edit profile rendering (missing segments list) + fallback for Url::redirectBack()

lib/Form/Block/Checkbox.php

@@ -35,7 +35,7 @@ class Checkbox extends Base {
 
       $html .= $field_validation;
 
-      $html .= ' /> '.$option['value'];
+      $html .= ' /> '.esc_attr($option['value']);
 
       $html .= '</label>';
     }

lib/Form/Block/Radio.php

@@ -35,7 +35,7 @@ class Radio extends Base {
 
       $html .= $field_validation;
 
-      $html .= ' /> '.esc_attr($option['value']);
+      $html .= ' /> '.esc_attr($option['value']);
 
       $html .= '</label>';
     }

lib/Form/Block/Segment.php

@@ -28,7 +28,7 @@ class Segment extends Base {
       $html .= 'name="'.$field_name.'[]" ';
       $html .= 'value="'.$option['id'].'" '.$is_checked.' ';
       $html .= $field_validation;
-      $html .= ' /> '.$option['name'];
+      $html .= ' /> '.esc_attr($option['name']);
       $html .= '</label>';
     }
 

lib/Form/Block/Select.php

@@ -34,7 +34,7 @@ class Select extends Base {
       }
 
       $html .= '<option value="'.$value.'" '.$is_selected.'>';
-      $html .= $label;
+      $html .= esc_attr($label);
       $html .= '</option>';
     }
     $html .= '</select>';

lib/Subscription/Pages.php

@@ -10,6 +10,8 @@ use \MailPoet\Util\Helpers;
 use \MailPoet\Util\Url;
 
 class Pages {
+  const DEMO_EMAIL = 'demo@mailpoet.com';
+
   function __construct() {
   }
 
@@ -37,7 +39,7 @@ class Pages {
     $subscriber = Subscriber::createOrUpdate($subscriber_data);
     $errors = $subscriber->getErrors();
 
-    // TODO: success/error messages
+    // TBD: success/error messages (not present in MP2)
 
     Url::redirectBack();
   }
@@ -127,7 +129,7 @@ class Pages {
     if($this->isPreview()) {
       return sprintf(
         __('Edit your subscriber profile: %s'),
-        'demo@mailpoet.com'
+        self::DEMO_EMAIL
       );
     } else if($subscriber !== false) {
       return sprintf(
@@ -154,7 +156,7 @@ class Pages {
     if($this->isPreview()) {
       $subscriber = Subscriber::create();
       $subscriber->hydrate(array(
-        'email' => 'demo@mailpoet.com'
+        'email' => self::DEMO_EMAIL
       ));
     } else if($subscriber !== false) {
       $subscriber = $subscriber
@@ -180,7 +182,6 @@ class Pages {
       $segments = Segment::getPublic()
         ->findMany();
     }
-
     $subscribed_segment_ids = array();
     if(!empty($subscriber->subscriptions)) {
       foreach ($subscriber->subscriptions as $subscription) {
@@ -263,20 +264,31 @@ class Pages {
       $fields,
       $custom_fields,
       array(
+        array(
+          'id' => 'segments',
+          'type' => 'segment',
+          'params' => array(
+            'label' => __('Your lists'),
+            'values' => $segments
+          )
+        ),
         array(
           'id' => 'submit',
           'type' => 'submit',
           'params' => array(
-            'label' => __('Subscribe!')
+            'label' => __('Save')
           )
         )
       )
     );
 
-    $form_html = '<form method="POST" action="'.admin_url('admin-post.php').'" novalidate>';
+    $form_html = '<form method="POST" '.
+      'action="'.admin_url('admin-post.php').'" '.
+      'novalidate>';
     $form_html .= '<input type="hidden" name="action" value="update" />';
-    $form_html .= '<input type="hidden" name="mailpoet_redirect" value="'.Url::getCurrentUrl().'" />';
+    $form_html .= '<input type="hidden" name="segments" value="" />';
-
+    $form_html .= '<input type="hidden" name="mailpoet_redirect" '.
+      'value="'.Url::getCurrentUrl().'" />';
     $form_html .= \MailPoet\Form\Renderer::renderBlocks($form);
     $form_html .= '</form>';
     return $form_html;

lib/Util/Url.php

@@ -21,17 +21,24 @@ class Url {
   }
 
   static function redirectBack() {
-    $referer = (isset($_REQUEST['mailpoet_redirect'])
+    // check mailpoet_redirect parameter
-      ? $_REQUEST['mailpoet_redirect']
+    $referer = (isset($_POST['mailpoet_redirect'])
+      ? $_POST['mailpoet_redirect']
       : null
     );
+
+    // fallback: http referer
     if($referer === null) {
-      // try to get the server's referer
       if(!empty($_SERVER['HTTP_REFERER'])) {
         $referer = $_SERVER['HTTP_REFERER'];
       }
     }
 
+    // fallback: home_url
+    if($referer === null) {
+      $referer = home_url();
+    }
+
     if($referer !== null) {
       self::redirectTo($referer);
     }