← All changes | includes/Frontend/Form/FrontendFormManager.php +891 -419 2.0 → V3.3.2 View file →

		@@ -9,8 +9,9 @@
9	9	/**
10	10	* FrontendFormManager class
11	11	*/
12	12
	13	+use BitCode\BitForm\Admin\Form\AdminFormHandler;
13	14	use BitCode\BitForm\Admin\Form\Helpers;
14	15	use BitCode\BitForm\Core\Database\FormEntryModel;
15	16	use BitCode\BitForm\Core\Form\FormManager;
16	17	use BitCode\BitForm\Core\Form\Validator\FormFieldValidator;
		@@ -16,25 +17,34 @@
16	17	use BitCode\BitForm\Core\Form\Validator\FormFieldValidator;
17	18	use BitCode\BitForm\Core\Integration\IntegrationHandler;
18	19	use BitCode\BitForm\Core\Messages\SuccessMessageHandler;
19	20	use BitCode\BitForm\Core\Util\ApiResponse as UtilApiResponse;
20		-use BitCode\BitForm\Core\Util\DateTimeHelper;
	21	+use BitCode\BitForm\Core\Util\EscapingHelper;
	22	+use BitCode\BitForm\Core\Util\FieldValueHandler;
	23	+use BitCode\BitForm\Core\Util\FrontendHelpers;
21	24	use BitCode\BitForm\Core\Util\HttpHelper;
22	25	use BitCode\BitForm\Core\Util\IpTool;
	26	+use BitCode\BitForm\Core\Util\Log;
	27	+use BitCode\BitForm\Core\Util\Utilities;
23	28	use BitCode\BitForm\Core\WorkFlow\WorkFlow;
24		-use BitCode\BitForm\Core\WorkFlow\WorkFlowHandler;
25	29	use BitCode\BitForm\Frontend\Form\View\FormViewer;
	30	+use BitCode\BitForm\GlobalHelper;
26	31	use WP_Error;
27	32
28		-final class FrontendFormManager extends FormManager {
	33	+final class FrontendFormManager extends FormManager
	34	+{
29	35	private $_form_identifier;
	36	+
	37	+ /** @var array|null reCAPTCHA v3 verdict, reused for the log */
	38	+ private $recaptchaV3Verification;
30	39	private $_form_token;
31	40	private $_form_id;
32		- private $_work_flows;
33	41	private $_conf_messages;
	42	+ private static $_instance = [];
34	43
35	44	// private $_has_upload = false;
36		- public function __construct($form_id, $shortCodeCounter = null) {
	45	+ public function __construct($form_id, $shortCodeCounter = null)
	46	+ {
37	47	parent::__construct($form_id);
38	48	$this->_form_identifier = 'bitforms_' . $form_id;
39	49	$this->_form_identifier .= !empty(get_post()->ID) ? '_' . get_post()->ID : '';
40	50	$this->_form_identifier .= !empty($shortCodeCounter) ? "_$shortCodeCounter" : '';
		@@ -41,32 +51,43 @@
41	51	$this->_form_token = wp_create_nonce('bitforms_' . $form_id);
42	52	$this->_form_id = $form_id;
43	53	}
44	54
45		- public function getFormIdentifier() {
	55	+ public static function getInstance($form_id, $shortCodeCounter = null)
	56	+ {
	57	+ $key = $form_id . ':' . ($shortCodeCounter ?? 'default');
	58	+
	59	+ if (!isset(self::$_instance[$key])) {
	60	+ self::$_instance[$key] = new self($form_id, $shortCodeCounter);
	61	+ }
	62	+
	63	+ return self::$_instance[$key];
	64	+ }
	65	+
	66	+ public function getFormIdentifier()
	67	+ {
46	68	return $this->_form_identifier;
47	69	}
48	70
49		- public function getFormID() {
	71	+ public function getFormID()
	72	+ {
50	73	return $this->_form_id;
51	74	}
52	75
53		- public function getFormToken() {
	76	+ public function getFormToken()
	77	+ {
54	78	return $this->_form_token;
55	79	}
56	80
57		- public function isSubmitted() {
58		- // return isset($_POST[$this->_form_identifier]) ? true : false;
59		- return (isset($_POST['bitforms_id']) && $_POST['bitforms_id'] === $this->_form_identifier) ? true : false;
60		- }
61		-
62		- public function getSubmittedFields($submitted_data) {
	81	+ public function getSubmittedFields($submitted_data)
	82	+ {
63	83	unset($submitted_data[$this->_form_identifier]);
64	84	// unset($submitted_data['bit-form-submit-btn']);
65	85	return array_keys($submitted_data);
66	86	}
67	87
68		- public function formView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null) {
	88	+ public function formView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null, $isEntryEdit = false)
	89	+ {
69	90	$formContents = $this->getFormContent();
70	91	$formAtomicClsMap = $this->getAtomicClsMap();
71	92	if (!empty($fields)) {
72	93	$formContents->fields = is_string($fields) ? json_decode($fields) : $fields;
		@@ -78,24 +99,69 @@
78	99	);
79	100	$formContents->fields = empty($workFlowreturnedOnLoad['fields']) ? $formContents->fields : $workFlowreturnedOnLoad['fields'];
80	101	}
81	102	$formViewer = new FormViewer($this, $formContents, $formAtomicClsMap, $errorMessages, $previousValue);
82		- return $formViewer->getView($hasFile);
	103	+ $isRestricted = $this->checkSubmissionRestriction(false, $isEntryEdit);
	104	+ $msg = !empty($isRestricted) ? $isRestricted[0] : '';
	105	+ return $formViewer->getView($hasFile, $msg);
83	106	}
84	107
85		- private function checkEmptySubmission($data, $file) {
	108	+ public function conversationalFormView($fields = null, $hasFile = false, $errorMessages = null, $previousValue = null, $isEntryEdit = false)
	109	+ {
	110	+ $formContents = $this->getFormContent();
	111	+ $formAtomicClsMap = $this->getAtomicClsMap();
	112	+ if (!empty($fields)) {
	113	+ $formContents->fields = is_string($fields) ? json_decode($fields) : $fields;
	114	+ } else {
	115	+ $workFlowRunHelper = new WorkFlow($this->form_id);
	116	+ $workFlowreturnedOnLoad = $workFlowRunHelper->executeOnLoad(
	117	+ 'create',
	118	+ $formContents->fields
	119	+ );
	120	+ $formContents->fields = empty($workFlowreturnedOnLoad['fields']) ? $formContents->fields : $workFlowreturnedOnLoad['fields'];
	121	+ }
	122	+ $formViewer = new FormViewer($this, $formContents, $formAtomicClsMap, $errorMessages, $previousValue);
	123	+ $isRestricted = $this->checkSubmissionRestriction(false, $isEntryEdit);
	124	+ $msg = !empty($isRestricted) ? $isRestricted[0] : '';
	125	+ return $formViewer->getConversationalView($hasFile, $msg);
	126	+ }
	127	+
	128	+ public function checkEmptySubmission($data, $file, $isEntryEdit = false)
	129	+ {
86	130	$formFields = $this->getFields();
87	131	foreach ($formFields as $key => $field) {
88	132	$fieldType = $field['type'];
	133	+ if ('button' === $fieldType) {
	134	+ continue;
	135	+ }
89	136	$fileUploadFieldTypes = ['file-up', 'advanced-file-up'];
	137	+ if ('decision-box' === $fieldType || 'gdpr' === $fieldType) {
	138	+ continue;
	139	+ }
90	140	$isFileType = in_array($fieldType, $fileUploadFieldTypes);
91		- if (!$isFileType && !empty($data[$key])) {
	141	+ // An edit keeps an untouched file/signature as `<fieldKey>_old`, not as an upload.
	142	+ if (
	143	+ $isEntryEdit
	144	+ && ($isFileType || 'signature' === $fieldType)
	145	+ && !empty(FieldValueHandler::retainedOldValues($data, $key))
	146	+ ) {
92	147	return false;
93	148	}
	149	+ if ($this->isRepeatedField($key)) {
	150	+ $fileData = !empty($file[$key]) ? $file[$key] : [];
	151	+ $dataVal = !empty($data[$key]) ? $data[$key] : [];
	152	+ if (!$this->checkRepeatedFieldEmptySubmission($isFileType, $dataVal, $fileData)) {
	153	+ return false;
	154	+ }
	155	+ continue;
	156	+ }
	157	+ if (!$isFileType && (!empty($data[$key]) || (isset($data[$key]) && is_numeric($data[$key])))) {
	158	+ return false;
	159	+ }
94	160	if ($isFileType && !empty($file[$key]['name']) && is_string($file[$key]['name'])) {
95	161	return false;
96	162	}
97		- if ($isFileType && is_array($file[$key]['name']) && !empty($file[$key]['name'][0])) {
	163	+ if ($isFileType && !empty($file[$key]['name'][0])) {
98	164	return false;
99	165	}
100	166	}
101	167	return true;
		@@ -100,50 +166,224 @@
100	166	}
101	167	return true;
102	168	}
103	169
104		- private function getParams() {
105		- $url = parse_url(wp_get_referer());
	170	+ private function checkRepeatedFieldEmptySubmission($isFileType, $data, $file = [])
	171	+ {
	172	+ if (!$isFileType) {
	173	+ foreach ($data as $value) {
	174	+ if (!empty($value)) {
	175	+ return false;
	176	+ }
	177	+ }
	178	+ }
	179	+ if ($isFileType) {
	180	+ foreach ($file['name'] as $value) {
	181	+ if (!empty($value) && is_string($value)) {
	182	+ return false;
	183	+ }
	184	+ if (is_array($value) && !empty($value[0])) {
	185	+ return false;
	186	+ }
	187	+ }
	188	+ }
	189	+ return true;
	190	+ }
	191	+
	192	+ private function getParams()
	193	+ {
	194	+ $url = wp_parse_url(wp_get_referer());
106	195	$parameter = [];
107	196	if (isset($url['query'])) {
108		- $queries = explode('&', $url['query']);
109		- foreach ($queries as $query) {
110		- list($field, $value) = explode('=', $query);
111		- $parameter[$field] = $value;
	197	+ // a bare key (?preview) made the old explode() split warn; this also URL-decodes values
	198	+ wp_parse_str($url['query'], $parameter);
	199	+ }
	200	+ return $parameter;
	201	+ }
	202	+
	203	+ private function getFormFields($formID)
	204	+ {
	205	+ $adminFormHandler = new AdminFormHandler();
	206	+ $post = new \stdClass();
	207	+ $post = (object) [
	208	+ 'id' => $formID
	209	+ ];
	210	+ $getForm = $adminFormHandler->getAForm('', $post);
	211	+ $formContainer = $getForm['form_content'];
	212	+
	213	+ return $formContainer['fields'];
	214	+ }
	215	+
	216	+ private function transformDrpdwnValue($post)
	217	+ {
	218	+ $formFields = $this->getFormFields($this->_form_id);
	219	+
	220	+ foreach ($post as $key => $value) {
	221	+ if (!str_starts_with($key, 'repeater') && isset($formFields->{$key}) && 'select' === $formFields->{$key}->typ) {
	222	+ if (is_array($value)) {
	223	+ foreach ($value as $k => $v) {
	224	+ $post[$key][$k] = !is_array($v) && is_string($v) ? explode(BITFORMS_BF_SEPARATOR, $v) : $v;
	225	+ }
	226	+ } else {
	227	+ $post[$key] = explode(BITFORMS_BF_SEPARATOR, $value);
	228	+ }
	229	+ };
	230	+ }
	231	+
	232	+ return $post;
	233	+ }
	234	+
	235	+ /**
	236	+ * WP auth errors carry markup and the confirmation box paints them with innerHTML,
	237	+ * so esc_html() would show the tags as text. kses keeps only the safe markup.
	238	+ *
	239	+ * @param mixed $message
	240	+ *
	241	+ * @return string
	242	+ */
	243	+ private static function authErrorMessage($message)
	244	+ {
	245	+ return wp_kses(is_string($message) ? $message : '', EscapingHelper::getAllowedHtmlTags());
	246	+ }
	247	+
	248	+ /**
	249	+ * A confirm-enabled email/password field posts as one composite and the validator collapses it
	250	+ * to the primary value, so the confirm child's own field key never reaches $_POST. WP auth
	251	+ * integrations map fields by key, so fill those child keys on a copy for the auth filter.
	252	+ *
	253	+ * @param mixed $postData
	254	+ *
	255	+ * @return mixed
	256	+ */
	257	+ private function resolveConfirmChildValues($postData)
	258	+ {
	259	+ if (!is_array($postData)) {
	260	+ return $postData;
	261	+ }
	262	+ $fields = $this->getFields();
	263	+ $postData = $this->resolveCompositeChildValues($postData, $fields);
	264	+ foreach ($fields as $fieldKey => $fieldData) {
	265	+ if (
	266	+ empty($fieldData['childFields'])
	267	+ || !isset($fieldData['type'])
	268	+ || !in_array($fieldData['type'], ['email', 'password'], true)
	269	+ || !empty($fieldData['repeated'])
	270	+ || !isset($postData[$fieldKey])
	271	+ ) {
	272	+ continue;
112	273	}
	274	+ $parentValue = $postData[$fieldKey];
	275	+ foreach ((array) $fieldData['childFields'] as $childFieldRef) {
	276	+ $childKey = is_object($childFieldRef) && isset($childFieldRef->fldKey) ? $childFieldRef->fldKey : '';
	277	+ if (
	278	+ empty($childKey)
	279	+ || !isset($fields[$childKey])
	280	+ || !empty($fields[$childKey]['isDeactive'])
	281	+ || isset($postData[$childKey])
	282	+ ) {
	283	+ continue;
	284	+ }
	285	+ if (is_array($parentValue)) {
	286	+ if (array_key_exists('confirm', $parentValue)) {
	287	+ $postData[$childKey] = $parentValue['confirm'];
	288	+ }
	289	+ continue;
	290	+ }
	291	+ // Validation matched primary against confirm before collapsing, so this is that value.
	292	+ $postData[$childKey] = $parentValue;
	293	+ }
	294	+ if (is_array($parentValue) && array_key_exists('primary', $parentValue)) {
	295	+ $postData[$fieldKey] = $parentValue['primary'];
	296	+ }
113	297	}
114		- return $parameter;
	298	+
	299	+ return $postData;
115	300	}
116	301
117		- public function handleSubmission() {
	302	+ /**
	303	+ * Name/Address parts post as one array under the parent key ("parent[first_name]"), so a WP
	304	+ * auth mapping that points at a part's own key (First Name, Last Name) found nothing. Copy each
	305	+ * part's value to its key; the parent value is left as it was.
	306	+ *
	307	+ * @param array $postData
	308	+ * @param array $fields getFields() output
	309	+ *
	310	+ * @return array
	311	+ */
	312	+ private function resolveCompositeChildValues($postData, $fields)
	313	+ {
	314	+ foreach ($fields as $fieldKey => $fieldData) {
	315	+ if (
	316	+ empty($fieldData['childFields'])
	317	+ || !isset($fieldData['type'])
	318	+ || !in_array($fieldData['type'], ['name', 'address'], true)
	319	+ || !empty($fieldData['repeated'])
	320	+ || !isset($postData[$fieldKey])
	321	+ || !is_array($postData[$fieldKey])
	322	+ ) {
	323	+ continue;
	324	+ }
	325	+ foreach ((array) $fieldData['childFields'] as $childFieldRef) {
	326	+ $childKey = is_object($childFieldRef) && isset($childFieldRef->fldKey) ? $childFieldRef->fldKey : '';
	327	+ if (
	328	+ empty($childKey)
	329	+ || !isset($fields[$childKey])
	330	+ || !empty($fields[$childKey]['isDeactive'])
	331	+ || isset($postData[$childKey])
	332	+ || !preg_match('/\[([^\]]+)\]$/', (string) ($fields[$childKey]['name'] ?? ''), $matches)
	333	+ ) {
	334	+ continue;
	335	+ }
	336	+ $value = FieldValueHandler::extractChildValueFromParentValue($postData[$fieldKey], $matches[1], $childKey);
	337	+ if (null !== $value) {
	338	+ $postData[$childKey] = $value;
	339	+ }
	340	+ }
	341	+ }
	342	+
	343	+ return $postData;
	344	+ }
	345	+
	346	+ public function handleSubmission()
	347	+ {
	348	+ // CSRF verified via verifySubmissionNonce() before this method is called. All $_POST reads below occur after that verification.
118	349	$this->fieldNameReplaceOfPost();
	350	+
119	351	$validated = $this->beforeSubmittedValidate();
120	352
	353	+ $validated = apply_filters('bitform_filter_form_validation', $validated, $this->_form_id);
	354	+
121	355	if (true === $validated) {
122		- unset($_POST['hidden_fields']);
	356	+ do_action('bitform_validation_success', $this->_form_id);
	357	+ $this->discardHiddenFieldValues();
123	358
124	359	$redirectPage = '';
125	360	$regSuccMsg = '';
126	361
127	362	$existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
	363	+ $unslashed_post = wp_unslash($_POST);
128	364	if (!is_wp_error($existAuth) && count($existAuth) > 0) {
129	365	$parameter = $this->getParams();
130		- $existAuthFilter = has_filter('bf_wp_user_auth');
	366	+ $existAuthFilter = has_filter('bitform_wp_user_auth');
131	367
132	368	if (true === $existAuthFilter) {
133		- $result = apply_filters('bf_wp_user_auth', $existAuth[0], $_POST, $parameter);
	369	+ $authPostData = $this->resolveConfirmChildValues($unslashed_post);
	370	+ $result = apply_filters('bitform_wp_user_auth', $existAuth[0], $authPostData, $parameter);
134	371
	372	+ $result = apply_filters('bitform_filter_wp_user_auth_response', $result, $this->_form_id, $authPostData, $parameter);
	373	+
	374	+ do_action('bitform_wp_user_auth_response', $result, $this->_form_id, $authPostData, $parameter);
	375	+
135	376	if (isset($result['auth_type']) && 'register' === $result['auth_type']) {
136	377	if (!$result['success']) {
137		- return new WP_Error('errors', __($result['message'], 'bit-form'));
	378	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
138	379	} elseif (isset($result['success'])) {
139		- $redirectPage = $result['redirect_url'];
	380	+ $redirectPage = $result['redirectPage'];
140	381	$regSuccMsg = $result['message'];
141		- $newNonce = wp_create_nonce('bitforms_' . $this->_form_id);
142	382	}
143	383	} else {
144	384	if (!$result['success']) {
145		- return new WP_Error('errors', __($result['message'], 'bit-form'));
	385	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
146	386	} else {
147	387	return $result;
148	388	}
149	389	}
		@@ -149,44 +389,21 @@
149	389	}
150	390	}
151	391	}
152	392
153		- $saveResponse = $this->saveFormEntry($_POST);
	393	+ $saveResponse = $this->saveFormEntry($unslashed_post);
154	394	if (is_wp_error($saveResponse)) {
155	395	return $saveResponse;
156	396	}
157	397
158	398	$entryID = $saveResponse['entry_id'];
159		- do_action('bitform_submit_success', $this->_form_id, $entryID, $_POST);
160	399
161		- $captchaV3Settings = $this->getCaptchaV3Settings();
162		- if ($captchaV3Settings) {
163		- $token = $_POST['g-recaptcha-response'];
164		- $integrationHandler = new IntegrationHandler(0);
165		- $allFormIntegrations = $integrationHandler->getAllIntegration('app', 'gReCaptchaV3');
166		- if (!is_wp_error($allFormIntegrations)) {
167		- foreach ($allFormIntegrations as $integration) {
168		- if (!is_null($integration->integration_type) && 'gReCaptchaV3' === $integration->integration_type) {
169		- $integrationDetails = json_decode($integration->integration_details);
170		- $integrationDetails->id = $integration->id;
171		- $reCAPTCHA = $integrationDetails;
172		- }
173		- }
174		- }
175		- if (!empty($reCAPTCHA->secretKey)) {
176		- $gRecaptchaResponse = HttpHelper::post(
177		- 'https://www.google.com/recaptcha/api/siteverify',
178		- ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
179		- );
180		- if ($captchaV3Settings && !empty($saveResponse['triggerData'])) {
181		- $logID = $saveResponse['triggerData']['logID'];
182		- $integId = $reCAPTCHA->id;
183		- $saveApiResponse = new UtilApiResponse();
184		- $saveApiResponse->apiResponse($logID, $integId, ['type_name' => 'ReCaptcha', 'type' => 'v3'], 'success', $gRecaptchaResponse);
185		- }
186		- }
187		- unset($_POST['g-recaptcha-response']);
188		- }
	400	+ // transformed dropdown value from string to array
	401	+ $newPost = $this->transformDrpdwnValue($unslashed_post);
	402	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
	403	+ do_action('bitform_submit_success', $this->_form_id, $entryID, $newPost, $filesData);
	404	+
	405	+ $this->logRecaptchaV3Verification($saveResponse);
189	406	if (!empty($redirectPage) && empty($saveResponse['redirectPage']) || null === $saveResponse['redirectPage']) {
190	407	$saveResponse['redirectPage'] = $redirectPage;
191	408	}
192	409	if (!empty($regSuccMsg) && isset($saveResponse['dflt_message'])) {
		@@ -191,15 +408,14 @@
191	408	}
192	409	if (!empty($regSuccMsg) && isset($saveResponse['dflt_message'])) {
193	410	$saveResponse['message'] = $regSuccMsg;
194	411	}
	412	+ $saveResponse['new_nonce'] = wp_create_nonce('bitforms_' . $this->_form_id);
	413	+
195	414	$saveResponse = IntegrationHandler::maybeSetCronForIntegration($saveResponse, 'create');
196	415	$entryId = $saveResponse['entry_id'];
197	416
198	417	$responseMsg = is_array($saveResponse) && !empty($saveResponse) ? $saveResponse : __('Form Submitted Successfully', 'bit-form');
199		- if (isset($newNonce)) {
200		- $responseMsg['new_nonce'] = $newNonce;
201		- }
202	418	$_POST = [];
203	419	$responseMsg['entry_id'] = $entryId;
204	420	return $responseMsg;
205	421	}
		@@ -206,41 +422,48 @@
206	422	do_action('bitform_validation_error', $this->_form_id, $validated);
207	423	return $validated;
208	424	}
209	425
210		- public function handleUpdateEntry() {
	426	+ public function handleUpdateEntry()
	427	+ {
	428	+ // Entry token or capability verified by caller (FrontendAjax::update_entry). All $_POST reads occur after that check.
211	429	$this->fieldNameReplaceOfPost();
212		- $validated = $this->beforeSubmittedValidate();
	430	+ $validated = $this->beforeSubmittedValidate(true, true);
	431	+ $validated = apply_filters('bitform_filter_form_validation', $validated, $this->_form_id);
213	432
214		- $entryID = $_POST['entryID'];
	433	+ $entryID = isset($_REQUEST['entryID']) ? sanitize_text_field(wp_unslash($_REQUEST['entryID'])) : null;
	434	+ $GLOBALS['bitform_entry_id'] = $entryID;
215	435	if (is_null($entryID)) {
216	436	return new WP_Error('empty_form', __('Entries id is invalid', 'bit-form'));
217	437	}
218	438	if (true === $validated) {
219		- unset($_POST['hidden_fields'], $_POST['entryID']);
	439	+ do_action('bitform_validation_success', $this->_form_id);
	440	+ $this->discardHiddenFieldValues();
	441	+ unset($_POST['entryID']);
220	442
221	443	$redirectPage = '';
222	444	$regSuccMsg = '';
	445	+ $postData = wp_unslash($_POST);
223	446
224	447	$existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
225	448	if (!is_wp_error($existAuth) && count($existAuth) > 0) {
226	449	$parameter = $this->getParams();
227		- $existAuthFilter = has_filter('bf_wp_user_auth');
	450	+ $existAuthFilter = has_filter('bitform_wp_user_auth');
228	451
229	452	if (true === $existAuthFilter) {
230		- $result = apply_filters('bf_wp_user_auth', $existAuth[0], $_POST, $parameter);
	453	+ $authPostData = $this->resolveConfirmChildValues($postData);
	454	+ $result = apply_filters('bitform_wp_user_auth', $existAuth[0], $authPostData, $parameter);
231	455
232	456	if (isset($result['auth_type']) && 'register' === $result['auth_type']) {
233	457	if (!$result['success']) {
234		- return new WP_Error('errors', __($result['message'], 'bit-form'));
	458	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
235	459	} elseif (isset($result['success'])) {
236		- $redirectPage = $result['redirect_url'];
	460	+ $redirectPage = $result['redirectPage'];
237	461	$regSuccMsg = $result['message'];
238		- $newNonce = wp_create_nonce('bitforms_' . $this->_form_id);
239	462	}
240	463	} else {
241	464	if (!$result['success']) {
242		- return new WP_Error('errors', __($result['message'], 'bit-form'));
	465	+ return new WP_Error('errors', self::authErrorMessage($result['message']));
243	466	} else {
244	467	return $result;
245	468	}
246	469	}
		@@ -246,43 +469,22 @@
246	469	}
247	470	}
248	471	}
249	472
250		- $updateResponse = $this->updateFormEntry($_POST, $this->getFormID(), $entryID);
	473	+ $updateResponse = $this->updateFormEntry(wp_unslash($_POST), $this->getFormID(), $entryID);
251	474	if (is_wp_error($updateResponse)) {
252	475	return $updateResponse;
253	476	}
254	477
255		- do_action('bitform_submit_success', $this->_form_id, $entryID, $_POST);
	478	+ // transformed dropdown value from string to array
	479	+ $newPost = $this->transformDrpdwnValue($postData);
	480	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
256	481
257		- $captchaV3Settings = $this->getCaptchaV3Settings();
258		- if ($captchaV3Settings) {
259		- $token = $_POST['g-recaptcha-response'];
260		- $integrationHandler = new IntegrationHandler(0);
261		- $allFormIntegrations = $integrationHandler->getAllIntegration('app', 'gReCaptchaV3');
262		- if (!is_wp_error($allFormIntegrations)) {
263		- foreach ($allFormIntegrations as $integration) {
264		- if (!is_null($integration->integration_type) && 'gReCaptchaV3' === $integration->integration_type) {
265		- $integrationDetails = json_decode($integration->integration_details);
266		- $integrationDetails->id = $integration->id;
267		- $reCAPTCHA = $integrationDetails;
268		- }
269		- }
270		- }
271		- if (!empty($reCAPTCHA->secretKey)) {
272		- $gRecaptchaResponse = HttpHelper::post(
273		- 'https://www.google.com/recaptcha/api/siteverify',
274		- ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
275		- );
276		- if ($captchaV3Settings && !empty($updateResponse['triggerData'])) {
277		- $logID = $updateResponse['triggerData']['logID'];
278		- $integId = $reCAPTCHA->id;
279		- $saveApiResponse = new UtilApiResponse();
280		- $saveApiResponse->apiResponse($logID, $integId, ['type_name' => 'ReCaptcha', 'type' => 'v3'], 'success', $gRecaptchaResponse);
281		- }
282		- }
283		- unset($_POST['g-recaptcha-response']);
284		- }
	482	+ //TO DO:: submit success action temporarily added for solution of a issue
	483	+ do_action('bitform_submit_success', $this->_form_id, $entryID, $newPost, $filesData);
	484	+ do_action('bitform_update_success', $this->_form_id, $entryID, $newPost, $filesData);
	485	+
	486	+ $this->logRecaptchaV3Verification($updateResponse);
285	487	if (!empty($redirectPage) && empty($updateResponse['redirectPage']) || null === $updateResponse['redirectPage']) {
286	488	$updateResponse['redirectPage'] = $redirectPage;
287	489	}
288	490	if (!empty($regSuccMsg) && isset($updateResponse['dflt_message'])) {
		@@ -287,15 +489,14 @@
287	489	}
288	490	if (!empty($regSuccMsg) && isset($updateResponse['dflt_message'])) {
289	491	$updateResponse['message'] = $regSuccMsg;
290	492	}
291		- $updateResponse = IntegrationHandler::maybeSetCronForIntegration($updateResponse, 'create');
	493	+ $updateResponse['new_nonce'] = wp_create_nonce('bitforms_' . $this->_form_id);
	494	+ $updateResponse = IntegrationHandler::maybeSetCronForIntegration($updateResponse, 'update');
292	495	$entryId = $updateResponse['entry_id'];
293	496
294	497	$responseMsg = is_array($updateResponse) && !empty($updateResponse) ? $updateResponse : __('Entry Update Successfully', 'bit-form');
295		- if (isset($newNonce)) {
296		- $responseMsg['new_nonce'] = $newNonce;
297		- }
	498	+
298	499	$_POST = [];
299	500	$responseMsg['entry_id'] = $entryId;
300	501	return $responseMsg;
301	502	}
		@@ -302,10 +503,96 @@
302	503	do_action('bitform_validation_error', $this->_form_id, $validated);
303	504	return $validated;
304	505	}
305	506
306		- public function validateFormSubmission($submitted_data) {
307		- $hidden_fields = isset($submitted_data['hidden_fields']) ? $submitted_data['hidden_fields'] : '';
	507	+ /**
	508	+ * Drop the posted `hidden_fields` transport key and, when the form opts in, the values of
	509	+ * the fields it names.
	510	+ *
	511	+ * A hidden field keeps its typed value in the DOM, so the browser still submits it. Runs
	512	+ * here because it is the last point before entry, notifications and integrations are built
	513	+ * from $_POST.
	514	+ *
	515	+ * @return void
	516	+ */
	517	+ private function discardHiddenFieldValues()
	518	+ {
	519	+ // CSRF verified upstream via verifySubmissionNonce(); $_POST is only being narrowed here.
	520	+ $rawHiddenFields = isset($_POST['hidden_fields']) ? wp_unslash($_POST['hidden_fields']) : '';
	521	+ unset($_POST['hidden_fields']);
	522	+
	523	+ if (!$this->shouldDiscardHiddenFieldValues()) {
	524	+ return;
	525	+ }
	526	+ $hiddenFieldKeys = FrontendHelpers::parseHiddenFieldKeys($rawHiddenFields);
	527	+ if (empty($hiddenFieldKeys)) {
	528	+ return;
	529	+ }
	530	+
	531	+ $formFields = $this->getFields();
	532	+ foreach ($hiddenFieldKeys as $fieldKey) {
	533	+ if (!isset($formFields[$fieldKey])) {
	534	+ continue;
	535	+ }
	536	+ $field = $formFields[$fieldKey];
	537	+ // The posted list also names builder-hidden and hidden-type fields, which carry a value
	538	+ // on purpose. Only what conditional logic hid is discarded.
	539	+ if ('hidden' === $field['type'] || !empty($field['valid']['hide'])) {
	540	+ continue;
	541	+ }
	542	+ // Hiding flags a repeater child once, not per row, so discarding would wipe the column
	543	+ // in every row.
	544	+ if (!empty($field['repeated'])) {
	545	+ continue;
	546	+ }
	547	+ // Calculation and tracking fields opt out.
	548	+ if (!empty($field['valid']['keepValueWhenHidden'])) {
	549	+ continue;
	550	+ }
	551	+ // A composite child (name/address/confirm) posts nested under its parent key.
	552	+ if (!empty($field['parentFieldKey'])) {
	553	+ $this->discardCompositeChildValue($formFields, $field, $fieldKey);
	554	+ continue;
	555	+ }
	556	+ unset($_POST[$fieldKey], $_FILES[$fieldKey]);
	557	+ }
	558	+ }
	559	+
	560	+ /**
	561	+ * @param array $formFields
	562	+ * @param array $field the child field's config
	563	+ * @param string $fieldKey the child field's key
	564	+ *
	565	+ * @return void
	566	+ */
	567	+ private function discardCompositeChildValue($formFields, $field, $fieldKey)
	568	+ {
	569	+ $parentKey = $field['parentFieldKey'];
	570	+ if (!isset($_POST[$parentKey]) || !is_array($_POST[$parentKey])) {
	571	+ return;
	572	+ }
	573	+ $parentName = isset($formFields[$parentKey]['name']) ? $formFields[$parentKey]['name'] : '';
	574	+ $childName = FieldValueHandler::deriveChildName(isset($field['name']) ? $field['name'] : '', $parentName);
	575	+ unset($_POST[$parentKey][$childName], $_POST[$parentKey][$fieldKey]);
	576	+ }
	577	+
	578	+ /**
	579	+ * @return bool
	580	+ */
	581	+ private function shouldDiscardHiddenFieldValues()
	582	+ {
	583	+ $formInfo = $this->getFormInfo();
	584	+ if (!is_object($formInfo) || !isset($formInfo->submissionSettings)) {
	585	+ return false;
	586	+ }
	587	+ $submissionSettings = (object) $formInfo->submissionSettings;
	588	+
	589	+ return !empty($submissionSettings->discardHiddenFieldValues);
	590	+ }
	591	+
	592	+ public function validateFormSubmission($submitted_data)
	593	+ {
	594	+ $hidden_fields = FrontendHelpers::parseHiddenFieldKeys(isset($submitted_data['hidden_fields']) ? $submitted_data['hidden_fields'] : '');
308	595	$submitted_fields = $this->getSubmittedFields($submitted_data);
309	596	$form_fields = $this->getFields();
310	597	$form_fields_names = array_keys($form_fields);
311	598	if ($this->isGCLIDEnabled()) {
		@@ -310,10 +597,10 @@
310	597	$form_fields_names = array_keys($form_fields);
311	598	if ($this->isGCLIDEnabled()) {
312	599	array_push($form_fields_names, 'GCLID');
313	600	}
314		- foreach ($submitted_fields as $key => $field) {
315		- if ('hidden_fields' !== $field && !in_array($field, $form_fields_names) || false !== strpos($hidden_fields, $field)) {
	601	+ foreach ($submitted_fields as $field) {
	602	+ if ('hidden_fields' !== $field && !in_array($field, $form_fields_names) || FrontendHelpers::isFieldHidden($hidden_fields, $field)) {
316	603	unset($submitted_data[$field]);
317	604	}
318	605	}
319	606	return $submitted_data;
		@@ -318,81 +605,41 @@
318	605	}
319	606	return $submitted_data;
320	607	}
321	608
322		- public function fieldNameReplaceOfPost() {
323		- $fields = $this->getFields();
324		- foreach ($fields as $fieldKey => $fieldData) {
325		- if (array_key_exists('name', $fieldData)) {
326		- $fldName = $fieldData['name'];
327		- if (array_key_exists($fldName, $_POST)) {
328		- $temp = $_POST[$fldName];
329		- unset($_POST[$fldName]);
330		- $_POST[$fieldKey] = $temp;
331		- } elseif (array_key_exists($fldName, $_FILES)) {
332		- $temp = $_FILES[$fldName];
333		- unset($_FILES[$fldName]);
334		- $_FILES[$fieldKey] = $temp;
335		- }
336		- }
337		- }
338		- }
339		-
340		- public function beforeSubmittedValidate() {
	609	+ public function beforeSubmittedValidate($verifyCaptcha = true, $isEntryEdit = false)
	610	+ {
341	611	if ($this->verifySubmissionNonce()) {
342	612	if ($this->isExist()) {
343		- $isRestricted = $this->checkSubmissionRestriction();
	613	+ $isRestricted = $this->checkSubmissionRestriction(true, $isEntryEdit);
344	614	if ($isRestricted && !empty($isRestricted)) {
345	615	return new WP_Error('spam_detection', $isRestricted[0]);
346	616	}
347		- if ($this->isTrappedInHoneypot()) {
	617	+ $postData = wp_unslash($_POST);
	618	+ $filesData = GlobalHelper::sanitize_files_input($_FILES);
	619	+ $isHoneypot = apply_filters('bitform_check_honeypot', false, $this->_form_id, $postData);
	620	+ if ($isHoneypot) {
348	621	return new WP_Error('spam_detection', __('Token verification failed', 'bit-form'));
349	622	}
350		- $captchaSettings = $this->getCaptchaSettings();
351		- $captchaV3Settings = $this->getCaptchaV3Settings();
352		- if ($captchaSettings || $captchaV3Settings) {
353		- $token = $_POST['g-recaptcha-response'];
354		- if (!isset($_POST['g-recaptcha-response'])) {
355		- return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	623	+ $formCurrentStep = isset($_POST['form-current-step']) ? sanitize_text_field(wp_unslash($_POST['form-current-step'])) : null;
	624	+ // TODO: Temporary parameter to skip captcha verification in step change of multi step form
	625	+ if ($verifyCaptcha) {
	626	+ $verifyGRecaptchaResult = $this->verifyGRecaptcha();
	627	+ if (is_wp_error($verifyGRecaptchaResult)) {
	628	+ return $verifyGRecaptchaResult;
356	629	}
357		- $integrationHandler = new IntegrationHandler(0);
358		- $allFormIntegrations = $integrationHandler->getAllIntegration('app', $captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3');
359		- if (!is_wp_error($allFormIntegrations)) {
360		- foreach ($allFormIntegrations as $integration) {
361		- if (!is_null($integration->integration_type) && $integration->integration_type === ($captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3')) {
362		- $integrationDetails = json_decode($integration->integration_details);
363		- $integrationDetails->id = $integration->id;
364		- $reCAPTCHA = $integrationDetails;
365		- }
366		- }
	630	+ $verifyHCaptchaResult = $this->verifyHCaptcha();
	631	+ if (is_wp_error($verifyHCaptchaResult)) {
	632	+ return $verifyHCaptchaResult;
367	633	}
368		- if (!empty($reCAPTCHA->secretKey)) {
369		- $gRecaptchaResponse = HttpHelper::post(
370		- 'https://www.google.com/recaptcha/api/siteverify',
371		- ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
372		- );
373		- $isgReCaptchaVerified = false;
374		- if (!is_wp_error($gRecaptchaResponse)) {
375		- if (
376		- $captchaV3Settings
377		- && !empty($gRecaptchaResponse->score)
378		- && ((float) $gRecaptchaResponse->score < (float) $captchaV3Settings->score)
379		- ) {
380		- wp_send_json_error(
381		- __(
382		- $captchaV3Settings->message,
383		- 'bit-form'
384		- )
385		- );
386		- }
387		-
388		- $isgReCaptchaVerified = $gRecaptchaResponse->success;
389		- }
390		- if (!$isgReCaptchaVerified) {
391		- return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
392		- }
	634	+ /* Implement Turnstile Captcha start */
	635	+ $verifyTurnstileCaptchaResult = $this->verifyTurnstileCaptcha();
	636	+ if (is_wp_error($verifyTurnstileCaptchaResult)) {
	637	+ return $verifyTurnstileCaptchaResult;
393	638	}
394	639	}
	640	+ /* Implement Turnstile Captcha end */
	641	+
395	642	$existAuth = (new IntegrationHandler($this->_form_id))->getAllIntegration('wp_user_auth', 'wp_auth', 1);
396	643
397	644	// check if user is already logged in and form has auth integration
398	645	do_action('bitform_checked_exist_auth', $this->_form_id, $existAuth);
		@@ -398,17 +645,80 @@
398	645	do_action('bitform_checked_exist_auth', $this->_form_id, $existAuth);
399	646	if (!is_wp_error($existAuth) && count($existAuth) > 0 && is_user_logged_in()) {
400	647	return new WP_Error('auth_error', __('You are already logged in', 'bit-form'));
401	648	}
402		- $validateForm = $this->validateFormSubmission($_POST);
403		- $validateFormFiles = $this->validateFormSubmission($_FILES);
	649	+ $validateForm = $this->validateFormSubmission($postData);
	650	+ $validateFormFiles = $this->validateFormSubmission($filesData);
404	651	$validateForm = array_merge($validateForm, $validateFormFiles);
405		- $form_fields = $this->getFields();
406		- $formFieldValidator = new FormFieldValidator($form_fields, $_POST, $_FILES);
	652	+ // Validate only provably-rendered fields: a field stranded in form_content->fields
	653	+ // with no layout entry (orphan) is never shown to the user and must not block
	654	+ // submission. getRenderedFields() unions ALL breakpoints × steps × nested layouts
	655	+ // + childFields of rendered parents, derives only from DB-stored form_content,
	656	+ // and fails closed (returns all fields) when the layout is unusable.
	657	+ $form_fields = $this->getRenderedFields();
	658	+ // check if form-current-step is set and form is multi-step
	659	+ $formCurrentStep = isset($_POST['form-current-step']) ? sanitize_text_field(wp_unslash($_POST['form-current-step'])) : null;
	660	+ if (!is_null($formCurrentStep)) {
	661	+ // Narrow validation to the current step's fields. SECURITY: the step
	662	+ // key set unions ALL breakpoints (lg/md/sm) — an md/sm-only field was
	663	+ // previously null-skipped by the validator (silent bypass). A forged
	664	+ // step index or malformed layout skips the narrowing entirely so every
	665	+ // rendered field stays validated (fail closed).
	666	+ $formContents = $this->getFormContent();
	667	+ $layout = isset($formContents->layout) ? $formContents->layout : null;
	668	+ $stepIndex = (int) $formCurrentStep - 1;
	669	+ if (is_array($layout) && isset($layout[$stepIndex]->layout) && is_object($layout[$stepIndex]->layout)) {
	670	+ $stepLayout = $layout[$stepIndex]->layout;
	671	+ $nestedLayout = isset($formContents->nestedLayout) && is_object($formContents->nestedLayout)
	672	+ ? $formContents->nestedLayout : null;
	673	+ $stepKeys = [];
	674	+ foreach (['lg', 'md', 'sm'] as $brkpnt) {
	675	+ if (!isset($stepLayout->{$brkpnt}) || !is_array($stepLayout->{$brkpnt})) {
	676	+ continue;
	677	+ }
	678	+ foreach ($stepLayout->{$brkpnt} as $lay) {
	679	+ if (!is_object($lay) || !isset($lay->i)) {
	680	+ continue;
	681	+ }
	682	+ $fk = $lay->i;
	683	+ $stepKeys[$fk] = true;
	684	+ if (!is_null($nestedLayout) && isset($nestedLayout->{$fk})) {
	685	+ foreach (['lg', 'md', 'sm'] as $nBrkpnt) {
	686	+ if (!isset($nestedLayout->{$fk}->{$nBrkpnt}) || !is_array($nestedLayout->{$fk}->{$nBrkpnt})) {
	687	+ continue;
	688	+ }
	689	+ foreach ($nestedLayout->{$fk}->{$nBrkpnt} as $nestedLay) {
	690	+ if (is_object($nestedLay) && isset($nestedLay->i)) {
	691	+ $stepKeys[$nestedLay->i] = true;
	692	+ }
	693	+ }
	694	+ }
	695	+ }
	696	+ }
	697	+ }
	698	+ // Name/Address/Email/Password children live outside layouts; a child
	699	+ // is part of this step iff its parent is.
	700	+ self::expandChildFieldKeys($stepKeys, $form_fields);
	701	+ if (!empty($stepKeys)) {
	702	+ $step_fields = [];
	703	+ foreach (array_keys($stepKeys) as $fk) {
	704	+ if (isset($form_fields[$fk])) {
	705	+ $step_fields[$fk] = $form_fields[$fk];
	706	+ }
	707	+ }
	708	+ $form_fields = $step_fields;
	709	+ }
	710	+ }
	711	+ }
	712	+ // Only an edit may satisfy a required upload/signature from a `_old` marker.
	713	+ $editedEntryID = $isEntryEdit && isset($_REQUEST['entryID'])
	714	+ ? sanitize_text_field(wp_unslash($_REQUEST['entryID']))
	715	+ : null;
	716	+ $formFieldValidator = new FormFieldValidator($form_fields, $postData, $filesData, $editedEntryID);
407	717	$validUniuqFields = [];
408		- $existFilter = has_filter('bf_check_duplicate_entry');
	718	+ $existFilter = has_filter('bitform_check_duplicate_entry');
409	719	if (true === $existFilter) {
410		- $validUniuqFields = apply_filters('bf_check_duplicate_entry', $form_fields, $_POST);
	720	+ $validUniuqFields = apply_filters('bitform_check_duplicate_entry', $form_fields, $postData);
411	721
412	722	$fieldKeys = array_keys($validUniuqFields);
413	723	$form_fields_keys = array_keys($form_fields);
414	724	$uniqueFields = [];
		@@ -416,9 +726,9 @@
416	726	if (in_array($key, $form_fields_keys)) {
417	727	$uniqueFields[] = $form_fields[$key];
418	728	}
419	729	}
420		- do_action('bitform_Unique_entry', $uniqueFields, $validUniuqFields, $this->_form_id, $_POST);
	730	+ do_action('bitform_Unique_entry', $uniqueFields, $validUniuqFields, $this->_form_id, $postData);
421	731	}
422	732	$validateField = $formFieldValidator->validate('create', $this->_form_id);
423	733
424	734	if ($validateForm && $validateField && 0 === count($validUniuqFields)) {
		@@ -440,23 +750,255 @@
440	750	return new WP_Error('token_expired', __('Token expired', 'bit-form'));
441	751	}
442	752	}
443	753
444		- public function verifySubmissionNonce() {
445		- if (!isset($_POST['t_identy']) && !isset($_POST['csrf'])) {
	754	+ /**
	755	+ * Whether the IP already has a completed entry; drafts (status 9) don't count.
	756	+ *
	757	+ * @param string $ipAddress Visitor IP
	758	+ *
	759	+ * @return bool
	760	+ */
	761	+ private function hasCompletedEntryFromIp($ipAddress)
	762	+ {
	763	+ $storedIp = IpTool::storageValue($ipAddress);
	764	+ if ('' === $storedIp) {
446	765	return false;
447	766	}
448		- $tIdenty = sanitize_text_field($_POST['t_identy']);
449		- $csrf = sanitize_text_field($_POST['csrf']);
450		- unset($_POST['t_identy'], $_POST['action'], $_POST['bitforms_id'], $_POST['csrf']);
	767	+
	768	+ $entries = (new FormEntryModel())->get(
	769	+ ['status'],
	770	+ [
	771	+ 'form_id' => $this->form_id,
	772	+ 'user_ip' => $storedIp,
	773	+ ]
	774	+ );
	775	+
	776	+ if (is_wp_error($entries) || !is_array($entries)) {
	777	+ return false;
	778	+ }
	779	+
	780	+ foreach ($entries as $entry) {
	781	+ if (9 !== (int) $entry->status) {
	782	+ return true;
	783	+ }
	784	+ }
	785	+
	786	+ return false;
	787	+ }
	788	+
	789	+ private function verifyGRecaptcha()
	790	+ {
	791	+ $captchaSettings = $this->getCaptchaSettings();
	792	+ $captchaV3Settings = $this->getCaptchaV3Settings();
	793	+ if (!$captchaSettings && !$captchaV3Settings) {
	794	+ return;
	795	+ }
	796	+
	797	+ if (!isset($_POST['g-recaptcha-response'])) {
	798	+ return new WP_Error('spam_detection', __('Please recheck your reCaptcha Configuration', 'bit-form'));
	799	+ }
	800	+ $token = sanitize_text_field(wp_unslash($_POST['g-recaptcha-response']));
	801	+
	802	+ $appType = $captchaSettings ? 'gReCaptcha' : 'gReCaptchaV3';
	803	+ $reCAPTCHA = $this->getCaptchaApp($appType);
	804	+
	805	+ // Fail closed: no secret key must not skip verification.
	806	+ if (empty($reCAPTCHA->secretKey)) {
	807	+ Log::debug_log("reCAPTCHA ({$appType}) is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	808	+ return new WP_Error('spam_detection', __('reCAPTCHA is not configured. Please contact the site administrator.', 'bit-form'));
	809	+ }
	810	+
	811	+ $gRecaptchaResponse = HttpHelper::post(
	812	+ 'https://www.google.com/recaptcha/api/siteverify',
	813	+ ['secret' => $reCAPTCHA->secretKey, 'response' => $token]
	814	+ );
	815	+ if (is_wp_error($gRecaptchaResponse)) {
	816	+ return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	817	+ }
	818	+
	819	+ // Tokens are single-use; keep this verdict for the log.
	820	+ if ('gReCaptchaV3' === $appType) {
	821	+ $this->recaptchaV3Verification = ['integId' => $reCAPTCHA->id, 'response' => $gRecaptchaResponse];
	822	+ }
	823	+
	824	+ if ($captchaV3Settings && self::isRecaptchaScoreTooLow($gRecaptchaResponse, $captchaV3Settings)) {
	825	+ wp_send_json_error(
	826	+ sanitize_text_field((string) $captchaV3Settings->message)
	827	+ );
	828	+ }
	829	+
	830	+ if (!is_object($gRecaptchaResponse) || empty($gRecaptchaResponse->success)) {
	831	+ return new WP_Error('spam_detection', __('Please verify reCAPTCHA', 'bit-form'));
	832	+ }
	833	+ }
	834	+
	835	+ /**
	836	+ * Connected captcha app from App Settings, with its integration id.
	837	+ *
	838	+ * @param string $appType gReCaptcha, gReCaptchaV3, hcaptcha or turnstileCaptcha
	839	+ *
	840	+ * @return object|null
	841	+ */
	842	+ private function getCaptchaApp($appType)
	843	+ {
	844	+ $apps = (new IntegrationHandler(0))->getAllIntegration('app', $appType);
	845	+ if (is_wp_error($apps) || !is_array($apps)) {
	846	+ return null;
	847	+ }
	848	+
	849	+ $reCAPTCHA = null;
	850	+ foreach ($apps as $integration) {
	851	+ if ($appType !== $integration->integration_type) {
	852	+ continue;
	853	+ }
	854	+ $details = Utilities::jsonObj($integration->integration_details);
	855	+ if (is_object($details)) {
	856	+ $details->id = $integration->id;
	857	+ $reCAPTCHA = $details;
	858	+ }
	859	+ }
	860	+
	861	+ return $reCAPTCHA;
	862	+ }
	863	+
	864	+ /**
	865	+ * Log the reCAPTCHA v3 verdict for this submission.
	866	+ *
	867	+ * @param array $saveResponse Entry save/update response
	868	+ *
	869	+ * @return void
	870	+ */
	871	+ private function logRecaptchaV3Verification($saveResponse)
	872	+ {
	873	+ if (!$this->getCaptchaV3Settings()) {
	874	+ return;
	875	+ }
	876	+ unset($_POST['g-recaptcha-response']);
	877	+
	878	+ if (empty($this->recaptchaV3Verification) || empty($saveResponse['triggerData']['logID'])) {
	879	+ return;
	880	+ }
	881	+
	882	+ $response = $this->recaptchaV3Verification['response'];
	883	+ $status = is_object($response) && !empty($response->success) ? 'success' : 'error';
	884	+ (new UtilApiResponse())->apiResponse(
	885	+ $saveResponse['triggerData']['logID'],
	886	+ $this->recaptchaV3Verification['integId'],
	887	+ ['type_name' => 'ReCaptcha', 'type' => 'v3'],
	888	+ $status,
	889	+ $response
	890	+ );
	891	+ }
	892	+
	893	+ /**
	894	+ * Whether the v3 score is below tolerance; 0.0 counts, blank tolerance means 0.6.
	895	+ *
	896	+ * @param mixed $response Decoded siteverify response
	897	+ * @param mixed $settings Form's recaptchav3 settings
	898	+ *
	899	+ * @return bool
	900	+ */
	901	+ private static function isRecaptchaScoreTooLow($response, $settings)
	902	+ {
	903	+ if (!is_object($response) || !isset($response->score) || !is_numeric($response->score)) {
	904	+ return false;
	905	+ }
	906	+
	907	+ $threshold = is_object($settings) && isset($settings->score) && is_numeric($settings->score)
	908	+ ? (float) $settings->score
	909	+ : 0.6;
	910	+
	911	+ return (float) $response->score < $threshold;
	912	+ }
	913	+
	914	+ private function verifyHCaptcha()
	915	+ {
	916	+ if (!$this->isFieldTypeExist('hcaptcha')) {
	917	+ return;
	918	+ }
	919	+
	920	+ if (!isset($_POST['h-captcha-response'])) {
	921	+ return new WP_Error('spam_detection', __('Please verify hCaptcha', 'bit-form'));
	922	+ }
	923	+ $token = sanitize_text_field(wp_unslash($_POST['h-captcha-response']));
	924	+ $hCaptcha = $this->getCaptchaApp('hcaptcha');
	925	+
	926	+ // Fail closed: no secret key must not skip verification.
	927	+ if (empty($hCaptcha->secretKey)) {
	928	+ Log::debug_log("hCaptcha is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	929	+ return new WP_Error('spam_detection', __('hCaptcha is not configured. Please contact the site administrator.', 'bit-form'));
	930	+ }
	931	+
	932	+ $hCaptchaResponse = HttpHelper::post(
	933	+ 'https://api.hcaptcha.com/siteverify',
	934	+ [
	935	+ 'secret' => $hCaptcha->secretKey,
	936	+ 'response' => $token,
	937	+ 'remoteip' => (isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '')
	938	+ ]
	939	+ );
	940	+
	941	+ if (is_wp_error($hCaptchaResponse) || !is_object($hCaptchaResponse) || empty($hCaptchaResponse->success)) {
	942	+ return new WP_Error('spam_detection', __('hCaptcha verification failed', 'bit-form'));
	943	+ }
	944	+ }
	945	+
	946	+ private function verifyTurnstileCaptcha()
	947	+ {
	948	+ if (!$this->isFieldTypeExist('turnstile')) {
	949	+ return;
	950	+ }
	951	+
	952	+ if (!isset($_POST['cf-turnstile-response'])) {
	953	+ return new WP_Error('spam_detection', __('Please verify Cloudflare Turnstile Captcha', 'bit-form'));
	954	+ }
	955	+ $token = sanitize_text_field(wp_unslash($_POST['cf-turnstile-response']));
	956	+ $turnstileCaptcha = $this->getCaptchaApp('turnstileCaptcha');
	957	+
	958	+ // Fail closed: no secret key must not skip verification.
	959	+ if (empty($turnstileCaptcha->secretKey)) {
	960	+ Log::debug_log("Turnstile is enabled on form {$this->form_id}, but no secret key is set in App Settings.");
	961	+ return new WP_Error('spam_detection', __('Cloudflare Turnstile is not configured. Please contact the site administrator.', 'bit-form'));
	962	+ }
	963	+
	964	+ $turnstileResponse = HttpHelper::post(
	965	+ 'https://challenges.cloudflare.com/turnstile/v0/siteverify',
	966	+ ['secret' => $turnstileCaptcha->secretKey, 'response' => $token]
	967	+ );
	968	+ if (is_wp_error($turnstileResponse) || !is_object($turnstileResponse)) {
	969	+ return new WP_Error('spam_detection', __('Please verify Cloudflare Turnstile Captcha', 'bit-form'));
	970	+ }
	971	+
	972	+ if (empty($turnstileResponse->success)) {
	973	+ $errorCodes = implode(', ', (array) ($turnstileResponse->{'error-codes'} ?? []));
	974	+ wp_send_json_error(
	975	+ sprintf(
	976	+ /* translators: %s: dynamic value. */
	977	+ __('Cloudflare Turnstile Validation Error: %s', 'bit-form'),
	978	+ $errorCodes
	979	+ )
	980	+ );
	981	+ }
	982	+ }
	983	+
	984	+ public function verifySubmissionNonce()
	985	+ {
	986	+ if (!isset($_POST['t_identity']) || !isset($_POST['csrf'])) {
	987	+ return false;
	988	+ }
	989	+ $tIdenty = sanitize_text_field(wp_unslash($_POST['t_identity']));
	990	+ $csrf = sanitize_text_field(wp_unslash($_POST['csrf']));
	991	+ unset($_POST['t_identity'], $_POST['action'], $_POST['bitforms_id'], $_POST['csrf']);
451	992	return Helpers::csrfDecrypted($tIdenty, $csrf);
452	993	}
453	994
454		- public function setViewCount() {
	995	+ public function setViewCount()
	996	+ {
455	997	if (!current_user_can('manage_options')) {
456	998	$update_status = $this->formModel->update(
457	999	[
458		- 'views' => intval(static::$form[0]->views) + 1
	1000	+ 'views' => intval($this->form[0]->views) + 1
459	1001	],
460	1002	[
461	1003	'id' => $this->form_id
462	1004	]
		@@ -463,212 +1005,137 @@
463	1005	);
464	1006	}
465	1007	}
466	1008
467		- public function checkSubmissionRestriction() {
468		- $formContents = $this->getFormContent();
469		- $fromRestrictionSetitingsEnabled = empty($formContents->additional->enabled) ? [] : $formContents->additional->enabled;
470		- $fromRestrictionSetitings = empty($formContents->additional->settings) ? null : $formContents->additional->settings;
471		- if (is_null($formContents->additional->enabled) || is_null($formContents->additional->settings)) {
472		- return false;
473		- }
474		- $restrictionMessage = [];
475		- $ipTool = new IpTool();
476		- $ipAddress = $ipTool->getIP();
477		- foreach ($fromRestrictionSetitingsEnabled as $restrictionKey => $isEnabled) {
478		- if ($isEnabled) {
479		- if ('entry_limit' === $restrictionKey && isset($fromRestrictionSetitings->{$restrictionKey})) {
480		- $formEntry = new FormEntryModel();
481		- $countResult = $formEntry->count(
482		- [
483		- 'form_id' => $this->form_id
484		- ]
485		- );
486		- $count = !empty($countResult[0]) && !empty($countResult[0]->count) ? $countResult[0]->count : false;
487		- if ($count && $count >= intval($fromRestrictionSetitings->{$restrictionKey})) {
488		- $restrictionMessage[] = __('Sorry!! Entry limit exceeded', 'bit-form');
489		- }
	1009	+ /**
	1010	+ * @param bool $checkedEmptySubmitted whether the empty-submission rule applies here
	1011	+ * @param bool $isEntryEdit true when an existing entry is being updated
	1012	+ */
	1013	+ public function checkSubmissionRestriction($checkedEmptySubmitted = true, $isEntryEdit = false)
	1014	+ {
	1015	+ $formContents = $this->getFormContent();
	1016	+ $additionalSettings = isset($formContents->additional) ? $formContents->additional : null;
	1017	+ $fromRestrictionSetitingsEnabled = empty($additionalSettings->enabled) ? [] : $additionalSettings->enabled;
	1018	+ $fromRestrictionSetitings = empty($additionalSettings->settings) ? null : $additionalSettings->settings;
	1019	+
	1020	+ if (is_null($additionalSettings) || is_null($fromRestrictionSetitings) || empty((array) $fromRestrictionSetitingsEnabled)) {
	1021	+ return false;
	1022	+ }
	1023	+
	1024	+ $restrictionMessage = [];
	1025	+ $ipTool = new IpTool();
	1026	+ $ipAddress = $ipTool->getIP();
	1027	+ $currentUserId = get_current_user_id();
	1028	+
	1029	+ foreach ($fromRestrictionSetitingsEnabled as $restrictionKey => $isEnabled) {
	1030	+ if ($isEnabled) {
	1031	+ // Quota rules gate creating an entry, so an edit skips them; access-control keys stay.
	1032	+ $skippableOnEdit = ['onePerIp', 'entry_limit', 'entry_limit_by_user', 'restrict_form'];
	1033	+ if ($isEntryEdit && in_array($restrictionKey, $skippableOnEdit, true)) {
	1034	+ $skipOnEdit = apply_filters(
	1035	+ 'bitform_skip_restriction_on_entry_edit',
	1036	+ true,
	1037	+ $restrictionKey,
	1038	+ $this->form_id
	1039	+ );
	1040	+ if ($skipOnEdit) {
	1041	+ continue;
490	1042	}
491		- if ('onePerIp' === $restrictionKey) {
492		- $formEntry = new FormEntryModel();
493		- $countResult = $formEntry->count(
494		- [
495		- 'form_id' => $this->form_id,
496		- 'user_ip' => ip2long($ipAddress)
497		- ]
498		- );
499		- $count = !empty($countResult[0]) && !empty($countResult[0]->count) ? $countResult[0]->count : false;
	1043	+ }
	1044	+ /**
	1045	+ * Allow add-ons to handle any restriction key (Pro-only restrictions
	1046	+ * should be implemented in the add-on, not shipped in the free plugin).
	1047	+ *
	1048	+ * Return a non-null string to block submission.
	1049	+ */
	1050	+ $addonMsg = apply_filters(
	1051	+ 'bitform_submission_restriction',
	1052	+ null,
	1053	+ $restrictionKey,
	1054	+ $this->form_id,
	1055	+ $fromRestrictionSetitingsEnabled,
	1056	+ $fromRestrictionSetitings,
	1057	+ $ipAddress,
	1058	+ $currentUserId
	1059	+ );
500	1060
501		- if ($count && $count > 0) {
502		- $restrictionMessage[] = __('Sorry!! You have already submitted', 'bit-form');
503		- }
504		- }
505		- if ('is_login' === $restrictionKey && 0 === get_current_user_id()) {
506		- $restrictionMessage[] = __($fromRestrictionSetitings->is_login->message, 'bit-form');
507		- }
508		- if ('empty_submission' === $restrictionKey) {
509		- $isEmpty = $this->checkEmptySubmission($_POST, $_FILES);
510		- if ($isEmpty) {
511		- $restrictionMessage[] = __($fromRestrictionSetitings->empty_submission->message, 'bit-form');
512		- }
513		- }
514		- if ('restrict_form' === $restrictionKey && isset($fromRestrictionSetitings->{$restrictionKey})) {
515		- $day = empty($fromRestrictionSetitings->{$restrictionKey}->day) ? null : $fromRestrictionSetitings->{$restrictionKey}->day;
516		- $date = empty($fromRestrictionSetitings->{$restrictionKey}->date) ? null : $fromRestrictionSetitings->{$restrictionKey}->date;
517		- $time = empty($fromRestrictionSetitings->{$restrictionKey}->time) ? null : $fromRestrictionSetitings->{$restrictionKey}->time;
	1061	+ if (!is_null($addonMsg) && '' !== $addonMsg) {
	1062	+ $restrictionMessage[] = $addonMsg;
	1063	+ continue;
	1064	+ }
518	1065
519		- $isdayOk = $isdateOk = $istimeOk = true;
520		- $dayNotOkMsg = $dateNotOkMsg = $timeNotOkMsg = '';
521		- $dateTimeHelper = new DateTimeHelper();
522		- if (
523		- !empty($day)
524		- && is_array($day)
525		- && (in_array('Friday', $day)
526		- || in_array('Saturday', $day)
527		- || in_array('Sunday', $day)
528		- || in_array('Monday', $day)
529		- || in_array('Tuesday', $day)
530		- || in_array('Wednesday', $day)
531		- || in_array('Thursday', $day))
532		- && (!in_array($dateTimeHelper->getDay('full-name'), $day))
533		- ) {
534		- $isdayOk = false;
535		- $dayMsgVarsFormat = '';
536		- foreach ($day as $dayIndex => $dayValue) {
537		- if ($dayIndex > 0) {
538		- $dayMsgVarsFormat .= ', ';
539		- }
540		- $dayMsgVarsFormat .= '%s';
541		- }
542		- $dayNotOkMsg = vsprintf(__("in $dayMsgVarsFormat", 'bit-form'), $day);
543		- }
544		- if (
545		- !empty($day)
546		- && is_array($day)
547		- && (in_array('Custom', $day))
548		- ) {
549		- $startDate = empty($date->from) ? '00-00-0000' : $date->from;
550		- $endDate = empty($date->to) ? '00-00-0000' : $date->to;
551		- if (!empty($date->from) && false !== strpos($startDate, 'T')) {
552		- $startDate = $dateTimeHelper->getDate($startDate, false, null, 'm-d-Y');
553		- }
554		- if (!empty($date->to) && false !== strpos($endDate, 'T')) {
555		- $endDate = $dateTimeHelper->getDate($endDate, false, null, 'm-d-Y');
556		- }
557		- $currentDate = $dateTimeHelper->getDate(null, null, null, 'm-d-Y');
558		- if (!($currentDate >= $startDate && $currentDate <= $endDate)) {
559		- $isdateOk = false;
560		- $dateNotOkMsg = sprintf(__('within %s to %s', 'bit-form'), $startDate, $endDate);
561		- }
562		- }
	1066	+ if ('onePerIp' === $restrictionKey) {
	1067	+ if ($this->hasCompletedEntryFromIp($ipAddress)) {
	1068	+ $onePerIp = __('Sorry!! You have already submitted from this IP address', 'bit-form');
563	1069
564		- if (!empty($time)) {
565		- $startTime = empty($time->from) ? '00:00' : $time->from;
566		- $endTime = empty($time->to) ? '23:59.999' : $time->to;
567		- $currentTime = $dateTimeHelper->getTime(null, null, null, 'H:i');
568		- if (!($currentTime >= $startTime && $currentTime <= $endTime)) {
569		- $istimeOk = false;
570		- $startTime = $dateTimeHelper->getTime($startTime, 'H:i', null);
571		- $endTime = $dateTimeHelper->getTime($endTime, 'H:i', null);
572		- $isTimeOk = false;
573		- $timeNotOkMsg = sprintf(__('%s to %s', 'bit-form'), $startTime, $endTime);
574		- }
575		- }
	1070	+ $onePerIp = apply_filters(
	1071	+ 'bitform_filter_restriction_one_per_ip_message',
	1072	+ $onePerIp,
	1073	+ $this->form_id
	1074	+ );
576	1075
577		- if (!($isdateOk && $isdayOk && $istimeOk)) {
578		- if (!$isdayOk) {
579		- $restrictionMessage[] = !empty($timeNotOkMsg) ? sprintf(__('Form is available %s From %s', 'bit-form'), $dayNotOkMsg, $timeNotOkMsg) :
580		- sprintf(__('Form is available %s', 'bit-form'), $dayNotOkMsg, $timeNotOkMsg);
581		- } elseif (!$isdateOk) {
582		- $restrictionMessage[] = !empty($timeNotOkMsg) ? sprintf(__('Form is available %s From %s', 'bit-form'), $dateNotOkMsg, $timeNotOkMsg) :
583		- sprintf(__('Form is available %s', 'bit-form'), $dateNotOkMsg, $timeNotOkMsg);
584		- } elseif (!$istimeOk) {
585		- $restrictionMessage[] = sprintf(__('Form is available on %s', 'bit-form'), $timeNotOkMsg);
586		- }
587		- }
	1076	+ $restrictionMessage[] = $onePerIp;
588	1077	}
589		- if ('blocked_ip' === $restrictionKey && isset($fromRestrictionSetitings->{$restrictionKey})) {
590		- $isIpBlocked = false;
591		- foreach ($fromRestrictionSetitings->{$restrictionKey} as $ipIndex => $ipDetails) {
592		- if (!empty($ipDetails->status) && $ipDetails->status && !empty($ipDetails->ip) && $ipDetails->ip === $ipAddress) {
593		- $isIpBlocked = true;
594		- break;
595		- }
596		- }
597		- if ($isIpBlocked) {
598		- $restrictionMessage[] = sprintf(__('Sorry!! Your IP address is %s, Blocked from submitting the form', 'bit-form'), $ipAddress);
599		- }
600		- }
601		- if ('private_ip' === $restrictionKey && isset($fromRestrictionSetitings->{$restrictionKey})) {
602		- $isIpWhiteListed = false;
603		- foreach ($fromRestrictionSetitings->{$restrictionKey} as $ipIndex => $ipDetails) {
604		- if (!empty($ipDetails->status) && $ipDetails->status && !empty($ipDetails->ip) && $ipDetails->ip === $ipAddress) {
605		- $isIpWhiteListed = true;
606		- break;
607		- }
608		- }
609		- if (!$isIpWhiteListed) {
610		- $restrictionMessage[] = sprintf(__('Sorry!! Your IP address is %s, Blocked from submitting the form', 'bit-form'), $ipAddress);
611		- }
612		- }
613	1078	}
614		- }
615		- return $restrictionMessage;
616		- }
	1079	+ if ('is_login' === $restrictionKey && 0 === get_current_user_id()) {
	1080	+ $is_login_messages = $fromRestrictionSetitings->is_login->message;
617	1081
618		- /**
619		- * Will check if form is submitted by a bot
620		- *
621		- * @return Boolean true - if submitted by bot else false
622		- */
623		- public function isTrappedInHoneypot() {
624		- $isHoneyPot = false;
	1082	+ $is_login_messages = apply_filters(
	1083	+ 'bitform_filter_restriction_is_login_message',
	1084	+ $is_login_messages,
	1085	+ $this->form_id
	1086	+ );
625	1087
626		- if (!$this->isHoneypotActive()) {
627		- return false;
628		- }
	1088	+ $restrictionMessage[] = $is_login_messages;
	1089	+ }
	1090	+ if ($checkedEmptySubmitted && 'empty_submission' === $restrictionKey) {
	1091	+ $isEmpty = $this->checkEmptySubmission(wp_unslash($_POST), GlobalHelper::sanitize_files_input($_FILES), $isEntryEdit);
	1092	+ if ($isEmpty) {
	1093	+ $restriction = $fromRestrictionSetitings->empty_submission->message;
629	1094
630		- $token = $_POST['b_h_t'];
631		- $pattern = '/^([a-zA-Z0-9]*_[a-zA-Z0-9]*){4}$/';
632		- $decryptedToken = base64_decode(base64_decode($token));
	1095	+ $restriction = apply_filters(
	1096	+ 'bitform_filter_restriction_empty_submission_message',
	1097	+ $restriction,
	1098	+ $this->form_id
	1099	+ );
633	1100
634		- preg_match($pattern, $decryptedToken, $validToken);
635		-
636		- if ($validToken) {
637		- if (isset($_POST[$token]) && empty($_POST[$token])) {
638		- $isHoneyPot = false;
639		- } else {
640		- $isHoneyPot = true;
	1101	+ $restrictionMessage[] = $restriction;
	1102	+ }
	1103	+ }
641	1104	}
642		- } else {
643		- $isHoneyPot = true;
644	1105	}
	1106	+ return $restrictionMessage;
	1107	+ }
645	1108
646		- if (isset($_POST[$token])) {
647		- unset($_POST[$token]);
648		- }
649		- unset($_POST['b_h_t']);
650		- return $isHoneyPot;
	1109	+ /**
	1110	+ * Will check if form is submitted by a bot
	1111	+ *
	1112	+ * @return Boolean true - if submitted by bot else false
	1113	+ */
	1114	+ public function isTrappedInHoneypot()
	1115	+ {
	1116	+ // Honeypot is implemented by add-ons (e.g. Pro) via filter.
	1117	+ return (bool) apply_filters('bitform_check_honeypot', false, $this->_form_id, wp_unslash($_POST));
651	1118	}
652	1119
653		- public function isHoneypotActive() {
654		- $formContents = $this->getFormContent();
655		- $enabled = empty($formContents->additional->enabled) ? null : $formContents->additional->enabled;
656		- if (!empty($enabled->honeypot) && $enabled->honeypot) {
657		- return true;
658		- }
659		- return false;
	1120	+ public function isHoneypotActive()
	1121	+ {
	1122	+ return (bool) apply_filters('bitform_is_honeypot_active', false, $this->_form_id, $this->getFormContent());
660	1123	}
661	1124
662		- public function checkPaymentFields() {
	1125	+ public function checkPaymentFields()
	1126	+ {
663	1127	$formContents = $this->getFormContent();
664	1128	$fields = $formContents->fields;
665	1129
666	1130	$payments = [];
667	1131	foreach ($fields as $fldData) {
	1132	+ if (!is_object($fldData)) {
	1133	+ continue;
	1134	+ }
668	1135	if ('paypal' === $fldData->typ && property_exists($fldData, 'payIntegID')) {
669	1136	$payments['paypalKey'] = $this->getClientKey($fldData->payIntegID, 'clientID');
670		- } elseif ('razorpay' === $fldData->typ && property_exists($fldData->options, 'payIntegID')) {
	1137	+ } elseif ('razorpay' === $fldData->typ && isset($fldData->options) && is_object($fldData->options) && property_exists($fldData->options, 'payIntegID')) {
671	1138	$payments['razorpayKey'] = $this->getClientKey($fldData->options->payIntegID, 'apiKey');
672	1139	}
673	1140	}
674	1141
		@@ -674,52 +1141,30 @@
674	1141
675	1142	return $payments;
676	1143	}
677	1144
678		- private function getClientKey($integID, $keyName) {
	1145	+ private function getClientKey($integID, $keyName)
	1146	+ {
679	1147	$client = '';
680	1148	if (!empty($integID)) {
681	1149	$integrationHandler = new IntegrationHandler(0);
682	1150	$integration = $integrationHandler->getAIntegration($integID, 'app', 'payments');
683	1151	if (!is_wp_error($integration)) {
684		- $integration_details = json_decode($integration[0]->integration_details);
685		- $client = base64_encode($integration_details->{$keyName});
	1152	+ $integrationRow = Utilities::firstRow($integration);
	1153	+ $integration_details = Utilities::jsonObj($integrationRow->integration_details ?? '');
	1154	+ if ($integration_details && isset($integration_details->{$keyName})) {
	1155	+ $client = base64_encode($integration_details->{$keyName});
	1156	+ }
686	1157	}
687	1158	}
688	1159	return $client;
689	1160	}
690	1161
691		- public function getSuccessMessageMarkups() {
692		- if (is_null($this->_work_flows)) {
693		- $workFlowManager = new WorkFlowHandler($this->form_id);
694		- $this->_work_flows = $workFlowManager->getAllworkFlow();
695		- }
696		-
697		- $ids = [];
698		- foreach ($this->_work_flows as $msgItem) {
699		- foreach ($msgItem['conditions'] as $condition) {
700		- if (isset($condition->actions->success)) {
701		- foreach ($condition->actions->success as $msg) {
702		- if ('successMsg' === $msg->type && isset($msg->details->id)) {
703		- $idObj = json_decode(stripslashes($msg->details->id));
704		- if (is_object($idObj) && !empty($idObj->id)) {
705		- array_push($ids, $idObj->id);
706		- }
707		- }
708		- }
709		- }
710		- if (isset($condition->actions->failure)) {
711		- $idObj = json_decode(stripslashes($condition->actions->failure));
712		- if (is_object($idObj) && !empty($idObj->id)) {
713		- array_push($ids, $idObj->id);
714		- }
715		- }
716		- }
717		- }
718		- $ids = array_unique($ids);
	1162	+ public function getSuccessMessageMarkups()
	1163	+ {
719	1164	if (is_null($this->_conf_messages)) {
720	1165	$successMsgHandler = new SuccessMessageHandler($this->form_id);
721		- $this->_conf_messages = $successMsgHandler->getMessages($ids);
	1166	+ $this->_conf_messages = $successMsgHandler->getAllMessage();
722	1167	}
723	1168
724	1169	$messageMarkups = '';
725	1170	if (is_wp_error($this->_conf_messages)) {
		@@ -726,8 +1171,12 @@
726	1171	return $messageMarkups;
727	1172	}
728	1173
729	1174	foreach ($this->_conf_messages as $msgItem) {
	1175	+ $msgConfig = json_decode($msgItem->message_config);
	1176	+ if (is_object($msgConfig) && property_exists($msgConfig, 'status') && empty($msgConfig->status)) {
	1177	+ continue;
	1178	+ }
730	1179	$messageMarkups .= $this->messageMarkup($msgItem);
731	1180	}
732	1181
733	1182	return $messageMarkups;
		@@ -732,26 +1181,49 @@
732	1181
733	1182	return $messageMarkups;
734	1183	}
735	1184
736		- private function messageMarkup($msg) {
	1185	+ public function getFormAbandonmentMessage()
	1186	+ {
	1187	+ $msg = apply_filters('bitform_form_abandonment_warning_markup', '', $this->form_id);
	1188	+ return is_string($msg) ? $msg : '';
	1189	+ }
	1190	+
	1191	+ public function getFormAbandonmentSettings()
	1192	+ {
	1193	+ return apply_filters('bitform_form_abandonment_settings', null, $this->form_id);
	1194	+ }
	1195	+
	1196	+ private function messageMarkup($msg)
	1197	+ {
737	1198	$msgId = $msg->id;
738	1199	$msgConfig = json_decode($msg->message_config);
739		- $scrollClass = 'below' === $msgConfig->msgType ? 'scroll' : '';
	1200	+ $msgType = (is_object($msgConfig) && isset($msgConfig->msgType)) ? $msgConfig->msgType : 'below';
	1201	+ $scrollClass = 'below' === $msgType ? 'scroll' : '';
740	1202
741		- return <<<SUCCESSMSG
742		- <div role="dialog" aria-hidden="true" data-modal-backdrop="true" class="{$this->getAtomicCls("msg-container-{$msgId}")} deactive {$scrollClass}">
743		- <div data-contentid="{$this->getFormIdentifier()}" data-msgid="{$msgId}" role="button" class="{$this->getAtomicCls("msg-background-{$msgId}")} msg-backdrop">
744		- <div class="{$this->getAtomicCls("msg-content-{$msgId}")}">
745		- <button data-contentid="{$this->getFormIdentifier()}" data-msgid="{$msgId}" class="{$this->getAtomicCls("close-{$msgId}")} msg-close" type="button">
746		- <svg class="{$this->getAtomicCls("close-icn-{$msgId}")}" viewBox="0 0 30 30">
747		- <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="4" y1="3.88" x2="26" y2="26.12"></line>
748		- <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="26" y1="3.88" x2="4" y2="26.12"></line>
749		- </svg>
750		- </button>
751		- <div class="msg-content"></div>
752		- </div>
753		- </div>
754		- </div>
755		-SUCCESSMSG;
	1203	+ return '<div
	1204	+ role="dialog"
	1205	+ aria-hidden="true"
	1206	+ data-modal-backdrop="true"
	1207	+ class="' . $this->getAtomicCls("msg-container-{$msgId}") . ' deactive ' . $scrollClass . '">
	1208	+ <div
	1209	+ data-contentid="' . $this->getFormIdentifier() . '"
	1210	+ data-msgid="' . $msgId . '"
	1211	+ role="button"
	1212	+ class="' . $this->getAtomicCls("msg-background-{$msgId}") . ' msg-backdrop">
	1213	+ <div class="bf-msg-content ' . $this->getAtomicCls("msg-content-{$msgId}") . '">
	1214	+ <button
	1215	+ data-contentid="' . $this->getFormIdentifier() . '"
	1216	+ data-msgid="' . $msgId . '"
	1217	+ class="' . $this->getAtomicCls("close-{$msgId}") . ' bf-msg-close"
	1218	+ type="button">
	1219	+ <svg class="' . $this->getAtomicCls("close-icn-{$msgId}") . '" viewBox="0 0 30 30">
	1220	+ <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="4" y1="3.88" x2="26" y2="26.12"></line>
	1221	+ <line fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" x1="26" y1="3.88" x2="4" y2="26.12"></line>
	1222	+ </svg>
	1223	+ </button>
	1224	+ <div class="msg-content"></div>
	1225	+ </div>
	1226	+ </div>
	1227	+ </div>';
756	1228	}
757	1229	}