form subscription only using Router now

assets/js/src/public.js

@@ -22,7 +22,7 @@ function(
 
         form.parsley().on('form:validated', function(parsley) {
           // clear messages
-          form.find('.mailpoet_message').html('');
+          //form.find('.mailpoet_message').hide();
 
           // resize iframe
           if(window.frameElement !== null) {
@@ -59,13 +59,9 @@ function(
                 if(response.page !== undefined) {
                   // go to page
                   window.location.href = response.page;
-                } else if(response.message !== undefined) {
+                } else {
                   // display success message
-                  form
+                  form.find('.mailpoet_validate_success').show();
-                    .find('.mailpoet_message')
-                    .html('<p class="mailpoet_validate_success">'+
-                      response.message+
-                    '</p>');
                 }
 
                 // reset form

lib/Config/Hooks.php

@@ -9,14 +9,13 @@ class Hooks {
   }
 
   function init() {
-    $this->setupSubscribe();
     $this->setupWPUsers();
     $this->setupImageSize();
     $this->setupListing();
-    $this->setupManageSubscription();
+    $this->setupSubscriptionEvents();
   }
 
-  function setupSubscribe() {
+  function setupSubscriptionEvents() {
     $subscribe = Setting::getValue('subscribe', array());
     // Subscribe in comments
     if(
@@ -98,7 +97,7 @@ class Hooks {
     add_action(
       'profile_update',
       '\MailPoet\Segments\WP::synchronizeUser',
-      1,2
+      1, 2
     );
     add_action(
       'delete_user',
@@ -140,18 +139,6 @@ class Hooks {
     );
   }
 
-  function setupManageSubscription() {
-    // handle subscription form submission
-    add_action(
-      'admin_post_mailpoet_subscription_update',
-      '\MailPoet\Subscription\Manage::onSave'
-    );
-    add_action(
-      'admin_post_nopriv_mailpoet_subscription_update',
-      '\MailPoet\Subscription\Manage::onSave'
-    );
-  }
-
   function setScreenOption($status, $option, $value) {
     if(preg_match('/^mailpoet_(.*)_per_page$/', $option)) {
       return $value;

lib/Form/Widget.php

@@ -7,33 +7,12 @@ use \MailPoet\Models\Setting;
 use \MailPoet\Models\Subscriber;
 use \MailPoet\Form\Renderer as FormRenderer;
 use \MailPoet\Form\Util;
+use \MailPoet\Util\Security;
 
 if(!defined('ABSPATH')) exit;
 
 class Widget extends \WP_Widget {
   function __construct () {
-    // add_action(
-    //   'wp_ajax_mailpoet_form_subscribe',
-    //   array($this, 'subscribe')
-    // );
-    // add_action(
-    //   'wp_ajax_nopriv_mailpoet_form_subscribe',
-    //   array($this, 'subscribe')
-    // );
-    // add_action(
-    //   'admin_post_nopriv_mailpoet_form_subscribe',
-    //   array($this, 'subscribe')
-    // );
-    // add_action(
-    //   'admin_post_mailpoet_form_subscribe',
-    //   array($this, 'subscribe')
-    // );
-
-    // add_action(
-    //   'init',
-    //   array($this, 'subscribe')
-    // );
-
     return parent::__construct(
       'mailpoet_form',
       __('MailPoet Form'),
@@ -169,21 +148,15 @@ class Widget extends \WP_Widget {
           'after_title' => (!empty($after_title) ? $after_title : '')
         );
 
-        // if(isset($_GET['mailpoet_form']) && (int)$_GET['mailpoet_form'] === $form['id']) {
+        // check if the form was submitted
-        //   // form messages (success / error)
+        $data['is_submitted'] = (
-        //   $output .= '<div class="mailpoet_message">';
+          (isset($_GET['mailpoet_form']))
-        //   // success message
+          &&
-        //   if(isset($_GET['mailpoet_success'])) {
+          ((int)$_GET['mailpoet_form'] === (int)$form['id'])
-        //     $output .= '<p class="mailpoet_validate_success">'.strip_tags(urldecode($_GET['mailpoet_success']), '<a><strong><em><br><p>').'</p>';
+        );
-        //   }
+
-        //   // error message
+        // generate security token
-        //   if(isset($_GET['mailpoet_error'])) {
+        $data['token'] = Security::generateToken();
-        //     $output .= '<p class="mailpoet_validate_error">'.strip_tags(urldecode($_GET['mailpoet_error']), '<a><strong><em><br><p>').'</p>';
-        //   }
-        //   $output .= '</div>';
-        // } else {
-        //   $output .= '<div class="mailpoet_message"></div>';
-        // }
 
         // render form
         $renderer = new Renderer();

lib/Router/Router.php

@@ -9,18 +9,28 @@ class Router {
   }
 
   function init() {
+    // security token
     add_action(
       'admin_head',
       array($this, 'setToken')
     );
+
+    // Admin API (Ajax only)
     add_action(
       'wp_ajax_mailpoet',
       array($this, 'setupAdmin')
     );
+
+    // Public API (Ajax)
     add_action(
       'wp_ajax_nopriv_mailpoet',
       array($this, 'setupPublic')
     );
+    // Public API (Post)
+    add_action(
+      'admin_post_nopriv_mailpoet',
+      array($this, 'setupPublic')
+    );
   }
 
   function setupAdmin() {
@@ -38,7 +48,23 @@ class Router {
     $class = ucfirst($_POST['endpoint']);
     $endpoint =  __NAMESPACE__ . "\\" . $class;
     $method = $_POST['method'];
-    $data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : array();
+
+    $doing_ajax = (bool)(defined('DOING_AJAX') && DOING_AJAX);
+
+    if($doing_ajax) {
+      $data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : array();
+    } else {
+      $data = $_POST;
+    }
+
+    // filter out reserved keywords from data
+    $reserved_keywords = array(
+      'token',
+      'endpoint',
+      'method',
+      'mailpoet_redirect'
+    );
+    $data = array_diff_key($data, array_flip($reserved_keywords));
 
     try {
       $endpoint = new $endpoint();
@@ -62,6 +88,12 @@ class Router {
   }
 
   function verifyToken() {
-    if(!wp_verify_nonce($_POST['token'], 'mailpoet_token')) { die(); }
+    if(
+      empty($_POST['token'])
+      ||
+      !wp_verify_nonce($_POST['token'], 'mailpoet_token')
+    ) {
+      die();
+    }
   }
 }

lib/Router/Subscribers.php

@@ -8,6 +8,7 @@ use MailPoet\Models\SubscriberCustomField;
 use MailPoet\Models\Segment;
 use MailPoet\Models\Setting;
 use MailPoet\Models\Form;
+use MailPoet\Util\Url;
 
 if(!defined('ABSPATH')) exit;
 
@@ -88,41 +89,17 @@ class Subscribers {
     }
 
     $subscriber = Subscriber::subscribe($data, $segment_ids);
-    if($subscriber->getErrors() !== false) {
+    $errors = $subscriber->getErrors();
-      return array(
+    $result = ($errors === false && $subscriber->id() > 0);
-        'result' => false,
-        'errors' => $subscriber->getErrors()
-      );
-    }
 
     // get success message to display after subscription
     $form_settings = (
       isset($form->settings)
-      ? unserialize($form->settings) : null
+      ? unserialize($form->settings)
+      : null
     );
 
     if($form_settings !== null) {
-      $message = $form_settings['success_message'];
-
-      // url params for non ajax requests
-      if($doing_ajax === false) {
-        // get referer
-        $referer = (wp_get_referer() !== false)
-          ? wp_get_referer() : $_SERVER['HTTP_REFERER'];
-
-        // redirection parameters
-        $params = array(
-          'mailpoet_form' => $form->id()
-        );
-
-        // handle success/error messages
-        if($result === false) {
-          $params['mailpoet_error'] = urlencode($message);
-        } else {
-          $params['mailpoet_success'] = urlencode($message);
-        }
-      }
-
       switch($form_settings['on_success']) {
         case 'page':
           // response depending on context
@@ -130,11 +107,15 @@ class Subscribers {
             return array(
               'result' => $result,
               'page' => get_permalink($form_settings['success_page']),
-              'message' => $message
+              'errors' => $errors
             );
           } else {
-            $redirect_to = ($result === false) ? $referer : get_permalink($form_settings['success_page']);
+            // handle success/error messages
-            wp_redirect(add_query_arg($params, $redirect_to));
+            if($result === false) {
+              Url::redirectBack();
+            } else {
+              Url::redirectTo(get_permalink($form_settings['success_page']));
+            }
           }
         break;
 
@@ -144,11 +125,10 @@ class Subscribers {
           if($doing_ajax === true) {
             return array(
               'result' => true,
-              'message' => $message
+              'errors' => $errors
             );
           } else {
-            // redirect to previous page
+            Url::redirectBack();
-            wp_redirect(add_query_arg($params, $referer));
           }
         break;
       }

lib/Subscription/Manage.php

@@ -1,8 +1,6 @@
 <?php
 namespace MailPoet\Subscription;
-use \MailPoet\Models\Setting;
 use \MailPoet\Models\Subscriber;
-use \MailPoet\Models\SubscriberSegment;
 use \MailPoet\Util\Url;
 
 class Manage {

lib/Util/Url.php

@@ -14,28 +14,24 @@ class Url {
     exit();
   }
 
-  static function redirectBack() {
+  static function redirectBack($params = array()) {
     // check mailpoet_redirect parameter
     $referer = (isset($_POST['mailpoet_redirect'])
       ? $_POST['mailpoet_redirect']
-      : null
+      : wp_get_referer()
     );
 
-    // fallback: http referer
-    if($referer === null) {
-      if(!empty($_SERVER['HTTP_REFERER'])) {
-        $referer = $_SERVER['HTTP_REFERER'];
-      }
-    }
-
     // fallback: home_url
-    if($referer === null) {
+    if(!$referer) {
       $referer = home_url();
     }
 
-    if($referer !== null) {
+    // append extra params to url
-      self::redirectTo($referer);
+    if(!empty($params)) {
+      $referer = add_query_arg($params, $referer);
     }
+
+    self::redirectTo($referer);
     exit();
   }
 

views/form/widget.html

@@ -9,13 +9,14 @@
     <%= styles | raw %>
     <form
       method="post"
-      <#
+      action="<%= admin_url('admin-post.php?action=mailpoet') | raw %>"
-      action="<%= admin_url('admin-post.php?action=mailpoet_form_subscribe') | raw %>"
-      #>
       class="mailpoet_form mailpoet_form_<%= form_type %>"
       novalidate
     >
       <input type="hidden" name="form_id" value="<%= form.id %>" />
+      <input type="hidden" name="token" value="<%= token %>" />
+      <input type="hidden" name="endpoint" value="subscribers" />
+      <input type="hidden" name="method" value="subscribe" />
 
       <% if not(form.settings.segments_selected_by == 'user') %>
         <% for segment in form.settings.segments %>
@@ -23,8 +24,15 @@
         <% endfor %>
       <% endif %>
       <%= html | raw %>
+      <div
+        class="mailpoet_message"
+      >
 
-      <div class="mailpoet_message"></div>
+          <p class="mailpoet_validate_success" style="display:none;">
+            <%= form.settings.success_message %>
+          </p>
+
+      </div>
     </form>
   </div>
   <%= after_widget | raw %>