How to create a setting form In taps page

In December 2022 I made a publication proposal for wordpress plugin on wordpress.org. I recently needed an on-screen numeric keypad. The only plugin I could find was “on-screen-kyeboard”. I thought it would be helpful to the community to revive this plugin and add a pure numeric keypad, especially for password-protected pages. That’s how I did it.
The source can be downloaded at:

https://github.com/kresimir71/on-screen-keyboard

However, for submitting the plugin to wordpress dot org the following requirements are proposed during inspection:

Data Must be Sanitized, Escaped, and Validated

When you include POST/GET/REQUEST/FILE calls in your plugin, it's important to sanitize, validate, and escape them. The goal here is to prevent a user from accidentally sending trash data through the system, as well as protecting them from potential security issues.

SANITIZE: Data that is input (either by a user or automatically) must be sanitized as soon as possible. This lessens the possibility of XSS vulnerabilities and MITM attacks where posted data is subverted.

VALIDATE: All data should be validated, no matter what. Even when you sanitize, remember that you don’t want someone putting in ‘dog’ when the only valid values are numbers.

ESCAPE: Data that is output must be escaped properly when it is echo'd, so it can't hijack admin screens. There are many esc_*() functions you can use to make sure you don't show people the wrong data.

To help you with this, WordPress comes with a number of sanitization and escaping functions. You can read about those here:
• https://developer.wordpress.org/apis/security/sanitizing/
• https://developer.wordpress.org/apis/security/escaping/

Remember: You must use the most appropriate functions for the context. If you’re sanitizing email, use sanitize_email(), if you’re outputting HTML, use wp_kses_post(), and so on.

An easy mantra here is this:

Sanitize early
Escape Late
Always Validate

Clean everything, check everything, escape everything, and never trust the users to always have input sane data. After all, users come from all walks of life.

Example(s) from your plugin:

on-screen-keyboard-master/library/apf/factory/_common/utility/base_utility/AdminPageFramework_Utility_URL.php:27: $_sHost = isset($_SERVER[ 'HTTP_X_FORWARDED_HOST' ]) ? $_SERVER[ 'HTTP_X_FORWARDED_HOST' ] : (isset($_SERVER[ 'HTTP_HOST' ]) ? $_SERVER[ 'HTTP_HOST' ] : $_SERVER[ 'SERVER_NAME' ]);
on-screen-keyboard-master/library/apf/factory/_common/utility/base_utility/AdminPageFramework_Utility_URL.php:29: return $_sProtocol . '://' . $_sHost . $_sPort . $_SERVER[ 'REQUEST_URI' ];
on-screen-keyboard-master/library/apf/factory/_common/utility/base_utility/AdminPageFramework_Utility_URL.php:33: $_sPort = isset($_SERVER[ 'SERVER_PORT' ]) ? ( string ) $_SERVER[ 'SERVER_PORT' ] : '';
on-screen-keyboard-master/library/apf/factory/_common/utility/base_utility/AdminPageFramework_Utility_URL.php:40: return array_key_exists('HTTPS', $_SERVER) && 'on' === $_SERVER[ 'HTTPS' ];
on-screen-keyboard-master/library/apf/factory/_common/utility/wp_utility/AdminPageFramework_WPUtility_URL.php:24: $sPageURL .= $_SERVER[ "SERVER_NAME" ] . ":" . $_SERVER[ "SERVER_PORT" ] . $sRequestURI;
on-screen-keyboard-master/library/apf/factory/_common/utility/wp_utility/AdminPageFramework_WPUtility_URL.php:26: $sPageURL .= $_SERVER[ "SERVER_NAME" ] . $sRequestURI;

Variables and options must be escaped when echo'd

Much related to sanitizing everything, all variables that are echoed need to be escaped when they're echoed, so it can't hijack users or (worse) admin screens. There are many esc_*() functions you can use to make sure you don't show people the wrong data, as well as some that will allow you to echo HTML safely.

At this time, we ask you escape all $-variables, options, and any sort of generated data when it is being echoed. That means you should not be escaping when you build a variable, but when you output it at the end. We call this 'escaping late.'

Besides protecting yourself from a possible XSS vulnerability, escaping late makes sure that you're keeping the future you safe. While today your code may be only outputted hardcoded content, that may not be true in the future. By taking the time to properly escape when you echo, you prevent a mistake in the future from becoming a critical security issue.

This remains true of options you've saved to the database. Even if you've properly sanitized when you saved, the tools for sanitizing and escaping aren't interchangeable. Sanitizing makes sure it's safe for processing and storing in the database. Escaping makes it safe to output.

Also keep in mind that sometimes a function is echoing when it should really be returning content instead. This is a common mistake when it comes to returning JSON encoded content. Very rarely is that actually something you should be echoing at all. Echoing is because it needs to be on the screen, read by a human. Returning (which is what you would do with an API) can be json encoded, though remember to sanitize when you save to that json object!

There are a number of options to secure all types of content (html, email, etc). Yes, even HTML needs to be properly escaped.
• https://developer.wordpress.org/apis/security/escaping/

Remember: You must use the most appropriate functions for the context. There is pretty much an option for everything you could echo. Even echoing HTML safely.

Example(s) from your plugin:

on-screen-keyboard-master/library/apf/factory/widget/AdminPageFramework_Widget_Factory.php:19: echo $aArguments[ 'before_widget' ];
on-screen-keyboard-master/library/apf/factory/widget/AdminPageFramework_Widget_Factory.php:23: echo $_sContent;
on-screen-keyboard-master/library/apf/factory/widget/AdminPageFramework_Widget_Factory.php:24: echo $aArguments[ 'after_widget' ];
on-screen-keyboard-master/library/apf/factory/admin_page/_view/AdminPageFramework_View__PageMetaboxEnabler.php:72: echo '';

Any experiance with this?

in user_meta profile when save data store on databae but not show value in input on admin dashboard.
this problem after update wordpress

Hi there,

I don’t quite understand the way of licensing of the Field Type Pack. Does the number of pages refer to the plugin installations of the Field Type Pack (development) or does it mean the number of pages where the developed end product is used?

Hi,

is this library PHP 8.1 ready (using in end-product)? When I switch the PHP version, several error messages will be displayed. See below:

Deprecated: trim(): Passing null to parameter #1 ($string) of type string is deprecated in /wp-content/plugins/co-ctconnect/library/admin-page-framework/factory/post_type/AdminPageFramework_PostType.php on line 24

Deprecated: trim(): Passing null to parameter #1 ($string) of type string is deprecated in /wp-content/plugins/co-ctconnect/library/admin-page-framework/factory/post_type/AdminPageFramework_PostType.php on line 24

Deprecated: trim(): Passing null to parameter #1 ($string) of type string is deprecated in /wp-content/plugins/co-ctconnect/library/admin-page-framework/factory/post_type/AdminPageFramework_PostType.php on line 24

Hello,

I managed to have a working Admin Page with a checkbox (result is correcty stored in database) but I can’t figure how to execute some piece of code only if is checked… Found nothing related to checkbox in tutorials.

Tried this with no succes:

 if (AdminPageFramework::getOption( 'MyPluginName', 'my_checkbox_2', '1' )) {
    remove_action( 'wp_head', 'feed_links', 2 );
    remove_action( 'wp_head', 'feed_links_extra', 3 );
  } else {}

In fact, the code is always executed. Not only when the option is checked…

Somebody has an idea?

Here is a gist with my full plugin code
https://gist.github.com/bugsysop/5b81d62ae49415df4e9c3cc657964118

• This topic was modified 3 years, 6 months ago by Aris.

Hi, hope someone can advise. Have created an Admin plugin. Installs and Activates 100% ok on my local dev. When I upload the .zip plugin to my live test site it will not Activate. Yes, I have the APF framework installed. What I get is:

Fatal error: Unparenthesized a ? b : c ? d : e is not supported. Use either (a ? b : c) ? d : e or a ? b : (c ? d : e) in /home/edwardc/web/plugindev.hostwest.net/public_html/wp-content/plugins/hestia-plugin/library/admin-page-framework/factory/AdminPageFramework_Factory/utility/AdminPageFramework_Utility/AdminPageFramework_Utility_URL.php on line 15

Any ideas please?
Edward

Hi. Apologies if this is a dumb question. I’m new. So, I will be using the amazing APF Plugin and I have code that needs to be called upon Form Submit which uses Fields from the Form in the process.

So in my Form i will call below and insert Form Fields i.e. $username, $password into the API call.

Can someone please show me how this might look in my Form?
Thank you kindly,
Edward

<?php

// Server credentials
$hst_hostname = 'server.hestiacp.com';
$hst_port = '8083';
$hst_username = '<redacted>';
$hst_password = '<redacted>';
$hst_returncode = 'yes';
$hst_command = 'v-add-user';

// New Account
$username = 'demo';
$password = '<redacted>';
$email = '<redacted>';
$package = 'default';
$first_name = 'First';
$last_name = 'Last';

// Prepare POST query
$postvars = array(
    'user' => $hst_username,
    'password' => $hst_password,
    'returncode' => $hst_returncode,
    'cmd' => $hst_command,
    'arg1' => $username,
    'arg2' => $password,
    'arg3' => $email,
    'arg4' => $package,
    'arg5' => $first_name,
    'arg6' => $last_name
);

// Send POST query via cURL
$postdata = http_build_query($postvars);
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, 'https://' . $hst_hostname . ':' . $hst_port . '/api/');
curl_setopt($curl, CURLOPT_RETURNTRANSFER,true);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $postdata);
$answer = curl_exec($curl);

// Check result
if($answer === 0) {
    echo "User account has been successfuly created\n";
} else {
    echo "Query returned error code: " .$answer. "\n";
}

• This topic was modified 3 years, 9 months ago by Yui. Reason: unnecessary possibly sensitive data redacted

hi,

I’m working on a multisite installation.
I’d like to retrieve saved options of a specific blog from another blog.
There is a function getSiteOption() but I can’t figure how to send the blog ID as parameter.

Could you help me?

Thanks

Thank you for creating such a good frame, but can fix the framework in the mobile side? (There are very few parts that are not good in the mobile side)

While trying to internationalize a plugin developed with APF, I found quite a few __('text %1$s replacement', domain)strings without preceding/* translators: 1: whatever */ comments.

wp i18n make-pot complains, rightly, about those.

It would be convenient if those comments were there, explaining to translators the purpose of the numbered sprintf parameters.

I’m new to using the AdminPageFramework but am thoroughly enjoying it so far. I’m kinda stumped. I’m trying to create a Settings page that has tabs and inside one of the tabs are collapsible sections. Inside each of those collapsible sections, I want a set of sortable collapsible sections (subsections) that contain fields that are unique for each of the subsections. The structure would look something like:

Settings
   +-->General (Tab)
   |   +-->Sections & fields
   +-->Forms (Tab)
   |   +-->Form 1 (Collapsible Section)
   |   |   +-->Field 1 (Sortable Collapsible Section)
   |   |   |   +-->Field 1 Attribute 1 (checkbox)
   |   |   |   +-->Field 1 Attribute 2 (text)
   |   |   |   +-->more fields
   |   |   +-->Field 2 (Sortable Collapsible Section)
   |   |   |   +-->Field 2 Attribute 1 (radio)
   |   |   |   +-->Field 2 Attribute 2 (checkbox)
   |   |   |   +-->Field 2 Attribute 3 (text)
   |   |   |   +-->more field
   |   |   +-->Field 3 (Sortable Collapsible Section)
   |   |   |   +-->more fields
   +-->Notifications (Tab)
   ...

The Forms tab is the one of interest. Hopefully you get the idea. Can this be done with AdminPageFramework? How would I go about making it happen?

Thanks in advance so much.

Hi there,

I’ve been using this framework for a few weeks, but I have reached a speed bump.

I want to be able to run certain code that creates a csv file when the user clicks submit. I’ve tried using the submit and validation hooks but it doesn’t seem to work.

I hope to use the same option value in multiple tabs. That is, I want to populate the value in each tab from the saved option, and I want to update the option value when my user pushes the submit button in the form.

Is there a good way to do that?

hello
how Use AdminPageFramework_MetaBox in custom class and namespace?
when
extends AdminPageFramework_MetaBox;
and
use AdminPageFramework_MetaBox;

this error showing:
Uncaught ArgumentCountError: Too few arguments to function AdminPageFramework_MetaBox::__construct()

My admin page’s ‘submit’ buttons have hovering tooltips containing the same text as the item’s ‘value’.

Is it possible to use the tip attribute to put something else, perhaps more useful, in those tooltips? Or is there some other attribute I haven’t yet found for that purpose?

I’m hoping to create a few inPageTabs from a list, in which the tag slugs come from variables.

Is there a good way, from within a content_pageslug() {} method, to figure out the name of the current tab so I can render the correct content?

(I’d have to use eval() to declare a content_pageslug_tabslug() function, but I obvs don’t want to do that.)

Or is this a misbegotten idea I should abandon?

Thanks for a great framework!

• This topic was modified 4 years, 6 months ago by OllieJones.

I have a particular Menu page structure where the Settings is set to be a submenu off an existing menu.

The main Admin Page menu loads fine with the initial page having in-page tabs.
However, I am unable to navigate to the tabs since the tab URL for some reason appends “post_type=post” to the page URL, which causes the WordPress admin to fail with “Cannot load page”.

Is there a way to disable the addition of the post_type=post to the automatically generated URL to navigate to the proper in-page tab? I find that when I remove the extra &post_type=post from the URL, the tab loads fine.

Is there something in how I setup the menu and submenu structure?

I’m finishing up a new plugin that almost never needs access to its options (from wp_options).

Is there a way I can avoid autoloading the options from that table? Can I create the options object with some sort of “autoload” => false parameter.

I’m a bit compulsive about avoiding pointless extra work for webservers and their databases.

How can I use the array() passed to addSettingsField to give one or more of my own css classes to HTML elements in the field, to allow styling my admin pages?

Or if there’s another way, that would be helpful.

Great great stuff, but you already know that. Thanks.

Hi, when I use “capability” => “activate_plugins” (for example) it hides the field, but not the heading. As a result you end up with this weird menu filled with orphaned titles.

I can’t imagine this is the intended use. Can anyone tell me the correct way to hide fields for different user levels?

Thanks
Lachlan

How can i translate it?
https://translate.wordpress.org/projects/wp-plugins/admin-page-framework/

Is says: “This plugin is not properly prepared for localization (View detailed logs on Slack). If you would like to translate this plugin, please contact the author.” 🙁

Any Hint?

• This topic was modified 5 years, 1 month ago by Reinhard Jung.

In one of the examples (https://wordpress.org/support/topic/representing-custom-post-types-under-tabs-in-settings-menu/) given in this forum for tabbing CPTs it refers to new AdminPageFramework_TabNavigationBar but I can’t find any documentation for it.
Suggestions?

It works great by the way, just trying to fully understand your example. Ta

Trying out your framework. Using your tutorial examples for both page groups/tabs and custom post types (cpts), how would I show the admin list page/table for cptA on the first_page submenuitem (Tab1), and also the admin list page for cptB on second_page submenu item (Tab2)

I have the CPTS create, and the page groups from your tutorial. Both work fine. But now trying to combine them.

I am cofortable with php, but never really used classes alot.
Thanks – this framework does make alot so much easier.

I have a scheduling post plugin for WordPress. It works pretty well. but today I see an error on Query Monitoring plugin.

ScheduleMenu->load_pre_schedule_queue()
Error: Method ScheduleMenu::load_pre_schedule_queue() does not exist

I do not know why WordPress could not find the method! but everything works fine!

admin-menu.php:

require_once SCHEDULE_PLUGIN_DIR . 'libs/admin-page-framework/admin-page-framework.php';
require_once SCHEDULE_PLUGIN_DIR . 'admin/settings.php';
require_once SCHEDULE_PLUGIN_DIR . 'admin/queue.php';
class ScheduleMenu extends LazyCoala_AdminPageFramework
{
    public function setUp() {
        $this->setRootMenuPage('Post Timing');
        $this->addSubMenuItems(
            array(
                'title'     => 'Setup Time',
                'page_slug' => 'schedule_settings',
            ),
            array(
                'title'     => 'Queue',
                'page_slug' => 'schedule_queue',
            )
        );
    }
    
}
new ScheduleMenu();

index.php:

define("SCHEDULE_PLUGIN_DIR", trailingslashit(dirname(__FILE__)));
define("SCHEDULE_PLUGIN_URL", trailingslashit(plugin_dir_url(__FILE__)));
require_once SCHEDULE_PLUGIN_DIR . "functions.php";
require_once SCHEDULE_PLUGIN_DIR . "admin/admin-menu.php";

Hi there,

For safari users: When I want to click on an collapsible section, it jumps away. No chance to edit the fields.

See screen capture at: https://www.dropbox.com/s/hvy3druyqesmqog/2020-11-16_09-05-30.mp4?dl=0

How can this be fixed?

Thanks & kind regards,
Simon

Hello
I’m using ‘Admin Page Framework’ to administrate my theme, till now all is fine, but I’m straggling with the little documentation … and can’t list posts/pages from some reason (with select2) … what am I missing ?

This code is taken from the demo, but is not working for me:

<?php

        $this->addSettingFields(
array(
    'type'          => 'select2',
    'field_id'        => 'pstSwiper_cat',
    'options'         => array(
        'minimumInputLength' => 2,
        'width' => '60%',
    ),
    'callback'        => array(
        'search'    => __CLASS__ . '::getPosts',
    ),
),

            array(
                'field_id'      => 'pstSwiper_postno',
                'title'         => __( 'No. of post to show', 'bitRT' ),
                'type'          => 'no_ui_slider',
                'default'       => 4,
                'options'       => array(
                    'range' => array(
                        'min'   => 2,
                        'max'   => 10,
                    ),
                    'step'  => 1,
                ),
            ),

            array( // Submit button
                'field_id'      => 'submit_button',
                'type'          => 'submit',
                'value'         => __( 'Submit', 'bitRT' ),
            )

        );

function getPosts( $aQueries, $aFieldset ) {

    $_aArgs         = array(
        'post_type'         => 'post',
        'paged'             => $aQueries[ 'page' ],
        's'                 => $aQueries[ 'q' ],
        'posts_per_page'    => 30,
        'nopaging'          => false,
    );
    $_oResults      = new WP_Query( $_aArgs );
    $_aPostTitles   = array();
    foreach( $_oResults->posts as $_iIndex => $_oPost ) {
        $_aPostTitles[] = array(    // must be numeric
            'id'    => $_oPost->ID,
            'text'  => $_oPost->post_title,
        );
    }
    return array(
        'results'       => $_aPostTitles,
        'pagination'    => array(
            'more'  => intval( $_oResults->max_num_pages ) !== intval( $_oResults->get( 'paged' ) ),
        ),
    );

}
    new bitRT_Select2CustomFieldType( 'bitRT' );
 ?>

• This topic was modified 5 years, 6 months ago by Tzvook.
• This topic was modified 5 years, 6 months ago by Tzvook.

Hello, I just installed admin page frame and I would like to know if you can create a submenu within a group of pages on different pages for example:

$ this-> addSubMenuItems (
training(
'title' => 'First page', // page title
'page_slug' => 'my_first_page', // page slug
'screen_icon' => 'https://lh5.googleusercontent.com/-vr0hu0pHcYo/UilDa_OwGYI/AAAAAAAABRg/29eid1MIBW0/s800/demo03_01_32x32.png',
'style' => array (
AdminPageFrameworkLoader_Registry :: $ sDirPath. '/css/code.css',
) // page screen icon for WP 3.7.x or lower
),
training(
'title' => 'Second page', // page title
'page_slug' => 'my_second_page', // page slug
'screen_icon' => 'https://lh5.googleusercontent.com/-vr0hu0pHcYo/UilDa_OwGYI/AAAAAAAABRg/29eid1MIBW0/s800/demo03_01_32x32.png' // page screen icon for WP 3.7.x or lower
), 

That the first page of the submenu is on a different page, to better organize the submenus.

I saw this example, but I don’t know how to do it for a group of pages
Example
and the other question is if you can add css file to the file

I hope you can help me, thanks in advance

• This topic was modified 5 years, 11 months ago by luis9430.

Hello again

I’d like to create my own custom settings pages for various plugins and core settings. Unfortunately this isn’t so easy with ACF, as you can’t map form fields directly to existing wp_options values. Is this possible with your framework?

Also, would it be possible for you to add the following tab style to the framework? https://i.imgur.com/QoaD4la.png

Thanks!

I need to set some options manually… I really got a hard time figuring out how to do it. A form is submitted with some options, and i need to set an option manually, after submit. I think i have tried all hooks now, could someone plz point me in the correct way, i would be forever grateful 🙂