← All changes | includes/Frontend/Form/FrontendFormManager.php +1128 -476 1.5.2 → V3.3.2 View file →

		@@ -9,569 +9,1221 @@
9	9	/**
10	10	* FrontendFormManager class
11	11	*/
12	12
13		-use WP_Error;
14		-use BitCode\BitForm\Core\Util\IpTool;
15		-use BitCode\BitForm\Core\Util\HttpHelper;
	13	+use BitCode\BitForm\Admin\Form\AdminFormHandler;
	14	+use BitCode\BitForm\Admin\Form\Helpers;
	15	+use BitCode\BitForm\Core\Database\FormEntryModel;
16	16	use BitCode\BitForm\Core\Form\FormManager;
17		-use BitCode\BitForm\Core\Util\DateTimeHelper;
18		-use BitCode\BitForm\Core\Database\FormEntryModel;
19		-use BitCode\BitForm\Frontend\Form\View\FormViewer;
20		-use BitCode\BitForm\Core\WorkFlow\WorkFlowRunHelper;
	17	+use BitCode\BitForm\Core\Form\Validator\FormFieldValidator;
21	18	use BitCode\BitForm\Core\Integration\IntegrationHandler;
22		-use BitCode\BitForm\Core\Form\Validator\FormFieldValidator;
	19	+use BitCode\BitForm\Core\Messages\SuccessMessageHandler;
23	20	use BitCode\BitForm\Core\Util\ApiResponse as UtilApiResponse;
	21	+use BitCode\BitForm\Core\Util\EscapingHelper;
	22	+use BitCode\BitForm\Core\Util\FieldValueHandler;
	23	+use BitCode\BitForm\Core\Util\FrontendHelpers;
	24	+use BitCode\BitForm\Core\Util\HttpHelper;
	25	+use BitCode\BitForm\Core\Util\IpTool;
	26	+use BitCode\BitForm\Core\Util\Log;
	27	+use BitCode\BitForm\Core\Util\Utilities;
	28	+use BitCode\BitForm\Core\WorkFlow\WorkFlow;
	29	+use BitCode\BitForm\Frontend\Form\View\FormViewer;
	30	+use BitCode\BitForm\GlobalHelper;
	31	+use WP_Error;
24	32
25	33	final class FrontendFormManager extends FormManager
26	34	{
27		- private $_form_identifier;
28		- private $_form_token;
29		- private $_form_id;
30		- // private $_has_upload = false;
31		- public function __construct($form_id, $shortCodeCounter = null)
32		- {
33		- parent::__construct($form_id);
34		- $this->_form_identifier = 'bitforms_' . $form_id . '_submit_';
35		- $this->_form_identifier .= !empty(get_post()->ID) ? get_post()->ID : '';
36		- $this->_form_identifier .= !empty($shortCodeCounter) ? "_$shortCodeCounter" : '';
37		- $this->_form_token = wp_create_nonce('bitforms_' . $form_id);
38		- $this->_form_id = $form_id;
	35	+ private $_form_identifier;
	36	+
	37	+ /** @var array|null reCAPTCHA v3 verdict, reused for the log */
	38	+ private $recaptchaV3Verification;
	39	+ private $_form_token;
	40	+ private $_form_id;
	41	+ private $_conf_messages;
	42	+ private static $_instance = [];
	43	+
	44	+ // private $_has_upload = false;
	45	+ public function __construct($form_id, $shortCodeCounter = null)
	46	+ {
	47	+ parent::__construct($form_id);
	48	+ $this->_form_identifier = 'bitforms_' . $form_id;
	49	+ $this->_form_identifier .= !empty(get_post()->ID) ? '_' . get_post()->ID : '';
	50	+ $this->_form_identifier .= !empty($shortCodeCounter) ? "_$shortCodeCounter" : '';
	51	+ $this->_form_token = wp_create_nonce('bitforms_' . $form_id);
	52	+ $this->_form_id = $form_id;
	53	+ }
	54	+
	55	+ public static function getInstance($form_id, $shortCodeCounter = null)
	56	+ {
	57	+ $key = $form_id . ':' . ($shortCodeCounter ?? 'default');
	58	+
	59	+ if (!isset(self::$_instance[$key])) {
	60	+ self::$_instance[$key] = new self($form_id, $shortCodeCounter);
39	61	}
40	62
41		- public function getFormIdentifier()
42		- {
43		- return $this->_form_identifier;
	63	+ return self::$_instance[$key];
	64	+ }
	65	+
	66	+ public function getFormIdentifier()
	67	+ {
	68	+ return $this->_form_identifier;
	69	+ }
	70	+
	71	+ public function getFormID()
	72	+ {
	73	+ return $this->_form_id;
	74	+ }
	75	+
	76	+ public function getFormToken()
	77	+ {
	78	+ return $this->_form_token;
	79	+ }
	80	+
	81	+ public function getSubmittedFields($submitted_data)
	82	+ {
	83	+ unset($submitted_data[$this->_form_identifier]);
	84	+ // unset($submitted_data['bit-form-submit-btn']);
	85	+ return array_keys($submitted_data);
	86	+ }
	87	+
	88	+ public function formView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null, $isEntryEdit = false)
	89	+ {
	90	+ $formContents = $this->getFormContent();
	91	+ $formAtomicClsMap = $this->getAtomicClsMap();
	92	+ if (!empty($fields)) {
	93	+ $formContents->fields = is_string($fields) ? json_decode($fields) : $fields;
	94	+ } else {
	95	+ $workFlowRunHelper = new WorkFlow($this->form_id);
	96	+ $workFlowreturnedOnLoad = $workFlowRunHelper->executeOnLoad(
	97	+ 'create',
	98	+ $formContents->fields
	99	+ );
	100	+ $formContents->fields = empty($workFlowreturnedOnLoad['fields']) ? $formContents->fields : $workFlowreturnedOnLoad['fields'];
44	101	}
	102	+ $formViewer = new FormViewer($this, $formContents, $formAtomicClsMap, $errorMessages, $previousValue);
	103	+ $isRestricted = $this->checkSubmissionRestriction(false, $isEntryEdit);
	104	+ $msg = !empty($isRestricted) ? $isRestricted[0] : '';
	105	+ return $formViewer->getView($hasFile, $msg);
	106	+ }
45	107
46		- public function getFormID()
47		- {
48		- return $this->_form_id;
	108	+ public function conversationalFormView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null, $isEntryEdit = false)
	109	+ {
	110	+ $formContents = $this->getFormContent();
	111	+ $formAtomicClsMap = $this->getAtomicClsMap();
	112	+ if (!empty($fields)) {
	113	+ $formContents->fields = is_string($fields) ? json_decode($fields) : $fields;
	114	+ } else {
	115	+ $workFlowRunHelper = new WorkFlow($this->form_id);
	116	+ $workFlowreturnedOnLoad = $workFlowRunHelper->executeOnLoad(
	117	+ 'create',
	118	+ $formContents->fields
	119	+ );
	120	+ $formContents->fields = empty($workFlowreturnedOnLoad['fields']) ? $formContents->fields : $workFlowreturnedOnLoad['fields'];
49	121	}
	122	+ $formViewer = new FormViewer($this, $formContents, $formAtomicClsMap, $errorMessages, $previousValue);
	123	+ $isRestricted = $this->checkSubmissionRestriction(false, $isEntryEdit);
	124	+ $msg = !empty($isRestricted) ? $isRestricted[0] : '';
	125	+ return $formViewer->getConversationalView($hasFile, $msg);
	126	+ }
50	127
51		- public function getFormToken()
52		- {
53		- return $this->_form_token;
	128	+ public function checkEmptySubmission($data, $file, $isEntryEdit = false)
	129	+ {
	130	+ $formFields = $this->getFields();
	131	+ foreach ($formFields as $key => $field) {
	132	+ $fieldType = $field['type'];
	133	+ if ('button' === $fieldType) {
	134	+ continue;
	135	+ }
	136	+ $fileUploadFieldTypes = ['file-up', 'advanced-file-up'];
	137	+ if ('decision-box' === $fieldType || 'gdpr' === $fieldType) {
	138	+ continue;
	139	+ }
	140	+ $isFileType = in_array($fieldType, $fileUploadFieldTypes);
	141	+ // An edit keeps an untouched file/signature as `<fieldKey>_old`, not as an upload.
	142	+ if (
	143	+ $isEntryEdit
	144	+ && ($isFileType || 'signature' === $fieldType)
	145	+ && !empty(FieldValueHandler::retainedOldValues($data, $key))
	146	+ ) {
	147	+ return false;
	148	+ }
	149	+ if ($this->isRepeatedField($key)) {
	150	+ $fileData = !empty($file[$key]) ? $file[$key] : [];
	151	+ $dataVal = !empty($data[$key]) ? $data[$key] : [];
	152	+ if (!$this->checkRepeatedFieldEmptySubmission($isFileType, $dataVal, $fileData)) {
	153	+ return false;
	154	+ }
	155	+ continue;
	156	+ }
	157	+ if (!$isFileType && (!empty($data[$key]) || (isset($data[$key]) && is_numeric($data[$key])))) {
	158	+ return false;
	159	+ }
	160	+ if ($isFileType && !empty($file[$key]['name']) && is_string($file[$key]['name'])) {
	161	+ return false;
	162	+ }
	163	+ if ($isFileType && !empty($file[$key]['name'][0])) {
	164	+ return false;
	165	+ }
54	166	}
	167	+ return true;
	168	+ }
55	169
56		- public function isSubmitted()
57		- {
58		- return isset($_POST[$this->_form_identifier]) ? true : false;
	170	+ private function checkRepeatedFieldEmptySubmission($isFileType, $data, $file = [])
	171	+ {
	172	+ if (!$isFileType) {
	173	+ foreach ($data as $value) {
	174	+ if (!empty($value)) {
	175	+ return false;
	176	+ }
	177	+ }
59	178	}
	179	+ if ($isFileType) {
	180	+ foreach ($file['name'] as $value) {
	181	+ if (!empty($value) && is_string($value)) {
	182	+ return false;
	183	+ }
	184	+ if (is_array($value) && !empty($value[0])) {
	185	+ return false;
	186	+ }
	187	+ }
	188	+ }
	189	+ return true;
	190	+ }
60	191
61		- public function getSubmittedFields($submitted_data)
62		- {
63		- unset($submitted_data[$this->_form_identifier]);
64		- return array_keys($submitted_data);
	192	+ private function getParams()
	193	+ {
	194	+ $url = wp_parse_url(wp_get_referer());
	195	+ $parameter = [];
	196	+ if (isset($url['query'])) {
	197	+ // a bare key (?preview) made the old explode() split warn; this also URL-decodes values
	198	+ wp_parse_str($url['query'], $parameter);
65	199	}
	200	+ return $parameter;
	201	+ }
66	202
67		- public function formView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null)
68		- {
69		- $formContents = $this->getFormContent();
70		- if (!empty($fields)) {
71		- $formContents->fields = is_string($fields) ? json_decode($fields) : $fields;
	203	+ private function getFormFields($formID)
	204	+ {
	205	+ $adminFormHandler = new AdminFormHandler();
	206	+ $post = new \stdClass();
	207	+ $post = (object) [
	208	+ 'id' => $formID
	209	+ ];
	210	+ $getForm = $adminFormHandler->getAForm('', $post);
	211	+ $formContainer = $getForm['form_content'];
	212	+
	213	+ return $formContainer['fields'];
	214	+ }
	215	+
	216	+ private function transformDrpdwnValue($post)
	217	+ {
	218	+ $formFields = $this->getFormFields($this->_form_id);
	219	+
	220	+ foreach ($post as $key => $value) {
	221	+ if (!str_starts_with($key, 'repeater') && isset($formFields->{$key}) && 'select' === $formFields->{$key}->typ) {
	222	+ if (is_array($value)) {
	223	+ foreach ($value as $k => $v) {
	224	+ $post[$key][$k] = !is_array($v) && is_string($v) ? explode(BITFORMS_BF_SEPARATOR, $v) : $v;
	225	+ }
72	226	} else {
73		- $workFlowRunHelper = new WorkFlowRunHelper($this->form_id);
74		- $workFlowreturnedOnLoad = $workFlowRunHelper->executeOnLoad(
75		- 'create',
76		- $formContents->fields
77		- );
78		- $formContents->fields = empty($workFlowreturnedOnLoad['fields']) ? $formContents->fields : $workFlowreturnedOnLoad['fields'];
	227	+ $post[$key] = explode(BITFORMS_BF_SEPARATOR, $value);
79	228	}
80		- $formViewer = new FormViewer($this, $formContents, $errorMessages, $previousValue);
81		- return $formViewer->getView($hasFile);
	229	+ };
82	230	}
83	231
84		- private function checkEmptySubmission($data, $file)
85		- {
86		- $form_fields = $this->getFields();
87		- $emptySubmission = true;
88		- foreach ($form_fields as $key => $field) {
89		- if (!empty($data[$key]) || !empty($file[$key]['name'])) {
90		- $emptySubmission = false;
91		- break;
92		- }
	232	+ return $post;
	233	+ }
	234	+
	235	+ /**
	236	+ * WP auth errors carry markup and the confirmation box paints them with innerHTML,
	237	+ * so esc_html() would show the tags as text. kses keeps only the safe markup.
	238	+ *
	239	+ * @param mixed $message
	240	+ *
	241	+ * @return string
	242	+ */
	243	+ private static function authErrorMessage($message)
	244	+ {
	245	+ return wp_kses(is_string($message) ? $message : '', EscapingHelper::getAllowedHtmlTags());
	246	+ }
	247	+
	248	+ /**
	249	+ * A confirm-enabled email/password field posts as one composite and the validator collapses it
	250	+ * to the primary value, so the confirm child's own field key never reaches $_POST. WP auth
	251	+ * integrations map fields by key, so fill those child keys on a copy for the auth filter.
	252	+ *
	253	+ * @param mixed $postData
	254	+ *
	255	+ * @return mixed
	256	+ */
	257	+ private function resolveConfirmChildValues($postData)
	258	+ {
	259	+ if (!is_array($postData)) {
	260	+ return $postData;
	261	+ }
	262	+ $fields = $this->getFields();
	263	+ $postData = $this->resolveCompositeChildValues($postData, $fields);
	264	+ foreach ($fields as $fieldKey => $fieldData) {
	265	+ if (
	266	+ empty($fieldData['childFields'])
	267	+ || !isset($fieldData['type'])
	268	+ || !in_array($fieldData['type'], ['email', 'password'], true)
	269	+ || !empty($fieldData['repeated'])
	270	+ || !isset($postData[$fieldKey])
	271	+ ) {
	272	+ continue;
	273	+ }
	274	+ $parentValue = $postData[$fieldKey];
	275	+ foreach ((array) $fieldData['childFields'] as $childFieldRef) {
	276	+ $childKey = is_object($childFieldRef) && isset($childFieldRef->fldKey) ? $childFieldRef->fldKey : '';
	277	+ if (
	278	+ empty($childKey)
	279	+ || !isset($fields[$childKey])
	280	+ || !empty($fields[$childKey]['isDeactive'])
	281	+ || isset($postData[$childKey])
	282	+ ) {
	283	+ continue;
93	284	}
94		- return $emptySubmission;
	285	+ if (is_array($parentValue)) {
	286	+ if (array_key_exists('confirm', $parentValue)) {
	287	+ $postData[$childKey] = $parentValue['confirm'];
	288	+ }
	289	+ continue;
	290	+ }
	291	+ // Validation matched primary against confirm before collapsing, so this is that value.
	292	+ $postData[$childKey] = $parentValue;
	293	+ }
	294	+ if (is_array($parentValue) && array_key_exists('primary', $parentValue)) {
	295	+ $postData[$fieldKey] = $parentValue['primary'];
	296	+ }
95	297	}
96	298
97		- private function getParams()
98		- {
99		- $url = parse_url(wp_get_referer());
100		- $parameter = [];
101		- if (isset($url['query'])) {
102		- $queries = explode('&', $url['query']);
103		- foreach ($queries as $query) {
104		- list($field, $value) = explode('=', $query);
105		- $parameter[$field] = $value;
106		- }
	299	+ return $postData;
	300	+ }
	301	+
	302	+ /**
	303	+ * Name/Address parts post as one array under the parent key ("parent[first_name]"), so a WP
	304	+ * auth mapping that points at a part's own key (First Name, Last Name) found nothing. Copy each
	305	+ * part's value to its key; the parent value is left as it was.
	306	+ *
	307	+ * @param array $postData
	308	+ * @param array $fields getFields() output
	309	+ *
	310	+ * @return array
	311	+ */
	312	+ private function resolveCompositeChildValues($postData, $fields)
	313	+ {
	314	+ foreach ($fields as $fieldKey => $fieldData) {
	315	+ if (
	316	+ empty($fieldData['childFields'])
	317	+ || !isset($fieldData['type'])
	318	+ || !in_array($fieldData['type'], ['name', 'address'], true)
	319	+ || !empty($fieldData['repeated'])
	320	+ || !isset($postData[$fieldKey])
	321	+ || !is_array($postData[$fieldKey])
	322	+ ) {
	323	+ continue;
	324	+ }
	325	+ foreach ((array) $fieldData['childFields'] as $childFieldRef) {
	326	+ $childKey = is_object($childFieldRef) && isset($childFieldRef->fldKey) ? $childFieldRef->fldKey : '';
	327	+ if (
	328	+ empty($childKey)
	329	+ || !isset($fields[$childKey])
	330	+ || !empty($fields[$childKey]['isDeactive'])
	331	+ || isset($postData[$childKey])
	332	+ || !preg_match('/\[([^\]]+)\]$/', (string) ($fields[$childKey]['name'] ?? ''), $matches)
	333	+ ) {
	334	+ continue;
107	335	}
108		- return $parameter;
	336	+ $value = FieldValueHandler::extractChildValueFromParentValue($postData[$fieldKey], $matches[1], $childKey);
	337	+ if (null !== $value) {
	338	+ $postData[$childKey] = $value;
	339	+ }
	340	+ }
109	341	}
110	342
	343	+ return $postData;
	344	+ }
111	345
112		- public function handleSubmission()
113		- {
114		- $validated = $this->beforeSubmittedValidate();
	346	+ public function handleSubmission()
	347	+ {
	348	+ // CSRF verified via verifySubmissionNonce() before this method is called. All $_POST reads below occur after that verification.
	349	+ $this->fieldNameReplaceOfPost();
115	350
116		- if ($validated === true) {
117		- unset($_POST['hidden_fields']);
	351	+ $validated = $this->beforeSubmittedValidate();
118	352
119		- $redirectPage = '';
120		- $regSuccMsg = '';
	353	+ $validated = apply_filters('bitform_filter_form_validation', $validated, $this->_form_id);
121	354
122		- $existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
123		- if (!is_wp_error($existAuth) && count($existAuth) > 0) {
	355	+ if (true === $validated) {
	356	+ do_action('bitform_validation_success', $this->_form_id);
	357	+ $this->discardHiddenFieldValues();
124	358
125		- $parameter = $this->getParams();
126		- $existAuthFilter = has_filter('bf_wp_user_auth');
	359	+ $redirectPage = '';
	360	+ $regSuccMsg = '';
127	361
128		- if ($existAuthFilter === true) {
129		- $result = apply_filters('bf_wp_user_auth', $existAuth[0], $_POST, $parameter);
	362	+ $existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
	363	+ $unslashed_post = wp_unslash($_POST);
	364	+ if (!is_wp_error($existAuth) && count($existAuth) > 0) {
	365	+ $parameter = $this->getParams();
	366	+ $existAuthFilter = has_filter('bitform_wp_user_auth');
130	367
131		- if (isset($result['auth_type']) && $result['auth_type'] === 'register') {
132		- if (!$result['success']) {
133		- return new WP_Error('errors', __($result['message'], 'bit-form'));
134		- } elseif (isset($result['success'])) {
135		- $redirectPage = $result['redirect_url'];
136		- $regSuccMsg = $result['message'];
137		- $newNonce = wp_create_nonce('bitforms_' . $this->_form_id);
138		- }
139		- } else {
140		- if (!$result['success']) {
141		- return new WP_Error('errors', __($result['message'], 'bit-form'));
142		- } else {
143		- return $result;
144		- }
145		- }
146		- }
147		- }
	368	+ if (true === $existAuthFilter) {
	369	+ $authPostData = $this->resolveConfirmChildValues($unslashed_post);
	370	+ $result = apply_filters('bitform_wp_user_auth', $existAuth[0], $authPostData, $parameter);
148	371
149		- $saveResponse = $this->saveFormEntry($_POST);
150		- if (is_wp_error($saveResponse)) {
151		- return $saveResponse;
	372	+ $result = apply_filters('bitform_filter_wp_user_auth_response', $result, $this->_form_id, $authPostData, $parameter);
	373	+
	374	+ do_action('bitform_wp_user_auth_response', $result, $this->_form_id, $authPostData, $parameter);
	375	+
	376	+ if (isset($result['auth_type']) && 'register' === $result['auth_type']) {
	377	+ if (!$result['success']) {
	378	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
	379	+ } elseif (isset($result['success'])) {
	380	+ $redirectPage = $result['redirectPage'];
	381	+ $regSuccMsg = $result['message'];
152	382	}
153		- $captchaV3Settings = $this->getCaptchaV3Settings();
154		- if ($captchaV3Settings) {
155		- $token = $_POST['g-recaptcha-response'];
156		- $integrationHandler = new IntegrationHandler(0);
157		- $allFormIntegrations = $integrationHandler->getAllIntegration('app', 'gReCaptchaV3');
158		- if (!is_wp_error($allFormIntegrations)) {
159		- foreach ($allFormIntegrations as $integration) {
160		- if (!is_null($integration->integration_type) && $integration->integration_type === 'gReCaptchaV3') {
161		- $integrationDetails = json_decode($integration->integration_details);
162		- $integrationDetails->id = $integration->id;
163		- $reCAPTCHA = $integrationDetails;
164		- }
165		- }
166		- }
167		- if (!empty($reCAPTCHA->secretKey)) {
168		- $gRecaptchaResponse = HttpHelper::post(
169		- 'https://www.google.com/recaptcha/api/siteverify',
170		- ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
171		- );
172		- if ($captchaV3Settings && !empty($saveResponse['triggerData'])) {
173		- $logID = $saveResponse['triggerData']['logID'];
174		- $integId = $reCAPTCHA->id;
175		- $saveApiResponse = new UtilApiResponse();
176		- $saveApiResponse->apiResponse($logID, $integId, ['type_name' => 'ReCaptcha', 'type' => 'v3'], 'success', $gRecaptchaResponse);
177		- }
178		- }
179		- unset($_POST['g-recaptcha-response']);
	383	+ } else {
	384	+ if (!$result['success']) {
	385	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
	386	+ } else {
	387	+ return $result;
180	388	}
181		- if (!empty($redirectPage) && empty($saveResponse['redirectPage']) || $saveResponse['redirectPage'] == null) {
182		- $saveResponse['redirectPage'] = $redirectPage;
	389	+ }
	390	+ }
	391	+ }
	392	+
	393	+ $saveResponse = $this->saveFormEntry($unslashed_post);
	394	+ if (is_wp_error($saveResponse)) {
	395	+ return $saveResponse;
	396	+ }
	397	+
	398	+ $entryID = $saveResponse['entry_id'];
	399	+
	400	+ // transformed dropdown value from string to array
	401	+ $newPost = $this->transformDrpdwnValue($unslashed_post);
	402	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
	403	+ do_action('bitform_submit_success', $this->_form_id, $entryID, $newPost, $filesData);
	404	+
	405	+ $this->logRecaptchaV3Verification($saveResponse);
	406	+ if (!empty($redirectPage) && empty($saveResponse['redirectPage']) || null === $saveResponse['redirectPage']) {
	407	+ $saveResponse['redirectPage'] = $redirectPage;
	408	+ }
	409	+ if (!empty($regSuccMsg) && isset($saveResponse['dflt_message'])) {
	410	+ $saveResponse['message'] = $regSuccMsg;
	411	+ }
	412	+ $saveResponse['new_nonce'] = wp_create_nonce('bitforms_' . $this->_form_id);
	413	+
	414	+ $saveResponse = IntegrationHandler::maybeSetCronForIntegration($saveResponse, 'create');
	415	+ $entryId = $saveResponse['entry_id'];
	416	+
	417	+ $responseMsg = is_array($saveResponse) && !empty($saveResponse) ? $saveResponse : __('Form Submitted Successfully', 'bit-form');
	418	+ $_POST = [];
	419	+ $responseMsg['entry_id'] = $entryId;
	420	+ return $responseMsg;
	421	+ }
	422	+ do_action('bitform_validation_error', $this->_form_id, $validated);
	423	+ return $validated;
	424	+ }
	425	+
	426	+ public function handleUpdateEntry()
	427	+ {
	428	+ // Entry token or capability verified by caller (FrontendAjax::update_entry). All $_POST reads occur after that check.
	429	+ $this->fieldNameReplaceOfPost();
	430	+ $validated = $this->beforeSubmittedValidate(true, true);
	431	+ $validated = apply_filters('bitform_filter_form_validation', $validated, $this->_form_id);
	432	+
	433	+ $entryID = isset($_REQUEST['entryID']) ? sanitize_text_field(wp_unslash($_REQUEST['entryID'])) : null;
	434	+ $GLOBALS['bitform_entry_id'] = $entryID;
	435	+ if (is_null($entryID)) {
	436	+ return new WP_Error('empty_form', __('Entries id is invalid', 'bit-form'));
	437	+ }
	438	+ if (true === $validated) {
	439	+ do_action('bitform_validation_success', $this->_form_id);
	440	+ $this->discardHiddenFieldValues();
	441	+ unset($_POST['entryID']);
	442	+
	443	+ $redirectPage = '';
	444	+ $regSuccMsg = '';
	445	+ $postData = wp_unslash($_POST);
	446	+
	447	+ $existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
	448	+ if (!is_wp_error($existAuth) && count($existAuth) > 0) {
	449	+ $parameter = $this->getParams();
	450	+ $existAuthFilter = has_filter('bitform_wp_user_auth');
	451	+
	452	+ if (true === $existAuthFilter) {
	453	+ $authPostData = $this->resolveConfirmChildValues($postData);
	454	+ $result = apply_filters('bitform_wp_user_auth', $existAuth[0], $authPostData, $parameter);
	455	+
	456	+ if (isset($result['auth_type']) && 'register' === $result['auth_type']) {
	457	+ if (!$result['success']) {
	458	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
	459	+ } elseif (isset($result['success'])) {
	460	+ $redirectPage = $result['redirectPage'];
	461	+ $regSuccMsg = $result['message'];
183	462	}
184		- if (!empty($regSuccMsg) && isset($saveResponse['dflt_message'])) {
185		- $saveResponse['message'] = $regSuccMsg;
	463	+ } else {
	464	+ if (!$result['success']) {
	465	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
	466	+ } else {
	467	+ return $result;
186	468	}
187		- $saveResponse = IntegrationHandler::maybeSetCronForIntegration($saveResponse, 'create');
	469	+ }
	470	+ }
	471	+ }
188	472
189		- $responseMsg = is_array($saveResponse) && !empty($saveResponse) ? $saveResponse : __('Form Submitted Successfully', 'bit-form');
190		- if (isset($newNonce)) {
191		- $responseMsg['new_nonce'] = $newNonce;
192		- }
193		- $_POST = array();
	473	+ $updateResponse = $this->updateFormEntry(wp_unslash($_POST), $this->getFormID(), $entryID);
	474	+ if (is_wp_error($updateResponse)) {
	475	+ return $updateResponse;
	476	+ }
194	477
195		- return $responseMsg;
196		- }
	478	+ // transformed dropdown value from string to array
	479	+ $newPost = $this->transformDrpdwnValue($postData);
	480	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
197	481
198		- return $validated;
	482	+ //TO DO:: submit success action temporarily added for solution of a issue
	483	+ do_action('bitform_submit_success', $this->_form_id, $entryID, $newPost, $filesData);
	484	+ do_action('bitform_update_success', $this->_form_id, $entryID, $newPost, $filesData);
	485	+
	486	+ $this->logRecaptchaV3Verification($updateResponse);
	487	+ if (!empty($redirectPage) && empty($updateResponse['redirectPage']) || null === $updateResponse['redirectPage']) {
	488	+ $updateResponse['redirectPage'] = $redirectPage;
	489	+ }
	490	+ if (!empty($regSuccMsg) && isset($updateResponse['dflt_message'])) {
	491	+ $updateResponse['message'] = $regSuccMsg;
	492	+ }
	493	+ $updateResponse['new_nonce'] = wp_create_nonce('bitforms_' . $this->_form_id);
	494	+ $updateResponse = IntegrationHandler::maybeSetCronForIntegration($updateResponse, 'update');
	495	+ $entryId = $updateResponse['entry_id'];
	496	+
	497	+ $responseMsg = is_array($updateResponse) && !empty($updateResponse) ? $updateResponse : __('Entry Update Successfully', 'bit-form');
	498	+
	499	+ $_POST = [];
	500	+ $responseMsg['entry_id'] = $entryId;
	501	+ return $responseMsg;
199	502	}
	503	+ do_action('bitform_validation_error', $this->_form_id, $validated);
	504	+ return $validated;
	505	+ }
200	506
201		- public function validateFormSubmission($submitted_data)
202		- {
203		- $hidden_fields = isset($submitted_data['hidden_fields']) ? $submitted_data['hidden_fields'] : '';
204		- $submitted_fields = $this->getSubmittedFields($submitted_data);
205		- $form_fields = $this->getFields();
206		- $form_fields_names = array_keys($form_fields);
207		- if ($this->isGCLIDEnabled()) {
208		- array_push($form_fields_names, 'GCLID');
	507	+ /**
	508	+ * Drop the posted `hidden_fields` transport key and, when the form opts in, the values of
	509	+ * the fields it names.
	510	+ *
	511	+ * A hidden field keeps its typed value in the DOM, so the browser still submits it. Runs
	512	+ * here because it is the last point before entry, notifications and integrations are built
	513	+ * from $_POST.
	514	+ *
	515	+ * @return void
	516	+ */
	517	+ private function discardHiddenFieldValues()
	518	+ {
	519	+ // CSRF verified upstream via verifySubmissionNonce(); $_POST is only being narrowed here.
	520	+ $rawHiddenFields = isset($_POST['hidden_fields']) ? wp_unslash($_POST['hidden_fields']) : '';
	521	+ unset($_POST['hidden_fields']);
	522	+
	523	+ if (!$this->shouldDiscardHiddenFieldValues()) {
	524	+ return;
	525	+ }
	526	+ $hiddenFieldKeys = FrontendHelpers::parseHiddenFieldKeys($rawHiddenFields);
	527	+ if (empty($hiddenFieldKeys)) {
	528	+ return;
	529	+ }
	530	+
	531	+ $formFields = $this->getFields();
	532	+ foreach ($hiddenFieldKeys as $fieldKey) {
	533	+ if (!isset($formFields[$fieldKey])) {
	534	+ continue;
	535	+ }
	536	+ $field = $formFields[$fieldKey];
	537	+ // The posted list also names builder-hidden and hidden-type fields, which carry a value
	538	+ // on purpose. Only what conditional logic hid is discarded.
	539	+ if ('hidden' === $field['type'] || !empty($field['valid']['hide'])) {
	540	+ continue;
	541	+ }
	542	+ // Hiding flags a repeater child once, not per row, so discarding would wipe the column
	543	+ // in every row.
	544	+ if (!empty($field['repeated'])) {
	545	+ continue;
	546	+ }
	547	+ // Calculation and tracking fields opt out.
	548	+ if (!empty($field['valid']['keepValueWhenHidden'])) {
	549	+ continue;
	550	+ }
	551	+ // A composite child (name/address/confirm) posts nested under its parent key.
	552	+ if (!empty($field['parentFieldKey'])) {
	553	+ $this->discardCompositeChildValue($formFields, $field, $fieldKey);
	554	+ continue;
	555	+ }
	556	+ unset($_POST[$fieldKey], $_FILES[$fieldKey]);
	557	+ }
	558	+ }
	559	+
	560	+ /**
	561	+ * @param array $formFields
	562	+ * @param array $field the child field's config
	563	+ * @param string $fieldKey the child field's key
	564	+ *
	565	+ * @return void
	566	+ */
	567	+ private function discardCompositeChildValue($formFields, $field, $fieldKey)
	568	+ {
	569	+ $parentKey = $field['parentFieldKey'];
	570	+ if (!isset($_POST[$parentKey]) || !is_array($_POST[$parentKey])) {
	571	+ return;
	572	+ }
	573	+ $parentName = isset($formFields[$parentKey]['name']) ? $formFields[$parentKey]['name'] : '';
	574	+ $childName = FieldValueHandler::deriveChildName(isset($field['name']) ? $field['name'] : '', $parentName);
	575	+ unset($_POST[$parentKey][$childName], $_POST[$parentKey][$fieldKey]);
	576	+ }
	577	+
	578	+ /**
	579	+ * @return bool
	580	+ */
	581	+ private function shouldDiscardHiddenFieldValues()
	582	+ {
	583	+ $formInfo = $this->getFormInfo();
	584	+ if (!is_object($formInfo) || !isset($formInfo->submissionSettings)) {
	585	+ return false;
	586	+ }
	587	+ $submissionSettings = (object) $formInfo->submissionSettings;
	588	+
	589	+ return !empty($submissionSettings->discardHiddenFieldValues);
	590	+ }
	591	+
	592	+ public function validateFormSubmission($submitted_data)
	593	+ {
	594	+ $hidden_fields = FrontendHelpers::parseHiddenFieldKeys(isset($submitted_data['hidden_fields']) ? $submitted_data['hidden_fields'] : '');
	595	+ $submitted_fields = $this->getSubmittedFields($submitted_data);
	596	+ $form_fields = $this->getFields();
	597	+ $form_fields_names = array_keys($form_fields);
	598	+ if ($this->isGCLIDEnabled()) {
	599	+ array_push($form_fields_names, 'GCLID');
	600	+ }
	601	+ foreach ($submitted_fields as $field) {
	602	+ if ('hidden_fields' !== $field && !in_array($field, $form_fields_names) || FrontendHelpers::isFieldHidden($hidden_fields, $field)) {
	603	+ unset($submitted_data[$field]);
	604	+ }
	605	+ }
	606	+ return $submitted_data;
	607	+ }
	608	+
	609	+ public function beforeSubmittedValidate($verifyCaptcha = true, $isEntryEdit = false)
	610	+ {
	611	+ if ($this->verifySubmissionNonce()) {
	612	+ if ($this->isExist()) {
	613	+ $isRestricted = $this->checkSubmissionRestriction(true, $isEntryEdit);
	614	+ if ($isRestricted && !empty($isRestricted)) {
	615	+ return new WP_Error('spam_detection', $isRestricted[0]);
209	616	}
210		- foreach ($submitted_fields as $key => $field) {
211		- if ($field !== 'hidden_fields' && !in_array($field, $form_fields_names) || strpos($hidden_fields, $field) !== false) {
212		- unset($submitted_data[$field]);
213		- }
	617	+ $postData = wp_unslash($_POST);
	618	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
	619	+ $isHoneypot = apply_filters('bitform_check_honeypot', false, $this->_form_id, $postData);
	620	+ if ($isHoneypot) {
	621	+ return new WP_Error('spam_detection', __('Token verification failed', 'bit-form'));
214	622	}
215		- return $submitted_data;
216		- }
	623	+ $formCurrentStep = isset($_POST['form-current-step']) ? sanitize_text_field(wp_unslash($_POST['form-current-step'])) : null;
	624	+ // TODO: Temporary parameter to skip captcha verification in step change of multi step form
	625	+ if ($verifyCaptcha) {
	626	+ $verifyGRecaptchaResult = $this->verifyGRecaptcha();
	627	+ if (is_wp_error($verifyGRecaptchaResult)) {
	628	+ return $verifyGRecaptchaResult;
	629	+ }
	630	+ $verifyHCaptchaResult = $this->verifyHCaptcha();
	631	+ if (is_wp_error($verifyHCaptchaResult)) {
	632	+ return $verifyHCaptchaResult;
	633	+ }
	634	+ /* Implement Turnstile Captcha start */
	635	+ $verifyTurnstileCaptchaResult = $this->verifyTurnstileCaptcha();
	636	+ if (is_wp_error($verifyTurnstileCaptchaResult)) {
	637	+ return $verifyTurnstileCaptchaResult;
	638	+ }
	639	+ }
	640	+ /* Implement Turnstile Captcha end */
217	641
218		- public function beforeSubmittedValidate()
219		- {
220		- if ($this->verifySubmissionNonce()) {
221		- if ($this->isExist()) {
222		- $isRestricted = $this->checkSubmissionRestriction();
223		- if ($isRestricted && !empty($isRestricted)) {
224		- return new WP_Error('spam_detection', $isRestricted[0]);
	642	+ $existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
	643	+
	644	+ // check if user is already logged in and form has auth integration
	645	+ do_action('bitform_checked_exist_auth', $this->_form_id, $existAuth);
	646	+ if (!is_wp_error($existAuth) && count($existAuth) > 0 && is_user_logged_in()) {
	647	+ return new WP_Error('auth_error', __('You are already logged in', 'bit-form'));
	648	+ }
	649	+ $validateForm = $this->validateFormSubmission($postData);
	650	+ $validateFormFiles = $this->validateFormSubmission($filesData);
	651	+ $validateForm = array_merge($validateForm, $validateFormFiles);
	652	+ // Validate only provably-rendered fields: a field stranded in form_content->fields
	653	+ // with no layout entry (orphan) is never shown to the user and must not block
	654	+ // submission. getRenderedFields() unions ALL breakpoints × steps × nested layouts
	655	+ // + childFields of rendered parents, derives only from DB-stored form_content,
	656	+ // and fails closed (returns all fields) when the layout is unusable.
	657	+ $form_fields = $this->getRenderedFields();
	658	+ // check if form-current-step is set and form is multi-step
	659	+ $formCurrentStep = isset($_POST['form-current-step']) ? sanitize_text_field(wp_unslash($_POST['form-current-step'])) : null;
	660	+ if (!is_null($formCurrentStep)) {
	661	+ // Narrow validation to the current step's fields. SECURITY: the step
	662	+ // key set unions ALL breakpoints (lg/md/sm) — an md/sm-only field was
	663	+ // previously null-skipped by the validator (silent bypass). A forged
	664	+ // step index or malformed layout skips the narrowing entirely so every
	665	+ // rendered field stays validated (fail closed).
	666	+ $formContents = $this->getFormContent();
	667	+ $layout = isset($formContents->layout) ? $formContents->layout : null;
	668	+ $stepIndex = (int) $formCurrentStep - 1;
	669	+ if (is_array($layout) && isset($layout[$stepIndex]->layout) && is_object($layout[$stepIndex]->layout)) {
	670	+ $stepLayout = $layout[$stepIndex]->layout;
	671	+ $nestedLayout = isset($formContents->nestedLayout) && is_object($formContents->nestedLayout)
	672	+ ? $formContents->nestedLayout : null;
	673	+ $stepKeys = [];
	674	+ foreach (['lg', 'md', 'sm'] as $brkpnt) {
	675	+ if (!isset($stepLayout->{$brkpnt}) || !is_array($stepLayout->{$brkpnt})) {
	676	+ continue;
	677	+ }
	678	+ foreach ($stepLayout->{$brkpnt} as $lay) {
	679	+ if (!is_object($lay) || !isset($lay->i)) {
	680	+ continue;
225	681	}
226		- if ($this->isTrappedInHoneypot()) {
227		- return new WP_Error('spam_detection', __('Token verification failed', 'bit-form'));
228		- }
229		- $captchaSettings = $this->getCaptchaSettings();
230		- $captchaV3Settings = $this->getCaptchaV3Settings();
231		- if ($captchaSettings || $captchaV3Settings) {
232		- $token = $_POST['g-recaptcha-response'];
233		- if (!isset($_POST['g-recaptcha-response'])) {
234		- return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	682	+ $fk = $lay->i;
	683	+ $stepKeys[$fk] = true;
	684	+ if (!is_null($nestedLayout) && isset($nestedLayout->{$fk})) {
	685	+ foreach (['lg', 'md', 'sm'] as $nBrkpnt) {
	686	+ if (!isset($nestedLayout->{$fk}->{$nBrkpnt}) || !is_array($nestedLayout->{$fk}->{$nBrkpnt})) {
	687	+ continue;
235	688	}
236		- $integrationHandler = new IntegrationHandler(0);
237		- $allFormIntegrations = $integrationHandler->getAllIntegration('app', $captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3');
238		- if (!is_wp_error($allFormIntegrations)) {
239		- foreach ($allFormIntegrations as $integration) {
240		- if (!is_null($integration->integration_type) && $integration->integration_type === ($captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3')) {
241		- $integrationDetails = json_decode($integration->integration_details);
242		- $integrationDetails->id = $integration->id;
243		- $reCAPTCHA = $integrationDetails;
244		- }
245		- }
	689	+ foreach ($nestedLayout->{$fk}->{$nBrkpnt} as $nestedLay) {
	690	+ if (is_object($nestedLay) && isset($nestedLay->i)) {
	691	+ $stepKeys[$nestedLay->i] = true;
	692	+ }
246	693	}
247		- if (!empty($reCAPTCHA->secretKey)) {
248		- $gRecaptchaResponse = HttpHelper::post(
249		- 'https://www.google.com/recaptcha/api/siteverify',
250		- ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
251		- );
252		- $isgReCaptchaVerified = false;
253		- if (!is_wp_error($gRecaptchaResponse)) {
254		- if (
255		- $captchaV3Settings
256		- && !empty($gRecaptchaResponse->score)
257		- && ((float) $gRecaptchaResponse->score < (float) $captchaV3Settings->score)
258		- ) {
259		- wp_send_json_error(
260		- __(
261		- $captchaV3Settings->message,
262		- 'bit-form'
263		- )
264		- );
265		- }
266		-
267		- $isgReCaptchaVerified = $gRecaptchaResponse->success;
268		- }
269		- if (!$isgReCaptchaVerified) {
270		- return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
271		- }
272		- }
	694	+ }
273	695	}
274		- $existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
275		- if (!is_wp_error($existAuth) && count($existAuth) > 0 && is_user_logged_in()) {
276		- return new WP_Error('auth_error', __('You are already logged in', 'bit-form'));
	696	+ }
	697	+ }
	698	+ // Name/Address/Email/Password children live outside layouts; a child
	699	+ // is part of this step iff its parent is.
	700	+ self::expandChildFieldKeys($stepKeys, $form_fields);
	701	+ if (!empty($stepKeys)) {
	702	+ $step_fields = [];
	703	+ foreach (array_keys($stepKeys) as $fk) {
	704	+ if (isset($form_fields[$fk])) {
	705	+ $step_fields[$fk] = $form_fields[$fk];
277	706	}
278		- $validateForm = $this->validateFormSubmission($_POST);
279		- $form_fields = $this->getFields();
280		- $formFieldValidator = new FormFieldValidator($form_fields, $_POST, $_FILES);
281		- $validUniuqFields = [];
	707	+ }
	708	+ $form_fields = $step_fields;
	709	+ }
	710	+ }
	711	+ }
	712	+ // Only an edit may satisfy a required upload/signature from a `_old` marker.
	713	+ $editedEntryID = $isEntryEdit && isset($_REQUEST['entryID'])
	714	+ ? sanitize_text_field(wp_unslash($_REQUEST['entryID']))
	715	+ : null;
	716	+ $formFieldValidator = new FormFieldValidator($form_fields, $postData, $filesData, $editedEntryID);
	717	+ $validUniuqFields = [];
	718	+ $existFilter = has_filter('bitform_check_duplicate_entry');
	719	+ if (true === $existFilter) {
	720	+ $validUniuqFields = apply_filters('bitform_check_duplicate_entry', $form_fields, $postData);
282	721
283		- $existFilter = has_filter('bf_check_duplicate_entry');
284		- if ($existFilter === true) {
285		- $validUniuqFields = apply_filters('bf_check_duplicate_entry', $form_fields, $_POST);
286		- }
	722	+ $fieldKeys = array_keys($validUniuqFields);
	723	+ $form_fields_keys = array_keys($form_fields);
	724	+ $uniqueFields = [];
	725	+ foreach ($fieldKeys as $key) {
	726	+ if (in_array($key, $form_fields_keys)) {
	727	+ $uniqueFields[] = $form_fields[$key];
	728	+ }
	729	+ }
	730	+ do_action('bitform_Unique_entry', $uniqueFields, $validUniuqFields, $this->_form_id, $postData);
	731	+ }
	732	+ $validateField = $formFieldValidator->validate('create', $this->_form_id);
287	733
288		- $validateField = $formFieldValidator->validate('create', $this->_form_id);
289		- if ($validateForm && $validateField && count($validUniuqFields) == 0) {
290		-
291		- return true;
292		- } else {
293		- $error = __('Please submit form with valid fields', 'bit-form');
294		- if (!$validateForm) {
295		- $errorMessages = $error;
296		- } else if (count($formFieldValidator->getMessage()) > 0) {
297		- $errorMessages = $formFieldValidator->getMessage();
298		- } else {
299		- $errorMessages = count($validUniuqFields) == 0 ? $error : $validUniuqFields;
300		- }
301		- return new WP_Error('validation_error', $errorMessages);
302		- }
303		- }
304		- return new WP_Error('unknown_form', __('Form does not exist', 'bit-form'));
	734	+ if ($validateForm && $validateField && 0 === count($validUniuqFields)) {
	735	+ return true;
305	736	} else {
306		- return new WP_Error('token_expired', __('Token expired', 'bit-form'));
	737	+ $error = __('Please submit form with valid fields', 'bit-form');
	738	+ if (!$validateForm) {
	739	+ $errorMessages = $error;
	740	+ } elseif (count($formFieldValidator->getMessage()) > 0) {
	741	+ $errorMessages = $formFieldValidator->getMessage();
	742	+ } else {
	743	+ $errorMessages = 0 === count($validUniuqFields) ? $error : $validUniuqFields;
	744	+ }
	745	+ return new WP_Error('validation_error', $errorMessages);
307	746	}
	747	+ }
	748	+ return new WP_Error('unknown_form', __('Form does not exist', 'bit-form'));
	749	+ } else {
	750	+ return new WP_Error('token_expired', __('Token expired', 'bit-form'));
308	751	}
	752	+ }
309	753
310		- public function verifySubmissionNonce()
311		- {
312		- if (!isset($_POST['bitforms_token'])) {
313		- return false;
314		- }
315		- $token = sanitize_text_field($_POST['bitforms_token']);
316		- unset($_POST['_ajax_nonce'], $_POST['action'], $_POST['bitforms_id'], $_POST['bitforms_token']);
317		- if (!is_user_logged_in()) {
318		- return true;
319		- }
320		- return wp_verify_nonce($token, "bitforms_{$this->form_id}");
	754	+ /**
	755	+ * Whether the IP already has a completed entry; drafts (status 9) don't count.
	756	+ *
	757	+ * @param string $ipAddress Visitor IP
	758	+ *
	759	+ * @return bool
	760	+ */
	761	+ private function hasCompletedEntryFromIp($ipAddress)
	762	+ {
	763	+ $storedIp = IpTool::storageValue($ipAddress);
	764	+ if ('' === $storedIp) {
	765	+ return false;
321	766	}
322	767
323		- public function setViewCount()
324		- {
325		- if (!current_user_can('manage_options')) {
326		- $update_status = $this->formModel->update(
327		- array(
328		- 'views' => intval(static::$form[0]->views) + 1
329		- ),
330		- array(
331		- 'id' => $this->form_id
332		- )
333		- );
334		- }
	768	+ $entries = (new FormEntryModel())->get(
	769	+ ['status'],
	770	+ [
	771	+ 'form_id' => $this->form_id,
	772	+ 'user_ip' => $storedIp,
	773	+ ]
	774	+ );
	775	+
	776	+ if (is_wp_error($entries) || !is_array($entries)) {
	777	+ return false;
335	778	}
336	779
337		- public function checkSubmissionRestriction()
338		- {
339		- $formContents = $this->getFormContent();
340		- $fromRestrictionSetitingsEnabled = empty($formContents->additional->enabled) ? null : $formContents->additional->enabled;
341		- $fromRestrictionSetitings = empty($formContents->additional->settings) ? null : $formContents->additional->settings;
342		- if (is_null($formContents->additional->enabled) || is_null($formContents->additional->settings)) {
343		- return false;
344		- }
345		- $restrictionMessage = array();
346		- $ipTool = new IpTool();
347		- $ipAddress = $ipTool->getIP();
348		- foreach ($fromRestrictionSetitingsEnabled as $restrictionKey => $isEnabled) {
349		- if ($isEnabled) {
350		- if ($restrictionKey === 'entry_limit' && isset($fromRestrictionSetitings->{$restrictionKey})) {
351		- $formEntry = new FormEntryModel();
352		- $countResult = $formEntry->count(
353		- array(
354		- 'form_id' => $this->form_id
355		- )
356		- );
357		- $count = !empty($countResult[0]) && !empty($countResult[0]->count) ? $countResult[0]->count : false;
358		- if ($count && $count >= intval($fromRestrictionSetitings->{$restrictionKey})) {
359		- $restrictionMessage[] = __('Sorry!! Entry limit exceeded', "bit-form");
360		- }
361		- }
362		- if ($restrictionKey === 'onePerIp') {
363		- $formEntry = new FormEntryModel();
364		- $countResult = $formEntry->count(
365		- array(
366		- 'form_id' => $this->form_id,
367		- 'user_ip' => ip2long($ipAddress)
368		- )
369		- );
370		- $count = !empty($countResult[0]) && !empty($countResult[0]->count) ? $countResult[0]->count : false;
	780	+ foreach ($entries as $entry) {
	781	+ if (9 !== (int) $entry->status) {
	782	+ return true;
	783	+ }
	784	+ }
371	785
372		- if ($count && $count > 0) {
373		- $restrictionMessage[] = __('Sorry!! You have already submitted', "bit-form");
374		- }
375		- }
376		- if ($restrictionKey === 'is_login' && get_current_user_id() === 0) {
377		- $restrictionMessage[] = __($fromRestrictionSetitings->is_login->message, "bit-form");
378		- }
379		- if ($restrictionKey === 'empty_submission') {
380		- $isEmpty = $this->checkEmptySubmission($_POST, $_FILES);
381		- if ($isEmpty) {
382		- $restrictionMessage[] = __($fromRestrictionSetitings->empty_submission->message, "bit-form");
383		- }
384		- }
385		- if ($restrictionKey === 'restrict_form' && isset($fromRestrictionSetitings->{$restrictionKey})) {
386		- $day = empty($fromRestrictionSetitings->{$restrictionKey}->day) ? null : $fromRestrictionSetitings->{$restrictionKey}->day;
387		- $date = empty($fromRestrictionSetitings->{$restrictionKey}->date) ? null : $fromRestrictionSetitings->{$restrictionKey}->date;
388		- $time = empty($fromRestrictionSetitings->{$restrictionKey}->time) ? null : $fromRestrictionSetitings->{$restrictionKey}->time;
	786	+ return false;
	787	+ }
389	788
390		- $isdayOk = $isdateOk = $istimeOk = true;
391		- $dayNotOkMsg = $dateNotOkMsg = $timeNotOkMsg = '';
392		- $dateTimeHelper = new DateTimeHelper();
393		- if (
394		- !empty($day)
395		- && is_array($day)
396		- && (in_array("Friday", $day)
397		- || in_array("Saturday", $day)
398		- || in_array("Sunday", $day)
399		- || in_array("Monday", $day)
400		- || in_array("Tuesday", $day)
401		- || in_array("Wednesday", $day)
402		- || in_array("Thursday", $day))
403		- && (!in_array($dateTimeHelper->getDay('full-name'), $day))
404		- ) {
405		- $isdayOk = false;
406		- $dayMsgVarsFormat = '';
407		- foreach ($day as $dayIndex => $dayValue) {
408		- if ($dayIndex > 0) {
409		- $dayMsgVarsFormat .= ', ';
410		- }
411		- $dayMsgVarsFormat .= '%s';
412		- }
413		- $dayNotOkMsg = vsprintf(__("in $dayMsgVarsFormat", 'bit-form'), $day);
414		- }
415		- if (
416		- !empty($day)
417		- && is_array($day)
418		- && (in_array("Custom", $day))
419		- ) {
420		- $startDate = empty($date->from) ? '00-00-0000' : $date->from;
421		- $endDate = empty($date->to) ? '00-00-0000' : $date->to;
422		- if (!empty($date->from) && strpos($startDate, 'T') !== false) {
423		- $startDate = $dateTimeHelper->getDate($startDate, false, null, 'm-d-Y');
424		- }
425		- if (!empty($date->to) && strpos($endDate, 'T') !== false) {
426		- $endDate = $dateTimeHelper->getDate($endDate, false, null, 'm-d-Y');
427		- }
428		- $currentDate = $dateTimeHelper->getDate(null, null, null, 'm-d-Y');
429		- if (!($currentDate >= $startDate && $currentDate <= $endDate)) {
430		- $isdateOk = false;
431		- $dateNotOkMsg = sprintf(__("within %s to %s", 'bit-form'), $startDate, $endDate);
432		- }
433		- }
	789	+ private function verifyGRecaptcha()
	790	+ {
	791	+ $captchaSettings = $this->getCaptchaSettings();
	792	+ $captchaV3Settings = $this->getCaptchaV3Settings();
	793	+ if (!$captchaSettings && !$captchaV3Settings) {
	794	+ return;
	795	+ }
434	796
435		- if (!empty($time)) {
436		- $startTime = empty($time->from) ? '00:00' : $time->from;
437		- $endTime = empty($time->to) ? '23:59.999' : $time->to;
438		- $currentTime = $dateTimeHelper->getTime(null, null, null, 'H:i');
439		- if (!($currentTime >= $startTime && $currentTime <= $endTime)) {
440		- $istimeOk = false;
441		- $startTime = $dateTimeHelper->getTime($startTime, 'H:i', null);
442		- $endTime = $dateTimeHelper->getTime($endTime, 'H:i', null);
443		- $isTimeOk = false;
444		- $timeNotOkMsg = sprintf(__("%s to %s", 'bit-form'), $startTime, $endTime);
445		- }
446		- }
	797	+ if (!isset($_POST['g-recaptcha-response'])) {
	798	+ return new WP_Error('spam_detection', __('Please recheck your reCaptcha Configuration', 'bit-form'));
	799	+ }
	800	+ $token = sanitize_text_field(wp_unslash($_POST['g-recaptcha-response']));
447	801
448		- if (!($isdateOk && $isdayOk && $istimeOk)) {
449		- if (!$isdayOk) {
450		- $restrictionMessage[] = !empty($timeNotOkMsg) ? sprintf(__("Form is available %s From %s", 'bit-form'), $dayNotOkMsg, $timeNotOkMsg) :
451		- sprintf(__("Form is available %s", 'bit-form'), $dayNotOkMsg, $timeNotOkMsg);
452		- } elseif (!$isdateOk) {
453		- $restrictionMessage[] = !empty($timeNotOkMsg) ? sprintf(__("Form is available %s From %s", 'bit-form'), $dateNotOkMsg, $timeNotOkMsg) :
454		- sprintf(__("Form is available %s", 'bit-form'), $dateNotOkMsg, $timeNotOkMsg);
455		- } elseif (!$istimeOk) {
456		- $restrictionMessage[] = sprintf(__("Form is available on %s", 'bit-form'), $timeNotOkMsg);
457		- }
458		- }
459		- }
460		- if ($restrictionKey === 'blocked_ip' && isset($fromRestrictionSetitings->{$restrictionKey})) {
461		- $isIpBlocked = false;
462		- foreach ($fromRestrictionSetitings->{$restrictionKey} as $ipIndex => $ipDetails) {
463		- if (!empty($ipDetails->status) && $ipDetails->status && !empty($ipDetails->ip) && $ipDetails->ip === $ipAddress) {
464		- $isIpBlocked = true;
465		- break;
466		- }
467		- }
468		- if ($isIpBlocked) {
469		- $restrictionMessage[] = sprintf(__("Sorry!! Your IP address is %s, Blocked from submitting the form", 'bit-form'), $ipAddress);
470		- }
471		- }
472		- if ($restrictionKey === 'private_ip' && isset($fromRestrictionSetitings->{$restrictionKey})) {
473		- $isIpWhiteListed = false;
474		- foreach ($fromRestrictionSetitings->{$restrictionKey} as $ipIndex => $ipDetails) {
475		- if (!empty($ipDetails->status) && $ipDetails->status && !empty($ipDetails->ip) && $ipDetails->ip === $ipAddress) {
476		- $isIpWhiteListed = true;
477		- break;
478		- }
479		- }
480		- if (!$isIpWhiteListed) {
481		- $restrictionMessage[] = sprintf(__("Sorry!! Your IP address is %s, Blocked from submitting the form", 'bit-form'), $ipAddress);
482		- }
483		- }
484		- }
485		- }
486		- return $restrictionMessage;
	802	+ $appType = $captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3';
	803	+ $reCAPTCHA = $this->getCaptchaApp($appType);
	804	+
	805	+ // Fail closed: no secret key must not skip verification.
	806	+ if (empty($reCAPTCHA->secretKey)) {
	807	+ Log::debug_log("reCAPTCHA ({$appType}) is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	808	+ return new WP_Error('spam_detection', __('reCAPTCHA is not configured. Please contact the site administrator.', 'bit-form'));
487	809	}
488	810
489		- public function honeypotTrap()
490		- {
491		- if ($this->isHoneypotActive()) {
492		- $time = \time();
493		- $token = base64_encode(base64_encode($time . "." . wp_hash(wp_get_session_token() . $time)));
494		- $script = "document.addEventListener('DOMContentLoaded',(event)=>{ let frm=document.getElementById('form-{$this->_form_identifier}'),token=document.createElement('input');token.type='hidden',token.name='token',token.value='$token',frm.prepend(token);let nam=document.createElement('input');nam.type='text',nam.className='vis-n',nam.name='{$token}.name',frm.prepend(nam);let em=document.createElement('input');em.type='email',em.className='vis-n',em.name='{$token}.email',frm.prepend(em);let msg=document.createElement('textarea');msg.className='vis-n',msg.name='{$token}.message',frm.prepend(msg);})";
495		- wp_add_inline_script('bitforms-frontend-script', $script, 'after');
	811	+ $gRecaptchaResponse = HttpHelper::post(
	812	+ 'https://www.google.com/recaptcha/api/siteverify',
	813	+ ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
	814	+ );
	815	+ if (is_wp_error($gRecaptchaResponse)) {
	816	+ return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	817	+ }
	818	+
	819	+ // Tokens are single-use; keep this verdict for the log.
	820	+ if ('gReCaptchaV3' === $appType) {
	821	+ $this->recaptchaV3Verification = ['integId' => $reCAPTCHA->id, 'response' => $gRecaptchaResponse];
	822	+ }
	823	+
	824	+ if ($captchaV3Settings && self::isRecaptchaScoreTooLow($gRecaptchaResponse, $captchaV3Settings)) {
	825	+ wp_send_json_error(
	826	+ sanitize_text_field((string) $captchaV3Settings->message)
	827	+ );
	828	+ }
	829	+
	830	+ if (!is_object($gRecaptchaResponse) || empty($gRecaptchaResponse->success)) {
	831	+ return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	832	+ }
	833	+ }
	834	+
	835	+ /**
	836	+ * Connected captcha app from App Settings, with its integration id.
	837	+ *
	838	+ * @param string $appType gReCaptcha, gReCaptchaV3, hcaptcha or turnstileCaptcha
	839	+ *
	840	+ * @return object|null
	841	+ */
	842	+ private function getCaptchaApp($appType)
	843	+ {
	844	+ $apps = (new IntegrationHandler(0))->getAllIntegration('app', $appType);
	845	+ if (is_wp_error($apps) || !is_array($apps)) {
	846	+ return null;
	847	+ }
	848	+
	849	+ $reCAPTCHA = null;
	850	+ foreach ($apps as $integration) {
	851	+ if ($appType !== $integration->integration_type) {
	852	+ continue;
	853	+ }
	854	+ $details = Utilities::jsonObj($integration->integration_details);
	855	+ if (is_object($details)) {
	856	+ $details->id = $integration->id;
	857	+ $reCAPTCHA = $details;
	858	+ }
	859	+ }
	860	+
	861	+ return $reCAPTCHA;
	862	+ }
	863	+
	864	+ /**
	865	+ * Log the reCAPTCHA v3 verdict for this submission.
	866	+ *
	867	+ * @param array $saveResponse Entry save/update response
	868	+ *
	869	+ * @return void
	870	+ */
	871	+ private function logRecaptchaV3Verification($saveResponse)
	872	+ {
	873	+ if (!$this->getCaptchaV3Settings()) {
	874	+ return;
	875	+ }
	876	+ unset($_POST['g-recaptcha-response']);
	877	+
	878	+ if (empty($this->recaptchaV3Verification) || empty($saveResponse['triggerData']['logID'])) {
	879	+ return;
	880	+ }
	881	+
	882	+ $response = $this->recaptchaV3Verification['response'];
	883	+ $status = is_object($response) && !empty($response->success) ? 'success' : 'error';
	884	+ (new UtilApiResponse())->apiResponse(
	885	+ $saveResponse['triggerData']['logID'],
	886	+ $this->recaptchaV3Verification['integId'],
	887	+ ['type_name' => 'ReCaptcha', 'type' => 'v3'],
	888	+ $status,
	889	+ $response
	890	+ );
	891	+ }
	892	+
	893	+ /**
	894	+ * Whether the v3 score is below tolerance; 0.0 counts, blank tolerance means 0.6.
	895	+ *
	896	+ * @param mixed $response Decoded siteverify response
	897	+ * @param mixed $settings Form's recaptchav3 settings
	898	+ *
	899	+ * @return bool
	900	+ */
	901	+ private static function isRecaptchaScoreTooLow($response, $settings)
	902	+ {
	903	+ if (!is_object($response) || !isset($response->score) || !is_numeric($response->score)) {
	904	+ return false;
	905	+ }
	906	+
	907	+ $threshold = is_object($settings) && isset($settings->score) && is_numeric($settings->score)
	908	+ ? (float) $settings->score
	909	+ : 0.6;
	910	+
	911	+ return (float) $response->score < $threshold;
	912	+ }
	913	+
	914	+ private function verifyHCaptcha()
	915	+ {
	916	+ if (!$this->isFieldTypeExist('hcaptcha')) {
	917	+ return;
	918	+ }
	919	+
	920	+ if (!isset($_POST['h-captcha-response'])) {
	921	+ return new WP_Error('spam_detection', __('Please verify hCaptcha', 'bit-form'));
	922	+ }
	923	+ $token = sanitize_text_field(wp_unslash($_POST['h-captcha-response']));
	924	+ $hCaptcha = $this->getCaptchaApp('hcaptcha');
	925	+
	926	+ // Fail closed: no secret key must not skip verification.
	927	+ if (empty($hCaptcha->secretKey)) {
	928	+ Log::debug_log("hCaptcha is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	929	+ return new WP_Error('spam_detection', __('hCaptcha is not configured. Please contact the site administrator.', 'bit-form'));
	930	+ }
	931	+
	932	+ $hCaptchaResponse = HttpHelper::post(
	933	+ 'https://api.hcaptcha.com/siteverify',
	934	+ [
	935	+ 'secret' => $hCaptcha->secretKey,
	936	+ 'response' => $token,
	937	+ 'remoteip' => (isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '')
	938	+ ]
	939	+ );
	940	+
	941	+ if (is_wp_error($hCaptchaResponse) || !is_object($hCaptchaResponse) || empty($hCaptchaResponse->success)) {
	942	+ return new WP_Error('spam_detection', __('hCaptcha verification failed', 'bit-form'));
	943	+ }
	944	+ }
	945	+
	946	+ private function verifyTurnstileCaptcha()
	947	+ {
	948	+ if (!$this->isFieldTypeExist('turnstile')) {
	949	+ return;
	950	+ }
	951	+
	952	+ if (!isset($_POST['cf-turnstile-response'])) {
	953	+ return new WP_Error('spam_detection', __('Please verify Cloudflare Turnstile Captcha', 'bit-form'));
	954	+ }
	955	+ $token = sanitize_text_field(wp_unslash($_POST['cf-turnstile-response']));
	956	+ $turnstileCaptcha = $this->getCaptchaApp('turnstileCaptcha');
	957	+
	958	+ // Fail closed: no secret key must not skip verification.
	959	+ if (empty($turnstileCaptcha->secretKey)) {
	960	+ Log::debug_log("Turnstile is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	961	+ return new WP_Error('spam_detection', __('Cloudflare Turnstile is not configured. Please contact the site administrator.', 'bit-form'));
	962	+ }
	963	+
	964	+ $turnstileResponse = HttpHelper::post(
	965	+ 'https://challenges.cloudflare.com/turnstile/v0/siteverify',
	966	+ ['secret' => $turnstileCaptcha->secretKey, 'response' => $token]
	967	+ );
	968	+ if (is_wp_error($turnstileResponse) || !is_object($turnstileResponse)) {
	969	+ return new WP_Error('spam_detection', __('Please verify Cloudflare Turnstile Captcha', 'bit-form'));
	970	+ }
	971	+
	972	+ if (empty($turnstileResponse->success)) {
	973	+ $errorCodes = implode(', ', (array) ($turnstileResponse->{'error-codes'} ?? []));
	974	+ wp_send_json_error(
	975	+ sprintf(
	976	+ /* translators: %s: dynamic value. */
	977	+ __('Cloudflare Turnstile Validation Error: %s', 'bit-form'),
	978	+ $errorCodes
	979	+ )
	980	+ );
	981	+ }
	982	+ }
	983	+
	984	+ public function verifySubmissionNonce()
	985	+ {
	986	+ if (!isset($_POST['t_identity']) || !isset($_POST['csrf'])) {
	987	+ return false;
	988	+ }
	989	+ $tIdenty = sanitize_text_field(wp_unslash($_POST['t_identity']));
	990	+ $csrf = sanitize_text_field(wp_unslash($_POST['csrf']));
	991	+ unset($_POST['t_identity'], $_POST['action'], $_POST['bitforms_id'], $_POST['csrf']);
	992	+ return Helpers::csrfDecrypted($tIdenty, $csrf);
	993	+ }
	994	+
	995	+ public function setViewCount()
	996	+ {
	997	+ if (!current_user_can('manage_options')) {
	998	+ $update_status = $this->formModel->update(
	999	+ [
	1000	+ 'views' => intval($this->form[0]->views) + 1
	1001	+ ],
	1002	+ [
	1003	+ 'id' => $this->form_id
	1004	+ ]
	1005	+ );
	1006	+ }
	1007	+ }
	1008	+
	1009	+ /**
	1010	+ * @param bool $checkedEmptySubmitted whether the empty-submission rule applies here
	1011	+ * @param bool $isEntryEdit true when an existing entry is being updated
	1012	+ */
	1013	+ public function checkSubmissionRestriction($checkedEmptySubmitted = true, $isEntryEdit = false)
	1014	+ {
	1015	+ $formContents = $this->getFormContent();
	1016	+ $additionalSettings = isset($formContents->additional) ? $formContents->additional : null;
	1017	+ $fromRestrictionSetitingsEnabled = empty($additionalSettings->enabled) ? [] : $additionalSettings->enabled;
	1018	+ $fromRestrictionSetitings = empty($additionalSettings->settings) ? null : $additionalSettings->settings;
	1019	+
	1020	+ if (is_null($additionalSettings) || is_null($fromRestrictionSetitings) || empty((array) $fromRestrictionSetitingsEnabled)) {
	1021	+ return false;
	1022	+ }
	1023	+
	1024	+ $restrictionMessage = [];
	1025	+ $ipTool = new IpTool();
	1026	+ $ipAddress = $ipTool->getIP();
	1027	+ $currentUserId = get_current_user_id();
	1028	+
	1029	+ foreach ($fromRestrictionSetitingsEnabled as $restrictionKey => $isEnabled) {
	1030	+ if ($isEnabled) {
	1031	+ // Quota rules gate creating an entry, so an edit skips them; access-control keys stay.
	1032	+ $skippableOnEdit = ['onePerIp', 'entry_limit', 'entry_limit_by_user', 'restrict_form'];
	1033	+ if ($isEntryEdit && in_array($restrictionKey, $skippableOnEdit, true)) {
	1034	+ $skipOnEdit = apply_filters(
	1035	+ 'bitform_skip_restriction_on_entry_edit',
	1036	+ true,
	1037	+ $restrictionKey,
	1038	+ $this->form_id
	1039	+ );
	1040	+ if ($skipOnEdit) {
	1041	+ continue;
	1042	+ }
496	1043	}
497		- return;
498		- }
	1044	+ /**
	1045	+ * Allow add-ons to handle any restriction key (Pro-only restrictions
	1046	+ * should be implemented in the add-on, not shipped in the free plugin).
	1047	+ *
	1048	+ * Return a non-null string to block submission.
	1049	+ */
	1050	+ $addonMsg = apply_filters(
	1051	+ 'bitform_submission_restriction',
	1052	+ null,
	1053	+ $restrictionKey,
	1054	+ $this->form_id,
	1055	+ $fromRestrictionSetitingsEnabled,
	1056	+ $fromRestrictionSetitings,
	1057	+ $ipAddress,
	1058	+ $currentUserId
	1059	+ );
499	1060
500		- /**
501		- * Will check if form is submitted by a bot
502		- *
503		- * @return Boolean true - if submitted by bot else false
504		- */
505		- public function isTrappedInHoneypot()
506		- {
507		- if (!$this->isHoneypotActive()) {
508		- return false;
	1061	+ if (!is_null($addonMsg) && '' !== $addonMsg) {
	1062	+ $restrictionMessage[] = $addonMsg;
	1063	+ continue;
509	1064	}
510	1065
511		- if (empty($_POST['token'])) {
512		- return true;
513		- } else {
514		- $token = $_POST['token'];
	1066	+ if ('onePerIp' === $restrictionKey) {
	1067	+ if ($this->hasCompletedEntryFromIp($ipAddress)) {
	1068	+ $onePerIp = __('Sorry!! You have already submitted from this IP address', 'bit-form');
	1069	+
	1070	+ $onePerIp = apply_filters(
	1071	+ 'bitform_filter_restriction_one_per_ip_message',
	1072	+ $onePerIp,
	1073	+ $this->form_id
	1074	+ );
	1075	+
	1076	+ $restrictionMessage[] = $onePerIp;
	1077	+ }
515	1078	}
	1079	+ if ('is_login' === $restrictionKey && 0 === get_current_user_id()) {
	1080	+ $is_login_messages = $fromRestrictionSetitings->is_login->message;
516	1081
517		- $dtoken = explode('.', base64_decode(base64_decode($token)))[1];
518		- $time = explode('.', base64_decode(base64_decode($token)))[0];
	1082	+ $is_login_messages = apply_filters(
	1083	+ 'bitform_filter_restriction_is_login_message',
	1084	+ $is_login_messages,
	1085	+ $this->form_id
	1086	+ );
519	1087
520		- if (time() - $time < 6 || hash_equals($dtoken, wp_hash(wp_get_session_token() . $time)) === false) {
521		- return true;
	1088	+ $restrictionMessage[] = $is_login_messages;
522	1089	}
523		- if (
524		- !empty($_POST[$token . '.name'])
525		- || !empty($_POST[$token . '_name'])
526		- || !empty($_POST[$token . '.email'])
527		- || !empty($_POST[$token . '_email'])
528		- || !empty($_POST[$token . '.message'])
529		- || !empty($_POST[$token . '_message'])
530		- ) {
531		- return true;
	1090	+ if ($checkedEmptySubmitted && 'empty_submission' === $restrictionKey) {
	1091	+ $isEmpty = $this->checkEmptySubmission(wp_unslash($_POST), GlobalHelper::sanitize_files_input($_FILES), $isEntryEdit);
	1092	+ if ($isEmpty) {
	1093	+ $restriction = $fromRestrictionSetitings->empty_submission->message;
	1094	+
	1095	+ $restriction = apply_filters(
	1096	+ 'bitform_filter_restriction_empty_submission_message',
	1097	+ $restriction,
	1098	+ $this->form_id
	1099	+ );
	1100	+
	1101	+ $restrictionMessage[] = $restriction;
	1102	+ }
532	1103	}
533		- unset($_POST['token'], $_POST[$token . 'name'], $_POST[$token . 'email'], $_POST[$token . 'message']);
534		- return false;
	1104	+ }
535	1105	}
	1106	+ return $restrictionMessage;
	1107	+ }
536	1108
537		- public function isHoneypotActive()
538		- {
539		- $formContents = $this->getFormContent();
540		- $enabled = empty($formContents->additional->enabled) ? null : $formContents->additional->enabled;
541		- if (!empty($enabled->honeypot) && $enabled->honeypot) {
542		- return true;
543		- }
544		- return false;
	1109	+ /**
	1110	+ * Will check if form is submitted by a bot
	1111	+ *
	1112	+ * @return Boolean true - if submitted by bot else false
	1113	+ */
	1114	+ public function isTrappedInHoneypot()
	1115	+ {
	1116	+ // Honeypot is implemented by add-ons (e.g. Pro) via filter.
	1117	+ return (bool) apply_filters('bitform_check_honeypot', false, $this->_form_id, wp_unslash($_POST));
	1118	+ }
	1119	+
	1120	+ public function isHoneypotActive()
	1121	+ {
	1122	+ return (bool) apply_filters('bitform_is_honeypot_active', false, $this->_form_id, $this->getFormContent());
	1123	+ }
	1124	+
	1125	+ public function checkPaymentFields()
	1126	+ {
	1127	+ $formContents = $this->getFormContent();
	1128	+ $fields = $formContents->fields;
	1129	+
	1130	+ $payments = [];
	1131	+ foreach ($fields as $fldData) {
	1132	+ if (!is_object($fldData)) {
	1133	+ continue;
	1134	+ }
	1135	+ if ('paypal' === $fldData->typ && property_exists($fldData, 'payIntegID')) {
	1136	+ $payments['paypalKey'] = $this->getClientKey($fldData->payIntegID, 'clientID');
	1137	+ } elseif ('razorpay' === $fldData->typ && isset($fldData->options) && is_object($fldData->options) && property_exists($fldData->options, 'payIntegID')) {
	1138	+ $payments['razorpayKey'] = $this->getClientKey($fldData->options->payIntegID, 'apiKey');
	1139	+ }
545	1140	}
546	1141
547		- public function checkPaymentFields()
548		- {
549		- $formContents = $this->getFormContent();
550		- $fields = $formContents->fields;
	1142	+ return $payments;
	1143	+ }
551	1144
552		- $payments = [];
553		- foreach ($fields as $fldData) {
554		- if ($fldData->typ === 'paypal' && property_exists($fldData, 'payIntegID')) {
555		- $payments['paypalKey'] = $this->getClientKey($fldData->payIntegID, 'clientID');
556		- } else if ($fldData->typ === 'razorpay' && property_exists($fldData->options, 'payIntegID')) {
557		- $payments['razorpayKey'] = $this->getClientKey($fldData->options->payIntegID, 'apiKey');
558		- }
	1145	+ private function getClientKey($integID, $keyName)
	1146	+ {
	1147	+ $client = '';
	1148	+ if (!empty($integID)) {
	1149	+ $integrationHandler = new IntegrationHandler(0);
	1150	+ $integration = $integrationHandler->getAIntegration($integID, 'app', 'payments');
	1151	+ if (!is_wp_error($integration)) {
	1152	+ $integrationRow = Utilities::firstRow($integration);
	1153	+ $integration_details = Utilities::jsonObj($integrationRow->integration_details ?? '');
	1154	+ if ($integration_details && isset($integration_details->{$keyName})) {
	1155	+ $client = base64_encode($integration_details->{$keyName});
559	1156	}
	1157	+ }
	1158	+ }
	1159	+ return $client;
	1160	+ }
560	1161
561		- return $payments;
	1162	+ public function getSuccessMessageMarkups()
	1163	+ {
	1164	+ if (is_null($this->_conf_messages)) {
	1165	+ $successMsgHandler = new SuccessMessageHandler($this->form_id);
	1166	+ $this->_conf_messages = $successMsgHandler->getAllMessage();
562	1167	}
563	1168
564		- private function getClientKey($integID, $keyName)
565		- {
566		- $client = '';
567		- if (!empty($integID)) {
568		- $integrationHandler = new IntegrationHandler(0);
569		- $integration = $integrationHandler->getAIntegration($integID, 'app', 'payments');
570		- if (!is_wp_error($integration)) {
571		- $integration_details = json_decode($integration[0]->integration_details);
572		- $client = base64_encode($integration_details->{$keyName});
573		- }
574		- }
575		- return $client;
	1169	+ $messageMarkups = '';
	1170	+ if (is_wp_error($this->_conf_messages)) {
	1171	+ return $messageMarkups;
576	1172	}
	1173	+
	1174	+ foreach ($this->_conf_messages as $msgItem) {
	1175	+ $msgConfig = json_decode($msgItem->message_config);
	1176	+ if (is_object($msgConfig) && property_exists($msgConfig, 'status') && empty($msgConfig->status)) {
	1177	+ continue;
	1178	+ }
	1179	+ $messageMarkups .= $this->messageMarkup($msgItem);
	1180	+ }
	1181	+
	1182	+ return $messageMarkups;
	1183	+ }
	1184	+
	1185	+ public function getFormAbandonmentMessage()
	1186	+ {
	1187	+ $msg = apply_filters('bitform_form_abandonment_warning_markup', '', $this->form_id);
	1188	+ return is_string($msg) ? $msg : '';
	1189	+ }
	1190	+
	1191	+ public function getFormAbandonmentSettings()
	1192	+ {
	1193	+ return apply_filters('bitform_form_abandonment_settings', null, $this->form_id);
	1194	+ }
	1195	+
	1196	+ private function messageMarkup($msg)
	1197	+ {
	1198	+ $msgId = $msg->id;
	1199	+ $msgConfig = json_decode($msg->message_config);
	1200	+ $msgType = (is_object($msgConfig) && isset($msgConfig->msgType)) ? $msgConfig->msgType : 'below';
	1201	+ $scrollClass = 'below' === $msgType ? 'scroll' : '';
	1202	+
	1203	+ return '<div
	1204	+ role="dialog"
	1205	+ aria-hidden="true"
	1206	+ data-modal-backdrop="true"
	1207	+ class="' . $this->getAtomicCls("msg-container-{$msgId}") . ' deactive ' . $scrollClass . '">
	1208	+ <div
	1209	+ data-contentid="' . $this->getFormIdentifier() . '"
	1210	+ data-msgid="' . $msgId . '"
	1211	+ role="button"
	1212	+ class="' . $this->getAtomicCls("msg-background-{$msgId}") . ' msg-backdrop">
	1213	+ <div class="bf-msg-content ' . $this->getAtomicCls("msg-content-{$msgId}") . '">
	1214	+ <button
	1215	+ data-contentid="' . $this->getFormIdentifier() . '"
	1216	+ data-msgid="' . $msgId . '"
	1217	+ class="' . $this->getAtomicCls("close-{$msgId}") . ' bf-msg-close"
	1218	+ type="button">
	1219	+ <svg class="' . $this->getAtomicCls("close-icn-{$msgId}") . '" viewBox="0 0 30 30">
	1220	+ <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="4" y1="3.88" x2="26" y2="26.12"></line>
	1221	+ <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="26" y1="3.88" x2="4" y2="26.12"></line>
	1222	+ </svg>
	1223	+ </button>
	1224	+ <div class="msg-content"></div>
	1225	+ </div>
	1226	+ </div>
	1227	+ </div>';
	1228	+ }
577	1229	}