|
1
|
|
|
<?php |
|
2
|
|
|
/** |
|
3
|
|
|
* The GravityView Edit Entry Extension |
|
4
|
|
|
* |
|
5
|
|
|
* Easily edit entries in GravityView. |
|
6
|
|
|
* |
|
7
|
|
|
* @package GravityView |
|
8
|
|
|
* @license GPL2+ |
|
9
|
|
|
* @author GravityView <[email protected]> |
|
10
|
|
|
* @link http://gravityview.co |
|
11
|
|
|
* @copyright Copyright 2014, Katz Web Services, Inc. |
|
12
|
|
|
*/ |
|
13
|
|
|
|
|
14
|
|
|
if ( ! defined( 'WPINC' ) ) { |
|
15
|
|
|
die; |
|
16
|
|
|
} |
|
17
|
|
|
|
|
18
|
|
|
|
|
19
|
|
|
class GravityView_Edit_Entry { |
|
20
|
|
|
|
|
21
|
|
|
/** |
|
22
|
|
|
* @var string |
|
23
|
|
|
*/ |
|
24
|
|
|
static $file; |
|
25
|
|
|
|
|
26
|
|
|
static $instance; |
|
27
|
|
|
|
|
28
|
|
|
/** |
|
29
|
|
|
* Component instances. |
|
30
|
|
|
* @var array |
|
31
|
|
|
*/ |
|
32
|
|
|
public $instances = array(); |
|
33
|
|
|
|
|
34
|
|
|
|
|
35
|
22 |
|
function __construct() { |
|
|
|
|
|
|
36
|
|
|
|
|
37
|
22 |
|
self::$file = plugin_dir_path( __FILE__ ); |
|
38
|
|
|
|
|
39
|
22 |
|
if( is_admin() ) { |
|
40
|
|
|
$this->load_components( 'admin' ); |
|
41
|
|
|
} |
|
42
|
|
|
|
|
43
|
22 |
|
$this->load_components( 'locking' ); |
|
44
|
|
|
|
|
45
|
22 |
|
$this->load_components( 'render' ); |
|
46
|
|
|
|
|
47
|
|
|
// If GF User Registration Add-on exists |
|
48
|
22 |
|
$this->load_components( 'user-registration' ); |
|
49
|
|
|
|
|
50
|
22 |
|
$this->add_hooks(); |
|
51
|
|
|
|
|
52
|
|
|
// Process hooks for addons that may or may not be present |
|
53
|
22 |
|
$this->addon_specific_hooks(); |
|
54
|
22 |
|
} |
|
55
|
|
|
|
|
56
|
|
|
|
|
57
|
23 |
|
static function getInstance() { |
|
|
|
|
|
|
58
|
|
|
|
|
59
|
23 |
|
if( empty( self::$instance ) ) { |
|
60
|
22 |
|
self::$instance = new GravityView_Edit_Entry; |
|
61
|
|
|
} |
|
62
|
|
|
|
|
63
|
23 |
|
return self::$instance; |
|
64
|
|
|
} |
|
65
|
|
|
|
|
66
|
|
|
|
|
67
|
22 |
|
private function load_components( $component ) { |
|
68
|
|
|
|
|
69
|
22 |
|
$dir = trailingslashit( self::$file ); |
|
70
|
|
|
|
|
71
|
22 |
|
$filename = $dir . 'class-edit-entry-' . $component . '.php'; |
|
72
|
22 |
|
$classname = 'GravityView_Edit_Entry_' . str_replace( ' ', '_', ucwords( str_replace( '-', ' ', $component ) ) ); |
|
73
|
|
|
|
|
74
|
|
|
// Loads component and pass extension's instance so that component can |
|
75
|
|
|
// talk each other. |
|
76
|
22 |
|
require_once $filename; |
|
77
|
22 |
|
$this->instances[ $component ] = new $classname( $this ); |
|
78
|
22 |
|
$this->instances[ $component ]->load(); |
|
79
|
|
|
|
|
80
|
22 |
|
} |
|
81
|
|
|
|
|
82
|
22 |
|
private function add_hooks() { |
|
83
|
|
|
|
|
84
|
|
|
// Add front-end access to Gravity Forms delete file action |
|
85
|
22 |
|
add_action( 'wp_ajax_nopriv_rg_delete_file', array( 'GFForms', 'delete_file') ); |
|
86
|
|
|
|
|
87
|
|
|
// Make sure this hook is run for non-admins |
|
88
|
22 |
|
add_action( 'wp_ajax_rg_delete_file', array( 'GFForms', 'delete_file') ); |
|
89
|
|
|
|
|
90
|
22 |
|
add_filter( 'gravityview_blacklist_field_types', array( $this, 'modify_field_blacklist' ), 10, 2 ); |
|
91
|
|
|
|
|
92
|
|
|
// add template path to check for field |
|
93
|
22 |
|
add_filter( 'gravityview_template_paths', array( $this, 'add_template_path' ) ); |
|
94
|
|
|
|
|
95
|
22 |
|
add_filter( 'gravityview/field/is_visible', array( $this, 'maybe_not_visible' ), 10, 3 ); |
|
96
|
|
|
|
|
97
|
22 |
|
add_filter( 'gravityview/api/reserved_query_args', array( $this, 'add_reserved_arg' ) ); |
|
98
|
|
|
} |
|
99
|
|
|
|
|
100
|
|
|
/** |
|
101
|
|
|
* Adds "edit" to the list of internal reserved query args |
|
102
|
|
|
* |
|
103
|
22 |
|
* @since 2.10 |
|
104
|
|
|
* |
|
105
|
22 |
|
* @param array $args Existing reserved args |
|
106
|
|
|
* |
|
107
|
|
|
* @return array |
|
108
|
|
|
*/ |
|
109
|
22 |
|
public function add_reserved_arg( $args ) { |
|
110
|
|
|
|
|
111
|
|
|
$args[] = 'edit'; |
|
112
|
|
|
|
|
113
|
|
|
return $args; |
|
114
|
|
|
} |
|
115
|
|
|
|
|
116
|
|
|
/** |
|
117
|
|
|
* Trigger hooks that are normally run in the admin for Addons, but need to be triggered manually because we're not in the admin |
|
118
|
|
|
* @return void |
|
119
|
|
|
*/ |
|
120
|
|
|
private function addon_specific_hooks() { |
|
121
|
|
|
|
|
122
|
|
|
if( class_exists( 'GFSignature' ) && is_callable( array( 'GFSignature', 'get_instance' ) ) ) { |
|
123
|
44 |
|
add_filter('gform_admin_pre_render', array( GFSignature::get_instance(), 'edit_lead_script')); |
|
124
|
|
|
} |
|
125
|
44 |
|
|
|
126
|
44 |
|
} |
|
127
|
|
|
|
|
128
|
|
|
/** |
|
129
|
|
|
* Hide the field or not. |
|
130
|
|
|
* |
|
131
|
|
|
* For non-logged in users. |
|
132
|
|
|
* For users that have no edit rights on any of the current entries. |
|
133
|
|
|
* |
|
134
|
|
|
* @param bool $visible Visible or not. |
|
135
|
|
|
* @param \GV\Field $field The field. |
|
136
|
|
|
* @param \GV\View $view The View context. |
|
137
|
|
|
* |
|
138
|
|
|
* @return bool |
|
139
|
|
|
*/ |
|
140
|
|
|
public function maybe_not_visible( $visible, $field, $view ) { |
|
141
|
|
|
|
|
142
|
|
|
if ( 'edit_link' !== $field->ID ) { |
|
143
|
|
|
return $visible; |
|
144
|
|
|
} |
|
145
|
|
|
|
|
146
|
|
|
if ( ! $view instanceof \GV\View ) { |
|
147
|
|
|
return $visible; |
|
148
|
|
|
} |
|
149
|
|
|
|
|
150
|
|
|
static $visibility_cache_for_view = array(); |
|
151
|
|
|
|
|
152
|
|
|
if ( ! is_null( $result = \GV\Utils::get( $visibility_cache_for_view, $view->ID, null ) ) ) { |
|
153
|
|
|
return $result; |
|
154
|
|
|
} |
|
155
|
|
|
|
|
156
|
2 |
|
foreach ( $view->get_entries()->all() as $entry ) { |
|
157
|
|
|
if ( self::check_user_cap_edit_entry( $entry->as_entry(), $view ) ) { |
|
158
|
|
|
// At least one entry is deletable for this user |
|
159
|
2 |
|
$visibility_cache_for_view[ $view->ID ] = true; |
|
160
|
|
|
return true; |
|
161
|
2 |
|
} |
|
162
|
|
|
} |
|
163
|
|
|
|
|
164
|
|
|
$visibility_cache_for_view[ $view->ID ] = false; |
|
165
|
|
|
|
|
166
|
|
|
return false; |
|
167
|
|
|
} |
|
168
|
|
|
|
|
169
|
|
|
/** |
|
170
|
|
|
* Include this extension templates path |
|
171
|
|
|
* @param array $file_paths List of template paths ordered |
|
172
|
|
|
*/ |
|
173
|
24 |
|
public function add_template_path( $file_paths ) { |
|
174
|
24 |
|
|
|
175
|
|
|
// Index 100 is the default GravityView template path. |
|
176
|
|
|
$file_paths[ 110 ] = self::$file; |
|
177
|
|
|
|
|
178
|
|
|
return $file_paths; |
|
179
|
|
|
} |
|
180
|
|
|
|
|
181
|
|
|
/** |
|
182
|
|
|
* |
|
183
|
|
|
* Return a well formatted nonce key according to GravityView Edit Entry protocol |
|
184
|
|
|
* |
|
185
|
|
|
* @param $view_id int GravityView view id |
|
186
|
|
|
* @param $form_id int Gravity Forms form id |
|
187
|
|
|
* @param $entry_id int Gravity Forms entry id |
|
188
|
|
|
* @return string |
|
189
|
|
|
*/ |
|
190
|
|
|
public static function get_nonce_key( $view_id, $form_id, $entry_id ) { |
|
191
|
3 |
|
return sprintf( 'edit_%d_%d_%d', $view_id, $form_id, $entry_id ); |
|
192
|
|
|
} |
|
193
|
3 |
|
|
|
194
|
|
|
|
|
195
|
3 |
|
/** |
|
196
|
|
|
* The edit entry link creates a secure link with a nonce |
|
197
|
3 |
|
* |
|
198
|
3 |
|
* It also mimics the URL structure Gravity Forms expects to have so that |
|
199
|
3 |
|
* it formats the display of the edit form like it does in the backend, like |
|
200
|
|
|
* "You can edit this post from the post page" fields, for example. |
|
201
|
3 |
|
* |
|
202
|
2 |
|
* @param $entry array Gravity Forms entry object |
|
203
|
|
|
* @param $view_id int GravityView view id |
|
204
|
|
|
* @param $post_id int GravityView Post ID where View may be embedded {@since 1.9.2} |
|
205
|
|
|
* @param string|array $field_values Parameters to pass in to the Edit Entry form to prefill data. Uses the same format as Gravity Forms "Allow field to be populated dynamically" {@since 1.9.2} {@see https://www.gravityhelp.com/documentation/article/allow-field-to-be-populated-dynamically/ } |
|
206
|
|
|
* @return string |
|
207
|
|
|
*/ |
|
208
|
|
|
public static function get_edit_link( $entry, $view_id, $post_id = null, $field_values = '' ) { |
|
209
|
3 |
|
|
|
210
|
|
|
$nonce_key = self::get_nonce_key( $view_id, $entry['form_id'], $entry['id'] ); |
|
211
|
|
|
|
|
212
|
|
|
$base = gv_entry_link( $entry, $post_id ? : $view_id ); |
|
213
|
|
|
|
|
214
|
|
|
$url = add_query_arg( array( |
|
215
|
|
|
'edit' => wp_create_nonce( $nonce_key ) |
|
216
|
|
|
), $base ); |
|
217
|
|
|
|
|
218
|
|
|
if( $post_id ) { |
|
219
|
|
|
$url = add_query_arg( array( 'gvid' => $view_id ), $url ); |
|
220
|
|
|
} |
|
221
|
|
|
|
|
222
|
|
|
/** |
|
223
|
|
|
* Allow passing params to dynamically populate entry with values |
|
224
|
|
|
* @since 1.9.2 |
|
225
|
|
|
*/ |
|
226
|
|
|
if( !empty( $field_values ) ) { |
|
227
|
3 |
|
|
|
228
|
|
|
if( is_array( $field_values ) ) { |
|
229
|
|
|
// If already an array, no parse_str() needed |
|
230
|
|
|
$params = $field_values; |
|
231
|
|
|
} else { |
|
232
|
|
|
parse_str( $field_values, $params ); |
|
233
|
|
|
} |
|
234
|
|
|
|
|
235
|
|
|
$url = add_query_arg( $params, $url ); |
|
236
|
|
|
} |
|
237
|
|
|
|
|
238
|
|
|
/** |
|
239
|
|
|
* @filter `gravityview/edit/link` Filter the edit URL link. |
|
240
|
|
|
* @param[in,out] string $url The url. |
|
241
|
|
|
* @param array $entry The entry. |
|
242
|
|
|
* @param \GV\View $view The View. |
|
243
|
|
|
*/ |
|
244
|
|
|
return apply_filters( 'gravityview/edit/link', $url, $entry, \GV\View::by_id( $view_id ) ); |
|
245
|
|
|
} |
|
246
|
|
|
|
|
247
|
|
|
/** |
|
248
|
|
|
* Edit mode doesn't allow certain field types. |
|
249
|
|
|
* @param array $fields Existing blacklist fields |
|
250
|
|
|
* @param string|null $context Context |
|
251
|
|
|
* @return array If not edit context, original field blacklist. Otherwise, blacklist including post fields. |
|
252
|
|
|
*/ |
|
253
|
|
|
public function modify_field_blacklist( $fields = array(), $context = NULL ) { |
|
254
|
|
|
|
|
255
|
|
|
if( empty( $context ) || $context !== 'edit' ) { |
|
256
|
22 |
|
return $fields; |
|
257
|
|
|
} |
|
258
|
|
|
|
|
259
|
22 |
|
$add_fields = $this->get_field_blacklist(); |
|
260
|
|
|
|
|
261
|
|
|
return array_merge( $fields, $add_fields ); |
|
262
|
|
|
} |
|
263
|
|
|
|
|
264
|
|
|
/** |
|
265
|
|
|
* Returns array of field types that should not be displayed in Edit Entry |
|
266
|
|
|
* |
|
267
|
|
|
* @since 1.20 |
|
268
|
|
|
* |
|
269
|
|
|
* @param array $entry Gravity Forms entry array |
|
270
|
|
|
* |
|
271
|
|
|
* @return array Blacklist of field types |
|
272
|
|
|
*/ |
|
273
|
|
|
function get_field_blacklist( $entry = array() ) { |
|
|
|
|
|
|
274
|
|
|
|
|
275
|
|
|
$fields = array( |
|
276
|
|
|
'page', |
|
277
|
22 |
|
'payment_status', |
|
278
|
|
|
'payment_date', |
|
279
|
22 |
|
'payment_amount', |
|
280
|
|
|
'is_fulfilled', |
|
281
|
|
|
'transaction_id', |
|
282
|
|
|
'transaction_type', |
|
283
|
|
|
'captcha', |
|
284
|
|
|
'honeypot', |
|
285
|
|
|
'creditcard', |
|
286
|
|
|
); |
|
287
|
|
|
|
|
288
|
|
|
/** |
|
289
|
|
|
* @filter `gravityview/edit_entry/field_blacklist` Array of fields that should not be displayed in Edit Entry |
|
290
|
|
|
* @since 1.20 |
|
291
|
|
|
* @param array $fields Blacklist field type array |
|
292
|
24 |
|
* @param array $entry Gravity Forms entry array |
|
293
|
|
|
*/ |
|
294
|
|
|
$fields = apply_filters( 'gravityview/edit_entry/field_blacklist', $fields, $entry ); |
|
295
|
24 |
|
|
|
296
|
|
|
return $fields; |
|
297
|
|
|
} |
|
298
|
24 |
|
|
|
299
|
|
|
|
|
300
|
22 |
|
/** |
|
301
|
22 |
|
* checks if user has permissions to edit a specific entry |
|
302
|
|
|
* |
|
303
|
2 |
|
* Needs to be used combined with GravityView_Edit_Entry::user_can_edit_entry for maximum security!! |
|
304
|
|
|
* |
|
305
|
|
|
* @param array $entry Gravity Forms entry array |
|
306
|
2 |
|
* @param \GV\View|int $view ID of the view you want to check visibility against {@since 1.9.2}. Required since 2.0 |
|
307
|
|
|
* @return bool |
|
308
|
|
|
*/ |
|
309
|
|
|
public static function check_user_cap_edit_entry( $entry, $view = 0 ) { |
|
310
|
2 |
|
|
|
311
|
|
|
// No permission by default |
|
312
|
|
|
$user_can_edit = false; |
|
313
|
|
|
|
|
314
|
|
|
// get user_edit setting |
|
315
|
|
|
if ( empty( $view ) ) { |
|
316
|
24 |
|
// @deprecated path |
|
317
|
|
|
$view_id = GravityView_View::getInstance()->getViewId(); |
|
318
|
23 |
|
$user_edit = GravityView_View::getInstance()->getAtts( 'user_edit' ); |
|
319
|
|
|
} else { |
|
320
|
23 |
|
if ( $view instanceof \GV\View ) { |
|
321
|
|
|
$view_id = $view->ID; |
|
322
|
3 |
|
} else { |
|
323
|
|
|
$view_id = $view; |
|
324
|
1 |
|
} |
|
325
|
|
|
|
|
326
|
1 |
|
// in case is specified and not the current view |
|
327
|
|
|
$user_edit = GVCommon::get_template_setting( $view_id, 'user_edit' ); |
|
328
|
|
|
} |
|
329
|
|
|
|
|
330
|
3 |
|
// If they can edit any entries (as defined in Gravity Forms) |
|
331
|
|
|
// Or if they can edit other people's entries |
|
332
|
|
|
// Then we're good. |
|
333
|
3 |
|
if( GVCommon::has_cap( array( 'gravityforms_edit_entries', 'gravityview_edit_others_entries' ), $entry['id'] ) ) { |
|
334
|
|
|
|
|
335
|
2 |
|
gravityview()->log->debug( 'User has ability to edit all entries.' ); |
|
336
|
|
|
|
|
337
|
2 |
|
$user_can_edit = true; |
|
338
|
|
|
|
|
339
|
|
|
} else if( !isset( $entry['created_by'] ) ) { |
|
340
|
|
|
|
|
341
|
2 |
|
gravityview()->log->error( 'Entry `created_by` doesn\'t exist.'); |
|
342
|
|
|
|
|
343
|
2 |
|
$user_can_edit = false; |
|
344
|
|
|
|
|
345
|
2 |
|
} else { |
|
346
|
|
|
|
|
347
|
2 |
|
$current_user = wp_get_current_user(); |
|
348
|
|
|
|
|
349
|
|
|
// User edit is disabled |
|
350
|
|
|
if( empty( $user_edit ) ) { |
|
351
|
|
|
|
|
352
|
|
|
gravityview()->log->debug( 'User Edit is disabled. Returning false.' ); |
|
353
|
|
|
|
|
354
|
|
|
$user_can_edit = false; |
|
355
|
|
|
} |
|
356
|
|
|
|
|
357
|
|
|
// User edit is enabled and the logged-in user is the same as the user who created the entry. We're good. |
|
358
|
|
|
else if( is_user_logged_in() && intval( $current_user->ID ) === intval( $entry['created_by'] ) ) { |
|
359
|
|
|
|
|
360
|
|
|
gravityview()->log->debug( 'User {user_id} created the entry.', array( 'user_id', $current_user->ID ) ); |
|
361
|
|
|
|
|
362
|
|
|
$user_can_edit = true; |
|
363
|
24 |
|
|
|
364
|
|
|
} else if( ! is_user_logged_in() ) { |
|
365
|
24 |
|
|
|
366
|
|
|
gravityview()->log->debug( 'No user defined; edit entry requires logged in user' ); |
|
367
|
|
|
|
|
368
|
|
|
$user_can_edit = false; // Here just for clarity |
|
369
|
|
|
} |
|
370
|
|
|
|
|
371
|
|
|
} |
|
372
|
|
|
|
|
373
|
|
|
/** |
|
374
|
|
|
* @filter `gravityview/edit_entry/user_can_edit_entry` Modify whether user can edit an entry. |
|
375
|
|
|
* @since 1.15 Added `$entry` and `$view_id` parameters |
|
376
|
|
|
* @param[in,out] boolean $user_can_edit Can the current user edit the current entry? (Default: false) |
|
377
|
|
|
* @param[in] array $entry Gravity Forms entry array {@since 1.15} |
|
378
|
|
|
* @param[in] int $view_id ID of the view you want to check visibility against {@since 1.15} |
|
379
|
|
|
*/ |
|
380
|
|
|
$user_can_edit = apply_filters( 'gravityview/edit_entry/user_can_edit_entry', $user_can_edit, $entry, $view_id ); |
|
381
|
|
|
|
|
382
|
|
|
return (bool) $user_can_edit; |
|
383
|
|
|
} |
|
384
|
|
|
|
|
385
|
|
|
|
|
386
|
|
|
|
|
387
|
|
|
} // end class |
|
388
|
|
|
|
|
389
|
|
|
//add_action( 'plugins_loaded', array('GravityView_Edit_Entry', 'getInstance'), 6 ); |
|
390
|
|
|
GravityView_Edit_Entry::getInstance(); |
|
391
|
|
|
|
|
392
|
|
|
|
Adding explicit visibility (
private,protected, orpublic) is generally recommend to communicate to other developers how, and from where this method is intended to be used.