From 4869d273ba1697aedf6d82bad5b0e5c735b1c800 Mon Sep 17 00:00:00 2001
From: Mykyta Synelnikov <nsinelnikov.work@gmail.com>
Date: Thu, 22 Jun 2023 12:00:45 +0300
Subject: [PATCH] - removed extract() function from
 `um_admin_field_update_error_handling()` function; - added hookdoc for
 `um_admin_builder_skip_field_validation` hook; - updated hookdoc for
 `um_admin_field_update_error_handling` hook; - fixed deprecated PHP notice
 for $set_field_type variable; - changed htmlspecialchars to esc_attr() for
 form builder modal;

---
 includes/admin/core/class-admin-builder.php | 167 +++++++++++---------
 includes/admin/core/class-admin-metabox.php |  16 +-
 2 files changed, 100 insertions(+), 83 deletions(-)

diff --git a/includes/admin/core/class-admin-builder.php b/includes/admin/core/class-admin-builder.php
index a2eca841..bdfd994f 100644
--- a/includes/admin/core/class-admin-builder.php
+++ b/includes/admin/core/class-admin-builder.php
@@ -37,78 +37,96 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
 		}
 
 		/**
-		 * Apply a filter to handle errors for field updating in backend
+		 * Apply a filter to handle errors for field updating in backend.
 		 *
-		 * @param $errors
-		 * @param $array
+		 * @param null|array $errors
+		 * @param array      $submission_data
 		 *
 		 * @return mixed
 		 */
-		function um_admin_field_update_error_handling( $errors, $array ) {
-			/**
-			 * @var $field_type
-			 */
-			extract( $array );
+		public function um_admin_field_update_error_handling( $errors, $submission_data ) {
+			if ( ! array_key_exists( 'field_type', $submission_data ) ) {
+				return $errors;
+			}
 
-			$field_attr = UM()->builtin()->get_core_field_attrs( $field_type );
-
-			if ( isset( $field_attr['validate'] ) ) {
-
-				$validate = $field_attr['validate'];
-				foreach ( $validate as $post_input => $arr ) {
-
-					$skip = apply_filters( 'um_admin_builder_skip_field_validation', false, $post_input, $array );
-					if ( $skip ) {
-						continue;
-					}
-
-					$mode = $arr['mode'];
-
-					switch ( $mode ) {
-
-						case 'numeric':
-							if ( ! empty( $array['post'][ $post_input ] ) && ! is_numeric( $array['post'][ $post_input ] ) ){
-								$errors[ $post_input ] = $validate[ $post_input ]['error'];
-							}
-							break;
-
-						case 'unique':
-							if ( ! isset( $array['post']['edit_mode'] ) ) {
-								if ( UM()->builtin()->unique_field_err( $array['post'][ $post_input ] ) ) {
-									$errors[ $post_input ] = UM()->builtin()->unique_field_err( $array['post'][ $post_input ] );
-								}
-							}
-							break;
-
-						case 'required':
-							if ( $array['post'][ $post_input ] == '' ) {
-								$errors[ $post_input ] = $validate[ $post_input ]['error'];
-							}
-							break;
-
-						case 'range-start':
-							if ( UM()->builtin()->date_range_start_err( $array['post'][ $post_input ] ) && $array['post']['_range'] == 'date_range' ) {
-								$errors[ $post_input ] = UM()->builtin()->date_range_start_err( $array['post'][ $post_input ] );
-							}
-							break;
-
-						case 'range-end':
-							if ( UM()->builtin()->date_range_end_err( $array['post'][ $post_input ], $array['post']['_range_start'] ) && $array['post']['_range'] == 'date_range' ) {
-								$errors[ $post_input ] = UM()->builtin()->date_range_end_err( $array['post'][ $post_input ], $array['post']['_range_start'] );
-							}
-							break;
-
-					}
+			$field_attr = UM()->builtin()->get_core_field_attrs( $submission_data['field_type'] );
+			if ( ! array_key_exists( 'validate', $field_attr ) ) {
+				return $errors;
+			}
 
+			$validate = $field_attr['validate'];
+			foreach ( $validate as $post_input => $arr ) {
+				/**
+				 * Filters the marker for skipping field validation.
+				 *
+				 * @param {bool}   $skip            Errors list. It's null by default.
+				 * @param {string} $post_input      Field key for validation.
+				 * @param {array}  $submission_data Update field handler data.
+				 *
+				 * @return {bool} True for skipping validation.
+				 *
+				 * @since 2.1.0
+				 * @hook um_admin_builder_skip_field_validation
+				 *
+				 * @example <caption>Skipping validation for the `_options` setting field for `billing_country` and `shipping_country` form fields.</caption>
+				 * function my_custom_um_admin_builder_skip_field_validation( $skip, $post_input, $submission_data ) {
+				 *     if ( $post_input === '_options' && isset( $submission_data['post']['_metakey'] ) && in_array( $submission_data['post']['_metakey'], array( 'billing_country', 'shipping_country' ), true ) ) {
+				 *         $skip = true;
+				 *     }
+				 *     return $skip;
+				 * }
+				 * add_filter( 'um_admin_builder_skip_field_validation', 'my_custom_um_admin_builder_skip_field_validation', 10, 3 );
+				 */
+				$skip = apply_filters( 'um_admin_builder_skip_field_validation', false, $post_input, $submission_data );
+				if ( $skip ) {
+					continue;
 				}
 
+				if ( ! array_key_exists( 'mode', $arr ) ) {
+					continue;
+				}
+
+				switch ( $arr['mode'] ) {
+					case 'numeric':
+						if ( ! empty( $submission_data['post'][ $post_input ] ) && ! is_numeric( $submission_data['post'][ $post_input ] ) ) {
+							$errors[ $post_input ] = $validate[ $post_input ]['error'];
+						}
+						break;
+					case 'unique':
+						if ( ! isset( $submission_data['post']['edit_mode'] ) ) {
+							$mode_error = UM()->builtin()->unique_field_err( $submission_data['post'][ $post_input ] );
+							if ( ! empty( $mode_error ) ) {
+								$errors[ $post_input ] = $mode_error;
+							}
+						}
+						break;
+					case 'required':
+						if ( '' === $submission_data['post'][ $post_input ] ) {
+							$errors[ $post_input ] = $validate[ $post_input ]['error'];
+						}
+						break;
+					case 'range-start':
+						if ( 'date_range' === $submission_data['post']['_range'] ) {
+							$mode_error = UM()->builtin()->date_range_start_err( $submission_data['post'][ $post_input ] );
+							if ( ! empty( $mode_error ) ) {
+								$errors[ $post_input ] = $mode_error;
+							}
+						}
+						break;
+					case 'range-end':
+						if ( 'date_range' === $submission_data['post']['_range'] ) {
+							$mode_error = UM()->builtin()->date_range_end_err( $submission_data['post'][ $post_input ], $submission_data['post']['_range_start'] );
+							if ( ! empty( $mode_error ) ) {
+								$errors[ $post_input ] = $mode_error;
+							}
+						}
+						break;
+				}
 			}
 
 			return $errors;
-
 		}
 
-
 		/**
 		 * Some fields may require extra fields before saving
 		 *
@@ -646,25 +664,22 @@ if ( ! class_exists( 'um\admin\core\Admin_Builder' ) ) {
 			$array = apply_filters( 'um_admin_pre_save_fields_hook', $array );
 
 			/**
-			 * UM hook
+			 * Filters the validation errors on the update field in Form Builder.
 			 *
-			 * @type filter
-			 * @title um_admin_field_update_error_handling
-			 * @description Change error string on save field
-			 * @input_vars
-			 * [{"var":"$error","type":"string","desc":"Error String"},
-			 * {"var":"$array","type":"array","desc":"Save Field data"}]
-			 * @change_log
-			 * ["Since: 2.0"]
-			 * @usage add_filter( 'um_admin_field_update_error_handling', 'function_name', 10, 2 );
-			 * @example
-			 * <?php
-			 * add_filter( 'um_admin_field_update_error_handling', 'my_admin_field_update_error', 10, 2 );
-			 * function my_admin_field_update_error( $error, $array ) {
-			 *     // your code here
-			 *     return $error;
+			 * @param {null|array} $errors          Errors list. It's null by default.
+			 * @param {array}      $submission_data Update field handler data.
+			 *
+			 * @return {array} Errors list.
+			 *
+			 * @since 1.3.x
+			 * @hook um_admin_field_update_error_handling
+			 *
+			 * @example <caption>Added error with Error text to the field by the field key.</caption>
+			 * function my_custom_um_admin_field_update_error_handling( $errors, $submission_data ) {
+			 *     $errors['{field_key}'] = {Error text};
+			 *     return $errors;
 			 * }
-			 * ?>
+			 * add_filter( 'um_admin_field_update_error_handling', 'my_custom_um_admin_field_update_error_handling', 10, 2 );
 			 */
 			$output['error'] = apply_filters( 'um_admin_field_update_error_handling', $output['error'], $array );
 
diff --git a/includes/admin/core/class-admin-metabox.php b/includes/admin/core/class-admin-metabox.php
index e226068d..2b4a9c96 100644
--- a/includes/admin/core/class-admin-metabox.php
+++ b/includes/admin/core/class-admin-metabox.php
@@ -61,6 +61,8 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 		 */
 		public $is_loaded = false;
 
+		public $set_field_type;
+
 		/**
 		 * Admin_Metabox constructor.
 		 */
@@ -1820,7 +1822,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p><label for="_format_custom"><?php _e( 'Use custom Date format', 'ultimate-member' ); ?> <?php UM()->tooltip( __( 'This option overrides "Date User-Friendly Format" option. See https://www.php.net/manual/en/function.date.php', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_format_custom" id="_format_custom" value="<?php echo htmlspecialchars( $this->edit_mode_value, ENT_QUOTES ); ?>" placeholder="j M Y" />
+						<input type="text" name="_format_custom" id="_format_custom" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" placeholder="j M Y" />
 					</p>
 
 					<?php
@@ -2191,7 +2193,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p><label for="_title"><?php _e( 'Title', 'ultimate-member' ) ?> <?php UM()->tooltip( __( 'This is the title of the field for your reference in the backend. The title will not appear on the front-end of your website.', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_title" id="_title" value="<?php echo htmlspecialchars( $this->edit_mode_value, ENT_QUOTES ); ?>" />
+						<input type="text" name="_title" id="_title" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 					<?php
@@ -2202,7 +2204,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p style="display:none"><label for="_id"><?php _e( 'Unique ID', 'ultimate-member' ) ?></label>
-						<input type="text" name="_id" id="_id" value="<?php echo $this->edit_mode_value; ?>" />
+						<input type="text" name="_id" id="_id" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 					<?php
@@ -2271,7 +2273,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 				<?php } else { ?>
 
 					<p><label for="_default"><?php _e( 'Default Value', 'ultimate-member' ); ?> <?php UM()->tooltip( __( 'This option allows you to pre-fill the field with a default value prior to the user entering a value in the field. Leave blank to have no default value', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_default" id="_default" value="<?php echo $this->edit_mode_value; ?>" />
+						<input type="text" name="_default" id="_default" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 				<?php } ?>
@@ -2283,7 +2285,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p><label for="_label"><?php _e( 'Label', 'ultimate-member' ) ?> <?php UM()->tooltip( __( 'The field label is the text that appears above the field on your front-end form. Leave blank to not show a label above field.', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_label" id="_label" value="<?php echo htmlspecialchars( $this->edit_mode_value, ENT_QUOTES ); ?>" />
+						<input type="text" name="_label" id="_label" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 					<?php
@@ -2293,7 +2295,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p><label for="_label_confirm_pass"><?php _e( 'Confirm password field label', 'ultimate-member' ) ?> <?php UM()->tooltip( __( 'This label is the text that appears above the confirm password field. Leave blank to show default label.', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_label_confirm_pass" id="_label_confirm_pass" value="<?php echo htmlspecialchars( $this->edit_mode_value, ENT_QUOTES ); ?>" />
+						<input type="text" name="_label_confirm_pass" id="_label_confirm_pass" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 					<?php
@@ -2303,7 +2305,7 @@ if ( ! class_exists( 'um\admin\core\Admin_Metabox' ) ) {
 					?>
 
 					<p><label for="_placeholder"><?php _e( 'Placeholder', 'ultimate-member' ) ?> <?php UM()->tooltip( __( 'This is the text that appears within the field e.g please enter your email address. Leave blank to not show any placeholder text.', 'ultimate-member' ) ); ?></label>
-						<input type="text" name="_placeholder" id="_placeholder" value="<?php echo htmlspecialchars( $this->edit_mode_value, ENT_QUOTES ); ?>" />
+						<input type="text" name="_placeholder" id="_placeholder" value="<?php echo esc_attr( $this->edit_mode_value ); ?>" />
 					</p>
 
 					<?php