Completed
Push — update/feedback_menu_name ( bb6cf7...62ffb5 )
by
unknown
65:06 queued 53:35
created

Grunion_Contact_Form_Field   F

Complexity

Total Complexity 95

Size/Duplication

Total Lines 517
Duplicated Lines 3.09 %

Coupling/Cohesion

Components 1
Dependencies 6

Importance

Changes 0
Metric Value
dl 16
loc 517
rs 2
c 0
b 0
f 0
wmc 95
lcom 1
cbo 6

How to fix   Duplicated Code    Complexity   

Duplicated Code

Duplicate code is one of the most pungent code smells. A rule that is often used is to re-structure code once it is duplicated in three or more places.

Common duplication problems, and corresponding solutions are:

Complex Class

 Tip:   Before tackling complexity, make sure that you eliminate any duplication first. This often can reduce the size of classes significantly.

Complex classes like Grunion_Contact_Form_Field often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.

Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.

While breaking up the class, it is a good idea to analyze how other classes use Grunion_Contact_Form_Field, and based on these observations, apply Extract Interface, too.

1
<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2
/**
3
 * Grunion Contact Form
4
 * Add a contact form to any post, page or text widget.
5
 * Emails will be sent to the post's author by default, or any email address you choose.
6
 *
7
 * @package automattic/jetpack
8
 */
9
10
use Automattic\Jetpack\Assets;
11
use Automattic\Jetpack\Blocks;
12
use Automattic\Jetpack\Sync\Settings;
13
14
define( 'GRUNION_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
15
define( 'GRUNION_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
16
17
if ( is_admin() ) {
18
	require_once GRUNION_PLUGIN_DIR . 'admin.php';
19
}
20
21
add_action( 'rest_api_init', 'grunion_contact_form_require_endpoint' );
22
function grunion_contact_form_require_endpoint() {
23
	require_once GRUNION_PLUGIN_DIR . 'class-grunion-contact-form-endpoint.php';
24
}
25
26
/**
27
 * Sets up various actions, filters, post types, post statuses, shortcodes.
28
 */
29
class Grunion_Contact_Form_Plugin {
30
31
	/**
32
	 * @var string The Widget ID of the widget currently being processed.  Used to build the unique contact-form ID for forms embedded in widgets.
33
	 */
34
	public $current_widget_id;
35
36
	static $using_contact_form_field = false;
37
38
	/**
39
	 * @var int The last Feedback Post ID Erased as part of the Personal Data Eraser.
40
	 * Helps with pagination.
41
	 */
42
	private $pde_last_post_id_erased = 0;
43
44
	/**
45
	 * @var string The email address for which we are deleting/exporting all feedbacks
46
	 * as part of a Personal Data Eraser or Personal Data Exporter request.
47
	 */
48
	private $pde_email_address = '';
49
50
	static function init() {
51
		static $instance = false;
52
53
		if ( ! $instance ) {
54
			$instance = new Grunion_Contact_Form_Plugin();
55
56
			// Schedule our daily cleanup
57
			add_action( 'wp_scheduled_delete', array( $instance, 'daily_akismet_meta_cleanup' ) );
58
		}
59
60
		return $instance;
61
	}
62
63
	/**
64
	 * Runs daily to clean up spam detection metadata after 15 days.  Keeps your DB squeaky clean.
65
	 */
66
	public function daily_akismet_meta_cleanup() {
67
		global $wpdb;
68
69
		$feedback_ids = $wpdb->get_col( "SELECT p.ID FROM {$wpdb->posts} as p INNER JOIN {$wpdb->postmeta} as m on m.post_id = p.ID WHERE p.post_type = 'feedback' AND m.meta_key = '_feedback_akismet_values' AND DATE_SUB(NOW(), INTERVAL 15 DAY) > p.post_date_gmt LIMIT 10000" );
70
71
		if ( empty( $feedback_ids ) ) {
72
			return;
73
		}
74
75
		/**
76
		 * Fires right before deleting the _feedback_akismet_values post meta on $feedback_ids
77
		 *
78
		 * @module contact-form
79
		 *
80
		 * @since 6.1.0
81
		 *
82
		 * @param array $feedback_ids list of feedback post ID
83
		 */
84
		do_action( 'jetpack_daily_akismet_meta_cleanup_before', $feedback_ids );
85
		foreach ( $feedback_ids as $feedback_id ) {
86
			delete_post_meta( $feedback_id, '_feedback_akismet_values' );
87
		}
88
89
		/**
90
		 * Fires right after deleting the _feedback_akismet_values post meta on $feedback_ids
91
		 *
92
		 * @module contact-form
93
		 *
94
		 * @since 6.1.0
95
		 *
96
		 * @param array $feedback_ids list of feedback post ID
97
		 */
98
		do_action( 'jetpack_daily_akismet_meta_cleanup_after', $feedback_ids );
99
	}
100
101
	/**
102
	 * Strips HTML tags from input.  Output is NOT HTML safe.
103
	 *
104
	 * @param mixed $data_with_tags
105
	 * @return mixed
106
	 */
107
	public static function strip_tags( $data_with_tags ) {
108
		if ( is_array( $data_with_tags ) ) {
109
			foreach ( $data_with_tags as $index => $value ) {
110
				$index = sanitize_text_field( (string) $index );
111
				$value = wp_kses( (string) $value, array() );
112
				$value = str_replace( '&amp;', '&', $value ); // undo damage done by wp_kses_normalize_entities()
113
114
				$data_without_tags[ $index ] = $value;
115
			}
116
		} else {
117
			$data_without_tags = wp_kses( $data_with_tags, array() );
118
			$data_without_tags = str_replace( '&amp;', '&', $data_without_tags ); // undo damage done by wp_kses_normalize_entities()
119
		}
120
121
		return $data_without_tags;
122
	}
123
124
	/**
125
	 * Class uses singleton pattern; use Grunion_Contact_Form_Plugin::init() to initialize.
126
	 */
127
	protected function __construct() {
128
		$this->add_shortcode();
129
130
		// While generating the output of a text widget with a contact-form shortcode, we need to know its widget ID.
131
		add_action( 'dynamic_sidebar', array( $this, 'track_current_widget' ) );
132
133
		// Add a "widget" shortcode attribute to all contact-form shortcodes embedded in widgets
134
		add_filter( 'widget_text', array( $this, 'widget_atts' ), 0 );
135
136
		// If Text Widgets don't get shortcode processed, hack ours into place.
137
		if (
138
			version_compare( get_bloginfo( 'version' ), '4.9-z', '<=' )
139
			&& ! has_filter( 'widget_text', 'do_shortcode' )
140
		) {
141
			add_filter( 'widget_text', array( $this, 'widget_shortcode_hack' ), 5 );
142
		}
143
144
		add_filter( 'jetpack_contact_form_is_spam', array( $this, 'is_spam_blocklist' ), 10, 2 );
145
		add_filter( 'jetpack_contact_form_in_comment_disallowed_list', array( $this, 'is_in_disallowed_list' ), 10, 2 );
146
		// Akismet to the rescue
147
		if ( defined( 'AKISMET_VERSION' ) || function_exists( 'akismet_http_post' ) ) {
148
			add_filter( 'jetpack_contact_form_is_spam', array( $this, 'is_spam_akismet' ), 10, 2 );
149
			add_action( 'contact_form_akismet', array( $this, 'akismet_submit' ), 10, 2 );
150
		}
151
152
		add_action( 'loop_start', array( 'Grunion_Contact_Form', '_style_on' ) );
153
		add_action( 'pre_amp_render_post', array( 'Grunion_Contact_Form', '_style_on' ) );
154
155
		add_action( 'wp_ajax_grunion-contact-form', array( $this, 'ajax_request' ) );
156
		add_action( 'wp_ajax_nopriv_grunion-contact-form', array( $this, 'ajax_request' ) );
157
158
		// GDPR: personal data exporter & eraser.
159
		add_filter( 'wp_privacy_personal_data_exporters', array( $this, 'register_personal_data_exporter' ) );
160
		add_filter( 'wp_privacy_personal_data_erasers', array( $this, 'register_personal_data_eraser' ) );
161
162
		// Export to CSV feature
163
		if ( is_admin() ) {
164
			add_action( 'admin_init', array( $this, 'download_feedback_as_csv' ) );
165
			add_action( 'admin_footer-edit.php', array( $this, 'export_form' ) );
166
			add_action( 'admin_menu', array( $this, 'admin_menu' ) );
167
			add_action( 'current_screen', array( $this, 'unread_count' ) );
168
		}
169
170
		// custom post type we'll use to keep copies of the feedback items
171
		$slug = 'edit.php?post_type=feedback';
172
		register_post_type(
173
			'feedback', array(
174
				'labels'                => array(
175
					'name'               => __( 'Form Responses', 'jetpack' ),
176
					'singular_name'      => __( 'Form Responses', 'jetpack' ),
177
					'search_items'       => __( 'Search Responses', 'jetpack' ),
178
					'not_found'          => __( 'No responses found', 'jetpack' ),
179
					'not_found_in_trash' => __( 'No responses found', 'jetpack' ),
180
				),
181
				'menu_icon'             => 'dashicons-feedback',
182
				'show_ui'               => true,
183
				'show_in_menu'          => $slug,
184
				'show_in_admin_bar'     => false,
185
				'public'                => false,
186
				'rewrite'               => false,
187
				'query_var'             => false,
188
				'capability_type'       => 'page',
189
				'show_in_rest'          => true,
190
				'rest_controller_class' => 'Grunion_Contact_Form_Endpoint',
191
				'capabilities'          => array(
192
					'create_posts'        => 'do_not_allow',
193
					'publish_posts'       => 'publish_pages',
194
					'edit_posts'          => 'edit_pages',
195
					'edit_others_posts'   => 'edit_others_pages',
196
					'delete_posts'        => 'delete_pages',
197
					'delete_others_posts' => 'delete_others_pages',
198
					'read_private_posts'  => 'read_private_pages',
199
					'edit_post'           => 'edit_page',
200
					'delete_post'         => 'delete_page',
201
					'read_post'           => 'read_page',
202
				),
203
				'map_meta_cap'          => true,
204
			)
205
		);
206
207
		add_menu_page(
208
			__( 'Feedback', 'jetpack' ),
209
			__( 'Feedback', 'jetpack' ),
210
			'edit_pages',
211
			$slug,
212
			null,
213
			'dashicons-feedback',
214
			45
215
		);
216
		add_action( 'admin_menu', array( $this, 'rename_feedback_menu' ) );
217
218
		// Add to REST API post type allowed list.
219
		add_filter( 'rest_api_allowed_post_types', array( $this, 'allow_feedback_rest_api_type' ) );
220
221
		// Add "spam" as a post status
222
		register_post_status(
223
			'spam', array(
224
				'label'                  => 'Spam',
225
				'public'                 => false,
226
				'exclude_from_search'    => true,
227
				'show_in_admin_all_list' => false,
228
				'label_count'            => _n_noop( 'Spam <span class="count">(%s)</span>', 'Spam <span class="count">(%s)</span>', 'jetpack' ),
229
				'protected'              => true,
230
				'_builtin'               => false,
231
			)
232
		);
233
234
		// POST handler
235
		if (
236
			isset( $_SERVER['REQUEST_METHOD'] ) && 'POST' == strtoupper( $_SERVER['REQUEST_METHOD'] )
237
			&&
238
			isset( $_POST['action'] ) && 'grunion-contact-form' == $_POST['action']
239
			&&
240
			isset( $_POST['contact-form-id'] )
241
		) {
242
			add_action( 'template_redirect', array( $this, 'process_form_submission' ) );
243
		}
244
245
		/*
246
		 Can be dequeued by placing the following in wp-content/themes/yourtheme/functions.php
247
		 *
248
		 * 	function remove_grunion_style() {
249
		 *		wp_deregister_style('grunion.css');
250
		 *	}
251
		 *	add_action('wp_print_styles', 'remove_grunion_style');
252
		 */
253
		wp_register_style( 'grunion.css', GRUNION_PLUGIN_URL . 'css/grunion.css', array(), JETPACK__VERSION );
254
		wp_style_add_data( 'grunion.css', 'rtl', 'replace' );
255
256
		self::register_contact_form_blocks();
257
	}
258
259
	public function rename_feedback_menu() {
260
		$slug = 'edit.php?post_type=feedback';
261
		remove_submenu_page(
262
			$slug,
263
			$slug,
264
		);
0 ignored issues
show
Bug introduced by
This code did not parse for me. Apparently, there is an error somewhere around this line:

Syntax error, unexpected ')'
Loading history...
265
		add_submenu_page(
266
			$slug,
267
			__( 'Form Responses', 'jetpack' ),
268
			__( 'Form Responses', 'jetpack' ),
269
			'edit_pages',
270
			$slug,
271
			null
272
		);
273
	}
274
275
	private static function register_contact_form_blocks() {
276
		Blocks::jetpack_register_block(
277
			'jetpack/contact-form',
278
			array(
279
				'render_callback' => array( __CLASS__, 'gutenblock_render_form' ),
280
			)
281
		);
282
283
		// Field render methods.
284
		Blocks::jetpack_register_block(
285
			'jetpack/field-text',
286
			array(
287
				'parent'          => array( 'jetpack/contact-form' ),
288
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_text' ),
289
			)
290
		);
291
		Blocks::jetpack_register_block(
292
			'jetpack/field-name',
293
			array(
294
				'parent'          => array( 'jetpack/contact-form' ),
295
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_name' ),
296
			)
297
		);
298
		Blocks::jetpack_register_block(
299
			'jetpack/field-email',
300
			array(
301
				'parent'          => array( 'jetpack/contact-form' ),
302
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_email' ),
303
			)
304
		);
305
		Blocks::jetpack_register_block(
306
			'jetpack/field-url',
307
			array(
308
				'parent'          => array( 'jetpack/contact-form' ),
309
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_url' ),
310
			)
311
		);
312
		Blocks::jetpack_register_block(
313
			'jetpack/field-date',
314
			array(
315
				'parent'          => array( 'jetpack/contact-form' ),
316
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_date' ),
317
			)
318
		);
319
		Blocks::jetpack_register_block(
320
			'jetpack/field-telephone',
321
			array(
322
				'parent'          => array( 'jetpack/contact-form' ),
323
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_telephone' ),
324
			)
325
		);
326
		Blocks::jetpack_register_block(
327
			'jetpack/field-textarea',
328
			array(
329
				'parent'          => array( 'jetpack/contact-form' ),
330
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_textarea' ),
331
			)
332
		);
333
		Blocks::jetpack_register_block(
334
			'jetpack/field-checkbox',
335
			array(
336
				'parent'          => array( 'jetpack/contact-form' ),
337
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_checkbox' ),
338
			)
339
		);
340
		Blocks::jetpack_register_block(
341
			'jetpack/field-checkbox-multiple',
342
			array(
343
				'parent'          => array( 'jetpack/contact-form' ),
344
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_checkbox_multiple' ),
345
			)
346
		);
347
		Blocks::jetpack_register_block(
348
			'jetpack/field-radio',
349
			array(
350
				'parent'          => array( 'jetpack/contact-form' ),
351
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_radio' ),
352
			)
353
		);
354
		Blocks::jetpack_register_block(
355
			'jetpack/field-select',
356
			array(
357
				'parent'          => array( 'jetpack/contact-form' ),
358
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_select' ),
359
			)
360
		);
361
		Blocks::jetpack_register_block(
362
			'jetpack/field-consent',
363
			array(
364
				'parent'          => array( 'jetpack/contact-form' ),
365
				'render_callback' => array( __CLASS__, 'gutenblock_render_field_consent' ),
366
			)
367
		);
368
	}
369
370
	public static function gutenblock_render_form( $atts, $content ) {
371
372
		// Render fallback in other contexts than frontend (i.e. feed, emails, API, etc.), unless the form is being submitted.
373
		if ( ! jetpack_is_frontend() && ! isset( $_POST['contact-form-id'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
374
			return sprintf(
375
				'<div class="%1$s"><a href="%2$s" target="_blank" rel="noopener noreferrer">%3$s</a></div>',
376
				esc_attr( Blocks::classes( 'contact-form', $atts ) ),
377
				esc_url( get_the_permalink() ),
378
				esc_html__( 'Submit a form.', 'jetpack' )
379
			);
380
		}
381
382
		return Grunion_Contact_Form::parse( $atts, do_blocks( $content ) );
383
	}
384
385
	public static function block_attributes_to_shortcode_attributes( $atts, $type ) {
386
		$atts['type'] = $type;
387
		if ( isset( $atts['className'] ) ) {
388
			$atts['class'] = $atts['className'];
389
			unset( $atts['className'] );
390
		}
391
392
		if ( isset( $atts['defaultValue'] ) ) {
393
			$atts['default'] = $atts['defaultValue'];
394
			unset( $atts['defaultValue'] );
395
		}
396
397
		return $atts;
398
	}
399
400
	public static function gutenblock_render_field_text( $atts, $content ) {
401
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'text' );
402
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
403
	}
404
	public static function gutenblock_render_field_name( $atts, $content ) {
405
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'name' );
406
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
407
	}
408
	public static function gutenblock_render_field_email( $atts, $content ) {
409
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'email' );
410
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
411
	}
412
	public static function gutenblock_render_field_url( $atts, $content ) {
413
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'url' );
414
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
415
	}
416
	public static function gutenblock_render_field_date( $atts, $content ) {
417
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'date' );
418
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
419
	}
420
	public static function gutenblock_render_field_telephone( $atts, $content ) {
421
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'telephone' );
422
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
423
	}
424
	public static function gutenblock_render_field_textarea( $atts, $content ) {
425
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'textarea' );
426
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
427
	}
428
	public static function gutenblock_render_field_checkbox( $atts, $content ) {
429
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'checkbox' );
430
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
431
	}
432
	public static function gutenblock_render_field_checkbox_multiple( $atts, $content ) {
433
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'checkbox-multiple' );
434
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
435
	}
436
	public static function gutenblock_render_field_radio( $atts, $content ) {
437
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'radio' );
438
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
439
	}
440
	public static function gutenblock_render_field_select( $atts, $content ) {
441
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'select' );
442
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
443
	}
444
445
	/**
446
	 * Render the consent field.
447
	 *
448
	 * @param string $atts consent attributes.
449
	 * @param string $content html content.
450
	 */
451
	public static function gutenblock_render_field_consent( $atts, $content ) {
452
		$atts = self::block_attributes_to_shortcode_attributes( $atts, 'consent' );
453
454
		if ( ! isset( $atts['implicitConsentMessage'] ) ) {
455
			$atts['implicitConsentMessage'] = __( "By submitting your information, you're giving us permission to email you. You may unsubscribe at any time.", 'jetpack' );
456
		}
457
458
		if ( ! isset( $atts['explicitConsentMessage'] ) ) {
459
			$atts['explicitConsentMessage'] = __( 'Can we send you an email from time to time?', 'jetpack' );
460
		}
461
462
		return Grunion_Contact_Form::parse_contact_field( $atts, $content );
463
	}
464
465
	/**
466
	 * Add the 'Export' menu item as a submenu of Feedback.
467
	 */
468
	public function admin_menu() {
469
		add_submenu_page(
470
			'edit.php?post_type=feedback',
471
			__( 'Export feedback as CSV', 'jetpack' ),
472
			__( 'Export CSV', 'jetpack' ),
473
			'export',
474
			'feedback-export',
475
			array( $this, 'export_form' )
476
		);
477
	}
478
479
	/**
480
	 * Add to REST API post type allowed list.
481
	 */
482
	function allow_feedback_rest_api_type( $post_types ) {
483
		$post_types[] = 'feedback';
484
		return $post_types;
485
	}
486
487
	/**
488
	 * Display the count of new feedback entries received. It's reset when user visits the Feedback screen.
489
	 *
490
	 * @since 4.1.0
491
	 *
492
	 * @param object $screen Information about the current screen.
493
	 */
494
	function unread_count( $screen ) {
495
		if ( isset( $screen->post_type ) && 'feedback' == $screen->post_type ) {
496
			update_option( 'feedback_unread_count', 0 );
497
		} else {
498
			global $menu;
499
			if ( isset( $menu ) && is_array( $menu ) && ! empty( $menu ) ) {
500
				foreach ( $menu as $index => $menu_item ) {
501
					if ( 'edit.php?post_type=feedback' == $menu_item[2] ) {
502
						$unread = get_option( 'feedback_unread_count', 0 );
503
						if ( $unread > 0 ) {
504
							$unread_count       = current_user_can( 'publish_pages' ) ? " <span class='feedback-unread count-{$unread} awaiting-mod'><span class='feedback-unread-count'>" . number_format_i18n( $unread ) . '</span></span>' : '';
505
							$menu[ $index ][0] .= $unread_count;
506
						}
507
						break;
508
					}
509
				}
510
			}
511
		}
512
	}
513
514
	/**
515
	 * Handles all contact-form POST submissions
516
	 *
517
	 * Conditionally attached to `template_redirect`
518
	 */
519
	function process_form_submission() {
520
		// Add a filter to replace tokens in the subject field with sanitized field values
521
		add_filter( 'contact_form_subject', array( $this, 'replace_tokens_with_input' ), 10, 2 );
522
523
		$id   = stripslashes( $_POST['contact-form-id'] );
524
		$hash = isset( $_POST['contact-form-hash'] ) ? $_POST['contact-form-hash'] : '';
525
		$hash = preg_replace( '/[^\da-f]/i', '', $hash );
526
527
		if ( ! is_string( $id ) || ! is_string( $hash ) ) {
528
			return false;
529
		}
530
531
		if ( is_user_logged_in() ) {
532
			check_admin_referer( "contact-form_{$id}" );
533
		}
534
535
		$is_widget = 0 === strpos( $id, 'widget-' );
536
537
		$form = false;
538
539
		if ( $is_widget ) {
540
			// It's a form embedded in a text widget
541
			$this->current_widget_id = substr( $id, 7 ); // remove "widget-"
542
			$widget_type             = implode( '-', array_slice( explode( '-', $this->current_widget_id ), 0, -1 ) ); // Remove trailing -#
543
544
			// Is the widget active?
545
			$sidebar = is_active_widget( false, $this->current_widget_id, $widget_type );
546
547
			// This is lame - no core API for getting a widget by ID
548
			$widget = isset( $GLOBALS['wp_registered_widgets'][ $this->current_widget_id ] ) ? $GLOBALS['wp_registered_widgets'][ $this->current_widget_id ] : false;
549
550
			if ( $sidebar && $widget && isset( $widget['callback'] ) ) {
551
				// prevent PHP notices by populating widget args
552
				$widget_args = array(
553
					'before_widget' => '',
554
					'after_widget'  => '',
555
					'before_title'  => '',
556
					'after_title'   => '',
557
				);
558
				// This is lamer - no API for outputting a given widget by ID
559
				ob_start();
560
				// Process the widget to populate Grunion_Contact_Form::$last
561
				call_user_func( $widget['callback'], $widget_args, $widget['params'][0] );
562
				ob_end_clean();
563
			}
564
		} else {
565
			// It's a form embedded in a post
566
			$post = get_post( $id );
567
568
			// Process the content to populate Grunion_Contact_Form::$last
569
			if ( $post ) {
570
				/** This filter is already documented in core. wp-includes/post-template.php */
571
				apply_filters( 'the_content', $post->post_content );
572
			}
573
		}
574
575
		$form = isset( Grunion_Contact_Form::$forms[ $hash ] ) ? Grunion_Contact_Form::$forms[ $hash ] : null;
576
577
		// No form may mean user is using do_shortcode, grab the form using the stored post meta
578
		if ( ! $form && is_numeric( $id ) && $hash ) {
579
580
			// Get shortcode from post meta
581
			$shortcode = get_post_meta( $id, "_g_feedback_shortcode_{$hash}", true );
582
583
			// Format it
584
			if ( $shortcode != '' ) {
585
586
				// Get attributes from post meta.
587
				$parameters = '';
588
				$attributes = get_post_meta( $id, "_g_feedback_shortcode_atts_{$hash}", true );
589
				if ( ! empty( $attributes ) && is_array( $attributes ) ) {
590
					foreach ( array_filter( $attributes ) as $param => $value ) {
591
						$parameters .= " $param=\"$value\"";
592
					}
593
				}
594
595
				$shortcode = '[contact-form' . $parameters . ']' . $shortcode . '[/contact-form]';
596
				do_shortcode( $shortcode );
597
598
				// Recreate form
599
				$form = Grunion_Contact_Form::$last;
600
			}
601
		}
602
603
		if ( ! $form ) {
604
			return false;
605
		}
606
607
		if ( is_wp_error( $form->errors ) && $form->errors->get_error_codes() ) {
608
			return $form->errors;
609
		}
610
611
		// Process the form
612
		return $form->process_submission();
613
	}
614
615
	function ajax_request() {
616
		$submission_result = self::process_form_submission();
617
618
		if ( ! $submission_result ) {
619
			header( 'HTTP/1.1 500 Server Error', 500, true );
620
			echo '<div class="form-error"><ul class="form-errors"><li class="form-error-message">';
621
			esc_html_e( 'An error occurred. Please try again later.', 'jetpack' );
622
			echo '</li></ul></div>';
623
		} elseif ( is_wp_error( $submission_result ) ) {
624
			header( 'HTTP/1.1 400 Bad Request', 403, true );
625
			echo '<div class="form-error"><ul class="form-errors"><li class="form-error-message">';
626
			echo esc_html( $submission_result->get_error_message() );
627
			echo '</li></ul></div>';
628
		} else {
629
			echo '<h3>' . esc_html__( 'Message Sent', 'jetpack' ) . '</h3>' . $submission_result;
630
		}
631
632
		die;
633
	}
634
635
	/**
636
	 * Ensure the post author is always zero for contact-form feedbacks
637
	 * Attached to `wp_insert_post_data`
638
	 *
639
	 * @see Grunion_Contact_Form::process_submission()
640
	 *
641
	 * @param array $data the data to insert
642
	 * @param array $postarr the data sent to wp_insert_post()
643
	 * @return array The filtered $data to insert
644
	 */
645
	function insert_feedback_filter( $data, $postarr ) {
646
		if ( $data['post_type'] == 'feedback' && $postarr['post_type'] == 'feedback' ) {
647
			$data['post_author'] = 0;
648
		}
649
650
		return $data;
651
	}
652
	/*
653
	 * Adds our contact-form shortcode
654
	 * The "child" contact-field shortcode is enabled as needed by the contact-form shortcode handler
655
	 */
656
	function add_shortcode() {
657
		add_shortcode( 'contact-form', array( 'Grunion_Contact_Form', 'parse' ) );
658
		add_shortcode( 'contact-field', array( 'Grunion_Contact_Form', 'parse_contact_field' ) );
659
	}
660
661
	static function tokenize_label( $label ) {
662
		return '{' . trim( preg_replace( '#^\d+_#', '', $label ) ) . '}';
663
	}
664
665
	static function sanitize_value( $value ) {
666
		return preg_replace( '=((<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*=i', null, $value );
667
	}
668
669
	/**
670
	 * Replaces tokens like {city} or {City} (case insensitive) with the value
671
	 * of an input field of that name
672
	 *
673
	 * @param string $subject
674
	 * @param array  $field_values Array with field label => field value associations
675
	 *
676
	 * @return string The filtered $subject with the tokens replaced
677
	 */
678
	function replace_tokens_with_input( $subject, $field_values ) {
679
		// Wrap labels into tokens (inside {})
680
		$wrapped_labels = array_map( array( 'Grunion_Contact_Form_Plugin', 'tokenize_label' ), array_keys( $field_values ) );
681
		// Sanitize all values
682
		$sanitized_values = array_map( array( 'Grunion_Contact_Form_Plugin', 'sanitize_value' ), array_values( $field_values ) );
683
684
		foreach ( $sanitized_values as $k => $sanitized_value ) {
685
			if ( is_array( $sanitized_value ) ) {
686
				$sanitized_values[ $k ] = implode( ', ', $sanitized_value );
687
			}
688
		}
689
690
		// Search for all valid tokens (based on existing fields) and replace with the field's value
691
		$subject = str_ireplace( $wrapped_labels, $sanitized_values, $subject );
692
		return $subject;
693
	}
694
695
	/**
696
	 * Tracks the widget currently being processed.
697
	 * Attached to `dynamic_sidebar`
698
	 *
699
	 * @see $current_widget_id
700
	 *
701
	 * @param array $widget The widget data
702
	 */
703
	function track_current_widget( $widget ) {
704
		$this->current_widget_id = $widget['id'];
705
	}
706
707
	/**
708
	 * Adds a "widget" attribute to every contact-form embedded in a text widget.
709
	 * Used to tell the difference between post-embedded contact-forms and widget-embedded contact-forms
710
	 * Attached to `widget_text`
711
	 *
712
	 * @param string $text The widget text
713
	 * @return string The filtered widget text
714
	 */
715
	function widget_atts( $text ) {
716
		Grunion_Contact_Form::style( true );
717
718
		return preg_replace( '/\[contact-form([^a-zA-Z_-])/', '[contact-form widget="' . $this->current_widget_id . '"\\1', $text );
719
	}
720
721
	/**
722
	 * For sites where text widgets are not processed for shortcodes, we add this hack to process just our shortcode
723
	 * Attached to `widget_text`
724
	 *
725
	 * @param string $text The widget text
726
	 * @return string The contact-form filtered widget text
727
	 */
728
	function widget_shortcode_hack( $text ) {
729
		if ( ! preg_match( '/\[contact-form([^a-zA-Z_-])/', $text ) ) {
730
			return $text;
731
		}
732
733
		$old = $GLOBALS['shortcode_tags'];
734
		remove_all_shortcodes();
735
		Grunion_Contact_Form_Plugin::$using_contact_form_field = true;
736
		$this->add_shortcode();
737
738
		$text = do_shortcode( $text );
739
740
		Grunion_Contact_Form_Plugin::$using_contact_form_field = false;
741
		$GLOBALS['shortcode_tags']                             = $old;
742
743
		return $text;
744
	}
745
746
	/**
747
	 * Check if a submission matches the Comment Blocklist.
748
	 * The Comment Blocklist is a means to moderate discussion, and contact
749
	 * forms are 1:1 discussion forums, ripe for abuse by users who are being
750
	 * removed from the public discussion.
751
	 * Attached to `jetpack_contact_form_is_spam`
752
	 *
753
	 * @param bool  $is_spam
754
	 * @param array $form
755
	 * @return bool TRUE => spam, FALSE => not spam
756
	 */
757
	public function is_spam_blocklist( $is_spam, $form = array() ) {
758
		if ( $is_spam ) {
759
			return $is_spam;
760
		}
761
762
		return $this->is_in_disallowed_list( false, $form );
763
	}
764
765
	/**
766
	 * Check if a submission matches the comment disallowed list.
767
	 * Attached to `jetpack_contact_form_in_comment_disallowed_list`.
768
	 *
769
	 * @param boolean $in_disallowed_list Whether the feedback is in the disallowed list.
770
	 * @param array   $form The form array.
771
	 * @return bool Returns true if the form submission matches the disallowed list and false if it doesn't.
772
	 */
773
	public function is_in_disallowed_list( $in_disallowed_list, $form = array() ) {
774
		if ( $in_disallowed_list ) {
775
			return $in_disallowed_list;
776
		}
777
778
		if (
779
			wp_check_comment_disallowed_list(
780
				$form['comment_author'],
781
				$form['comment_author_email'],
782
				$form['comment_author_url'],
783
				$form['comment_content'],
784
				$form['user_ip'],
785
				$form['user_agent']
786
			)
787
		) {
788
			return true;
789
		}
790
791
		return false;
792
	}
793
794
	/**
795
	 * Populate an array with all values necessary to submit a NEW contact-form feedback to Akismet.
796
	 * Note that this includes the current user_ip etc, so this should only be called when accepting a new item via $_POST
797
	 *
798
	 * @param array $form Contact form feedback array
799
	 * @return array feedback array with additional data ready for submission to Akismet
800
	 */
801
	function prepare_for_akismet( $form ) {
802
		$form['comment_type'] = 'contact_form';
803
		$form['user_ip']      = $_SERVER['REMOTE_ADDR'];
804
		$form['user_agent']   = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : '';
805
		$form['referrer']     = isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : '';
806
		$form['blog']         = get_option( 'home' );
807
808
		foreach ( $_SERVER as $key => $value ) {
809
			if ( ! is_string( $value ) ) {
810
				continue;
811
			}
812
			if ( in_array( $key, array( 'HTTP_COOKIE', 'HTTP_COOKIE2', 'HTTP_USER_AGENT', 'HTTP_REFERER' ) ) ) {
813
				// We don't care about cookies, and the UA and Referrer were caught above.
814
				continue;
815
			} elseif ( in_array( $key, array( 'REMOTE_ADDR', 'REQUEST_URI', 'DOCUMENT_URI' ) ) ) {
816
				// All three of these are relevant indicators and should be passed along.
817
				$form[ $key ] = $value;
818
			} elseif ( wp_startswith( $key, 'HTTP_' ) ) {
819
				// Any other HTTP header indicators.
820
				// `wp_startswith()` is a wpcom helper function and is included in Jetpack via `functions.compat.php`
821
				$form[ $key ] = $value;
822
			}
823
		}
824
825
		return $form;
826
	}
827
828
	/**
829
	 * Submit contact-form data to Akismet to check for spam.
830
	 * If you're accepting a new item via $_POST, run it Grunion_Contact_Form_Plugin::prepare_for_akismet() first
831
	 * Attached to `jetpack_contact_form_is_spam`
832
	 *
833
	 * @param bool  $is_spam
834
	 * @param array $form
835
	 * @return bool|WP_Error TRUE => spam, FALSE => not spam, WP_Error => stop processing entirely
836
	 */
837
	function is_spam_akismet( $is_spam, $form = array() ) {
838
		global $akismet_api_host, $akismet_api_port;
839
840
		// The signature of this function changed from accepting just $form.
841
		// If something only sends an array, assume it's still using the old
842
		// signature and work around it.
843
		if ( empty( $form ) && is_array( $is_spam ) ) {
844
			$form    = $is_spam;
845
			$is_spam = false;
846
		}
847
848
		// If a previous filter has alrady marked this as spam, trust that and move on.
849
		if ( $is_spam ) {
850
			return $is_spam;
851
		}
852
853
		if ( ! function_exists( 'akismet_http_post' ) && ! defined( 'AKISMET_VERSION' ) ) {
854
			return false;
855
		}
856
857
		$query_string = http_build_query( $form );
858
859
		if ( method_exists( 'Akismet', 'http_post' ) ) {
860
			$response = Akismet::http_post( $query_string, 'comment-check' );
861
		} else {
862
			$response = akismet_http_post( $query_string, $akismet_api_host, '/1.1/comment-check', $akismet_api_port );
863
		}
864
865
		$result = false;
866
867
		if ( isset( $response[0]['x-akismet-pro-tip'] ) && 'discard' === trim( $response[0]['x-akismet-pro-tip'] ) && get_option( 'akismet_strictness' ) === '1' ) {
868
			$result = new WP_Error( 'feedback-discarded', __( 'Feedback discarded.', 'jetpack' ) );
869
		} elseif ( isset( $response[1] ) && 'true' == trim( $response[1] ) ) { // 'true' is spam
870
			$result = true;
871
		}
872
873
		/**
874
		 * Filter the results returned by Akismet for each submitted contact form.
875
		 *
876
		 * @module contact-form
877
		 *
878
		 * @since 1.3.1
879
		 *
880
		 * @param WP_Error|bool $result Is the submitted feedback spam.
881
		 * @param array|bool $form Submitted feedback.
882
		 */
883
		return apply_filters( 'contact_form_is_spam_akismet', $result, $form );
884
	}
885
886
	/**
887
	 * Submit a feedback as either spam or ham
888
	 *
889
	 * @param string $as Either 'spam' or 'ham'.
890
	 * @param array  $form the contact-form data
891
	 */
892
	function akismet_submit( $as, $form ) {
893
		global $akismet_api_host, $akismet_api_port;
894
895
		if ( ! in_array( $as, array( 'ham', 'spam' ) ) ) {
896
			return false;
897
		}
898
899
		$query_string = '';
900
		if ( is_array( $form ) ) {
901
			$query_string = http_build_query( $form );
902
		}
903
		if ( method_exists( 'Akismet', 'http_post' ) ) {
904
			$response = Akismet::http_post( $query_string, "submit-{$as}" );
905
		} else {
906
			$response = akismet_http_post( $query_string, $akismet_api_host, "/1.1/submit-{$as}", $akismet_api_port );
907
		}
908
909
		return trim( $response[1] );
910
	}
911
912
	/**
913
	 * Prints the menu
914
	 */
915
	function export_form() {
916
		$current_screen = get_current_screen();
917
		if ( ! in_array( $current_screen->id, array( 'edit-feedback', 'feedback_page_feedback-export' ) ) ) {
918
			return;
919
		}
920
921
		if ( ! current_user_can( 'export' ) ) {
922
			return;
923
		}
924
925
		// if there aren't any feedbacks, bail out
926
		if ( ! (int) wp_count_posts( 'feedback' )->publish ) {
927
			return;
928
		}
929
		?>
930
931
		<div id="feedback-export" style="display:none">
932
			<h2><?php _e( 'Export feedback as CSV', 'jetpack' ); ?></h2>
933
			<div class="clear"></div>
934
			<form action="<?php echo admin_url( 'admin-post.php' ); ?>" method="post" class="form">
935
				<?php wp_nonce_field( 'feedback_export', 'feedback_export_nonce' ); ?>
936
937
				<input name="action" value="feedback_export" type="hidden">
938
				<label for="post"><?php _e( 'Select feedback to download', 'jetpack' ); ?></label>
939
				<select name="post">
940
					<option value="all"><?php esc_html_e( 'All posts', 'jetpack' ); ?></option>
941
					<?php echo $this->get_feedbacks_as_options(); ?>
942
				</select>
943
944
				<br><br>
945
				<input type="submit" name="submit" id="submit" class="button button-primary" value="<?php esc_html_e( 'Download', 'jetpack' ); ?>">
946
			</form>
947
		</div>
948
949
		<?php
950
		// There aren't any usable actions in core to output the "export feedback" form in the correct place,
951
		// so this inline JS moves it from the top of the page to the bottom.
952
		?>
953
		<script type='text/javascript'>
954
		    var menu = document.getElementById( 'feedback-export' ),
955
                wrapper = document.getElementsByClassName( 'wrap' )[0];
956
            <?php if ( 'edit-feedback' === $current_screen->id ) : ?>
957
            wrapper.appendChild(menu);
958
            <?php endif; ?>
959
            menu.style.display = 'block';
960
		</script>
961
		<?php
962
	}
963
964
	/**
965
	 * Fetch post content for a post and extract just the comment.
966
	 *
967
	 * @param int $post_id The post id to fetch the content for.
968
	 *
969
	 * @return string Trimmed post comment.
970
	 *
971
	 * @codeCoverageIgnore
972
	 */
973
	public function get_post_content_for_csv_export( $post_id ) {
974
		$post_content = get_post_field( 'post_content', $post_id );
975
		$content      = explode( '<!--more-->', $post_content );
976
977
		return trim( $content[0] );
978
	}
979
980
	/**
981
	 * Get `_feedback_extra_fields` field from post meta data.
982
	 *
983
	 * @param int $post_id Id of the post to fetch meta data for.
984
	 *
985
	 * @return mixed
986
	 */
987
	public function get_post_meta_for_csv_export( $post_id ) {
988
		$md                  = get_post_meta( $post_id, '_feedback_extra_fields', true );
989
		$md['feedback_date'] = get_the_date( DATE_RFC3339, $post_id );
990
		$content_fields      = self::parse_fields_from_content( $post_id );
991
		$md['feedback_ip']   = ( isset( $content_fields['_feedback_ip'] ) ) ? $content_fields['_feedback_ip'] : 0;
992
993
		// add the email_marketing_consent to the post meta.
994
		$md['email_marketing_consent'] = 0;
995
		if ( isset( $content_fields['_feedback_all_fields'] ) ) {
996
			$all_fields = $content_fields['_feedback_all_fields'];
997
			// check if the email_marketing_consent field exists.
998
			if ( isset( $all_fields['email_marketing_consent'] ) ) {
999
				$md['email_marketing_consent'] = $all_fields['email_marketing_consent'];
1000
			}
1001
		}
1002
1003
		return $md;
1004
	}
1005
1006
	/**
1007
	 * Get parsed feedback post fields.
1008
	 *
1009
	 * @param int $post_id Id of the post to fetch parsed contents for.
1010
	 *
1011
	 * @return array
1012
	 *
1013
	 * @codeCoverageIgnore - No need to be covered.
1014
	 */
1015
	public function get_parsed_field_contents_of_post( $post_id ) {
1016
		return self::parse_fields_from_content( $post_id );
1017
	}
1018
1019
	/**
1020
	 * Properly maps fields that are missing from the post meta data
1021
	 * to names, that are similar to those of the post meta.
1022
	 *
1023
	 * @param array $parsed_post_content Parsed post content
1024
	 *
1025
	 * @see parse_fields_from_content for how the input data is generated.
1026
	 *
1027
	 * @return array Mapped fields.
1028
	 */
1029
	public function map_parsed_field_contents_of_post_to_field_names( $parsed_post_content ) {
1030
1031
		$mapped_fields = array();
1032
1033
		$field_mapping = array(
1034
			'_feedback_subject'      => __( 'Contact Form', 'jetpack' ),
1035
			'_feedback_author'       => '1_Name',
1036
			'_feedback_author_email' => '2_Email',
1037
			'_feedback_author_url'   => '3_Website',
1038
			'_feedback_main_comment' => '4_Comment',
1039
			'_feedback_author_ip'    => '5_IP',
1040
		);
1041
1042
		foreach ( $field_mapping as $parsed_field_name => $field_name ) {
1043
			if (
1044
				isset( $parsed_post_content[ $parsed_field_name ] )
1045
				&& ! empty( $parsed_post_content[ $parsed_field_name ] )
1046
			) {
1047
				$mapped_fields[ $field_name ] = $parsed_post_content[ $parsed_field_name ];
1048
			}
1049
		}
1050
1051
		return $mapped_fields;
1052
	}
1053
1054
	/**
1055
	 * Registers the personal data exporter.
1056
	 *
1057
	 * @since 6.1.1
1058
	 *
1059
	 * @param  array $exporters An array of personal data exporters.
1060
	 *
1061
	 * @return array $exporters An array of personal data exporters.
1062
	 */
1063
	public function register_personal_data_exporter( $exporters ) {
1064
		$exporters['jetpack-feedback'] = array(
1065
			'exporter_friendly_name' => __( 'Feedback', 'jetpack' ),
1066
			'callback'               => array( $this, 'personal_data_exporter' ),
1067
		);
1068
1069
		return $exporters;
1070
	}
1071
1072
	/**
1073
	 * Registers the personal data eraser.
1074
	 *
1075
	 * @since 6.1.1
1076
	 *
1077
	 * @param  array $erasers An array of personal data erasers.
1078
	 *
1079
	 * @return array $erasers An array of personal data erasers.
1080
	 */
1081
	public function register_personal_data_eraser( $erasers ) {
1082
		$erasers['jetpack-feedback'] = array(
1083
			'eraser_friendly_name' => __( 'Feedback', 'jetpack' ),
1084
			'callback'             => array( $this, 'personal_data_eraser' ),
1085
		);
1086
1087
		return $erasers;
1088
	}
1089
1090
	/**
1091
	 * Exports personal data.
1092
	 *
1093
	 * @since 6.1.1
1094
	 *
1095
	 * @param  string $email  Email address.
1096
	 * @param  int    $page   Page to export.
1097
	 *
1098
	 * @return array  $return Associative array with keys expected by core.
1099
	 */
1100
	public function personal_data_exporter( $email, $page = 1 ) {
1101
		return $this->_internal_personal_data_exporter( $email, $page );
1102
	}
1103
1104
	/**
1105
	 * Internal method for exporting personal data.
1106
	 *
1107
	 * Allows us to have a different signature than core expects
1108
	 * while protecting against future core API changes.
1109
	 *
1110
	 * @internal
1111
	 * @since 6.5
1112
	 *
1113
	 * @param  string $email    Email address.
1114
	 * @param  int    $page     Page to export.
1115
	 * @param  int    $per_page Number of feedbacks to process per page. Internal use only (testing)
1116
	 *
1117
	 * @return array            Associative array with keys expected by core.
1118
	 */
1119
	public function _internal_personal_data_exporter( $email, $page = 1, $per_page = 250 ) {
1120
		$export_data = array();
1121
		$post_ids    = $this->personal_data_post_ids_by_email( $email, $per_page, $page );
1122
1123
		foreach ( $post_ids as $post_id ) {
1124
			$post_fields = $this->get_parsed_field_contents_of_post( $post_id );
1125
1126
			if ( ! is_array( $post_fields ) || empty( $post_fields['_feedback_subject'] ) ) {
1127
				continue; // Corrupt data.
1128
			}
1129
1130
			$post_fields['_feedback_main_comment'] = $this->get_post_content_for_csv_export( $post_id );
1131
			$post_fields                           = $this->map_parsed_field_contents_of_post_to_field_names( $post_fields );
1132
1133
			if ( ! is_array( $post_fields ) || empty( $post_fields ) ) {
1134
				continue; // No fields to export.
1135
			}
1136
1137
			$post_meta = $this->get_post_meta_for_csv_export( $post_id );
1138
			$post_meta = is_array( $post_meta ) ? $post_meta : array();
1139
1140
			$post_export_data = array();
1141
			$post_data        = array_merge( $post_fields, $post_meta );
1142
			ksort( $post_data );
1143
1144
			foreach ( $post_data as $post_data_key => $post_data_value ) {
1145
				$post_export_data[] = array(
1146
					'name'  => preg_replace( '/^[0-9]+_/', '', $post_data_key ),
1147
					'value' => $post_data_value,
1148
				);
1149
			}
1150
1151
			$export_data[] = array(
1152
				'group_id'    => 'feedback',
1153
				'group_label' => __( 'Feedback', 'jetpack' ),
1154
				'item_id'     => 'feedback-' . $post_id,
1155
				'data'        => $post_export_data,
1156
			);
1157
		}
1158
1159
		return array(
1160
			'data' => $export_data,
1161
			'done' => count( $post_ids ) < $per_page,
1162
		);
1163
	}
1164
1165
	/**
1166
	 * Erases personal data.
1167
	 *
1168
	 * @since 6.1.1
1169
	 *
1170
	 * @param  string $email Email address.
1171
	 * @param  int    $page  Page to erase.
1172
	 *
1173
	 * @return array         Associative array with keys expected by core.
1174
	 */
1175
	public function personal_data_eraser( $email, $page = 1 ) {
1176
		return $this->_internal_personal_data_eraser( $email, $page );
1177
	}
1178
1179
	/**
1180
	 * Internal method for erasing personal data.
1181
	 *
1182
	 * Allows us to have a different signature than core expects
1183
	 * while protecting against future core API changes.
1184
	 *
1185
	 * @internal
1186
	 * @since 6.5
1187
	 *
1188
	 * @param  string $email    Email address.
1189
	 * @param  int    $page     Page to erase.
1190
	 * @param  int    $per_page Number of feedbacks to process per page. Internal use only (testing)
1191
	 *
1192
	 * @return array            Associative array with keys expected by core.
1193
	 */
1194
	public function _internal_personal_data_eraser( $email, $page = 1, $per_page = 250 ) {
1195
		$removed      = false;
1196
		$retained     = false;
1197
		$messages     = array();
1198
		$option_name  = sprintf( '_jetpack_pde_feedback_%s', md5( $email ) );
1199
		$last_post_id = 1 === $page ? 0 : get_option( $option_name, 0 );
1200
		$post_ids     = $this->personal_data_post_ids_by_email( $email, $per_page, $page, $last_post_id );
1201
1202
		foreach ( $post_ids as $post_id ) {
1203
			/**
1204
			 * Filters whether to erase a particular Feedback post.
1205
			 *
1206
			 * @since 6.3.0
1207
			 *
1208
			 * @param bool|string $prevention_message Whether to apply erase the Feedback post (bool).
1209
			 *                                        Custom prevention message (string). Default true.
1210
			 * @param int         $post_id            Feedback post ID.
1211
			 */
1212
			$prevention_message = apply_filters( 'grunion_contact_form_delete_feedback_post', true, $post_id );
1213
1214
			if ( true !== $prevention_message ) {
1215
				if ( $prevention_message && is_string( $prevention_message ) ) {
1216
					$messages[] = esc_html( $prevention_message );
1217
				} else {
1218
					$messages[] = sprintf(
1219
					// translators: %d: Post ID.
1220
						__( 'Feedback ID %d could not be removed at this time.', 'jetpack' ),
1221
						$post_id
1222
					);
1223
				}
1224
1225
				$retained = true;
1226
1227
				continue;
1228
			}
1229
1230
			if ( wp_delete_post( $post_id, true ) ) {
1231
				$removed = true;
1232
			} else {
1233
				$retained   = true;
1234
				$messages[] = sprintf(
1235
				// translators: %d: Post ID.
1236
					__( 'Feedback ID %d could not be removed at this time.', 'jetpack' ),
1237
					$post_id
1238
				);
1239
			}
1240
		}
1241
1242
		$done = count( $post_ids ) < $per_page;
1243
1244
		if ( $done ) {
1245
			delete_option( $option_name );
1246
		} else {
1247
			update_option( $option_name, (int) $post_id );
1248
		}
1249
1250
		return array(
1251
			'items_removed'  => $removed,
1252
			'items_retained' => $retained,
1253
			'messages'       => $messages,
1254
			'done'           => $done,
1255
		);
1256
	}
1257
1258
	/**
1259
	 * Queries personal data by email address.
1260
	 *
1261
	 * @since 6.1.1
1262
	 *
1263
	 * @param  string $email        Email address.
1264
	 * @param  int    $per_page     Post IDs per page. Default is `250`.
1265
	 * @param  int    $page         Page to query. Default is `1`.
1266
	 * @param  int    $last_post_id Page to query. Default is `0`. If non-zero, used instead of $page.
1267
	 *
1268
	 * @return array An array of post IDs.
1269
	 */
1270
	public function personal_data_post_ids_by_email( $email, $per_page = 250, $page = 1, $last_post_id = 0 ) {
1271
		add_filter( 'posts_search', array( $this, 'personal_data_search_filter' ) );
1272
1273
		$this->pde_last_post_id_erased = $last_post_id;
1274
		$this->pde_email_address       = $email;
1275
1276
		$post_ids = get_posts(
1277
			array(
1278
				'post_type'        => 'feedback',
1279
				'post_status'      => 'publish',
1280
				// This search parameter gets overwritten in ->personal_data_search_filter()
1281
				's'                => '..PDE..AUTHOR EMAIL:..PDE..',
1282
				'sentence'         => true,
1283
				'order'            => 'ASC',
1284
				'orderby'          => 'ID',
1285
				'fields'           => 'ids',
1286
				'posts_per_page'   => $per_page,
1287
				'paged'            => $last_post_id ? 1 : $page,
1288
				'suppress_filters' => false,
1289
			)
1290
		);
1291
1292
		$this->pde_last_post_id_erased = 0;
1293
		$this->pde_email_address       = '';
1294
1295
		remove_filter( 'posts_search', array( $this, 'personal_data_search_filter' ) );
1296
1297
		return $post_ids;
1298
	}
1299
1300
	/**
1301
	 * Filters searches by email address.
1302
	 *
1303
	 * @since 6.1.1
1304
	 *
1305
	 * @param  string $search SQL where clause.
1306
	 *
1307
	 * @return array          Filtered SQL where clause.
1308
	 */
1309
	public function personal_data_search_filter( $search ) {
1310
		global $wpdb;
1311
1312
		/*
1313
		 * Limits search to `post_content` only, and we only match the
1314
		 * author's email address whenever it's on a line by itself.
1315
		 */
1316
		if ( $this->pde_email_address && false !== strpos( $search, '..PDE..AUTHOR EMAIL:..PDE..' ) ) {
1317
			$search = $wpdb->prepare(
1318
				" AND (
1319
					{$wpdb->posts}.post_content LIKE %s
1320
					OR {$wpdb->posts}.post_content LIKE %s
1321
				)",
1322
				// `chr( 10 )` = `\n`, `chr( 13 )` = `\r`
1323
				'%' . $wpdb->esc_like( chr( 10 ) . 'AUTHOR EMAIL: ' . $this->pde_email_address . chr( 10 ) ) . '%',
1324
				'%' . $wpdb->esc_like( chr( 13 ) . 'AUTHOR EMAIL: ' . $this->pde_email_address . chr( 13 ) ) . '%'
1325
			);
1326
1327
			if ( $this->pde_last_post_id_erased ) {
1328
				$search .= $wpdb->prepare( " AND {$wpdb->posts}.ID > %d", $this->pde_last_post_id_erased );
1329
			}
1330
		}
1331
1332
		return $search;
1333
	}
1334
1335
	/**
1336
	 * Prepares feedback post data for CSV export.
1337
	 *
1338
	 * @param array $post_ids Post IDs to fetch the data for. These need to be Feedback posts.
1339
	 *
1340
	 * @return array
1341
	 */
1342
	public function get_export_data_for_posts( $post_ids ) {
1343
1344
		$posts_data  = array();
1345
		$field_names = array();
1346
		$result      = array();
1347
1348
		/**
1349
		 * Fetch posts and get the possible field names for later use
1350
		 */
1351
		foreach ( $post_ids as $post_id ) {
1352
1353
			/**
1354
			 * Fetch post main data, because we need the subject and author data for the feedback form.
1355
			 */
1356
			$post_real_data = $this->get_parsed_field_contents_of_post( $post_id );
1357
1358
			/**
1359
			 * If `$post_real_data` is not an array or there is no `_feedback_subject` set,
1360
			 * then something must be wrong with the feedback post. Skip it.
1361
			 */
1362
			if ( ! is_array( $post_real_data ) || ! isset( $post_real_data['_feedback_subject'] ) ) {
1363
				continue;
1364
			}
1365
1366
			/**
1367
			 * Fetch main post comment. This is from the default textarea fields.
1368
			 * If it is non-empty, then we add it to data, otherwise skip it.
1369
			 */
1370
			$post_comment_content = $this->get_post_content_for_csv_export( $post_id );
1371
			if ( ! empty( $post_comment_content ) ) {
1372
				$post_real_data['_feedback_main_comment'] = $post_comment_content;
1373
			}
1374
1375
			/**
1376
			 * Map parsed fields to proper field names
1377
			 */
1378
			$mapped_fields = $this->map_parsed_field_contents_of_post_to_field_names( $post_real_data );
1379
1380
			/**
1381
			 * Fetch post meta data.
1382
			 */
1383
			$post_meta_data = $this->get_post_meta_for_csv_export( $post_id );
1384
1385
			/**
1386
			 * If `$post_meta_data` is not an array or if it is empty, then there is no
1387
			 * extra feedback to work with. Create an empty array.
1388
			 */
1389
			if ( ! is_array( $post_meta_data ) || empty( $post_meta_data ) ) {
1390
				$post_meta_data = array();
1391
			}
1392
1393
			/**
1394
			 * Prepend the feedback subject to the list of fields.
1395
			 */
1396
			$post_meta_data = array_merge(
1397
				$mapped_fields,
1398
				$post_meta_data
1399
			);
1400
1401
			/**
1402
			 * Save post metadata for later usage.
1403
			 */
1404
			$posts_data[ $post_id ] = $post_meta_data;
1405
1406
			/**
1407
			 * Save field names, so we can use them as header fields later in the CSV.
1408
			 */
1409
			$field_names = array_merge( $field_names, array_keys( $post_meta_data ) );
1410
		}
1411
1412
		/**
1413
		 * Make sure the field names are unique, because we don't want duplicate data.
1414
		 */
1415
		$field_names = array_unique( $field_names );
1416
1417
		/**
1418
		 * Sort the field names by the field id number
1419
		 */
1420
		sort( $field_names, SORT_NUMERIC );
1421
1422
		/**
1423
		 * Loop through every post, which is essentially CSV row.
1424
		 */
1425
		foreach ( $posts_data as $post_id => $single_post_data ) {
1426
1427
			/**
1428
			 * Go through all the possible fields and check if the field is available
1429
			 * in the current post.
1430
			 *
1431
			 * If it is - add the data as a value.
1432
			 * If it is not - add an empty string, which is just a placeholder in the CSV.
1433
			 */
1434
			foreach ( $field_names as $single_field_name ) {
1435
				if (
1436
					isset( $single_post_data[ $single_field_name ] )
1437
					&& ! empty( $single_post_data[ $single_field_name ] )
1438
				) {
1439
					$result[ $single_field_name ][] = trim( $single_post_data[ $single_field_name ] );
1440
				} else {
1441
					$result[ $single_field_name ][] = '';
1442
				}
1443
			}
1444
		}
1445
1446
		return $result;
1447
	}
1448
1449
	/**
1450
	 * download as a csv a contact form or all of them in a csv file
1451
	 */
1452
	function download_feedback_as_csv() {
1453
		if ( empty( $_POST['feedback_export_nonce'] ) ) {
1454
			return;
1455
		}
1456
1457
		check_admin_referer( 'feedback_export', 'feedback_export_nonce' );
1458
1459
		if ( ! current_user_can( 'export' ) ) {
1460
			return;
1461
		}
1462
1463
		$args = array(
1464
			'posts_per_page'   => -1,
1465
			'post_type'        => 'feedback',
1466
			'post_status'      => 'publish',
1467
			'order'            => 'ASC',
1468
			'fields'           => 'ids',
1469
			'suppress_filters' => false,
1470
		);
1471
1472
		$filename = date( 'Y-m-d' ) . '-feedback-export.csv';
1473
1474
		// Check if we want to download all the feedbacks or just a certain contact form
1475
		if ( ! empty( $_POST['post'] ) && $_POST['post'] !== 'all' ) {
1476
			$args['post_parent'] = (int) $_POST['post'];
1477
			$filename            = date( 'Y-m-d' ) . '-' . str_replace( '&nbsp;', '-', get_the_title( (int) $_POST['post'] ) ) . '.csv';
1478
		}
1479
1480
		$feedbacks = get_posts( $args );
1481
1482
		if ( empty( $feedbacks ) ) {
1483
			return;
1484
		}
1485
1486
		$filename = sanitize_file_name( $filename );
1487
1488
		/**
1489
		 * Prepare data for export.
1490
		 */
1491
		$data = $this->get_export_data_for_posts( $feedbacks );
1492
1493
		/**
1494
		 * If `$data` is empty, there's nothing we can do below.
1495
		 */
1496
		if ( ! is_array( $data ) || empty( $data ) ) {
1497
			return;
1498
		}
1499
1500
		/**
1501
		 * Extract field names from `$data` for later use.
1502
		 */
1503
		$fields = array_keys( $data );
1504
1505
		/**
1506
		 * Count how many rows will be exported.
1507
		 */
1508
		$row_count = count( reset( $data ) );
1509
1510
		// Forces the download of the CSV instead of echoing
1511
		header( 'Content-Disposition: attachment; filename=' . $filename );
1512
		header( 'Pragma: no-cache' );
1513
		header( 'Expires: 0' );
1514
		header( 'Content-Type: text/csv; charset=utf-8' );
1515
1516
		$output = fopen( 'php://output', 'w' );
1517
1518
		/**
1519
		 * Print CSV headers
1520
		 */
1521
		fputcsv( $output, $fields );
1522
1523
		/**
1524
		 * Print rows to the output.
1525
		 */
1526
		for ( $i = 0; $i < $row_count; $i ++ ) {
1527
1528
			$current_row = array();
1529
1530
			/**
1531
			 * Put all the fields in `$current_row` array.
1532
			 */
1533
			foreach ( $fields as $single_field_name ) {
1534
				$current_row[] = $this->esc_csv( $data[ $single_field_name ][ $i ] );
1535
			}
1536
1537
			/**
1538
			 * Output the complete CSV row
1539
			 */
1540
			fputcsv( $output, $current_row );
1541
		}
1542
1543
		fclose( $output );
1544
	}
1545
1546
	/**
1547
	 * Escape a string to be used in a CSV context
1548
	 *
1549
	 * Malicious input can inject formulas into CSV files, opening up the possibility for phishing attacks and
1550
	 * disclosure of sensitive information.
1551
	 *
1552
	 * Additionally, Excel exposes the ability to launch arbitrary commands through the DDE protocol.
1553
	 *
1554
	 * @see https://www.contextis.com/en/blog/comma-separated-vulnerabilities
1555
	 *
1556
	 * @param string $field
1557
	 *
1558
	 * @return string
1559
	 */
1560
	public function esc_csv( $field ) {
1561
		$active_content_triggers = array( '=', '+', '-', '@' );
1562
1563
		if ( in_array( mb_substr( $field, 0, 1 ), $active_content_triggers, true ) ) {
1564
			$field = "'" . $field;
1565
		}
1566
1567
		return $field;
1568
	}
1569
1570
	/**
1571
	 * Returns a string of HTML <option> items from an array of posts
1572
	 *
1573
	 * @return string a string of HTML <option> items
1574
	 */
1575
	protected function get_feedbacks_as_options() {
1576
		$options = '';
1577
1578
		// Get the feedbacks' parents' post IDs
1579
		$feedbacks = get_posts(
1580
			array(
1581
				'fields'           => 'id=>parent',
1582
				'posts_per_page'   => 100000,
1583
				'post_type'        => 'feedback',
1584
				'post_status'      => 'publish',
1585
				'suppress_filters' => false,
1586
			)
1587
		);
1588
		$parents   = array_unique( array_values( $feedbacks ) );
1589
1590
		$posts = get_posts(
1591
			array(
1592
				'orderby'          => 'ID',
1593
				'posts_per_page'   => 1000,
1594
				'post_type'        => 'any',
1595
				'post__in'         => array_values( $parents ),
1596
				'suppress_filters' => false,
1597
			)
1598
		);
1599
1600
		// creates the string of <option> elements
1601
		foreach ( $posts as $post ) {
1602
			$options .= sprintf( '<option value="%s">%s</option>', esc_attr( $post->ID ), esc_html( $post->post_title ) );
1603
		}
1604
1605
		return $options;
1606
	}
1607
1608
	/**
1609
	 * Get the names of all the form's fields
1610
	 *
1611
	 * @param  array|int $posts the post we want the fields of
1612
	 *
1613
	 * @return array     the array of fields
1614
	 *
1615
	 * @deprecated As this is no longer necessary as of the CSV export rewrite. - 2015-12-29
1616
	 */
1617
	protected function get_field_names( $posts ) {
1618
		$posts      = (array) $posts;
1619
		$all_fields = array();
1620
1621
		foreach ( $posts as $post ) {
1622
			$fields = self::parse_fields_from_content( $post );
1623
1624
			if ( isset( $fields['_feedback_all_fields'] ) ) {
1625
				$extra_fields = array_keys( $fields['_feedback_all_fields'] );
1626
				$all_fields   = array_merge( $all_fields, $extra_fields );
1627
			}
1628
		}
1629
1630
		$all_fields = array_unique( $all_fields );
1631
		return $all_fields;
1632
	}
1633
1634
	public static function parse_fields_from_content( $post_id ) {
1635
		static $post_fields;
1636
1637
		if ( ! is_array( $post_fields ) ) {
1638
			$post_fields = array();
1639
		}
1640
1641
		if ( isset( $post_fields[ $post_id ] ) ) {
1642
			return $post_fields[ $post_id ];
1643
		}
1644
1645
		$all_values   = array();
1646
		$post_content = get_post_field( 'post_content', $post_id );
1647
		$content      = explode( '<!--more-->', $post_content );
1648
		$lines        = array();
1649
1650
		if ( count( $content ) > 1 ) {
1651
			$content  = str_ireplace( array( '<br />', ')</p>' ), '', $content[1] );
1652
			$one_line = preg_replace( '/\s+/', ' ', $content );
1653
			$one_line = preg_replace( '/.*Array \( (.*)\)/', '$1', $one_line );
1654
1655
			preg_match_all( '/\[([^\]]+)\] =\&gt\; ([^\[]+)/', $one_line, $matches );
1656
1657
			if ( count( $matches ) > 1 ) {
1658
				$all_values = array_combine( array_map( 'trim', $matches[1] ), array_map( 'trim', $matches[2] ) );
1659
			}
1660
1661
			$lines = array_filter( explode( "\n", $content ) );
1662
		}
1663
1664
		$var_map = array(
1665
			'AUTHOR'       => '_feedback_author',
1666
			'AUTHOR EMAIL' => '_feedback_author_email',
1667
			'AUTHOR URL'   => '_feedback_author_url',
1668
			'SUBJECT'      => '_feedback_subject',
1669
			'IP'           => '_feedback_ip',
1670
		);
1671
1672
		$fields = array();
1673
1674
		foreach ( $lines as $line ) {
1675
			$vars = explode( ': ', $line, 2 );
1676
			if ( ! empty( $vars ) ) {
1677
				if ( isset( $var_map[ $vars[0] ] ) ) {
1678
					$fields[ $var_map[ $vars[0] ] ] = self::strip_tags( trim( $vars[1] ) );
1679
				}
1680
			}
1681
		}
1682
1683
		$fields['_feedback_all_fields'] = $all_values;
1684
1685
		$post_fields[ $post_id ] = $fields;
1686
1687
		return $fields;
1688
	}
1689
1690
	/**
1691
	 * Creates a valid csv row from a post id
1692
	 *
1693
	 * @param  int   $post_id The id of the post
1694
	 * @param  array $fields  An array containing the names of all the fields of the csv
1695
	 * @return String The csv row
1696
	 *
1697
	 * @deprecated This is no longer needed, as of the CSV export rewrite.
1698
	 */
1699
	protected static function make_csv_row_from_feedback( $post_id, $fields ) {
1700
		$content_fields = self::parse_fields_from_content( $post_id );
1701
		$all_fields     = array();
1702
1703
		if ( isset( $content_fields['_feedback_all_fields'] ) ) {
1704
			$all_fields = $content_fields['_feedback_all_fields'];
1705
		}
1706
1707
		// Overwrite the parsed content with the content we stored in post_meta in a better format.
1708
		$extra_fields = get_post_meta( $post_id, '_feedback_extra_fields', true );
1709
		foreach ( $extra_fields as $extra_field => $extra_value ) {
1710
			$all_fields[ $extra_field ] = $extra_value;
1711
		}
1712
1713
		// The first element in all of the exports will be the subject
1714
		$row_items[] = $content_fields['_feedback_subject'];
1715
1716
		// Loop the fields array in order to fill the $row_items array correctly
1717
		foreach ( $fields as $field ) {
1718
			if ( $field === __( 'Contact Form', 'jetpack' ) ) { // the first field will ever be the contact form, so we can continue
1719
				continue;
1720
			} elseif ( array_key_exists( $field, $all_fields ) ) {
1721
				$row_items[] = $all_fields[ $field ];
1722
			} else {
1723
				$row_items[] = '';
1724
			}
1725
		}
1726
1727
		return $row_items;
1728
	}
1729
1730
	public static function get_ip_address() {
1731
		return isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : null;
1732
	}
1733
}
1734
1735
/**
1736
 * Generic shortcode class.
1737
 * Does nothing other than store structured data and output the shortcode as a string
1738
 *
1739
 * Not very general - specific to Grunion.
1740
 */
1741
class Crunion_Contact_Form_Shortcode {
1742
	/**
1743
	 * @var string the name of the shortcode: [$shortcode_name /]
1744
	 */
1745
	public $shortcode_name;
1746
1747
	/**
1748
	 * @var array key => value pairs for the shortcode's attributes: [$shortcode_name key="value" ... /]
1749
	 */
1750
	public $attributes;
1751
1752
	/**
1753
	 * @var array key => value pair for attribute defaults
1754
	 */
1755
	public $defaults = array();
1756
1757
	/**
1758
	 * @var null|string Null for selfclosing shortcodes.  Hhe inner content of otherwise: [$shortcode_name]$content[/$shortcode_name]
1759
	 */
1760
	public $content;
1761
1762
	/**
1763
	 * @var array Associative array of inner "child" shortcodes equivalent to the $content: [$shortcode_name][child 1/][child 2/][/$shortcode_name]
1764
	 */
1765
	public $fields;
1766
1767
	/**
1768
	 * @var null|string The HTML of the parsed inner "child" shortcodes".  Null for selfclosing shortcodes.
1769
	 */
1770
	public $body;
1771
1772
	/**
1773
	 * @param array       $attributes An associative array of shortcode attributes.  @see shortcode_atts()
1774
	 * @param null|string $content Null for selfclosing shortcodes.  The inner content otherwise.
1775
	 */
1776
	function __construct( $attributes, $content = null ) {
1777
		$this->attributes = $this->unesc_attr( $attributes );
1778
		if ( is_array( $content ) ) {
1779
			$string_content = '';
1780
			foreach ( $content as $field ) {
1781
				$string_content .= (string) $field;
1782
			}
1783
1784
			$this->content = $string_content;
1785
		} else {
1786
			$this->content = $content;
1787
		}
1788
1789
		$this->parse_content( $this->content );
1790
	}
1791
1792
	/**
1793
	 * Processes the shortcode's inner content for "child" shortcodes
1794
	 *
1795
	 * @param string $content The shortcode's inner content: [shortcode]$content[/shortcode]
1796
	 */
1797
	function parse_content( $content ) {
1798
		if ( is_null( $content ) ) {
1799
			$this->body = null;
1800
		}
1801
1802
		$this->body = do_shortcode( $content );
1803
	}
1804
1805
	/**
1806
	 * Returns the value of the requested attribute.
1807
	 *
1808
	 * @param string $key The attribute to retrieve
1809
	 * @return mixed
1810
	 */
1811
	function get_attribute( $key ) {
1812
		return isset( $this->attributes[ $key ] ) ? $this->attributes[ $key ] : null;
1813
	}
1814
1815
	function esc_attr( $value ) {
1816
		if ( is_array( $value ) ) {
1817
			return array_map( array( $this, 'esc_attr' ), $value );
1818
		}
1819
1820
		$value = Grunion_Contact_Form_Plugin::strip_tags( $value );
1821
		$value = _wp_specialchars( $value, ENT_QUOTES, false, true );
1822
1823
		// Shortcode attributes can't contain "]"
1824
		$value = str_replace( ']', '', $value );
1825
		$value = str_replace( ',', '&#x002c;', $value ); // store commas encoded
1826
		$value = strtr(
1827
			$value, array(
1828
				'%' => '%25',
1829
				'&' => '%26',
1830
			)
1831
		);
1832
1833
		// shortcode_parse_atts() does stripcslashes()
1834
		$value = addslashes( $value );
1835
		return $value;
1836
	}
1837
1838
	function unesc_attr( $value ) {
1839
		if ( is_array( $value ) ) {
1840
			return array_map( array( $this, 'unesc_attr' ), $value );
1841
		}
1842
1843
		// For back-compat with old Grunion encoding
1844
		// Also, unencode commas
1845
		$value = strtr(
1846
			$value, array(
1847
				'%26' => '&',
1848
				'%25' => '%',
1849
			)
1850
		);
1851
		$value = preg_replace( array( '/&#x0*22;/i', '/&#x0*27;/i', '/&#x0*26;/i', '/&#x0*2c;/i' ), array( '"', "'", '&', ',' ), $value );
1852
		$value = htmlspecialchars_decode( $value, ENT_QUOTES );
1853
		$value = Grunion_Contact_Form_Plugin::strip_tags( $value );
1854
1855
		return $value;
1856
	}
1857
1858
	/**
1859
	 * Generates the shortcode
1860
	 */
1861
	function __toString() {
1862
		$r = "[{$this->shortcode_name} ";
1863
1864
		foreach ( $this->attributes as $key => $value ) {
1865
			if ( ! $value ) {
1866
				continue;
1867
			}
1868
1869
			if ( isset( $this->defaults[ $key ] ) && $this->defaults[ $key ] == $value ) {
1870
				continue;
1871
			}
1872
1873
			if ( 'id' == $key ) {
1874
				continue;
1875
			}
1876
1877
			$value = $this->esc_attr( $value );
1878
1879
			if ( is_array( $value ) ) {
1880
				$value = join( ',', $value );
1881
			}
1882
1883
			if ( false === strpos( $value, "'" ) ) {
1884
				$value = "'$value'";
1885
			} elseif ( false === strpos( $value, '"' ) ) {
1886
				$value = '"' . $value . '"';
1887
			} else {
1888
				// Shortcodes can't contain both '"' and "'".  Strip one.
1889
				$value = str_replace( "'", '', $value );
1890
				$value = "'$value'";
1891
			}
1892
1893
			$r .= "{$key}={$value} ";
1894
		}
1895
1896
		$r = rtrim( $r );
1897
1898
		if ( $this->fields ) {
1899
			$r .= ']';
1900
1901
			foreach ( $this->fields as $field ) {
1902
				$r .= (string) $field;
1903
			}
1904
1905
			$r .= "[/{$this->shortcode_name}]";
1906
		} else {
1907
			$r .= '/]';
1908
		}
1909
1910
		return $r;
1911
	}
1912
}
1913
1914
/**
1915
 * Class for the contact-form shortcode.
1916
 * Parses shortcode to output the contact form as HTML
1917
 * Sends email and stores the contact form response (a.k.a. "feedback")
1918
 */
1919
class Grunion_Contact_Form extends Crunion_Contact_Form_Shortcode {
1920
	public $shortcode_name = 'contact-form';
1921
1922
	/**
1923
	 * @var WP_Error stores form submission errors
1924
	 */
1925
	public $errors;
1926
1927
	/**
1928
	 * @var string The SHA1 hash of the attributes that comprise the form.
1929
	 */
1930
	public $hash;
1931
1932
	/**
1933
	 * @var Grunion_Contact_Form The most recent (inclusive) contact-form shortcode processed
1934
	 */
1935
	static $last;
1936
1937
	/**
1938
	 * @var Whatever form we are currently looking at. If processed, will become $last
1939
	 */
1940
	static $current_form;
1941
1942
	/**
1943
	 * @var array All found forms, indexed by hash.
1944
	 */
1945
	static $forms = array();
1946
1947
	/**
1948
	 * @var bool Whether to print the grunion.css style when processing the contact-form shortcode
1949
	 */
1950
	static $style = false;
1951
1952
	/**
1953
	 * @var array When printing the submit button, what tags are allowed
1954
	 */
1955
	static $allowed_html_tags_for_submit_button = array( 'br' => array() );
1956
1957
	function __construct( $attributes, $content = null ) {
1958
		global $post;
1959
1960
		$this->hash                 = sha1( json_encode( $attributes ) . $content );
1961
		self::$forms[ $this->hash ] = $this;
1962
1963
		// Set up the default subject and recipient for this form.
1964
		$default_to      = '';
1965
		$default_subject = '[' . get_option( 'blogname' ) . ']';
1966
1967
		if ( ! isset( $attributes ) || ! is_array( $attributes ) ) {
1968
			$attributes = array();
1969
		}
1970
1971
		if ( ! empty( $attributes['widget'] ) && $attributes['widget'] ) {
1972
			$default_to      .= get_option( 'admin_email' );
1973
			$attributes['id'] = 'widget-' . $attributes['widget'];
1974
			$default_subject  = sprintf( _x( '%1$s Sidebar', '%1$s = blog name', 'jetpack' ), $default_subject );
1975
		} elseif ( $post ) {
1976
			$attributes['id'] = $post->ID;
1977
			$default_subject  = sprintf( _x( '%1$s %2$s', '%1$s = blog name, %2$s = post title', 'jetpack' ), $default_subject, Grunion_Contact_Form_Plugin::strip_tags( $post->post_title ) );
1978
			$post_author      = get_userdata( $post->post_author );
1979
			$default_to      .= $post_author->user_email;
1980
		}
1981
1982
		// Keep reference to $this for parsing form fields.
1983
		self::$current_form = $this;
1984
1985
		$this->defaults = array(
1986
			'to'                     => $default_to,
1987
			'subject'                => $default_subject,
1988
			'show_subject'           => 'no', // only used in back-compat mode
1989
			'widget'                 => 0,    // Not exposed to the user. Works with Grunion_Contact_Form_Plugin::widget_atts()
1990
			'id'                     => null, // Not exposed to the user. Set above.
1991
			'submit_button_text'     => __( 'Submit', 'jetpack' ),
1992
			// These attributes come from the block editor, so use camel case instead of snake case.
1993
			'customThankyou'         => '', // Whether to show a custom thankyou response after submitting a form. '' for no, 'message' for a custom message, 'redirect' to redirect to a new URL.
1994
			'customThankyouMessage'  => __( 'Thank you for your submission!', 'jetpack' ), // The message to show when customThankyou is set to 'message'.
1995
			'customThankyouRedirect' => '', // The URL to redirect to when customThankyou is set to 'redirect'.
1996
			'jetpackCRM'             => true, // Whether Jetpack CRM should store the form submission.
1997
		);
1998
1999
		$attributes = shortcode_atts( $this->defaults, $attributes, 'contact-form' );
2000
2001
		// We only enable the contact-field shortcode temporarily while processing the contact-form shortcode.
2002
		Grunion_Contact_Form_Plugin::$using_contact_form_field = true;
2003
2004
		parent::__construct( $attributes, $content );
2005
2006
		// There were no fields in the contact form. The form was probably just [contact-form /]. Build a default form.
2007
		if ( empty( $this->fields ) ) {
2008
			// same as the original Grunion v1 form.
2009
			$default_form = '
2010
				[contact-field label="' . __( 'Name', 'jetpack' ) . '" type="name"  required="true" /]
2011
				[contact-field label="' . __( 'Email', 'jetpack' ) . '" type="email" required="true" /]
2012
				[contact-field label="' . __( 'Website', 'jetpack' ) . '" type="url" /]';
2013
2014
			if ( 'yes' == strtolower( $this->get_attribute( 'show_subject' ) ) ) {
2015
				$default_form .= '
2016
					[contact-field label="' . __( 'Subject', 'jetpack' ) . '" type="subject" /]';
2017
			}
2018
2019
			$default_form .= '
2020
				[contact-field label="' . __( 'Message', 'jetpack' ) . '" type="textarea" /]';
2021
2022
			$this->parse_content( $default_form );
2023
2024
			// Store the shortcode.
2025
			$this->store_shortcode( $default_form, $attributes, $this->hash );
2026
		} else {
2027
			// Store the shortcode.
2028
			$this->store_shortcode( $content, $attributes, $this->hash );
2029
		}
2030
2031
		// $this->body and $this->fields have been setup.  We no longer need the contact-field shortcode.
2032
		Grunion_Contact_Form_Plugin::$using_contact_form_field = false;
2033
	}
2034
2035
	/**
2036
	 * Store shortcode content for recall later
2037
	 *  - used to receate shortcode when user uses do_shortcode
2038
	 *
2039
	 * @param string $content
2040
	 * @param array $attributes
2041
	 * @param string $hash
2042
	 */
2043
	static function store_shortcode( $content = null, $attributes = null, $hash = null ) {
2044
2045
		if ( $content != null and isset( $attributes['id'] ) ) {
2046
2047
			if ( empty( $hash ) ) {
2048
				$hash = sha1( json_encode( $attributes ) . $content );
2049
			}
2050
2051
			$shortcode_meta = get_post_meta( $attributes['id'], "_g_feedback_shortcode_{$hash}", true );
2052
2053
			if ( $shortcode_meta != '' or $shortcode_meta != $content ) {
2054
				update_post_meta( $attributes['id'], "_g_feedback_shortcode_{$hash}", $content );
2055
2056
				// Save attributes to post_meta for later use. They're not available later in do_shortcode situations.
2057
				update_post_meta( $attributes['id'], "_g_feedback_shortcode_atts_{$hash}", $attributes );
2058
			}
2059
		}
2060
	}
2061
2062
	/**
2063
	 * Toggle for printing the grunion.css stylesheet
2064
	 *
2065
	 * @param bool $style
2066
	 */
2067
	static function style( $style ) {
2068
		$previous_style = self::$style;
2069
		self::$style    = (bool) $style;
2070
		return $previous_style;
2071
	}
2072
2073
	/**
2074
	 * Turn on printing of grunion.css stylesheet
2075
	 *
2076
	 * @see ::style()
2077
	 * @internal
2078
	 * @param bool $style
2079
	 */
2080
	static function _style_on() {
2081
		return self::style( true );
2082
	}
2083
2084
	/**
2085
	 * The contact-form shortcode processor
2086
	 *
2087
	 * @param array       $attributes Key => Value pairs as parsed by shortcode_parse_atts()
2088
	 * @param string|null $content The shortcode's inner content: [contact-form]$content[/contact-form]
2089
	 * @return string HTML for the concat form.
2090
	 */
2091
	static function parse( $attributes, $content ) {
2092
		if ( Settings::is_syncing() ) {
2093
			return '';
2094
		}
2095
		// Create a new Grunion_Contact_Form object (this class)
2096
		$form = new Grunion_Contact_Form( $attributes, $content );
2097
2098
		$id = $form->get_attribute( 'id' );
2099
2100
		if ( ! $id ) { // something terrible has happened
2101
			return '[contact-form]';
2102
		}
2103
2104
		if ( is_feed() ) {
2105
			return '[contact-form]';
2106
		}
2107
2108
		self::$last = $form;
2109
2110
		// Enqueue the grunion.css stylesheet if self::$style allows it
2111
		if ( self::$style && ( empty( $_REQUEST['action'] ) || $_REQUEST['action'] != 'grunion_shortcode_to_json' ) ) {
2112
			// Enqueue the style here instead of printing it, because if some other plugin has run the_post()+rewind_posts(),
2113
			// (like VideoPress does), the style tag gets "printed" the first time and discarded, leaving the contact form unstyled.
2114
			// when WordPress does the real loop.
2115
			wp_enqueue_style( 'grunion.css' );
2116
		}
2117
2118
		$r  = '';
2119
		$r .= "<div id='contact-form-$id'>\n";
2120
2121
		if ( is_wp_error( $form->errors ) && $form->errors->get_error_codes() ) {
2122
			// There are errors.  Display them
2123
			$r .= "<div class='form-error'>\n<h3>" . __( 'Error!', 'jetpack' ) . "</h3>\n<ul class='form-errors'>\n";
2124
			foreach ( $form->errors->get_error_messages() as $message ) {
2125
				$r .= "\t<li class='form-error-message'>" . esc_html( $message ) . "</li>\n";
2126
			}
2127
			$r .= "</ul>\n</div>\n\n";
2128
		}
2129
2130
		if ( isset( $_GET['contact-form-id'] )
2131
			&& (int) $_GET['contact-form-id'] === (int) self::$last->get_attribute( 'id' )
2132
			&& isset( $_GET['contact-form-sent'], $_GET['contact-form-hash'] )
2133
			&& is_string( $_GET['contact-form-hash'] )
2134
			&& hash_equals( $form->hash, $_GET['contact-form-hash'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
2135
			// The contact form was submitted.  Show the success message/results.
2136
			$feedback_id = (int) $_GET['contact-form-sent'];
2137
2138
			$back_url = remove_query_arg( array( 'contact-form-id', 'contact-form-sent', '_wpnonce' ) );
2139
2140
			$r_success_message =
2141
				'<h3>' . __( 'Message Sent', 'jetpack' ) .
2142
				' (<a href="' . esc_url( $back_url ) . '">' . esc_html__( 'go back', 'jetpack' ) . '</a>)' .
2143
				"</h3>\n\n";
2144
2145
			// Don't show the feedback details unless the nonce matches
2146
			if ( $feedback_id && wp_verify_nonce( stripslashes( $_GET['_wpnonce'] ), "contact-form-sent-{$feedback_id}" ) ) {
2147
				$r_success_message .= self::success_message( $feedback_id, $form );
2148
			}
2149
2150
			/**
2151
			 * Filter the message returned after a successful contact form submission.
2152
			 *
2153
			 * @module contact-form
2154
			 *
2155
			 * @since 1.3.1
2156
			 *
2157
			 * @param string $r_success_message Success message.
2158
			 */
2159
			$r .= apply_filters( 'grunion_contact_form_success_message', $r_success_message );
2160
		} else {
2161
			// Nothing special - show the normal contact form
2162
			if ( $form->get_attribute( 'widget' ) ) {
2163
				// Submit form to the current URL
2164
				$url = remove_query_arg( array( 'contact-form-id', 'contact-form-sent', 'action', '_wpnonce' ) );
2165
			} else {
2166
				// Submit form to the post permalink
2167
				$url = get_permalink();
2168
			}
2169
2170
			// For SSL/TLS page. See RFC 3986 Section 4.2
2171
			$url = set_url_scheme( $url );
2172
2173
			// May eventually want to send this to admin-post.php...
2174
			/**
2175
			 * Filter the contact form action URL.
2176
			 *
2177
			 * @module contact-form
2178
			 *
2179
			 * @since 1.3.1
2180
			 *
2181
			 * @param string $contact_form_id Contact form post URL.
2182
			 * @param $post $GLOBALS['post'] Post global variable.
2183
			 * @param int $id Contact Form ID.
2184
			 */
2185
			$url                     = apply_filters( 'grunion_contact_form_form_action', "{$url}#contact-form-{$id}", $GLOBALS['post'], $id );
2186
			$has_submit_button_block = ! ( false === strpos( $content, 'wp-block-jetpack-button' ) );
2187
			$form_classes            = 'contact-form commentsblock';
2188
2189
			if ( $has_submit_button_block ) {
2190
				$form_classes .= ' wp-block-jetpack-contact-form';
2191
			}
2192
2193
			$r .= "<form action='" . esc_url( $url ) . "' method='post' class='" . esc_attr( $form_classes ) . "'>\n";
2194
			$r .= $form->body;
2195
2196
			// In new versions of the contact form block the button is an inner block
2197
			// so the button does not need to be constructed server-side.
2198
			if ( ! $has_submit_button_block ) {
2199
				$r .= "\t<p class='contact-submit'>\n";
2200
2201
				$gutenberg_submit_button_classes = '';
2202
				if ( ! empty( $attributes['submitButtonClasses'] ) ) {
2203
					$gutenberg_submit_button_classes = ' ' . $attributes['submitButtonClasses'];
2204
				}
2205
2206
				/**
2207
				 * Filter the contact form submit button class attribute.
2208
				 *
2209
				 * @module contact-form
2210
				 *
2211
				 * @since 6.6.0
2212
				 *
2213
				 * @param string $class Additional CSS classes for button attribute.
2214
				 */
2215
				$submit_button_class = apply_filters( 'jetpack_contact_form_submit_button_class', 'pushbutton-wide' . $gutenberg_submit_button_classes );
2216
2217
				$submit_button_styles = '';
2218
				if ( ! empty( $attributes['customBackgroundButtonColor'] ) ) {
2219
					$submit_button_styles .= 'background-color: ' . $attributes['customBackgroundButtonColor'] . '; ';
2220
				}
2221
				if ( ! empty( $attributes['customTextButtonColor'] ) ) {
2222
					$submit_button_styles .= 'color: ' . $attributes['customTextButtonColor'] . ';';
2223
				}
2224
				if ( ! empty( $attributes['submitButtonText'] ) ) {
2225
					$submit_button_text = $attributes['submitButtonText'];
2226
				} else {
2227
					$submit_button_text = $form->get_attribute( 'submit_button_text' );
2228
				}
2229
2230
				$r .= "\t\t<button type='submit' class='" . esc_attr( $submit_button_class ) . "'";
2231
				if ( ! empty( $submit_button_styles ) ) {
2232
					$r .= " style='" . esc_attr( $submit_button_styles ) . "'";
2233
				}
2234
				$r .= ">";
2235
				$r .= wp_kses(
2236
					      $submit_button_text,
2237
					      self::$allowed_html_tags_for_submit_button
2238
				      ) . "</button>";
2239
			}
2240
2241
			if ( is_user_logged_in() ) {
2242
				$r .= "\t\t" . wp_nonce_field( 'contact-form_' . $id, '_wpnonce', true, false ) . "\n"; // nonce and referer
2243
			}
2244
2245
			if ( isset( $attributes['hasFormSettingsSet'] ) && $attributes['hasFormSettingsSet'] ) {
2246
				$r .= "\t\t<input type='hidden' name='is_block' value='1' />\n";
2247
			}
2248
			$r .= "\t\t<input type='hidden' name='contact-form-id' value='$id' />\n";
2249
			$r .= "\t\t<input type='hidden' name='action' value='grunion-contact-form' />\n";
2250
			$r .= "\t\t<input type='hidden' name='contact-form-hash' value='" . esc_attr( $form->hash ) . "' />\n";
2251
2252
			if ( ! $has_submit_button_block ) {
2253
				$r .= "\t</p>\n";
2254
			}
2255
2256
			$r .= "</form>\n";
2257
		}
2258
2259
		$r .= '</div>';
2260
2261
		return $r;
2262
	}
2263
2264
	/**
2265
	 * Returns a success message to be returned if the form is sent via AJAX.
2266
	 *
2267
	 * @param int                         $feedback_id
2268
	 * @param object Grunion_Contact_Form $form
2269
	 *
2270
	 * @return string $message
2271
	 */
2272
	static function success_message( $feedback_id, $form ) {
2273
		if ( 'message' === $form->get_attribute( 'customThankyou' ) ) {
2274
			$message = wpautop( $form->get_attribute( 'customThankyouMessage' ) );
2275
		} else {
2276
			$message = '<blockquote class="contact-form-submission">'
2277
			. '<p>' . join( '</p><p>', self::get_compiled_form( $feedback_id, $form ) ) . '</p>'
2278
			. '</blockquote>';
2279
		}
2280
2281
		return wp_kses(
2282
			$message,
2283
			array(
2284
				'br'         => array(),
2285
				'blockquote' => array( 'class' => array() ),
2286
				'p'          => array(),
2287
			)
2288
		);
2289
	}
2290
2291
	/**
2292
	 * Returns a compiled form with labels and values in a form of  an array
2293
	 * of lines.
2294
	 *
2295
	 * @param int                         $feedback_id
2296
	 * @param object Grunion_Contact_Form $form
2297
	 *
2298
	 * @return array $lines
2299
	 */
2300
	static function get_compiled_form( $feedback_id, $form ) {
2301
		$feedback       = get_post( $feedback_id );
2302
		$field_ids      = $form->get_field_ids();
2303
		$content_fields = Grunion_Contact_Form_Plugin::parse_fields_from_content( $feedback_id );
2304
2305
		// Maps field_ids to post_meta keys
2306
		$field_value_map = array(
2307
			'name'     => 'author',
2308
			'email'    => 'author_email',
2309
			'url'      => 'author_url',
2310
			'subject'  => 'subject',
2311
			'textarea' => false, // not a post_meta key.  This is stored in post_content
2312
		);
2313
2314
		$compiled_form = array();
2315
2316
		// "Standard" field allowed list.
2317
		foreach ( $field_value_map as $type => $meta_key ) {
2318
			if ( isset( $field_ids[ $type ] ) ) {
2319
				$field = $form->fields[ $field_ids[ $type ] ];
2320
2321
				if ( $meta_key ) {
2322
					if ( isset( $content_fields[ "_feedback_{$meta_key}" ] ) ) {
2323
						$value = $content_fields[ "_feedback_{$meta_key}" ];
2324
					}
2325
				} else {
2326
					// The feedback content is stored as the first "half" of post_content
2327
					$value         = $feedback->post_content;
2328
					list( $value ) = explode( '<!--more-->', $value );
2329
					$value         = trim( $value );
2330
				}
2331
2332
				$field_index                   = array_search( $field_ids[ $type ], $field_ids['all'] );
2333
				$compiled_form[ $field_index ] = sprintf(
2334
					'<b>%1$s:</b> %2$s<br /><br />',
2335
					wp_kses( $field->get_attribute( 'label' ), array() ),
2336
					self::escape_and_sanitize_field_value( $value )
2337
				);
2338
			}
2339
		}
2340
2341
		// "Non-standard" fields
2342
		if ( $field_ids['extra'] ) {
2343
			// array indexed by field label (not field id)
2344
			$extra_fields = get_post_meta( $feedback_id, '_feedback_extra_fields', true );
2345
2346
			/**
2347
			 * Only get data for the compiled form if `$extra_fields` is a valid and non-empty array.
2348
			 */
2349
			if ( is_array( $extra_fields ) && ! empty( $extra_fields ) ) {
2350
2351
				$extra_field_keys = array_keys( $extra_fields );
2352
2353
				$i = 0;
2354
				foreach ( $field_ids['extra'] as $field_id ) {
2355
					$field       = $form->fields[ $field_id ];
2356
					$field_index = array_search( $field_id, $field_ids['all'] );
2357
2358
					$label = $field->get_attribute( 'label' );
2359
2360
					$compiled_form[ $field_index ] = sprintf(
2361
						'<b>%1$s:</b> %2$s<br /><br />',
2362
						wp_kses( $label, array() ),
2363
						self::escape_and_sanitize_field_value( $extra_fields[ $extra_field_keys[ $i ] ] )
2364
					);
2365
2366
					$i++;
2367
				}
2368
			}
2369
		}
2370
2371
		// Sorting lines by the field index
2372
		ksort( $compiled_form );
2373
2374
		return $compiled_form;
2375
	}
2376
2377
	static function escape_and_sanitize_field_value( $value ) {
2378
        $value = str_replace( array( '[' , ']' ) ,  array( '&#91;' , '&#93;' ) , $value );
2379
        return nl2br( wp_kses( $value, array() ) );
2380
    }
2381
2382
	/**
2383
	 * Only strip out empty string values and keep all the other values as they are.
2384
     *
2385
	 * @param $single_value
2386
	 *
2387
	 * @return bool
2388
	 */
2389
	static function remove_empty( $single_value ) {
2390
		return ( $single_value !== '' );
2391
	}
2392
2393
	/**
2394
	 * Escape a shortcode value.
2395
	 *
2396
	 * Shortcode attribute values have a number of unfortunate restrictions, which fortunately we
2397
	 * can get around by adding some extra HTML encoding.
2398
	 *
2399
	 * The output HTML will have a few extra escapes, but that makes no functional difference.
2400
	 *
2401
	 * @since 9.1.0
2402
	 * @param string $val Value to escape.
2403
	 * @return string
2404
	 */
2405
	private static function esc_shortcode_val( $val ) {
2406
		return strtr(
2407
			esc_html( $val ),
2408
			array(
2409
				// Brackets in attribute values break the shortcode parser.
2410
				'['  => '&#091;',
2411
				']'  => '&#093;',
2412
				// Shortcode parser screws up backslashes too, thanks to calls to `stripcslashes`.
2413
				'\\' => '&#092;',
2414
				// The existing code here represents arrays as comma-separated strings.
2415
				// Rather than trying to change representations now, just escape the commas in values.
2416
				','  => '&#044;',
2417
			)
2418
		);
2419
	}
2420
2421
	/**
2422
	 * The contact-field shortcode processor
2423
	 * We use an object method here instead of a static Grunion_Contact_Form_Field class method to parse contact-field shortcodes so that we can tie them to the contact-form object.
2424
	 *
2425
	 * @param array       $attributes Key => Value pairs as parsed by shortcode_parse_atts()
2426
	 * @param string|null $content The shortcode's inner content: [contact-field]$content[/contact-field]
2427
	 * @return HTML for the contact form field
2428
	 */
2429
	static function parse_contact_field( $attributes, $content ) {
2430
		// Don't try to parse contact form fields if not inside a contact form
2431
		if ( ! Grunion_Contact_Form_Plugin::$using_contact_form_field ) {
2432
			$att_strs = array();
2433
			if ( ! isset( $attributes['label'] )  ) {
2434
				$type = isset( $attributes['type'] ) ? $attributes['type'] : null;
2435
				$attributes['label'] = self::get_default_label_from_type( $type );
2436
			}
2437
			foreach ( $attributes as $att => $val ) {
2438
				if ( is_numeric( $att ) ) { // Is a valueless attribute
2439
					$att_strs[] = self::esc_shortcode_val( $val );
2440
				} elseif ( isset( $val ) ) { // A regular attr - value pair
2441
					if ( ( $att === 'options' || $att === 'values' ) && is_string( $val ) ) { // remove any empty strings
2442
						$val = explode( ',', $val );
2443
					}
2444
					if ( is_array( $val ) ) {
2445
						$val =  array_filter( $val, array( __CLASS__, 'remove_empty' ) ); // removes any empty strings
2446
						$att_strs[] = esc_html( $att ) . '="' . implode( ',', array_map( array( __CLASS__, 'esc_shortcode_val' ), $val ) ) . '"';
2447
					} elseif ( is_bool( $val ) ) {
2448
						$att_strs[] = esc_html( $att ) . '="' . ( $val ? '1' : '' ) . '"';
2449
					} else {
2450
						$att_strs[] = esc_html( $att ) . '="' . self::esc_shortcode_val( $val ) . '"';
2451
					}
2452
				}
2453
			}
2454
2455
			$html = '[contact-field ' . implode( ' ', $att_strs );
2456
2457
			if ( isset( $content ) && ! empty( $content ) ) { // If there is content, let's add a closing tag
2458
				$html .= ']' . esc_html( $content ) . '[/contact-field]';
2459
			} else { // Otherwise let's add a closing slash in the first tag
2460
				$html .= '/]';
2461
			}
2462
2463
			return $html;
2464
		}
2465
2466
		$form = Grunion_Contact_Form::$current_form;
2467
2468
		$field = new Grunion_Contact_Form_Field( $attributes, $content, $form );
2469
2470
		$field_id = $field->get_attribute( 'id' );
2471
		if ( $field_id ) {
2472
			$form->fields[ $field_id ] = $field;
2473
		} else {
2474
			$form->fields[] = $field;
2475
		}
2476
2477
		if (
2478
			isset( $_POST['action'] ) && 'grunion-contact-form' === $_POST['action']
2479
			&&
2480
			isset( $_POST['contact-form-id'] ) && $form->get_attribute( 'id' ) == $_POST['contact-form-id']
2481
			&&
2482
			isset( $_POST['contact-form-hash'] ) && hash_equals( $form->hash, $_POST['contact-form-hash'] )
2483
		) {
2484
			// If we're processing a POST submission for this contact form, validate the field value so we can show errors as necessary.
2485
			$field->validate();
2486
		}
2487
2488
		// Output HTML
2489
		return $field->render();
2490
	}
2491
2492
	static function get_default_label_from_type( $type ) {
2493
		$str = null;
2494
		switch ( $type ) {
2495
			case 'text':
2496
				$str = __( 'Text', 'jetpack' );
2497
				break;
2498
			case 'name':
2499
				$str = __( 'Name', 'jetpack' );
2500
				break;
2501
			case 'email':
2502
				$str = __( 'Email', 'jetpack' );
2503
				break;
2504
			case 'url':
2505
				$str = __( 'Website', 'jetpack' );
2506
				break;
2507
			case 'date':
2508
				$str = __( 'Date', 'jetpack' );
2509
				break;
2510
			case 'telephone':
2511
				$str = __( 'Phone', 'jetpack' );
2512
				break;
2513
			case 'textarea':
2514
				$str = __( 'Message', 'jetpack' );
2515
				break;
2516
			case 'checkbox':
2517
				$str = __( 'Checkbox', 'jetpack' );
2518
				break;
2519
			case 'checkbox-multiple':
2520
				$str = __( 'Choose several', 'jetpack' );
2521
				break;
2522
			case 'radio':
2523
				$str = __( 'Choose one', 'jetpack' );
2524
				break;
2525
			case 'select':
2526
				$str = __( 'Select one', 'jetpack' );
2527
				break;
2528
			case 'consent':
2529
				$str = __( 'Consent', 'jetpack' );
2530
				break;
2531
			default:
2532
				$str = null;
2533
		}
2534
		return $str;
2535
	}
2536
2537
	/**
2538
	 * Loops through $this->fields to generate a (structured) list of field IDs.
2539
	 *
2540
	 * Important: Currently the allowed fields are defined as follows:
2541
	 *  `name`, `email`, `url`, `subject`, `textarea`
2542
	 *
2543
	 * If you need to add new fields to the Contact Form, please don't add them
2544
	 * to the allowed fields and leave them as extra fields.
2545
	 *
2546
	 * The reasoning behind this is that both the admin Feedback view and the CSV
2547
	 * export will not include any fields that are added to the list of
2548
	 * allowed fields without taking proper care to add them to all the
2549
	 * other places where they accessed/used/saved.
2550
	 *
2551
	 * The safest way to add new fields is to add them to the dropdown and the
2552
	 * HTML list ( @see Grunion_Contact_Form_Field::render ) and don't add them
2553
	 * to the list of allowed fields. This way they will become a part of the
2554
	 * `extra fields` which are saved in the post meta and will be properly
2555
	 * handled by the admin Feedback view and the CSV Export without any extra
2556
	 * work.
2557
	 *
2558
	 * If there is need to add a field to the allowed fields, then please
2559
	 * take proper care to add logic to handle the field in the following places:
2560
	 *
2561
	 *  - Below in the switch statement - so the field is recognized as allowed.
2562
	 *
2563
	 *  - Grunion_Contact_Form::process_submission - validation and logic.
2564
	 *
2565
	 *  - Grunion_Contact_Form::process_submission - add the field as an additional
2566
	 *      field in the `post_content` when saving the feedback content.
2567
	 *
2568
	 *  - Grunion_Contact_Form_Plugin::parse_fields_from_content - add mapping
2569
	 *      for the field, defined in the above method.
2570
	 *
2571
	 *  - Grunion_Contact_Form_Plugin::map_parsed_field_contents_of_post_to_field_names -
2572
	 *      add mapping of the field for the CSV Export. Otherwise it will be missing
2573
	 *      from the exported data.
2574
	 *
2575
	 *  - admin.php / grunion_manage_post_columns - add the field to the render logic.
2576
	 *      Otherwise it will be missing from the admin Feedback view.
2577
	 *
2578
	 * @return array
2579
	 */
2580
	function get_field_ids() {
2581
		$field_ids = array(
2582
			'all'   => array(), // array of all field_ids.
2583
			'extra' => array(), // array of all non-allowed field IDs.
2584
2585
			// Allowed "standard" field IDs:
2586
			// 'email'    => field_id,
2587
			// 'name'     => field_id,
2588
			// 'url'      => field_id,
2589
			// 'subject'  => field_id,
2590
			// 'textarea' => field_id,
2591
		);
2592
2593
		foreach ( $this->fields as $id => $field ) {
2594
			$field_ids['all'][] = $id;
2595
2596
			$type = $field->get_attribute( 'type' );
2597
			if ( isset( $field_ids[ $type ] ) ) {
2598
				// This type of field is already present in our allowed list of "standard" fields for this form
2599
				// Put it in extra
2600
				$field_ids['extra'][] = $id;
2601
				continue;
2602
			}
2603
2604
			/**
2605
			 * See method description before modifying the switch cases.
2606
			 */
2607
			switch ( $type ) {
2608
				case 'email':
2609
				case 'name':
2610
				case 'url':
2611
				case 'subject':
2612
				case 'textarea':
2613
				case 'consent':
2614
					$field_ids[ $type ] = $id;
2615
					break;
2616
				default:
2617
					// Put everything else in extra
2618
					$field_ids['extra'][] = $id;
2619
			}
2620
		}
2621
2622
		return $field_ids;
2623
	}
2624
2625
	/**
2626
	 * Process the contact form's POST submission
2627
	 * Stores feedback.  Sends email.
2628
	 */
2629
	function process_submission() {
2630
		global $post;
2631
2632
		$plugin = Grunion_Contact_Form_Plugin::init();
2633
2634
		$id     = $this->get_attribute( 'id' );
2635
		$to     = $this->get_attribute( 'to' );
2636
		$widget = $this->get_attribute( 'widget' );
2637
2638
		$contact_form_subject    = $this->get_attribute( 'subject' );
2639
		$email_marketing_consent = false;
2640
2641
		$to     = str_replace( ' ', '', $to );
2642
		$emails = explode( ',', $to );
2643
2644
		$valid_emails = array();
2645
2646
		foreach ( (array) $emails as $email ) {
2647
			if ( ! is_email( $email ) ) {
2648
				continue;
2649
			}
2650
2651
			if ( function_exists( 'is_email_address_unsafe' ) && is_email_address_unsafe( $email ) ) {
2652
				continue;
2653
			}
2654
2655
			$valid_emails[] = $email;
2656
		}
2657
2658
		// No one to send it to, which means none of the "to" attributes are valid emails.
2659
		// Use default email instead.
2660
		if ( ! $valid_emails ) {
2661
			$valid_emails = $this->defaults['to'];
2662
		}
2663
2664
		$to = $valid_emails;
2665
2666
		// Last ditch effort to set a recipient if somehow none have been set.
2667
		if ( empty( $to ) ) {
2668
			$to = get_option( 'admin_email' );
2669
		}
2670
2671
		// Make sure we're processing the form we think we're processing... probably a redundant check.
2672
		if ( $widget ) {
2673
			if ( 'widget-' . $widget != $_POST['contact-form-id'] ) {
2674
				return false;
2675
			}
2676
		} else {
2677
			if ( $post->ID != $_POST['contact-form-id'] ) {
2678
				return false;
2679
			}
2680
		}
2681
2682
		$field_ids = $this->get_field_ids();
2683
2684
		// Initialize all these "standard" fields to null
2685
		$comment_author_email = $comment_author_email_label = // v
2686
		$comment_author       = $comment_author_label       = // v
2687
		$comment_author_url   = $comment_author_url_label   = // v
2688
		$comment_content      = $comment_content_label = null;
2689
2690
		// For each of the "standard" fields, grab their field label and value.
2691
		if ( isset( $field_ids['name'] ) ) {
2692
			$field          = $this->fields[ $field_ids['name'] ];
2693
			$comment_author = Grunion_Contact_Form_Plugin::strip_tags(
2694
				stripslashes(
2695
					/** This filter is already documented in core/wp-includes/comment-functions.php */
2696
					apply_filters( 'pre_comment_author_name', addslashes( $field->value ) )
2697
				)
2698
			);
2699
			$comment_author_label = Grunion_Contact_Form_Plugin::strip_tags( $field->get_attribute( 'label' ) );
2700
		}
2701
2702
		if ( isset( $field_ids['email'] ) ) {
2703
			$field                = $this->fields[ $field_ids['email'] ];
2704
			$comment_author_email = Grunion_Contact_Form_Plugin::strip_tags(
2705
				stripslashes(
2706
					/** This filter is already documented in core/wp-includes/comment-functions.php */
2707
					apply_filters( 'pre_comment_author_email', addslashes( $field->value ) )
2708
				)
2709
			);
2710
			$comment_author_email_label = Grunion_Contact_Form_Plugin::strip_tags( $field->get_attribute( 'label' ) );
2711
		}
2712
2713
		if ( isset( $field_ids['url'] ) ) {
2714
			$field              = $this->fields[ $field_ids['url'] ];
2715
			$comment_author_url = Grunion_Contact_Form_Plugin::strip_tags(
2716
				stripslashes(
2717
					/** This filter is already documented in core/wp-includes/comment-functions.php */
2718
					apply_filters( 'pre_comment_author_url', addslashes( $field->value ) )
2719
				)
2720
			);
2721
			if ( 'http://' == $comment_author_url ) {
2722
				$comment_author_url = '';
2723
			}
2724
			$comment_author_url_label = Grunion_Contact_Form_Plugin::strip_tags( $field->get_attribute( 'label' ) );
2725
		}
2726
2727
		if ( isset( $field_ids['textarea'] ) ) {
2728
			$field                 = $this->fields[ $field_ids['textarea'] ];
2729
			$comment_content       = trim( Grunion_Contact_Form_Plugin::strip_tags( $field->value ) );
2730
			$comment_content_label = Grunion_Contact_Form_Plugin::strip_tags( $field->get_attribute( 'label' ) );
2731
		}
2732
2733
		if ( isset( $field_ids['subject'] ) ) {
2734
			$field = $this->fields[ $field_ids['subject'] ];
2735
			if ( $field->value ) {
2736
				$contact_form_subject = Grunion_Contact_Form_Plugin::strip_tags( $field->value );
2737
			}
2738
		}
2739
2740
		if ( isset( $field_ids['consent'] ) ) {
2741
			$field = $this->fields[ $field_ids['consent'] ];
2742
			if ( $field->value ) {
2743
				$email_marketing_consent = true;
2744
			}
2745
		}
2746
2747
		$all_values = $extra_values = array();
2748
		$i          = 1; // Prefix counter for stored metadata
2749
2750
		// For all fields, grab label and value
2751
		foreach ( $field_ids['all'] as $field_id ) {
2752
			$field = $this->fields[ $field_id ];
2753
			$label = $i . '_' . $field->get_attribute( 'label' );
2754
			$value = $field->value;
2755
2756
			$all_values[ $label ] = $value;
2757
			$i++; // Increment prefix counter for the next field
2758
		}
2759
2760
		// For the "non-standard" fields, grab label and value
2761
		// Extra fields have their prefix starting from count( $all_values ) + 1
2762
		foreach ( $field_ids['extra'] as $field_id ) {
2763
			$field = $this->fields[ $field_id ];
2764
			$label = $i . '_' . $field->get_attribute( 'label' );
2765
			$value = $field->value;
2766
2767
			if ( is_array( $value ) ) {
2768
				$value = implode( ', ', $value );
2769
			}
2770
2771
			$extra_values[ $label ] = $value;
2772
			$i++; // Increment prefix counter for the next extra field
2773
		}
2774
2775
		if ( isset( $_REQUEST['is_block'] ) && $_REQUEST['is_block'] ) {
2776
			$extra_values['is_block'] = true;
2777
		}
2778
2779
		$contact_form_subject = trim( $contact_form_subject );
2780
2781
		$comment_author_IP = Grunion_Contact_Form_Plugin::get_ip_address();
2782
2783
		$vars = array( 'comment_author', 'comment_author_email', 'comment_author_url', 'contact_form_subject', 'comment_author_IP' );
2784
		foreach ( $vars as $var ) {
2785
			$$var = str_replace( array( "\n", "\r" ), '', $$var );
2786
		}
2787
2788
		// Ensure that Akismet gets all of the relevant information from the contact form,
2789
		// not just the textarea field and predetermined subject.
2790
		$akismet_vars                    = compact( $vars );
2791
		$akismet_vars['comment_content'] = $comment_content;
2792
2793
		foreach ( array_merge( $field_ids['all'], $field_ids['extra'] ) as $field_id ) {
2794
			$field = $this->fields[ $field_id ];
2795
2796
			// Skip any fields that are just a choice from a pre-defined list. They wouldn't have any value
2797
			// from a spam-filtering point of view.
2798
			if ( in_array( $field->get_attribute( 'type' ), array( 'select', 'checkbox', 'checkbox-multiple', 'radio' ) ) ) {
2799
				continue;
2800
			}
2801
2802
			// Normalize the label into a slug.
2803
			$field_slug = trim( // Strip all leading/trailing dashes.
2804
				preg_replace(   // Normalize everything to a-z0-9_-
2805
					'/[^a-z0-9_]+/',
2806
					'-',
2807
					strtolower( $field->get_attribute( 'label' ) ) // Lowercase
2808
				),
2809
				'-'
2810
			);
2811
2812
			$field_value = ( is_array( $field->value ) ) ? trim( implode( ', ', $field->value ) ) : trim( $field->value );
2813
2814
			// Skip any values that are already in the array we're sending.
2815
			if ( $field_value && in_array( $field_value, $akismet_vars ) ) {
2816
				continue;
2817
			}
2818
2819
			$akismet_vars[ 'contact_form_field_' . $field_slug ] = $field_value;
2820
		}
2821
2822
		$spam           = '';
2823
		$akismet_values = $plugin->prepare_for_akismet( $akismet_vars );
2824
2825
		// Is it spam?
2826
		/** This filter is already documented in modules/contact-form/admin.php */
2827
		$is_spam = apply_filters( 'jetpack_contact_form_is_spam', false, $akismet_values );
2828
		if ( is_wp_error( $is_spam ) ) { // WP_Error to abort
2829
			return $is_spam; // abort
2830
		} elseif ( $is_spam === true ) {  // TRUE to flag a spam
2831
			$spam = '***SPAM*** ';
2832
		}
2833
2834
		/**
2835
		 * Filter whether a submitted contact form is in the comment disallowed list.
2836
		 *
2837
		 * @module contact-form
2838
		 *
2839
		 * @since 8.9.0
2840
		 *
2841
		 * @param bool  $result         Is the submitted feedback in the disallowed list.
2842
		 * @param array $akismet_values Feedack values returned by the Akismet plugin.
2843
		 */
2844
		$in_comment_disallowed_list = apply_filters( 'jetpack_contact_form_in_comment_disallowed_list', false, $akismet_values );
2845
2846
		if ( ! $comment_author ) {
2847
			$comment_author = $comment_author_email;
2848
		}
2849
2850
		/**
2851
		 * Filter the email where a submitted feedback is sent.
2852
		 *
2853
		 * @module contact-form
2854
		 *
2855
		 * @since 1.3.1
2856
		 *
2857
		 * @param string|array $to Array of valid email addresses, or single email address.
2858
		 */
2859
		$to            = (array) apply_filters( 'contact_form_to', $to );
2860
		$reply_to_addr = $to[0]; // get just the address part before the name part is added
2861
2862
		foreach ( $to as $to_key => $to_value ) {
2863
			$to[ $to_key ] = Grunion_Contact_Form_Plugin::strip_tags( $to_value );
2864
			$to[ $to_key ] = self::add_name_to_address( $to_value );
2865
		}
2866
2867
		$blog_url        = wp_parse_url( site_url() );
2868
		$from_email_addr = 'wordpress@' . $blog_url['host'];
2869
2870
		if ( ! empty( $comment_author_email ) ) {
2871
			$reply_to_addr = $comment_author_email;
2872
		}
2873
2874
		$headers = 'From: "' . $comment_author . '" <' . $from_email_addr . ">\r\n" .
2875
		           'Reply-To: "' . $comment_author . '" <' . $reply_to_addr . ">\r\n";
2876
2877
		$all_values['email_marketing_consent'] = $email_marketing_consent;
2878
2879
		// Build feedback reference
2880
		$feedback_time  = current_time( 'mysql' );
2881
		$feedback_title = "{$comment_author} - {$feedback_time}";
2882
		$feedback_id    = md5( $feedback_title );
2883
2884
		$entry_values = array(
2885
			'entry_title'     => the_title_attribute( 'echo=0' ),
2886
			'entry_permalink' => esc_url( get_permalink( get_the_ID() ) ),
2887
			'feedback_id'     => $feedback_id,
2888
		);
2889
2890
		$all_values = array_merge( $all_values, $entry_values );
2891
2892
		/** This filter is already documented in modules/contact-form/admin.php */
2893
		$subject = apply_filters( 'contact_form_subject', $contact_form_subject, $all_values );
2894
		$url     = $widget ? home_url( '/' ) : get_permalink( $post->ID );
2895
2896
		$date_time_format = _x( '%1$s \a\t %2$s', '{$date_format} \a\t {$time_format}', 'jetpack' );
2897
		$date_time_format = sprintf( $date_time_format, get_option( 'date_format' ), get_option( 'time_format' ) );
2898
		$time             = date_i18n( $date_time_format, current_time( 'timestamp' ) );
2899
2900
		// Keep a copy of the feedback as a custom post type.
2901
		if ( $in_comment_disallowed_list ) {
2902
			$feedback_status = 'trash';
2903
		} elseif ( $is_spam ) {
2904
			$feedback_status = 'spam';
2905
		} else {
2906
			$feedback_status = 'publish';
2907
		}
2908
2909
		foreach ( (array) $akismet_values as $av_key => $av_value ) {
2910
			$akismet_values[ $av_key ] = Grunion_Contact_Form_Plugin::strip_tags( $av_value );
2911
		}
2912
2913
		foreach ( (array) $all_values as $all_key => $all_value ) {
2914
			$all_values[ $all_key ] = Grunion_Contact_Form_Plugin::strip_tags( $all_value );
2915
		}
2916
2917
		foreach ( (array) $extra_values as $ev_key => $ev_value ) {
2918
			$extra_values[ $ev_key ] = Grunion_Contact_Form_Plugin::strip_tags( $ev_value );
2919
		}
2920
2921
		/*
2922
		 We need to make sure that the post author is always zero for contact
2923
		 * form submissions.  This prevents export/import from trying to create
2924
		 * new users based on form submissions from people who were logged in
2925
		 * at the time.
2926
		 *
2927
		 * Unfortunately wp_insert_post() tries very hard to make sure the post
2928
		 * author gets the currently logged in user id.  That is how we ended up
2929
		 * with this work around. */
2930
		add_filter( 'wp_insert_post_data', array( $plugin, 'insert_feedback_filter' ), 10, 2 );
2931
2932
		$post_id = wp_insert_post(
2933
			array(
2934
				'post_date'    => addslashes( $feedback_time ),
2935
				'post_type'    => 'feedback',
2936
				'post_status'  => addslashes( $feedback_status ),
2937
				'post_parent'  => (int) $post->ID,
2938
				'post_title'   => addslashes( wp_kses( $feedback_title, array() ) ),
2939
				'post_content' => addslashes( wp_kses( $comment_content . "\n<!--more-->\n" . "AUTHOR: {$comment_author}\nAUTHOR EMAIL: {$comment_author_email}\nAUTHOR URL: {$comment_author_url}\nSUBJECT: {$subject}\nIP: {$comment_author_IP}\n" . @print_r( $all_values, true ), array() ) ), // so that search will pick up this data
2940
				'post_name'    => $feedback_id,
2941
			)
2942
		);
2943
2944
		// once insert has finished we don't need this filter any more
2945
		remove_filter( 'wp_insert_post_data', array( $plugin, 'insert_feedback_filter' ), 10 );
2946
2947
		update_post_meta( $post_id, '_feedback_extra_fields', $this->addslashes_deep( $extra_values ) );
2948
2949
		if ( 'publish' == $feedback_status ) {
2950
			// Increase count of unread feedback.
2951
			$unread = get_option( 'feedback_unread_count', 0 ) + 1;
2952
			update_option( 'feedback_unread_count', $unread );
2953
		}
2954
2955
		if ( defined( 'AKISMET_VERSION' ) ) {
2956
			update_post_meta( $post_id, '_feedback_akismet_values', $this->addslashes_deep( $akismet_values ) );
2957
		}
2958
2959
		/**
2960
		 * Fires after the feedback post for the contact form submission has been inserted.
2961
		 *
2962
		 * @module contact-form
2963
		 *
2964
		 * @since 8.6.0
2965
		 *
2966
		 * @param integer $post_id The post id that contains the contact form data.
2967
		 * @param array   $this->fields An array containg the form's Grunion_Contact_Form_Field objects.
2968
		 * @param boolean $is_spam Whether the form submission has been identified as spam.
2969
		 * @param array   $entry_values The feedback entry values.
2970
		 */
2971
		do_action( 'grunion_after_feedback_post_inserted', $post_id, $this->fields, $is_spam, $entry_values );
2972
2973
		$message = self::get_compiled_form( $post_id, $this );
2974
2975
		array_push(
2976
			$message,
2977
			'<br />',
2978
			'<hr />',
2979
			__( 'Time:', 'jetpack' ) . ' ' . $time . '<br />',
2980
			__( 'IP Address:', 'jetpack' ) . ' ' . $comment_author_IP . '<br />',
2981
			__( 'Contact Form URL:', 'jetpack' ) . ' ' . $url . '<br />'
2982
		);
2983
2984
		if ( is_user_logged_in() ) {
2985
			array_push(
2986
				$message,
2987
				sprintf(
2988
					'<p>' . __( 'Sent by a verified %s user.', 'jetpack' ) . '</p>',
2989
					isset( $GLOBALS['current_site']->site_name ) && $GLOBALS['current_site']->site_name ?
2990
						$GLOBALS['current_site']->site_name : '"' . get_option( 'blogname' ) . '"'
2991
				)
2992
			);
2993
		} else {
2994
			array_push( $message, '<p>' . __( 'Sent by an unverified visitor to your site.', 'jetpack' ) . '</p>' );
2995
		}
2996
2997
		$message = join( '', $message );
2998
2999
		/**
3000
		 * Filters the message sent via email after a successful form submission.
3001
		 *
3002
		 * @module contact-form
3003
		 *
3004
		 * @since 1.3.1
3005
		 *
3006
		 * @param string $message Feedback email message.
3007
		 */
3008
		$message = apply_filters( 'contact_form_message', $message );
3009
3010
		// This is called after `contact_form_message`, in order to preserve back-compat
3011
		$message = self::wrap_message_in_html_tags( $message );
3012
3013
		update_post_meta( $post_id, '_feedback_email', $this->addslashes_deep( compact( 'to', 'message' ) ) );
3014
3015
		/**
3016
		 * Fires right before the contact form message is sent via email to
3017
		 * the recipient specified in the contact form.
3018
		 *
3019
		 * @module contact-form
3020
		 *
3021
		 * @since 1.3.1
3022
		 *
3023
		 * @param integer $post_id Post contact form lives on
3024
		 * @param array $all_values Contact form fields
3025
		 * @param array $extra_values Contact form fields not included in $all_values
3026
		 */
3027
		do_action( 'grunion_pre_message_sent', $post_id, $all_values, $extra_values );
3028
3029
		// schedule deletes of old spam feedbacks
3030
		if ( ! wp_next_scheduled( 'grunion_scheduled_delete' ) ) {
3031
			wp_schedule_event( time() + 250, 'daily', 'grunion_scheduled_delete' );
3032
		}
3033
3034
		if (
3035
			$is_spam !== true &&
3036
			/**
3037
			 * Filter to choose whether an email should be sent after each successful contact form submission.
3038
			 *
3039
			 * @module contact-form
3040
			 *
3041
			 * @since 2.6.0
3042
			 *
3043
			 * @param bool true Should an email be sent after a form submission. Default to true.
3044
			 * @param int $post_id Post ID.
3045
			 */
3046
			true === apply_filters( 'grunion_should_send_email', true, $post_id )
3047
		) {
3048
			self::wp_mail( $to, "{$spam}{$subject}", $message, $headers );
3049
		} elseif (
3050
			true === $is_spam &&
3051
			/**
3052
			 * Choose whether an email should be sent for each spam contact form submission.
3053
			 *
3054
			 * @module contact-form
3055
			 *
3056
			 * @since 1.3.1
3057
			 *
3058
			 * @param bool false Should an email be sent after a spam form submission. Default to false.
3059
			 */
3060
			apply_filters( 'grunion_still_email_spam', false ) == true
3061
		) { // don't send spam by default.  Filterable.
3062
			self::wp_mail( $to, "{$spam}{$subject}", $message, $headers );
3063
		}
3064
3065
		/**
3066
		 * Fires an action hook right after the email(s) have been sent.
3067
		 *
3068
		 * @module contact-form
3069
		 *
3070
		 * @since 7.3.0
3071
		 *
3072
		 * @param int $post_id Post contact form lives on.
3073
		 * @param string|array $to Array of valid email addresses, or single email address.
3074
		 * @param string $subject Feedback email subject.
3075
		 * @param string $message Feedback email message.
3076
		 * @param string|array $headers Optional. Additional headers.
3077
		 * @param array $all_values Contact form fields.
3078
		 * @param array $extra_values Contact form fields not included in $all_values
3079
		 */
3080
		do_action( 'grunion_after_message_sent', $post_id, $to, $subject, $message, $headers, $all_values, $extra_values );
3081
3082
		if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
3083
			return self::success_message( $post_id, $this );
3084
		}
3085
3086
		$redirect = '';
3087
		$custom_redirect = false;
3088
		if ( 'redirect' === $this->get_attribute( 'customThankyou' ) ) {
3089
			$custom_redirect = true;
3090
			$redirect        = esc_url( $this->get_attribute( 'customThankyouRedirect' ) );
3091
		}
3092
3093
		if ( ! $redirect ) {
3094
			$custom_redirect = false;
3095
			$redirect        = wp_get_referer();
3096
		}
3097
3098
		if ( ! $redirect ) { // wp_get_referer() returns false if the referer is the same as the current page.
3099
			$custom_redirect = false;
3100
			$redirect        = $_SERVER['REQUEST_URI'];
3101
		}
3102
3103
		if ( ! $custom_redirect ) {
3104
			$redirect = add_query_arg(
3105
				urlencode_deep(
3106
					array(
3107
						'contact-form-id'   => $id,
3108
						'contact-form-sent' => $post_id,
3109
						'contact-form-hash' => $this->hash,
3110
						'_wpnonce'          => wp_create_nonce( "contact-form-sent-{$post_id}" ), // wp_nonce_url HTMLencodes :( .
3111
					)
3112
				),
3113
				$redirect
3114
			);
3115
		}
3116
3117
		/**
3118
		 * Filter the URL where the reader is redirected after submitting a form.
3119
		 *
3120
		 * @module contact-form
3121
		 *
3122
		 * @since 1.9.0
3123
		 *
3124
		 * @param string $redirect Post submission URL.
3125
		 * @param int $id Contact Form ID.
3126
		 * @param int $post_id Post ID.
3127
		 */
3128
		$redirect = apply_filters( 'grunion_contact_form_redirect_url', $redirect, $id, $post_id );
3129
3130
		// phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- We intentially allow external redirects here.
3131
		wp_redirect( $redirect );
3132
		exit;
3133
	}
3134
3135
	/**
3136
	 * Wrapper for wp_mail() that enables HTML messages with text alternatives
3137
	 *
3138
	 * @param string|array $to          Array or comma-separated list of email addresses to send message.
3139
	 * @param string       $subject     Email subject.
3140
	 * @param string       $message     Message contents.
3141
	 * @param string|array $headers     Optional. Additional headers.
3142
	 * @param string|array $attachments Optional. Files to attach.
3143
	 *
3144
	 * @return bool Whether the email contents were sent successfully.
3145
	 */
3146
	public static function wp_mail( $to, $subject, $message, $headers = '', $attachments = array() ) {
3147
		add_filter( 'wp_mail_content_type', __CLASS__ . '::get_mail_content_type' );
3148
		add_action( 'phpmailer_init', __CLASS__ . '::add_plain_text_alternative' );
3149
3150
		$result = wp_mail( $to, $subject, $message, $headers, $attachments );
3151
3152
		remove_filter( 'wp_mail_content_type', __CLASS__ . '::get_mail_content_type' );
3153
		remove_action( 'phpmailer_init', __CLASS__ . '::add_plain_text_alternative' );
3154
3155
		return $result;
3156
	}
3157
3158
	/**
3159
	 * Add a display name part to an email address
3160
	 *
3161
	 * SpamAssassin doesn't like addresses in HTML messages that are missing display names (e.g., `[email protected]`
3162
	 * instead of `"Foo Bar" <[email protected]>`.
3163
	 *
3164
	 * @param string $address
3165
	 *
3166
	 * @return string
3167
	 */
3168
	function add_name_to_address( $address ) {
3169
		// If it's just the address, without a display name
3170
		if ( is_email( $address ) ) {
3171
			$address_parts = explode( '@', $address );
3172
			$address       = sprintf( '"%s" <%s>', $address_parts[0], $address );
3173
		}
3174
3175
		return $address;
3176
	}
3177
3178
	/**
3179
	 * Get the content type that should be assigned to outbound emails
3180
	 *
3181
	 * @return string
3182
	 */
3183
	static function get_mail_content_type() {
3184
		return 'text/html';
3185
	}
3186
3187
	/**
3188
	 * Wrap a message body with the appropriate in HTML tags
3189
	 *
3190
	 * This helps to ensure correct parsing by clients, and also helps avoid triggering spam filtering rules
3191
	 *
3192
	 * @param string $body
3193
	 *
3194
	 * @return string
3195
	 */
3196
	static function wrap_message_in_html_tags( $body ) {
3197
		// Don't do anything if the message was already wrapped in HTML tags
3198
		// That could have be done by a plugin via filters
3199
		if ( false !== strpos( $body, '<html' ) ) {
3200
			return $body;
3201
		}
3202
3203
		$html_message = sprintf(
3204
			// The tabs are just here so that the raw code is correctly formatted for developers
3205
			// They're removed so that they don't affect the final message sent to users
3206
			str_replace(
3207
				"\t", '',
3208
				'<!doctype html>
3209
				<html xmlns="http://www.w3.org/1999/xhtml">
3210
				<body>
3211
3212
				%s
3213
3214
				</body>
3215
				</html>'
3216
			),
3217
			$body
3218
		);
3219
3220
		return $html_message;
3221
	}
3222
3223
	/**
3224
	 * Add a plain-text alternative part to an outbound email
3225
	 *
3226
	 * This makes the message more accessible to mail clients that aren't HTML-aware, and decreases the likelihood
3227
	 * that the message will be flagged as spam.
3228
	 *
3229
	 * @param PHPMailer $phpmailer
3230
	 */
3231
	static function add_plain_text_alternative( $phpmailer ) {
3232
		// Add an extra break so that the extra space above the <p> is preserved after the <p> is stripped out
3233
		$alt_body = str_replace( '<p>', '<p><br />', $phpmailer->Body );
3234
3235
		// Convert <br> to \n breaks, to preserve the space between lines that we want to keep
3236
		$alt_body = str_replace( array( '<br>', '<br />' ), "\n", $alt_body );
3237
3238
		// Convert <hr> to an plain-text equivalent, to preserve the integrity of the message
3239
		$alt_body = str_replace( array( '<hr>', '<hr />' ), "----\n", $alt_body );
3240
3241
		// Trim the plain text message to remove the \n breaks that were after <doctype>, <html>, and <body>
3242
		$phpmailer->AltBody = trim( strip_tags( $alt_body ) );
3243
	}
3244
3245
	function addslashes_deep( $value ) {
3246
		if ( is_array( $value ) ) {
3247
			return array_map( array( $this, 'addslashes_deep' ), $value );
3248
		} elseif ( is_object( $value ) ) {
3249
			$vars = get_object_vars( $value );
3250
			foreach ( $vars as $key => $data ) {
3251
				$value->{$key} = $this->addslashes_deep( $data );
3252
			}
3253
			return $value;
3254
		}
3255
3256
		return addslashes( $value );
3257
	}
3258
3259
} // end class Grunion_Contact_Form
3260
3261
/**
3262
 * Class for the contact-field shortcode.
3263
 * Parses shortcode to output the contact form field as HTML.
3264
 * Validates input.
3265
 */
3266
class Grunion_Contact_Form_Field extends Crunion_Contact_Form_Shortcode {
3267
	public $shortcode_name = 'contact-field';
3268
3269
	/**
3270
	 * @var Grunion_Contact_Form parent form
3271
	 */
3272
	public $form;
3273
3274
	/**
3275
	 * @var string default or POSTed value
3276
	 */
3277
	public $value;
3278
3279
	/**
3280
	 * @var bool Is the input invalid?
3281
	 */
3282
	public $error = false;
3283
3284
	/**
3285
	 * @param array                $attributes An associative array of shortcode attributes.  @see shortcode_atts()
3286
	 * @param null|string          $content Null for selfclosing shortcodes.  The inner content otherwise.
3287
	 * @param Grunion_Contact_Form $form The parent form
3288
	 */
3289
	function __construct( $attributes, $content = null, $form = null ) {
3290
		$attributes = shortcode_atts(
3291
			array(
3292
				'label'                  => null,
3293
				'type'                   => 'text',
3294
				'required'               => false,
3295
				'options'                => array(),
3296
				'id'                     => null,
3297
				'default'                => null,
3298
				'values'                 => null,
3299
				'placeholder'            => null,
3300
				'class'                  => null,
3301
				'width'                  => null,
3302
				'consenttype'            => null,
3303
				'implicitconsentmessage' => null,
3304
				'explicitconsentmessage' => null,
3305
			), $attributes, 'contact-field'
3306
		);
3307
3308
		// special default for subject field
3309
		if ( 'subject' == $attributes['type'] && is_null( $attributes['default'] ) && ! is_null( $form ) ) {
3310
			$attributes['default'] = $form->get_attribute( 'subject' );
3311
		}
3312
3313
		// allow required=1 or required=true
3314
		if ( '1' == $attributes['required'] || 'true' == strtolower( $attributes['required'] ) ) {
3315
			$attributes['required'] = true;
3316
		} else {
3317
			$attributes['required'] = false;
3318
		}
3319
3320
		// parse out comma-separated options list (for selects, radios, and checkbox-multiples)
3321
		if ( ! empty( $attributes['options'] ) && is_string( $attributes['options'] ) ) {
3322
			$attributes['options'] = array_map( 'trim', explode( ',', $attributes['options'] ) );
3323
3324
			if ( ! empty( $attributes['values'] ) && is_string( $attributes['values'] ) ) {
3325
				$attributes['values'] = array_map( 'trim', explode( ',', $attributes['values'] ) );
3326
			}
3327
		}
3328
3329
		if ( $form ) {
3330
			// make a unique field ID based on the label, with an incrementing number if needed to avoid clashes
3331
			$form_id = $form->get_attribute( 'id' );
3332
			$id      = isset( $attributes['id'] ) ? $attributes['id'] : false;
3333
3334
			$unescaped_label = $this->unesc_attr( $attributes['label'] );
3335
			$unescaped_label = str_replace( '%', '-', $unescaped_label ); // jQuery doesn't like % in IDs?
3336
			$unescaped_label = preg_replace( '/[^a-zA-Z0-9.-_:]/', '', $unescaped_label );
3337
3338
			if ( empty( $id ) ) {
3339
				$id        = sanitize_title_with_dashes( 'g' . $form_id . '-' . $unescaped_label );
3340
				$i         = 0;
3341
				$max_tries = 99;
3342
				while ( isset( $form->fields[ $id ] ) ) {
3343
					$i++;
3344
					$id = sanitize_title_with_dashes( 'g' . $form_id . '-' . $unescaped_label . '-' . $i );
3345
3346
					if ( $i > $max_tries ) {
3347
						break;
3348
					}
3349
				}
3350
			}
3351
3352
			$attributes['id'] = $id;
3353
		}
3354
3355
		parent::__construct( $attributes, $content );
3356
3357
		// Store parent form
3358
		$this->form = $form;
3359
	}
3360
3361
	/**
3362
	 * This field's input is invalid.  Flag as invalid and add an error to the parent form
3363
	 *
3364
	 * @param string $message The error message to display on the form.
3365
	 */
3366
	function add_error( $message ) {
3367
		$this->is_error = true;
3368
3369
		if ( ! is_wp_error( $this->form->errors ) ) {
3370
			$this->form->errors = new WP_Error;
3371
		}
3372
3373
		$this->form->errors->add( $this->get_attribute( 'id' ), $message );
3374
	}
3375
3376
	/**
3377
	 * Is the field input invalid?
3378
	 *
3379
	 * @see $error
3380
	 *
3381
	 * @return bool
3382
	 */
3383
	function is_error() {
3384
		return $this->error;
3385
	}
3386
3387
	/**
3388
	 * Validates the form input
3389
	 */
3390
	function validate() {
3391
		// If it's not required, there's nothing to validate
3392
		if ( ! $this->get_attribute( 'required' ) ) {
3393
			return;
3394
		}
3395
3396
		$field_id    = $this->get_attribute( 'id' );
3397
		$field_type  = $this->get_attribute( 'type' );
3398
		$field_label = $this->get_attribute( 'label' );
3399
3400
		if ( isset( $_POST[ $field_id ] ) ) {
3401
			if ( is_array( $_POST[ $field_id ] ) ) {
3402
				$field_value = array_map( 'stripslashes', $_POST[ $field_id ] );
3403
			} else {
3404
				$field_value = stripslashes( $_POST[ $field_id ] );
3405
			}
3406
		} else {
3407
			$field_value = '';
3408
		}
3409
3410
		switch ( $field_type ) {
3411
			case 'email':
3412
				// Make sure the email address is valid
3413
				if ( ! is_string( $field_value ) || ! is_email( $field_value ) ) {
3414
					/* translators: %s is the name of a form field */
3415
					$this->add_error( sprintf( __( '%s requires a valid email address', 'jetpack' ), $field_label ) );
3416
				}
3417
				break;
3418
			case 'checkbox-multiple':
3419
				// Check that there is at least one option selected
3420
				if ( empty( $field_value ) ) {
3421
					/* translators: %s is the name of a form field */
3422
					$this->add_error( sprintf( __( '%s requires at least one selection', 'jetpack' ), $field_label ) );
3423
				}
3424
				break;
3425
			default:
3426
				// Just check for presence of any text
3427
				if ( ! is_string( $field_value ) || ! strlen( trim( $field_value ) ) ) {
3428
					/* translators: %s is the name of a form field */
3429
					$this->add_error( sprintf( __( '%s is required', 'jetpack' ), $field_label ) );
3430
				}
3431
		}
3432
	}
3433
3434
3435
	/**
3436
	 * Check the default value for options field
3437
	 *
3438
	 * @param string value
3439
	 * @param int index
3440
	 * @param string default value
3441
	 *
3442
	 * @return string
3443
	 */
3444
	public function get_option_value( $value, $index, $options ) {
3445
		if ( empty( $value[ $index ] ) ) {
3446
			return $options;
3447
		}
3448
		return $value[ $index ];
3449
	}
3450
3451
	/**
3452
	 * Outputs the HTML for this form field
3453
	 *
3454
	 * @return string HTML
3455
	 */
3456
	function render() {
3457
		global $current_user, $user_identity;
3458
3459
		$field_id          = $this->get_attribute( 'id' );
3460
		$field_type        = $this->get_attribute( 'type' );
3461
		$field_label       = $this->get_attribute( 'label' );
3462
		$field_required    = $this->get_attribute( 'required' );
3463
		$field_placeholder = $this->get_attribute( 'placeholder' );
3464
		$field_width       = $this->get_attribute( 'width' );
3465
		$class             = 'date' === $field_type ? 'jp-contact-form-date' : $this->get_attribute( 'class' );
3466
3467
		if ( ! empty( $field_width ) ) {
3468
			$class .= ' grunion-field-width-' . $field_width;
3469
		}
3470
3471
		/**
3472
		 * Filters the "class" attribute of the contact form input
3473
		 *
3474
		 * @module contact-form
3475
		 *
3476
		 * @since 6.6.0
3477
		 *
3478
		 * @param string $class Additional CSS classes for input class attribute.
3479
		 */
3480
		$field_class = apply_filters( 'jetpack_contact_form_input_class', $class );
3481
3482
		if ( isset( $_POST[ $field_id ] ) ) {
3483
			if ( is_array( $_POST[ $field_id ] ) ) {
3484
				$this->value = array_map( 'stripslashes', $_POST[ $field_id ] );
3485
			} else {
3486
				$this->value = stripslashes( (string) $_POST[ $field_id ] );
3487
			}
3488
		} elseif ( isset( $_GET[ $field_id ] ) ) {
3489
			$this->value = stripslashes( (string) $_GET[ $field_id ] );
3490
		} elseif (
3491
			is_user_logged_in() &&
3492
			( ( defined( 'IS_WPCOM' ) && IS_WPCOM ) ||
3493
			  /**
3494
			   * Allow third-party tools to prefill the contact form with the user's details when they're logged in.
3495
			   *
3496
			   * @module contact-form
3497
			   *
3498
			   * @since 3.2.0
3499
			   *
3500
			   * @param bool false Should the Contact Form be prefilled with your details when you're logged in. Default to false.
3501
			   */
3502
			  true === apply_filters( 'jetpack_auto_fill_logged_in_user', false )
3503
			)
3504
		) {
3505
			// Special defaults for logged-in users
3506
			switch ( $this->get_attribute( 'type' ) ) {
3507
				case 'email':
3508
					$this->value = $current_user->data->user_email;
3509
					break;
3510
				case 'name':
3511
					$this->value = $user_identity;
3512
					break;
3513
				case 'url':
3514
					$this->value = $current_user->data->user_url;
3515
					break;
3516
				default:
3517
					$this->value = $this->get_attribute( 'default' );
3518
			}
3519
		} else {
3520
			$this->value = $this->get_attribute( 'default' );
3521
		}
3522
3523
		$field_value = Grunion_Contact_Form_Plugin::strip_tags( $this->value );
3524
		$field_label = Grunion_Contact_Form_Plugin::strip_tags( $field_label );
3525
3526
		$rendered_field = $this->render_field( $field_type, $field_id, $field_label, $field_value, $field_class, $field_placeholder, $field_required );
3527
3528
		/**
3529
		 * Filter the HTML of the Contact Form.
3530
		 *
3531
		 * @module contact-form
3532
		 *
3533
		 * @since 2.6.0
3534
		 *
3535
		 * @param string $rendered_field Contact Form HTML output.
3536
		 * @param string $field_label Field label.
3537
		 * @param int|null $id Post ID.
3538
		 */
3539
		return apply_filters( 'grunion_contact_form_field_html', $rendered_field, $field_label, ( in_the_loop() ? get_the_ID() : null ) );
3540
	}
3541
3542
	public function render_label( $type, $id, $label, $required, $required_field_text ) {
3543
3544
		$type_class = $type ? ' ' .$type : '';
3545
		return
3546
			"<label
3547
				for='" . esc_attr( $id ) . "'
3548
				class='grunion-field-label{$type_class}" . ( $this->is_error() ? ' form-error' : '' ) . "'
3549
				>"
3550
				. esc_html( $label )
3551
				. ( $required ? '<span>' . $required_field_text . '</span>' : '' )
3552
			. "</label>\n";
3553
3554
	}
3555
3556
	function render_input_field( $type, $id, $value, $class, $placeholder, $required ) {
3557
		return "<input
3558
					type='". esc_attr( $type ) ."'
3559
					name='" . esc_attr( $id ) . "'
3560
					id='" . esc_attr( $id ) . "'
3561
					value='" . esc_attr( $value ) . "'
3562
					" . $class . $placeholder . '
3563
					' . ( $required ? "required aria-required='true'" : '' ) . "
3564
				/>\n";
3565
	}
3566
3567
	function render_email_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder ) {
3568
		$field = $this->render_label( 'email', $id, $label, $required, $required_field_text );
3569
		$field .= $this->render_input_field( 'email', $id, $value, $class, $placeholder, $required );
3570
		return $field;
3571
	}
3572
3573
	function render_telephone_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder ) {
3574
		$field = $this->render_label( 'telephone', $id, $label, $required, $required_field_text );
3575
		$field .= $this->render_input_field( 'tel', $id, $value, $class, $placeholder, $required );
3576
		return $field;
3577
	}
3578
3579
	function render_url_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder ) {
3580
		$field = $this->render_label( 'url', $id, $label, $required, $required_field_text );
3581
		$field .= $this->render_input_field( 'url', $id, $value, $class, $placeholder, $required );
3582
		return $field;
3583
	}
3584
3585
	function render_textarea_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder ) {
3586
		$field = $this->render_label( 'textarea', 'contact-form-comment-' . $id, $label, $required, $required_field_text );
3587
		$field .= "<textarea
3588
		                name='" . esc_attr( $id ) . "'
3589
		                id='contact-form-comment-" . esc_attr( $id ) . "'
3590
		                rows='20' "
3591
		                . $class
3592
		                . $placeholder
3593
		                . ' ' . ( $required ? "required aria-required='true'" : '' ) .
3594
		                '>' . esc_textarea( $value )
3595
		          . "</textarea>\n";
3596
		return $field;
3597
	}
3598
3599
	function render_radio_field( $id, $label, $value, $class, $required, $required_field_text ) {
3600
		$field = $this->render_label( '', $id, $label, $required, $required_field_text );
3601
		foreach ( (array) $this->get_attribute( 'options' ) as $optionIndex => $option ) {
3602
			$option = Grunion_Contact_Form_Plugin::strip_tags( $option );
3603
			if ( $option ) {
3604
				$field .= "\t\t<label class='grunion-radio-label radio" . ( $this->is_error() ? ' form-error' : '' ) . "'>";
3605
				$field .= "<input
3606
									type='radio'
3607
									name='" . esc_attr( $id ) . "'
3608
									value='" . esc_attr( $this->get_option_value( $this->get_attribute( 'values' ), $optionIndex, $option ) ) . "' "
3609
				                    . $class
3610
				                    . checked( $option, $value, false ) . ' '
3611
				                    . ( $required ? "required aria-required='true'" : '' )
3612
				              . '/> ';
3613
				$field .= esc_html( $option ) . "</label>\n";
3614
				$field .= "\t\t<div class='clear-form'></div>\n";
3615
			}
3616
		}
3617
		return $field;
3618
	}
3619
3620
	function render_checkbox_field( $id, $label, $value, $class, $required, $required_field_text ) {
3621
		$field = "<label class='grunion-field-label checkbox" . ( $this->is_error() ? ' form-error' : '' ) . "'>";
3622
			$field .= "\t\t<input type='checkbox' name='" . esc_attr( $id ) . "' value='" . esc_attr__( 'Yes', 'jetpack' ) . "' " . $class . checked( (bool) $value, true, false ) . ' ' . ( $required ? "required aria-required='true'" : '' ) . "/> \n";
3623
			$field .= "\t\t" . esc_html( $label ) . ( $required ? '<span>' . $required_field_text . '</span>' : '' );
3624
		$field .=  "</label>\n";
3625
		$field .= "<div class='clear-form'></div>\n";
3626
		return $field;
3627
	}
3628
3629
	/**
3630
	 * Render the consent field.
3631
	 *
3632
	 * @param string $id field id.
3633
	 * @param string $class html classes (can be set by the admin).
3634
	 */
3635
	private function render_consent_field( $id, $class ) {
3636
		$consent_type    = 'explicit' === $this->get_attribute( 'consenttype' ) ? 'explicit' : 'implicit';
3637
		$consent_message = 'explicit' === $consent_type ? $this->get_attribute( 'explicitconsentmessage' ) : $this->get_attribute( 'implicitconsentmessage' );
3638
3639
		$field  = "<label class='grunion-field-label consent consent-" . $consent_type . "'>";
3640
3641
		if ( 'implicit' === $consent_type ) {
3642
			$field .= "\t\t<input aria-hidden='true' type='checkbox' checked name='" . esc_attr( $id ) . "' value='" . esc_attr__( 'Yes', 'jetpack' ) . "' style='display:none;' /> \n";
3643
		} else {
3644
			$field .= "\t\t<input type='checkbox' name='" . esc_attr( $id ) . "' value='" . esc_attr__( 'Yes', 'jetpack' ) . "' " . $class . "/> \n";
3645
		}
3646
		$field .= "\t\t" . esc_html( $consent_message );
3647
		$field .= "</label>\n";
3648
		$field .= "<div class='clear-form'></div>\n";
3649
		return $field;
3650
	}
3651
3652
	function render_checkbox_multiple_field( $id, $label, $value, $class, $required, $required_field_text  ) {
3653
		$field = $this->render_label( '', $id, $label, $required, $required_field_text );
3654
		foreach ( (array) $this->get_attribute( 'options' ) as $optionIndex => $option ) {
3655
			$option = Grunion_Contact_Form_Plugin::strip_tags( $option );
3656
			if ( $option  ) {
3657
				$field .= "\t\t<label class='grunion-checkbox-multiple-label checkbox-multiple" . ( $this->is_error() ? ' form-error' : '' ) . "'>";
3658
				$field .= "<input type='checkbox' name='" . esc_attr( $id ) . "[]' value='" . esc_attr( $this->get_option_value( $this->get_attribute( 'values' ), $optionIndex, $option ) ) . "' " . $class . checked( in_array( $option, (array) $value ), true, false ) . ' /> ';
3659
				$field .= esc_html( $option ) . "</label>\n";
3660
				$field .= "\t\t<div class='clear-form'></div>\n";
3661
			}
3662
		}
3663
3664
		return $field;
3665
	}
3666
3667
	function render_select_field( $id, $label, $value, $class, $required, $required_field_text ) {
3668
		$field = $this->render_label( 'select', $id, $label, $required, $required_field_text );
3669
		$field  .= "\t<select name='" . esc_attr( $id ) . "' id='" . esc_attr( $id ) . "' " . $class . ( $required ? "required aria-required='true'" : '' ) . ">\n";
3670
		foreach ( (array) $this->get_attribute( 'options' ) as $optionIndex => $option ) {
3671
			$option = Grunion_Contact_Form_Plugin::strip_tags( $option );
3672
			if ( $option ) {
3673
				$field .= "\t\t<option"
3674
				               . selected( $option, $value, false )
3675
				               . " value='" . esc_attr( $this->get_option_value( $this->get_attribute( 'values' ), $optionIndex, $option ) )
3676
				               . "'>" . esc_html( $option )
3677
				          . "</option>\n";
3678
			}
3679
		}
3680
		$field  .= "\t</select>\n";
3681
		return $field;
3682
	}
3683
3684
	function render_date_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder ) {
3685
3686
		$field = $this->render_label( 'date', $id, $label, $required, $required_field_text );
3687
		$field .= $this->render_input_field( 'text', $id, $value, $class, $placeholder, $required );
3688
3689
		/* For AMP requests, use amp-date-picker element: https://amp.dev/documentation/components/amp-date-picker */
3690
		if ( class_exists( 'Jetpack_AMP_Support' ) && Jetpack_AMP_Support::is_amp_request() ) {
3691
			return sprintf(
3692
				'<%1$s mode="overlay" layout="container" type="single" input-selector="[name=%2$s]">%3$s</%1$s>',
3693
				'amp-date-picker',
3694
				esc_attr( $id ),
3695
				$field
3696
			);
3697
		}
3698
3699
		wp_enqueue_script(
3700
			'grunion-frontend',
3701
			Assets::get_file_url_for_environment(
3702
				'_inc/build/contact-form/js/grunion-frontend.min.js',
3703
				'modules/contact-form/js/grunion-frontend.js'
3704
			),
3705
			array( 'jquery', 'jquery-ui-datepicker' )
3706
		);
3707
		wp_enqueue_style( 'jp-jquery-ui-datepicker', plugins_url( 'css/jquery-ui-datepicker.css', __FILE__ ), array( 'dashicons' ), '1.0' );
3708
3709
		// Using Core's built-in datepicker localization routine
3710
		wp_localize_jquery_ui_datepicker();
3711
		return $field;
3712
	}
3713
3714
	function render_default_field( $id, $label, $value, $class, $required, $required_field_text, $placeholder, $type ) {
3715
		$field = $this->render_label( $type, $id, $label, $required, $required_field_text );
3716
		$field .= $this->render_input_field( 'text', $id, $value, $class, $placeholder, $required );
3717
		return $field;
3718
	}
3719
3720
	function render_field( $type, $id, $label, $value, $class, $placeholder, $required ) {
3721
3722
		$field_placeholder = ( ! empty( $placeholder ) ) ? "placeholder='" . esc_attr( $placeholder ) . "'" : '';
3723
		$field_class       = "class='" . trim( esc_attr( $type ) . ' ' . esc_attr( $class ) ) . "' ";
3724
		$wrap_classes = empty( $class ) ? '' : implode( '-wrap ', array_filter( explode( ' ', $class ) ) ) . '-wrap'; // this adds
3725
3726
		$shell_field_class = "class='grunion-field-wrap grunion-field-" . trim( esc_attr( $type ) . '-wrap ' . esc_attr( $wrap_classes ) ) . "' ";
3727
		/**
3728
		/**
3729
		 * Filter the Contact Form required field text
3730
		 *
3731
		 * @module contact-form
3732
		 *
3733
		 * @since 3.8.0
3734
		 *
3735
		 * @param string $var Required field text. Default is "(required)".
3736
		 */
3737
		$required_field_text = esc_html( apply_filters( 'jetpack_required_field_text', __( '(required)', 'jetpack' ) ) );
3738
3739
		$field = "\n<div {$shell_field_class} >\n"; // new in Jetpack 6.8.0
3740
		// If they are logged in, and this is their site, don't pre-populate fields
3741
		if ( current_user_can( 'manage_options' ) ) {
3742
			$value = '';
3743
		}
3744
		switch ( $type ) {
3745
			case 'email':
3746
				$field .= $this->render_email_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3747
				break;
3748
			case 'telephone':
3749
				$field .= $this->render_telephone_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3750
				break;
3751
			case 'url':
3752
				$field .= $this->render_url_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3753
				break;
3754
			case 'textarea':
3755
				$field .= $this->render_textarea_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3756
				break;
3757
			case 'radio':
3758
				$field .= $this->render_radio_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3759
				break;
3760
			case 'checkbox':
3761
				$field .= $this->render_checkbox_field( $id, $label, $value, $field_class, $required, $required_field_text );
3762
				break;
3763
			case 'checkbox-multiple':
3764
				$field .= $this->render_checkbox_multiple_field( $id, $label, $value, $field_class, $required, $required_field_text );
3765
				break;
3766
			case 'select':
3767
				$field .= $this->render_select_field( $id, $label, $value, $field_class, $required, $required_field_text );
3768
				break;
3769
			case 'date':
3770
				$field .= $this->render_date_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder );
3771
				break;
3772
			case 'consent':
3773
				$field .= $this->render_consent_field( $id, $field_class );
3774
				break;
3775
			default: // text field
3776
				$field .= $this->render_default_field( $id, $label, $value, $field_class, $required, $required_field_text, $field_placeholder, $type );
3777
				break;
3778
		}
3779
		$field .= "\t</div>\n";
3780
		return $field;
3781
	}
3782
}
3783
3784
add_action( 'init', array( 'Grunion_Contact_Form_Plugin', 'init' ), 9 );
3785
3786
add_action( 'grunion_scheduled_delete', 'grunion_delete_old_spam' );
3787
3788
/**
3789
 * Deletes old spam feedbacks to keep the posts table size under control
3790
 */
3791
function grunion_delete_old_spam() {
3792
	global $wpdb;
3793
3794
	$grunion_delete_limit = 100;
3795
3796
	$now_gmt  = current_time( 'mysql', 1 );
3797
	$sql      = $wpdb->prepare(
3798
		"
3799
		SELECT `ID`
3800
		FROM $wpdb->posts
3801
		WHERE DATE_SUB( %s, INTERVAL 15 DAY ) > `post_date_gmt`
3802
			AND `post_type` = 'feedback'
3803
			AND `post_status` = 'spam'
3804
		LIMIT %d
3805
	", $now_gmt, $grunion_delete_limit
3806
	);
3807
	$post_ids = $wpdb->get_col( $sql );
3808
3809
	foreach ( (array) $post_ids as $post_id ) {
3810
		// force a full delete, skip the trash
3811
		wp_delete_post( $post_id, true );
3812
	}
3813
3814
	if (
3815
		/**
3816
		 * Filter if the module run OPTIMIZE TABLE on the core WP tables.
3817
		 *
3818
		 * @module contact-form
3819
		 *
3820
		 * @since 1.3.1
3821
		 * @since 6.4.0 Set to false by default.
3822
		 *
3823
		 * @param bool $filter Should Jetpack optimize the table, defaults to false.
3824
		 */
3825
		apply_filters( 'grunion_optimize_table', false )
3826
	) {
3827
		$wpdb->query( "OPTIMIZE TABLE $wpdb->posts" );
3828
	}
3829
3830
	// if we hit the max then schedule another run
3831
	if ( count( $post_ids ) >= $grunion_delete_limit ) {
3832
		wp_schedule_single_event( time() + 700, 'grunion_scheduled_delete' );
3833
	}
3834
}
3835
3836
/**
3837
 * Send an event to Tracks on form submission.
3838
 *
3839
 * @param int   $post_id - the post_id for the CPT that is created.
3840
 * @param array $all_values - fields from the default contact form.
3841
 * @param array $extra_values - extra fields added to from the contact form.
3842
 *
3843
 * @return null|void
3844
 */
3845
function jetpack_tracks_record_grunion_pre_message_sent( $post_id, $all_values, $extra_values ) {
3846
	// Do not do anything if the submission is not from a block.
3847
	if (
3848
		! isset( $extra_values['is_block'] )
3849
		|| ! $extra_values['is_block']
3850
	) {
3851
		return;
3852
	}
3853
3854
	/*
3855
	 * Event details.
3856
	 */
3857
	$event_user  = wp_get_current_user();
3858
	$event_name  = 'contact_form_block_message_sent';
3859
	$event_props = array(
3860
		'entry_permalink' => esc_url( $all_values['entry_permalink'] ),
3861
		'feedback_id'     => esc_attr( $all_values['feedback_id'] ),
3862
	);
3863
3864
	/*
3865
	 * Record event.
3866
	 * We use different libs on wpcom and Jetpack.
3867
	 */
3868
	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
3869
		$event_name             = 'wpcom_' . $event_name;
3870
		$event_props['blog_id'] = get_current_blog_id();
3871
		// If the form was sent by a logged out visitor, record event with blog owner.
3872
		if ( empty( $event_user->ID ) ) {
3873
			$event_user_id = wpcom_get_blog_owner( $event_props['blog_id'] );
3874
			$event_user    = get_userdata( $event_user_id );
3875
		}
3876
3877
		jetpack_require_lib( 'tracks/client' );
3878
		tracks_record_event( $event_user, $event_name, $event_props );
3879
	} else {
3880
		// If the form was sent by a logged out visitor, record event with Jetpack master user.
3881
		if ( empty( $event_user->ID ) ) {
3882
			$master_user_id = Jetpack_Options::get_option( 'master_user' );
3883
			if ( ! empty( $master_user_id ) ) {
3884
				$event_user = get_userdata( $master_user_id );
3885
			}
3886
		}
3887
3888
		$tracking = new Automattic\Jetpack\Tracking();
3889
		$tracking->record_user_event( $event_name, $event_props, $event_user );
3890
	}
3891
}
3892
add_action( 'grunion_pre_message_sent', 'jetpack_tracks_record_grunion_pre_message_sent', 12, 3 );
3893