/home/techb158/public_html/wp-content/plugins/kirki/app/FormActions/Actions
Edit: /home/techb158/public_html/wp-content/plugins/kirki/app/FormActions/Actions/EmailActionHandler.php (7802B)
register_shortcodes($action, $form_data); //@todo: maybe we can implement this without wp shortcodes but a different approach as current implementation might collide with other shortcodes registered
return $this->send_single_email_action($action, $form_data, $form_config->name);
}
/**
* Register shortcodes referenced by the email action's fields.
*
* Every field is rendered through {@see render_email_action_text()}, which
* strips any shortcode that does not map to a submitted form field, so no
* arbitrary site shortcode can execute here.
*
* @param array $action
* @param array $form_data
* @return void
*/
protected function register_shortcodes($action, $form_data)
{
$this->register_shortcodes_from_field($action['emailList'] ?? '', $form_data);
$this->register_shortcodes_from_field($action['replyTo'] ?? '', $form_data);
$this->register_shortcodes_from_field($action['name'] ?? '', $form_data);
$this->register_shortcodes_from_field($action['subject'] ?? '', $form_data);
add_shortcode(
'admin_email',
function () {
return get_option('admin_email');
}
);
}
/**
* Register shortcodes referenced in a single email action field.
*
* @param string $field_value The field value containing shortcodes.
* @param array $form_data The form data to use for shortcode values.
* @return void
*/
protected function register_shortcodes_from_field($field_value, $form_data)
{
if (empty($field_value)) {
return;
}
$regex = '/\[([^\]]+)\]/';
preg_match_all($regex, $field_value, $matches);
foreach (($matches[1] ?? []) as $match) {
if (isset($form_data[$match])) {
add_shortcode($match, fn() => $form_data[$match]);
}
}
}
/**
* Send a single email action.
*
* @param array $email_action Email action configuration.
* @param array $form_data Form data.
* @param string $form_name Form name.
* @return bool
*/
protected function send_single_email_action($email_action, $form_data, $form_name)
{
$body = $this->convert_form_data_into_html_for_email($form_data);
$reply_to = '';
$name = '';
$subject = 'New ' . $form_name;
$header = [];
if (isset($email_action['body']) && is_array($email_action['body'])) {
$body = $this->build_email_body($email_action['body'], $form_data);
}
if (isset($email_action['replyTo'])) {
$reply_to = sanitize_email($this->render_email_action_text($email_action['replyTo'], $form_data));
}
if (isset($email_action['name'])) {
$name = $this->render_email_action_text($email_action['name'], $form_data);
}
if (isset($email_action['subject'])) {
$subject = $this->render_email_action_text($email_action['subject'], $form_data);
}
if (strlen($reply_to) > 0 && strlen($name) > 0) {
$header = ['Reply-To: ' . $name . ' <' . $reply_to . '>'];
}
if (isset($email_action['emailList']) && !empty($email_action['emailList'])) {
$to = $this->sanitize_email_list($this->render_email_action_text($email_action['emailList'], $form_data));
if ($to) {
return $this->send_email_notification($to, $subject, $body, $header);
}
}
return false;
}
/**
* Render a templated email action field using an explicit whitelist array.
*
* @param string $value The configured field value.
* @param array $form_data The submitted form data.
* @return string
*/
protected function render_email_action_text($value, $form_data)
{
if (empty($value) || !is_string($value)) {
return (string) $value;
}
// Whitelist array of acceptable email action shortcodes and their resolved values.
$whitelist = [
'admin_email' => (string) get_option('admin_email'),
];
if (is_array($form_data)) {
foreach ($form_data as $field_name => $field_value) {
if (is_array($field_value)) {
$whitelist[$field_name] = implode(', ', $field_value);
} else {
$whitelist[$field_name] = (string) $field_value;
}
}
}
// Render only the whitelisted shortcodes from the array
foreach ($whitelist as $tag => $replacement) {
$value = str_replace('[' . $tag . ']', $replacement, $value);
}
return $value;
}
/**
* Sanitize a comma-separated list of email addresses.
*
* @param string $value The configured email list value.
* @return string A comma-separated string of valid addresses, or '' when empty.
*/
protected function sanitize_email_list($value)
{
if (empty($value) || !is_string($value)) {
return '';
}
$valid = [];
foreach (explode(',', $value) as $address) {
$address = sanitize_email(trim($address));
if ($address) {
$valid[] = $address;
}
}
return implode(', ', $valid);
}
/**
* Build the email body from a body configuration.
*
* @param array $body_config Body configuration.
* @param array $form_data Form data.
* @return string Email body HTML.
*/
protected function build_email_body($body_config, $form_data)
{
$body_parts = [];
foreach ($body_config as $body_data) {
if (!isset($body_data['type'], $body_data['value'])) {
continue;
}
if ($body_data['type'] === FormEmailBodyPartTypes::TEXT) {
$body_parts[] = $body_data['value'];
} elseif ($body_data['type'] === FormEmailBodyPartTypes::FORM && isset($form_data[$body_data['value']])) {
$body_parts[] = esc_html($form_data[$body_data['value']]);
}
}
return nl2br(implode('', $body_parts));
}
/**
* Convert form data into an HTML list for email.
*
* @param array $form_data Form data.
* @return string
*/
protected function convert_form_data_into_html_for_email($form_data = [])
{
$html = '
';
if (is_array($form_data)) {
foreach ($form_data as $key => $value) {
$html .= '- ' . esc_html($key) . ': ' . esc_html($value) . '
';
}
}
$html .= '
';
return $html;
}
/**
* Send an email notification.
*
* @param string|string[] $to Address(es) to send to.
* @param string $subject Email subject.
* @param string $message Message contents.
* @param array $headers Email headers.
* @return bool
*/
protected function send_email_notification($to, $subject, $message, $headers = [])
{
$headers[] = 'Content-Type: text/html; charset=UTF-8';
return wp_mail($to, $subject, $message, $headers);
}
}