PluginProbe
Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification / 5.5.0
Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification v5.5.0
5.6.2 5.6.3 5.6.1 5.6.0 5.5.0 5.4.0 5.3.2 5.3.1 5.1.6 5.1.5 trunk 2.1.5 2.11 2.12 2.13 2.15 3.0.0 3.0.1 3.0.2 3.0.3 3.0.5 3.0.51 3.0.60 3.0.61 3.0.62 All 38 releases
← All changes | src/Integration/AbstractFormIntegration.php +10 -163 5.6.3 → 5.5.0 View file →
@@ -15,10 +15,8 @@
15 15 use Forge12\DoubleOptIn\Events\Integration\FormSubmissionEvent;
16 16 use Forge12\DoubleOptIn\Events\Lifecycle\OptInConfirmedEvent;
17 17 use Forge12\DoubleOptIn\Events\Lifecycle\OptInCreatedEvent;
18 18 use Forge12\DoubleOptIn\Files\FileStorage;
19 -use Forge12\DoubleOptIn\FollowUp\FollowUpAttempt;
20 -use Forge12\DoubleOptIn\FollowUp\FollowUpCoordinator;
21 19 use Forge12\DoubleOptIn\Frontend\ErrorNotification;
22 20 use Forge12\DoubleOptIn\Service\RateLimiter;
23 21 use forge12\contactform7\CF7DoubleOptIn\CF7DoubleOptIn;
24 22 use forge12\contactform7\CF7DoubleOptIn\IPHelper;
@@ -83,47 +81,8 @@
83 81 * Get the validation status from the last validateOptIn() call.
84 82 *
85 83 * @return string One of: '', 'confirmed', 'already_confirmed', 'expired', 'not_found'.
86 84 */
87 - /**
88 - * Nesting depth of post-confirmation replays in this request.
89 - *
90 - * @var int
91 - */
92 - private static $replayDepth = 0;
93 -
94 - /**
95 - * True while a post-confirmation replay (re-submitting the stored
96 - * data to the form plugin) runs in this request. Set only by server
97 - * code via {@see runAsReplay()} — never derived from request input.
98 - *
99 - * @since 5.6.0
100 - */
101 - public static function isReplaying(): bool {
102 - return self::$replayDepth > 0;
103 - }
104 -
105 - /**
106 - * Run $fn as a post-confirmation replay: form-submit hooks that fire
107 - * inside it (wpcf7_before_send_mail, gform_after_submission, …) see
108 - * {@see isReplaying()} and do not create a new opt-in.
109 - *
110 - * @template T
111 - * @param callable():T $fn
112 - *
113 - * @return T
114 - *
115 - * @since 5.6.0
116 - */
117 - public static function runAsReplay( callable $fn ) {
118 - self::$replayDepth++;
119 - try {
120 - return $fn();
121 - } finally {
122 - self::$replayDepth--;
123 - }
124 - }
125 -
126 85 public static function getValidationStatus(): string {
127 86 return self::$validationStatus;
128 87 }
129 88
@@ -212,19 +171,12 @@
212 171 /**
213 172 * {@inheritdoc}
214 173 */
215 174 public function isOptInEnabled( int $formId ): bool {
216 - // Disable while our own post-confirmation replay runs — the stored
217 - // submission must be processed, not turned into a new opt-in.
218 - //
219 - // This used to test `isset( $_GET['optin'] )`. That flag is set by
220 - // whoever sends the request: `…/feedback?optin=1` on the CF7 REST
221 - // route submitted a DOI form with every mail and no confirmation.
222 - // It also broke every replay outside the confirmation request
223 - // (cron, admin retry), which has no `?optin` in its URL.
224 - if ( self::isReplaying() ) {
175 + // Disable if opt-in confirmation is in progress
176 + if ( isset( $_GET['optin'] ) ) {
225 177 $this->getLogger()->debug(
226 - 'Opt-in disabled during post-confirmation replay',
178 + 'Opt-in disabled due to optin flag in GET request',
227 179 array(
228 180 'plugin' => 'double-opt-in',
229 181 'class' => static::class,
230 182 )
@@ -487,81 +439,8 @@
487 439 return null;
488 440 }
489 441
490 442 /**
491 - * The consent gate, asked at the form plugin's own validation stage.
492 - *
493 - * For integrations whose submit hook runs after the form plugin has
494 - * already accepted the submission (WPForms `wpforms_process_complete`,
495 - * Gravity Forms `gform_after_submission`). By then the form has been
496 - * replaced by its confirmation, and a refused consent could only be
497 - * reported in a toast over an empty page (5.6.2 click test). Asked from
498 - * `wpforms_process` / `gform_validation` instead, the form plugin marks
499 - * the checkbox like a missed required field and keeps the input.
500 - *
501 - * Only a refusal that would stand is returned: DOI on for the form, not
502 - * skipped by `f12_cf7_doubleoptin_skip_option`, verdict NOT_GIVEN, gate
503 - * enforced. Everything else — a stale field name, the gate switched off
504 - * by filter — is left to createOptIn(), which logs it as before.
505 - *
506 - * @param FormDataInterface $formData The submission, normalized the same
507 - * way the submit hook will normalize it.
508 - * @param mixed $rawFields What the skip filter receives in the
509 - * submit hook of this integration.
510 - *
511 - * @return OptInError|null The refusal, or null to let the form through.
512 - *
513 - * @since 5.6.2
514 - */
515 - public function refusedConsentBeforeSubmit( FormDataInterface $formData, $rawFields = array() ): ?OptInError {
516 - $formId = $formData->getFormId();
517 -
518 - if ( ! $this->isOptInEnabled( $formId ) ) {
519 - return null;
520 - }
521 -
522 - if ( apply_filters( 'f12_cf7_doubleoptin_skip_option', false, $formId, $rawFields, $this->getIdentifier() ) ) {
523 - return null;
524 - }
525 -
526 - $consentField = (string) ( $this->getFormParameter( $formId )['consent_field'] ?? '' );
527 - if ( $consentField === '' ) {
528 - return null;
529 - }
530 -
531 - $verdict = ConsentGate::evaluate(
532 - $consentField,
533 - $formData->getFields(),
534 - $this->getKnownFieldNames( $formId )
535 - );
536 -
537 - if ( $verdict !== ConsentGate::NOT_GIVEN || ! ConsentGate::isEnforced( $formId, $this->getIdentifier() ) ) {
538 - return null;
539 - }
540 -
541 - $this->getLogger()->info(
542 - 'Consent acceptance not given, rejecting submission at validation',
543 - array(
544 - 'plugin' => 'double-opt-in',
545 - 'form_id' => $formId,
546 - 'integration' => $this->getIdentifier(),
547 - 'consent_field' => $consentField,
548 - )
549 - );
550 -
551 - /** This action is documented in createOptIn(). */
552 - do_action( 'f12_cf7_doubleoptin_consent_not_given', $formId, $consentField );
553 -
554 - return OptInError::fromCode(
555 - OptInError::CONSENT_NOT_GIVEN,
556 - array(
557 - 'form_id' => $formId,
558 - 'consent_field' => $consentField,
559 - )
560 - );
561 - }
562 -
563 - /**
564 443 * Validate the consent-acceptance gate (GDPR Art. 7).
565 444 *
566 445 * The decision itself lives in {@see ConsentGate} — this method only
567 446 * turns it into the return value `createOptIn()` expects and writes
@@ -1152,24 +1031,8 @@
1152 1031 self::setValidationStatus( 'already_confirmed' );
1153 1032 return false;
1154 1033 }
1155 1034
1156 - /**
1157 - * Enable / Disable default mail.
1158 - *
1159 - * @param bool $status Enable (true) or disable (false) the default mail.
1160 - * @param int $postId The ID of the Post / Form.
1161 - *
1162 - * @since 2.3.3
1163 - */
1164 - $sendDefaultMail = (bool) apply_filters( 'f12_cf7_doubleoptin_send_default_mail', true, $optIn->get_cf_form_id() );
1165 -
1166 - // Bind the follow-up plan BEFORE the confirmation is saved, so a
1167 - // request that dies in between leaves rows the sweep can finish.
1168 - // False = no adapter for this integration → previous behaviour.
1169 - $coordinator = FollowUpCoordinator::instance();
1170 - $managed = $coordinator !== null && $coordinator->plan( $optIn, $sendDefaultMail );
1171 -
1172 1035 // Confirm the opt-in
1173 1036 do_action( 'f12_cf7_doubleoptin_before_confirm', $hash, $optIn );
1174 1037
1175 1038 $optIn->set_doubleoptin( 1 );
@@ -1195,32 +1058,16 @@
1195 1058
1196 1059 // Dispatch event
1197 1060 $this->dispatchOptInConfirmedEvent( $optIn, $hash );
1198 1061
1199 - // Everything from here on re-processes the stored submission.
1200 - self::runAsReplay(
1201 - function () use ( $hash, $optIn, $managed, $coordinator, $sendDefaultMail ) {
1202 - do_action( 'f12_cf7_doubleoptin_after_confirm', $hash, $optIn );
1062 + do_action( 'f12_cf7_doubleoptin_after_confirm', $hash, $optIn );
1203 1063
1204 - if ( $managed ) {
1205 - // The coordinator runs every planned action — entry and
1206 - // mail — and records a result per action. The before/after
1207 - // hooks keep firing for listeners that depend on them.
1208 - if ( $sendDefaultMail ) {
1209 - do_action( 'f12_cf7_doubleoptin_before_send_default_mail', $optIn );
1210 - }
1211 - $coordinator->run( $optIn, FollowUpAttempt::TRIGGER_CONFIRM );
1212 - if ( $sendDefaultMail ) {
1213 - do_action( 'f12_cf7_doubleoptin_after_send_default_mail', $optIn );
1214 - }
1215 - } elseif ( $sendDefaultMail ) {
1216 - // Send the original mail if enabled
1217 - do_action( 'f12_cf7_doubleoptin_before_send_default_mail', $optIn );
1218 - $this->sendConfirmationMail( $optIn );
1219 - do_action( 'f12_cf7_doubleoptin_after_send_default_mail', $optIn );
1220 - }
1221 - }
1222 - );
1064 + // Send the original mail if enabled
1065 + if ( apply_filters( 'f12_cf7_doubleoptin_send_default_mail', true, $optIn->get_cf_form_id() ) ) {
1066 + do_action( 'f12_cf7_doubleoptin_before_send_default_mail', $optIn );
1067 + $this->sendConfirmationMail( $optIn );
1068 + do_action( 'f12_cf7_doubleoptin_after_send_default_mail', $optIn );
1069 + }
1223 1070
1224 1071 $this->getLogger()->info(
1225 1072 'OptIn confirmed successfully',
1226 1073 array(