<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Admin;

[2] Fix | Delete

[3] Fix | Delete

use WP_Post;

[4] Fix | Delete

[5] Fix | Delete

/**

[6] Fix | Delete

* Form Revisions.

[7] Fix | Delete

*

[8] Fix | Delete

* @since 1.7.3

[9] Fix | Delete

*/

[10] Fix | Delete

class Revisions {

[11] Fix | Delete

[12] Fix | Delete

/**

[13] Fix | Delete

* Current Form Builder panel view.

[14] Fix | Delete

*

[15] Fix | Delete

* @since 1.7.3

[16] Fix | Delete

*

[17] Fix | Delete

* @var string

[18] Fix | Delete

*/

[19] Fix | Delete

private $view = 'revisions';

[20] Fix | Delete

[21] Fix | Delete

/**

[22] Fix | Delete

* Current Form ID.

[23] Fix | Delete

*

[24] Fix | Delete

* @since 1.7.3

[25] Fix | Delete

*

[26] Fix | Delete

* @var int|false

[27] Fix | Delete

*/

[28] Fix | Delete

private $form_id = false;

[29] Fix | Delete

[30] Fix | Delete

/**

[31] Fix | Delete

* Current Form.

[32] Fix | Delete

*

[33] Fix | Delete

* @since 1.7.3

[34] Fix | Delete

*

[35] Fix | Delete

* @var WP_Post|null

[36] Fix | Delete

*/

[37] Fix | Delete

private $form;

[38] Fix | Delete

[39] Fix | Delete

/**

[40] Fix | Delete

* Current Form Revision ID.

[41] Fix | Delete

*

[42] Fix | Delete

* @since 1.7.3

[43] Fix | Delete

*

[44] Fix | Delete

* @var int|false

[45] Fix | Delete

*/

[46] Fix | Delete

private $revision_id = false;

[47] Fix | Delete

[48] Fix | Delete

/**

[49] Fix | Delete

* Current Form Revision.

[50] Fix | Delete

*

[51] Fix | Delete

* @since 1.7.3

[52] Fix | Delete

*

[53] Fix | Delete

* @var WP_Post|null

[54] Fix | Delete

*/

[55] Fix | Delete

private $revision;

[56] Fix | Delete

[57] Fix | Delete

/**

[58] Fix | Delete

* Whether revisions panel was already viewed by the user at least once.

[59] Fix | Delete

*

[60] Fix | Delete

* @since 1.7.3

[61] Fix | Delete

*

[62] Fix | Delete

* @var bool

[63] Fix | Delete

*/

[64] Fix | Delete

private $viewed;

[65] Fix | Delete

[66] Fix | Delete

/**

[67] Fix | Delete

* Initialize the class if preconditions are met.

[68] Fix | Delete

*

[69] Fix | Delete

* @since 1.7.3

[70] Fix | Delete

*

[71] Fix | Delete

* @return void

[72] Fix | Delete

*/

[73] Fix | Delete

public function init() {

[74] Fix | Delete

[75] Fix | Delete

if ( ! $this->allow_load() ) {

[76] Fix | Delete

return;

[77] Fix | Delete

}

[78] Fix | Delete

[79] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Recommended

[80] Fix | Delete

[81] Fix | Delete

if ( isset( $_REQUEST['view'] ) ) {

[82] Fix | Delete

$this->view = sanitize_key( $_REQUEST['view'] );

[83] Fix | Delete

}

[84] Fix | Delete

[85] Fix | Delete

if ( isset( $_REQUEST['revision_id'] ) ) {

[86] Fix | Delete

$this->revision_id = absint( $_REQUEST['revision_id'] );

[87] Fix | Delete

}

[88] Fix | Delete

[89] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Recommended

[90] Fix | Delete

[91] Fix | Delete

if ( ! $this->can_access_form() ) {

[92] Fix | Delete

return;

[93] Fix | Delete

}

[94] Fix | Delete

[95] Fix | Delete

if ( $this->revision_id && wp_revisions_enabled( $this->form ) ) {

[96] Fix | Delete

$this->revision = wp_get_post_revision( $this->revision_id );

[97] Fix | Delete

[98] Fix | Delete

// Bail if we don't have a valid revision.

[99] Fix | Delete

if (

[100] Fix | Delete

! $this->revision instanceof WP_Post ||

[101] Fix | Delete

$this->revision->post_parent !== $this->form_id ||

[102] Fix | Delete

$this->revision->ID !== $this->revision_id

[103] Fix | Delete

) {

[104] Fix | Delete

return;

[105] Fix | Delete

}

[106] Fix | Delete

}

[107] Fix | Delete

[108] Fix | Delete

$this->hooks();

[109] Fix | Delete

}

[110] Fix | Delete

[111] Fix | Delete

/**

[112] Fix | Delete

* Whether it is allowed to load under certain conditions.

[113] Fix | Delete

*

[114] Fix | Delete

* - numeric, non-zero form ID provided,

[115] Fix | Delete

* - the form with this ID exists and was successfully fetched,

[116] Fix | Delete

* - we're in the Form Builder or processing an ajax request.

[117] Fix | Delete

*

[118] Fix | Delete

* @since 1.7.3

[119] Fix | Delete

*

[120] Fix | Delete

* @return bool

[121] Fix | Delete

*/

[122] Fix | Delete

private function allow_load() {

[123] Fix | Delete

[124] Fix | Delete

if ( ! ( wpforms_is_admin_page( 'builder' ) || wp_doing_ajax() ) ) {

[125] Fix | Delete

return false;

[126] Fix | Delete

}

[127] Fix | Delete

[128] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Recommended

[129] Fix | Delete

$id = wp_doing_ajax() && isset( $_REQUEST['id'] ) ? absint( $_REQUEST['id'] ) : false;

[130] Fix | Delete

$id = isset( $_REQUEST['form_id'] ) && ! is_array( $_REQUEST['form_id'] ) ? absint( $_REQUEST['form_id'] ) : $id;

[131] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Recommended

[132] Fix | Delete

[133] Fix | Delete

$this->form_id = $id;

[134] Fix | Delete

$form_handler = wpforms()->obj( 'form' );

[135] Fix | Delete

[136] Fix | Delete

if ( ! $form_handler ) {

[137] Fix | Delete

return false;

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

$this->form = $form_handler->get( $this->form_id );

[141] Fix | Delete

[142] Fix | Delete

return $this->form_id && $this->form instanceof WP_Post;

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

/**

[146] Fix | Delete

* Hook into WordPress lifecycle.

[147] Fix | Delete

*

[148] Fix | Delete

* @since 1.7.3

[149] Fix | Delete

*/

[150] Fix | Delete

private function hooks() {

[151] Fix | Delete

[152] Fix | Delete

// Restore a revision. The `admin_init` action has already fired, `current_screen` fires before headers are sent.

[153] Fix | Delete

add_action( 'current_screen', [ $this, 'process_restore' ] );

[154] Fix | Delete

[155] Fix | Delete

// Refresh a rendered list of revisions on the frontend.

[156] Fix | Delete

add_action( 'wp_ajax_wpforms_get_form_revisions', [ $this, 'fetch_revisions_list' ] );

[157] Fix | Delete

[158] Fix | Delete

// Mark Revisions panel as viewed when viewed for the first time. Hides the error badge.

[159] Fix | Delete

add_action( 'wp_ajax_wpforms_mark_panel_viewed', [ $this, 'mark_panel_viewed' ] );

[160] Fix | Delete

[161] Fix | Delete

// Back-compat for forms created with revisions disabled.

[162] Fix | Delete

add_action( 'wpforms_builder_init', [ $this, 'maybe_create_initial_revision' ] );

[163] Fix | Delete

[164] Fix | Delete

// Pass localized strings to frontend.

[165] Fix | Delete

add_filter( 'wpforms_builder_strings', [ $this, 'get_localized_strings' ], 10, 2 );

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

/**

[169] Fix | Delete

* Get current revision, if available.

[170] Fix | Delete

*

[171] Fix | Delete

* @since 1.7.3

[172] Fix | Delete

*

[173] Fix | Delete

* @return WP_Post|null

[174] Fix | Delete

*/

[175] Fix | Delete

public function get_revision() {

[176] Fix | Delete

[177] Fix | Delete

return $this->revision;

[178] Fix | Delete

}

[179] Fix | Delete

[180] Fix | Delete

/**

[181] Fix | Delete

* Get formatted date or time.

[182] Fix | Delete

*

[183] Fix | Delete

* @since 1.7.3

[184] Fix | Delete

*

[185] Fix | Delete

* @param string $datetime UTC datetime from the post object.

[186] Fix | Delete

* @param string $part What to return - date or time, defaults to date.

[187] Fix | Delete

*

[188] Fix | Delete

* @return string

[189] Fix | Delete

*/

[190] Fix | Delete

public function get_formatted_datetime( $datetime, $part = 'date' ) {

[191] Fix | Delete

[192] Fix | Delete

if ( $part === 'time' ) {

[193] Fix | Delete

return wpforms_time_format( $datetime, '', true );

[194] Fix | Delete

}

[195] Fix | Delete

[196] Fix | Delete

// M j format needs to keep one-line date.

[197] Fix | Delete

return wpforms_date_format( $datetime, 'M j', true );

[198] Fix | Delete

}

[199] Fix | Delete

[200] Fix | Delete

/**

[201] Fix | Delete

* Get admin (Form Builder) base URL with additional query args.

[202] Fix | Delete

*

[203] Fix | Delete

* @since 1.7.3

[204] Fix | Delete

*

[205] Fix | Delete

* @param array $query_args Additional query args to append to the base URL.

[206] Fix | Delete

*

[207] Fix | Delete

* @return string

[208] Fix | Delete

*/

[209] Fix | Delete

public function get_url( $query_args = [] ) {

[210] Fix | Delete

[211] Fix | Delete

$defaults = [

[212] Fix | Delete

'page' => 'wpforms-builder',

[213] Fix | Delete

'view' => $this->view,

[214] Fix | Delete

'form_id' => $this->form_id,

[215] Fix | Delete

];

[216] Fix | Delete

[217] Fix | Delete

return add_query_arg(

[218] Fix | Delete

wp_parse_args( $query_args, $defaults ),

[219] Fix | Delete

admin_url( 'admin.php' )

[220] Fix | Delete

);

[221] Fix | Delete

}

[222] Fix | Delete

[223] Fix | Delete

/**

[224] Fix | Delete

* Determine if Revisions panel was previously viewed by current user.

[225] Fix | Delete

*

[226] Fix | Delete

* @since 1.7.3

[227] Fix | Delete

*

[228] Fix | Delete

* @return bool

[229] Fix | Delete

*/

[230] Fix | Delete

public function panel_viewed() {

[231] Fix | Delete

[232] Fix | Delete

if ( $this->viewed === null ) {

[233] Fix | Delete

$this->viewed = (bool) get_user_meta( get_current_user_id(), 'wpforms_revisions_disabled_notice_dismissed', true );

[234] Fix | Delete

}

[235] Fix | Delete

[236] Fix | Delete

return $this->viewed;

[237] Fix | Delete

}

[238] Fix | Delete

[239] Fix | Delete

/**

[240] Fix | Delete

* Mark Revisions panel as viewed by current user.

[241] Fix | Delete

*

[242] Fix | Delete

* @since 1.7.3

[243] Fix | Delete

*/

[244] Fix | Delete

public function mark_panel_viewed() {

[245] Fix | Delete

[246] Fix | Delete

// Run a security check.

[247] Fix | Delete

check_ajax_referer( 'wpforms-builder', 'nonce' );

[248] Fix | Delete

[249] Fix | Delete

if ( ! $this->panel_viewed() ) {

[250] Fix | Delete

$this->viewed = update_user_meta( get_current_user_id(), 'wpforms_revisions_disabled_notice_dismissed', true );

[251] Fix | Delete

}

[252] Fix | Delete

[253] Fix | Delete

wp_send_json_success( [ 'updated' => $this->viewed ] );

[254] Fix | Delete

}

[255] Fix | Delete

[256] Fix | Delete

/**

[257] Fix | Delete

* Get a rendered list of all revisions.

[258] Fix | Delete

*

[259] Fix | Delete

* @since 1.7.3

[260] Fix | Delete

*

[261] Fix | Delete

* @return string

[262] Fix | Delete

*/

[263] Fix | Delete

public function render_revisions_list() {

[264] Fix | Delete

[265] Fix | Delete

return wpforms_render(

[266] Fix | Delete

'builder/revisions/list',

[267] Fix | Delete

$this->prepare_template_render_arguments(),

[268] Fix | Delete

true

[269] Fix | Delete

);

[270] Fix | Delete

}

[271] Fix | Delete

[272] Fix | Delete

/**

[273] Fix | Delete

* Prepare all arguments for the template to be rendered.

[274] Fix | Delete

*

[275] Fix | Delete

* Note: All data is escaped in the template.

[276] Fix | Delete

*

[277] Fix | Delete

* @since 1.7.3

[278] Fix | Delete

*

[279] Fix | Delete

* @return array

[280] Fix | Delete

*/

[281] Fix | Delete

private function prepare_template_render_arguments() {

[282] Fix | Delete

[283] Fix | Delete

$args = [

[284] Fix | Delete

'active_class' => $this->revision ? '' : ' active',

[285] Fix | Delete

'current_version_url' => $this->get_url(),

[286] Fix | Delete

'author_id' => $this->form->post_author,

[287] Fix | Delete

'revisions' => [],

[288] Fix | Delete

'show_avatars' => get_option( 'show_avatars' ),

[289] Fix | Delete

];

[290] Fix | Delete

[291] Fix | Delete

$revisions = wp_get_post_revisions( $this->form_id );

[292] Fix | Delete

[293] Fix | Delete

if ( empty( $revisions ) ) {

[294] Fix | Delete

return $args;

[295] Fix | Delete

}

[296] Fix | Delete

[297] Fix | Delete

// WordPress always orders entries by `post_date` column, which contains a date and time in site's timezone configured in settings.

[298] Fix | Delete

// This setting is per site, not per user, and it's not expected to be changed. However, if it was changed for whatever reason,

[299] Fix | Delete

// the order of revisions will be incorrect. This is definitely an edge case, but we can prevent this from ever happening

[300] Fix | Delete

// by sorting the results using `post_date_gmt` or `post_modified_gmt`, which contains UTC date and never changes.

[301] Fix | Delete

uasort(

[302] Fix | Delete

$revisions,

[303] Fix | Delete

static function ( $a, $b ) {

[304] Fix | Delete

[305] Fix | Delete

return strtotime( $a->post_modified_gmt ) > strtotime( $b->post_modified_gmt ) ? -1 : 1;

[306] Fix | Delete

}

[307] Fix | Delete

);

[308] Fix | Delete

[309] Fix | Delete

// The first revision is always identical to the current version and should not be displayed in the list.

[310] Fix | Delete

$current_revision = array_shift( $revisions );

[311] Fix | Delete

[312] Fix | Delete

// Display the author of current version instead of a form author.

[313] Fix | Delete

$args['author_id'] = $current_revision->post_author;

[314] Fix | Delete

[315] Fix | Delete

foreach ( $revisions as $revision ) {

[316] Fix | Delete

$time_diff = sprintf( /* translators: %s - relative time difference, e.g. "5 minutes", "12 days". */

[317] Fix | Delete

__( '%s ago', 'wpforms-lite' ),

[318] Fix | Delete

human_time_diff( strtotime( $revision->post_modified_gmt . ' +0000' ) )

[319] Fix | Delete

);

[320] Fix | Delete

[321] Fix | Delete

$date_time = sprintf( /* translators: %1$s - date, %2$s - time when item was created, e.g. "Oct 22 at 11:11am". */

[322] Fix | Delete

__( '%1$s at %2$s', 'wpforms-lite' ),

[323] Fix | Delete

$this->get_formatted_datetime( $revision->post_modified_gmt ),

[324] Fix | Delete

$this->get_formatted_datetime( $revision->post_modified_gmt, 'time' )

[325] Fix | Delete

);

[326] Fix | Delete

[327] Fix | Delete

$args['revisions'][] = [

[328] Fix | Delete

'active_class' => $this->revision && $this->revision->ID === $revision->ID ? ' active' : '',

[329] Fix | Delete

'url' => $this->get_url(

[330] Fix | Delete

[

[331] Fix | Delete

'revision_id' => $revision->ID,

[332] Fix | Delete

]

[333] Fix | Delete

),

[334] Fix | Delete

'author_id' => $revision->post_author,

[335] Fix | Delete

'time_diff' => $time_diff,

[336] Fix | Delete

'date_time' => $date_time,

[337] Fix | Delete

];

[338] Fix | Delete

}

[339] Fix | Delete

[340] Fix | Delete

return $args;

[341] Fix | Delete

}

[342] Fix | Delete

[343] Fix | Delete

/**

[344] Fix | Delete

* Fetch a list of revisions via ajax.

[345] Fix | Delete

*

[346] Fix | Delete

* @since 1.7.3

[347] Fix | Delete

*/

[348] Fix | Delete

public function fetch_revisions_list() {

[349] Fix | Delete

[350] Fix | Delete

// Run a security check.

[351] Fix | Delete

check_ajax_referer( 'wpforms-builder', 'nonce' );

[352] Fix | Delete

[353] Fix | Delete

wp_send_json_success(

[354] Fix | Delete

[

[355] Fix | Delete

'html' => $this->render_revisions_list(),

[356] Fix | Delete

]

[357] Fix | Delete

);

[358] Fix | Delete

}

[359] Fix | Delete

[360] Fix | Delete

/**

[361] Fix | Delete

* Restore the revision (if needed) and reload the Form Builder.

[362] Fix | Delete

*

[363] Fix | Delete

* @since 1.7.3

[364] Fix | Delete

*

[365] Fix | Delete

* @return void

[366] Fix | Delete

*/

[367] Fix | Delete

public function process_restore() {

[368] Fix | Delete

[369] Fix | Delete

$is_restore_request = isset( $_GET['action'] ) && $_GET['action'] === 'restore_revision';

[370] Fix | Delete

[371] Fix | Delete

// Bail early.

[372] Fix | Delete

if (

[373] Fix | Delete

! $is_restore_request ||

[374] Fix | Delete

! $this->form_id ||

[375] Fix | Delete

! $this->form ||

[376] Fix | Delete

! $this->revision_id ||

[377] Fix | Delete

! $this->revision ||

[378] Fix | Delete

! check_admin_referer( 'restore_revision', 'wpforms_nonce' )

[379] Fix | Delete

) {

[380] Fix | Delete

return;

[381] Fix | Delete

}

[382] Fix | Delete

[383] Fix | Delete

if ( ! $this->can_access_form() ) {

[384] Fix | Delete

wp_die( esc_html__( 'You do not have permission to restore revisions for this form.', 'wpforms-lite' ) );

[385] Fix | Delete

}

[386] Fix | Delete

[387] Fix | Delete

if (

[388] Fix | Delete

! $this->revision instanceof WP_Post ||

[389] Fix | Delete

$this->revision->post_parent !== $this->form_id ||

[390] Fix | Delete

$this->revision->ID !== $this->revision_id

[391] Fix | Delete

) {

[392] Fix | Delete

wp_die( esc_html__( 'Invalid revision. The revision does not belong to this form.', 'wpforms-lite' ) );

[393] Fix | Delete

}

[394] Fix | Delete

[395] Fix | Delete

$restored_id = wp_restore_post_revision( $this->revision );

[396] Fix | Delete

[397] Fix | Delete

if ( $restored_id ) {

[398] Fix | Delete

wp_safe_redirect(

[399] Fix | Delete

wpforms()->obj( 'revisions' )->get_url(

[400] Fix | Delete

[

[401] Fix | Delete

'form_id' => $restored_id,

[402] Fix | Delete

]

[403] Fix | Delete

)

[404] Fix | Delete

);

[405] Fix | Delete

[406] Fix | Delete

exit;

[407] Fix | Delete

}

[408] Fix | Delete

}

[409] Fix | Delete

[410] Fix | Delete

/**

[411] Fix | Delete

* Create initial revision for existing form.

[412] Fix | Delete

*

[413] Fix | Delete

* When a new form is created with revisions enabled, WordPress immediately creates first revision which is identical to the form. But when

[414] Fix | Delete

* a form was created with revisions disabled, this initial revision does not exist. Revisions are saved after post update, so modifying

[415] Fix | Delete

* a form that have no initial revision will update the post first, then a revision of this updated post will be saved. The version of

[416] Fix | Delete

* the form that existed before this update is now gone. To avoid losing this pre-revisions state, we create this initial revision

[417] Fix | Delete

* when the Form Builder loads, if needed.

[418] Fix | Delete

*

[419] Fix | Delete

* @since 1.7.3

[420] Fix | Delete

*

[421] Fix | Delete

* @return void

[422] Fix | Delete

*/

[423] Fix | Delete

public function maybe_create_initial_revision() {

[424] Fix | Delete

[425] Fix | Delete

// On new form creation there's no revisions yet, bail. Also, when revisions are disabled.

[426] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[427] Fix | Delete

if ( isset( $_GET['newform'] ) || ! wp_revisions_enabled( $this->form ) ) {

[428] Fix | Delete

return;

[429] Fix | Delete

}

[430] Fix | Delete

[431] Fix | Delete

$revisions = wp_get_post_revisions(

[432] Fix | Delete

$this->form_id,

[433] Fix | Delete

[

[434] Fix | Delete

'fields' => 'ids',

[435] Fix | Delete

'numberposts' => 1,

[436] Fix | Delete

]

[437] Fix | Delete

);

[438] Fix | Delete

[439] Fix | Delete

if ( $revisions ) {

[440] Fix | Delete

return;

[441] Fix | Delete

}

[442] Fix | Delete

[443] Fix | Delete

$initial_revision_id = wp_save_post_revision( $this->form_id );

[444] Fix | Delete

$initial_revision = wp_get_post_revision( $initial_revision_id );

[445] Fix | Delete

[446] Fix | Delete

// Initial revision should belong to the author of the original form.

[447] Fix | Delete

if ( $initial_revision->post_author !== $this->form->post_author ) {

[448] Fix | Delete

[449] Fix | Delete

wp_update_post(

[450] Fix | Delete

[

[451] Fix | Delete

'ID' => $initial_revision_id,

[452] Fix | Delete

'post_author' => $this->form->post_author,

[453] Fix | Delete

]

[454] Fix | Delete

);

[455] Fix | Delete

}

[456] Fix | Delete

}

[457] Fix | Delete

[458] Fix | Delete

/**

[459] Fix | Delete

* Pass localized strings to frontend.

[460] Fix | Delete

*

[461] Fix | Delete

* @since 1.7.3

[462] Fix | Delete

*

[463] Fix | Delete

* @param array $strings All strings that will be passed to frontend.

[464] Fix | Delete

* @param WP_Post $form Current form object.

[465] Fix | Delete

*

[466] Fix | Delete

* @return array

[467] Fix | Delete

*/

[468] Fix | Delete

public function get_localized_strings( $strings, $form ) {

[469] Fix | Delete

[470] Fix | Delete

$strings['revision_update_confirm'] = esc_html__( 'You’re about to save a form revision. Continuing will make this the current version.', 'wpforms-lite' );

[471] Fix | Delete

[472] Fix | Delete

return $strings;

[473] Fix | Delete

}

[474] Fix | Delete

[475] Fix | Delete

/**

[476] Fix | Delete

* Check if the current user has permission to access the form and its revisions.

[477] Fix | Delete

*

[478] Fix | Delete

* @since 1.9.5

[479] Fix | Delete

*

[480] Fix | Delete

* @return bool

[481] Fix | Delete

*/

[482] Fix | Delete

private function can_access_form(): bool {

[483] Fix | Delete

[484] Fix | Delete

if ( ! wpforms_current_user_can( 'view_form_single', $this->form_id ) ) {

[485] Fix | Delete

return false;

[486] Fix | Delete

}

[487] Fix | Delete

[488] Fix | Delete

if ( ! wpforms_current_user_can( 'edit_form_single', $this->form_id ) ) {

[489] Fix | Delete

return false;

[490] Fix | Delete

}

[491] Fix | Delete

[492] Fix | Delete

return true;

[493] Fix | Delete

}

[494] Fix | Delete

}

[495] Fix | Delete

[496] Fix | Delete