From 2b6981905e3fcd0a00ad722fa08ad465174de0e8 Mon Sep 17 00:00:00 2001
From: Francis Whittle <francis@agileware.com.au>
Date: Fri, 8 Nov 2024 10:20:15 +1100
Subject: [PATCH] WPCIVIUX-176 Clarify logging and documentation for API Field
 name validator

---
 .../utils/class-civicrm-ux-validators.php     | 28 +++++++++++++------
 rest/json-all-events.php                      |  4 +--
 shortcodes/event/event-fullcalendar.php       |  4 +--
 3 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/includes/utils/class-civicrm-ux-validators.php b/includes/utils/class-civicrm-ux-validators.php
index 47589a7..26ebfa6 100644
--- a/includes/utils/class-civicrm-ux-validators.php
+++ b/includes/utils/class-civicrm-ux-validators.php
@@ -44,15 +44,25 @@ public static function validateCssColor($color): ?string
         return $valid ? $matches[1] : null;
     }
 
-    public static function validateAPIFieldName($field, $key = null): ?string
-    {
-        $valid = preg_match('{ ^ (?! [.-] ) [[:alnum:]._:-]+ (?<! [._-]) $ }xi', $field, $matches);
+	public static function validateAPIFieldName($field, $key = null): ?string
+	{
+		/** API Field names:
+		 *   - must contain only alphanumeric characters, dash (-), underscore(_), dot(.) or colon (:)
+		 *   - may not start or end with a dot dash or colon
+		 */
+		$valid = preg_match('{  
+		                        ^ (?! [.:-] )    # Exclude disallowed prefix 
+		                        [[:alnum:]._:-]+ # Sequence of valid characters
+		                        (?<! [.:-]) $    # Exclude disallowed suffix
+		                         }xi', $field, $matches);
 
-        if (!$valid) {
-			error_log( $key ? __('Invalid field key given') : sprintf(__('Invalid key given for "%1$s"' )));
+		if ( ! $valid ) {
+			error_log( sprintf( 
+				( ! $key ) ? __( '%1$s: Invalid field key given' ) : __( '%1$s: Invalid key given for "%2$s"' ),
+				'ux_event_fullcalendar', $key ) );
 			return null;
-        }
+		}
 
-        return $matches[0];
-    }
-}
\ No newline at end of file
+		return $matches[0];
+	}
+}
diff --git a/rest/json-all-events.php b/rest/json-all-events.php
index e2485f4..1363fc8 100644
--- a/rest/json-all-events.php
+++ b/rest/json-all-events.php
@@ -51,7 +51,7 @@ protected function get_events_all() {
         $force_login = rest_sanitize_boolean($_REQUEST['force_login'] ?? Shortcode::getDefaultForceLogin());
 		$redirect_after_login = esc_url($_REQUEST['redirect_after_login']);
 		$extra_fields = !empty($_REQUEST['extra_fields']) ? explode(',', filter_var($_REQUEST['extra_fields'], FILTER_SANITIZE_STRING)) : [];
-        $extra_fields = array_map( [ 'Civicrm_Ux_Validators', 'validateAPIFieldName' ], $extra_fields );
+        $extra_fields = array_map( fn($field) => Civicrm_Ux_Validators::validateAPIFieldName( $field, 'extra_fields' ), $extra_fields );
 
         if(!empty($_REQUEST['colors']) && !is_array($_REQUEST['colors'])) {
             $_REQUEST['colors'] = explode(',', $_REQUEST['colors']);
@@ -91,7 +91,7 @@ protected function get_events_all() {
             }
 
             if(!empty($_REQUEST['image_src_field'])) {
-                $image_src_field = Civicrm_Ux_Validators::validateAPIFieldName($_REQUEST['image_src_field']);
+                $image_src_field = Civicrm_Ux_Validators::validateAPIFieldName($_REQUEST['image_src_field'], 'image_src_field');
                 $eventQuery->addSelect($image_src_field);
             } else {
                 $image_src_field = null;
diff --git a/shortcodes/event/event-fullcalendar.php b/shortcodes/event/event-fullcalendar.php
index c95ab14..1c40c64 100644
--- a/shortcodes/event/event-fullcalendar.php
+++ b/shortcodes/event/event-fullcalendar.php
@@ -39,10 +39,10 @@ public function shortcode_callback( $atts = [], $content = null, $tag = '' ) {
 				}
 			}
 			if (isset($atts['extra_fields'])) {
-                $extra_fields_arr = array_map([ 'Civicrm_Ux_Validators', 'validateAPIFieldName' ], explode(",", $atts['extra_fields']));
+                $extra_fields_arr = array_map( fn( $field ) => Civicrm_Ux_Validators::validateAPIFieldName( $field, 'extra_fields' ), explode( ",", $atts['extra_fields'] ) );
             }
 			if (isset($atts['image_src_field'])) {
-				$atts['image_src_field'] = Civicrm_Ux_Validators::validateAPIFieldName($atts['image_src_field']);
+				$atts['image_src_field'] = Civicrm_Ux_Validators::validateAPIFieldName( $atts['image_src_field'], 'image_src_field' );
 			}
 			if (isset($atts['force_login'])) {
 				$atts['force_login'] = filter_var($atts['force_login'], FILTER_VALIDATE_BOOLEAN);