← All changes | includes/Frontend/Form/FrontendFormHandler.php +244 -46 3.1.3 → 3.3.1 View file →

		@@ -15,15 +15,21 @@
15	15	use BitCode\BitForm\Core\Integration\IntegrationHandler;
16	16	use BitCode\BitForm\Core\Util\EscapingHelper;
17	17	use BitCode\BitForm\Core\Util\FieldValueHandler;
18	18	use BitCode\BitForm\Core\Util\FileDownloadProvider;
	19	+use BitCode\BitForm\Core\Util\FileHandler;
19	20	use BitCode\BitForm\Core\Util\FrontendHelpers;
	21	+use BitCode\BitForm\Core\Util\Log;
20	22	use BitCode\BitForm\Core\Util\SmartTagRegistry;
21	23	use BitCode\BitForm\Core\Util\SmartTags;
	24	+use BitCode\BitForm\Core\Util\Utilities;
22	25	use BitCode\BitForm\Core\WorkFlow\WorkFlow;
23	26
24	27	final class FrontendFormHandler
25	28	{
	29	+ /** Largest stored signature inlined into the page as a data URI. */
	30	+ private const MAX_INLINE_SIGNATURE_BYTES = 2097152;
	31	+
26	32	public function __construct()
27	33	{
28	34	// before markup load - formids [], posts [1,2]
29	35	add_action('wp_enqueue_scripts', [$this, 'loadAssets']);
		@@ -29,9 +35,11 @@
29	35	add_action('wp_enqueue_scripts', [$this, 'loadAssets']);
30	36	// markup loads - formids []
31	37	add_shortcode('bitform', [$this, 'handleFrontendRenderRequest']);
32	38	// after markup load - formids [1,35,3]
33		- add_action('wp_footer', [$this, 'generateJS']);
	39	+ // After popup plugins render at 10 (that is when popup-only forms register
	40	+ // their formID), before wp_print_footer_scripts at 20.
	41	+ add_action('wp_footer', [$this, 'generateJS'], 15);
34	42	}
35	43
36	44	private function validPassowordResetToken($token, $userID, $formId)
37	45	{
		@@ -60,10 +68,43 @@
60	68
61	69	return $formScriptSrc;
62	70	}
63	71
	72	+ private function getJSFilePath($postId)
	73	+ {
	74	+ return BITFORMS_CONTENT_DIR . "/form-scripts/$postId/bitform-js-$postId.js";
	75	+ }
	76	+
	77	+ /**
	78	+ * Does this page's bundle need (re)generating?
	79	+ *
	80	+ * The DB flag alone is not enough: a page marked generated whose file was never written
	81	+ * (crashed generation, unwritable uploads dir) would enqueue a 404 forever. Conversely a
	82	+ * file that cannot be written must not make every request rebuild it, so a missing file
	83	+ * is retried on a backoff window rather than on every hit.
	84	+ *
	85	+ * @param int $postId
	86	+ * @param bool $regenerateScriptFlag DB-side verdict from regenerateScriptChecker()
	87	+ *
	88	+ * @return bool
	89	+ */
	90	+ private function needsScriptGeneration($postId, $regenerateScriptFlag)
	91	+ {
	92	+ if (file_exists($this->getJSFilePath($postId))) {
	93	+ return (bool) $regenerateScriptFlag;
	94	+ }
	95	+ $retryKey = 'bitforms_js_regen_' . $postId;
	96	+ if (get_transient($retryKey)) {
	97	+ return false;
	98	+ }
	99	+ set_transient($retryKey, 1, 5 * MINUTE_IN_SECONDS);
	100	+ return true;
	101	+ }
	102	+
64	103	public function generateJs($formID = null, $entryID = null, $formType = null)
65	104	{
	105	+ // bitform-js-{postId}.js is disk-cached per post ID with no language key.
	106	+ // Display strings must stay out of it and travel in bf_globals per request.
66	107	// return true;
67	108	$isFormPreview = get_transient('bitform_form_preview');
68	109	if ($isFormPreview && !$formID) {
69	110	delete_transient('bitform_form_preview');
		@@ -123,8 +164,10 @@
123	164	if (!$regenerateScriptFlag) {
124	165	$regenerateScriptFlag = $this->deleteUnusedFormPageIds($postId, $bfUniqFormIds);
125	166	}
126	167	$isJsGenerating = get_option('bitforms_frontend_js_generating');
	168	+ // The fast path also requires the cached bundle to exist on disk, not just be flagged in the DB.
	169	+ $regenerateScriptFlag = $this->needsScriptGeneration($postId, $regenerateScriptFlag);
127	170	if (!$regenerateScriptFlag && !$isJsGenerating && !empty($formIDs)) {
128	171	wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], $formUpdateVersion, true);
129	172	return;
130	173	}
		@@ -157,8 +200,13 @@
157	200	$frontendScriptGenObj->generateJsFile($formContents, $allFields, $contentIds, $postId, $formIDs, $previewMode);
158	201	if ('preview' === $previewMode) {
159	202	return;
160	203	}
	204	+ // Only mark the page as generated once the bundle is verifiably on disk; otherwise the
	205	+ // next request must retry generation instead of fast-pathing to a stale/missing file.
	206	+ if (!empty($bfUniqFormIds) && file_exists($this->getJSFilePath($postId))) {
	207	+ $this->markScriptGenerated($bfUniqFormIds, $postId);
	208	+ }
161	209	wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], $formUpdateVersion, true);
162	210	}
163	211
164	212	private function deleteUnusedFormPageIds($postId, $formIDs)
		@@ -174,9 +222,9 @@
174	222	);
175	223	$regenerateScriptFlag = false;
176	224	foreach ($forms as $form) {
177	225	$formId = $form->id;
178		- $generatedScriptPageIdsDecoded = json_decode($form->generated_script_page_ids, true);
	226	+ $generatedScriptPageIdsDecoded = json_decode((string) $form->generated_script_page_ids, true);
179	227	$generatedScriptPageIds = is_array($generatedScriptPageIdsDecoded) ? array_keys($generatedScriptPageIdsDecoded) : [];
180	228	if (!empty($generatedScriptPageIds) && !in_array($formId, $formIDs) && in_array($postId, $generatedScriptPageIds)) {
181	229	unset($generatedScriptPageIdsDecoded[$postId]);
182	230	if (empty($generatedScriptPageIdsDecoded)) {
		@@ -204,10 +252,11 @@
204	252	if (!is_a($post, 'WP_Post') && !isset($post->ID)) {
205	253	return;
206	254	}
207	255	$postId = $post->ID;
208		- $regenerateScriptFlag = false;
209		- $formModel = new FormModel();
	256	+ // Read-only check. Marking the page as generated is deferred to markScriptGenerated(),
	257	+ // called only after the bundle file is actually written — marking here left the DB
	258	+ // saying "generated" while the file stayed stale whenever generation failed mid-way.
210	259	foreach ($formsIds as $formId) {
211	260	$formInstance = FormManager::getInstance($formId);
212	261	if (!$formInstance->isExist()) {
213	262	continue;
		@@ -213,18 +262,35 @@
213	262	continue;
214	263	}
215	264	$generatedPages = $formInstance->getFormData('generated_script_page_ids');
216	265	if (empty($generatedPages)) {
217		- $regenerateScriptFlag = true;
218		- } elseif (is_object($generatedPages) && (!isset($generatedPages->{$postId}) || (isset($generatedPages->{$postId}) && false === $generatedPages->{$postId}))) {
219		- $regenerateScriptFlag = true;
	266	+ return true;
220	267	}
221		- if (!$regenerateScriptFlag) {
	268	+ if (is_object($generatedPages) && (!isset($generatedPages->{$postId}) || false === $generatedPages->{$postId})) {
	269	+ return true;
	270	+ }
	271	+ }
	272	+ return false;
	273	+ }
	274	+
	275	+ private function markScriptGenerated($formsIds, $postId)
	276	+ {
	277	+ // Fetched via FormModel rather than FormManager: FormManager keeps its row in a static
	278	+ // property shared across instances, so after the render loop it holds the last form's
	279	+ // data regardless of which instance is asked.
	280	+ $formModel = new FormModel();
	281	+ foreach ($formsIds as $formId) {
	282	+ $form = $formModel->get(['generated_script_page_ids'], ['id' => $formId]);
	283	+ if (is_wp_error($form) || empty($form)) {
222	284	continue;
223	285	}
	286	+ $generatedPages = Utilities::jsonObj($form[0]->generated_script_page_ids ?? '');
224	287	if (!is_object($generatedPages)) {
225	288	$generatedPages = (object) [];
226	289	}
	290	+ if (!empty($generatedPages->{$postId})) {
	291	+ continue;
	292	+ }
227	293	$generatedPages->{$postId} = true;
228	294	$formModel->update(
229	295	[
230	296	'generated_script_page_ids' => \wp_json_encode($generatedPages)
		@@ -233,9 +299,8 @@
233	299	'id' => $formId,
234	300	]
235	301	);
236	302	}
237		- return $regenerateScriptFlag;
238	303	}
239	304
240	305	private function addInlineScript($code, $handle = '', $position = 'after')
241	306	{
		@@ -280,9 +345,9 @@
280	345
281	346	return $fields;
282	347	}
283	348
284		- private function executeOnUserInput($formID, $shortCodeCounter, $fields)
	349	+ private function executeOnUserInput($formID, $shortCodeCounter, $workFlowRunType = 'create')
285	350	{
286	351	$FrontendFormManager = FrontendFormManager::getInstance($formID, $shortCodeCounter);
287	352	$previousValue = $this->getValuesFromQueryParams();
288	353	$formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
		@@ -288,9 +353,9 @@
288	353	$formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
289	354	$customCodesExist = strpos(FrontEndScriptGenerator::getCustomCodes($formID)['JavaScript'], 'bfVars');
290	355	if ($customCodesExist || (!empty($formContent->workFlowExist) && !empty($formContent->workFlowExist->oninput))) {
291	356	$workFlowRunHelper = new WorkFlow($formID);
292		- return $workFlowRunHelper->executeOnUserInput('create', $fields);
	357	+ return $workFlowRunHelper->executeOnUserInput($workFlowRunType);
293	358	}
294	359	}
295	360
296	361	private function getValuesFromQueryParams()
		@@ -410,9 +475,9 @@
410	475	$fields = apply_filters('bitform_filter_before_workflow_onload_fields', $fields, $formID);
411	476	$fields = $this->triggerWorkflowOnLoad($formID, $shortCodeCounter, $fields, $workFlowRunType);
412	477	$fields = apply_filters('bitform_filter_after_workflow_onload_fields', $fields, $formID);
413	478	do_action('bitform_onload_fields', $fields, $formID);
414		- $workFlowreturnedOnUserInput = $this->executeOnUserInput($formID, $shortCodeCounter, $fields);
	479	+ $workFlowreturnedOnUserInput = $this->executeOnUserInput($formID, $shortCodeCounter, $workFlowRunType);
415	480
416	481	// test for form before remove
417	482	$noLabelFieldTypes = ['decision-box', 'gdpr', 'html', 'shortcode', 'button', 'paypal', 'razorpay', 'recaptcha', 'turnstile', 'hcaptcha', 'stripe', 'spacer'];
418	483	foreach ($fields as $fldKey => $field) {
		@@ -433,12 +498,14 @@
433	498	$FrontendFormManager->getCaptchaSettings()
434	499	&& !is_null($integration->integration_type)
435	500	&& 'gReCaptcha' === $integration->integration_type
436	501	) {
437		- $integrationDetails = json_decode($integration->integration_details);
438		- $integrationDetails->id = $integration->id;
439		- $reCAPTCHA = $integrationDetails;
440		- $reCAPTCHAVersion = 'v2';
	502	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	503	+ if ($integrationDetails) {
	504	+ $integrationDetails->id = $integration->id;
	505	+ $reCAPTCHA = $integrationDetails;
	506	+ $reCAPTCHAVersion = 'v2';
	507	+ }
441	508	}
442	509
443	510	if (
444	511	$FrontendFormManager->getTurnstileSettings()
		@@ -444,10 +511,10 @@
444	511	$FrontendFormManager->getTurnstileSettings()
445	512	&& !is_null($integration->integration_type)
446	513	&& 'turnstileCaptcha' === $integration->integration_type
447	514	) {
448		- $integrationDetails = json_decode($integration->integration_details);
449		- $turnstileSiteKey = $integrationDetails->siteKey;
	515	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	516	+ $turnstileSiteKey = $integrationDetails->siteKey ?? '';
450	517	}
451	518
452	519	if (
453	520	$FrontendFormManager->isFieldTypeExist('hcaptcha')
		@@ -453,18 +520,20 @@
453	520	$FrontendFormManager->isFieldTypeExist('hcaptcha')
454	521	&& !is_null($integration->integration_type)
455	522	&& 'hcaptcha' === $integration->integration_type
456	523	) {
457		- $integrationDetails = json_decode($integration->integration_details);
458		- $hCaptchaSiteKey = $integrationDetails->siteKey;
	524	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	525	+ $hCaptchaSiteKey = $integrationDetails->siteKey ?? '';
459	526	}
460	527
461	528	if ($captchaV3Settings) {
462	529	if (!is_null($integration->integration_type) && 'gReCaptchaV3' === $integration->integration_type) {
463		- $integrationDetails = json_decode($integration->integration_details);
464		- $integrationDetails->id = $integration->id;
465		- $reCAPTCHA = $integrationDetails;
466		- $reCAPTCHAVersion = 'v3';
	530	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	531	+ if ($integrationDetails) {
	532	+ $integrationDetails->id = $integration->id;
	533	+ $reCAPTCHA = $integrationDetails;
	534	+ $reCAPTCHAVersion = 'v3';
	535	+ }
467	536	}
468	537	}
469	538	}
470	539	}
		@@ -497,19 +566,20 @@
497	566	$paymentIntegration = $integrationHandler->getAIntegration($fldData->payIntegID);
498	567	if (is_wp_error($paymentIntegration)) {
499	568	continue;
500	569	}
	570	+ $paymentIntegrationRow = Utilities::firstRow($paymentIntegration);
501	571	if ('paypal' === $fldData->typ) {
502		- $integrationDetails = json_decode($paymentIntegration[0]->integration_details);
503		- $clientID = $integrationDetails->clientID;
	572	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	573	+ $clientID = $integrationDetails->clientID ?? '';
504	574	$fields->{$fldKey}->clientId = $clientID;
505	575	} elseif ('razorpay' === $fldData->typ) {
506		- $integrationDetails = json_decode($paymentIntegration[0]->integration_details);
507		- $clientID = $integrationDetails->apiKey;
	576	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	577	+ $clientID = $integrationDetails->apiKey ?? '';
508	578	$fields->{$fldKey}->clientId = $clientID;
509	579	} elseif ('stripe' === $fldData->typ) {
510		- $integrationDetails = json_decode($paymentIntegration[0]->integration_details);
511		- $publishableKey = $integrationDetails->publishableKey;
	580	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	581	+ $publishableKey = $integrationDetails->publishableKey ?? '';
512	582	$fields->{$fldKey}->publishableKey = $publishableKey;
513	583	}
514	584	}
515	585	}
		@@ -539,8 +609,9 @@
539	609	];
540	610
541	611	if ($entryId) {
542	612	$bitFormFrontArr['entryId'] = $entryId;
	613	+ self::markResponseUncacheable();
543	614	}
544	615
545	616	if (isset($additional->enabled->validateFocusLost)) {
546	617	$bitFormFrontArr['validateFocusLost'] = true;
		@@ -546,9 +617,11 @@
546	617	$bitFormFrontArr['validateFocusLost'] = true;
547	618	}
548	619
549	620	if (!empty($isAbandoned)) {
	621	+ // One visitor's typed values, so this response must not be page-cached.
550	622	$bitFormFrontArr['oldValues'] = $this->getFieldsValue($formID, $isAbandoned);
	623	+ self::markResponseUncacheable();
551	624	if (empty($entryId)) {
552	625	$bitFormFrontArr['entryId'] = $entryId;
553	626	}
554	627	}
		@@ -585,27 +658,31 @@
585	658	$layout = wp_json_encode($layout);
586	659	$buttons = wp_json_encode($buttons);
587	660	$frontArr = wp_json_encode($bitFormFrontArr);
588	661
589		- $bfGlobals = sprintf('
590		- if(!window.bf_globals) {
591		- window.bf_globals = {}
592		- } if(!window.bf_globals.%1$s) {
593		- window.bf_globals.%1$s = {}
	662	+ $bfGlobals = sprintf('
	663	+ if(!window.bf_globals) {
	664	+ window.bf_globals = {}
	665	+ } if(!window.bf_globals.%1$s) {
	666	+ window.bf_globals.%1$s = {}
594	667	}
595		- if(document.getElementById("%1$s")) {
596		- window.bf_globals.%1$s = {
597		- ...window.bf_globals.%1$s,
598		- ...%2$s
599		- };
600		- }', $FormIdentifier, $frontArr);
	668	+ window.bf_globals.%1$s = {
	669	+ ...window.bf_globals.%1$s,
	670	+ ...%2$s
	671	+ };
	672	+ if (typeof window.bitformInit === "function") { window.bitformInit("%1$s"); }', $FormIdentifier, $frontArr);
601	673
	674	+ // Inert copy of the config. Optimizers only rewrite executable scripts, so
	675	+ // this survives and travels with the markup; the runtime hydrates from it
	676	+ // whenever bf_globals is missing.
	677	+ $configTag = self::buildFormConfigTag($FormIdentifier, $bitFormFrontArr);
	678	+
602	679	if ('conversational' === $formType
603	680	&& isset($formContent->formInfo->conversationalSettings->enable)
604	681	&& $formContent->formInfo->conversationalSettings->enable) {
605		- $html = $FrontendFormManager->conversationalFormView($fields, $file, $errorMessages);
	682	+ $html = $FrontendFormManager->conversationalFormView($fields, $file, $errorMessages, null, !empty($entryId));
606	683	} else {
607		- $html = $FrontendFormManager->formView($fields, $file, $errorMessages);
	684	+ $html = $FrontendFormManager->formView($fields, $file, $errorMessages, null, !empty($entryId));
608	685	}
609	686
610	687	// if form preview then return html otherwise echo with output buffer
611	688	if ($formPreview) {
		@@ -613,8 +690,9 @@
613	690	$formViewObject = new \stdClass();
614	691	$formViewObject->html = $html;
615	692	$formViewObject->font = $font;
616	693	$formViewObject->bfGlobals = $bfGlobals;
	694	+ $formViewObject->configTag = $configTag;
617	695	$formViewObject->formContent = $formContent;
618	696	return $formViewObject;
619	697	}
620	698
		@@ -621,13 +699,60 @@
621	699	$bfGlobalsHandle = 'bitform-bf-globals-' . sanitize_key($FormIdentifier);
622	700	$this->addInlineScript($bfGlobals, $bfGlobalsHandle, 'after');
623	701	$this->emitShowPickerBridge();
624	702
	703	+ // Printed outside wp_kses rather than allowing <script> in form markup.
	704	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built by buildFormConfigTag(), JSON_HEX_* escaped.
	705	+ echo $configTag;
625	706	echo wp_kses(trim($html), EscapingHelper::getFormAllowedHtml($formContent));
626	707	return ob_get_clean();
627	708	}
628	709
629	710	/**
	711	+ * Keep per-visitor config (oldValues, entryId) out of full-page caches.
	712	+ *
	713	+ * @return void
	714	+ */
	715	+ public static function markResponseUncacheable()
	716	+ {
	717	+ // DONOTCACHEPAGE does the work; caches read it at shutdown. Rendering
	718	+ // usually runs after headers are sent, so nocache_headers() is a bonus.
	719	+ if (!defined('DONOTCACHEPAGE')) {
	720	+ define('DONOTCACHEPAGE', true);
	721	+ }
	722	+ if (!headers_sent() && function_exists('nocache_headers')) {
	723	+ nocache_headers();
	724	+ }
	725	+ }
	726	+
	727	+ /**
	728	+ * Build the inert JSON config block for a rendered form.
	729	+ *
	730	+ * JSON_HEX_* escapes < > & as \u00XX so no field value can close the script
	731	+ * element or inject markup.
	732	+ *
	733	+ * @param string $formIdentifier
	734	+ * @param array $config
	735	+ *
	736	+ * @return string
	737	+ */
	738	+ public static function buildFormConfigTag($formIdentifier, $config)
	739	+ {
	740	+ $json = wp_json_encode($config, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
	741	+ if (false === $json) {
	742	+ return '';
	743	+ }
	744	+ // Some optimizers wrap any inline <script>, including application/json,
	745	+ // in DOMContentLoaded boilerplate that corrupts the JSON. These attributes
	746	+ // make the common ones skip it; the JS side also salvage-parses.
	747	+ return sprintf(
	748	+ '<script type="application/json" class="bf-form-config" id="bf-config-%1$s" data-bf-form="%1$s" data-no-optimize="1" data-no-defer="1" data-no-minify="1" data-cfasync="false" nowprocket>%2$s</script>',
	749	+ esc_attr($formIdentifier),
	750	+ $json
	751	+ );
	752	+ }
	753	+
	754	+ /**
630	755	* Build the smart-tag map exposed to the browser in window.bf_globals[formId].smartTags.
631	756	*
632	757	* Security: the legacy code shipped the ENTIRE ~43-tag map to every visitor, leaking
633	758	* PII (admin/user/author email) and freezing per-visitor request data (IP, time,
		@@ -692,8 +817,15 @@
692	817	$code = 'if(!window.__bfShowPickerBound){window.__bfShowPickerBound=true;document.addEventListener("click",function(e){var t=e.target;if(t&&t.matches&&t.matches("input[data-bf-show-picker=\"1\"]")&&typeof t.showPicker==="function"){try{t.showPicker();}catch(_){}}});}';
693	818	$this->addInlineScript($code, 'bitform-show-picker-bridge', 'after');
694	819	}
695	820
	821	+ /**
	822	+ * Does this form row exist?
	823	+ *
	824	+ * @param int $formID
	825	+ *
	826	+ * @return bool
	827	+ */
696	828	private function isExist($formID)
697	829	{
698	830	$formModel = new FormModel();
699	831	$form = $formModel->get(
		@@ -703,12 +835,32 @@
703	835	[
704	836	'id' => $formID,
705	837	]
706	838	);
707		- if (!is_wp_error($form)) {
708		- return true;
	839	+
	840	+ if (is_wp_error($form)) {
	841	+ if ('result_empty' !== $form->get_error_code()) {
	842	+ Log::debug_log([
	843	+ 'message' => 'Form lookup failed — reported to the visitor as a missing form',
	844	+ 'formID' => $formID,
	845	+ 'code' => $form->get_error_code(),
	846	+ 'error' => $form->get_error_message(),
	847	+ ]);
	848	+ }
	849	+
	850	+ return false;
709	851	}
710		- return false;
	852	+
	853	+ if (empty($form)) {
	854	+ Log::debug_log([
	855	+ 'message' => 'Form lookup returned no rows without an error (is the form table present?)',
	856	+ 'formID' => $formID,
	857	+ ]);
	858	+
	859	+ return false;
	860	+ }
	861	+
	862	+ return true;
711	863	}
712	864
713	865	private function getFieldsValue($formID, $entryID)
714	866	{
		@@ -798,12 +950,58 @@
798	950	if ('file-up' === $fields->{$metaKey}->typ || 'advanced-file-up' === $fields->{$metaKey}->typ) {
799	951	$fields->{$metaKey}->val = $metaValue->meta_value;
800	952	$fields->{$metaKey}->config->oldFiles = $metaValue->meta_value;
801	953	}
	954	+ if ('signature' === $fields->{$metaKey}->typ) {
	955	+ $this->setOldSignature($fields->{$metaKey}, $formID, $entryID, $metaValue->meta_value);
	956	+ }
802	957	}
803	958	}
804	959	}
805	960	return $fields;
	961	+ }
	962	+
	963	+ /** Give the signature field its stored signature: a data URI to redraw, and the name it posts back as `_old`. */
	964	+ private function setOldSignature($field, $formID, $entryID, $storedValue)
	965	+ {
	966	+ $fileName = is_string($storedValue) ? trim($storedValue) : '';
	967	+ $decoded = json_decode($fileName, true);
	968	+ if (is_array($decoded)) {
	969	+ $fileName = empty($decoded) ? '' : trim((string) reset($decoded));
	970	+ }
	971	+ // signature-failed.png means the stored signature was never usable.
	972	+ if ('' === $fileName || 'signature-failed.png' === $fileName) {
	973	+ return;
	974	+ }
	975	+ $fileName = sanitize_file_name($fileName);
	976	+ if (!isset($field->config)) {
	977	+ $field->config = (object) [];
	978	+ } elseif (is_array($field->config)) {
	979	+ $field->config = (object) $field->config;
	980	+ }
	981	+ $field->config->oldSignatureFile = $fileName;
	982	+
	983	+ $filePath = FileHandler::getEntriesFileUploadDir($formID, $entryID) . DIRECTORY_SEPARATOR . $fileName;
	984	+ if (!is_file($filePath) || !is_readable($filePath)) {
	985	+ return;
	986	+ }
	987	+ // The types getSignatureFilePath() writes; wp_check_filetype() reports none for SVG.
	988	+ $signatureMimeTypes = ['png' => 'image/png', 'jpg' => 'image/jpeg', 'svg' => 'image/svg+xml'];
	989	+ $extension = strtolower((string) pathinfo($fileName, PATHINFO_EXTENSION));
	990	+ if (!isset($signatureMimeTypes[$extension])) {
	991	+ return;
	992	+ }
	993	+ $mimeType = $signatureMimeTypes[$extension];
	994	+ // A hand-drawn signature is a few KB; a larger file is not worth inlining.
	995	+ if (filesize($filePath) > self::MAX_INLINE_SIGNATURE_BYTES) {
	996	+ return;
	997	+ }
	998	+ // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_get_contents -- local upload dir read, inlined as a data URI for the signature pad.
	999	+ $contents = file_get_contents($filePath);
	1000	+ if (false === $contents || '' === $contents) {
	1001	+ return;
	1002	+ }
	1003	+ $field->config->oldSignature = 'data:' . $mimeType . ';base64,' . base64_encode($contents);
806	1004	}
807	1005
808	1006	public function loadAssets($formID = 0, $fromType = 'classic')
809	1007	{