommerce hooks for proper attribute display
if ( method_exists( $this, 'init_woocommerce_hooks' ) ) {
$this->init_woocommerce_hooks();
}

// Enable post edit link for post authors in frontend
if ( ! is_admin() ) {
Expand Down Expand Up @@ -173,7 +178,7 @@
public function draft_post() {
check_ajax_referer( 'wpuf_form_add' );
add_filter( 'wpuf_form_fields', [ $this, 'add_field_settings' ] );
@header( 'Content-Type: application/json; charset=' . get_option( 'blog_charset' ) );

Check warning on line 181 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Silencing errors is strongly discouraged. Use proper error checking instead. Found: @Header( 'Content-Type: application/json; charset=' ...

$form_id = isset( $_POST['form_id'] ) ? intval( wp_unslash( $_POST['form_id'] ) ) : 0;
$form = new Form( $form_id );
Expand All @@ -181,7 +186,7 @@
$this->form_fields = $form->get_fields();
$pay_per_post = $form->is_enabled_pay_per_post();

[ $post_vars, $taxonomy_vars, $meta_vars ] = $this->get_input_fields( $this->form_fields );

Check failure on line 189 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

The shorthand list syntax "[]" to destructure arrays is not available in PHP 7.0 or earlier.

$entry_fields = $form->prepare_entries();
$allowed_tags = wp_kses_allowed_html( 'post' );
Expand Down Expand Up @@ -309,7 +314,7 @@
$this->form_fields = $form->get_fields();
$this->form_settings = $form->get_settings();
$this->generate_auth_link(); // Translate tag %login% %registration% to login registartion url
[ $user_can_post, $info ] = $form->is_submission_open( $form, $this->form_settings );

Check failure on line 317 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

The shorthand list syntax "[]" to destructure arrays is not available in PHP 7.0 or earlier.
$info = apply_filters( 'wpuf_addpost_notice', $info, $id, $this->form_settings );
$user_can_post = apply_filters( 'wpuf_can_post', $user_can_post, $id, $this->form_settings );

Expand All @@ -330,9 +335,9 @@
* @since 2.5.8
*/
public function publish_guest_post() {
$post_msg = isset( $_GET['post_msg'] ) ? sanitize_text_field( wp_unslash( $_GET['post_msg'] ) ) : '';

Check warning on line 338 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.

Check warning on line 338 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.
$pid = isset( $_GET['p_id'] ) ? sanitize_text_field( wp_unslash( $_GET['p_id'] ) ) : '';

Check warning on line 339 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.

Check warning on line 339 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.
$fid = isset( $_GET['f_id'] ) ? sanitize_text_field( wp_unslash( $_GET['f_id'] ) ) : '';

Check warning on line 340 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.

Check warning on line 340 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.

if ( $post_msg !== 'verified' ) {
return;
Expand Down Expand Up @@ -360,7 +365,7 @@
get_permalink( wpuf_get_option( 'payment_page', 'wpuf_payment' ) )
);

wp_redirect( $response['redirect_to'] );

Check warning on line 368 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
wpuf_clear_buffer();
wp_send_json_error( $response );
}
Expand Down Expand Up @@ -437,10 +442,10 @@
public function get_edit_post_link( $url, $post_id ) {
if (
current_user_can( 'edit_post', $post_id )
&& ! current_user_can( 'administrator' )

Check failure on line 445 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Capabilities should be used instead of roles. Found "administrator" in function call to current_user_can()
&& ! current_user_can( 'editor' )

Check failure on line 446 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Capabilities should be used instead of roles. Found "editor" in function call to current_user_can()
&& ! current_user_can( 'author' )

Check failure on line 447 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Capabilities should be used instead of roles. Found "author" in function call to current_user_can()
&& ! current_user_can( 'contributor' )

Check failure on line 448 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Capabilities should be used instead of roles. Found "contributor" in function call to current_user_can()
) {
$post = get_post( $post_id );
$form_id = get_post_meta( $post_id, '_wpuf_form_id', true );
Expand Down Expand Up @@ -497,7 +502,7 @@
* @return void
*/
public function send_mail_to_admin_after_guest_mail_verified() {
$post_id = ! empty( $_GET['p_id'] ) ? wpuf_decryption( sanitize_text_field( wp_unslash( $_GET['p_id'] ) ) ) : 0;

Check warning on line 505 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.

Check warning on line 505 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Processing form data without nonce verification.
$form_id = ! empty( $_GET['f_id'] ) ? wpuf_decryption( sanitize_text_field( wp_unslash( $_GET['f_id'] ) ) ) : 0;

if ( empty( $post_id ) || empty( $form_id ) ) {
Expand Down Expand Up @@ -529,10 +534,10 @@
$to = implode(
',',
array_filter(
array_map( static function ( $addr ) {

Check failure on line 537 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Opening parenthesis of a multi-line function call must be the last content on the line
$addr = trim( $addr );
return is_email( $addr ) ? $addr : null;
}, explode( ',', $to_raw ) )

Check failure on line 540 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

Closing parenthesis of a multi-line function call must be on a line by itself
)
);
$subject = $this->prepare_mail_body( $this->form_settings['notification']['new_subject'], $author_id, $post_id );
Expand Down Expand Up @@ -603,7 +608,7 @@

// custom fields
preg_match_all( '/{custom_([\w-]*)\b}/', $content, $matches );
[ $search, $replace ] = $matches;

Check failure on line 611 in includes/Frontend/Frontend_Form.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection

The shorthand list syntax "[]" to destructure arrays is not available in PHP 7.0 or earlier.

if ( $replace ) {
foreach ( $replace as $index => $meta_key ) {
Expand Down
Loading
Loading