Bonjour,
\nMerci pour ce plugin. Je n’ai pas vu de bugs et il est facile \u00e0 utiliser.
\nToutefois pour un projet personnel, j’ai modifi\u00e9 deux fichiers pour :
\n– S\u00e9curiser un peu les acc\u00e8s au $_POST
\n– R\u00e9cup\u00e9rer les valeurs des champs en cas de non validation afin de ne pas avoir \u00e0 re-remplir le formulaire
\n– Ajouter des messages d’erreurs pour chaque champs et un style .wrong ou .ok sur le champs en question
\n– Ajouter un type de champs code postal (pas tout \u00e0 fait fini)…
\n– Limiter le contenu des champs \u00e0 32 caract\u00e8res
\n– Ajouter email, nom et pr\u00e9nom dans des colonnes sp\u00e9cifiques de la BDD afin de pouvoir faire des recherches (la s\u00e9rialisation ne permet pas trop de trier), la table a \u00e9t\u00e9 modifi\u00e9e \u00e0 la main….
\nJe n’ai pas modifier la partie admin car c’est un projet unique….
\nbref si cela int\u00e9resse voici les deux fichiers modifi\u00e9s :<\/p>\n
++
\neKo<\/p>\n
display_yawpp.php<\/p>\n
<?php\n\/\/ligne de securit\u00e9\ndefined('ABSPATH') or die("No script kiddies please!");\n\ninclude(plugin_dir_path( __FILE__ ). '\/display_functions.php');\n\n\/\/Affichage du formulaire de la p\u00e9tition\nfunction yawpp_display_form($id){\n\n\tif(isset($_POST['submit_yawpp'])){\n\n\t\tadd_signs();\n\n\t}\n\n\tglobal $wpdb;\n\tglobal $yawpp_error;\n\n\t\/\/variable de retour\n\t$html = '';\n\n\t\/\/On r\u00e9cup\u00e8re les champs de la p\u00e9tition\n\t$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_fields WHERE id_petition = %d ORDER BY id ASC", $id), OBJECT);\n\t$html .= $yawpp_error;\n\t$html .= '<div class="form_yawpp"><fieldset><form name="form_yawpp" method="post">';\n\n\tforeach ($fields as $field){\n\n\t\t\/\/recuperer les variables post securis\u00e9es\n\t\tglobal ${'yawpp_f_field'.$field->id};\n\t\tglobal ${'yawpp_f_needed'.$field->id};\n\t\tglobal ${'yawpp_f_wrongmail'.$field->id};\n\t\tglobal ${'yawpp_f_unique'.$field->id};\n\t\tglobal ${'yawpp_f_zipcode'.$field->id};\n\t\tglobal $yawpp_post;\n\n\t\t\/\/test des champs ok pour l'affichage\n\t\tif(${'yawpp_f_needed'.$field->id}==true\n\t\t\t|| ${'yawpp_f_wrongmail'.$field->id}==true\n\t\t\t|| ${'yawpp_f_unique'.$field->id}==true\n\t\t\t|| ${'yawpp_f_zipcode'.$field->id}==true\n\t\t\t)\n\t\t{\n\t\t\t$wrongClass="wrong";\n\t\t}\n\t\telse if ($yawpp_post)\n\t\t{\n\t\t\t$wrongClass="ok";\n\t\t}\n\n\t\t$html .= '<div class="field_yawpp '.$wrongClass.'"><label for="field'.$field->id.'">'.$field->text;\n\t\tif($field->needed == 0){\n\t\t\t$html .= ' : <\/label>';\n\t\t}else{\n\t\t\t$html .= '* : <\/label>';\n\t\t}\n\n\t\tswitch($field->type){\n\t\t\tcase 'text':\n\t\t\t\t$html .='<input type="text" name="field'.$field->id.'" id="field'.$field->id.'" value="'.${'yawpp_f_field'.$field->id}.'"\/>';\n\t\t\t\tbreak;\n\n\t\t\tcase 'email':\n\t\t\t\t$html .='<input type="email" name="field'.$field->id.'" id="field'.$field->id.'" value="'.${'yawpp_f_field'.$field->id}.'"\/>';\n\t\t\t\tbreak;\n\n\t\t\tcase 'comment':\n\t\t\t\t$html .='<textarea name="field'.$field->id.'" id="field'.$field->id.'">'.${'yawpp_f_field'.$field->id}.'<\/textarea>';\n\t\t\t\tbreak;\n\t\t\tcase 'checkbox':\n\t\t\t\t\/\/verifier si la check box \u00e9tait checked\n\t\t\t\tif(${'yawpp_f_field'.$field->id}=="1")\n\t\t\t\t{\n\t\t\t\t\t$checked="checked";\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\t$checked="";\n\t\t\t\t}\n\t\t\t\t$html .= '<input type="checkbox" name="field'.$field->id.'" id="field'.$field->id.'" value="1" '.$checked.'\/>';\n\t\t}\n\t\t$html .='<br \/><\/div>';\n\n\t}\n\n\t$html .= '<p>* '.__("Champs obligatoires", 'yawpp').'<\/p><input type="hidden" name="id" value="'.$id.'" \/><input type="submit" value="Valider" name="submit_yawpp" \/><\/fieldset><\/form><\/div>';\n\n\treturn $html;\t\t\n\n}\n\n\/\/Affichage de la liste des signataires\nfunction yawpp_display_signs($id){\n\nglobal $wpdb;\n\n$html = null;\n\n\/\/On r\u00e9cup\u00e8re la liste des signataires pour la p\u00e9tition\n\n$html .= '<div class="signs_yawpp">';\n\n$p = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_petitions WHERE id = %d", $id), OBJECT);\n\nif(empty($p[0]->max)){\n\t$result = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_signs WHERE id_petition = %d ORDER BY id DESC", $id), OBJECT);\n}\nelse{\n\t$result = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_signs WHERE id_petition = %d ORDER BY id DESC LIMIT 0, %d", $id, $p[0]->max), OBJECT);\n}\n\n if($result) {\n\n \t\/\/S'il y a des signataires, on affiche les champs dans le tableau\n $html .= "<table class='signs_table'>\n <thead>\n <tr>";\n\n \/\/Affichage des ent\u00eates du tableau\n $resultfields = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_fields WHERE id_petition = %d", $id), OBJECT);\n\n foreach($resultfields as $rf){\n \tif ($rf->private != 1) $html .= "<th>".$rf->text."<\/th>";\n }\n\n $html .= "\n \t<\/tr>\n \t\t<\/thead>\n \t<tfoot>\n \t \t<tr>";\n\n foreach($resultfields as $rf){\n \tif ($rf->private != 1) $html .= "<th>".$rf->text."<\/th>";\n }\n\n $html .= "\n <\/tr>\n <\/tfoot>";\n\n foreach($result as $r)\n {\n $html .= "<tbody><tr>";\n\n \/\/On d\u00e9s\u00e9rialise les champs\n $fieldsvalue = unserialize($r->fieldstable);\n \/\/On boucle sur les champs\n foreach($resultfields as $rf){\n\t if ($rf->private != 1) $html .= "<td>".$fieldsvalue[$rf->id]."<\/td>";\n\t }\n $html .= '<\/td>';\n $html .= "<td><\/td><\/tr><\/tbody>";\n }\n $html .= "<\/table>";\n\n\t}else{\n $html .= "<h3>".__("Aucun signataire pour cette p\u00e9tition.", 'yawpp')."<\/h3>";\n }\n\n $html .= '<\/div>';\n\n\treturn $html ;\n\n}\n\n\/\/Affichage du nombre de signataire\n\nfunction yawpp_display_num_signs($id){\n\nglobal $wpdb;\n\t$wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_signs WHERE id_petition = %d ORDER BY id DESC", $id), OBJECT);\n\n\treturn '<span class="yawppnumsign">'.$wpdb->num_rows.'<\/span>';\n}\n?><\/code><\/pre>\net display_fonctions.php<\/p>\n
<?php\n\n\/\/ligne de securit\u00e9\ndefined('ABSPATH') or die("No script kiddies please!");\n\n\/\/\/verification du XSS en GET et en POST\nif (isset($_POST))\n{\n\tforeach ($_POST as $key=>$secvalue)\n\t{\n\t\t\/\/echo "debug0: key=".$key.",value=".$secvalue.",";\n\t\tif (is_array($secvalue))\n\t\t {\n\t\t \t\t$secvalue=implode(",",$secvalue);\n\t\t }\n\n\t\tif (preg_match("\/<[^>]*script*\\"?[^>]*>\/i", $secvalue))\n\t\t{\n\t\t\tif ($key!="form_description" && $key!="form_content") die ("You can't do this...");\n\t\t\t\/\/ Traitement de la description saisie qui peut contenir du code\n\t\t}\n\t}\n}\nif (isset($_GET))\n{\n\tforeach ($_GET as $key=>$secvalue)\n\t{\n\t if (is_array($secvalue)) $secvalue=implode(",",$secvalue);\n\t\tif (preg_match("\/<[^>]*script*\\"?[^>]*>\/i", $secvalue))\n\t\t{\n\t\tif ($key!="form_description") die ("You can't do this...");\n\t\t\/\/ Traitement de la description saisie qui peut contenir du code\n\t\t}\n\t}\n}\n\/\/ recuperation des variables de session\nif (isset($_SESSION)) foreach($_SESSION as $k=>$v) $$k=$v;\n\/\/limite de taille des champs\n$nb_caractere_limit=32;\n\/\/ recuperation des parametres envoyes par formulaire (POST) ou URL (GET)\nif (isset($_POST)) foreach($_POST as $k=>$v) ${"yawpp_f_".$k}=substr($v, 0, $nb_caractere_limit);\nif (isset($_GET)) foreach($_GET as $k=>$v) ${"yawpp_f_".$k}=substr($v, 0, $nb_caractere_limit);\n\n\/*-------------------------------------\nV\u00e9rification de l'unicit\u00e9 d'un champs\n--------------------------------------*\/\n\n\/\/Affichage de la liste des signataires\nfunction check_unicity($id, $field, $id_petition)\n{\n\n\tglobal $wpdb;\n\n\t\/\/On r\u00e9cup\u00e8re la liste des signataires pour la p\u00e9tition\n\n\t$result = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_signs WHERE id_petition = %d", $id_petition), OBJECT);\n\n if($result)\n\t{\n\n\t \/\/On r\u00e9cup\u00e8re les champs\n\t $resultfields = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_fields WHERE id_petition = %d", $id_petition), OBJECT);\n\n\t\t foreach($result as $r)\n\t\t {\n \/\/On d\u00e9s\u00e9rialise les champs\n $fieldsvalue = unserialize($r->fieldstable);\n \tif ($fieldsvalue[$id] == $field) {\n \t\treturn false;\n \t}\n \telse{\n\n \t}\n\n \t}\n\t\treturn true;\n\n\t}\n\telse\n\t{\n\t\treturn true;\n\n \t}\n\n}\n\n\/*----------------------------------------\nAjout d'une signature \u00e0 la base de donn\u00e9e\n-----------------------------------------*\/\n\nfunction add_signs()\n{\n\n\tglobal $wpdb;\n\tglobal $yawpp_f_id;\n\t\/\/On v\u00e9rifie que tous les champs obigatoires ont \u00e9t\u00e9 remplis\n\n\t\/\/On r\u00e9cup\u00e8re l'ID de la p\u00e9tition\n\t$id_petition = $yawpp_f_id;\n\n\t\/\/ On r\u00e9cup\u00e8re les champs dans la base de donn\u00e9e.\n\t$fields = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."yawpp_fields WHERE id_petition = %d", $id_petition), OBJECT);\n\n\t\/\/On boucle sur les champs\n\t$test = 0;\n\t$wrongmail = 0;\n\t$unique = 0;\n\t$zipcode=0;\n\tforeach($fields as $field)\n\t{\n\t\t\/\/flag de passage en post\n\t\tglobal $yawpp_post;\n\t\t$yawpp_post=true;\n\n\t\tglobal ${'yawpp_f_field'.$field->id};\n\t\tglobal ${'yawpp_f_needed'.$field->id};\n\t\tglobal ${'yawpp_f_wrongmail'.$field->id};\n\t\tglobal ${'yawpp_f_unique'.$field->id};\n\t\tglobal ${'yawpp_f_zipcode'.$field->id};\n\t\t\/\/echo 'yawpp_f_field'.$field->id." :";\n\t\t\/\/echo ' -'.$field->text.'- ';\n\t\t\/\/echo ${'yawpp_f_field'.$field->id};\n\t\t\/\/echo "<br \/>";\n\n\t\t\/\/champs obligatoire\n\t\tif(($field->needed == 1) && (empty(${'yawpp_f_field'.$field->id})))\n\t\t{\n\n\t\t\t$test++;\n\t\t\t${'yawpp_f_needed'.$field->id}=true;\n\n\t\t}\n\n\t\t\/\/champs email\n\t\tif(($field->type == "email") &&((!filter_var(${'yawpp_f_field'.$field->id}, FILTER_VALIDATE_EMAIL) || ${'yawpp_f_field'.$field->id}=="" )))\n\t\t{\n\n\t\t\t$wrongmail++;\n\t\t\t${'yawpp_f_wrongmail'.$field->id}=true;\t\n\n\t\t}\n\n\t\t\/\/champs unique\n\t\tif(($field->uniquefield == 1) && (!check_unicity($field->id, ${'yawpp_f_field'.$field->id}, $id_petition)))\n\t\t{\n\n\t\t\t$unique++;\n\t\t\t${'yawpp_f_unique'.$field->id}=true;\t\t\t\n\n\t\t}\n\t\t\/\/champs code postal\n\t\tif(($field->type == "zipcode") && (!filter_var(${'yawpp_f_field'.$field->id}, FILTER_VALIDATE_INT)) && (strlen (${'yawpp_f_field'.$field->id}))==5)\n\t\t{\n\n\t\t\t$zipcode++;\n\t\t\t${'yawpp_f_zipcode'.$field->id}=true;\t\n\n\t\t}\t\n\n\t}\n\n\t\/\/ ok pour signer\n\tif($test == 0 && $wrongmail == 0 && $unique == 0 && $zipcode == 0)\n\t{\n\t\t\/\/S\u00e9rialisation des valeurs des champs\n\t\t$fieldstable[] = NULL;\n\n\t\t\/\/champs enregistr\u00e9 en dur : nom pr\u00e9nom et email\n\t\t$nom="";\n\t\t$prenom="";\n\t\t$email="";\n\n\t\tforeach($fields as $field){\n\n\t\t\tif(empty(${'yawpp_f_field'.$field->id}))\n\t\t\t{\n\t\t\t\t$fieldstable[$field->id] = '';\n\t\t\t}else{\n\t\t\t\t$fieldstable[$field->id] = ${'yawpp_f_field'.$field->id};\n\t\t\t}\n\t\t\t\/\/quelques champs en dur dans la bdd (pour les recherches)\n\t\t\tswitch(strtolower($field->text))\n\t\t\t{\n\t\t\t\tcase "email" :\n\t\t\t\t\/\/echo "email ok";\n\t\t\t\t$email=${'yawpp_f_field'.$field->id};\n\t\t\t\tbreak;\n\t\t\t\tcase "pr\u00e9nom" :\n\t\t\t\t\/\/echo "prenom ok";\n\t\t\t\t$prenom=${'yawpp_f_field'.$field->id};\n\t\t\t\tbreak;\n\t\t\t\tcase "nom" :\n\t\t\t\t\/\/echo "nom ok";\n\t\t\t\t$nom=${'yawpp_f_field'.$field->id};\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t}\n\n\t\t$serializefields = serialize($fieldstable);\n\t\t$wpdb->query($wpdb->prepare("INSERT INTO ".$wpdb->prefix."yawpp_signs (time, fieldstable, display, id_petition,email,firstname,lastname) VALUES ( now(), %s, 1, %d, %s,%s,%s)", $serializefields, $id_petition, $email, $prenom, $nom));\n\t\techo '<div class="okmessage_yawpp">'.__("Merci, votre signature a bien \u00e9t\u00e9 enregistr\u00e9e.", 'yawpp').'<\/div>';\n\t}\n\n\telse\n\t{\n\t\tglobal $yawpp_error;\n\n\t\t\/\/generer les messages d'erreur\n\t\t$yawpp_error="";\n\t\t$yawpp_error.= '<div class="errormessage_yawpp">';\n\t\tforeach($fields as $field)\n\t\t{\t\n\n\t\t\t\/\/erreur obligatoire\n\t\t\tif(${'yawpp_f_needed'.$field->id}==true)\n\t\t\t{\n\t\t\t\t$yawpp_error.= $field->text." ".__("est un champs obligatoires.", 'yawpp').'<br \/>';\n\t\t\t}\n\t\t\t\/\/erreur unique\n\t\t\tif(${'yawpp_f_unique'.$field->id}==true)\n\t\t\t{\n\t\t\t\t$yawpp_error.= __("Cet email a d\u00e9j\u00e0 \u00e9t\u00e9 utilis\u00e9 pour une autre inscription.", 'yawpp').'<br \/>';\n\t\t\t}\n\t\t\t\/\/erreur email\n\t\t\tif(${'yawpp_f_wrongmail'.$field->id}==true)\n\t\t\t{\n\t\t\t\t$yawpp_error.= $field->text." ".__("n'est pas un e-mail valide.", 'yawpp').'<br \/>';\n\t\t\t}\n\t\t\t\/\/erreur code postal\n\t\t\tif(${'yawpp_f_zipcode'.$field->id}==true)\n\t\t\t{\n\t\t\t\t$yawpp_error.= $field->text." ".__("n'est pas un code postal valide.", 'yawpp').'<br \/>';\n\t\t\t}\n\t\t}\n\t\t$yawpp_error.= '<\/div>';\n\t}\n}\n\n?><\/code><\/pre>\nhttps:\/\/wordpress.org\/plugins\/yawpp\/<\/p>\n","protected":false},"template":"","class_list":["post-5390640","topic","type-topic","status-closed","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5390640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5390640\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=5390640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}