<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Admin\Tools\Views;

[2] Fix | Delete

[3] Fix | Delete

use WP_Error;

[4] Fix | Delete

use WPForms\Helpers\File;

[5] Fix | Delete

use WPForms\Admin\Tools\Importers;

[6] Fix | Delete

use WPForms\Admin\Tools\Tools;

[7] Fix | Delete

use WPForms_Form_Handler;

[8] Fix | Delete

use WPForms\Admin\Notice;

[9] Fix | Delete

[10] Fix | Delete

/**

[11] Fix | Delete

* Class Import.

[12] Fix | Delete

*

[13] Fix | Delete

* @since 1.6.6

[14] Fix | Delete

*/

[15] Fix | Delete

class Import extends View {

[16] Fix | Delete

[17] Fix | Delete

/**

[18] Fix | Delete

* View slug.

[19] Fix | Delete

*

[20] Fix | Delete

* @since 1.6.6

[21] Fix | Delete

*

[22] Fix | Delete

* @var string

[23] Fix | Delete

*/

[24] Fix | Delete

protected $slug = 'import';

[25] Fix | Delete

[26] Fix | Delete

/**

[27] Fix | Delete

* Registered importers.

[28] Fix | Delete

*

[29] Fix | Delete

* @since 1.6.6

[30] Fix | Delete

*

[31] Fix | Delete

* @var array

[32] Fix | Delete

*/

[33] Fix | Delete

public $importers = [];

[34] Fix | Delete

[35] Fix | Delete

/**

[36] Fix | Delete

* Checking user capability to view.

[37] Fix | Delete

*

[38] Fix | Delete

* @since 1.6.6

[39] Fix | Delete

*

[40] Fix | Delete

* @return bool

[41] Fix | Delete

*/

[42] Fix | Delete

public function check_capability() {

[43] Fix | Delete

[44] Fix | Delete

return wpforms_current_user_can( 'create_forms' );

[45] Fix | Delete

}

[46] Fix | Delete

[47] Fix | Delete

/**

[48] Fix | Delete

* Determine whether user has the "unfiltered_html" capability.

[49] Fix | Delete

*

[50] Fix | Delete

* By default, the "unfiltered_html" permission is only given to

[51] Fix | Delete

* Super Admins, Administrators and Editors.

[52] Fix | Delete

*

[53] Fix | Delete

* @since 1.7.9

[54] Fix | Delete

*

[55] Fix | Delete

* @return bool

[56] Fix | Delete

*/

[57] Fix | Delete

private function check_unfiltered_html_capability() {

[58] Fix | Delete

[59] Fix | Delete

return current_user_can( 'unfiltered_html' );

[60] Fix | Delete

}

[61] Fix | Delete

[62] Fix | Delete

/**

[63] Fix | Delete

* Init view.

[64] Fix | Delete

*

[65] Fix | Delete

* @since 1.6.6

[66] Fix | Delete

*/

[67] Fix | Delete

public function init() {

[68] Fix | Delete

[69] Fix | Delete

// Bail early, in case the current user lacks the `unfiltered_html` capability.

[70] Fix | Delete

if ( ! $this->check_unfiltered_html_capability() ) {

[71] Fix | Delete

$this->error_unfiltered_html_import_message();

[72] Fix | Delete

[73] Fix | Delete

return;

[74] Fix | Delete

}

[75] Fix | Delete

[76] Fix | Delete

$this->hooks();

[77] Fix | Delete

[78] Fix | Delete

$this->importers = ( new Importers() )->get_importers();

[79] Fix | Delete

}

[80] Fix | Delete

[81] Fix | Delete

/**

[82] Fix | Delete

* Register hooks.

[83] Fix | Delete

*

[84] Fix | Delete

* @since 1.7.9

[85] Fix | Delete

*/

[86] Fix | Delete

private function hooks() {

[87] Fix | Delete

[88] Fix | Delete

add_action( 'wpforms_tools_init', [ $this, 'import_process' ] );

[89] Fix | Delete

}

[90] Fix | Delete

[91] Fix | Delete

/**

[92] Fix | Delete

* Get view label.

[93] Fix | Delete

*

[94] Fix | Delete

* @since 1.6.6

[95] Fix | Delete

*

[96] Fix | Delete

* @return string

[97] Fix | Delete

*/

[98] Fix | Delete

public function get_label() {

[99] Fix | Delete

[100] Fix | Delete

return esc_html__( 'Import', 'wpforms-lite' );

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

/**

[104] Fix | Delete

* Import process.

[105] Fix | Delete

*

[106] Fix | Delete

* @since 1.6.6

[107] Fix | Delete

*/

[108] Fix | Delete

public function import_process() {

[109] Fix | Delete

[110] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Missing

[111] Fix | Delete

if (

[112] Fix | Delete

empty( $_POST['action'] ) ||

[113] Fix | Delete

$_POST['action'] !== 'import_form' ||

[114] Fix | Delete

empty( $_FILES['file']['tmp_name'] ) ||

[115] Fix | Delete

! isset( $_POST['submit-import'] ) ||

[116] Fix | Delete

! $this->verify_nonce()

[117] Fix | Delete

) {

[118] Fix | Delete

return;

[119] Fix | Delete

}

[120] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Missing

[121] Fix | Delete

[122] Fix | Delete

$this->process();

[123] Fix | Delete

}

[124] Fix | Delete

[125] Fix | Delete

/**

[126] Fix | Delete

* Import view content.

[127] Fix | Delete

*

[128] Fix | Delete

* @since 1.6.6

[129] Fix | Delete

*/

[130] Fix | Delete

public function display() {

[131] Fix | Delete

[132] Fix | Delete

// Bail early, in case the current user lacks the `unfiltered_html` capability.

[133] Fix | Delete

if ( ! $this->check_unfiltered_html_capability() ) {

[134] Fix | Delete

return;

[135] Fix | Delete

}

[136] Fix | Delete

[137] Fix | Delete

$this->success_import_message();

[138] Fix | Delete

$this->wpforms_block();

[139] Fix | Delete

$this->other_forms_block();

[140] Fix | Delete

}

[141] Fix | Delete

[142] Fix | Delete

/**

[143] Fix | Delete

* Success import message.

[144] Fix | Delete

*

[145] Fix | Delete

* @since 1.6.6

[146] Fix | Delete

*/

[147] Fix | Delete

private function success_import_message() {

[148] Fix | Delete

[149] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[150] Fix | Delete

if ( isset( $_GET['wpforms_notice'] ) && $_GET['wpforms_notice'] === 'forms-imported' ) {

[151] Fix | Delete

?>

[152] Fix | Delete

<div class="updated notice is-dismissible">

[153] Fix | Delete

<p>

[154] Fix | Delete

<?php esc_html_e( 'Import was successfully finished.', 'wpforms-lite' ); ?>

[155] Fix | Delete

<?php

[156] Fix | Delete

if ( wpforms_current_user_can( 'view_forms' ) ) {

[157] Fix | Delete

printf(

[158] Fix | Delete

wp_kses( /* translators: %s - forms list page URL. */

[159] Fix | Delete

__( 'You can go and <a href="%s">check your forms</a>.', 'wpforms-lite' ),

[160] Fix | Delete

[ 'a' => [ 'href' => [] ] ]

[161] Fix | Delete

),

[162] Fix | Delete

esc_url( admin_url( 'admin.php?page=wpforms-overview' ) )

[163] Fix | Delete

);

[164] Fix | Delete

}

[165] Fix | Delete

?>

[166] Fix | Delete

</p>

[167] Fix | Delete

</div>

[168] Fix | Delete

<?php

[169] Fix | Delete

}

[170] Fix | Delete

}

[171] Fix | Delete

[172] Fix | Delete

/**

[173] Fix | Delete

* Error message for users with no `unfiltered_html` permission.

[174] Fix | Delete

*

[175] Fix | Delete

* @since 1.7.9

[176] Fix | Delete

*/

[177] Fix | Delete

private function error_unfiltered_html_import_message() {

[178] Fix | Delete

[179] Fix | Delete

Notice::error(

[180] Fix | Delete

sprintf(

[181] Fix | Delete

wp_kses( /* translators: %s - WPForms contact page URL. */

[182] Fix | Delete

__( 'You can’t import forms because you don’t have unfiltered HTML permissions. Please contact your site administrator or <a href="%s" target="_blank" rel="noopener noreferrer">reach out to our support team</a>.', 'wpforms-lite' ),

[183] Fix | Delete

[

[184] Fix | Delete

'a' => [

[185] Fix | Delete

'href' => [],

[186] Fix | Delete

'target' => [],

[187] Fix | Delete

'rel' => [],

[188] Fix | Delete

],

[189] Fix | Delete

]

[190] Fix | Delete

),

[191] Fix | Delete

'https://wpforms.com/contact/'

[192] Fix | Delete

)

[193] Fix | Delete

);

[194] Fix | Delete

}

[195] Fix | Delete

[196] Fix | Delete

/**

[197] Fix | Delete

* WPForms section.

[198] Fix | Delete

*

[199] Fix | Delete

* @since 1.6.6

[200] Fix | Delete

*/

[201] Fix | Delete

private function wpforms_block() {

[202] Fix | Delete

?>

[203] Fix | Delete

[204] Fix | Delete

<div class="wpforms-setting-row tools wpforms-settings-row-divider">

[205] Fix | Delete

<h4><?php esc_html_e( 'WPForms Import', 'wpforms-lite' ); ?></h4>

[206] Fix | Delete

<p><?php esc_html_e( 'Select a WPForms export file.', 'wpforms-lite' ); ?></p>

[207] Fix | Delete

[208] Fix | Delete

<form method="post" enctype="multipart/form-data" action="<?php echo esc_attr( $this->get_link() ); ?>">

[209] Fix | Delete

<div class="wpforms-file-upload">

[210] Fix | Delete

<input type="file" name="file" id="wpforms-tools-form-import" class="inputfile"

[211] Fix | Delete

data-multiple-caption="{count} <?php esc_attr_e( 'files selected', 'wpforms-lite' ); ?>"

[212] Fix | Delete

accept=".json" />

[213] Fix | Delete

<label for="wpforms-tools-form-import">

[214] Fix | Delete

<span class="fld"><span class="placeholder"><?php esc_html_e( 'No file chosen', 'wpforms-lite' ); ?></span></span>

[215] Fix | Delete

<strong class="wpforms-btn wpforms-btn-md wpforms-btn-light-grey">

[216] Fix | Delete

<i class="fa fa-cloud-upload"></i><?php esc_html_e( 'Choose a File', 'wpforms-lite' ); ?>

[217] Fix | Delete

</strong>

[218] Fix | Delete

</label>

[219] Fix | Delete

</div>

[220] Fix | Delete

<input type="hidden" name="action" value="import_form">

[221] Fix | Delete

<button name="submit-import" class="wpforms-btn wpforms-btn-md wpforms-btn-orange" id="wpforms-import" aria-disabled="true">

[222] Fix | Delete

<?php esc_html_e( 'Import', 'wpforms-lite' ); ?>

[223] Fix | Delete

</button>

[224] Fix | Delete

<?php $this->nonce_field(); ?>

[225] Fix | Delete

</form>

[226] Fix | Delete

</div>

[227] Fix | Delete

<?php

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

/**

[231] Fix | Delete

* WPForms section.

[232] Fix | Delete

*

[233] Fix | Delete

* @since 1.6.6

[234] Fix | Delete

*/

[235] Fix | Delete

private function other_forms_block() {

[236] Fix | Delete

?>

[237] Fix | Delete

[238] Fix | Delete

<div class="wpforms-setting-row tools" id="wpforms-importers">

[239] Fix | Delete

<h4><?php esc_html_e( 'Import from Other Form Plugins', 'wpforms-lite' ); ?></h4>

[240] Fix | Delete

<p><?php esc_html_e( 'Not happy with other WordPress contact form plugins?', 'wpforms-lite' ); ?></p>

[241] Fix | Delete

<p><?php esc_html_e( 'WPForms makes it easy for you to switch by allowing you import your third-party forms with a single click.', 'wpforms-lite' ); ?></p>

[242] Fix | Delete

[243] Fix | Delete

<div class="wpforms-importers-wrap">

[244] Fix | Delete

<?php if ( empty( $this->importers ) ) { ?>

[245] Fix | Delete

<p><?php esc_html_e( 'No form importers are currently enabled.', 'wpforms-lite' ); ?> </p>

[246] Fix | Delete

<?php } else { ?>

[247] Fix | Delete

<form action="<?php echo esc_url( admin_url( 'admin.php' ) ); ?>">

[248] Fix | Delete

<span class="choicesjs-select-wrap">

[249] Fix | Delete

<select id="wpforms-tools-form-other-import" class="choicesjs-select" name="provider" data-search="<?php echo esc_attr( wpforms_choices_js_is_search_enabled( $this->importers ) ); ?>" required>

[250] Fix | Delete

<option value=""><?php esc_html_e( 'Select previous contact form plugin...', 'wpforms-lite' ); ?></option>

[251] Fix | Delete

<?php

[252] Fix | Delete

foreach ( $this->importers as $importer ) {

[253] Fix | Delete

$status = '';

[254] Fix | Delete

[255] Fix | Delete

if ( empty( $importer['installed'] ) ) {

[256] Fix | Delete

$status = esc_html__( 'Not Installed', 'wpforms-lite' );

[257] Fix | Delete

} elseif ( empty( $importer['active'] ) ) {

[258] Fix | Delete

$status = esc_html__( 'Not Active', 'wpforms-lite' );

[259] Fix | Delete

}

[260] Fix | Delete

printf(

[261] Fix | Delete

'<option value="%s" %s>%s %s</option>',

[262] Fix | Delete

esc_attr( $importer['slug'] ),

[263] Fix | Delete

! empty( $status ) ? 'disabled' : '',

[264] Fix | Delete

esc_html( $importer['name'] ),

[265] Fix | Delete

! empty( $status ) ? '(' . esc_html( $status ) . ')' : '' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped

[266] Fix | Delete

);

[267] Fix | Delete

}

[268] Fix | Delete

?>

[269] Fix | Delete

</select>

[270] Fix | Delete

</span>

[271] Fix | Delete

<input type="hidden" name="page" value="<?php echo esc_attr( Tools::SLUG ); ?>">

[272] Fix | Delete

<input type="hidden" name="view" value="importer">

[273] Fix | Delete

<button class="wpforms-btn wpforms-btn-md wpforms-btn-orange" id="wpforms-import-other" aria-disabled="true">

[274] Fix | Delete

<?php esc_html_e( 'Import', 'wpforms-lite' ); ?>

[275] Fix | Delete

</button>

[276] Fix | Delete

</form>

[277] Fix | Delete

<?php } ?>

[278] Fix | Delete

</div>

[279] Fix | Delete

</div>

[280] Fix | Delete

<?php

[281] Fix | Delete

}

[282] Fix | Delete

[283] Fix | Delete

/**

[284] Fix | Delete

* Import processing.

[285] Fix | Delete

*

[286] Fix | Delete

* @since 1.6.6

[287] Fix | Delete

*/

[288] Fix | Delete

private function process() { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks

[289] Fix | Delete

[290] Fix | Delete

// Add filter of the link rel attr to avoid JSON damage.

[291] Fix | Delete

add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 );

[292] Fix | Delete

[293] Fix | Delete

$ext = '';

[294] Fix | Delete

[295] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Missing

[296] Fix | Delete

if ( isset( $_FILES['file']['name'] ) ) {

[297] Fix | Delete

$ext = strtolower( pathinfo( sanitize_text_field( wp_unslash( $_FILES['file']['name'] ) ), PATHINFO_EXTENSION ) );

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

if ( $ext !== 'json' ) {

[301] Fix | Delete

wp_die(

[302] Fix | Delete

esc_html__( 'Please upload a valid .json form export file.', 'wpforms-lite' ),

[303] Fix | Delete

esc_html__( 'Error', 'wpforms-lite' ),

[304] Fix | Delete

[

[305] Fix | Delete

'response' => 400,

[306] Fix | Delete

]

[307] Fix | Delete

);

[308] Fix | Delete

}

[309] Fix | Delete

[310] Fix | Delete

// The wp_unslash() function breaks upload on Windows.

[311] Fix | Delete

// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing

[312] Fix | Delete

$filename = isset( $_FILES['file']['tmp_name'] ) ? sanitize_text_field( $_FILES['file']['tmp_name'] ) : '';

[313] Fix | Delete

[314] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Missing

[315] Fix | Delete

[316] Fix | Delete

$result = self::import_forms( $filename );

[317] Fix | Delete

[318] Fix | Delete

if ( $result !== null ) {

[319] Fix | Delete

wp_die(

[320] Fix | Delete

esc_html( $result->get_error_message() ),

[321] Fix | Delete

esc_html__( 'Error', 'wpforms-lite' ),

[322] Fix | Delete

[

[323] Fix | Delete

'response' => 400,

[324] Fix | Delete

]

[325] Fix | Delete

);

[326] Fix | Delete

}

[327] Fix | Delete

[328] Fix | Delete

wp_safe_redirect( add_query_arg( [ 'wpforms_notice' => 'forms-imported' ] ) );

[329] Fix | Delete

exit;

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

/**

[333] Fix | Delete

* Import forms from file.

[334] Fix | Delete

* Should be static for external use.

[335] Fix | Delete

*

[336] Fix | Delete

* @since 1.8.6

[337] Fix | Delete

*

[338] Fix | Delete

* @param string $filename File containing forms to be imported.

[339] Fix | Delete

*

[340] Fix | Delete

* @return null|WP_Error

[341] Fix | Delete

*/

[342] Fix | Delete

public static function import_forms( string $filename ) {

[343] Fix | Delete

[344] Fix | Delete

if ( ! current_user_can( 'unfiltered_html' ) ) {

[345] Fix | Delete

return new WP_Error( 'no_permission', __( 'The unfiltered HTML permissions are required to import form.', 'wpforms-lite' ) );

[346] Fix | Delete

}

[347] Fix | Delete

[348] Fix | Delete

$forms = json_decode( File::remove_utf8_bom( file_get_contents( $filename ) ), true );

[349] Fix | Delete

[350] Fix | Delete

if ( empty( $forms ) || ! is_array( $forms ) ) {

[351] Fix | Delete

return new WP_Error( 'bad_json', __( 'Please upload a valid .json form export file.', 'wpforms-lite' ) );

[352] Fix | Delete

}

[353] Fix | Delete

[354] Fix | Delete

if ( ! self::save_forms( $forms ) ) {

[355] Fix | Delete

return new WP_Error( 'no_permission', __( 'There was an error saving your form. Please check your file and try again.', 'wpforms-lite' ) );

[356] Fix | Delete

}

[357] Fix | Delete

[358] Fix | Delete

return null;

[359] Fix | Delete

}

[360] Fix | Delete

[361] Fix | Delete

/**

[362] Fix | Delete

* Save forms.

[363] Fix | Delete

*

[364] Fix | Delete

* @since 1.8.6

[365] Fix | Delete

*

[366] Fix | Delete

* @param array $forms Forms.

[367] Fix | Delete

*

[368] Fix | Delete

* @return bool

[369] Fix | Delete

*/

[370] Fix | Delete

private static function save_forms( array $forms ): bool {

[371] Fix | Delete

[372] Fix | Delete

foreach ( $forms as $form ) {

[373] Fix | Delete

$title = ! empty( $form['settings']['form_title'] ) ? $form['settings']['form_title'] : '';

[374] Fix | Delete

$desc = ! empty( $form['settings']['form_desc'] ) ? $form['settings']['form_desc'] : '';

[375] Fix | Delete

$new_id = wp_insert_post(

[376] Fix | Delete

[

[377] Fix | Delete

'post_title' => $title,

[378] Fix | Delete

'post_status' => 'publish',

[379] Fix | Delete

'post_type' => 'wpforms',

[380] Fix | Delete

'post_excerpt' => $desc,

[381] Fix | Delete

]

[382] Fix | Delete

);

[383] Fix | Delete

[384] Fix | Delete

// When we cannot insert one form into the DB, or update it,

[385] Fix | Delete

// we will have a similar issue with the following form in the JSON file.

[386] Fix | Delete

// So, it is better to bail out and inform the user that we cannot proceed.

[387] Fix | Delete

if ( ! $new_id ) {

[388] Fix | Delete

return false;

[389] Fix | Delete

}

[390] Fix | Delete

[391] Fix | Delete

$form['id'] = $new_id;

[392] Fix | Delete

[393] Fix | Delete

if ( ! self::update_form( $form ) ) {

[394] Fix | Delete

return false;

[395] Fix | Delete

}

[396] Fix | Delete

}

[397] Fix | Delete

[398] Fix | Delete

return true;

[399] Fix | Delete

}

[400] Fix | Delete

[401] Fix | Delete

/**

[402] Fix | Delete

* Update form.

[403] Fix | Delete

*

[404] Fix | Delete

* @since 1.8.6

[405] Fix | Delete

*

[406] Fix | Delete

* @param array $form Form.

[407] Fix | Delete

*

[408] Fix | Delete

* @return bool

[409] Fix | Delete

*/

[410] Fix | Delete

private static function update_form( array $form ): bool {

[411] Fix | Delete

[412] Fix | Delete

$result = wp_update_post(

[413] Fix | Delete

[

[414] Fix | Delete

'ID' => $form['id'],

[415] Fix | Delete

'post_content' => wpforms_encode( $form ),

[416] Fix | Delete

]

[417] Fix | Delete

);

[418] Fix | Delete

[419] Fix | Delete

if ( ! $result ) {

[420] Fix | Delete

return false;

[421] Fix | Delete

}

[422] Fix | Delete

[423] Fix | Delete

if ( empty( $form['settings']['form_tags'] ) ) {

[424] Fix | Delete

return true;

[425] Fix | Delete

}

[426] Fix | Delete

[427] Fix | Delete

$result = wp_set_post_terms(

[428] Fix | Delete

$form['id'],

[429] Fix | Delete

implode( ',', (array) $form['settings']['form_tags'] ),

[430] Fix | Delete

WPForms_Form_Handler::TAGS_TAXONOMY

[431] Fix | Delete

);

[432] Fix | Delete

[433] Fix | Delete

if ( ! $result ) {

[434] Fix | Delete

return false;

[435] Fix | Delete

}

[436] Fix | Delete

[437] Fix | Delete

return true;

[438] Fix | Delete

}

[439] Fix | Delete

}

[440] Fix | Delete

[441] Fix | Delete