';
if ( 'none' !== $level ) {
$tag = in_array( $level, array( 'h2', 'h3', 'h4', 'h5', 'h6' ), true ) ? $level : 'h2';
$out .= '<' . $tag . ' class="af-heading">' . esc_html( $schema['heading'] ) . '';
}
return $out . '
' . esc_html( $schema['closed_message'] ) . '
sits in its own block and holds only inline content, so
* wpautop() run over the rendered form (by a theme or page builder) finds
* nothing to wrap in a stray paragraph.
*
* @param string $html Escaped inline HTML.
* @return string
*/
public static function noscript( $html ) {
return '' . $html . '
';
}
/**
* Escape a visitor's answer for use inside a ';
} elseif ( 'select' === $config['input'] ) {
$control = '';
$control .= '' . esc_html__( 'Select an option', 'accessible-forms-by-accessible-org' ) . ' ';
foreach ( $field['options'] as $option ) {
$control .=
'' .
esc_html( Choices::label( $field, $option ) ) .
' ';
}
$control .= ' ';
} else {
// No size attribute: width is CSS's job (WCAG 1.4.4).
$attrs['type'] = $config['input'];
$attrs['value'] = is_string( $value ) ? $value : '';
$control = '' . $control . $count_html . '
';
return $out;
}
/**
* Radio or checkbox group, wrapped in a fieldset with a legend.
*
* Only choice groups get a fieldset. Wrapping the whole form in one causes
* the legend to be re-announced on every control.
*
* @param array $field Field definition.
* @param string $id Base ID.
* @param string $error_id Error element ID.
* @param string $error_html Rendered error paragraph.
* @param string $classes Wrapper classes.
* @param mixed $value Submitted value(s).
* @param string $error Error message.
* @return string
*/
private static function choice_group(
array $field,
$id,
$error_id,
$error_html,
$classes,
$value,
$error
) {
$is_checkbox = 'checkbox' === $field['type'];
$selected = is_array( $value ) ? $value : ( '' === $value ? array() : array( $value ) );
$named_by = (string) ( $field['_named_by'] ?? '' );
$out = '';
$out .=
'' .
esc_html( $field['label'] ) .
self::required_hint( $field ) .
' ';
$out .= $error_html;
foreach ( $field['options'] as $index => $option ) {
$option_id = $id . '-' . $index;
$attrs = array(
'type' => $is_checkbox ? 'checkbox' : 'radio',
'id' => $option_id,
'name' => 'af[' . $field['name'] . ']' . ( $is_checkbox ? '[]' : '' ),
'value' => $option,
);
if ( ! empty( $field['required'] ) && ! $is_checkbox ) {
$attrs['required'] = 'required';
}
if ( in_array( (string) $option, array_map( 'strval', $selected ), true ) ) {
$attrs['checked'] = 'checked';
}
if ( $error ) {
$attrs['aria-invalid'] = 'true';
$attrs['aria-describedby'] = $error_id;
}
if ( ! empty( $field['help'] ) ) {
$attrs['aria-describedby'] = trim( ( $attrs['aria-describedby'] ?? '' ) . ' ' . $id . '-help' );
}
$out .= '';
$out .= '' .
esc_html( Choices::label( $field, $option ) ) .
' ';
$out .= '
';
}
$out .= ' ';
return $out;
}
/**
* Single consent checkbox. No fieldset: a lone control needs no group label.
*
* @param array $field Field definition.
* @param string $id Element ID.
* @param string $error_id Error element ID.
* @param string $error_html Rendered error paragraph.
* @param string $classes Wrapper classes.
* @param mixed $value Submitted value.
* @param string $error Error message.
* @return string
*/
private static function consent( array $field, $id, $error_id, $error_html, $classes, $value, $error ) {
$attrs = array(
'type' => 'checkbox',
'id' => $id,
'name' => 'af[' . $field['name'] . ']',
'value' => '1',
);
if ( ! empty( $field['required'] ) ) {
$attrs['required'] = 'required';
}
if ( $value ) {
$attrs['checked'] = 'checked';
}
$named_by = (string) ( $field['_named_by'] ?? '' );
if ( $named_by ) {
$attrs['aria-labelledby'] = $named_by . ' ' . $id . '-label';
}
if ( $error ) {
$attrs['aria-invalid'] = 'true';
$attrs['aria-describedby'] = $error_id;
}
if ( ! empty( $field['help'] ) ) {
$attrs['aria-describedby'] = trim( ( $attrs['aria-describedby'] ?? '' ) . ' ' . $id . '-help' );
}
$out = '';
return $out;
}
/**
* The next occurrence of a form on this page.
*
* The first embed uses af-{id}; repeats add -2, -3 and so on, so two copies
* of one form never share an ID.
*
* @param int $form_id Form post ID.
* @return int
*/
private static function next_instance( $form_id ) {
self::$instances[ $form_id ] = ( self::$instances[ $form_id ] ?? 0 ) + 1;
return self::$instances[ $form_id ];
}
/**
* Stable IDs for an embed, including its replacement and redirect target.
*
* @param int $form_id Form post ID.
* @param int $instance Occurrence on the page.
* @return string
*/
public static function instance_prefix( $form_id, $instance = 1 ) {
return 'af-' . (int) $form_id . ( $instance > 1 ? '-' . (int) $instance : '' );
}
/**
* Visible required indicator. Words, never a bare asterisk.
*
* @param array $field Field definition.
* @return string
*/
private static function required_hint( array $field ) {
if ( empty( $field['required'] ) ) {
return '';
}
return ' ' . esc_html__( '(required)', 'accessible-forms-by-accessible-org' ) . ' ';
}
/**
* Honeypot.
*
* The `hidden` attribute already removes the container from the accessibility
* tree, so no aria-hidden is added. A real label is present for the rare case
* where `hidden` is overridden by a theme.
*
* @param string $prefix Field ID prefix.
* @return string
*/
private static function honeypot( $prefix ) {
$id = $prefix . '-hp';
return '' .
'' .
esc_html__( 'Leave this field empty', 'accessible-forms-by-accessible-org' ) .
' ' .
'
';
}
/**
* Tags and attributes a rendered form may contain, for wp_kses() at the
* point of output. Everything in render() is already escaped; this keeps
* the final echo verifiably safe as well.
*
* @return array
*/
public static function allowed_html() {
$global = array(
'class' => true,
'id' => true,
'hidden' => true,
'role' => true,
'tabindex' => true,
'style' => true,
'autofocus' => true,
'aria-describedby' => true,
'aria-labelledby' => true,
'aria-label' => true,
'aria-invalid' => true,
'aria-hidden' => true,
'aria-live' => true,
'aria-current' => true,
'aria-expanded' => true,
'aria-controls' => true,
'data-*' => true,
);
$field = array(
'name' => true,
'value' => true,
'type' => true,
'required' => true,
'disabled' => true,
'readonly' => true,
'autocomplete' => true,
);
$tags = array(
'div' => array(),
'span' => array(),
'p' => array(),
'strong' => array(),
'b' => array(),
'em' => array(),
'i' => array(),
'br' => array(),
'ul' => array(),
'ol' => array(),
'li' => array(),
'dl' => array(),
'dt' => array(),
'dd' => array(),
'nav' => array(),
'section' => array(),
'noscript' => array(),
'details' => array( 'open' => true ),
'summary' => array(),
'fieldset' => array(),
'legend' => array(),
'a' => array( 'href' => true ),
'label' => array( 'for' => true ),
'form' => array(
'action' => true,
'method' => true,
'enctype' => true,
'novalidate' => true,
),
'input' => $field + array(
'accept' => true,
'checked' => true,
'min' => true,
'max' => true,
'step' => true,
'maxlength' => true,
'minlength' => true,
'multiple' => true,
),
'select' => $field + array( 'multiple' => true ),
'option' => array(
'value' => true,
'selected' => true,
'disabled' => true,
),
'textarea' => $field + array(
'rows' => true,
'maxlength' => true,
'minlength' => true,
),
'button' => $field,
'accessible-forms-altcha' => array(
'name' => true,
'auto' => true,
'workers' => true,
'challenge' => true,
'configuration' => true,
),
);
foreach ( array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6' ) as $heading ) {
$tags[ $heading ] = array();
}
foreach ( $tags as $tag => $attributes ) {
$tags[ $tag ] = $attributes + $global;
}
return $tags;
}
/**
* Build an escaped attribute string.
*
* @param array $attrs Attribute name => value.
* @return string
*/
private static function attrs( array $attrs ) {
$parts = array();
foreach ( $attrs as $key => $val ) {
$parts[] = esc_attr( $key ) . '="' . esc_attr( (string) $val ) . '"';
}
return implode( ' ', $parts );
}
}