<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Helper functions to work with licenses, permissions and capabilities.

[2] Fix | Delete

*

[3] Fix | Delete

* @since 1.8.0

[4] Fix | Delete

*/

[5] Fix | Delete

[6] Fix | Delete

/**

[7] Fix | Delete

* Determine if the plugin/addon installations are allowed.

[8] Fix | Delete

*

[9] Fix | Delete

* @since 1.6.2.3

[10] Fix | Delete

*

[11] Fix | Delete

* @param string $type Should be `plugin` or `addon`.

[12] Fix | Delete

*

[13] Fix | Delete

* @return bool

[14] Fix | Delete

*/

[15] Fix | Delete

function wpforms_can_install( $type ) {

[16] Fix | Delete

[17] Fix | Delete

return wpforms_can_do( 'install', $type );

[18] Fix | Delete

}

[19] Fix | Delete

[20] Fix | Delete

/**

[21] Fix | Delete

* Determine if the plugin/addon activations are allowed.

[22] Fix | Delete

*

[23] Fix | Delete

* @since 1.7.3

[24] Fix | Delete

*

[25] Fix | Delete

* @param string $type Should be `plugin` or `addon`.

[26] Fix | Delete

*

[27] Fix | Delete

* @return bool

[28] Fix | Delete

*/

[29] Fix | Delete

function wpforms_can_activate( $type ) {

[30] Fix | Delete

[31] Fix | Delete

return wpforms_can_do( 'activate', $type );

[32] Fix | Delete

}

[33] Fix | Delete

[34] Fix | Delete

/**

[35] Fix | Delete

* Determine if the plugin/addon installations/activations are allowed.

[36] Fix | Delete

*

[37] Fix | Delete

* @since 1.7.3

[38] Fix | Delete

*

[39] Fix | Delete

* @internal Use wpforms_can_activate() or wpforms_can_install() instead.

[40] Fix | Delete

*

[41] Fix | Delete

* @param string $what Should be 'activate' or 'install'.

[42] Fix | Delete

* @param string $type Should be `plugin` or `addon`.

[43] Fix | Delete

*

[44] Fix | Delete

* @return bool

[45] Fix | Delete

*/

[46] Fix | Delete

function wpforms_can_do( $what, $type ) {

[47] Fix | Delete

[48] Fix | Delete

if ( ! in_array( $what, [ 'install', 'activate' ], true ) ) {

[49] Fix | Delete

return false;

[50] Fix | Delete

}

[51] Fix | Delete

[52] Fix | Delete

if ( ! in_array( $type, [ 'plugin', 'addon' ], true ) ) {

[53] Fix | Delete

return false;

[54] Fix | Delete

}

[55] Fix | Delete

[56] Fix | Delete

$capability = $what . '_plugins';

[57] Fix | Delete

[58] Fix | Delete

if ( ! current_user_can( $capability ) ) {

[59] Fix | Delete

return false;

[60] Fix | Delete

}

[61] Fix | Delete

[62] Fix | Delete

// Determine whether file modifications are allowed and it is activation permissions checking.

[63] Fix | Delete

if ( $what === 'install' && ! wp_is_file_mod_allowed( 'wpforms_can_install' ) ) {

[64] Fix | Delete

return false;

[65] Fix | Delete

}

[66] Fix | Delete

[67] Fix | Delete

// All plugin checks are done.

[68] Fix | Delete

if ( $type === 'plugin' ) {

[69] Fix | Delete

return true;

[70] Fix | Delete

}

[71] Fix | Delete

[72] Fix | Delete

// Addons require additional license checks.

[73] Fix | Delete

$license = get_option( 'wpforms_license', [] );

[74] Fix | Delete

[75] Fix | Delete

// Allow addons installation if the license is not expired, enabled and valid.

[76] Fix | Delete

return empty( $license['is_expired'] ) && empty( $license['is_disabled'] ) && empty( $license['is_invalid'] );

[77] Fix | Delete

}

[78] Fix | Delete

[79] Fix | Delete

/**

[80] Fix | Delete

* Get the current installation license type (always lowercase).

[81] Fix | Delete

*

[82] Fix | Delete

* @since 1.5.6

[83] Fix | Delete

*

[84] Fix | Delete

* @return string|false

[85] Fix | Delete

*/

[86] Fix | Delete

function wpforms_get_license_type() {

[87] Fix | Delete

[88] Fix | Delete

$type = wpforms_setting( 'type', '', 'wpforms_license' );

[89] Fix | Delete

[90] Fix | Delete

if ( empty( $type ) || ! wpforms_is_pro() ) {

[91] Fix | Delete

return false;

[92] Fix | Delete

}

[93] Fix | Delete

[94] Fix | Delete

return strtolower( $type );

[95] Fix | Delete

}

[96] Fix | Delete

[97] Fix | Delete

/**

[98] Fix | Delete

* Get the current installation license key.

[99] Fix | Delete

*

[100] Fix | Delete

* @since 1.6.2.3

[101] Fix | Delete

* @since 1.8.0 The WPFORMS_LICENSE_KEY constant has higher priority than the DB option.

[102] Fix | Delete

*

[103] Fix | Delete

* @return string

[104] Fix | Delete

*/

[105] Fix | Delete

function wpforms_get_license_key() {

[106] Fix | Delete

[107] Fix | Delete

// Allow wp-config constant to pass key.

[108] Fix | Delete

if ( defined( 'WPFORMS_LICENSE_KEY' ) && WPFORMS_LICENSE_KEY ) {

[109] Fix | Delete

return WPFORMS_LICENSE_KEY;

[110] Fix | Delete

}

[111] Fix | Delete

[112] Fix | Delete

return wpforms_setting( 'key', '', 'wpforms_license' );

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

/**

[116] Fix | Delete

* Get when WPForms was first installed.

[117] Fix | Delete

*

[118] Fix | Delete

* @since 1.6.0

[119] Fix | Delete

*

[120] Fix | Delete

* @param string $type Specific installation type to check for.

[121] Fix | Delete

*

[122] Fix | Delete

* @return int|false Unix timestamp. False on failure.

[123] Fix | Delete

*/

[124] Fix | Delete

function wpforms_get_activated_timestamp( $type = '' ) {

[125] Fix | Delete

[126] Fix | Delete

$activated = (array) get_option( 'wpforms_activated', [] );

[127] Fix | Delete

[128] Fix | Delete

if ( empty( $activated ) ) {

[129] Fix | Delete

return false;

[130] Fix | Delete

}

[131] Fix | Delete

[132] Fix | Delete

// When a passed installation type is empty, then get it from a DB.

[133] Fix | Delete

// If it is installed/activated first, it is saved first.

[134] Fix | Delete

$type = empty( $type ) ? (string) array_keys( $activated )[0] : $type;

[135] Fix | Delete

[136] Fix | Delete

if ( ! empty( $activated[ $type ] ) ) {

[137] Fix | Delete

return absint( $activated[ $type ] );

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

// Fallback.

[141] Fix | Delete

$types = array_diff( [ 'lite', 'pro' ], [ $type ] );

[142] Fix | Delete

[143] Fix | Delete

foreach ( $types as $_type ) {

[144] Fix | Delete

if ( ! empty( $activated[ $_type ] ) ) {

[145] Fix | Delete

return absint( $activated[ $_type ] );

[146] Fix | Delete

}

[147] Fix | Delete

}

[148] Fix | Delete

[149] Fix | Delete

return false;

[150] Fix | Delete

}

[151] Fix | Delete

[152] Fix | Delete

/**

[153] Fix | Delete

* Retrieve a timestamp when WPForms was upgraded.

[154] Fix | Delete

*

[155] Fix | Delete

* @since 1.7.5

[156] Fix | Delete

*

[157] Fix | Delete

* @param string $version Specific plugin version to check for.

[158] Fix | Delete

*

[159] Fix | Delete

* @return int|false Unix timestamp or migration status. False on failure.

[160] Fix | Delete

* Available migration statuses:

[161] Fix | Delete

* -2 if migration is failed;

[162] Fix | Delete

* -1 if migration is started (in progress);

[163] Fix | Delete

* 0 if migration is completed, but no luck to set a timestamp.

[164] Fix | Delete

*/

[165] Fix | Delete

function wpforms_get_upgraded_timestamp( $version ) {

[166] Fix | Delete

[167] Fix | Delete

$option_name = wpforms()->is_pro() ? 'wpforms_versions' : 'wpforms_versions_lite';

[168] Fix | Delete

$upgrades = (array) get_option( $option_name, [] );

[169] Fix | Delete

[170] Fix | Delete

if ( ! isset( $upgrades[ $version ] ) ) {

[171] Fix | Delete

return false;

[172] Fix | Delete

}

[173] Fix | Delete

[174] Fix | Delete

return (int) $upgrades[ $version ];

[175] Fix | Delete

}

[176] Fix | Delete

[177] Fix | Delete

/**

[178] Fix | Delete

* Get the default capability to manage everything for WPForms.

[179] Fix | Delete

*

[180] Fix | Delete

* @since 1.4.4

[181] Fix | Delete

*

[182] Fix | Delete

* @return string

[183] Fix | Delete

*/

[184] Fix | Delete

function wpforms_get_capability_manage_options() {

[185] Fix | Delete

[186] Fix | Delete

/**

[187] Fix | Delete

* Filters the default capability to manage everything for WPForms.

[188] Fix | Delete

* By default, it is 'manage_options'.

[189] Fix | Delete

*

[190] Fix | Delete

* @since 1.4.4

[191] Fix | Delete

*

[192] Fix | Delete

* @param string $capability Default capability to manage everything for WPForms.

[193] Fix | Delete

*/

[194] Fix | Delete

return apply_filters( 'wpforms_manage_cap', 'manage_options' );

[195] Fix | Delete

}

[196] Fix | Delete

[197] Fix | Delete

/**

[198] Fix | Delete

* Check WPForms permissions for currently logged-in user.

[199] Fix | Delete

* Both short (e.g. 'view_own_forms') or long (e.g. 'wpforms_view_own_forms') capability name can be used.

[200] Fix | Delete

* Only WPForms capabilities get processed.

[201] Fix | Delete

*

[202] Fix | Delete

* @since 1.4.4

[203] Fix | Delete

*

[204] Fix | Delete

* @param array|string $caps Capability name(s).

[205] Fix | Delete

* @param int|mixed $id ID of the specific object to check against if capability is a "meta" cap.

[206] Fix | Delete

* "Meta" capabilities, e.g. 'edit_post', 'edit_user', etc.,

[207] Fix | Delete

* are capabilities used by map_meta_cap() to map to other "primitive" capabilities,

[208] Fix | Delete

* e.g. 'edit_posts', 'edit_others_posts', etc.

[209] Fix | Delete

* Accessed via func_get_args() and passed to WP_User::has_cap(), then map_meta_cap().

[210] Fix | Delete

*

[211] Fix | Delete

* @return bool

[212] Fix | Delete

*/

[213] Fix | Delete

function wpforms_current_user_can( $caps = [], $id = 0 ): bool {

[214] Fix | Delete

[215] Fix | Delete

$id = (int) $id;

[216] Fix | Delete

$access = wpforms()->obj( 'access' );

[217] Fix | Delete

[218] Fix | Delete

if ( ! $access || ! method_exists( $access, 'current_user_can' ) ) {

[219] Fix | Delete

return false;

[220] Fix | Delete

}

[221] Fix | Delete

[222] Fix | Delete

$user_can = $access->current_user_can( $caps, $id );

[223] Fix | Delete

[224] Fix | Delete

/**

[225] Fix | Delete

* Filters the result of the WPForms permissions check for the currently logged-in user.

[226] Fix | Delete

*

[227] Fix | Delete

* @since 1.4.4

[228] Fix | Delete

*

[229] Fix | Delete

* @param bool $user_can Whether the current user has the capability.

[230] Fix | Delete

* @param array|string $caps Capability name(s).

[231] Fix | Delete

* @param int $id ID of the specific object to check against if capability is a "meta" cap.

[232] Fix | Delete

*/

[233] Fix | Delete

return apply_filters( 'wpforms_current_user_can', $user_can, $caps, $id );

[234] Fix | Delete

}

[235] Fix | Delete

[236] Fix | Delete

/**

[237] Fix | Delete

* Search for posts editable by user.

[238] Fix | Delete

*

[239] Fix | Delete

* @since 1.7.9

[240] Fix | Delete

*

[241] Fix | Delete

* @param string $search_term Optional search term. Default ''.

[242] Fix | Delete

* @param array $args Args {

[243] Fix | Delete

* Optional. An array of arguments.

[244] Fix | Delete

*

[245] Fix | Delete

* @type string $post_type Post type to search for.

[246] Fix | Delete

* @type string[] $post_status Post status to search for.

[247] Fix | Delete

* @type int $count Number of results to return. Default 20.

[248] Fix | Delete

* }

[249] Fix | Delete

*

[250] Fix | Delete

* @return array

[251] Fix | Delete

* @noinspection PhpTernaryExpressionCanBeReducedToShortVersionInspection

[252] Fix | Delete

* @noinspection ElvisOperatorCanBeUsedInspection

[253] Fix | Delete

*/

[254] Fix | Delete

function wpforms_search_posts( $search_term = '', $args = [] ) {

[255] Fix | Delete

[256] Fix | Delete

global $wpdb;

[257] Fix | Delete

[258] Fix | Delete

$default_args = [

[259] Fix | Delete

'post_type' => 'page',

[260] Fix | Delete

'post_status' => [ 'publish' ],

[261] Fix | Delete

'count' => 20,

[262] Fix | Delete

];

[263] Fix | Delete

$args = wp_parse_args( $args, $default_args );

[264] Fix | Delete

[265] Fix | Delete

// @todo: add trash access capabilities to MySQL.

[266] Fix | Delete

// See edit_post/edit_page case in map_meta_cap().

[267] Fix | Delete

$args['post_status'] = array_diff( $args['post_status'], [ 'trash' ] );

[268] Fix | Delete

[269] Fix | Delete

$user = wp_get_current_user();

[270] Fix | Delete

$user_id = $user->ID ?? 0;

[271] Fix | Delete

$post_type = get_post_type_object( $args['post_type'] );

[272] Fix | Delete

[273] Fix | Delete

if ( ! $user_id || ! $post_type || $args['count'] <= 0 ) {

[274] Fix | Delete

return [];

[275] Fix | Delete

}

[276] Fix | Delete

[277] Fix | Delete

$last_changed = wp_cache_get_last_changed( 'posts' );

[278] Fix | Delete

$key = __FUNCTION__ . ":$search_term:$last_changed";

[279] Fix | Delete

$cache_posts = wp_cache_get( $key, '', false, $found );

[280] Fix | Delete

[281] Fix | Delete

if ( $found ) {

[282] Fix | Delete

return $cache_posts;

[283] Fix | Delete

}

[284] Fix | Delete

[285] Fix | Delete

$post_title_where = $search_term ? $wpdb->prepare(

[286] Fix | Delete

'post_title LIKE %s AND',

[287] Fix | Delete

'%' . $wpdb->esc_like( $search_term ) . '%'

[288] Fix | Delete

) :

[289] Fix | Delete

'';

[290] Fix | Delete

[291] Fix | Delete

$post_statuses = array_intersect( array_keys( get_post_statuses() ), $args['post_status'] );

[292] Fix | Delete

$post_statuses = wpforms_wpdb_prepare_in( $post_statuses );

[293] Fix | Delete

$policy_id = (int) get_option( 'wp_page_for_privacy_policy' );

[294] Fix | Delete

$can_delete_published_posts = (int) $user->has_cap( $post_type->cap->delete_published_posts );

[295] Fix | Delete

$can_delete_posts = (int) $user->has_cap( $post_type->cap->delete_posts );

[296] Fix | Delete

$can_delete_others_posts = (int) $user->has_cap( $post_type->cap->delete_others_posts );

[297] Fix | Delete

$can_delete_private_posts = (int) $user->has_cap( $post_type->cap->delete_private_posts );

[298] Fix | Delete

$can_edit_policy = (int) $user->has_cap( map_meta_cap( 'manage_privacy_options', $user_id )[0] );

[299] Fix | Delete

[300] Fix | Delete

// For the case when user is post author.

[301] Fix | Delete

$capability_author_where = "post_author = $user_id AND

[302] Fix | Delete

( ( post_status IN ( 'publish', 'future' ) AND $can_delete_published_posts ) OR

[303] Fix | Delete

( ( post_status NOT IN ( 'publish', 'future', 'trash' ) ) AND $can_delete_posts )

[304] Fix | Delete

)";

[305] Fix | Delete

[306] Fix | Delete

// For the case when accessing someone other's post.

[307] Fix | Delete

$capability_other_where = "post_author != $user_id AND

[308] Fix | Delete

$can_delete_others_posts AND

[309] Fix | Delete

( ( post_status IN ( 'publish', 'future' ) AND $can_delete_published_posts ) OR

[310] Fix | Delete

( ( post_status IN ( 'private' ) ) AND $can_delete_private_posts )

[311] Fix | Delete

)";

[312] Fix | Delete

[313] Fix | Delete

// For privacy policy page.

[314] Fix | Delete

$capability_policy_where = "ID = $policy_id AND $can_edit_policy";

[315] Fix | Delete

[316] Fix | Delete

$capability_where = '( ' .

[317] Fix | Delete

'(' . $capability_author_where . ') OR ' .

[318] Fix | Delete

'(' . $capability_other_where . ') OR ' .

[319] Fix | Delete

'(' . $capability_policy_where . ')' .

[320] Fix | Delete

' )';

[321] Fix | Delete

[322] Fix | Delete

// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.InterpolatedNotPrepared

[323] Fix | Delete

$posts = $wpdb->get_results(

[324] Fix | Delete

$wpdb->prepare(

[325] Fix | Delete

"SELECT ID, post_title, post_author

[326] Fix | Delete

FROM $wpdb->posts

[327] Fix | Delete

WHERE $post_title_where

[328] Fix | Delete

post_type = %s AND

[329] Fix | Delete

post_status IN ( $post_statuses ) AND

[330] Fix | Delete

$capability_where

[331] Fix | Delete

ORDER BY post_title LIMIT %d",

[332] Fix | Delete

$args['post_type'],

[333] Fix | Delete

absint( $args['count'] )

[334] Fix | Delete

)

[335] Fix | Delete

);

[336] Fix | Delete

// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared

[337] Fix | Delete

[338] Fix | Delete

$posts = $posts ? $posts : [];

[339] Fix | Delete

$posts = array_map(

[340] Fix | Delete

static function ( $post ) {

[341] Fix | Delete

$post->post_title = wpforms_get_post_title( $post );

[342] Fix | Delete

[343] Fix | Delete

unset( $post->post_author );

[344] Fix | Delete

[345] Fix | Delete

return $post;

[346] Fix | Delete

},

[347] Fix | Delete

$posts

[348] Fix | Delete

);

[349] Fix | Delete

[350] Fix | Delete

wp_cache_set( $key, $posts );

[351] Fix | Delete

[352] Fix | Delete

return $posts;

[353] Fix | Delete

}

[354] Fix | Delete

[355] Fix | Delete

/**

[356] Fix | Delete

* Search pages by search term and return an array containing

[357] Fix | Delete

* `value` and `label` which is the post ID and post title respectively.

[358] Fix | Delete

*

[359] Fix | Delete

* @since 1.7.9

[360] Fix | Delete

*

[361] Fix | Delete

* @param string $search_term The search term.

[362] Fix | Delete

* @param array $args Optional. An array of arguments.

[363] Fix | Delete

*

[364] Fix | Delete

* @return array

[365] Fix | Delete

*/

[366] Fix | Delete

function wpforms_search_pages_for_dropdown( $search_term, $args = [] ) {

[367] Fix | Delete

[368] Fix | Delete

$search_results = wpforms_search_posts( $search_term, $args );

[369] Fix | Delete

$result_pages = [];

[370] Fix | Delete

[371] Fix | Delete

// Prepare for ChoicesJS render.

[372] Fix | Delete

foreach ( $search_results as $search_result ) {

[373] Fix | Delete

$result_pages[] = [

[374] Fix | Delete

'value' => absint( $search_result->ID ),

[375] Fix | Delete

'label' => esc_html( $search_result->post_title ),

[376] Fix | Delete

];

[377] Fix | Delete

}

[378] Fix | Delete

[379] Fix | Delete

return $result_pages;

[380] Fix | Delete

}

[381] Fix | Delete

[382] Fix | Delete