form.lib.php

<?php
/**

Copyright 2015 JQueryForm.com
License: http://jqueryform.com/license.php

FormID: jqueryform-c96556
Date: 2015-11-02 19:47:59
Generated by http://www.jqueryform.com

IF your form uses mailgun AND the form has file upload field, PHP 5.5+ is required.

*/

namespace JF;

require_once( __DIR__ . '/form.config.php' );
use JF\Config;

// --------------------------------------------------------------
class Form {

    public static function setDataDir( $dir ){
        self::$dataDir = $dir ;
    }

    public static function getFormDataFile(){
        return self::$dataDir . '/form-data.php' ;
    }

    public static function getEmailLogFile(){
        return self::$dataDir . '/email-log.php' ;
    }

    public static function validate( $post = array() ){
        if( empty($post) ){
            $post = $_POST;
        };

        self::$post        = $post;
        self::$values      = array();
        self::$attachments = array();
        self::$invalid     = array();
        self::$columns     = array( self::csvfield('RecordID'), self::csvfield('Date'), self::csvfield('IP') );
        self::$csvValues   = array( self::csvfield(self::getRecordID()), self::csvfield(date("Y-m-d H:i:s")), self::csvfield($_SERVER['REMOTE_ADDR']) );
        self::$serverValidationFields = empty(self::$post['serverValidationFields']) ? array(): explode(',', self::$post['serverValidationFields']);
        self::$style  = 'font-family:Verdana, Arial, Helvetica, sans-serif; font-size : 13px; color:#474747;padding:6px;border:1px solid #cccccc;' ;
        self::$rows   = array();
        $config = self::getConfig();

        $ok = self::validateReCaptcha( $post, $config['recaptcha']['secretKey'] );
        if( !$ok ){
            self::$invalid[] = 'recaptcha';
        };

        foreach( $config['fields'] as $f ){
            switch ($f['field_type']) {
                // creditcard field contains extra fields, have to validate them one by one
                case 'creditcard':
                    self::_validateCreditcardFields( $f );
                    break;

                default:
                    self::_validateField( $f );
            };
        }; // foreach

        self::$values['dataTable'] = empty(self::$rows) ? '' : '<table cellspacing="0" cellpadding="0" border="1" bordercolor="#cccccc" style="border:1px solid #cccccc;"><tbody>' .
               join( "\n", self::$rows ).
               '</table>';

        // save form data to file
        if( self::isValid() ){
            self::saveRecord();
        };

        // add preset tags
        self::presetTags();

        self::$isValidated = true; // validation checked
    }

    private static function _validateCreditcardFields($field){
        foreach ($field['subfields'] as $name => $f ) {
            // remove spaces that are created by javascript jquery.payment plugin
            self::$post[$name] = str_replace(' ', '', self::$post[$name]);
            self::_validateField( $f );
        };
    }

    private static function _validateField($f){
        $key = $f['cid'];
        $value = "";
        switch ($f['field_type']) {
            case 'file':
                $value = self::handleUploadFile($f);
                break;

            default:
                if( !array_key_exists( $key, self::$post ) ){
                    self::$values[ $key ] = '';
                    continue;
                };

                $value = self::$post[$key];

                // checkboxes or select-multiple
                if( is_array($value) ){
                    $tmp = array();
                    foreach( $value as $v ){
                        $tmp[] = self::un_quotes($v);
                    };
                    $value = join(" | \n", $tmp);

                // other input/textarea ...
                }else{
                    $value = self::un_quotes( $value );
                };
                break;
        }; // switch

        self::$values[ $key ] = $value;

        if(  !empty($f['field_options']['sender']) ){
            if( 'email' == $f['field_type'] && true == $f['field_options']['sender'] ){
                $f['field_options']['sender'] = 'email';
            };
            self::$values[ 'sender.' . $f['field_options']['sender'] ] = self::$values[ $key ];
        };

        if( self::isRequired($f) && empty($value) ){
            if( empty(self::$serverValidationFields) || (!empty(self::$serverValidationFields) && in_array($key, self::$serverValidationFields))  ){
                self::$invalid[] = $key;
            };
        };

        self::$columns[]   = self::csvfield( $f['label'] );
        self::$csvValues[] = self::csvfield( $value );

        self::$rows[] = "<tr> <td valign=top style='" . self::$style."font-weight:bold;width:25%;'>" . $f['label'] . "&nbsp;</td> <td valign=top style='" . self::$style.";'>" . nl2br($value) . "&nbsp;</td></tr>" ;
    } // _validateField

    private static function validateReCaptcha( $post, $secretKey ){
        if( !empty($secretKey) && isset($post['g-recaptcha-response']) ){
            $get = 'https://www.google.com/recaptcha/api/siteverify?secret=' . $secretKey. '&response=' . $post['g-recaptcha-response'];
            $response = file_get_contents( $get );
            //echo $get . "\n" . $response;
            $success = false;
            if( function_exists('json_decode') ){
                $json = json_decode( $response, true );
                //var_dump($json);
                $success = $json['success'] === true;
            }else{
                $success = preg_match( '/success[\"\']*\\:\\s*(true|1|y)/i', $response );
            };
            return $success;
        };

        return true; // recaptcha is not enabled
    }

    private static function presetTags(){
        self::setValue( 'AutoID', self::getRecordID() );
        self::setValue( 'HTTP_HOST', $_SERVER['HTTP_HOST'] );
        self::setValue( 'IP', $_SERVER['REMOTE_ADDR'] );
        self::setValue( 'Date', date("Y-m-d") );
        self::setValue( 'Time', date("H:i:s") );
        self::setValue( 'HTTP_REFERER', $_SERVER['HTTP_REFERER'] );
        //self::setValue( 'FormURL', '' );
        //self::setValue( 'AdminURL', '' );
        // sender.email
        // sender.firstname
        // sender.lastname
        // sender.fullname
    }

    private static function un_quotes($str){
        return str_replace( array('&quot;', '&#039;'), array('"', "'"), $str );
    }

    private static function handleUploadFile($field){
        if( !isset($_FILES[ $field['cid'] ]) ){
            return '';
        };

        $dir = self::getDataDir();
        $file = $_FILES[ $field['cid'] ];
        $fileName = $file['name'];
        if( is_uploaded_file($file['tmp_name']) ){
            $safeName = self::renameHarmfulFile($file['name']);
            $safeName = preg_replace( "/[^0-9a-zA-Z\.]+/", "-",  $safeName );
            $filePath = $dir . '/' . self::getRecordID() . '-' . $safeName ;
            $ok = @move_uploaded_file( $file['tmp_name'], $filePath );

            $link = false;
            if( $ok ) {
                $link = self::checkFile2Link( $field, $filePath );
                if( !empty($link) ){
                    self::setValue( $field['cid'] . '.name', $fileName );
                    $fileName = "<a href='{$link}' target='_blank'>{$fileName}</a>";
                };
            };

            // if the file is not a link, then send it as attachment
            if( empty($link) ){
                self::$attachments[] = array('path' => $ok ? $filePath : $file['tmp_name'], 'name' => $fileName );
            };
        };
        return $fileName;
    }

    private static function checkFile2Link($field, $filepath){
        $kb = $field['field_options']['file']['fileToLinkSize'];
        if( empty($kb) ){
            return false ;
        };

        $filesize = filesize($filepath);
        if( $filesize >= $kb ){
            $link = self::getFileLink( $filepath );
            self::setValue( $field['cid'] . '.link', $link );
            return $link;
        };

        return false;
    }

    private static function getFileLink($filepath){
        $realpath = self::dir2unix( realpath($filepath) );
        $link = self::getAdminUrl() . '?method=downloadAttachment&id=' . urlencode(basename($filepath));
        return $link;
    }

    public static function dir2unix( $dir ){
        return str_replace( array("\\", '//'), '/', $dir );
    }

    // parse full admin url to view large size uploaded file online
    public static function getAdminUrl(){
        $url = 'admin.php';
        $http = 'http' . ( empty($_SERVER['HTTPS']) ? '' : 's' ) . '://' ;
        $http_host = $http . "{$_SERVER['HTTP_HOST']}";
        switch( true ){
            case (0 === strpos($url, $http )) :
                $url = $url;
                break;
            case ( '/' == substr($url,0,1) ) :
                $url = $http_host . $url ;
                break;
            default:
                $uri = self::requestUri();
                $pos = strrpos( $uri, '/' );
                $vdir = substr( $uri, 0, $pos );
                $url  = $http_host . $vdir . '/' . $url ;
        };
        return $url;
    }


    public static function requestUri(){
        $uri = getEnv('REQUEST_URI'); // apache has this
        if( false !== $uri && strlen($uri) > 0 ){
            return $uri ;
        } else {

            $uri = ($uri = getEnv('SCRIPT_NAME')) !== false
                   ? $uri
                   : getEnv('PATH_INFO') ;
            $qs = getEnv('QUERY_STRING'); // IIS and Apache has this
            return $uri . ( empty($qs) ? '' : '?' . $qs );

        };
        return "" ;
    }


    public static function getAttachments(){
        return self::$attachments;
    }

    public static function isValid(){
        return empty(self::$invalid);
    }

    public static function isValidated(){
        return self::$isValidated;
    }

    public static function getInvalidFields(){
        return self::$invalid;
    }

    public static function getValue( $cid ){
    	return array_key_exists( $cid, self::$values ) ? self::$values[$cid] : '';
    }

    public static function getAdminUsers(){
        $config = self::getConfig();
        $default = array();
        $admin = empty($config['admin']['users']) ? $default : $config['admin'];

        $users = array();
        $parts = explode(',', $admin['users']);
        foreach( $parts as $part ){
            $pos = strpos( $part, ':' );
            if( false === $pos ){
                continue;
            };
            $user = trim(substr($part,0,$pos));
            $pass = trim(substr($part,$pos+1));
            $users[$user] = array('user' => $user, 'password' => $pass);
        };

        return $users;
    }

    // avoid email header injection by removing line breaks for email headers 
    private static function removeLineBreaks( $str ){
        return trim(preg_replace('/[\r\n]+/', '', $str));
    }

    // Email for mail header
    public static function getFromEmail( $forAutoResponse = false ){
        $email = self::getSenderEmail();
        if( $forAutoResponse || empty($email) ){
            $email = self::$config['email']['to'];
        };

        $sendmail_from = self::$config['email']['sendmail_from'];
        if( !empty($sendmail_from) ){
            ini_set("sendmail_from", $sendmail_from);
            $email = $sendmail_from;
        };

        return self::removeLineBreaks( $email );
    }

    // Name for mail header
    public static function getFromName( $forAutoResponse = false ){
        if( $forAutoResponse ){
            $fromName = self::$config['email']['fromName'];
            return $fromName;
        };

        $fullname = self::getValue('sender.fullname');
        $fromName = '' != $fullname ? $fullname : trim(self::getValue('sender.firstname') . ' ' . self::getValue('sender.lastname')) ;
        return self::removeLineBreaks( $fromName );
    }

    public static function getSenderEmail(){
        $email = self::getValue('sender.email');
        return self::removeLineBreaks( $email );
    }

    public static function getToEmail(){
        self::getConfig();
        return self::removeLineBreaks( self::$config['email']['to'] );
    }

    public static function getReplyToEmail(){
        self::getConfig();
        return self::removeLineBreaks( self::$config['autoResponse']['replyTo'] );
    }

    public static function getReplyToName(){
        self::getConfig();
        return self::removeLineBreaks( self::$config['autoResponse']['replyToName'] );
    }

    public static function getId(){
        return 'test-form-id';
    }

    public static function getDataDelivery(){
        $config = self::getConfig();
        return self::$config['admin']['dataDelivery'];
    }

    public static function getValues(){
    	return self::$values;
    }


    public static function getMailSubject(){
    	return self::removeLineBreaks( self::renderContent( self::$config['email']['subject'] ) );
    }


    public static function getMailBody(){
    	return self::getHtmlHeader() .
               self::renderContent( self::mailTemplate() ) .
               self::getHtmlFooter();
    }


    public static function getAutoResponseMailSubject(){
    	return self::removeLineBreaks( self::renderContent( self::$config['autoResponse']['subject'] ) );
    }


    public static function getAutoResponseMailBody(){
        $body = self::autoResponseTemplate();
        return empty($body) ? "" :
               self::getHtmlHeader() .
               self::renderContent( $body ) .
               self::getHtmlFooter();
    }


    public static function setValue( $key, $value ){
    	self::$values[$key] = $value ;
    }


	private static function replaceTags( $content, $tags, $start='{', $end='}' ){
		$attrs = array();
		foreach ($tags as $tag => $value) {
			$attrs[$start.$tag.$end] = $value;
		};

		$names  = array_keys($attrs);
		$values = array_values($attrs);
		return str_replace( $names, $values, $content );
	}


    private static function renderContent( $content ){
    	return self::replaceTags( $content, self::$values );
    }


    private static function getHtmlHeader(){
        ob_start();
?>
<!DOCTYPE html>
<html lang="en">

<head>

  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<?php
        $output = ob_get_contents();
        ob_end_clean();

        return $output;
    }


    private static function getHtmlFooter(){
        ob_start();
?>
</body>
</html>
<?php
        $output = ob_get_contents();
        ob_end_clean();

        return $output;
    }

    private static function mailTemplate(){
        $default = "{dataTable}";
        $config = self::getConfig();
        $template = nl2br( trim(self::$config['email']['template']) );
        return empty($template) ? $default : $template;
    }

    private static function autoResponseTemplate(){
        $config = self::getConfig();
        $template = nl2br( trim(self::$config['autoResponse']['template']) );
        return $template;
    }

    private static function getDataDir(){
        $dir = dirname( self::getFormDataFile() ); 
        if( !is_dir($dir) ){
            @mkdir( $dir );
        };
        return $dir;
    }

    private static function saveRecord(){
        $method = self::getDataDelivery();
        if( 'emailOnly' == $method ){
            return;
        };

        // if there are any real data rather then only 3 columns: ID, Date, and IP
        if( count(self::$csvValues) <= 3 ){
            return;
        };

        $sep = chr(0x09);
        $recordCols = self::data2record( join($sep, self::$columns) ) . PHP_EOL;
        $record     = self::data2record( join($sep, self::$csvValues) ) . PHP_EOL;

        self::getDataDir();
        $dataFile = self::getFormDataFile();
        if( !file_exists($dataFile) ){
            self::secureFile( $dataFile );
            file_put_contents($dataFile, $recordCols, FILE_APPEND );
        };

        file_put_contents($dataFile, $record, FILE_APPEND );
    }

    public static function secureFile( $file ){
        if( !file_exists($file) ){
            file_put_contents($file, "<?php exit(); /* For security reason. To avoid public user downloading below data! */?>" . PHP_EOL);
        };
    }


    private static function getRecordID(){
        if( !isset($GLOBALS['RecordID']) ){
            $GLOBALS['RecordID'] = date("Ymd") . '-'.  substr( md5(uniqid(rand(), true)), 0,4 );
        };
        return $GLOBALS['RecordID'];
    }

    private static function data2record( $s, $b=true ){
        $from = array( "\r", "\n");
        $to   = array( "\\r", "\\n" );
        return $b ? str_replace( $from, $to, $s ) : str_replace( $to, $from, $s ) ;
    }


    private static function csvfield( $str ){
        $str = str_replace( '"', '""', $str );
        return '"' . trim($str) . '"';
    }

    private static function isRequired($field){
        return true === $field['field_options']['validators']['required']['enabled'];
    }

    private static function renameHarmfulFile( $name ){
        $ext = strrchr(strtolower($name), '.');
        if( $ext !== false ){
            $n = strpos( strtolower(self::$harmfulExts), $ext );
            if( $n !== false ){
                return $name . '.bak' ;
            };
        };
        return $name;
    }

    private static $config;
    private static $post;
    private static $values;
    private static $invalid;
    private static $isValidated = false; 
    private static $attachments;

    private static $dataDir = './data/'; // folder that stores form data file, email traffic log, and upload files
    private static $columns;
    private static $csvValues;

    private static $serverValidationFields;
    private static $style;
    private static $rows;

    private static $harmfulExts = ".php, .html, .css, .js, .exe, .com, .bat, .vb, .vbs, scr, .inf, .reg, .lnk, .pif, .ade, .adp, .app, .bas, .chm, .cmd, .cpl, .crt, .csh, .fxp, .hlp, .hta, .ins, .isp, .jse, .ksh, .Lnk, .mda, .mdb, .mde, .mdt, .mdw, .mdz, .msc, .msi, .msp, .mst, .ops, .pcd, .prf, .prg, .pst, .scf, .scr, .sct, .shb, .shs, .url, .vbe, .wsc, .wsf, .wsh";

    public static function getConfig( $decode = true ){
        self::$config = Config::getConfig($decode);
        self::overwriteConfig( $decode );
        return self::$config;
    }

    private static function overwriteConfig( $decode = true ){
        if( !$decode ){
            return;
        };

        $file = __DIR__.'/myconfig.php';
        if( !file_exists($file) ){
            return;
        };

        $config = include($file);
        if( !is_array($config) ){
            return;
        };

        foreach( $config as $sectionName => $var ){
            if( is_array($var) ){
                foreach( $var as $key => $val ){
                    if( !empty($val) ){
                        self::$config[$sectionName][$key] = $config[$sectionName][$key];
                    };
                };//
            }else{
                if( !empty($var) ){
                    self::$config[$sectionName] = $config[$sectionName];
                };
            }; // if
        }; // foreac

    } // overwriteConfig

}// end of Form class
// --------------------------------------------------------------



// --------------------------------------------------------------
class Mailer {
    private $config;
    private $mailer = 'local';
    private $logs = array();

    public $From;
    public $FromName;
    public $TO;
    public $Subject;
    public $Body;
    public $CC;
    public $BCC;
    public $ReplyTo;
    public $ReplyToName;
    private $isSent = false;
    private $sendError = '';
    private $sentMIMEMessage = '';


    function __construct(){
        $this->config = Form::getConfig();
    }

    public function Send(){
        $this->mailer   = empty($this->config['mailer']) ? 'local' : $this->config['mailer'];
        switch ( $this->mailer ) {
            case 'local':
            case 'smtp':
              $this->SendByPHPMailer();
              break;

            case 'mailgun':
              if ( function_exists('curl_init') ){
                $this->SendByMailGun();
              } else {
                $this->addLog( "CURL module is not avaiable. Can't use mailgun mailer, use normal sendmail mailer.");
                $this->SendByPHPMailer();
              };
              break;

            default:
              break;
        }; // switch
        $this->saveLogs();
    }

    public function mail( $to , $subject , $message, $from = '', $fromName = '' ){
        $this->TO       = $to;
        $this->From     = $from;
        $this->FromName = $fromName;
        $this->Subject  = $subject;
        $this->Body     = $message;
        return $this->Send();
    }


    public function validateForm( $post = array() ){
        if( !Form::isValidated() ){
            Form::validate($post);
        };
        $this->From     = Form::getFromEmail();
        $this->FromName = Form::getFromName();
        $this->Subject  = Form::getMailSubject();
        $this->Body     = Form::getMailBody();

        $email     = $this->config['email'];
        $this->TO  = Form::getToEmail();
        $this->CC  = empty($email['cc'])  ? '' : $email['cc'];
        $this->BCC = empty($email['bcc']) ? '' : $email['bcc'];
    }

    private function SendByPHPMailer(){
        $email = $this->config['email'];

        $mailer           = new \PHPMailer();
        if( !empty($this->ReplyTo) ){
            $mailer->AddReplyTo($this->ReplyTo, $this->ReplyToName);
        };
        $mailer->From     = $this->From;
        $mailer->FromName = $this->FromName;
        $mailer->Subject  = $this->Subject;
        $mailer->Body     = $this->Body;
        $mailer->CharSet  = 'UTF-8';
        $mailer->msgHTML($mailer->Body);
        $mailer->IsHtml(true);
        $mailer->AddAddress($this->TO);

        if( !empty($this->CC) ){
            $CCs = explode(',',$this->CC );
            foreach($CCs as $c){
                $mailer->AddCC( $c );
            };
        };

        if( !empty($this->BCC) ){
            $BCCs = explode(',',!empty($this->BCC));
            foreach($BCCs as $b){
                $mailer->AddBCC( $b );
            };
        };

        $attachments = Form::getAttachments();
        //$this->addLog($attachments);
        if( is_array($attachments) ){
            foreach($attachments as $f){
                $mailer->AddAttachment( $f['path'], basename($f['name']) );
            };
        };

        $smtp = $this->config['smtp'];
        $isSMTP = $this->mailer == 'smtp' && !empty($smtp);
        if( $isSMTP ){
            $mailer->IsSMTP();
            $mailer->Host = $smtp['host'];
            $mailer->Username = $smtp['user'];
            $mailer->Password = $smtp['password'];
            $mailer->SMTPAuth = !empty($mailer->Password);
            $mailer->SMTPSecure = $smtp['security'];
            $mailer->Port = empty($smtp['port']) ? 25 : $smtp['port'];
            $mailer->SMTPDebug = empty($smtp['debug']) ? 0 : 5;
        };

        if( $isSMTP && $mailer->SMTPDebug > 0 ){
            ob_start();
        };

        $this->isSent = $mailer->Send();

        if( $isSMTP && $mailer->SMTPDebug > 0 ){
            $debug = ob_get_contents();
            ob_end_clean();
            $this->addLog($debug);
        };

        if( !$sent ){
            $this->sendError = $mailer->ErrorInfo;
        };

        $this->sentMIMEMessage = $mailer->getSentMIMEMessage();

        return $this->isSent;
    }


    private function SendByMailGun(){
        $mg = $this->config['mailgun'];

        $api_key= $mg['apiKey']; /* Api Key got from https://mailgun.com/cp/my_account */
        $domain = $mg['domain']; /* Domain Name you given to Mailgun*/

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
        curl_setopt($ch, CURLOPT_USERPWD, "api:".$api_key);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
        curl_setopt($ch, CURLOPT_URL, "https://api.mailgun.net/v3/".$domain."/messages");
        $fields = array(
            "from" => $mg['fromName'] . " <" . $mg['fromEmail'] . ">",
            "to" => $this->TO,
            "subject" => $this->Subject,
            "h:Reply-To" => $this->FromName . " <" . $this->From . ">",
            "html" => $this->Body
        );

        // php 5.5+
        if( class_exists("\\CURLFile") ){
            $attachments = Form::getAttachments();
            if( is_array($attachments) ){
                $n = count($attachments);
                for( $i = 0; $i < $n; $i ++ ) {
                    $f = $attachments[$i];
                    $key = "attachment" . ( $i == 0 ? '' : "[{$i}]" );
                    $fields[$key] = new \CURLFile($f['path'], null, basename($f['name']) );
                };
            };
        };

        if( !empty($this->CC) ){
            $fields['cc'] = $this->CC;
        };
        if( !empty($this->BCC) ){
            $fields['bcc'] = $this->BCC;
        };
        curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
        $result = curl_exec($ch);

        $this->isSent = $result ? true : false;
        $this->sentMIMEMessage = "CURL paramenters:\n" . var_export($fields,true) . "\n" . var_export($result,true);
        if( !$this->isSent ){
            $this->sendError = curl_error($ch);
        }
        curl_close($ch);

        return $this->isSent;
    }


    private function saveLogs(){
        $line = str_repeat('--------', 8);
        $this->addLog( "\n\n" . $line );
        $this->addLog( date("Y-m-d H:i:s") );
        $this->addLog( "Email Sent: " . ( $this->isSent ? 'OK' : 'Failed (' . $this->sendError . ')' ) );
        $this->addLog($this->sentMIMEMessage);
        $this->addLog( $line . "\n\n" );

        $logFile = Form::getEmailLogFile();
        Form::secureFile( $logFile );
        file_put_contents($logFile, join("\n", $this->logs), FILE_APPEND);
        $this->logs = array(); // clear
    }

    private function addLog($msg){
        $this->logs[] = is_string($msg) ? $msg : var_export($msg,true);
    }


} // end of class Mailer
// --------------------------------------------------------------