Completed
Push — master ( 1fd6be...155036 )
by Zack
13s
created

GravityView_Delete_Entry::display_message()   C

Complexity

Conditions 7
Paths 5

Size

Total Lines 42
Code Lines 23

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 0
CRAP Score 56

Importance

Changes 0
Metric Value
cc 7
eloc 23
nc 5
nop 1
dl 0
loc 42
ccs 0
cts 22
cp 0
crap 56
rs 6.7272
c 0
b 0
f 0
1
<?php
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 22 and the first side effect is on line 16.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * The GravityView Delete Entry Extension
4
 *
5
 * Delete entries in GravityView.
6
 *
7
 * @since     1.5.1
8
 * @package   GravityView
9
 * @license   GPL2+
10
 * @author    Katz Web Services, Inc.
11
 * @link      http://gravityview.co
12
 * @copyright Copyright 2014, Katz Web Services, Inc.
13
 */
14
15
if ( ! defined( 'WPINC' ) ) {
16
	die;
17
}
18
19
/**
20
 * @since 1.5.1
21
 */
22
final class GravityView_Delete_Entry {
23
24
	static $file;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $file.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
25
	static $instance;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $instance.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
26
	var $entry;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $entry.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
27
	var $form;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $form.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
28
	var $view_id;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $view_id.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
29
	var $is_valid = NULL;
0 ignored issues
show
Coding Style introduced by
The visibility should be declared for property $is_valid.

The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using

class A {
    var $property;
}

the property is implicitly global.

To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.

Loading history...
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
30
31
	function __construct() {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
32
33
		self::$file = plugin_dir_path( __FILE__ );
34
35
		$this->add_hooks();
36
	}
37
38
	/**
39
	 * @since 1.9.2
40
	 */
41
	private function add_hooks() {
42
43
		add_action( 'wp', array( $this, 'process_delete' ), 10000 );
44
45
		add_filter( 'gravityview_entry_default_fields', array( $this, 'add_default_field'), 10, 3 );
0 ignored issues
show
introduced by
No space before closing parenthesis of array is bad style
Loading history...
46
47
		add_action( 'gravityview_before', array( $this, 'display_message' ) );
48
49
		// For the Delete Entry Link, you don't want visible to all users.
50
		add_filter( 'gravityview_field_visibility_caps', array( $this, 'modify_visibility_caps'), 10, 5 );
0 ignored issues
show
introduced by
No space before closing parenthesis of array is bad style
Loading history...
51
52
		// Modify the field options based on the name of the field type
53
		add_filter( 'gravityview_template_delete_link_options', array( $this, 'delete_link_field_options' ), 10, 5 );
54
55
		// add template path to check for field
56
		add_filter( 'gravityview_template_paths', array( $this, 'add_template_path' ) );
57
58
		add_action( 'gravityview/edit-entry/publishing-action/after', array( $this, 'add_delete_button'), 10, 3 );
0 ignored issues
show
introduced by
No space before closing parenthesis of array is bad style
Loading history...
59
60
		add_action ( 'gravityview/delete-entry/deleted', array( $this, 'process_connected_posts' ), 10, 2 );
0 ignored issues
show
Coding Style introduced by
Space before opening parenthesis of function call prohibited
Loading history...
61
		add_action ( 'gravityview/delete-entry/trashed', array( $this, 'process_connected_posts' ), 10, 2 );
0 ignored issues
show
Coding Style introduced by
Space before opening parenthesis of function call prohibited
Loading history...
62
	}
63
64
	/**
65
	 * Return the instantiated class object
66
	 *
67
	 * @since  1.5.1
68
	 * @return GravityView_Delete_Entry
69
	 */
70 3
	static function getInstance() {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
Coding Style introduced by
The function name getInstance is in camel caps, but expected get_instance instead as per the coding standard.
Loading history...
71
72 3
		if( empty( self::$instance ) ) {
73
			self::$instance = new self;
74
		}
75
76 3
		return self::$instance;
77
	}
78
79
	/**
80
	 * Include this extension templates path
81
	 *
82
	 * @since  1.5.1
83
	 * @param array $file_paths List of template paths ordered
84
	 */
85
	function add_template_path( $file_paths ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
86
87
		// Index 100 is the default GravityView template path.
88
		// Index 110 is Edit Entry link
89
		$file_paths[ 115 ] = self::$file;
0 ignored issues
show
introduced by
Array keys should NOT be surrounded by spaces if they only contain a string or an integer.
Loading history...
90
91
		return $file_paths;
92
	}
93
94
	/**
95
	 * Add "Delete Link Text" setting to the edit_link field settings
96
	 *
97
	 * @since  1.5.1
98
	 * @param  [type] $field_options [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
99
	 * @param  [type] $template_id   [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
100
	 * @param  [type] $field_id      [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
101
	 * @param  [type] $context       [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
102
	 * @param  [type] $input_type    [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
103
	 * @return [type]                [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
104
	 */
105
	function delete_link_field_options( $field_options, $template_id, $field_id, $context, $input_type ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
106
107
		// Always a link, never a filter
108
		unset( $field_options['show_as_link'], $field_options['search_filter'] );
109
110
		// Delete Entry link should only appear to visitors capable of editing entries
111
		unset( $field_options['only_loggedin'], $field_options['only_loggedin_cap'] );
112
113
		$add_option['delete_link'] = array(
0 ignored issues
show
Coding Style Comprehensibility introduced by
$add_option was never initialized. Although not strictly required by PHP, it is generally a good practice to add $add_option = array(); before regardless.

Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.

Let’s take a look at an example:

foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}

As you can see in this example, the array $myArray is initialized the first time when the foreach loop is entered. You can also see that the value of the bar key is only written conditionally; thus, its value might result from a previous iteration.

This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.

Loading history...
114
			'type' => 'text',
115
			'label' => __( 'Delete Link Text', 'gravityview' ),
116
			'desc' => NULL,
0 ignored issues
show
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
117
			'value' => __('Delete Entry', 'gravityview'),
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
118
			'merge_tags' => true,
119
		);
120
121
		$field_options['allow_edit_cap'] = array(
122
			'type' => 'select',
123
			'label' => __( 'Allow the following users to delete the entry:', 'gravityview' ),
124
			'choices' => GravityView_Render_Settings::get_cap_choices( $template_id, $field_id, $context, $input_type ),
125
			'tooltip' => 'allow_edit_cap',
126
			'class' => 'widefat',
127
			'value' => 'read', // Default: entry creator
128
		);
129
0 ignored issues
show
Coding Style introduced by
Functions must not contain multiple empty lines in a row; found 2 empty lines
Loading history...
130
131
		return array_merge( $add_option, $field_options );
132
	}
133
134
135
	/**
136
	 * Add Edit Link as a default field, outside those set in the Gravity Form form
137
	 *
138
	 * @since 1.5.1
139
	 * @param array $entry_default_fields Existing fields
140
	 * @param  string|array $form form_ID or form object
141
	 * @param  string $zone   Either 'single', 'directory', 'edit', 'header', 'footer'
142
	 */
143
	function add_default_field( $entry_default_fields, $form = array(), $zone = '' ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
144
145
		if( 'edit' !== $zone ) {
146
			$entry_default_fields['delete_link'] = array(
147
				'label' => __( 'Delete Entry', 'gravityview' ),
148
				'type'  => 'delete_link',
149
				'desc'  => __( 'A link to delete the entry. Respects the Delete Entry permissions.', 'gravityview' ),
150
			);
151
		}
152
153
		return $entry_default_fields;
154
	}
155
156
	/**
157
	 * Add Delete Entry Link to the Add Field dialog
158
	 * @since 1.5.1
159
	 * @param array $available_fields
160
	 */
161
	function add_available_field( $available_fields = array() ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
162
163
		$available_fields['delete_link'] = array(
164
			'label_text' => __( 'Delete Entry', 'gravityview' ),
165
			'field_id' => 'delete_link',
166
			'label_type' => 'field',
167
			'input_type' => 'delete_link',
168
			'field_options' => NULL
0 ignored issues
show
introduced by
Each line in an array declaration must end in a comma
Loading history...
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
169
		);
170
171
		return $available_fields;
172
	}
173
174
	/**
175
	 * Change wording for the Edit context to read Entry Creator
176
	 *
177
	 * @since 1.5.1
178
	 * @param  array 	   $visibility_caps        Array of capabilities to display in field dropdown.
179
	 * @param  string      $field_type  Type of field options to render (`field` or `widget`)
0 ignored issues
show
Bug introduced by
There is no parameter named $field_type. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
180
	 * @param  string      $template_id Table slug
181
	 * @param  float       $field_id    GF Field ID - Example: `3`, `5.2`, `entry_link`, `created_by`
182
	 * @param  string      $context     What context are we in? Example: `single` or `directory`
183
	 * @param  string      $input_type  (textarea, list, select, etc.)
184
	 * @return array                   Array of field options with `label`, `value`, `type`, `default` keys
185
	 */
186
	public function modify_visibility_caps( $visibility_caps = array(), $template_id = '', $field_id = '', $context = '', $input_type = '' ) {
0 ignored issues
show
Unused Code introduced by
The parameter $context is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
Unused Code introduced by
The parameter $input_type is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
187
188
		$caps = $visibility_caps;
189
190
		// If we're configuring fields in the edit context, we want a limited selection
191
		if( $field_id === 'delete_link' ) {
0 ignored issues
show
introduced by
Found "=== '". Use Yoda Condition checks, you must
Loading history...
192
193
			// Remove other built-in caps.
194
			unset( $caps['publish_posts'], $caps['gravityforms_view_entries'], $caps['delete_others_posts'] );
195
196
			$caps['read'] = _x('Entry Creator', 'User capability', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
197
		}
198
199
		return $caps;
200
	}
201
202
	/**
203
	 * Make sure there's an entry
204
	 *
205
	 * @since 1.5.1
206
	 * @param [type] $entry [description]
0 ignored issues
show
Documentation introduced by
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
207
	 */
208 3
	function set_entry( $entry = null ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
209 3
		$this->entry = empty( $entry ) ? GravityView_View::getInstance()->entries[0] : $entry;
0 ignored issues
show
Documentation introduced by
The property $entries is declared protected in GravityView_View. Since you implemented __get(), maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.

Since your code implements the magic setter _set, this function will be called for any write access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

Since the property has write access only, you can use the @property-write annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
210 3
	}
211
212
	/**
213
	 * Generate a consistent nonce key based on the Entry ID
214
	 *
215
	 * @since 1.5.1
216
	 * @param  int $entry_id Entry ID
217
	 * @return string           Key used to validate request
218
	 */
219
	public static function get_nonce_key( $entry_id ) {
220
		return sprintf( 'delete_%s', $entry_id );
221
	}
222
223
224
	/**
225
	 * Generate a nonce link with the base URL of the current View embed
226
	 *
227
	 * We don't want to link to the single entry, because when deleted, there would be nothing to return to.
228
	 *
229
	 * @since 1.5.1
230
	 * @param  array      $entry Gravity Forms entry array
231
	 * @return string|null             If directory link is valid, the URL to process the delete request. Otherwise, `NULL`.
232
	 */
233 3
	public static function get_delete_link( $entry, $view_id = 0, $post_id = null ) {
234
235 3
		self::getInstance()->set_entry( $entry );
236
237 3
        $base = GravityView_API::directory_link( $post_id, true );
238
239 3
		if( empty( $base ) ) {
240
			do_action( 'gravityview_log_error', __METHOD__ . ' - Post ID does not exist: '.$post_id );
241
			return NULL;
0 ignored issues
show
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
242
		}
243
244
		// Use the slug instead of the ID for consistent security
245 3
		$entry_slug = GravityView_API::get_entry_slug( $entry['id'], $entry );
246
247 3
        $view_id = empty( $view_id ) ? gravityview_get_view_id() : $view_id;
248
249 3
		$actionurl = add_query_arg( array(
250 3
			'action'	=> 'delete',
251 3
			'entry_id'		=> $entry_slug,
252 3
			'gvid' => $view_id,
253 3
            'view_id' => $view_id,
254 3
		), $base );
255
256 3
		$url = wp_nonce_url( $actionurl, 'delete_'.$entry_slug, 'delete' );
257
258 3
		return $url;
259
	}
260
261
262
	/**
263
	 * Add a Delete button to the #publishing-action section of the Delete Entry form
264
	 *
265
	 * @since 1.5.1
266
	 * @param array $form    Gravity Forms form array
267
	 * @param array $entry   Gravity Forms entry array
268
	 * @param int $view_id GravityView View ID
269
	 */
270 3
	function add_delete_button( $form = array(), $entry = array(), $view_id = NULL ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
271
272
		// Only show the link to those who are allowed to see it.
273 3
		if( !self::check_user_cap_delete_entry( $entry ) ) {
0 ignored issues
show
introduced by
Expected 1 space after "!"; 0 found
Loading history...
274
			return;
275
		}
276
277
		/**
278
		 * @filter `gravityview/delete-entry/show-delete-button` Should the Delete button be shown in the Edit Entry screen?
279
		 * @param boolean $show_entry Default: true
280
		 */
281 3
		$show_delete_button = apply_filters( 'gravityview/delete-entry/show-delete-button', true );
282
283
		// If the button is hidden by the filter, don't show.
284 3
		if( !$show_delete_button ) {
0 ignored issues
show
introduced by
Expected 1 space after "!"; 0 found
Loading history...
285
			return;
286
		}
287
288
		$attributes = array(
289 3
			'class' => 'btn btn-sm button button-small alignright pull-right btn-danger gv-button-delete',
290 3
			'tabindex' => '5',
291 3
			'onclick' => self::get_confirm_dialog(),
292
		);
293
294 3
		echo gravityview_get_link( self::get_delete_link( $entry, $view_id ), esc_attr__( 'Delete', 'gravityview' ), $attributes );
0 ignored issues
show
introduced by
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'gravityview_get_link'
Loading history...
295
296 3
	}
297
298
	/**
299
	 * Handle the deletion request, if $_GET['action'] is set to "delete"
300
	 *
301
	 * 1. Check referrer validity
302
	 * 2. Make sure there's an entry with the slug of $_GET['entry_id']
303
	 * 3. If so, attempt to delete the entry. If not, set the error status
304
	 * 4. Remove `action=delete` from the URL
305
	 * 5. Redirect to the page using `wp_safe_redirect()`
306
	 *
307
	 * @since 1.5.1
308
	 * @uses wp_safe_redirect()
309
	 * @return void
310
	 */
311
	function process_delete() {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
312
313
		// If the form is submitted
314
		if( isset( $_GET['action'] ) && 'delete' === $_GET['action'] && isset( $_GET['entry_id'] ) ) {
315
316
			// Make sure it's a GravityView request
317
			$valid_nonce_key = wp_verify_nonce( $_GET['delete'], self::get_nonce_key( $_GET['entry_id'] ) );
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
introduced by
Detected usage of a non-validated input variable: $_GET
Loading history...
introduced by
Detected usage of a non-sanitized input variable: $_GET
Loading history...
318
319
			if( ! $valid_nonce_key ) {
320
				do_action('gravityview_log_debug', __METHOD__ . ' Delete entry not processed: nonce validation failed.' );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
321
				return;
322
			}
323
324
			// Get the entry slug
325
			$entry_slug = esc_attr( $_GET['entry_id'] );
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
326
327
			// See if there's an entry there
328
			$entry = gravityview_get_entry( $entry_slug, true, false );
329
330
			if( $entry ) {
331
332
				$has_permission = $this->user_can_delete_entry( $entry );
333
334
				if( is_wp_error( $has_permission ) ) {
335
336
					$messages = array(
337
						'message' => urlencode( $has_permission->get_error_message() ),
338
						'status' => 'error',
339
					);
340
341
				} else {
342
343
					// Delete the entry
344
					$delete_response = $this->delete_or_trash_entry( $entry );
345
346
					if( is_wp_error( $delete_response ) ) {
347
348
						$messages = array(
349
							'message' => urlencode( $delete_response->get_error_message() ),
350
							'status' => 'error',
351
						);
352
353
					} else {
354
355
						$messages = array(
356
							'status' => $delete_response,
357
						);
358
359
					}
360
361
				}
362
363
			} else {
364
365
				do_action('gravityview_log_debug', __METHOD__ . ' Delete entry failed: there was no entry with the entry slug '. $entry_slug );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
366
367
				$messages = array(
368
					'message' => urlencode( __('The entry does not exist.', 'gravityview') ),
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
369
					'status' => 'error',
370
				);
371
			}
372
373
			$redirect_to_base = esc_url_raw( remove_query_arg( array( 'action', 'gvid' ) ) );
374
			$redirect_to = add_query_arg( $messages, $redirect_to_base );
375
376
			wp_safe_redirect( $redirect_to );
377
378
			exit();
0 ignored issues
show
Coding Style Compatibility introduced by
The method process_delete() contains an exit expression.

An exit expression should only be used in rare cases. For example, if you write a short command line script.

In most cases however, using an exit expression makes the code untestable and often causes incompatibilities with other libraries. Thus, unless you are absolutely sure it is required here, we recommend to refactor your code to avoid its usage.

Loading history...
379
380
		} // endif action is delete.
381
382
	}
383
384
	/**
385
	 * Delete mode: permanently delete, or move to trash?
386
	 *
387
	 * @return string `delete` or `trash`
388
	 */
389
	private function get_delete_mode() {
390
391
		/**
392
		 * @filter `gravityview/delete-entry/mode` Delete mode: permanently delete, or move to trash?
393
		 * @since 1.13.1
394
		 * @param string $delete_mode Delete mode: `trash` or `delete`. Default: `delete`
395
		 */
396
		$delete_mode = apply_filters( 'gravityview/delete-entry/mode', 'delete' );
397
398
		return ( 'trash' === $delete_mode ) ? 'trash' : 'delete';
399
	}
400
401
	/**
402
	 * @since 1.13.1
403
	 * @see GFAPI::delete_entry()
404
	 * @return WP_Error|boolean GFAPI::delete_entry() returns a WP_Error on error
405
	 */
406
	private function delete_or_trash_entry( $entry ) {
407
408
		$entry_id = $entry['id'];
409
		
410
		$mode = $this->get_delete_mode();
411
412
		if( 'delete' === $mode ) {
413
414
			do_action( 'gravityview_log_debug', __METHOD__ . ' Starting delete entry: ', $entry_id );
415
416
			// Delete the entry
417
			$delete_response = GFAPI::delete_entry( $entry_id );
418
419
			if( ! is_wp_error( $delete_response ) ) {
420
				$delete_response = 'deleted';
421
422
				/**
423
				 * @action `gravityview/delete-entry/deleted` Triggered when an entry is deleted
424
				 * @since 1.16.4
425
				 * @param  int $entry_id ID of the Gravity Forms entry
426
				 * @param  array $entry Deleted entry array
427
				*/
428
				do_action( 'gravityview/delete-entry/deleted', $entry_id, $entry );
429
			}
430
431
			do_action( 'gravityview_log_debug', __METHOD__ . ' Delete response: ', $delete_response );
432
433
		} else {
434
435
			do_action( 'gravityview_log_debug', __METHOD__ . ' Starting trash entry: ', $entry_id );
436
437
			$trashed = GFAPI::update_entry_property( $entry_id, 'status', 'trash' );
438
			new GravityView_Cache;
439
440
			if( ! $trashed ) {
441
				$delete_response = new WP_Error( 'trash_entry_failed', __('Moving the entry to the trash failed.', 'gravityview' ) );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
442
			} else {
443
444
				/**
445
				 * @action `gravityview/delete-entry/trashed` Triggered when an entry is trashed
446
				 * @since 1.16.4
447
				 * @param  int $entry_id ID of the Gravity Forms entry
448
				 * @param  array $entry Deleted entry array
449
				 */
450
				do_action( 'gravityview/delete-entry/trashed', $entry_id, $entry );
451
452
				$delete_response = 'trashed';
453
			}
454
455
			do_action( 'gravityview_log_debug', __METHOD__ . ' Trashed? ', $delete_response );
456
		}
457
458
		return $delete_response;
459
	}
460
461
	/**
462
	 * Delete or trash a post connected to an entry
463
	 *
464
	 * @since 1.17
465
	 *
466
	 * @param int $entry_id ID of entry being deleted/trashed
467
	 * @param array $entry Array of the entry being deleted/trashed
468
	 */
469
	public function process_connected_posts( $entry_id = 0, $entry = array() ) {
470
471
		// The entry had no connected post
472
		if( empty( $entry['post_id'] ) ) {
473
			return;
474
		}
475
476
		/**
477
		 * @filter `gravityview/delete-entry/delete-connected-post` Should posts connected to an entry be deleted when the entry is deleted?
478
		 * @since 1.17
479
		 * @param boolean $delete_post If trashing an entry, trash the post. If deleting an entry, delete the post. Default: true
480
		 */
481
		$delete_post = apply_filters( 'gravityview/delete-entry/delete-connected-post', true );
482
		
483
		if( false === $delete_post ) {
484
			return;
485
		}
486
487
		$action = current_action();
488
489
		if( 'gravityview/delete-entry/deleted' === $action ) {
490
			$result = wp_delete_post( $entry['post_id'], true );
491
		} else {
492
			$result = wp_trash_post( $entry['post_id'] );
493
		}
494
495
		if( false === $result ) {
496
			do_action( 'gravityview_log_error', __METHOD__ . ' (called by '.$action.'): Error processing the Post connected to the entry.', $entry );
497
		} else {
498
			do_action( 'gravityview_log_debug', __METHOD__ . ' (called by '.$action.'): Successfully processed Post connected to the entry.', $entry );
499
		}
500
	}
501
502
	/**
503
	 * Is the current nonce valid for editing the entry?
504
	 *
505
	 * @since 1.5.1
506
	 * @return boolean
507
	 */
508
	public function verify_nonce() {
509
510
		// No delete entry request was made
511
		if( empty( $_GET['entry_id'] ) || empty( $_GET['delete'] ) ) {
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
512
			return false;
513
		}
514
515
		$nonce_key = self::get_nonce_key( $_GET['entry_id'] );
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
introduced by
Detected usage of a non-sanitized input variable: $_GET
Loading history...
516
517
		$valid = wp_verify_nonce( $_GET['delete'], $nonce_key );
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
introduced by
Detected usage of a non-sanitized input variable: $_GET
Loading history...
518
519
		/**
520
		 * @filter `gravityview/delete-entry/verify_nonce` Override Delete Entry nonce validation. Return true to declare nonce valid.
521
		 * @since 1.15.2
522
		 * @see wp_verify_nonce()
523
		 * @param int|boolean $valid False if invalid; 1 or 2 when nonce was generated
524
		 * @param string $nonce_key Name of nonce action used in wp_verify_nonce. $_GET['delete'] holds the nonce value itself. Default: `delete_{entry_id}`
525
		 */
526
		$valid = apply_filters( 'gravityview/delete-entry/verify_nonce', $valid, $nonce_key );
527
528
		return $valid;
529
	}
530
531
	/**
532
	 * Get the onclick attribute for the confirm dialogs that warns users before they delete an entry
533
	 *
534
	 * @since 1.5.1
535
	 * @return string HTML `onclick` attribute
536
	 */
537 3
	public static function get_confirm_dialog() {
538
539 3
		$confirm = __('Are you sure you want to delete this entry? This cannot be undone.', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
540
541
		/**
542
		 * @filter `gravityview/delete-entry/confirm-text` Modify the Delete Entry Javascript confirmation text
543
		 * @param string $confirm Default: "Are you sure you want to delete this entry? This cannot be undone."
544
		 */
545 3
		$confirm = apply_filters( 'gravityview/delete-entry/confirm-text', $confirm );
546
547 3
		return 'return window.confirm(\''. esc_js( $confirm ) .'\');';
548
	}
549
550
	/**
551
	 * Check if the user can edit the entry
552
	 *
553
	 * - Is the nonce valid?
554
	 * - Does the user have the right caps for the entry
555
	 * - Is the entry in the trash?
556
	 *
557
	 * @since 1.5.1
558
	 * @param  array $entry Gravity Forms entry array
559
	 * @return boolean|WP_Error        True: can edit form. WP_Error: nope.
560
	 */
561
	function user_can_delete_entry( $entry = array() ) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
562
563
		$error = NULL;
0 ignored issues
show
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
564
565
		if( ! $this->verify_nonce() ) {
566
			$error = __( 'The link to delete this entry is not valid; it may have expired.', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
567
		}
568
569
		if( ! self::check_user_cap_delete_entry( $entry ) ) {
570
			$error = __( 'You do not have permission to delete this entry.', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
571
		}
572
573
		if( $entry['status'] === 'trash' ) {
0 ignored issues
show
introduced by
Found "=== '". Use Yoda Condition checks, you must
Loading history...
574
			if( 'trash' === $this->get_delete_mode() ) {
575
				$error = __( 'The entry is already in the trash.', 'gravityview' );
576
			} else {
577
				$error = __( 'You cannot delete the entry; it is already in the trash.', 'gravityview' );
578
			}
579
		}
580
581
		// No errors; everything's fine here!
582
		if( empty( $error ) ) {
583
			return true;
584
		}
585
586
		do_action('gravityview_log_error', 'GravityView_Delete_Entry[user_can_delete_entry]' . $error );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
587
588
		return new WP_Error( 'gravityview-delete-entry-permissions', $error );
589
	}
590
591
592
	/**
593
	 * checks if user has permissions to view the link or delete a specific entry
594
	 *
595
	 * @since 1.5.1
596
	 * @since 1.15 Added `$view_id` param
597
	 *
598
	 * @param  array $entry Gravity Forms entry array
599
	 * @param array $field Field settings (optional)
600
	 * @param int $view_id Pass a View ID to check caps against. If not set, check against current View (optional)
601
	 * @return bool
602
	 */
603 3
	public static function check_user_cap_delete_entry( $entry, $field = array(), $view_id = 0 ) {
604 3
		$gravityview_view = GravityView_View::getInstance();
605
606 3
		$current_user = wp_get_current_user();
607
608 3
		$entry_id = isset( $entry['id'] ) ? $entry['id'] : NULL;
0 ignored issues
show
Coding Style introduced by
TRUE, FALSE and NULL must be lowercase; expected null, but found NULL.
Loading history...
609
610
		// Or if they can delete any entries (as defined in Gravity Forms), we're good.
611 3
		if( GVCommon::has_cap( array( 'gravityforms_delete_entries', 'gravityview_delete_others_entries' ), $entry_id ) ) {
612
613 3
			do_action('gravityview_log_debug', 'GravityView_Delete_Entry[check_user_cap_delete_entry] Current user has `gravityforms_delete_entries` or `gravityview_delete_others_entries` capability.' );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
614
615 3
			return true;
616
		}
617
0 ignored issues
show
Coding Style introduced by
Functions must not contain multiple empty lines in a row; found 2 empty lines
Loading history...
618
619
		// If field options are passed, check if current user can view the link
620
		if( !empty( $field ) ) {
0 ignored issues
show
introduced by
Expected 1 space after "!"; 0 found
Loading history...
621
622
			// If capability is not defined, something is not right!
623
			if( empty( $field['allow_edit_cap'] ) ) {
624
625
				do_action( 'gravityview_log_error', 'GravityView_Delete_Entry[check_user_cap_delete_entry] Cannot read delete entry field caps', $field );
626
627
				return false;
628
			}
629
630
			if( GVCommon::has_cap( $field['allow_edit_cap'] ) ) {
631
632
				// Do not return true if cap is read, as we need to check if the current user created the entry
633
				if( $field['allow_edit_cap'] !== 'read' ) {
0 ignored issues
show
introduced by
Found "!== '". Use Yoda Condition checks, you must
Loading history...
634
					return true;
635
				}
636
637
			} else {
638
639
				do_action( 'gravityview_log_debug', sprintf( 'GravityView_Delete_Entry[check_user_cap_delete_entry] User %s is not authorized to view delete entry link ', $current_user->ID ) );
640
641
				return false;
642
			}
643
644
		}
645
646
		if( !isset( $entry['created_by'] ) ) {
0 ignored issues
show
introduced by
Expected 1 space after "!"; 0 found
Loading history...
647
648
			do_action('gravityview_log_error', 'GravityView_Delete_Entry[check_user_cap_delete_entry] Entry `created_by` doesn\'t exist.');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
649
650
			return false;
651
		}
652
653
		$view_id = empty( $view_id ) ? $gravityview_view->getViewId() : $view_id;
654
655
		// Only checks user_delete view option if view is already set
656
		if( $view_id ) {
657
658
			$current_view = gravityview_get_current_view_data( $view_id );
659
660
			$user_delete = isset( $current_view['atts']['user_delete'] ) ? $current_view['atts']['user_delete'] : false;
661
662
			if( empty( $user_delete ) ) {
663
664
				do_action('gravityview_log_debug', 'GravityView_Delete_Entry[check_user_cap_delete_entry] User Delete is disabled. Returning false.' );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
665
666
				return false;
667
			}
668
		}
669
670
		// If the logged-in user is the same as the user who created the entry, we're good.
671
		if( is_user_logged_in() && intval( $current_user->ID ) === intval( $entry['created_by'] ) ) {
672
673
			do_action('gravityview_log_debug', sprintf( 'GravityView_Delete_Entry[check_user_cap_delete_entry] User %s created the entry.', $current_user->ID ) );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
674
675
			return true;
676
		}
677
678
		return false;
679
	}
680
681
682
	/**
683
	 * After processing delete entry, the user will be redirected to the referring View or embedded post/page. Display a message on redirection.
684
	 *
685
	 * If success, there will be `status` URL parameters `status=>success`
686
	 * If an error, there will be `status` and `message` URL parameters `status=>error&message=example`
687
	 *
688
	 * @since 1.15.2 Only show message when the URL parameter's View ID matches the current View ID
689
	 * @since 1.5.1
690
	 *
691
	 * @param int $current_view_id The ID of the View being rendered
692
	 * @return void
693
	 */
694
	public function display_message( $current_view_id = 0 ) {
695
696
		if( empty( $_GET['status'] ) || ! self::verify_nonce() ) {
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
697
			return;
698
		}
699
700
		// Entry wasn't deleted from current View
701
		if( isset( $_GET['view_id'] ) && intval( $_GET['view_id'] ) !== intval( $current_view_id ) ) {
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
702
			return;
703
		}
704
705
		$status = esc_attr( $_GET['status'] );
0 ignored issues
show
introduced by
Detected access of super global var $_GET, probably need manual inspection.
Loading history...
706
		$message_from_url = rgget('message');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
707
		$message_from_url = rawurldecode( stripslashes_deep( $message_from_url ) );
708
		$class = '';
709
710
		switch ( $status ) {
711
			case 'error':
712
				$class = ' gv-error error';
713
				$error_message = __('There was an error deleting the entry: %s', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
714
				$message = sprintf( $error_message, $message_from_url );
715
				break;
716
			case 'trashed':
717
				$message = __('The entry was successfully moved to the trash.', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
718
				break;
719
			default:
720
				$message = __('The entry was successfully deleted.', 'gravityview');
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
721
				break;
722
		}
723
724
		/**
725
		 * @filter `gravityview/delete-entry/message` Modify the Delete Entry messages
726
		 * @since 1.13.1
727
		 * @param string $message Message to be displayed
728
		 * @param string $status Message status (`error` or `success`)
729
		 * @param string $message_from_url The original error message, if any, without the "There was an error deleting the entry:" prefix
730
		 */
731
		$message = apply_filters( 'gravityview/delete-entry/message', esc_attr( $message ), $status, $message_from_url );
732
733
		// DISPLAY ERROR/SUCCESS MESSAGE
734
		echo '<div class="gv-notice' . esc_attr( $class ) .'">'. $message .'</div>';
0 ignored issues
show
introduced by
Expected next thing to be a escaping function, not '$message'
Loading history...
735
	}
736
737
738
} // end class
739
740
GravityView_Delete_Entry::getInstance();
741
742