Skip to content

Commit f4dcbf0

Browse files
author
Chris Gårdenberg
committed
Release 2.0.1
chg: Validating all fields when you post a booking chg: Removed `setcookie( 'eduadmin_loginUser' ...`, since it's not needed by the plugin. chg: Fixed line breaks in interest registration in a textarea add: Validate what fields are being sorted on (if it's even possible) in course and event lists
1 parent d9e0762 commit f4dcbf0

12 files changed

Lines changed: 329 additions & 122 deletions

‎class/class-eduadmin-bookinghandler.php‎

Lines changed: 169 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -118,37 +118,78 @@ private function get_single_participant_booking() {
118118
$customer->CustomerId = $user->Customer->CustomerId;
119119
}
120120

121-
$first = @sanitize_text_field( $_POST['contactFirstName'] );
122-
$last = @sanitize_text_field( $_POST['contactLastName'] );
121+
$first = '';
122+
$last = '';
123+
124+
if ( ! empty( $_POST['contactFirstName'] ) ) {
125+
$first = sanitize_text_field( $_POST['contactFirstName'] );
126+
}
127+
if ( ! empty( $_POST['contactLastName'] ) ) {
128+
$last = sanitize_text_field( $_POST['contactLastName'] );
129+
}
130+
123131
$customer->CustomerName = $first . ' ' . $last;
124132
$customer->CustomerGroupId = intval( get_option( 'eduadmin-customerGroupId', null ) );
125133
if ( ! empty( $_POST['contactCivRegNr'] ) ) {
126-
$customer->OrganisationNumber = @sanitize_text_field( $_POST['contactCivRegNr'] );
134+
$customer->OrganisationNumber = sanitize_text_field( $_POST['contactCivRegNr'] );
135+
}
136+
if ( ! empty( $_POST['customerAddress1'] ) ) {
137+
$customer->Address = sanitize_text_field( $_POST['customerAddress1'] );
138+
}
139+
if ( ! empty( $_POST['customerAddress2'] ) ) {
140+
$customer->Address2 = sanitize_text_field( $_POST['customerAddress2'] );
141+
}
142+
if ( ! empty( $_POST['customerPostalCode'] ) ) {
143+
$customer->Zip = sanitize_text_field( $_POST['customerPostalCode'] );
144+
}
145+
if ( ! empty( $_POST['customerPostalCity'] ) ) {
146+
$customer->City = sanitize_text_field( $_POST['customerPostalCity'] );
147+
}
148+
if ( ! empty( $_POST['contactPhone'] ) ) {
149+
$customer->Phone = sanitize_text_field( $_POST['contactPhone'] );
150+
}
151+
if ( ! empty( $_POST['contactMobile'] ) ) {
152+
$customer->Mobile = sanitize_text_field( $_POST['contactMobile'] );
153+
}
154+
if ( ! empty( $_POST['contactEmail'] ) ) {
155+
$customer->Email = sanitize_email( $_POST['contactEmail'] );
156+
}
157+
if ( ! empty( $_POST['invoiceEmail'] ) ) {
158+
$customerInvoiceEmailAddress = sanitize_email( $_POST['invoiceEmail'] );
127159
}
128-
$customer->Address = @sanitize_text_field( $_POST['customerAddress1'] );
129-
$customer->Address2 = @sanitize_text_field( $_POST['customerAddress2'] );
130-
$customer->Zip = @sanitize_text_field( $_POST['customerPostalCode'] );
131-
$customer->City = @sanitize_text_field( $_POST['customerPostalCity'] );
132-
$customer->Phone = @sanitize_text_field( $_POST['contactPhone'] );
133-
$customer->Mobile = @sanitize_text_field( $_POST['contactMobile'] );
134-
$customer->Email = @sanitize_email( $_POST['contactEmail'] );
135-
136-
$customerInvoiceEmailAddress = @sanitize_email( $_POST['invoiceEmail'] );
137160

138161
$billing_info = new stdClass();
139162

140163
if ( empty( $_POST['alsoInvoiceCustomer'] ) ) {
141164
$billing_info->CustomerName = $first . ' ' . $last;
142-
$billing_info->Address = @sanitize_text_field( $_POST['customerAddress1'] );
143-
$billing_info->Address2 = @sanitize_text_field( $_POST['customerAddress2'] );
144-
$billing_info->Zip = @sanitize_text_field( $_POST['customerPostalCode'] );
145-
$billing_info->City = @sanitize_text_field( $_POST['customerPostalCity'] );
165+
if ( ! empty( $_POST['customerAddress1'] ) ) {
166+
$billing_info->Address = sanitize_text_field( $_POST['customerAddress1'] );
167+
}
168+
if ( ! empty( $_POST['customerAddress2'] ) ) {
169+
$billing_info->Address2 = sanitize_text_field( $_POST['customerAddress2'] );
170+
}
171+
if ( ! empty( $_POST['customerPostalCode'] ) ) {
172+
$billing_info->Zip = sanitize_text_field( $_POST['customerPostalCode'] );
173+
}
174+
if ( ! empty( $_POST['customerPostalCity'] ) ) {
175+
$billing_info->City = sanitize_text_field( $_POST['customerPostalCity'] );
176+
}
146177
} else {
147-
$billing_info->CustomerName = @sanitize_text_field( $_POST['invoiceName'] );
148-
$billing_info->Address = @sanitize_text_field( $_POST['invoiceAddress1'] );
149-
$billing_info->Address2 = @sanitize_text_field( $_POST['invoiceAddress2'] );
150-
$billing_info->Zip = @sanitize_text_field( $_POST['invoicePostalCode'] );
151-
$billing_info->City = @sanitize_text_field( $_POST['invoicePostalCity'] );
178+
if ( ! empty( $_POST['invoiceName'] ) ) {
179+
$billing_info->CustomerName = sanitize_text_field( $_POST['invoiceName'] );
180+
}
181+
if ( ! empty( $_POST['invoiceAddress1'] ) ) {
182+
$billing_info->Address = sanitize_text_field( $_POST['invoiceAddress1'] );
183+
}
184+
if ( ! empty( $_POST['invoiceAddress2'] ) ) {
185+
$billing_info->Address2 = sanitize_text_field( $_POST['invoiceAddress2'] );
186+
}
187+
if ( ! empty( $_POST['invoicePostalCode'] ) ) {
188+
$billing_info->Zip = sanitize_text_field( $_POST['invoicePostalCode'] );
189+
}
190+
if ( ! empty( $_POST['invoicePostalCity'] ) ) {
191+
$billing_info->City = sanitize_text_field( $_POST['invoicePostalCity'] );
192+
}
152193
}
153194

154195
if ( ! empty( $customerInvoiceEmailAddress ) ) {
@@ -178,21 +219,35 @@ private function get_contact_person( &$contact ) {
178219
return null;
179220
}
180221

181-
$contact->FirstName = @sanitize_text_field( $_POST['contactFirstName'] );
182-
$contact->LastName = @sanitize_text_field( $_POST['contactLastName'] );
183-
$contact->Phone = @sanitize_text_field( $_POST['contactPhone'] );
184-
$contact->Mobile = @sanitize_text_field( $_POST['contactMobile'] );
185-
$contact->Email = @sanitize_email( $_POST['contactEmail'] );
222+
if ( ! empty( $_POST['contactFirstName'] ) ) {
223+
$contact->FirstName = sanitize_text_field( $_POST['contactFirstName'] );
224+
}
225+
226+
if ( ! empty( $_POST['contactLastName'] ) ) {
227+
$contact->LastName = sanitize_text_field( $_POST['contactLastName'] );
228+
}
229+
230+
if ( ! empty( $_POST['contactPhone'] ) ) {
231+
$contact->Phone = sanitize_text_field( $_POST['contactPhone'] );
232+
}
233+
234+
if ( ! empty( $_POST['contactMobile'] ) ) {
235+
$contact->Mobile = sanitize_text_field( $_POST['contactMobile'] );
236+
}
237+
238+
if ( ! empty( $_POST['contactEmail'] ) ) {
239+
$contact->Email = sanitize_email( $_POST['contactEmail'] );
240+
}
186241

187242
if ( ! empty( $_POST['contactCivReg'] ) ) {
188-
$contact->CivicRegistrationNumber = @sanitize_text_field( $_POST['contactCivReg'] );
243+
$contact->CivicRegistrationNumber = sanitize_text_field( $_POST['contactCivReg'] );
189244
}
190245
if ( ! empty( $_POST['contactPass'] ) ) {
191-
$contact->Password = @sanitize_text_field( $_POST['contactPass'] );
246+
$contact->Password = sanitize_text_field( $_POST['contactPass'] );
192247
}
193248

194249
if ( ! empty( $_POST['contactPriceName'] ) ) {
195-
$contact->PriceNameId = @intval( $_POST['contactPriceName'] );
250+
$contact->PriceNameId = intval( $_POST['contactPriceName'] );
196251
}
197252

198253
$contact->CanLogin = true;
@@ -268,41 +323,77 @@ private function get_multiple_participant_booking() {
268323
$customer->CustomerId = $user->Customer->CustomerId;
269324
}
270325

271-
$customer->CustomerName = @sanitize_text_field( $_POST['customerName'] );
272-
$customer->CustomerGroupId = get_option( 'eduadmin-customerGroupId', null );
273-
$customer->OrganisationNumber = @sanitize_text_field( $_POST['customerVatNo'] );
274-
$customer->Address = @sanitize_text_field( $_POST['customerAddress1'] );
275-
$customer->Address2 = @sanitize_text_field( $_POST['customerAddress2'] );
276-
$customer->Zip = @sanitize_text_field( $_POST['customerPostalCode'] );
277-
$customer->City = @sanitize_text_field( $_POST['customerPostalCity'] );
278-
$customer->Email = @sanitize_email( $_POST['customerEmail'] );
326+
if ( ! empty( $_POST['customerName'] ) ) {
327+
$customer->CustomerName = sanitize_text_field( $_POST['customerName'] );
328+
}
329+
$customer->CustomerGroupId = get_option( 'eduadmin-customerGroupId', null );
330+
if ( ! empty( $_POST['customerVatNo'] ) ) {
331+
$customer->OrganisationNumber = sanitize_text_field( $_POST['customerVatNo'] );
332+
}
333+
if ( ! empty( $_POST['customerAddress1'] ) ) {
334+
$customer->Address = sanitize_text_field( $_POST['customerAddress1'] );
335+
}
336+
if ( ! empty( $_POST['customerAddress2'] ) ) {
337+
$customer->Address2 = sanitize_text_field( $_POST['customerAddress2'] );
338+
}
339+
if ( ! empty( $_POST['customerPostalCode'] ) ) {
340+
$customer->Zip = sanitize_text_field( $_POST['customerPostalCode'] );
341+
}
342+
if ( ! empty( $_POST['customerPostalCity'] ) ) {
343+
$customer->City = sanitize_text_field( $_POST['customerPostalCity'] );
344+
}
345+
if ( ! empty( $_POST['customerEmail'] ) ) {
346+
$customer->Email = sanitize_email( $_POST['customerEmail'] );
347+
}
279348

280349
if ( ! empty( $_POST['purchaseOrderNumber'] ) ) {
281-
$booking_data->PurchaseOrderNumber = @sanitize_text_field( $_POST['purchaseOrderNumber'] );
350+
$booking_data->PurchaseOrderNumber = sanitize_text_field( $_POST['purchaseOrderNumber'] );
282351
}
283352

284353
$customerInvoiceEmailAddress = null;
285354
if ( ! empty( $_POST['invoiceEmail'] ) ) {
286-
$customerInvoiceEmailAddress = @sanitize_email( $_POST['invoiceEmail'] );
355+
$customerInvoiceEmailAddress = sanitize_email( $_POST['invoiceEmail'] );
287356
}
288357

289358
$billing_info = new stdClass();
290359

291360
if ( ! isset( $_POST['alsoInvoiceCustomer'] ) ) {
292-
$billing_info->CustomerName = @sanitize_text_field( $_POST['customerName'] );
293-
$billing_info->Address = @sanitize_text_field( $_POST['customerAddress1'] );
294-
$billing_info->Address2 = @sanitize_text_field( $_POST['customerAddress2'] );
295-
$billing_info->Zip = @sanitize_text_field( $_POST['customerPostalCode'] );
296-
$billing_info->City = @sanitize_text_field( $_POST['customerPostalCity'] );
361+
if ( ! empty( $_POST['customerName'] ) ) {
362+
$billing_info->CustomerName = sanitize_text_field( $_POST['customerName'] );
363+
}
364+
if ( ! empty( $_POST['customerAddress1'] ) ) {
365+
$billing_info->Address = sanitize_text_field( $_POST['customerAddress1'] );
366+
}
367+
if ( ! empty( $_POST['customerAddress2'] ) ) {
368+
$billing_info->Address2 = sanitize_text_field( $_POST['customerAddress2'] );
369+
}
370+
if ( ! empty( $_POST['customerPostalCode'] ) ) {
371+
$billing_info->Zip = sanitize_text_field( $_POST['customerPostalCode'] );
372+
}
373+
if ( ! empty( $_POST['customerPostalCity'] ) ) {
374+
$billing_info->City = sanitize_text_field( $_POST['customerPostalCity'] );
375+
}
297376
} else {
298-
$billing_info->CustomerName = @sanitize_text_field( $_POST['invoiceName'] );
299-
$billing_info->Address = @sanitize_text_field( $_POST['invoiceAddress1'] );
300-
$billing_info->Address2 = @sanitize_text_field( $_POST['invoiceAddress2'] );
301-
$billing_info->Zip = @sanitize_text_field( $_POST['invoicePostalCode'] );
302-
$billing_info->City = @sanitize_text_field( $_POST['invoicePostalCity'] );
377+
if ( ! empty( $_POST['invoiceName'] ) ) {
378+
$billing_info->CustomerName = sanitize_text_field( $_POST['invoiceName'] );
379+
}
380+
if ( ! empty( $_POST['invoiceAddress1'] ) ) {
381+
$billing_info->Address = sanitize_text_field( $_POST['invoiceAddress1'] );
382+
}
383+
if ( ! empty( $_POST['invoiceAddress2'] ) ) {
384+
$billing_info->Address2 = sanitize_text_field( $_POST['invoiceAddress2'] );
385+
}
386+
if ( ! empty( $_POST['invoicePostalCode'] ) ) {
387+
$billing_info->Zip = sanitize_text_field( $_POST['invoicePostalCode'] );
388+
}
389+
if ( ! empty( $_POST['invoicePostalCity'] ) ) {
390+
$billing_info->City = sanitize_text_field( $_POST['invoicePostalCity'] );
391+
}
303392
}
304393

305-
$billing_info->SellerReference = @sanitize_text_field( $_POST['invoiceReference'] );
394+
if ( ! empty( $_POST['invoiceReference'] ) ) {
395+
$billing_info->SellerReference = sanitize_text_field( $_POST['invoiceReference'] );
396+
}
306397

307398
$booking_data->Reference = $billing_info->SellerReference;
308399

@@ -439,12 +530,12 @@ private function get_custom_field_data( $key, $custom_field_id, $custom_field_ty
439530
break;
440531
default:
441532
$answer->CustomFieldId = intval( $custom_field_id );
442-
if ( 'note' === $custom_field_type || 'text' === $custom_field_type ) {
443-
$answer->CustomFieldValue = @sanitize_text_field( $_POST[ $key ] );
444-
} elseif ( 'number' === $custom_field_type ) {
445-
$answer->CustomFieldValue = @intval( $_POST[ $key ] );
533+
if ( ( 'note' === $custom_field_type || 'text' === $custom_field_type ) && ! empty( $_POST[ $key ] ) ) {
534+
$answer->CustomFieldValue = sanitize_text_field( $_POST[ $key ] );
535+
} elseif ( 'number' === $custom_field_type && ! empty( $_POST[ $key ] ) ) {
536+
$answer->CustomFieldValue = intval( $_POST[ $key ] );
446537
} elseif ( 'date' === $custom_field_type && ! empty( $_POST[ $key ] ) ) {
447-
$answer->CustomFieldValue = @date( 'c', strtotime( $_POST[ $key ] ) );
538+
$answer->CustomFieldValue = date( 'c', strtotime( $_POST[ $key ] ) );
448539
} else {
449540
$answer->CustomFieldValue = null;
450541
}
@@ -527,12 +618,12 @@ private function get_answer_data( $key, $question_answer_id, $question_type ) {
527618
break;
528619
default:
529620
$answer->AnswerId = intval( $question_answer_id );
530-
if ( 'note' === $question_type || 'text' === $question_type ) {
531-
$answer->AnswerValue = @sanitize_text_field( $_POST[ $key ] );
532-
} elseif ( 'number' === $question_type ) {
533-
$answer->AnswerValue = @intval( $_POST[ $key ] );
621+
if ( ( 'note' === $question_type || 'text' === $question_type ) && ! empty( $_POST[ $key ] ) ) {
622+
$answer->AnswerValue = sanitize_text_field( $_POST[ $key ] );
623+
} elseif ( 'number' === $question_type && ! empty( $_POST[ $key ] ) ) {
624+
$answer->AnswerValue = intval( $_POST[ $key ] );
534625
} elseif ( 'date' === $question_type && ! empty( $_POST[ $key ] ) ) {
535-
$answer->AnswerValue = @date( 'c', strtotime( $_POST[ $key ] ) );
626+
$answer->AnswerValue = date( 'c', strtotime( $_POST[ $key ] ) );
536627
} else {
537628
$answer->AnswerValue = null;
538629
}
@@ -585,18 +676,26 @@ private function get_participant_data() {
585676

586677
if ( ! empty( $_POST['participantFirstName'][ $key ] ) ) {
587678
$person = new stdClass();
588-
$person->FirstName = @sanitize_text_field( $_POST['participantFirstName'][ $key ] );
589-
$person->LastName = @sanitize_text_field( $_POST['participantLastName'][ $key ] );
590-
$person->Email = @sanitize_email( $_POST['participantEmail'][ $key ] );
591-
$person->Phone = @sanitize_text_field( $_POST['participantPhone'][ $key ] );
592-
$person->Mobile = @sanitize_text_field( $_POST['participantMobile'][ $key ] );
593-
594-
if ( isset( $_POST['participantCivReg'][ $key ] ) ) {
595-
$person->CivicRegistrationNumber = @trim( sanitize_text_field( $_POST['participantCivReg'][ $key ] ) );
679+
$person->FirstName = sanitize_text_field( $_POST['participantFirstName'][ $key ] );
680+
if ( ! empty( $_POST['participantLastName'][ $key ] ) ) {
681+
$person->LastName = sanitize_text_field( $_POST['participantLastName'][ $key ] );
682+
}
683+
if ( ! empty( $_POST['participantEmail'][ $key ] ) ) {
684+
$person->Email = sanitize_email( $_POST['participantEmail'][ $key ] );
685+
}
686+
if ( ! empty( $_POST['participantPhone'][ $key ] ) ) {
687+
$person->Phone = sanitize_text_field( $_POST['participantPhone'][ $key ] );
688+
}
689+
if ( ! empty( $_POST['participantMobile'][ $key ] ) ) {
690+
$person->Mobile = sanitize_text_field( $_POST['participantMobile'][ $key ] );
691+
}
692+
693+
if ( ! empty( $_POST['participantCivReg'][ $key ] ) ) {
694+
$person->CivicRegistrationNumber = trim( sanitize_text_field( $_POST['participantCivReg'][ $key ] ) );
596695
}
597696

598-
if ( isset( $_POST['participantPriceName'][ $key ] ) ) {
599-
$person->PriceNameId = @intval( $_POST['participantPriceName'][ $key ] );
697+
if ( ! empty( $_POST['participantPriceName'][ $key ] ) ) {
698+
$person->PriceNameId = intval( $_POST['participantPriceName'][ $key ] );
600699
}
601700

602701
$person->CustomFields = $this->get_participant_custom_fields( $key );

‎class/class-eduadmin-loginhandler.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,6 @@ public function get_login_user( $personId, $customerId ) {
9191

9292
EDU()->session['eduadmin-loginUser'] = $user;
9393

94-
setcookie( 'eduadmin_loginUser', wp_json_encode( EDU()->session['eduadmin-loginUser']->Contact ), time() + 3600, COOKIEPATH, COOKIE_DOMAIN );
95-
9694
return $user;
9795
}
9896
}

0 commit comments

Comments
 (0)