: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
// we will use array_walk_recursive method for sanitizing current data because we can receive an multidimensional array!
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$newsletterData = isset($_POST['newsletterData']) ? stripslashes_deep($_POST['newsletterData']) : [];
array_walk_recursive($newsletterData, function(&$item, $k){
if ($k === 'messageBody'){
$item = wp_kses($item, AdminHelper::allowed_html_tags());
$item = sanitize_text_field($item);
if(isset($newsletterData['testSendingStatus']) && $newsletterData['testSendingStatus'] == 'test') {
AdminHelper::sendTestNewsletter($newsletterData);
$subscriptionFormId = (int)$newsletterData['subscriptionFormId'];
$subscribersTableName = $wpdb->prefix.SGPB_SUBSCRIBERS_TABLE_NAME;
$wpdb->query( $wpdb->prepare("UPDATE $subscribersTableName SET status = 0 WHERE subscriptionType = %d", $subscriptionFormId) );
$newsletterData['blogname'] = get_bloginfo('name');
$newsletterData['username'] = wp_get_current_user()->user_login;
update_option('SGPB_NEWSLETTER_DATA', $newsletterData);
wp_schedule_event(time(), 'sgpb_newsletter_send_every_minute', 'sgpb_send_newsletter');
public function checkSameOrigin()
check_ajax_referer(SG_AJAX_NONCE, 'nonce');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
$url = isset($_POST['iframeUrl']) ? esc_url_raw($_POST['iframeUrl']) : '';
$status = SGPB_AJAX_STATUS_FALSE;
$remoteGet = wp_remote_get($url);
if(is_array($remoteGet) && !empty($remoteGet['headers']['x-frame-options'])) {
$siteUrl = isset($_POST['siteUrl']) ? esc_url_raw($_POST['siteUrl']) : '';
$xFrameOptions = $remoteGet['headers']['x-frame-options'];
if($xFrameOptions == 'deny') {
} else if($xFrameOptions == 'SAMEORIGIN') {
if(strpos($url, $siteUrl) === false) {
if(strpos($xFrameOptions, $siteUrl) === false) {
// $remoteGet['response']['code'] < 400 it's mean correct status
if(is_array($remoteGet) && isset($remoteGet['response']['code']) && $remoteGet['response']['code'] < 400) {
$status = SGPB_AJAX_STATUS_TRUE;
public function changePopupStatus()
check_ajax_referer(SG_AJAX_NONCE, 'ajaxNonce');
if (!isset($_POST['popupId'])){
wp_die(esc_html(SGPB_AJAX_STATUS_FALSE));
$popupId = (int)sanitize_text_field($_POST['popupId']);
$obj = SGPopup::find($popupId);
$postStatus = get_post_status($popupId);
if($postStatus == 'draft') {
if(!$obj || !is_object($obj)) {
wp_die(esc_html(SGPB_AJAX_STATUS_FALSE));
$options = $obj->getOptions();
$options['sgpb-is-active'] = isset($_POST['popupStatus'])? sanitize_text_field($_POST['popupStatus']) : '';
if( isset( $options['sgpb-conditions'] ) ){
unset( $options['sgpb-conditions'] );
update_post_meta($popupId, 'sg_popup_options'.$isDraft, $options);
wp_die(esc_html($popupId));
public function subscriptionSubmission()
check_ajax_referer(SG_AJAX_NONCE, 'nonce');
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$submissionData = isset($_POST['formData']) ? $_POST['formData'] : "[]";
parse_str($submissionData, $formData);
array_walk_recursive($formData, function(&$item){
$item = sanitize_text_field($item);
$popupPostId = isset($_POST['popupPostId']) ? (int)sanitize_text_field($_POST['popupPostId']) : '';
echo esc_html( SGPB_AJAX_STATUS_FALSE );
$hiddenChecker = sanitize_text_field($formData['sgpb-subs-hidden-checker']);
// this check is made to protect ourselves from bot
if(!empty($hiddenChecker)) {
$status = SGPB_AJAX_STATUS_FALSE;
$email = sanitize_email($formData['sgpb-subs-email']);
$firstName = sanitize_text_field($formData['sgpb-subs-first-name']);
$lastName = sanitize_text_field($formData['sgpb-subs-last-name']);
$subscribersTableName = $wpdb->prefix.SGPB_SUBSCRIBERS_TABLE_NAME;
$list = $wpdb->get_row( $wpdb->prepare("SELECT id FROM $subscribersTableName WHERE email = %s AND subscriptionType = %d", $email, $popupPostId), ARRAY_A);
// When subscriber does not exist we insert to subscribers table otherwise we update user info
$res = $wpdb->query( $wpdb->prepare("INSERT INTO $subscribersTableName (firstName, lastName, email, cDate, subscriptionType) VALUES (%s, %s, %s, %s, %d) ", $firstName, $lastName, $email, $date, $popupPostId) );
$wpdb->query( $wpdb->prepare("UPDATE $subscribersTableName SET firstName = %s, lastName = %s, email = %s, cDate = %s, subscriptionType = %d WHERE id = %d", $firstName, $lastName, $email, $date, $popupPostId, $list['id']) );
$status = SGPB_AJAX_STATUS_TRUE;
echo esc_html( $status );
public function sgpbSubsciptionFormSubmittedAction()
check_ajax_referer(SG_AJAX_NONCE, 'nonce');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$submissionData = isset($_POST['formData']) ? $_POST['formData'] : "[]";
parse_str($submissionData, $formData);
array_walk_recursive($formData, function(&$item){
$item = sanitize_text_field($item);
$popupPostId = isset($_POST['popupPostId']) ? (int)sanitize_text_field($_POST['popupPostId']) : '';
echo esc_html( SGPB_AJAX_STATUS_FALSE );
$email = isset($_POST['emailValue']) ? sanitize_email($_POST['emailValue']) : '';
$firstName = isset($_POST['firstNameValue']) ? sanitize_text_field($_POST['firstNameValue']) : '';
$lastName = isset($_POST['lastNameValue']) ? sanitize_text_field($_POST['lastNameValue']) : '';
'firstName' => $firstName,
$this->sendSuccessEmails($popupPostId, $userData);
do_action('sgpbProcessAfterSuccessfulSubmission', $popupPostId, $userData);
public function sendSuccessEmails($popupPostId, $subscriptionDetails)
$popup = SGPopup::find($popupPostId);
$subscribersTableName = $wpdb->prefix.SGPB_SUBSCRIBERS_TABLE_NAME;
$count = $wpdb->get_row( $wpdb->prepare("SELECT COUNT(id) as countIds FROM $subscribersTableName WHERE subscriptionType = %d", $popupPostId), ARRAY_A);
$popupOptions = $popup->getOptions();
$adminUserName = 'admin';
$adminEmail = get_option('admin_email');
$userData = @get_user_by('email', $adminEmail);
$adminUserName = $userData->display_name;
$newSubscriberEmailHeader = AdminHelper::getEmailHeader($adminEmail);
$takeReviewAfterFirstSubscription = get_option('sgpb-new-subscriber');
if($count['countIds'] == 1 && !$takeReviewAfterFirstSubscription) {
update_option('sgpb-new-subscriber', 1);
$newSubscriberEmailTitle = __('Congrats! You have already 1 subscriber!', 'popup-builder');
$reviewEmailTemplate = AdminHelper::getFileFromURL(SG_POPUP_EMAIL_TEMPLATES_URL.'takeReviewAfterSubscribe.html');
$reviewEmailTemplate = preg_replace('/\[adminUserName]/', $adminUserName, $reviewEmailTemplate);
$sendStatus = wp_mail($adminEmail, $newSubscriberEmailTitle, $reviewEmailTemplate, $newSubscriberEmailHeader); //return true or false
public function select2SearchData()
check_ajax_referer(SG_AJAX_NONCE, 'nonce_ajax');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
$postTypeName = isset($_POST['searchKey']) ? sanitize_text_field($_POST['searchKey']) : ''; // TODO strongly validate postTypeName example: use ENUM
$search = isset($_POST['searchTerm']) ? sanitize_text_field($_POST['searchTerm']) : '';
$searchResults = SGPBConfigDataHelper::getPostsAllCategories('post', [], $search);
$searchResults = SGPBConfigDataHelper::getAllTags($search);
$searchResults = $this->selectFromPost($postTypeName, $search);
if(isset($_POST['searchCallback'])) {
$searchCallback = sanitize_text_field($_POST['searchCallback']);
$searchResults = apply_filters('sgpbSearchAdditionalData', $search, array());
if(empty($searchResults)) {
$results['items'] = array();
/*Selected custom post type convert for select2 format*/
foreach($searchResults as $id => $name) {
$results['items'][] = array(
private function selectFromPost($postTypeName, $search)
'post__in' => !empty($_REQUEST['include']) ? array_map('intval', $_REQUEST['include']) : null,
'page' => !empty($_REQUEST['page']) ? absint($_REQUEST['page']) : null,
'post_type' => $postTypeName
$searchResults = SGPBConfigDataHelper::getPostTypeData($args);
public function addConditionGroupRow()
check_ajax_referer(SG_AJAX_NONCE, 'nonce_ajax');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
global $SGPB_DATA_CONFIG_ARRAY;
$groupId = isset($_POST['groupId']) ? (int)sanitize_text_field($_POST['groupId']) : '';
$targetType = isset($_POST['conditionName']) ? sanitize_text_field($_POST['conditionName']) : '';
$builderObj = new ConditionBuilder();
$builderObj->setGroupId($groupId);
$builderObj->setRuleId(SG_CONDITION_FIRST_RULE);
$builderObj->setSavedData($SGPB_DATA_CONFIG_ARRAY[$targetType]['initialData'][0]);
$builderObj->setConditionName($targetType);
$addedObj[] = $builderObj;
$creator = new ConditionCreator($addedObj);
echo wp_kses($creator->render(), AdminHelper::allowed_html_tags());
public function addConditionRuleRow()
check_ajax_referer(SG_AJAX_NONCE, 'nonce_ajax');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
global $SGPB_DATA_CONFIG_ARRAY;
$targetType = isset($_POST['conditionName']) ? sanitize_text_field($_POST['conditionName']) : '';
$builderObj = new ConditionBuilder();
$groupId = isset($_POST['groupId']) ? (int)sanitize_text_field($_POST['groupId']) : '';
$ruleId = isset($_POST['ruleId']) ? (int)sanitize_text_field($_POST['ruleId']) : '';
$builderObj->setGroupId($groupId);
$builderObj->setRuleId($ruleId);
$builderObj->setSavedData($SGPB_DATA_CONFIG_ARRAY[$targetType]['initialData'][0]);
$builderObj->setConditionName($targetType);
$data .= ConditionCreator::createConditionRuleRow($builderObj);
echo wp_kses($data, AdminHelper::allowed_html_tags());
public function changeConditionRuleRow()
check_ajax_referer(SG_AJAX_NONCE, 'nonce_ajax');
* We only allow administrator to do this action
if ( ! current_user_can( 'manage_options' ) ) {
wp_die(esc_html__('You do not have permission to do this action!', 'popup-builder'));
global $SGPB_DATA_CONFIG_ARRAY;
$targetType = isset($_POST['conditionName']) ? sanitize_text_field($_POST['conditionName']) : '';
$builderObj = new ConditionBuilder();
$conditionConfig = $SGPB_DATA_CONFIG_ARRAY[$targetType];
$groupId = isset($_POST['groupId']) ? (int)sanitize_text_field($_POST['groupId']) : '';
$ruleId = isset($_POST['ruleId']) ? (int)sanitize_text_field($_POST['ruleId']) : '';
$popupId = isset($_POST['popupId']) ? (int)sanitize_text_field($_POST['popupId']) : '';
$paramName = isset($_POST['paramName']) ? sanitize_text_field($_POST['paramName']) : '';
if($targetType == 'target' || $targetType == 'conditions') {
$savedData['operator'] = '==';
} else if($conditionConfig['specialDefaultOperator']) {
$savedData['operator'] = $paramName;
if(!empty($_POST['paramValue'])) {
$savedData['tempParam'] = sanitize_text_field($_POST['paramValue']);
$savedData['operator'] = $paramName;
// change operator value related to condition value
if(!empty($conditionConfig['operatorAllowInConditions']) && in_array($paramName, $conditionConfig['operatorAllowInConditions'])) {
$conditionConfig['paramsData']['operator'] = array();
if(!empty($conditionConfig['paramsData'][$paramName.'Operator'])) {
$operatorData = $conditionConfig['paramsData'][$paramName.'Operator'];
$SGPB_DATA_CONFIG_ARRAY[$targetType]['paramsData']['operator'] = $operatorData;
// change take value related to condition value
$operatorDataKeys = array_keys($operatorData);
if(!empty($operatorDataKeys[0])) {
$savedData['operator'] = $operatorDataKeys[0];
$builderObj->setTakeValueFrom('operator');
// by default set empty value for users' role (adv. tar.)
$savedData['value'] = array();
$savedData['hiddenOption'] = isset($conditionConfig['hiddenOptionData'][$paramName]) ? $conditionConfig['hiddenOptionData'][$paramName] : '';
$builderObj->setPopupId($popupId);
$builderObj->setGroupId($groupId);
$builderObj->setRuleId($ruleId);
$builderObj->setSavedData($savedData);
$builderObj->setConditionName($targetType);
$data .= ConditionCreator::createConditionRuleRow($builderObj);
echo wp_kses($data, AdminHelper::allowed_html_tags());