__( 'WordPress', 'advanced-form-integration' ), 'tasks' => array( 'create_post' => __( 'Create New Post', 'advanced-form-integration' ), 'create_user' => __( 'Create New User', 'advanced-form-integration' ), 'update_role' => __( 'Update User Role', 'advanced-form-integration' ) ) ); return $actions; } add_action( 'adfoin_action_fields', 'adfoin_wordpress_action_fields' ); function adfoin_wordpress_action_fields() { ?> true ); $types = get_post_types( $get_cpt_args, 'object' ); $post_types = wp_list_pluck( $types, 'label', 'name' ); wp_send_json_success( $post_types ); } add_action( 'adfoin_wordpress_job_queue', 'adfoin_wordpress_job_queue', 10, 1 ); function adfoin_wordpress_job_queue( $data ) { adfoin_wordpress_send_data( $data['record'], $data['posted_data'] ); } /* * Handles creating new WordPress post */ function adfoin_wordpress_send_data( $record, $posted_data ) { $record_data = json_decode( $record["data"], true ); if ( adfoin_check_conditional_logic( $record_data['action_data']['cl'] ?? array(), $posted_data ) ) { return; } $data = $record_data["field_data"]; $task = $record["task"]; if( $task == "create_post" ) { $default_data = array( 'post_title' => '', 'post_name' => '', 'post_type' => 'post', 'post_status' => 'draft', 'post_date' => '', 'post_author' => '', 'post_content' => '', 'post_excerpt' => '', 'post_parent' => '', 'menu_order' => '0', 'post_password' => '', ); $submitted_data = array( 'post_type' => empty( $data["postTypeId"] ) ? "" : $data["postTypeId"], 'post_status' => empty( $data["status"] ) ? "" : $data["status"], 'post_title' => empty( $data["title"] ) ? "" : adfoin_get_parsed_values( $data["title"], $posted_data ), 'post_name' => empty( $data["slug"] ) ? "" : sanitize_title( adfoin_get_parsed_values( $data["slug"], $posted_data ) ), 'post_content' => empty( $data["content"] ) ? "" : adfoin_get_parsed_values( $data["content"], $posted_data ), ); $author = empty( $data["author"] ) ? "" : adfoin_get_parsed_values( $data["author"], $posted_data ); if( $author ) { if ( is_numeric( $author ) ) { $submitted_data['post_author'] = absint( $author ); } else { // get author by username or email $user = get_user_by( 'login', $author ); if ( ! $user ) { $user = get_user_by( 'email', $author ); } if ( ! $user ) { $user = get_user_by( 'slug', $author ); } if ( ! empty( $user ) ) { $submitted_data['post_author'] = absint( $user->ID ); } } } $post_data = wp_parse_args( $submitted_data, $default_data ); $post_id = wp_insert_post( $post_data ); if( is_numeric( $post_id ) ) { $post_metas = empty( $data["postMeta"] ) ? '' : sanitize_text_field( $data["postMeta"] ); $post_metas = explode( "||", $post_metas ); $post_metas = array_filter( $post_metas ); if( is_array( $post_metas ) && !empty( $post_metas ) ) { foreach( $post_metas as $post_meta ) { if( false !== strpos( $post_meta, ":" ) ) { list( $meta_key, $meta_value ) = explode(':', $post_meta, 2); $meta_value = adfoin_get_parsed_values( trim( $meta_value ), $posted_data ); if( $meta_key && $meta_value ) { update_post_meta( absint( $post_id ), $meta_key, $meta_value ); } } } } } } if( $task == 'create_user' ) { $user_data = array( 'user_login' => adfoin_get_parsed_values( $data['username'], $posted_data ), 'user_email' => adfoin_get_parsed_values( $data['email'], $posted_data ) ); $role = ! empty( $data['role'] ) ? sanitize_key( $data['role'] ) : 'subscriber'; // Security: users created here come from (possibly public) form // submissions, so only low-privilege roles may be assigned. if ( ! adfoin_is_assignable_role( $role, 'wordpress_create_user' ) ) { adfoin_log_blocked_role( $role, 'WordPress Create User', $record ); $role = 'subscriber'; } $user_data['role'] = $role; if( $data['password'] ) { $user_data['user_pass'] = adfoin_get_parsed_values( $data['password'], $posted_data ); } else{ $user_data['user_pass'] = wp_generate_password( 24 ); } if( $data['firstName'] ) { $user_data['first_name'] = adfoin_get_parsed_values( $data['firstName'], $posted_data ); } if( $data['lastName'] ) { $user_data['last_name'] = adfoin_get_parsed_values( $data['lastName'], $posted_data ); } if( $data['website'] ) { $user_data['user_url'] = adfoin_get_parsed_values( $data['website'], $posted_data ); } $user_id = wp_insert_user( $user_data ); if( $user_id && is_numeric( $user_id ) && $data['userMeta'] ) { $user_metas = empty( $data['userMeta'] ) ? '' : sanitize_text_field( $data['userMeta'] ); $user_metas = explode( '||', $user_metas ); if( is_array( $user_metas ) && !empty( $user_metas ) ) { foreach( $user_metas as $user_meta ) { if( false !== strpos( $user_meta, ':' ) ) { list( $meta_key, $meta_value ) = explode(':', $user_meta, 2); $meta_value = adfoin_get_parsed_values( trim( $meta_value ), $posted_data ); if( $meta_key && $meta_value ) { update_user_meta( absint( $user_id ), $meta_key, $meta_value ); } } } } } } if( $task == 'update_role' ) { $identifier = empty( $data['userIdentifier'] ) ? '' : adfoin_get_parsed_values( $data['userIdentifier'], $posted_data ); $role = empty( $data['updateRole'] ) ? '' : $data['updateRole']; if ( $role ) { $user = false; if ( '' === trim( (string) $identifier ) ) { // No user given: update the logged-in user submitting the form. $user = is_user_logged_in() ? wp_get_current_user() : false; } else { if ( is_numeric( $identifier ) ) { $user = get_user_by( 'id', absint( $identifier ) ); } if ( ! $user ) { $user = get_user_by( 'login', $identifier ); } if ( ! $user ) { $user = get_user_by( 'email', $identifier ); } } if ( ! empty( $user ) ) { // Security: Never change the role of an account that can manage // the site or holds any privileged role — otherwise any visitor // could demote staff by submitting their ID, login or email. $is_protected_user = user_can( $user, 'manage_options' ); foreach ( (array) $user->roles as $current_role ) { if ( ! adfoin_is_assignable_role( $current_role, 'wordpress_update_role_target' ) ) { $is_protected_user = true; break; } } if ( $is_protected_user ) { error_log( sprintf( 'AFI Security: Blocked attempt to change the role of privileged user #%d via WordPress Update Role integration (Integration ID: %s)', $user->ID, isset( $record['id'] ) ? $record['id'] : 'unknown' ) ); } elseif ( adfoin_is_assignable_role( $role, 'wordpress_update_role' ) ) { $user->set_role( $role ); } else { adfoin_log_blocked_role( $role, 'WordPress Update Role', $record ); } } } } return; }