← All changes | includes/Frontend/Form/FrontendFormHandler.php +828 -206 2.0 → V3.3.2 View file →

		@@ -1,58 +1,127 @@
1	1	<?php
2	2
3	3	namespace BitCode\BitForm\Frontend\Form;
4	4
	5	+if (!defined('ABSPATH')) {
	6	+ exit;
	7	+}
	8	+
	9	+use BitCode\BitForm\Admin\Form\AdminFormHandler;
5	10	use BitCode\BitForm\Admin\Form\FrontEndScriptGenerator;
	11	+use BitCode\BitForm\Admin\Form\Helpers;
	12	+use BitCode\BitForm\Core\Cryptography\Cryptography;
	13	+use BitCode\BitForm\Core\Database\FormEntryMetaModel;
6	14	use BitCode\BitForm\Core\Database\FormModel;
7	15	use BitCode\BitForm\Core\Form\FormManager;
8	16	use BitCode\BitForm\Core\Integration\IntegrationHandler;
	17	+use BitCode\BitForm\Core\Util\EscapingHelper;
9	18	use BitCode\BitForm\Core\Util\FieldValueHandler;
	19	+use BitCode\BitForm\Core\Util\FileDownloadProvider;
	20	+use BitCode\BitForm\Core\Util\FileHandler;
10	21	use BitCode\BitForm\Core\Util\FrontendHelpers;
	22	+use BitCode\BitForm\Core\Util\Log;
	23	+use BitCode\BitForm\Core\Util\SmartTagRegistry;
	24	+use BitCode\BitForm\Core\Util\SmartTags;
	25	+use BitCode\BitForm\Core\Util\Utilities;
11	26	use BitCode\BitForm\Core\WorkFlow\WorkFlow;
12	27
13		-final class FrontendFormHandler {
14		- public function __construct() {
	28	+final class FrontendFormHandler
	29	+{
	30	+ /** Largest stored signature inlined into the page as a data URI. */
	31	+ private const MAX_INLINE_SIGNATURE_BYTES = 2097152;
	32	+
	33	+ public function __construct()
	34	+ {
	35	+ // before markup load - formids [], posts [1,2]
15	36	add_action('wp_enqueue_scripts', [$this, 'loadAssets']);
16		- add_action('wp_footer', [$this, 'generateJS']);
	37	+ // markup loads - formids []
17	38	add_shortcode('bitform', [$this, 'handleFrontendRenderRequest']);
	39	+ // after markup load - formids [1,35,3]
	40	+ // After popup plugins render at 10 (that is when popup-only forms register
	41	+ // their formID), before wp_print_footer_scripts at 20.
	42	+ add_action('wp_footer', [$this, 'generateJS'], 15);
18	43	}
19	44
20		- private function validPassowordResetToken($token, $userID, $formId) {
	45	+ /**
	46	+ * A reset form opened from a used or expired link cannot succeed, so show why instead of
	47	+ * the form. Returns the notice markup, or '' when the link is fine or the form is not a
	48	+ * reset form. Rendered in place of the form (the old exit() cut the page off mid-theme).
	49	+ *
	50	+ * @param string $token key from the reset link
	51	+ * @param string $userID user ID from the reset link
	52	+ * @param int $formId form being rendered
	53	+ *
	54	+ * @return string
	55	+ */
	56	+ private function invalidPasswordResetNotice($token, $userID, $formId)
	57	+ {
21	58	$existResetInteg = (new IntegrationHandler($formId))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
22		- if (!is_wp_error($existResetInteg) && count($existResetInteg) > 0) {
23		- if ('reset' === $existResetInteg[0]->integration_name) {
24		- $user = get_userdata($userID);
25		- if ($user) {
26		- $validKey = check_password_reset_key($token, $user->user_login);
27		- if (is_wp_error($validKey)) {
28		- echo "<div id='bf-resp' style='display:grid;justify-content:center;color:#860000;'>This password reset token is invalid.</div>";
29		- exit();
30		- }
31		- } else {
32		- echo "<div id='bf-resp' style='display:grid;justify-content:center;color:#860000;'>Invalid User!!</div>";
33		- exit();
34		- }
35		- }
	59	+ if (is_wp_error($existResetInteg) || empty($existResetInteg) || 'reset' !== $existResetInteg[0]->integration_name) {
	60	+ return '';
36	61	}
	62	+ $user = get_userdata((int) $userID);
	63	+ if ($user && !is_wp_error(check_password_reset_key($token, $user->user_login))) {
	64	+ return '';
	65	+ }
	66	+ return "<div id='bf-resp' role='alert' style='display:grid;justify-content:center;color:#860000;'>"
	67	+ . esc_html__('This password reset link is invalid or has expired. Please request a new one.', 'bit-form')
	68	+ . '</div>';
37	69	}
38	70
39		- private function getJSFileSrc($postId) {
40		- $formUpdateVersion = get_option('bit-form_form_update_version');
	71	+ private function getJSFileSrc($postId)
	72	+ {
	73	+ $formUpdateVersion = get_option('bitform_form_update_version');
41	74	$formScriptSrc = BITFORMS_UPLOAD_BASE_URL . "/form-scripts/$postId/bitform-js-$postId.js?bfv=$formUpdateVersion";
42	75
43	76	return $formScriptSrc;
44	77	}
45	78
46		- public function generateJs($formID = null) {
	79	+ private function getJSFilePath($postId)
	80	+ {
	81	+ return BITFORMS_CONTENT_DIR . "/form-scripts/$postId/bitform-js-$postId.js";
	82	+ }
	83	+
	84	+ /**
	85	+ * Does this page's bundle need (re)generating?
	86	+ *
	87	+ * The DB flag alone is not enough: a page marked generated whose file was never written
	88	+ * (crashed generation, unwritable uploads dir) would enqueue a 404 forever. Conversely a
	89	+ * file that cannot be written must not make every request rebuild it, so a missing file
	90	+ * is retried on a backoff window rather than on every hit.
	91	+ *
	92	+ * @param int $postId
	93	+ * @param bool $regenerateScriptFlag DB-side verdict from regenerateScriptChecker()
	94	+ *
	95	+ * @return bool
	96	+ */
	97	+ private function needsScriptGeneration($postId, $regenerateScriptFlag)
	98	+ {
	99	+ if (file_exists($this->getJSFilePath($postId))) {
	100	+ return (bool) $regenerateScriptFlag;
	101	+ }
	102	+ $retryKey = 'bitforms_js_regen_' . $postId;
	103	+ if (get_transient($retryKey)) {
	104	+ return false;
	105	+ }
	106	+ set_transient($retryKey, 1, 5 * MINUTE_IN_SECONDS);
	107	+ return true;
	108	+ }
	109	+
	110	+ public function generateJs($formID = null, $entryID = null, $formType = null)
	111	+ {
	112	+ // bitform-js-{postId}.js is disk-cached per post ID with no language key.
	113	+ // Display strings must stay out of it and travel in bf_globals per request.
	114	+ // return true;
47	115	$isFormPreview = get_transient('bitform_form_preview');
48	116	if ($isFormPreview && !$formID) {
49	117	delete_transient('bitform_form_preview');
50	118	return;
51	119	}
52		- FrontendHelpers::isPageBuilder();
53		- global $isPageBuilder;
54		- if ($isPageBuilder) {
	120	+ $frontendScriptGenObj = new FrontEndScriptGenerator();
	121	+ $isPageBuilder = FrontendHelpers::checkIsPageBuilder($_SERVER);
	122	+ $bfFrontendFormIds = FrontendHelpers::$bfFrontendFormIds;
	123	+ if ($isPageBuilder || empty($bfFrontendFormIds)) {
55	124	return;
56	125	}
57	126	// for unique fields ids in the same form (e.g. multiple forms in the same page)
58	127	$allFields = [];
		@@ -58,23 +127,36 @@
58	127	$allFields = [];
59	128	$formContents = [];
60	129	$contentIds = [];
61	130	$formIDs = [];
62		- $preview = false;
	131	+ $previewMode = 'classic';
63	132	$postId = '';
64	133
	134	+ $formUpdateVersion = get_option('bitform_form_update_version');
65	135	if ($formID) {
66	136	$formIDs[] = $formID;
67		- $FrontendFormManager = new FrontendFormManager($formID, 1);
	137	+ $FrontendFormManager = FrontendFormManager::getInstance($formID, 1);
	138	+ $formInfo = $FrontendFormManager->getFormInfo();
68	139	$FormIdentifier = esc_js($FrontendFormManager->getFormIdentifier());
69	140	$formContent = $FrontendFormManager->getFormContentWithValue($this->getValuesFromQueryParams());
	141	+ $formContent->formId = $formID;
70	142	$formContents[] = $formContent;
71		- $fields = $this->triggerWorkflowOnLoad($formID, 1, $formContent->fields);
	143	+ $workFlowRunType = $entryID ? 'edit' : 'create';
	144	+ $fields = $formContent->fields;
	145	+ if ($entryID) {
	146	+ $fields = $this->setFieldsValue($fields, $formID, $entryID);
	147	+ }
	148	+ $fields = $this->triggerWorkflowOnLoad($formID, 1, $fields, $workFlowRunType);
72	149	array_push($contentIds, $FormIdentifier);
	150	+
73	151	foreach ($fields as $fk => $field) {
74	152	$allFields[$field->typ][] = ['fk' => $fk, 'field' => $field, 'formID' => $formID, 'contentId' => $FormIdentifier];
75	153	}
76		- $preview = true;
	154	+ //Generate JS file for conversational form
	155	+ if (!empty($formInfo->conversationalSettings->enable) && $formInfo->conversationalSettings->enable) {
	156	+ $frontendScriptGenObj->generateJsFile([$formContent], $allFields, [$FormIdentifier], $formID, [$formID], 'conversational');
	157	+ }
	158	+ $previewMode = 'preview';
77	159	$postId = $formID;
78	160	} else {
79	161	global $post;
80	162	if (!is_object($post) && !isset($post->ID)) {
		@@ -79,43 +161,64 @@
79	161	global $post;
80	162	if (!is_object($post) && !isset($post->ID)) {
81	163	return;
82	164	}
83		- FrontendHelpers::handleBfFormIdsSession();
84		- global $bfFrontendFormIds;
85		- $bfUniqFormIds = array_unique($bfFrontendFormIds);
	165	+ $bfFrontendFormIds = FrontendHelpers::$bfFrontendFormIds;
	166	+ $bfUniqFormIds = FrontendHelpers::getAllUniqFormIdsInPage();
	167	+ $formIDs = $bfUniqFormIds;
	168	+ $regenerateScriptFlag = $this->regenerateScriptChecker($bfUniqFormIds);
86	169
87		- $regenerateScriptFlag = $this->regenerateScriptChecker($bfUniqFormIds);
88	170	$postId = $post->ID;
89	171	if (!$regenerateScriptFlag) {
90	172	$regenerateScriptFlag = $this->deleteUnusedFormPageIds($postId, $bfUniqFormIds);
91	173	}
92	174	$isJsGenerating = get_option('bitforms_frontend_js_generating');
93		- if (!$regenerateScriptFlag && !$isJsGenerating) {
94		- wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], '', true);
	175	+ // The fast path also requires the cached bundle to exist on disk, not just be flagged in the DB.
	176	+ $regenerateScriptFlag = $this->needsScriptGeneration($postId, $regenerateScriptFlag);
	177	+ if (!$regenerateScriptFlag && !$isJsGenerating && !empty($formIDs)) {
	178	+ wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], $formUpdateVersion, true);
95	179	return;
96	180	}
97		-
98		- $formIDs = $bfUniqFormIds;
99		-
100	181	foreach ($bfFrontendFormIds as $index => $formId) {
101	182	$shortCodeCounter = $index + 1;
102		- $FrontendFormManager = new FrontendFormManager($formId, $shortCodeCounter);
	183	+ $FrontendFormManager = FrontendFormManager::getInstance($formId, $shortCodeCounter);
	184	+ $formInfo = $FrontendFormManager->getFormInfo();
103	185	$FormIdentifier = esc_js($FrontendFormManager->getFormIdentifier());
104	186	$formContent = $FrontendFormManager->getFormContentWithValue($this->getValuesFromQueryParams());
	187	+ $formContent->formId = $formId;
105	188	$formContents[] = $formContent;
106	189	$fields = $this->triggerWorkflowOnLoad($formId, $shortCodeCounter, $formContent->fields);
107		- array_push($contentIds, $FormIdentifier);
	190	+ $contentIds[] = $FormIdentifier;
	191	+ $formFields = []; // indivisual form fields array for conversational view
108	192	foreach ($fields as $fk => $field) {
109		- $allFields[$field->typ][] = ['fk' => $fk, 'field' => $field, 'formID' => $formId, 'contentId' => $FormIdentifier];
	193	+ $fieldArr = ['fk' => $fk, 'field' => $field, 'formID' => $formId, 'contentId' => $FormIdentifier];
	194	+ $allFields[$field->typ][] = $fieldArr;
	195	+ $formFields[$field->typ][] = $fieldArr;
110	196	}
	197	+ //Generate JS file for conversational form
	198	+ if (!empty($formInfo->conversationalSettings->enable) && $formInfo->conversationalSettings->enable) {
	199	+ $frontendScriptGenObj->generateJsFile([$formContent], $formFields, [$FormIdentifier], $formId, [$formId], 'conversational');
	200	+ }
111	201	}
112	202	}
113		- (new FrontEndScriptGenerator())->generateJsFile($formContents, $allFields, $contentIds, $postId, $formIDs, $preview);
114		- wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], '', true);
	203	+ if (empty($formIDs)) {
	204	+ return;
	205	+ }
	206	+
	207	+ $frontendScriptGenObj->generateJsFile($formContents, $allFields, $contentIds, $postId, $formIDs, $previewMode);
	208	+ if ('preview' === $previewMode) {
	209	+ return;
	210	+ }
	211	+ // Only mark the page as generated once the bundle is verifiably on disk; otherwise the
	212	+ // next request must retry generation instead of fast-pathing to a stale/missing file.
	213	+ if (!empty($bfUniqFormIds) && file_exists($this->getJSFilePath($postId))) {
	214	+ $this->markScriptGenerated($bfUniqFormIds, $postId);
	215	+ }
	216	+ wp_enqueue_script('bit-form-all-script-test', $this->getJSFileSrc($postId), [], $formUpdateVersion, true);
115	217	}
116	218
117		- private function deleteUnusedFormPageIds($postId, $formIDs) {
	219	+ private function deleteUnusedFormPageIds($postId, $formIDs)
	220	+ {
118	221	global $post;
119	222	if (!is_object($post) && !isset($post->ID)) {
120	223	return;
121	224	}
		@@ -126,40 +229,75 @@
126	229	);
127	230	$regenerateScriptFlag = false;
128	231	foreach ($forms as $form) {
129	232	$formId = $form->id;
130		- $generatedScriptPageIdsDecoded = json_decode($form->generated_script_page_ids, true);
	233	+ $generatedScriptPageIdsDecoded = json_decode((string) $form->generated_script_page_ids, true);
131	234	$generatedScriptPageIds = is_array($generatedScriptPageIdsDecoded) ? array_keys($generatedScriptPageIdsDecoded) : [];
132	235	if (!empty($generatedScriptPageIds) && !in_array($formId, $formIDs) && in_array($postId, $generatedScriptPageIds)) {
133	236	unset($generatedScriptPageIdsDecoded[$postId]);
	237	+ if (empty($generatedScriptPageIdsDecoded)) {
	238	+ $generatedScriptPageIdsDecoded = new \stdClass();
	239	+ }
134	240	$regenerateScriptFlag = true;
135	241	$formModel->update(['generated_script_page_ids' => wp_json_encode($generatedScriptPageIdsDecoded)], ['id' => $formId]);
136	242	}
137	243	}
	244	+ if ($regenerateScriptFlag) {
	245	+ $formUpdateVersion = get_option('bitform_form_update_version');
	246	+ if (!$formUpdateVersion) {
	247	+ $formUpdateVersion = 1;
	248	+ } else {
	249	+ $formUpdateVersion = (int) $formUpdateVersion + 1;
	250	+ }
	251	+ update_option('bitform_form_update_version', $formUpdateVersion);
	252	+ }
138	253	return $regenerateScriptFlag;
139	254	}
140	255
141		- private function regenerateScriptChecker($formsIds) {
	256	+ private function regenerateScriptChecker($formsIds)
	257	+ {
142	258	global $post;
143		- if (!is_object($post) && !isset($post->ID)) {
	259	+ if (!is_a($post, 'WP_Post') && !isset($post->ID)) {
144	260	return;
145	261	}
146	262	$postId = $post->ID;
147		- $regenerateScriptFlag = false;
148		- $formModel = new FormModel();
	263	+ // Read-only check. Marking the page as generated is deferred to markScriptGenerated(),
	264	+ // called only after the bundle file is actually written — marking here left the DB
	265	+ // saying "generated" while the file stayed stale whenever generation failed mid-way.
149	266	foreach ($formsIds as $formId) {
150		- $formInstance = new FormManager($formId);
	267	+ $formInstance = FormManager::getInstance($formId);
	268	+ if (!$formInstance->isExist()) {
	269	+ continue;
	270	+ }
151	271	$generatedPages = $formInstance->getFormData('generated_script_page_ids');
	272	+ if (empty($generatedPages)) {
	273	+ return true;
	274	+ }
	275	+ if (is_object($generatedPages) && (!isset($generatedPages->{$postId}) || false === $generatedPages->{$postId})) {
	276	+ return true;
	277	+ }
	278	+ }
	279	+ return false;
	280	+ }
152	281
153		- if (empty($generatedPages)) {
154		- $regenerateScriptFlag = true;
155		- } elseif (is_object($generatedPages) && (!isset($generatedPages->{$postId}) || (isset($generatedPages->{$postId}) && false === $generatedPages->{$postId}))) {
156		- $regenerateScriptFlag = true;
	282	+ private function markScriptGenerated($formsIds, $postId)
	283	+ {
	284	+ // Fetched via FormModel rather than FormManager: FormManager keeps its row in a static
	285	+ // property shared across instances, so after the render loop it holds the last form's
	286	+ // data regardless of which instance is asked.
	287	+ $formModel = new FormModel();
	288	+ foreach ($formsIds as $formId) {
	289	+ $form = $formModel->get(['generated_script_page_ids'], ['id' => $formId]);
	290	+ if (is_wp_error($form) || empty($form)) {
	291	+ continue;
157	292	}
158		- if (!$regenerateScriptFlag) {
	293	+ $generatedPages = Utilities::jsonObj($form[0]->generated_script_page_ids ?? '');
	294	+ if (!is_object($generatedPages)) {
	295	+ $generatedPages = (object) [];
	296	+ }
	297	+ if (!empty($generatedPages->{$postId})) {
159	298	continue;
160	299	}
161		-
162	300	$generatedPages->{$postId} = true;
163	301	$formModel->update(
164	302	[
165	303	'generated_script_page_ids' => \wp_json_encode($generatedPages)
		@@ -168,30 +306,34 @@
168	306	'id' => $formId,
169	307	]
170	308	);
171	309	}
172		- return $regenerateScriptFlag;
173	310	}
174	311
175		- private function addInlineScript($code, $handle = '', $position = 'after') {
	312	+ private function addInlineScript($code, $handle = '', $position = 'after')
	313	+ {
176	314	$scriptHandle = !empty($handle) ? $handle : 'bf-inline-script';
	315	+ $formUpdateVersion = get_option('bitform_form_update_version');
177	316	if (!wp_script_is($scriptHandle)) {
178		- wp_register_script($scriptHandle, '', [], '', true);
	317	+ wp_register_script($scriptHandle, '', [], $formUpdateVersion, true);
179	318	wp_enqueue_script($scriptHandle);
180	319	}
181	320	wp_add_inline_script($scriptHandle, $code, $position);
182	321	}
183	322
184		- private function addInlineStyle($code, $handle = '') {
	323	+ private function addInlineStyle($code, $handle = '')
	324	+ {
185	325	$styleHandle = !empty($handle) ? $handle : 'bf-inline-style';
	326	+ $formUpdateVersion = get_option('bitform_form_update_version');
186	327	if (!wp_style_is($styleHandle)) {
187		- wp_register_style($styleHandle, '', [], '', true);
	328	+ wp_register_style($styleHandle, '', [], $formUpdateVersion);
188	329	wp_enqueue_style($styleHandle);
189	330	}
190	331	wp_add_inline_style($styleHandle, $code);
191	332	}
192	333
193		- private function triggerWorkflowOnLoad($formID, $shortCodeCounter, $fields) {
	334	+ private function triggerWorkflowOnLoad($formID, $shortCodeCounter, $fields, $workFlowRunType = 'create')
	335	+ {
194	336	$FrontendFormManager = new FrontendFormManager($formID, $shortCodeCounter);
195	337	$previousValue = $this->getValuesFromQueryParams();
196	338	$formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
197	339	if (!empty($formContent->workFlowExist)) {
		@@ -197,9 +339,9 @@
197	339	if (!empty($formContent->workFlowExist)) {
198	340	$workFlowRunHelper = new WorkFlow($formID);
199	341	if (!empty($formContent->workFlowExist->onload)) {
200	342	$workFlowreturnedOnLoad = $workFlowRunHelper->executeOnLoad(
201		- 'create',
	343	+ $workFlowRunType,
202	344	$fields
203	345	);
204	346
205	347	if (!empty($workFlowreturnedOnLoad['fields'])) {
		@@ -210,35 +352,37 @@
210	352
211	353	return $fields;
212	354	}
213	355
214		- private function executeOnUserInput($formID, $shortCodeCounter, $fields) {
215		- $FrontendFormManager = new FrontendFormManager($formID, $shortCodeCounter);
	356	+ private function executeOnUserInput($formID, $shortCodeCounter, $workFlowRunType = 'create')
	357	+ {
	358	+ $FrontendFormManager = FrontendFormManager::getInstance($formID, $shortCodeCounter);
216	359	$previousValue = $this->getValuesFromQueryParams();
217	360	$formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
218	361	$customCodesExist = strpos(FrontEndScriptGenerator::getCustomCodes($formID)['JavaScript'], 'bfVars');
219	362	if ($customCodesExist || (!empty($formContent->workFlowExist) && !empty($formContent->workFlowExist->oninput))) {
220	363	$workFlowRunHelper = new WorkFlow($formID);
221		- return $workFlowRunHelper->executeOnUserInput('create', $fields);
	364	+ return $workFlowRunHelper->executeOnUserInput($workFlowRunType);
222	365	}
223	366	}
224	367
225		- private function getValuesFromQueryParams() {
226		- $reqField = $_SERVER['QUERY_STRING'];
	368	+ private function getValuesFromQueryParams()
	369	+ {
	370	+ // Read-only: query string parsed to pre-fill form fields. Values are sanitized per field before use.
227	371	$queryParamsValue = [];
228		- if (!empty($reqField)) {
	372	+ if (isset($_SERVER['QUERY_STRING']) && !empty($_SERVER['QUERY_STRING'])) {
	373	+ $reqField = wp_unslash($_SERVER['QUERY_STRING']);
229	374	foreach (explode('&', $reqField) as $keyValue) {
230		- // $pattern = '/([a-zA-Z0-9])([a-zA-Z])\=+/';
231		- $pattern = '/([^.]+)=(.*?)([^.]+)/';
232		- $matches = preg_match($pattern, $keyValue, $matchFormat);
233		- if ($matches) {
	375	+ if (false !== strpos($keyValue, '=')) {
234	376	list($field, $value) = explode('=', $keyValue, 2);
235	377
236	378	if (!trim($value)) {
237	379	continue;
238	380	}
239		-
240		- $queryParamsValue[$field][] = sanitize_text_field(urldecode($value));
	381	+ $field = sanitize_text_field(urldecode($field));
	382	+ if (!empty($field)) {
	383	+ $queryParamsValue[$field][] = sanitize_text_field(urldecode($value));
	384	+ }
241	385	}
242	386	}
243	387	}
244	388
		@@ -244,16 +388,24 @@
244	388
245	389	return $queryParamsValue;
246	390	}
247	391
248		- public function handleFrontendRenderRequest($atts, $formPreview = false) {
249		- static $shortCodeCounter = 0;
250		- $shortCodeCounter += 1;
251		-
252		- if ($formPreview) {
253		- // when $formPreview is true, it means that the atts is the form id
254		- $formID = $atts;
	392	+ public function handleFrontendRenderRequest($atts)
	393	+ {
	394	+ $formType = isset($atts['type']) ? $atts['type'] : 'classic';
	395	+ $formPreview = isset($atts['form_preview']) ? $atts['form_preview'] : false;
	396	+ if (isset($atts['form_id'])) {
	397	+ $formID = intval($atts['form_id']);
	398	+ }
	399	+ if (isset($atts['entry_id'])) {
	400	+ $entryId = intval($atts['entry_id']);
	401	+ // Read-only: entry ID from query string for shortcode render. No state mutation.
	402	+ } elseif (isset($_GET['bf_entry_id']) && !is_array($_GET['bf_entry_id'])) {
	403	+ $entryId = intval(sanitize_text_field(wp_unslash($_GET['bf_entry_id'])));
255	404	} else {
	405	+ $entryId = false;
	406	+ }
	407	+ if (isset($atts['id'])) {
256	408	$atts = shortcode_atts(['id' => 0], $atts);
257	409	$formID = intval($atts['id']);
258	410	}
259	411
		@@ -261,21 +413,43 @@
261	413	return __('Form ID cannot be empty', 'bit-form');
262	414	}
263	415
264	416	if (!$this->isExist($formID)) {
	417	+ /* translators: %s: form ID */
265	418	return sprintf(__('#%s no. Form doesn\'t exists', 'bit-form'), $formID);
266	419	}
267		- FrontendHelpers::handleBfFormIdsSession($formID);
268		- $FrontendFormManager = new FrontendFormManager($formID, $shortCodeCounter);
269	420
	421	+ // Add-ons return the id of the abandoned entry this visitor can resume. A bare
	422	+ // true (older Pro) carries no id, so nothing is restored rather than entry #1.
	423	+ $abandonedEntryId = apply_filters('bitform_is_abandoned_entry', false, $formID, $entryId, $atts);
	424	+ $abandonedEntryId = (!is_bool($abandonedEntryId) && is_numeric($abandonedEntryId)) ? (int) $abandonedEntryId : 0;
	425	+ $isAbandoned = $abandonedEntryId > 0;
	426	+
	427	+ FrontendHelpers::setBfFrontendFormIds($formID);
	428	+ $bfFrontendFormIds = FrontendHelpers::$bfFrontendFormIds;
	429	+ $shortCodeCounter = count($bfFrontendFormIds);
	430	+ $FrontendFormManager = FrontendFormManager::getInstance($formID, $shortCodeCounter);
	431	+
	432	+ if (!$FrontendFormManager->checkStatus()) {
	433	+ /* translators: %s: form ID */
	434	+ return sprintf(__('#%s no. Form is not active', 'bit-form'), $formID);
	435	+ }
	436	+ ob_start();
	437	+ $this->loadAssets($formID, $formType);
	438	+
270	439	$font = $FrontendFormManager->getFont();
271	440
272	441	if ($font && !$formPreview) {
273		- wp_enqueue_style('google-font', $font, '1.0.0', true);
	442	+ wp_enqueue_style('bf-google-font', $font, '1.0.0', true);
274	443	}
275	444
	445	+ // Read-only: password reset token from URL for display-time validation. No state written until form is submitted.
276	446	if (!empty($_GET['token']) && !empty($_GET['id'])) {
277		- $this->validPassowordResetToken($_GET['token'], $_GET['id'], $formID);
	447	+ $resetNotice = $this->invalidPasswordResetNotice(sanitize_text_field(wp_unslash($_GET['token'])), sanitize_text_field(wp_unslash($_GET['id'])), $formID);
	448	+ if ('' !== $resetNotice) {
	449	+ ob_end_clean();
	450	+ return $resetNotice;
	451	+ }
278	452	}
279	453
280	454	$previousValue = $this->getValuesFromQueryParams();
281	455	$errorMessages = []; // delete
		@@ -282,56 +456,94 @@
282	456	$FormIdentifier = esc_js($FrontendFormManager->getFormIdentifier());
283	457	$nonce = $FrontendFormManager->getFormToken();
284	458	$file = count($FrontendFormManager->getUploadFields()) > 0 ? $FrontendFormManager->getUploadFields() : false;
285	459
286		- if ($FrontendFormManager->checkStatus()) {
287		- $FrontendFormManager->setViewCount();
	460	+ $FrontendFormManager->setViewCount();
288	461
289		- $formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
290		- $fields = $formContent->fields;
291		- $layout = $formContent->layout;
292		- $buttons = !empty($formContent->buttons) ? $formContent->buttons : '';
293		- $additional = $formContent->additional;
	462	+ $formContent = $FrontendFormManager->getFormContentWithValue($previousValue);
	463	+ $fields = $formContent->fields;
	464	+ $layout = $formContent->layout;
	465	+ $nestedLayout = isset($formContent->nestedLayout) ? $formContent->nestedLayout : (object) [];
	466	+ $buttons = !empty($formContent->buttons) ? $formContent->buttons : '';
	467	+ $additional = $formContent->additional;
294	468
295		- $fields = $this->triggerWorkflowOnLoad($formID, $shortCodeCounter, $fields);
296		- $workFlowreturnedOnUserInput = $this->executeOnUserInput($formID, $shortCodeCounter, $fields);
	469	+ // $workFlowRunType = $entryId ? 'edit' : 'create';
	470	+ if ($entryId && (FrontendHelpers::is_current_user_can_access($formID, 'entryEditAccess'))) {
	471	+ $workFlowRunType = 'edit';
	472	+ $adminFormHandler = new AdminFormHandler();
	473	+ $getEntry = $adminFormHandler->getSingleEntry($formID, $entryId);
	474	+ if (FrontendHelpers::is_current_user_can_access($formID, 'entryEditAccess', '', $getEntry->__user_id)) {
	475	+ $fields = $this->setFieldsValue($fields, $formID, $entryId);
	476	+ } elseif (!$isAbandoned) {
	477	+ $entryId = false;
	478	+ $workFlowRunType = 'create';
	479	+ }
	480	+ } else {
	481	+ $entryId = false;
	482	+ $workFlowRunType = 'create';
	483	+ }
297	484
298		- // only for form not preview
299		- if (!wp_style_is('bitform-style' . $formID)) {
300		- $this->loadAssets(true, $formID, $file);
301		- }
	485	+ // if ($entryId) {
	486	+ // $fields = $this->setFieldsValue($fields, $formID, $entryId);
	487	+ // }
302	488
303		- // test for form before remove
304		- $noLabel = ['decision-box', 'html', 'button', 'paypal', 'razorpay', 'recaptcha'];
305		- $newFields = json_decode(json_encode($fields), true);
306		- foreach ($newFields as $fldKey => $field) {
307		- if (!in_array($field['typ'], $noLabel) && isset($field['lbl'])) {
308		- $lblReplaceToBackslash = str_replace('$_bf_$', '\\', $field['lbl']);
309		- $newFields[$fldKey]['lbl'] = FieldValueHandler::replaceSmartTagWithValue($lblReplaceToBackslash);
310		- }
	489	+ $fields = apply_filters('bitform_filter_before_workflow_onload_fields', $fields, $formID);
	490	+ $fields = $this->triggerWorkflowOnLoad($formID, $shortCodeCounter, $fields, $workFlowRunType);
	491	+ $fields = apply_filters('bitform_filter_after_workflow_onload_fields', $fields, $formID);
	492	+ do_action('bitform_onload_fields', $fields, $formID);
	493	+ $workFlowreturnedOnUserInput = $this->executeOnUserInput($formID, $shortCodeCounter, $workFlowRunType);
	494	+
	495	+ // test for form before remove
	496	+ $noLabelFieldTypes = ['decision-box', 'gdpr', 'html', 'shortcode', 'button', 'paypal', 'razorpay', 'recaptcha', 'turnstile', 'hcaptcha', 'stripe', 'spacer'];
	497	+ foreach ($fields as $fldKey => $field) {
	498	+ if (!in_array($field->typ, $noLabelFieldTypes) && isset($field->lbl)) {
	499	+ $lblReplaceToBackslash = str_replace('$_bf_$', '\\', $field->lbl);
	500	+ $fields->{$fldKey}->lbl = FieldValueHandler::replaceSmartTagWithValue($lblReplaceToBackslash);
311	501	}
312		- $fieldsKey = $FrontendFormManager->getFieldsKey();
	502	+ }
	503	+ $fieldsKey = $FrontendFormManager->getFieldsKey();
313	504
314		- $captchaV3Settings = $FrontendFormManager->getCaptchaV3Settings();
315		- if ($FrontendFormManager->getCaptchaSettings() || $captchaV3Settings) {
316		- $integrationHandler = new IntegrationHandler(0);
317		- $allFormIntegrations = $integrationHandler->getAllIntegration('app');
318		- if (!is_wp_error($allFormIntegrations)) {
319		- foreach ($allFormIntegrations as $integration) {
320		- if (
321		- $FrontendFormManager->getCaptchaSettings()
322		- && !is_null($integration->integration_type)
323		- && 'gReCaptcha' === $integration->integration_type
324		- ) {
325		- $integrationDetails = json_decode($integration->integration_details);
	505	+ $captchaV3Settings = $FrontendFormManager->getCaptchaV3Settings();
	506	+ if ($FrontendFormManager->getCaptchaSettings() || $captchaV3Settings || $FrontendFormManager->getTurnstileSettings() || $FrontendFormManager->isFieldTypeExist('hcaptcha')) {
	507	+ $integrationHandler = new IntegrationHandler(0);
	508	+ $allFormIntegrations = $integrationHandler->getAllIntegration('app');
	509	+ if (!is_wp_error($allFormIntegrations)) {
	510	+ foreach ($allFormIntegrations as $integration) {
	511	+ if (
	512	+ $FrontendFormManager->getCaptchaSettings()
	513	+ && !is_null($integration->integration_type)
	514	+ && 'gReCaptcha' === $integration->integration_type
	515	+ ) {
	516	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	517	+ if ($integrationDetails) {
326	518	$integrationDetails->id = $integration->id;
327	519	$reCAPTCHA = $integrationDetails;
328	520	$reCAPTCHAVersion = 'v2';
329	521	}
	522	+ }
330	523
331		- if ($captchaV3Settings) {
332		- if (!is_null($integration->integration_type) && 'gReCaptchaV3' === $integration->integration_type) {
333		- $integrationDetails = json_decode($integration->integration_details);
	524	+ if (
	525	+ $FrontendFormManager->getTurnstileSettings()
	526	+ && !is_null($integration->integration_type)
	527	+ && 'turnstileCaptcha' === $integration->integration_type
	528	+ ) {
	529	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	530	+ $turnstileSiteKey = $integrationDetails->siteKey ?? '';
	531	+ }
	532	+
	533	+ if (
	534	+ $FrontendFormManager->isFieldTypeExist('hcaptcha')
	535	+ && !is_null($integration->integration_type)
	536	+ && 'hcaptcha' === $integration->integration_type
	537	+ ) {
	538	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	539	+ $hCaptchaSiteKey = $integrationDetails->siteKey ?? '';
	540	+ }
	541	+
	542	+ if ($captchaV3Settings) {
	543	+ if (!is_null($integration->integration_type) && 'gReCaptchaV3' === $integration->integration_type) {
	544	+ $integrationDetails = Utilities::jsonObj($integration->integration_details);
	545	+ if ($integrationDetails) {
334	546	$integrationDetails->id = $integration->id;
335	547	$reCAPTCHA = $integrationDetails;
336	548	$reCAPTCHAVersion = 'v3';
337	549	}
		@@ -338,81 +550,303 @@
338	550	}
339	551	}
340	552	}
341	553	}
	554	+ }
342	555
343		- $configs = [
344		- 'bf_separator' => BITFORMS_BF_SEPARATOR,
	556	+ if ($captchaV3Settings && !empty($reCAPTCHA->siteKey)) {
	557	+ // DANGER: no matter what, DONT CHANGE THE SCRIPT ID OF THIS SCRIPT
	558	+ $scriptId = BITFORMS_PREFIX . 'recaptcha';
	559	+ // External Google reCAPTCHA script; version managed by URL query param. Loaded in header because
	560	+ // standalone form views do not render wp_footer(), making footer enqueue unreliable.
	561	+ wp_enqueue_script($scriptId, "https://www.google.com/recaptcha/api.js?render={$reCAPTCHA->siteKey}", [], null, false);
	562	+ }
	563	+
	564	+ $configs = [
	565	+ 'bf_separator' => BITFORMS_BF_SEPARATOR,
	566	+ ];
	567	+
	568	+ // check if fields has paypal or razorpay
	569	+ $paymentFields = ['paypal', 'razorpay', 'stripe'];
	570	+ $paymentFieldData = [];
	571	+ foreach ($fields as $key => $field) {
	572	+ if (in_array($field->typ, $paymentFields)) {
	573	+ $paymentFieldData[$key] = $field;
	574	+ }
	575	+ }
	576	+
	577	+ if (!empty($paymentFieldData)) {
	578	+ $integrationHandler = new IntegrationHandler(0);
	579	+ foreach ($paymentFieldData as $fldKey => $fldData) {
	580	+ $paymentIntegration = $integrationHandler->getAIntegration($fldData->payIntegID);
	581	+ if (is_wp_error($paymentIntegration)) {
	582	+ continue;
	583	+ }
	584	+ $paymentIntegrationRow = Utilities::firstRow($paymentIntegration);
	585	+ if ('paypal' === $fldData->typ) {
	586	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	587	+ $clientID = $integrationDetails->clientID ?? '';
	588	+ $fields->{$fldKey}->clientId = $clientID;
	589	+ } elseif ('razorpay' === $fldData->typ) {
	590	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	591	+ $clientID = $integrationDetails->apiKey ?? '';
	592	+ $fields->{$fldKey}->clientId = $clientID;
	593	+ } elseif ('stripe' === $fldData->typ) {
	594	+ $integrationDetails = Utilities::jsonObj($paymentIntegrationRow->integration_details ?? '');
	595	+ $publishableKey = $integrationDetails->publishableKey ?? '';
	596	+ $fields->{$fldKey}->publishableKey = $publishableKey;
	597	+ }
	598	+ }
	599	+ }
	600	+
	601	+ $bitFormFrontArr = [
	602	+ 'ajaxURL' => admin_url('admin-ajax.php'),
	603	+ 'nonce' => $nonce,
	604	+ 'version' => BITFORMS_VERSION,
	605	+ 'layout' => $layout,
	606	+ 'nestedLayout' => $nestedLayout,
	607	+ 'fields' => $fields,
	608	+ 'buttons' => $buttons,
	609	+ 'fieldsKey' => $fieldsKey,
	610	+ 'file' => $file,
	611	+ 'configs' => $configs,
	612	+ 'formId' => $formID,
	613	+ 'appID' => "bitforms_{$formID}",
	614	+ 'GCLID' => $FrontendFormManager->isGCLIDEnabled(),
	615	+ 'assetUrl' => BITFORMS_ASSET_URI,
	616	+ 'onfieldCondition' => !empty($workFlowreturnedOnUserInput['onfield_input_conditions']) ? $workFlowreturnedOnUserInput['onfield_input_conditions'] : false,
	617	+ 'smartTags' => $this->buildFrontendSmartTags($formID, $workFlowreturnedOnUserInput, $fields),
	618	+ 'paymentCallbackUrl' => get_rest_url() . 'bitform/v1/payments/razorpay',
	619	+ 'gRecaptchaSiteKey' => !empty($reCAPTCHA->siteKey) ? $reCAPTCHA->siteKey : null,
	620	+ 'gRecaptchaVersion' => !empty($reCAPTCHAVersion) ? $reCAPTCHAVersion : null,
	621	+ 'turnstileSiteKey' => !empty($turnstileSiteKey) ? $turnstileSiteKey : null,
	622	+ 'hCaptchaSiteKey' => !empty($hCaptchaSiteKey) ? $hCaptchaSiteKey : null,
	623	+ ];
	624	+
	625	+ if ($entryId) {
	626	+ $bitFormFrontArr['entryId'] = $entryId;
	627	+ self::markResponseUncacheable();
	628	+ }
	629	+
	630	+ if (isset($additional->enabled->validateFocusLost)) {
	631	+ $bitFormFrontArr['validateFocusLost'] = true;
	632	+ }
	633	+
	634	+ if ($isAbandoned) {
	635	+ // One visitor's typed values, so this response must not be page-cached.
	636	+ $bitFormFrontArr['oldValues'] = $this->getFieldsValue($formID, $abandonedEntryId);
	637	+ self::markResponseUncacheable();
	638	+ if (empty($entryId)) {
	639	+ // Later draft saves must update this entry, not start a new one each time.
	640	+ $bitFormFrontArr['entryId'] = $abandonedEntryId;
	641	+ $entryToken = Cryptography::encrypt($abandonedEntryId, Helpers::getBitformSalt());
	642	+ if (is_string($entryToken)) {
	643	+ $bitFormFrontArr['entryToken'] = $entryToken;
	644	+ }
	645	+ }
	646	+ }
	647	+
	648	+ $formInfo = $FrontendFormManager->getFormInfo();
	649	+ $bitFormFrontArr['formName'] = $formInfo->formName ?? '';
	650	+ if (is_array($layout) && count($layout) > 1) {
	651	+ $multiStepSettings = isset($formInfo->multiStepSettings) ? $formInfo->multiStepSettings : null;
	652	+ $newTempSettings = (object) [
	653	+ 'validateOnStepChange' => isset($multiStepSettings->validateOnStepChange) ? $multiStepSettings->validateOnStepChange : false,
	654	+ 'maintainStepHistory' => isset($multiStepSettings->maintainStepHistory) ? $multiStepSettings->maintainStepHistory : false,
	655	+ 'saveProgress' => isset($multiStepSettings->saveProgress) ? $multiStepSettings->saveProgress : false,
	656	+ 'showPercentage' => isset($multiStepSettings->progressSettings->showPercentage) ? $multiStepSettings->progressSettings->showPercentage : false,
345	657	];
	658	+ $bitFormFrontArr['formInfo'] = (object) [
	659	+ 'multiStepSettings' => $newTempSettings
	660	+ ];
	661	+ }
346	662
347		- $bitFormFrontArr = [
348		- 'ajaxURL' => admin_url('admin-ajax.php'),
349		- 'nonce' => $nonce,
350		- 'version' => BITFORMS_VERSION,
351		- 'layout' => $layout,
352		- 'fields' => $newFields,
353		- 'buttons' => $buttons,
354		- 'fieldsKey' => $fieldsKey,
355		- 'file' => $file,
356		- 'configs' => $configs,
357		- 'formId' => $formID,
358		- 'GCLID' => $FrontendFormManager->isGCLIDEnabled(),
359		- 'assetUrl' => BITFORMS_ASSET_URI,
360		- 'onfieldCondition' => !empty($workFlowreturnedOnUserInput['onfield_input_conditions']) ? $workFlowreturnedOnUserInput['onfield_input_conditions'] : false,
361		- 'smartTags' => !empty($workFlowreturnedOnUserInput['smart_tags']) ? $workFlowreturnedOnUserInput['smart_tags'] : [],
362		- 'paymentCallbackUrl' => get_rest_url() . 'bitform/v1/payments/razorpay',
363		- 'gRecaptchaSiteKey' => !empty($reCAPTCHA->siteKey) ? $reCAPTCHA->siteKey : null,
364		- 'gRecaptchaVersion' => !empty($reCAPTCHAVersion) ? $reCAPTCHAVersion : null,
	663	+ if (Helpers::property_exists_nested($formInfo, 'conversationalSettings->enable', true)) {
	664	+ if (!isset($bitFormFrontArr['formInfo'])) {
	665	+ $bitFormFrontArr['formInfo'] = new \stdClass();
	666	+ }
	667	+ $bitFormFrontArr['formInfo']->conversationalSettings = $formInfo->conversationalSettings;
	668	+ }
	669	+
	670	+ $formAbandonmentSettings = $FrontendFormManager->getFormAbandonmentSettings();
	671	+ if (Helpers::property_exists_nested($formAbandonmentSettings, 'active', true)) {
	672	+ $bitFormFrontArr['formSettings'] = (object)[
	673	+ 'formAbandonment' => $formAbandonmentSettings
365	674	];
	675	+ }
366	676
367		- if (isset($additional->enabled->validateFocusLost)) {
368		- $bitFormFrontArr['validateFocusLost'] = true;
	677	+ $layout = wp_json_encode($layout);
	678	+ $buttons = wp_json_encode($buttons);
	679	+ $frontArr = wp_json_encode($bitFormFrontArr);
	680	+
	681	+ $bfGlobals = sprintf('
	682	+ if(!window.bf_globals) {
	683	+ window.bf_globals = {}
	684	+ } if(!window.bf_globals.%1$s) {
	685	+ window.bf_globals.%1$s = {}
369	686	}
	687	+ window.bf_globals.%1$s = {
	688	+ ...window.bf_globals.%1$s,
	689	+ ...%2$s
	690	+ };
	691	+ if (typeof window.bitformInit === "function") { window.bitformInit("%1$s"); }', $FormIdentifier, $frontArr);
370	692
371		- $bitFormsFront = apply_filters(
372		- 'bitforms_localized_script',
373		- $bitFormFrontArr
374		- );
	693	+ // Inert copy of the config. Optimizers only rewrite executable scripts, so
	694	+ // this survives and travels with the markup; the runtime hydrates from it
	695	+ // whenever bf_globals is missing.
	696	+ $configTag = self::buildFormConfigTag($FormIdentifier, $bitFormFrontArr);
375	697
376		- $fields = \json_encode($fields);
377		- $layout = \json_encode($layout);
378		- $buttons = \json_encode($buttons);
379		- $frontArr = json_encode($bitFormFrontArr);
	698	+ if ('conversational' === $formType
	699	+ && isset($formContent->formInfo->conversationalSettings->enable)
	700	+ && $formContent->formInfo->conversationalSettings->enable) {
	701	+ $html = $FrontendFormManager->conversationalFormView($fields, $file, $errorMessages, null, !empty($entryId));
	702	+ } else {
	703	+ $html = $FrontendFormManager->formView($fields, $file, $errorMessages, null, !empty($entryId));
	704	+ }
380	705
381		- $bfGlobals = "if(!window.bf_globals) {
382		- window.bf_globals = {}
383		- } if(!window.bf_globals.{$FormIdentifier}) {
384		- window.bf_globals.{$FormIdentifier} = {}
385		- }
386		- window.bf_globals.{$FormIdentifier} = {...window.bf_globals.{$FormIdentifier}, ...{$frontArr}};";
387		- $this->addInlineScript($bfGlobals, 'bit-form-all-script', 'before');
	706	+ // if form preview then return html otherwise echo with output buffer
	707	+ if ($formPreview) {
	708	+ ob_clean();
	709	+ $formViewObject = new \stdClass();
	710	+ $formViewObject->html = $html;
	711	+ $formViewObject->font = $font;
	712	+ $formViewObject->bfGlobals = $bfGlobals;
	713	+ $formViewObject->configTag = $configTag;
	714	+ $formViewObject->formContent = $formContent;
	715	+ return $formViewObject;
	716	+ }
388	717
389		- $html = '';
	718	+ $bfGlobalsHandle = 'bitform-bf-globals-' . sanitize_key($FormIdentifier);
	719	+ $this->addInlineScript($bfGlobals, $bfGlobalsHandle, 'after');
	720	+ $this->emitShowPickerBridge();
390	721
391		- FrontendHelpers::isPageBuilder();
392		- global $isPageBuilder;
393		- if ($isPageBuilder) {
394		- $newFormId = $formID . '-formid';
395		- $formStyles = file_get_contents(BITFORMS_CONTENT_DIR . '/form-styles/bitform-' . $newFormId . '.css');
396		- $html .= '<style>' . $formStyles . '</style>';
	722	+ // Printed outside wp_kses rather than allowing <script> in form markup.
	723	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built by buildFormConfigTag(), JSON_HEX_* escaped.
	724	+ echo $configTag;
	725	+ echo wp_kses(trim($html), EscapingHelper::getFormAllowedHtml($formContent));
	726	+ return ob_get_clean();
	727	+ }
	728	+
	729	+ /**
	730	+ * Keep per-visitor config (oldValues, entryId) out of full-page caches.
	731	+ *
	732	+ * @return void
	733	+ */
	734	+ public static function markResponseUncacheable()
	735	+ {
	736	+ // DONOTCACHEPAGE does the work; caches read it at shutdown. Rendering
	737	+ // usually runs after headers are sent, so nocache_headers() is a bonus.
	738	+ if (!defined('DONOTCACHEPAGE')) {
	739	+ define('DONOTCACHEPAGE', true);
	740	+ }
	741	+ if (!headers_sent() && function_exists('nocache_headers')) {
	742	+ nocache_headers();
	743	+ }
	744	+ }
	745	+
	746	+ /**
	747	+ * Build the inert JSON config block for a rendered form.
	748	+ *
	749	+ * JSON_HEX_* escapes < > & as \u00XX so no field value can close the script
	750	+ * element or inject markup.
	751	+ *
	752	+ * @param string $formIdentifier
	753	+ * @param array $config
	754	+ *
	755	+ * @return string
	756	+ */
	757	+ public static function buildFormConfigTag($formIdentifier, $config)
	758	+ {
	759	+ $json = wp_json_encode($config, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
	760	+ if (false === $json) {
	761	+ return '';
	762	+ }
	763	+ // Some optimizers wrap any inline <script>, including application/json,
	764	+ // in DOMContentLoaded boilerplate that corrupts the JSON. These attributes
	765	+ // make the common ones skip it; the JS side also salvage-parses.
	766	+ return sprintf(
	767	+ '<script type="application/json" class="bf-form-config" id="bf-config-%1$s" data-bf-form="%1$s" data-no-optimize="1" data-no-defer="1" data-no-minify="1" data-cfasync="false" nowprocket>%2$s</script>',
	768	+ esc_attr($formIdentifier),
	769	+ $json
	770	+ );
	771	+ }
	772	+
	773	+ /**
	774	+ * Build the smart-tag map exposed to the browser in window.bf_globals[formId].smartTags.
	775	+ *
	776	+ * Security: the legacy code shipped the ENTIRE ~43-tag map to every visitor, leaking
	777	+ * PII (admin/user/author email) and freezing per-visitor request data (IP, time,
	778	+ * browser, referer) into cacheable HTML. We now emit ONLY tags that are (a) actually
	779	+ * referenced by this form's client-evaluated surfaces — conditional logic, payment
	780	+ * notes, admin custom JS — AND (b) flagged frontend-safe in the registry (static/post
	781	+ * context only). Sensitive (identity) and request/visitor tags are never emitted; they
	782	+ * resolve server-side at submit time instead.
	783	+ *
	784	+ * @param int|string $formID
	785	+ * @param mixed $workflowConditions on-field input conditions (client-evaluated)
	786	+ * @param mixed $fields form fields object (carries payment notes, etc.)
	787	+ * @return array<string,string>
	788	+ */
	789	+ private function buildFrontendSmartTags($formID, $workflowConditions, $fields)
	790	+ {
	791	+ // Haystack = only surfaces the browser actually evaluates against smartTags.
	792	+ $haystack = wp_json_encode($workflowConditions) . ' ' . wp_json_encode($fields);
	793	+ $customJs = FrontEndScriptGenerator::getCustomCodes($formID)['JavaScript'];
	794	+ if (is_string($customJs) && '' !== $customJs) {
	795	+ $haystack .= ' ' . $customJs;
	796	+ }
	797	+
	798	+ $ctx = SmartTags::getPostUserData();
	799	+ $frontendSmartTags = [];
	800	+ $referenced = [];
	801	+ foreach (SmartTags::smartTagFieldKeys() as $key) {
	802	+ if (!SmartTagRegistry::isFrontendExposable($key)) {
	803	+ continue; // identity / request / param tags never travel to the browser
397	804	}
398		- $html .= $FrontendFormManager->formView($fields, $file, $errorMessages);
399		- // if form preview then return html otherwise echo with output buffer
400		- if ($formPreview) {
401		- $formViewObject = new \stdClass();
402		- $formViewObject->html = $html;
403		- $formViewObject->font = $font;
404		- $formViewObject->bfGlobals = $bfGlobals;
405		- return $formViewObject;
	805	+ // Match '${' . key prefix so keys containing spaces/slashes/commas are handled.
	806	+ if (false !== strpos($haystack, '${' . $key)) {
	807	+ $referenced[] = $key;
	808	+ $frontendSmartTags[$key] = SmartTagRegistry::resolve($key, $ctx);
406	809	}
	810	+ }
407	811
408		- ob_start();
409		- echo trim($html);
410		- return ob_get_clean();
	812	+ /**
	813	+ * Escape hatch: a site that genuinely needs an extra tag client-side can opt it
	814	+ * back in explicitly here, rather than core shipping everything by default.
	815	+ *
	816	+ * @param array<string,string> $frontendSmartTags resolved frontend-safe smart tags
	817	+ * @param int|string $formID
	818	+ * @param string[] $referenced keys detected in client surfaces
	819	+ */
	820	+ return apply_filters('bitform_frontend_smarttags', $frontendSmartTags, $formID, $referenced);
	821	+ }
	822	+
	823	+ /**
	824	+ * Delegated listener that opens the native picker on date/time inputs marked
	825	+ * with data-bf-show-picker. Replaces the legacy hardcoded onclick attribute.
	826	+ * Registered as inline script once per request via wp_add_inline_script so
	827	+ * the markup never travels through wp_kses().
	828	+ */
	829	+ private function emitShowPickerBridge()
	830	+ {
	831	+ static $emitted = false;
	832	+ if ($emitted) {
	833	+ return;
411	834	}
	835	+ $emitted = true;
	836	+ $code = 'if(!window.__bfShowPickerBound){window.__bfShowPickerBound=true;document.addEventListener("click",function(e){var t=e.target;if(t&&t.matches&&t.matches("input[data-bf-show-picker=\"1\"]")&&typeof t.showPicker==="function"){try{t.showPicker();}catch(_){}}});}';
	837	+ $this->addInlineScript($code, 'bitform-show-picker-bridge', 'after');
412	838	}
413	839
414		- private function isExist($formID) {
	840	+ /**
	841	+ * Does this form row exist?
	842	+ *
	843	+ * @param int $formID
	844	+ *
	845	+ * @return bool
	846	+ */
	847	+ private function isExist($formID)
	848	+ {
415	849	$formModel = new FormModel();
416	850	$form = $formModel->get(
417	851	[
418	852	'id'
		@@ -420,56 +854,244 @@
420	854	[
421	855	'id' => $formID,
422	856	]
423	857	);
424		- if (!is_wp_error($form)) {
425		- return true;
	858	+
	859	+ if (is_wp_error($form)) {
	860	+ if ('result_empty' !== $form->get_error_code()) {
	861	+ Log::debug_log([
	862	+ 'message' => 'Form lookup failed — reported to the visitor as a missing form',
	863	+ 'formID' => $formID,
	864	+ 'code' => $form->get_error_code(),
	865	+ 'error' => $form->get_error_message(),
	866	+ ]);
	867	+ }
	868	+
	869	+ return false;
426	870	}
427		- return false;
	871	+
	872	+ if (empty($form)) {
	873	+ Log::debug_log([
	874	+ 'message' => 'Form lookup returned no rows without an error (is the form table present?)',
	875	+ 'formID' => $formID,
	876	+ ]);
	877	+
	878	+ return false;
	879	+ }
	880	+
	881	+ return true;
428	882	}
429	883
430		- public function loadAssets($recheck = false, $formID = 0, $isFileExists = false) {
431		- FrontendHelpers::getFormIdsFromPost();
432		- FrontendHelpers::isPageBuilder();
433		- global $bfUniqFormIds;
434		- global $bfMultipleFormsExists;
	884	+ private function getFieldsValue($formID, $entryID)
	885	+ {
	886	+ $FrontendFormManager = FrontendFormManager::getInstance($formID, 1);
	887	+ $formEntryModel = new FormEntryMetaModel();
	888	+ $metaValues = $formEntryModel->get(
	889	+ [
	890	+ 'meta_key',
	891	+ 'meta_value'
	892	+ ],
	893	+ [
	894	+ 'bitforms_form_entry_id' => $entryID,
	895	+ ]
	896	+ );
	897	+ $formFields = $FrontendFormManager->getFields();
	898	+ $fldsData = (object) [];
	899	+ if (!is_wp_error($metaValues)) {
	900	+ foreach ($metaValues as $metaValue) {
	901	+ $metaKey = $metaValue->meta_key;
	902	+ $metaVal = $metaValue->meta_value;
	903	+ // if meta value is array then convert to string
	904	+ if (preg_match('/^\[.*\]$/', $metaVal)) {
	905	+ $metaVal = json_decode($metaVal);
	906	+ //check is it array of objects
	907	+ if (is_array($metaVal) && is_object($metaVal[0])) {
	908	+ $metaVal = $metaValue->meta_value;
	909	+ } else {
	910	+ $metaVal = implode(BITFORMS_BF_SEPARATOR, $metaVal);
	911	+ }
	912	+ }
	913	+ // A restored draft never gets the password back; the visitor types it again.
	914	+ if (isset($formFields[$metaKey]['type']) && 'password' === $formFields[$metaKey]['type']) {
	915	+ continue;
	916	+ }
	917	+ if (!isset($fldsData->{$metaKey})) {
	918	+ $fldsData->{$metaKey} = '';
	919	+ }
	920	+ $fldsData->{$metaKey} = $metaVal;
	921	+ if (isset($formFields[$metaKey]['type']) && in_array($formFields[$metaKey]['type'], ['file-up', 'advanced-file-up'])) {
	922	+ $fldsData->{$metaKey} = $metaValue->meta_value;
	923	+ }
	924	+ }
	925	+ }
435	926
436		- if ($formID) {
	927	+ return $fldsData;
	928	+ }
	929	+
	930	+ public function setFieldsValue($fields, $formID, $entryID)
	931	+ {
	932	+ $formEntryModel = new FormEntryMetaModel();
	933	+ $metaValues = $formEntryModel->get(
	934	+ [
	935	+ 'meta_key',
	936	+ 'meta_value'
	937	+ ],
	938	+ [
	939	+ 'bitforms_form_entry_id' => $entryID,
	940	+ ]
	941	+ );
	942	+ if (!is_wp_error($metaValues)) {
	943	+ $urlQuery = wp_parse_url(FileDownloadProvider::getBaseDownloadURL(), PHP_URL_QUERY);
	944	+ $baseDLURL = FileDownloadProvider::getBaseDownloadURL();
	945	+ $baseDLURL = empty($urlQuery) ? $baseDLURL . '?' : $baseDLURL . '&';
	946	+ $baseDLURL .= "formID={$formID}&entryID={$entryID}";
	947	+
	948	+ foreach ($fields as $field) {
	949	+ if ('file-up' === $field->typ || 'advanced-file-up' === $field->typ) {
	950	+ if (!isset($field->config)) {
	951	+ $field->config = (object) [];
	952	+ } elseif (is_array($field->config)) {
	953	+ $field->config = (object) $field->config;
	954	+ }
	955	+ $field->config->baseDLURL = $baseDLURL;
	956	+ }
	957	+ }
	958	+ foreach ($metaValues as $metaValue) {
	959	+ $metaKey = $metaValue->meta_key;
	960	+ $metaVal = $metaValue->meta_value;
	961	+ // if meta value is array then convert to string
	962	+ if (preg_match('/^\[.*\]$/', $metaVal)) {
	963	+ $metaVal = json_decode($metaVal);
	964	+ //check is it array of objects
	965	+ if (is_array($metaVal) && is_object($metaVal[0])) {
	966	+ $metaVal = $metaValue->meta_value;
	967	+ } else {
	968	+ $metaVal = implode(BITFORMS_BF_SEPARATOR, $metaVal);
	969	+ }
	970	+ }
	971	+ if (property_exists($fields, $metaKey) && 'password' === $fields->{$metaKey}->typ) {
	972	+ // Never hand a stored password back to the browser; blank keeps it on update.
	973	+ $fields->{$metaKey}->val = '';
	974	+ if ('' !== (string) $metaValue->meta_value && isset($fields->{$metaKey}->valid) && is_object($fields->{$metaKey}->valid)) {
	975	+ $fields->{$metaKey}->valid->req = false;
	976	+ }
	977	+ continue;
	978	+ }
	979	+ if (property_exists($fields, $metaKey)) {
	980	+ $fields->{$metaKey}->val = $metaVal;
	981	+ if ('file-up' === $fields->{$metaKey}->typ || 'advanced-file-up' === $fields->{$metaKey}->typ) {
	982	+ $fields->{$metaKey}->val = $metaValue->meta_value;
	983	+ $fields->{$metaKey}->config->oldFiles = $metaValue->meta_value;
	984	+ }
	985	+ if ('signature' === $fields->{$metaKey}->typ) {
	986	+ $this->setOldSignature($fields->{$metaKey}, $formID, $entryID, $metaValue->meta_value);
	987	+ }
	988	+ }
	989	+ }
	990	+ }
	991	+ return $fields;
	992	+ }
	993	+
	994	+ /** Give the signature field its stored signature: a data URI to redraw, and the name it posts back as `_old`. */
	995	+ private function setOldSignature($field, $formID, $entryID, $storedValue)
	996	+ {
	997	+ $fileName = is_string($storedValue) ? trim($storedValue) : '';
	998	+ $decoded = json_decode($fileName, true);
	999	+ if (is_array($decoded)) {
	1000	+ $fileName = empty($decoded) ? '' : trim((string) reset($decoded));
	1001	+ }
	1002	+ // signature-failed.png means the stored signature was never usable.
	1003	+ if ('' === $fileName || 'signature-failed.png' === $fileName) {
	1004	+ return;
	1005	+ }
	1006	+ $fileName = sanitize_file_name($fileName);
	1007	+ if (!isset($field->config)) {
	1008	+ $field->config = (object) [];
	1009	+ } elseif (is_array($field->config)) {
	1010	+ $field->config = (object) $field->config;
	1011	+ }
	1012	+ $field->config->oldSignatureFile = $fileName;
	1013	+
	1014	+ $filePath = FileHandler::getEntriesFileUploadDir($formID, $entryID) . DIRECTORY_SEPARATOR . $fileName;
	1015	+ if (!is_file($filePath) || !is_readable($filePath)) {
	1016	+ return;
	1017	+ }
	1018	+ // The types getSignatureFilePath() writes; wp_check_filetype() reports none for SVG.
	1019	+ $signatureMimeTypes = ['png' => 'image/png', 'jpg' => 'image/jpeg', 'svg' => 'image/svg+xml'];
	1020	+ $extension = strtolower((string) pathinfo($fileName, PATHINFO_EXTENSION));
	1021	+ if (!isset($signatureMimeTypes[$extension])) {
	1022	+ return;
	1023	+ }
	1024	+ $mimeType = $signatureMimeTypes[$extension];
	1025	+ // A hand-drawn signature is a few KB; a larger file is not worth inlining.
	1026	+ if (filesize($filePath) > self::MAX_INLINE_SIGNATURE_BYTES) {
	1027	+ return;
	1028	+ }
	1029	+ // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_get_contents -- local upload dir read, inlined as a data URI for the signature pad.
	1030	+ $contents = file_get_contents($filePath);
	1031	+ if (false === $contents || '' === $contents) {
	1032	+ return;
	1033	+ }
	1034	+ $field->config->oldSignature = 'data:' . $mimeType . ';base64,' . base64_encode($contents);
	1035	+ }
	1036	+
	1037	+ public function loadAssets($formID = 0, $fromType = 'classic')
	1038	+ {
	1039	+ $bfUniqFormIds = FrontendHelpers::getAllFormIdsInPage();
	1040	+ $isPageBuilder = FrontendHelpers::$isPageBuilder;
	1041	+ $bfMultipleFormsExists = $isPageBuilder ? true : count($bfUniqFormIds) > 1;
	1042	+
	1043	+ if (!empty($formID)) {
437	1044	$formIds = [$formID];
438		- if (count($bfUniqFormIds) > 1) {
439		- $bfMultipleFormsExists = true;
440		- }
441	1045	} else {
442	1046	$formIds = $bfUniqFormIds;
443	1047	}
444		-
445	1048	foreach ($formIds as $formID) {
	1049	+ global $bitform_dequeued_styles;
	1050	+ if (is_array($bitform_dequeued_styles) && in_array($formID, $bitform_dequeued_styles)) {
	1051	+ continue;
	1052	+ }
446	1053	if ($bfMultipleFormsExists) {
447	1054	$newFormId = $formID . '-formid';
448	1055	} else {
449	1056	$newFormId = $formID;
450	1057	}
451		- if (is_readable(BITFORMS_CONTENT_DIR . '/form-styles/bitform-' . $newFormId . '.css')) {
452		- $styleModifyTime = filemtime(BITFORMS_CONTENT_DIR . '/form-styles/bitform-' . $newFormId . '.css');
453		- wp_register_style(
454		- 'bitform-style' . $formID,
455		- BITFORMS_UPLOAD_BASE_URL . '/form-styles/bitform-' . $newFormId . '.css',
	1058	+ $formUpdateVersion = get_option('bitform_form_update_version');
	1059	+ if (!wp_style_is('bitform-style-' . $newFormId) && is_readable(BITFORMS_CONTENT_DIR . '/form-styles/bitform-' . $newFormId . '.css')) {
	1060	+ wp_enqueue_style(
	1061	+ 'bitform-style-' . $newFormId,
	1062	+ FrontendHelpers::styleSrc("form-styles/bitform-{$newFormId}.css"),
456	1063	[],
457		- $styleModifyTime,
458		- 'all'
	1064	+ $formUpdateVersion
459	1065	);
460		- wp_enqueue_style('bitform-style' . $formID);
	1066	+ if ($isPageBuilder) {
	1067	+ $formStyle = file_get_contents(BITFORMS_CONTENT_DIR . '/form-styles/bitform-' . $newFormId . '.css');
	1068	+ echo '<style id="bitform-style-' . esc_attr((string) $newFormId) . '">' . wp_kses($formStyle, []) . '</style>';
	1069	+ }
461	1070	}
462		- if (is_readable(BITFORMS_CONTENT_DIR . '/form-styles/bitform-custom-' . $newFormId . '.css')) {
463		- $styleModifyTime = filemtime(BITFORMS_CONTENT_DIR . '/form-styles/bitform-custom-' . $newFormId . '.css');
464		- wp_register_style(
	1071	+ if (!wp_style_is('bitform-style-custom-' . $formID) && is_readable(BITFORMS_CONTENT_DIR . '/form-styles/bitform-custom-' . $formID . '.css')) {
	1072	+ wp_enqueue_style(
465	1073	'bitform-style-custom-' . $formID,
466		- BITFORMS_UPLOAD_BASE_URL . '/form-styles/bitform-custom-' . $newFormId . '.css',
	1074	+ FrontendHelpers::styleSrc("form-styles/bitform-custom-{$formID}.css"),
467	1075	[],
468		- $styleModifyTime,
469		- 'all'
	1076	+ $formUpdateVersion
470	1077	);
471		- wp_enqueue_style('bitform-style-custom-' . $formID);
	1078	+ if ($isPageBuilder) {
	1079	+ $formStyle = file_get_contents(BITFORMS_CONTENT_DIR . '/form-styles/bitform-custom-' . $formID . '.css');
	1080	+ echo '<style id="bitform-style-custom-' . esc_attr((string) $formID) . '">' . wp_kses($formStyle, []) . '</style>';
	1081	+ }
	1082	+ }
	1083	+ // load conversational form css
	1084	+ if ('conversational' === $fromType) {
	1085	+ if (!wp_style_is('bitform-conversational-style-' . $formID) &&
	1086	+ is_readable(BITFORMS_CONTENT_DIR . "/form-styles/bitform-conversational-{$formID}.css")) {
	1087	+ wp_enqueue_style(
	1088	+ 'bitform-conversational-style',
	1089	+ FrontendHelpers::styleSrc("form-styles/bitform-conversational-{$formID}.css"),
	1090	+ [],
	1091	+ $formUpdateVersion
	1092	+ );
	1093	+ }
472	1094	}
473	1095	}
474	1096	}
475	1097	}