class-evf-form-task.php — Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 1.5.4

everest-forms / includes / class-evf-form-task.php

everest-forms / includes Last commit date

class-evf-form-task.php

551 lines

1	<?php
2	/**
3	* Process form data
4	*
5	* @package EverestForms
6	* @since 1.0.0
7	*/
8
9	defined( 'ABSPATH' ) \|\| exit;
10
11	/**
12	* EVF_Form_Task class.
13	*/
14	class EVF_Form_Task {
15
16	/**
17	* Holds errors.
18	*
19	* @since 1.0.0
20	* @var array
21	*/
22	public $errors;
23
24	/**
25	* Holds formatted fields.
26	*
27	* @since 1.0.0
28	* @var array
29	*/
30	public $form_fields;
31
32	/**
33	* Holds the ID of a successful entry.
34	*
35	* @since 1.0.0
36	* @var int
37	*/
38	public $entry_id = 0;
39
40	/**
41	* Form data and settings.
42	*
43	* @since 1.5.0
44	*
45	* @var array
46	*/
47	public $form_data = array();
48
49	/**
50	* Primary class constructor.
51	*
52	* @since 1.0.0
53	*/
54	public function __construct() {
55	add_action( 'wp', array( $this, 'listen_task' ) );
56	}
57
58	/**
59	* Listen to see if this is a return callback or a posted form entry.
60	*
61	* @since 1.0.0
62	*/
63	public function listen_task() {
64	if ( ! empty( $_GET['everest_forms_return'] ) ) { // WPCS: CSRF ok.
65	$this->entry_confirmation_redirect( '', $_GET['everest_forms_return'] ); // WPCS: sanitization ok, CSRF ok.
66	}
67
68	if ( ! empty( $_POST['everest_forms']['id'] ) ) { // WPCS: CSRF ok.
69	$this->do_task( stripslashes_deep( $_POST['everest_forms'] ) ); // WPCS: sanitization ok, CSRF ok.
70	}
71	}
72
73	/**
74	* Do task of form entry
75	*
76	* @since 1.0.0
77	* @param array $entry $_POST object.
78	*/
79	public function do_task( $entry ) {
80	try {
81	$this->errors = array();
82	$this->form_fields = array();
83	$form_id = absint( $entry['id'] );
84	$form = EVF()->form->get( $form_id );
85	$honeypot = false;
86
87	// Check nonce for form submission.
88	if ( empty( $_POST['_wpnonce'] ) \|\| ! wp_verify_nonce( wp_unslash( $_POST['_wpnonce'] ), 'everest-forms_process_submit' ) ) { // WPCS: input var ok, sanitization ok.
89	$this->errors[ $form_id ]['header'] = esc_html__( 'We were unable to process your form, please try again.', 'everest-forms' );
90	return;
91	}
92
93	// Validate form is real and active (published).
94	if ( ! $form \|\| 'publish' !== $form->post_status ) {
95	$this->errors[ $form_id ]['header'] = esc_html__( 'Invalid form. Please check again.', 'everest-forms' );
96	return;
97	}
98
99	// Formatted form data for hooks.
100	$this->form_data = apply_filters( 'everest_forms_process_before_form_data', evf_decode( $form->post_content ), $entry );
101
102	// Pre-process/validate hooks and filter. Data is not validated or cleaned yet so use with caution.
103	$entry = apply_filters( 'everest_forms_process_before_filter', $entry, $this->form_data );
104
105	do_action( 'everest_forms_process_before', $entry, $this->form_data );
106	do_action( "everest_forms_process_before_{$form_id}", $entry, $this->form_data );
107
108	// Validate fields.
109	foreach ( $this->form_data['form_fields'] as $field ) {
110	$field_id = $field['id'];
111	$field_type = $field['type'];
112	$field_submit = isset( $entry['form_fields'][ $field_id ] ) ? $entry['form_fields'][ $field_id ] : '';
113
114	do_action( "everest_forms_process_validate_{$field_type}", $field_id, $field_submit, $this->form_data, $field_type );
115	}
116
117	// reCAPTCHA check.
118	$recaptcha_type = get_option( 'everest_forms_recaptcha_type', 'v2' );
119
120	if ( 'v2' === $recaptcha_type ) {
121	$site_key = get_option( 'everest_forms_recaptcha_v2_site_key' );
122	$secret_key = get_option( 'everest_forms_recaptcha_v2_secret_key' );
123	} else {
124	$site_key = get_option( 'everest_forms_recaptcha_v3_site_key' );
125	$secret_key = get_option( 'everest_forms_recaptcha_v3_secret_key' );
126	}
127
128	if ( ! empty( $site_key ) && ! empty( $secret_key ) && isset( $this->form_data['settings']['recaptcha_support'] ) && '1' === $this->form_data['settings']['recaptcha_support'] ) {
129	if ( ( 'v2' === $recaptcha_type && ! empty( $_POST['g-recaptcha-response'] ) ) \|\| ( 'v3' === $recaptcha_type && ! empty( $_POST['g-recaptcha-hidden'] ) ) ) {
130	$response = 'v2' === $recaptcha_type ? evf_clean( wp_unslash( $_POST['g-recaptcha-response'] ) ) : evf_clean( wp_unslash( $_POST['g-recaptcha-hidden'] ) ); // PHPCS: input var ok.
131	$raw_data = wp_safe_remote_get( 'https://www.google.com/recaptcha/api/siteverify?secret=' . $secret_key . '&response=' . $response );
132
133	if ( ! is_wp_error( $raw_data ) ) {
134	$data = json_decode( wp_remote_retrieve_body( $raw_data ) );
135
136	// Check reCAPTCHA response.
137	if ( empty( $data->success ) \|\| ( isset( $data->hostname ) && evf_clean( wp_unslash( $_SERVER['HTTP_HOST'] ) ) !== $data->hostname ) \|\| ( isset( $data->action, $data->score ) && ( 'everest_form' !== $data->action && 0.5 > floatval( $data->score ) ) ) ) {
138	$this->errors[ $form_id ]['header'] = esc_html__( 'Incorrect reCAPTCHA, please try again.', 'everest-forms' );
139	return;
140	}
141	}
142	} else {
143	// @todo This error message is not delivered in frontend. Need to fix :)
144	$this->errors[ $form_id ]['recaptcha'] = esc_html__( 'reCAPTCHA is required.', 'everest-forms' );
145	}
146	}
147
148	// Initial error check.
149	$errors = apply_filters( 'everest_forms_process_initial_errors', $this->errors, $this->form_data );
150
151	if ( ! empty( $errors[ $form_id ] ) ) {
152	if ( empty( $errors[ $form_id ]['header'] ) ) {
153	$errors[ $form_id ]['header'] = __( 'Form has not been submitted, please see the errors below.', 'everest-forms' );
154	}
155	$this->errors = $errors;
156	return;
157	}
158
159	// Early honeypot validation - before actual processing.
160	if ( isset( $this->form_data['settings']['honeypot'] ) && '1' === $this->form_data['settings']['honeypot'] && ! empty( $entry['hp'] ) ) {
161	$honeypot = esc_html__( 'Everest Forms honeypot field triggered.', 'everest-forms' );
162	}
163
164	$honeypot = apply_filters( 'everest_forms_process_honeypot', $honeypot, $this->form_fields, $entry, $this->form_data );
165
166	// If spam - return early.
167	if ( $honeypot ) {
168	$logger = evf_get_logger();
169	$logger->notice( sprintf( 'Spam entry for Form ID %d Response: %s', absint( $this->form_data['id'] ), evf_print_r( $entry, true ) ), array( 'source' => 'honeypot' ) );
170	return;
171	}
172
173	// Pass the form created date into the form data.
174	$this->form_data['created'] = $form->post_date;
175
176	// Format fields.
177	foreach ( (array) $this->form_data['form_fields'] as $field ) {
178	$field_id = $field['id'];
179	$field_key = isset( $field['meta-key'] ) ? $field['meta-key'] : '';
180	$field_type = $field['type'];
181	$field_submit = isset( $entry['form_fields'][ $field_id ] ) ? $entry['form_fields'][ $field_id ] : '';
182
183	do_action( "everest_forms_process_format_{$field_type}", $field_id, $field_submit, $this->form_data, $field_key );
184	}
185
186	// This hook is for internal purposes and should not be leveraged.
187	do_action( 'everest_forms_process_format_after', $this->form_data );
188
189	// Process hooks/filter - this is where most addons should hook
190	// because at this point we have completed all field validation and
191	// formatted the data.
192	$this->form_fields = apply_filters( 'everest_forms_process_filter', $this->form_fields, $entry, $this->form_data );
193
194	do_action( 'everest_forms_process', $this->form_fields, $entry, $this->form_data );
195	do_action( "everest_forms_process_{$form_id}", $this->form_fields, $entry, $this->form_data );
196
197	$this->form_fields = apply_filters( 'everest_forms_process_after_filter', $this->form_fields, $entry, $this->form_data );
198
199	// One last error check - don't proceed if there are any errors.
200	if ( ! empty( $this->errors[ $form_id ] ) ) {
201	if ( empty( $this->errors[ $form_id ]['header'] ) ) {
202	$this->errors[ $form_id ]['header'] = esc_html__( 'Form has not been submitted, please see the errors below.', 'everest-forms' );
203	}
204	return;
205	}
206
207	// Success - add entry to database.
208	$entry_id = $this->entry_save( $this->form_fields, $entry, $this->form_data['id'], $this->form_data );
209
210	// Success - send email notification.
211	$this->entry_email( $this->form_fields, $entry, $this->form_data, $entry_id, 'entry' );
212
213	// @todo remove this way of printing notices.
214	add_filter( 'everest_forms_success', array( $this, 'check_success_message' ), 10, 2 );
215
216	// Pass completed and formatted fields in POST.
217	$_POST['everest-forms']['complete'] = $this->form_fields;
218
219	// Pass entry ID in POST.
220	$_POST['everest-forms']['entry_id'] = $entry_id;
221
222	// Post-process hooks.
223	do_action( 'everest_forms_process_complete', $this->form_fields, $entry, $this->form_data, $entry_id );
224	do_action( "everest_forms_process_complete_{$form_id}", $this->form_fields, $entry, $this->form_data, $entry_id );
225	} catch ( Exception $e ) {
226	evf_add_notice( $e->getMessage(), 'error' );
227	}
228
229	$message = isset( $this->form_data['settings']['successful_form_submission_message'] ) ? $this->form_data['settings']['successful_form_submission_message'] : __( 'Thanks for contacting us! We will be in touch with you shortly.', 'everest-forms' );
230
231	evf_add_notice( $message, 'success' );
232
233	do_action( 'everest_forms_after_success_message', $this->form_data, $entry );
234
235	$this->entry_confirmation_redirect( $this->form_data );
236	}
237
238	/**
239	* Check the sucessful message.
240	*
241	* @param bool $status Message status.
242	* @param int $form_id Form ID.
243	*/
244	public function check_success_message( $status, $form_id ) {
245	if ( isset( $this->form_data['id'] ) && $form_id === absint( $this->form_data['id'] ) ) {
246	return true;
247	}
248	return false;
249	}
250
251	/**
252	* Validate the form return hash.
253	*
254	* @since 1.0.0
255	* @param string $hash Hash data.
256	* @return mixed false for invalid or form id.
257	*/
258	public function validate_return_hash( $hash = '' ) {
259	$query_args = base64_decode( $hash );
260
261	parse_str( $query_args, $output );
262
263	// Verify hash matches.
264	if ( wp_hash( $output['form_id'] . ',' . $output['entry_id'] ) !== $output['hash'] ) {
265	return false;
266	}
267
268	// Get lead and verify it is attached to the form we received with it.
269	$entry = EVF()->entry->get( $output['entry_id'] );
270
271	if ( $output['form_id'] !== $entry->form_id ) {
272	return false;
273	}
274
275	return absint( $output['form_id'] );
276	}
277
278	/**
279	* Redirects user to a page or URL specified in the form confirmation settings.
280	*
281	* @since 1.0.0
282	*
283	* @param array $form_data Form data and settings.
284	* @param string $hash Hash data.
285	*/
286	public function entry_confirmation_redirect( $form_data = '', $hash = '' ) {
287	$_POST = array(); // clear fields after successful form submission
288
289	if ( ! empty( $hash ) ) {
290	$form_id = $this->validate_return_hash( $hash );
291
292	if ( ! $form_id ) {
293	return;
294	}
295
296	// Get form.
297	$this->form_data = EVF()->form->get(
298	$form_id,
299	array(
300	'content_only' => true,
301	)
302	);
303	} else {
304	$this->form_data = $form_data;
305	}
306
307	$settings = $this->form_data['settings'];
308	if ( isset( $settings['redirect_to'] ) && '1' === $settings['redirect_to'] ) {
309	?>
310	<script>
311	var redirect = '<?php echo get_permalink( $settings['custom_page'] ); ?>';
312	window.setTimeout( function () {
313	window.location.href = redirect;
314	})
315	</script>
316	<?php
317	} elseif ( isset( $settings['redirect_to'] ) && '2' == $settings['redirect_to'] ) {
318	?>
319	<script>
320	window.setTimeout( function () {
321	window.location.href = '<?php echo $settings['external_url']; ?>';
322	})
323	</script>
324	<?php
325	}
326
327	// Redirect if needed, to either a page or URL, after form processing.
328	if ( ! empty( $this->form_data['settings']['confirmation_type'] ) && 'message' !== $this->form_data['settings']['confirmation_type'] ) {
329
330	if ( 'redirect' === $this->form_data['settings']['confirmation_type'] ) {
331	$url = apply_filters( 'everest_forms_process_smart_tags', $this->form_data['settings']['confirmation_redirect'], $this->form_data, $this->form_fields, $this->entry_id );
332	}
333
334	if ( 'page' === $this->form_data['settings']['confirmation_type'] ) {
335	$url = get_permalink( (int) $this->form_data['settings']['confirmation_page'] );
336	}
337	}
338
339	if ( ! empty( $this->form_data['id'] ) ) {
340	$form_id = $this->form_data['id'];
341	} else {
342	return;
343	}
344
345	if ( isset( $settings['submission_message_scroll'] ) && $settings['submission_message_scroll'] ) {
346	add_filter( 'everest_forms_success_notice_class', array( $this, 'add_scroll_notice_class' ) );
347	}
348
349	if ( ! empty( $url ) ) {
350	$url = apply_filters( 'everest_forms_process_redirect_url', $url, $form_id, $this->form_fields );
351	wp_redirect( esc_url_raw( $url ) );
352	do_action( 'everest_forms_process_redirect', $form_id );
353	do_action( "everest_forms_process_redirect_{$form_id}", $form_id );
354	exit;
355	}
356	}
357
358	/**
359	* Add scroll notice class.
360	*
361	* @param array $classes Notice Classes.
362	* @return array of notice classes.
363	*/
364	public function add_scroll_notice_class( $classes ) {
365	$classes[] = 'everest-forms-submission-scroll';
366
367	return $classes;
368	}
369
370	/**
371	* Sends entry email notifications.
372	*
373	* @param array $fields List of fields.
374	* @param array $entry Submitted form entry.
375	* @param array $form_data Form data and settings.
376	* @param int $entry_id Saved entry id.
377	* @param string $context In which context this email is sent.
378	*/
379	public function entry_email( $fields, $entry, $form_data, $entry_id, $context = '' ) {
380	// Provide the opportunity to override via a filter.
381	if ( ! apply_filters( 'everest_forms_entry_email', true, $fields, $entry, $form_data ) ) {
382	return;
383	}
384
385	// Don't proceed if email notification is not enabled.
386	if ( isset( $form_data['settings']['email']['enable_email_notification'] ) && '1' !== $form_data['settings']['email']['enable_email_notification'] ) {
387	return;
388	}
389
390	// Make sure we have an entry id.
391	if ( empty( $this->entry_id ) ) {
392	$this->entry_id = (int) $entry_id;
393	}
394
395	$fields = apply_filters( 'everest_forms_entry_email_data', $fields, $entry, $form_data );
396
397	if ( ! isset( $form_data['settings']['email']['connection_1'] ) ) {
398	$old_email_data = $form_data['settings']['email'];
399	$form_data['settings']['email'] = array();
400	$form_data['settings']['email']['connection_1'] = array( 'connection_name' => __( 'Admin Notification', 'everest-forms' ) );
401
402	$email_settings = array( 'evf_to_email', 'evf_from_name', 'evf_from_email', 'evf_reply_to', 'evf_email_subject', 'evf_email_message', 'attach_pdf_to_admin_email', 'show_header_in_attachment_pdf_file', 'conditional_logic_status', 'conditional_option', 'conditionals' );
403	foreach ( $email_settings as $email_setting ) {
404	$form_data['settings']['email']['connection_1'][ $email_setting ] = isset( $old_email_data[ $email_setting ] ) ? $old_email_data[ $email_setting ] : '';
405	}
406	}
407
408	$notifications = isset( $form_data['settings']['email'] ) ? $form_data['settings']['email'] : array();
409
410	foreach ( $notifications as $connection_id => $notification ) :
411	$process_email = apply_filters( 'everest_forms_entry_email_process', true, $fields, $form_data, $context, $connection_id );
412
413	if ( ! $process_email ) {
414	continue;
415	}
416
417	$email = array();
418	$evf_to_email = isset( $notification['evf_to_email'] ) ? $notification['evf_to_email'] : '';
419
420	// Setup email properties.
421	/* translators: %s - form name. */
422	$email['subject'] = ! empty( $notification['evf_email_subject'] ) ? $notification['evf_email_subject'] : sprintf( esc_html__( 'New %s Entry', 'everest-forms' ), $form_data['settings']['form_title'] );
423	$email['address'] = explode( ',', apply_filters( 'everest_forms_process_smart_tags', $evf_to_email, $form_data, $fields, $this->entry_id ) );
424	$email['address'] = array_map( 'sanitize_email', $email['address'] );
425	$email['sender_name'] = ! empty( $notification['evf_from_name'] ) ? $notification['evf_from_name'] : get_bloginfo( 'name' );
426	$email['sender_address'] = ! empty( $notification['evf_from_email'] ) ? $notification['evf_from_email'] : get_option( 'admin_email' );
427	$email['reply_to'] = ! empty( $notification['evf_reply_to'] ) ? $notification['evf_reply_to'] : $email['sender_address'];
428	$email['message'] = ! empty( $notification['evf_email_message'] ) ? $notification['evf_email_message'] : '{all_fields}';
429	$email = apply_filters( 'everest_forms_entry_email_atts', $email, $fields, $entry, $form_data );
430
431	$attachment = '';
432
433	// Create new email.
434	$emails = new EVF_Emails();
435	$emails->__set( 'form_data', $form_data );
436	$emails->__set( 'fields', $fields );
437	$emails->__set( 'entry_id', $entry_id );
438	$emails->__set( 'from_name', $email['sender_name'] );
439	$emails->__set( 'from_address', $email['sender_address'] );
440	$emails->__set( 'reply_to', $email['reply_to'] );
441	$emails->__set( 'attachments', apply_filters( 'everest_forms_email_file_attachments', $attachment, $entry, $form_data, 'entry-email', $connection_id ) );
442
443	// Maybe include Cc and Bcc email addresses.
444	if ( 'yes' === get_option( 'everest_forms_enable_email_copies' ) ) {
445	if ( ! empty( $notification['evf_carboncopy'] ) ) {
446	$emails->__set( 'cc', $notification['evf_carboncopy'] );
447	}
448	if ( ! empty( $notification['evf_blindcarboncopy'] ) ) {
449	$emails->__set( 'bcc', $notification['evf_blindcarboncopy'] );
450	}
451	}
452
453	$emails = apply_filters( 'everest_forms_entry_email_before_send', $emails );
454
455	// Send entry email.
456	foreach ( $email['address'] as $address ) {
457	$emails->send( trim( $address ), $email['subject'], $email['message'] );
458	}
459
460	endforeach;
461	}
462
463	/**
464	* Saves entry to database.
465	*
466	* @param array $fields List of form fields.
467	* @param array $entry User submitted data.
468	* @param int $form_id Form ID.
469	* @param array $form_data Prepared form settings.
470	* @return int
471	*/
472	public function entry_save( $fields, $entry, $form_id, $form_data = array() ) {
473	global $wpdb;
474
475	// Check if form has entries disabled.
476	if ( isset( $form_data['settings']['disabled_entries'] ) && '1' === $form_data['settings']['disabled_entries'] ) {
477	return;
478	}
479
480	// Provide the opportunity to override via a filter.
481	if ( ! apply_filters( 'everest_forms_entry_save', true, $fields, $entry, $form_data ) ) {
482	return;
483	}
484
485	do_action( 'everest_forms_process_entry_save', $fields, $entry, $form_id, $form_data );
486
487	$fields = apply_filters( 'everest_forms_entry_save_data', $fields, $entry, $form_data );
488	$browser = evf_get_browser();
489	$user_ip = evf_get_ip_address();
490	$user_agent = $browser['name'] . '/' . $browser['platform'];
491	$entry_id = false;
492
493	// GDPR enhancements - If user details are disabled globally discard the IP and UA.
494	if ( 'yes' === get_option( 'everest_forms_disable_user_details' ) ) {
495	$user_agent = '';
496	$user_ip = '';
497	}
498
499	$entry_data = array(
500	'form_id' => $form_id,
501	'user_id' => get_current_user_id(),
502	'user_device' => sanitize_text_field( $user_agent ),
503	'user_ip_address' => sanitize_text_field( $user_ip ),
504	'status' => 'publish',
505	'referer' => $_SERVER['HTTP_REFERER'],
506	'date_created' => current_time( 'mysql', true ),
507	);
508
509	if ( ! $entry_data['form_id'] ) {
510	return new WP_Error( 'no-form-id', __( 'No form ID was found.', 'everest-forms' ) );
511	}
512
513	// Create entry.
514	$success = $wpdb->insert( $wpdb->prefix . 'evf_entries', $entry_data );
515
516	if ( is_wp_error( $success ) \|\| ! $success ) {
517	return new WP_Error( 'could-not-create', __( 'Could not create an entry', 'everest-forms' ) );
518	}
519
520	$entry_id = $wpdb->insert_id;
521
522	// Create meta data.
523	if ( $entry_id ) {
524	foreach ( $fields as $field ) {
525	$field = apply_filters( 'everest_forms_entry_save_fields', $field, $form_data, $entry_id );
526
527	// Add only whitelisted fields to entry meta.
528	if ( in_array( $field['type'], array( 'html', 'title' ), true ) ) {
529	continue;
530	}
531
532	if ( isset( $field['value'], $field['meta_key'] ) && '' !== $field['value'] ) {
533	$field_value = is_array( $field['value'] ) ? serialize( $field['value'] ) : $field['value'];
534	$entry_metadata = array(
535	'entry_id' => $entry_id,
536	'meta_key' => $field['meta_key'],
537	'meta_value' => $field_value,
538	);
539
540	// Insert entry meta.
541	$wpdb->insert( $wpdb->prefix . 'evf_entrymeta', $entry_metadata );
542	}
543	}
544	}
545
546	do_action( 'everest_forms_complete_entry_save', $entry_id, $fields, $entry, $form_id, $form_data );
547
548	return $entry_id;
549	}
550	}
551