convertkit / includes / class-convertkit-spam-protection.php

class-convertkit-spam-protection.php in Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages 3.4.3, at includes/class-convertkit-spam-protection.php

139 lines 3.0 KB

Raw Download Zip

1	<?php
2	/**
3	* ConvertKit Spam Protection helper.
4	*
5	* @package ConvertKit
6	* @author ConvertKit
7	*/
8
9	/**
10	* Returns the currently active spam protection provider (reCAPTCHA or Cloudflare
11	* Turnstile) based on the Plugin settings, and exposes the corresponding POST
12	* field name used to carry the challenge response.
13	*
14	* The active provider is returned only if it has been configured with the
15	* required keys; otherwise `null` is returned so callers can safely treat spam
16	* protection as disabled without provider-specific branching.
17	*
18	* @since 3.3.7
19	*/
20	class ConvertKit_Spam_Protection {
21
22	/**
23	* Holds the settings class.
24	*
25	* @since 3.3.7
26	*
27	* @var bool\|ConvertKit_Settings
28	*/
29	private $settings = false;
30
31	/**
32	* Constructor.
33	*
34	* @since 3.3.7
35	*/
36	public function __construct() {
37
38	$this->settings = new ConvertKit_Settings();
39
40	}
41
42	/**
43	* Returns the configured spam protection provider instance, or false if the
44	* selected provider is missing its site and secret keys (in which case the
45	* caller should behave as if spam protection is disabled).
46	*
47	* @since 3.3.7
48	*
49	* @return ConvertKit_Recaptcha\|ConvertKit_Cloudflare_Turnstile\|bool
50	*/
51	public function get_active_provider() {
52
53	switch ( $this->settings->spam_protection_provider() ) {
54	case 'cloudflare_turnstile':
55	if ( ! $this->settings->has_cloudflare_turnstile_site_and_secret_keys() ) {
56	return false;
57	}
58
59	return new ConvertKit_Cloudflare_Turnstile();
60
61	case 'recaptcha':
62	default:
63	if ( ! $this->settings->has_recaptcha_site_and_secret_keys() ) {
64	return false;
65	}
66
67	return new ConvertKit_Recaptcha();
68	}
69
70	}
71
72	/**
73	* Returns the POST field name the active provider uses for its challenge
74	* response.
75	*
76	* @since 3.3.7
77	*
78	* @return string
79	*/
80	public function response_field_name() {
81
82	switch ( $this->settings->spam_protection_provider() ) {
83	case 'cloudflare_turnstile':
84	return 'cf-turnstile-response';
85
86	case 'recaptcha':
87	default:
88	return 'g-recaptcha-response';
89	}
90
91	}
92
93	/**
94	* Reads and sanitizes the challenge response from $_POST for the active
95	* provider. Returns an empty string if the field is absent.
96	*
97	* @since 3.3.7
98	*
99	* @return string
100	*/
101	public function get_response_from_post() {
102
103	$field = $this->response_field_name();
104
105	// phpcs:ignore WordPress.Security.NonceVerification.Missing
106	if ( ! isset( $_POST[ $field ] ) ) {
107	return '';
108	}
109
110	// phpcs:ignore WordPress.Security.NonceVerification.Missing
111	return sanitize_text_field( wp_unslash( $_POST[ $field ] ) );
112
113	}
114
115	/**
116	* Verifies the challenge response for the active provider.
117	*
118	* @since 3.3.7
119	*
120	* @param string $plugin_action Plugin action string.
121	* @return bool\|WP_Error
122	*/
123	public function verify( $plugin_action ) {
124
125	$provider = $this->get_active_provider();
126
127	// No provider configured: allow the request through.
128	if ( ! $provider ) {
129	return true;
130	}
131
132	$response = $this->get_response_from_post();
133
134	return $provider->verify( $response, $plugin_action );
135
136	}
137
138	}
139