ActiveCampaign site tracking code in your pages. To get started, please activate the plugin and add your API credentials in the plugin settings. Author: ActiveCampaign Version: 8.1.21 Author URI: http://www.activecampaign.com */ # Changelog ## version 1: - initial release ## version 1.1: Verified this works with latest versions of WordPress and ActiveCampaign; Updated installation instructions ## version 2.0: Re-configured to work with ActiveCampaign version 5.4. Also improved some areas. ## version 2.1: Changed internal API requests to use only API URL and Key instead of Username and Password. Also provided option to remove style blocks, and converting `input type="button"` into `input type="submit"` ## version 3.0: Re-wrote widget backend to use most recent WordPress Widget structure. Improvements include streamlined code and API usage, ability to reset or refresh your forms, and better form width detection. ## version 3.5: You can now use a shortcode to display your subscription form. ## version 4.0: Added many additional settings to control how your form is displayed and submitted. ## version 4.5: Added ActiveCampaign to the Settings menu so you can use the shortcode independent of the widget. ## version 5.0: Added support for multiple forms. Removed widget entirely. ## version 5.1: Added button to TinyMCE toolbar to more easily choose and embed the form shortcode into the post body. ## version 5.2: Default form behavior is now "sync." This coincided with WordPress version 3.9 release. ## version 5.5: Added site tracking. ## version 5.6: Patched major security bug. ## version 5.7: Removed ability to add custom form "action" URL. ## version 5.8: Security fix. ## version 5.9: Use current user's email for site tracking. ## version 5.91: Updates to avoid conflicts with other plugins using the ActiveCampaign PHP API wrapper. ## version 5.92: Support for captcha validation when using the 'Submit form without refreshing page' (Ajax) option. Also added success or error CSS classes to the Ajax response div. ## version 5.93: Fix for issue with captcha verification when using the Ajax ("Submit form without refreshing page") form submission option. ## version 6.0: Added support for new form builder. ## version 6.1: Fix for issue with new forms not displaying properly. ## version 6.2: Fix for compatability issue with live composer plugin. ## version 6.25: Fix for SSL issue (when the page is loaded via HTTPS and the AC account uses a CNAME, forms would not show up). ## version 6.2.6: Fix for certain error messages not being displayed properly. ## version 6.2.7: Fix for 6.2.6 change missing another check. ## version 6.2.8: Fix for `Undefined index: css` error. ## version 6.2.9: Fix for "Keep original form CSS" checkbox not being respected. ## version 6.2.10: Limit amount of ActiveCampaign account data shown in JavaScript (for site tracking). ## version 6.2.11: Fix for when the "site_tracking" key is undefined. ## version 6.2.12: Fix for when the "form_id" key is undefined. ## version 6.3: Added site tracking options for GDPR ## version 7.0: Force upgrade prompt for users on 6.25 ## version 7.1: Update Site Tracking snippet to route through Prism. ## version 7.1.1: Include our own host header on requests. ## version 7.1.2: Update tracking code copy to be more specific to Site Tracking and Conversations. Fix old link to Forms page. Make install code toggle focusable. ## version 7.1.3: Updated readme ## version 7.1.4: Updated listing ## version 8.0.0: Update ActiveCampaign forms embed to be compatible with Gutenberg editor, Resolve account connection UI bug ## version 8.0.1: Removing php 7 feature usage ## version 8.0.2: Security fix to address CSRF vulnerability, general fix to address browser warning for invalid cookie attribute ## version 8.0.3: Pluggable bug fix ## version 8.1.0: Improvements to Gutenberg Editor experience, including live preview of Form embeds. Background color bug fix. Shortcode support for optional 'css' and 'static' attributes that default to plugin settings. Avoiding global namespace conflicts of on-demand chunks bug fix. ## version 8.1.1: Improved error handling on expired credentials and misconfigurations. Shortening Block widget name to 'AC Forms'. ## version 8.1.2: Simplifying plugin settings options. Dropping 'Global' CSS option for block, defaulting to 'Use ActiveCampaign CSS'. Converting to Dynamic Block pattern. ## version 8.1.3: Hotfix for Default CSS option deprecation. Moving from global assignment to block/shortcode assignment. Allowing fallback for existing blocks without CSS setting. ## version 8.1.4: Rolling back settings page form/css deprecations. We have improved testing workflows moving forward. ## version 8.1.5: Updating Readme with up to date screenshots and better descriptions. Updating Plugin Settings with clearer descriptions of form and shortcode use cases. Fixing block editor CSS class input on dynamic div output. Fixing display of Site Tracking settings without forms. Migrating Site Tracking JS to vgo() from pgo(). Fixing bug with Tracking ID fetch. Adding admin notice stack for future plugin updates. ## version 8.1.6: Improving credential check to fix permissions bug. Fixing non-inline form previews in block editor. Removing unnecessary Google Font loads on no-style embeds. Updating Plugin description. ## version 8.1.7: Updated listing ## version 8.1.8: Updated listing ## version 8.1.9: Updated authentication for internal API requests ## version 8.1.10: Verify 6.0 Compatibility. Updated listing ## version 8.1.11: Removing obsolete Javascript ## version 8.1.12: Security fix to address XSS vulnerability ## version 8.1.13: Verify 6.3.1 Compatibility. Updated listing ## version 8.1.14: Fixing shortcode CSS display in Form Preview ## version 8.1.15: Security fix to address SSRF vulnerability with API URL verification and wp_safe_remote_get. Removing unreachable deprecated curl code ## version 8.1.16: Verify 6.5 Compatibility. Updated listing ## version 8.1.17: Security fix to address XSS vulnerability with API URL and API Key verification ## version 8.1.18: Update readme.txt, address supported version of WordPress ## version 8.1.19: Update readme.txt, with newest activecampaign features ## version 8.1.20: Update readme.txt, with newest activecampaign features ## version 8.1.21: Update plugin branding define("ACTIVECAMPAIGN_URL", ""); define("ACTIVECAMPAIGN_API_KEY", ""); require_once(dirname(__FILE__) . "/activecampaign-api-php/ActiveCampaign.class.php"); require_once(dirname(__FILE__) . "/activecampaign-form-block/activecampaign-form-block.php"); /** * Get the source code for the form itself. * In the past we just returned the form HTML code (CSS + HTML), but the new version of forms just uses the JavaScript stuff (HTML JavaScript include). * * @param array settings The saved ActiveCampaign settings (from the WordPress admin section). * @param array form The individual form metadata (that we obtained from the forms/getforms API call). * @param boolean static Set to true so the "floating" forms don't float. Typically this is done for the admin section only. * @param boolean nostyles Manual override value for nostyles URL Param. Used in shortcode eval to bypass plugin setting. * @param boolean preview Manual value for preview URL Param. * @return string The raw source code that will render the form in the browser. */ function activecampaign_form_source($settings, $form, $static = false, $nostyles = null, $preview = false) { $script_src = activecampaign_form_script_src($settings, $form, $static, $nostyles, $preview); $source = ""; if (isset($form["version"]) && $form["version"] == 2 && isset($script_src)) { if ($form["layout"] == "inline-form") { $source .= "
"; } $source .= ""; } else { // Version 1 forms. } return $source; } /** * Get the script src attribute value for the form's embed. * This is used in shortcode rendering as well as block editor initialization. * * @param array settings The saved ActiveCampaign settings (from the WordPress admin section). * @param array form The individual form metadata (that we obtained from the forms/getforms API call). * @param boolean static Set to true so the "floating" forms don't float. Typically this is done for the admin section only. * @param boolean nostyles Manual override value for nostyles URL Param. Used in shortcode eval to bypass plugin setting. * @param boolean preview Manual value for preview URL Param. * @return string The URL-Encoded src for the rendered script tag */ function activecampaign_form_script_src($settings, $form, $static = false, $nostyles = null, $preview = false) { // Set to activehosted.com domain by default. $domain = (isset($settings["account_view"]) && isset($settings["account_view"]["account"]))? $settings["account_view"]["account"] : null; if(!isset($domain)){ return null; } $source = sprintf("https://%s/f/embed.php?", $domain); $css = (isset($settings["css"]) && isset($settings["css"][$form["id"]]))? $settings["css"][$form["id"]] : null; // Always passing params for JS eval in block editor $source .= ($static)? "static=1&" : "static=0&"; $source .= sprintf("id=%d&%s", $form["id"], strtoupper(uniqid())); $source .= ( (isset($nostyles) && $nostyles === true) || (!isset($nostyles) && (!isset($css) || !$css)) )? "&nostyles=1" : "&nostyles=0"; $source .= ($preview)? "&preview=1" : "&preview=0"; return $source; } function activecampaign_shortcodes($args) { // check for Settings options saved first. $settings = get_option("settings_activecampaign"); if ($settings) { if (isset($settings["forms"]) && $settings["forms"]) { if (isset($args) && isset($args["form"]) && isset($settings["forms"][$args["form"]])) { $form_id = $args["form"]; $form = $settings["forms"][$form_id]; $static = false; if (isset($args["static"]) && ($args["static"] === 1 || $args["static"] === '1' || $args["static"] === 'true')) { $static = true; } $preview = false; if (isset($args["preview"]) && ($args["preview"] === 1 || $args["preview"] === '1' || $args["preview"] === 'true')) { $preview = true; } // Use null default for undefined settings fallback $nostyles = null; if (isset($args["css"])) { if ($args["css"] === 1 || $args["css"] === '1' || $args["css"] === 'true') { $nostyles = false; } elseif ($args["css"] === 0 || $args["css"] === '0' || $args["css"] === 'false') { $nostyles = true; } } return activecampaign_form_source($settings, $form, $static, $nostyles, $preview); } } // Returning un-filtered tag for block editor eval return "[activecampaign]"; } else { // try widget options. $widget = get_option("widget_activecampaign_widget"); // it comes out as an array with other things in it, so loop through it if(!empty($widget)){ foreach ($widget as $k => $v) { // look for the one that appears to be the ActiveCampaign widget settings if (isset($v["api_url"]) && isset($v["api_key"]) && isset($v["form_html"])) { $widget_display = $v["form_html"]; return $widget_display; } } } } return ""; } function activecampaign_verify_api_host($api_host) { return (bool) preg_match('/^https:\/\/([a-zA-Z0-9_\-]+)\.(api\-us1|activehosted)\.com$/', $api_host); } /* * The ActiveCampaign settings page. */ function activecampaign_plugin_options() { if (!current_user_can("manage_options")) { wp_die(__("You do not have sufficient permissions to access this page.")); } $step = 1; $instance = array(); $connected = false; if ($_SERVER["REQUEST_METHOD"] == "POST") { // saving the settings page. $sanitizedApiUrl = sanitize_text_field($_POST["api_url"]); $sanitizedApiKey = sanitize_text_field($_POST["api_key"]); if ($sanitizedApiUrl && $sanitizedApiKey) { //Nonce check for preventing CSRF if (isset($_REQUEST["_wpnonce"])) { $nonce = $_REQUEST["_wpnonce"]; } else { $nonce = wp_create_nonce("invalid_nonce"); } if (! wp_verify_nonce($nonce, "activecampaign_save_settings")) { exit; } // Verify host against whitelist of known domains if(!activecampaign_verify_api_host($sanitizedApiUrl)){ $access_denied_string = "Access denied: Invalid API URL " . $sanitizedApiUrl . ". Please ensure the API URL uses https, and has no extra whitespace."; echo ""; } else{ $ac = new ActiveCampaignWordPress($sanitizedApiUrl, $sanitizedApiKey); if (!(int)$ac->credentials_test()) { echo ""; } else { $instance = $_POST; // first form submit (after entering API credentials). // get account details. $account = $ac->api("account/view"); $instance["account_view"] = get_object_vars($account); $instance["account"] = property_exists($account, 'account')? $account->account : null; $instance["tracking_actid"] = activecampaign_fetch_accountid($ac); // get forms. $instance = activecampaign_getforms($ac, $instance); $instance = activecampaign_form_html($ac, $instance); $connected = true; // If fetches didn't return domain or account, we can't display embeds, so fail out. This can happen with non-admin API credentials $domain = (isset($instance["account_view"]) && isset($instance["account_view"]["account"]))? $instance["account_view"]["account"] : null; if(!isset($instance["account"]) || !isset($domain)){ $connected = false; $instance = []; echo ""; } } } } // else one or both of the credentials fields is empty. it will just disconnect below because $instance is empty. update_option("settings_activecampaign", $instance); } else { $instance = get_option("settings_activecampaign"); //dbg($instance); if ( isset($instance["api_url"], $instance["api_key"]) && $instance["api_url"] && $instance["api_key"] && activecampaign_verify_api_host($instance["api_url"]) ) { // instance saved already. $connected = true; } else { // settings not saved yet. // see if they set up our widget (maybe we can pull the API URL and Key from that). $widget = get_option("widget_activecampaign_widget"); if ($widget) { // if the ActiveCampaign widget is activated in a sidebar (dragged to a sidebar). $widget_info = current($widget); // take the first item. if ( isset($widget_info["api_url"], $widget_info["api_key"]) && $widget_info["api_url"] && $widget_info["api_key"] && activecampaign_verify_api_host($widget_info["api_url"]) ) { // if they already supplied an API URL and key in the widget. $instance["api_url"] = $widget_info["api_url"]; $instance["api_key"] = $widget_info["api_key"]; } } } } ?>[activecampaign form=ID] shortcode in posts, pages, or a sidebar after setting up everything below. Questions or problems? Contact help@activecampaign.com.", "menu-activecampaign"); ?>
[activecampaign form= css=]
" . __("Choose an integration form below to embed into your post or page body. Add or edit forms in ActiveCampaign and then refresh the forms on the Settings page.") . "
"; if ($forms) { echo "'.$notices[$i].'