PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 5.0
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v5.0
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/FrmEntryValidate.php +116 -801 6.265.0 View file →
@@ -3,22 +3,8 @@
3 3 die( 'You are not allowed to call this page directly.' );
4 4 }
5 5
6 6 class FrmEntryValidate {
7 -
8 - /**
9 - * @since 6.17
10 - *
11 - * @var array|null
12 - */
13 - private static $name_text_fields;
14 -
15 - /**
16 - * @param array $values
17 - * @param bool|string[] $exclude
18 - *
19 - * @return array
20 - */
21 7 public static function validate( $values, $exclude = false ) {
22 8 FrmEntry::sanitize_entry_post( $values );
23 9 $errors = array();
24 10
@@ -28,13 +14,11 @@
28 14 return $errors;
29 15 }
30 16
31 17 if ( FrmAppHelper::is_admin() && is_user_logged_in() && ( ! isset( $values[ 'frm_submit_entry_' . $values['form_id'] ] ) || ! wp_verify_nonce( $values[ 'frm_submit_entry_' . $values['form_id'] ], 'frm_submit_entry_nonce' ) ) ) {
32 - $frm_settings = FrmAppHelper::get_settings();
33 - $errors['form'] = $frm_settings->admin_permission;
18 + $errors['form'] = __( 'You do not have permission to do that', 'formidable' );
34 19 }
35 20
36 - self::maybe_fix_item_meta();
37 21 self::set_item_key( $values );
38 22
39 23 $posted_fields = self::get_fields_to_validate( $values, $exclude );
40 24
@@ -49,48 +33,13 @@
49 33 if ( empty( $errors ) ) {
50 34 self::spam_check( $exclude, $values, $errors );
51 35 }
52 36
53 - /**
54 - * Allows modifying the validation errors after validating all fields.
55 - *
56 - * @since 5.0.04 Added `posted_fields` to the third param.
57 - *
58 - * @param array $errors Errors data.
59 - * @param array $values Value data of the form.
60 - * @param array $args Custom arguments. Contains `exclude` and `posted_fields`.
61 - */
62 - $filtered_errors = apply_filters( 'frm_validate_entry', $errors, $values, compact( 'exclude', 'posted_fields' ) );
37 + $errors = apply_filters( 'frm_validate_entry', $errors, $values, compact( 'exclude' ) );
63 38
64 - if ( is_array( $filtered_errors ) ) {
65 - $errors = $filtered_errors;
66 - } else {
67 - _doing_it_wrong( __METHOD__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
68 - }
69 -
70 39 return $errors;
71 40 }
72 41
73 - /**
74 - * In case $_POST['item_meta'] is not an array, change it to an empty array.
75 - * This helps to avoid some warnings and errors when $_POST['item_meta'] is updated.
76 - *
77 - * @since 6.6
78 - *
79 - * @return void
80 - */
81 - private static function maybe_fix_item_meta() {
82 - // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
83 - if ( ! isset( $_POST['item_meta'] ) || ! is_array( $_POST['item_meta'] ) ) {
84 - $_POST['item_meta'] = array();
85 - }
86 - }
87 -
88 - /**
89 - * @param array $values
90 - *
91 - * @return void
92 - */
93 42 private static function set_item_key( &$values ) {
94 43 if ( ! isset( $values['item_key'] ) || $values['item_key'] == '' ) {
95 44 global $wpdb;
96 45 $values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
@@ -97,14 +46,8 @@
97 46 $_POST['item_key'] = $values['item_key'];
98 47 }
99 48 }
100 49
101 - /**
102 - * @param array $values
103 - * @param array|string $exclude
104 - *
105 - * @return array
106 - */
107 50 private static function get_fields_to_validate( $values, $exclude ) {
108 51 $where = apply_filters( 'frm_posted_field_ids', array( 'fi.form_id' => $values['form_id'] ) );
109 52
110 53 // Don't get subfields
@@ -114,44 +57,22 @@
114 57 if ( ! empty( $exclude ) ) {
115 58 $where['fi.type not'] = $exclude;
116 59 }
117 60
118 - $fields = FrmField::getAll( $where, 'field_order' );
119 -
120 - /**
121 - * Allows modifying fields to validate.
122 - *
123 - * @since 5.0.06
124 - *
125 - * @param array $fields List of fields.
126 - * @param array $args Includes `values`, `exclude`, `where`.
127 - */
128 - return apply_filters( 'frm_fields_to_validate', $fields, compact( 'values', 'exclude', 'where' ) );
61 + return FrmField::getAll( $where, 'field_order' );
129 62 }
130 63
131 - /**
132 - * @param object $posted_field
133 - * @param array $errors
134 - * @param array $values
135 - * @param array $args
136 - *
137 - * @return void
138 - */
139 64 public static function validate_field( $posted_field, &$errors, $values, $args = array() ) {
140 65 $defaults = array(
141 66 'id' => $posted_field->id,
142 - // The id of the repeat or embed form.
143 - 'parent_field_id' => '',
144 - // The pointer in the posted array.
145 - 'key_pointer' => '',
146 - // Exclude these field types from validation.
147 - 'exclude' => array(),
148 -
67 + 'parent_field_id' => '', // the id of the repeat or embed form
68 + 'key_pointer' => '', // the pointer in the posted array
69 + 'exclude' => array(), // exclude these field types from validation
149 70 );
150 - $args = wp_parse_args( $args, $defaults );
71 + $args = wp_parse_args( $args, $defaults );
151 72
152 73 if ( empty( $args['parent_field_id'] ) ) {
153 - $value = $values['item_meta'][ $args['id'] ] ?? '';
74 + $value = isset( $values['item_meta'][ $args['id'] ] ) ? $values['item_meta'][ $args['id'] ] : '';
154 75 } else {
155 76 // value is from a nested form
156 77 $value = $values;
157 78 }
@@ -161,9 +82,8 @@
161 82
162 83 self::maybe_clear_value_for_default_blank_setting( $posted_field, $value );
163 84
164 85 $should_trim = is_array( $value ) && count( $value ) == 1 && isset( $value[0] ) && $posted_field->type !== 'checkbox';
165 -
166 86 if ( $should_trim ) {
167 87 $value = reset( $value );
168 88 }
169 89
@@ -172,15 +92,14 @@
172 92 }
173 93
174 94 if ( $posted_field->required == '1' && FrmAppHelper::is_empty_value( $value ) ) {
175 95 $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'blank' );
176 - } elseif ( ! isset( $_POST['item_name'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
177 - self::maybe_add_item_name( $value, $posted_field );
96 + } elseif ( $posted_field->type == 'text' && ! isset( $_POST['item_name'] ) ) { // WPCS: CSRF ok.
97 + $_POST['item_name'] = $value;
178 98 }
179 99
180 100 FrmEntriesHelper::set_posted_value( $posted_field, $value, $args );
181 101
182 - self::validate_options( $errors, $posted_field, $value, $args );
183 102 self::validate_field_types( $errors, $posted_field, $value, $args );
184 103
185 104 // Field might want to modify value before other parts of the system
186 105 // e.g. trim off excess values like in the case of fields with limit.
@@ -191,232 +110,18 @@
191 110 }
192 111
193 112 $errors = apply_filters( 'frm_validate_' . $posted_field->type . '_field_entry', $errors, $posted_field, $value, $args );
194 113 $errors = apply_filters( 'frm_validate_field_entry', $errors, $posted_field, $value, $args );
195 -
196 - if ( ! FrmAppHelper::pro_is_installed() && empty( $args['other'] ) ) {
197 - FrmEntriesHelper::get_posted_value( $posted_field, $value, $args );
198 - }
199 114 }
200 115
201 116 /**
202 - * @since 6.21
203 - *
204 - * @param array $errors
205 - * @param object $posted_field
206 - * @param array|string $value
207 - * @param array $args
208 - *
209 - * @return void
210 - */
211 - private static function validate_options( &$errors, $posted_field, $value, $args ) {
212 - if ( empty( $posted_field->options ) ) {
213 - return;
214 - }
215 -
216 - $option_is_valid = self::option_is_valid( $posted_field, $value, $posted_field->options );
217 -
218 - /**
219 - * @since 6.21
220 - *
221 - * @param bool $option_is_valid
222 - * @param array|string $value
223 - * @param object $field
224 - */
225 - $option_is_valid = (bool) apply_filters( 'frm_option_is_valid', $option_is_valid, $value, $posted_field );
226 -
227 - if ( ! $option_is_valid ) {
228 - $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'invalid' );
229 - }
230 - }
231 -
232 - /**
233 - * Validate that value matches one of the options for the field.
234 - *
235 - * @since 6.21
236 - *
237 - * @param stdClass $field
238 - * @param array|string $value
239 - * @param array $options
240 - *
241 - * @return bool
242 - */
243 - private static function option_is_valid( $field, $value, $options ) {
244 - if ( '' === $value ) {
245 - return true;
246 - }
247 -
248 - $field_object = FrmFieldFactory::get_field_type( $field->type, $field );
249 -
250 - if ( ! $field_object->field_type_has_options_settings() ) {
251 - return true;
252 - }
253 -
254 - if ( in_array( $field->type, array( 'likert', 'ranking' ), true ) ) {
255 - // Ignore these field types automatically.
256 - return true;
257 - }
258 -
259 - if ( 'product' === $field->type && 'user_def' === FrmField::get_option( $field, 'data_type' ) ) {
260 - return true;
261 - }
262 -
263 - if ( ! empty( $field->field_options['post_field'] ) ) {
264 - return true;
265 - }
266 -
267 - $value = (array) $value;
268 -
269 - foreach ( $value as $current_value ) {
270 - $match = false;
271 -
272 - foreach ( $options as $key => $option ) {
273 - if ( strpos( $key, 'other_' ) === 0 ) {
274 - // Always return true if an other option is found.
275 - return true;
276 - }
277 -
278 - if ( is_array( $option ) ) {
279 - $separate_value = FrmField::get_option( $field, 'separate_value' );
280 - $option_value = $separate_value ? $option['value'] : $option['label'];
281 - } else {
282 - $option_value = $option;
283 - }
284 -
285 - $match = trim( $current_value ) === trim( $option_value );
286 -
287 - if ( $match ) {
288 - break;
289 - }
290 -
291 - $match = trim( $current_value ) === trim( do_shortcode( $option_value ) );
292 -
293 - if ( $match ) {
294 - break;
295 - }
296 -
297 - $match = self::is_filtered_match( $current_value, $option_value );
298 -
299 - if ( $match ) {
300 - break;
301 - }
302 -
303 - if ( is_numeric( $current_value ) ) {
304 - $match = (int) $current_value === (int) $option_value;
305 -
306 - if ( $match ) {
307 - break;
308 - }
309 - }
310 - }//end foreach
311 -
312 - if ( ! $match ) {
313 - return self::options_are_dynamic_based_on_hook( $field, $value );
314 - }
315 - }//end foreach
316 -
317 - return true;
318 - }
319 -
320 - /**
321 - * Make an extra check after passing $option_value through the_content filter.
322 - * This is to help catch cases where the option's formatting has been modified using
323 - * the_content filter.
324 - *
325 - * @since 6.22
326 - *
327 - * @param string $value
328 - * @param string $option_value
329 - *
330 - * @return bool
331 - */
332 - private static function is_filtered_match( $value, $option_value ) {
333 - // First remove the wpautop filter so it doesn't add extra tags to $option_value.
334 - $filter_priority = has_filter( 'the_content', 'wpautop' );
335 -
336 - if ( is_numeric( $filter_priority ) ) {
337 - remove_filter( 'the_content', 'wpautop', $filter_priority );
338 - }
339 -
340 - $filtered_option = apply_filters( 'the_content', $option_value );
341 -
342 - if ( is_numeric( $filter_priority ) ) {
343 - add_filter( 'the_content', 'wpautop', $filter_priority );
344 - }
345 - return trim( $value ) === trim( $filtered_option );
346 - }
347 -
348 - /**
349 - * Do not validate options if they have been modified with a hook.
350 - * This is to help avoid issues where the options could be based on a URL param for example.
351 - *
352 - * @since 6.21
353 - *
354 - * @param object $field_object The field object.
355 - * @param array|string $value The value to validate.
356 - *
357 - * @return bool
358 - */
359 - private static function options_are_dynamic_based_on_hook( $field_object, $value ) {
360 - $values = (array) $field_object;
361 - $values['value'] = $value;
362 - FrmFieldsHelper::prepare_new_front_field( $values, $field_object );
363 -
364 - $separate_value = FrmField::get_option( $field_object, 'separate_value' );
365 - $map_callback = function ( $option ) use ( $separate_value ) {
366 - if ( is_array( $option ) ) {
367 - $option_value = $separate_value ? $option['value'] : $option['label'];
368 - } else {
369 - $option_value = $option;
370 - }
371 -
372 - $option_value = do_shortcode( $option_value );
373 - return $option_value;
374 - };
375 -
376 - $values_options = array_map( $map_callback, $values['options'] );
377 - $field_object_options = array_map( $map_callback, $field_object->options );
378 -
379 - return $values_options !== $field_object_options;
380 - }
381 -
382 - /**
383 - * Maybe add item_name to $_POST to save it in items table.
384 - *
385 - * @since 5.2.02
386 - *
387 - * @param array|string $value Field value.
388 - * @param object $field Field object.
389 - *
390 - * @return void
391 - */
392 - private static function maybe_add_item_name( $value, $field ) {
393 - $item_name = false;
394 -
395 - if ( 'name' === $field->type ) {
396 - $field_obj = FrmFieldFactory::get_field_object( $field );
397 - $item_name = $field_obj->get_display_value( $value );
398 - } elseif ( 'text' === $field->type ) {
399 - $item_name = $value;
400 - }
401 -
402 - if ( false !== $item_name ) {
403 - // Item name has a max length of 255 characters so truncate it so it doesn't fail to save in the database.
404 - $_POST['item_name'] = substr( $item_name, 0, 255 );
405 - }
406 - }
407 -
408 - /**
409 117 * Set $value to an empty string if it matches its label
410 118 *
411 119 * @param object $field
412 120 * @param string $value
413 - *
414 - * @return void
415 121 */
416 122 private static function maybe_clear_value_for_default_blank_setting( $field, &$value ) {
417 123 $position = FrmField::get_option( $field, 'label' );
418 -
419 124 if ( ! $position ) {
420 125 $position = FrmStylesController::get_style_val( 'position', $field->form_id );
421 126 }
422 127
@@ -424,16 +129,8 @@
424 129 $value = '';
425 130 }
426 131 }
427 132
428 - /**
429 - * @param array $errors
430 - * @param object $posted_field
431 - * @param mixed $value
432 - * @param array $args
433 - *
434 - * @return void
435 - */
436 133 public static function validate_field_types( &$errors, $posted_field, $value, $args ) {
437 134 $field_obj = FrmFieldFactory::get_field_object( $posted_field );
438 135 $args['value'] = $value;
439 136 $args['errors'] = $errors;
@@ -438,26 +135,16 @@
438 135 $args['value'] = $value;
439 136 $args['errors'] = $errors;
440 137
441 138 $new_errors = $field_obj->validate( $args );
442 -
443 139 if ( ! empty( $new_errors ) ) {
444 140 $errors = array_merge( $errors, $new_errors );
445 141 }
446 142 }
447 143
448 - /**
449 - * @param array $errors
450 - * @param object $field
451 - * @param string $value
452 - * @param array $args
453 - *
454 - * @return void
455 - */
456 144 public static function validate_phone_field( &$errors, $field, $value, $args ) {
457 - $format_value = FrmField::get_option( $field, 'format' );
145 + if ( $field->type == 'phone' || ( $field->type == 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
458 146
459 - if ( $field->type === 'phone' || ( $field->type === 'text' && $format_value && ! FrmCurrencyHelper::is_currency_format( $format_value ) ) ) {
460 147 $pattern = self::phone_format( $field );
461 148
462 149 if ( ! preg_match( $pattern, $value ) ) {
463 150 $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $field, 'invalid' );
@@ -464,13 +151,8 @@
464 151 }
465 152 }
466 153 }
467 154
468 - /**
469 - * @param object $field
470 - *
471 - * @return string
472 - */
473 155 public static function phone_format( $field ) {
474 156 if ( FrmField::is_option_empty( $field, 'format' ) ) {
475 157 $pattern = self::default_phone_format();
476 158 } else {
@@ -476,11 +158,8 @@
476 158 } else {
477 159 $pattern = FrmField::get_option( $field, 'format' );
478 160 }
479 161
480 - // Ampersands are saved as &.
481 - // Reverse it here so we are checking for the correct character.
482 - $pattern = html_entity_decode( $pattern );
483 162 $pattern = apply_filters( 'frm_phone_pattern', $pattern, $field );
484 163
485 164 // Create a regexp if format is not already a regexp
486 165 if ( strpos( $pattern, '^' ) !== 0 ) {
@@ -493,10 +172,8 @@
493 172 }
494 173
495 174 /**
496 175 * @since 3.01
497 - *
498 - * @return string
499 176 */
500 177 private static function default_phone_format() {
501 178 return '^((\+\d{1,3}(-|.| )?\(?\d\)?(-| |.)?\d{1,5})|(\(?\d{2,6}\)?))(-|.| )?(\d{3,4})(-|.| )?(\d{4})(( x| ext)\d{1,5}){0,1}$';
502 179 }
@@ -525,9 +202,8 @@
525 202
526 203 if ( strpos( $pattern, '\?' ) !== false ) {
527 204 $parts = explode( '\?', $pattern );
528 205 $pattern = '';
529 -
530 206 foreach ( $parts as $part ) {
531 207 if ( empty( $pattern ) ) {
532 208 $pattern .= $part;
533 209 } else {
@@ -534,9 +210,8 @@
534 210 $pattern .= '(' . $part . ')?';
535 211 }
536 212 }
537 213 }
538 -
539 214 $pattern = '^' . $pattern . '$';
540 215
541 216 return $pattern;
542 217 }
@@ -541,70 +216,35 @@
541 216 return $pattern;
542 217 }
543 218
544 219 /**
545 - * Check for spam.
220 + * Check for spam
546 221 *
547 - * @param bool $exclude
222 + * @param boolean $exclude
548 223 * @param array $values
549 - * @param array $errors By reference.
550 - *
551 - * @return void
224 + * @param array $errors by reference
552 225 */
553 226 public static function spam_check( $exclude, $values, &$errors ) {
554 - if ( defined( 'WP_IMPORTING' ) && WP_IMPORTING ) {
555 - // Do not check spam on importing.
556 - return;
557 - }
558 -
559 - if ( ! empty( $exclude ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
227 + if ( ! empty( $exclude ) || ! isset( $values['item_meta'] ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
560 228 // only check spam if there are no other errors
561 229 return;
562 230 }
563 231
564 232 $antispam_check = self::is_antispam_check( $values['form_id'] );
565 - $spam_msg = FrmAntiSpamController::get_default_spam_message();
566 -
567 233 if ( is_string( $antispam_check ) ) {
568 234 $errors['spam'] = $antispam_check;
569 235 } elseif ( self::is_honeypot_spam( $values ) || self::is_spam_bot() ) {
570 - $errors['spam'] = $spam_msg;
571 - } else {
572 - $is_spam = FrmAntiSpamController::is_spam( $values );
573 -
574 - if ( $is_spam ) {
575 - $errors['spam'] = $is_spam;
576 - }
577 - }
578 -
579 - if ( isset( $errors['spam'] ) || self::form_is_in_progress( $values ) ) {
580 - return;
581 - }
582 -
583 - if ( self::is_akismet_enabled_for_user( $values['form_id'] ) && self::is_akismet_spam( $values ) ) {
584 236 $errors['spam'] = __( 'Your entry appears to be spam!', 'formidable' );
237 + } elseif ( self::blacklist_check( $values ) ) {
238 + $errors['spam'] = __( 'Your entry appears to be blocked spam!', 'formidable' );
239 + } elseif ( self::is_akismet_spam( $values ) && self::is_akismet_enabled_for_user( $values['form_id'] ) ) {
240 + $errors['spam'] = __( 'Your entry appears to be spam!', 'formidable' );
585 241 }
586 242 }
587 243
588 244 /**
589 - * Checks if form is in progress.
590 - *
591 - * @since 5.0.13
592 - *
593 - * @param array $values The values.
594 - *
595 - * @return bool
596 - */
597 - private static function form_is_in_progress( $values ) {
598 - return FrmAppHelper::pro_is_installed() &&
599 - ( isset( $values[ 'frm_page_order_' . $values['form_id'] ] ) || FrmAppHelper::get_post_param( 'frm_next_page' ) ) &&
600 - FrmField::get_all_types_in_form( $values['form_id'], 'break' );
601 - }
602 -
603 - /**
604 245 * @param int $form_id
605 - *
606 - * @return bool|string
246 + * @return boolean
607 247 */
608 248 private static function is_antispam_check( $form_id ) {
609 249 $aspm = new FrmAntiSpam( $form_id );
610 250 return $aspm->validate();
@@ -611,10 +251,9 @@
611 251 }
612 252
613 253 /**
614 254 * @param array $values
615 - *
616 - * @return bool
255 + * @return boolean
617 256 */
618 257 private static function is_honeypot_spam( $values ) {
619 258 $honeypot = new FrmHoneypot( $values['form_id'] );
620 259 return ! $honeypot->validate();
@@ -620,9 +259,9 @@
620 259 return ! $honeypot->validate();
621 260 }
622 261
623 262 /**
624 - * @return bool
263 + * @return boolean
625 264 */
626 265 private static function is_spam_bot() {
627 266 $ip = FrmAppHelper::get_ip_address();
628 267
@@ -630,10 +269,9 @@
630 269 }
631 270
632 271 /**
633 272 * @param array $values
634 - *
635 - * @return bool
273 + * @return boolean
636 274 */
637 275 private static function is_akismet_spam( $values ) {
638 276 global $wpcom_api_key;
639 277
@@ -641,84 +279,97 @@
641 279 }
642 280
643 281 /**
644 282 * @param int $form_id
645 - *
646 283 * @return bool
647 284 */
648 285 private static function is_akismet_enabled_for_user( $form_id ) {
649 286 $form = FrmForm::getOne( $form_id );
650 287
651 - return ( ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() ) );
288 + return ( isset( $form->options['akismet'] ) && ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() ) );
652 289 }
653 290
291 + public static function blacklist_check( $values ) {
292 + if ( ! apply_filters( 'frm_check_blacklist', true, $values ) ) {
293 + return false;
294 + }
295 +
296 + $mod_keys = trim( self::get_disallowed_words() );
297 + if ( empty( $mod_keys ) ) {
298 + return false;
299 + }
300 +
301 + $content = FrmEntriesHelper::entry_array_to_string( $values );
302 + if ( empty( $content ) ) {
303 + return false;
304 + }
305 +
306 + $ip = FrmAppHelper::get_ip_address();
307 + $user_agent = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
308 + $user_info = self::get_spam_check_user_info( $values );
309 +
310 + return self::check_disallowed_words( $user_info['comment_author'], $user_info['comment_author_email'], $user_info['comment_author_url'], $content, $ip, $user_agent );
311 + }
312 +
654 313 /**
655 - * Checks spam using WordPress disallowed words and Frm denylist.
314 + * For WP 5.5 compatibility.
656 315 *
657 - * @param array $values Entry values.
316 + * @since 4.06.02
317 + */
318 + private static function check_disallowed_words( $author, $email, $url, $content, $ip, $user_agent ) {
319 + if ( function_exists( 'wp_check_comment_disallowed_list' ) ) {
320 + return wp_check_comment_disallowed_list( $author, $email, $url, $content, $ip, $user_agent );
321 + } else {
322 + return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
323 + }
324 + }
325 +
326 + /**
327 + * For WP 5.5 compatibility.
658 328 *
659 - * @return bool
329 + * @since 4.06.02
660 330 */
661 - public static function blacklist_check( $values ) {
662 - return FrmAntiSpamController::contains_wp_disallowed_words( $values ) || FrmAntiSpamController::is_denylist_spam( $values );
331 + private static function get_disallowed_words() {
332 + $keys = get_option( 'disallowed_keys' );
333 + if ( false === $keys ) {
334 + // Fallback for WP < 5.5.
335 + $keys = get_option( 'blacklist_keys' );
336 + }
337 + return $keys;
663 338 }
664 339
665 340 /**
666 341 * Check entries for Akismet spam
667 342 *
668 - * @param array $values Entry values.
669 - *
670 - * @return bool true if is spam
343 + * @return boolean true if is spam
671 344 */
672 345 public static function akismet( $values ) {
673 - if ( empty( $values['item_meta'] ) ) {
346 + $content = FrmEntriesHelper::entry_array_to_string( $values );
347 + if ( empty( $content ) ) {
674 348 return false;
675 349 }
676 350
677 351 $datas = array(
678 - 'comment_type' => 'formidable',
352 + 'comment_type' => 'formidable',
353 + 'comment_content' => $content,
679 354 );
680 355 self::parse_akismet_array( $datas, $values );
681 356
682 - /**
683 - * Allows modifying the values sent to Akismet.
684 - *
685 - * @since 5.0.07
686 - *
687 - * @param array $datas The array of values being sent to Akismet.
688 - */
689 - $datas = apply_filters( 'frm_akismet_values', $datas );
690 -
691 357 $query_string = _http_build_query( $datas, '', '&' );
692 358 $response = Akismet::http_post( $query_string, 'comment-check' );
693 359
694 - return ( is_array( $response ) && $response[1] === 'true' );
360 + return ( is_array( $response ) && $response[1] == 'true' );
695 361 }
696 362
697 363 /**
698 364 * @since 2.0
699 - *
700 - * @param array $datas The array of values being sent to Akismet.
701 - * @param array $values Entry values.
702 - *
703 - * @return void
704 365 */
705 366 private static function parse_akismet_array( &$datas, $values ) {
706 367 self::add_site_info_to_akismet( $datas );
368 + self::add_user_info_to_akismet( $datas, $values );
707 369 self::add_server_values_to_akismet( $datas );
708 -
709 - self::prepare_values_for_spam_check( $values );
710 - self::skip_adding_values_to_akismet( $values );
711 -
712 - self::add_user_info_to_akismet( $datas, $values );
713 - self::add_comment_content_to_akismet( $datas, $values );
714 370 }
715 371
716 - /**
717 - * @param array $datas
718 - *
719 - * @return void
720 - */
721 372 private static function add_site_info_to_akismet( &$datas ) {
722 373 $datas['blog'] = FrmAppHelper::site_url();
723 374 $datas['user_ip'] = preg_replace( '/[^0-9., ]/', '', FrmAppHelper::get_ip_address() );
724 375 $datas['user_agent'] = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
@@ -730,14 +381,8 @@
730 381 $datas['is_test'] = 'true';
731 382 }
732 383 }
733 384
734 - /**
735 - * @param array $datas
736 - * @param array $values
737 - *
738 - * @return void
739 - */
740 385 private static function add_user_info_to_akismet( &$datas, $values ) {
741 386 $user_info = self::get_spam_check_user_info( $values );
742 387 $datas = $datas + $user_info;
743 388
@@ -745,194 +390,45 @@
745 390 $datas['user_role'] = Akismet::get_user_roles( $user_info['user_ID'] );
746 391 }
747 392 }
748 393
749 - /**
750 - * Gets user info for Akismet spam check.
751 - *
752 - * @since 5.0.13 Separate code for guest. Handle value of embedded|repeater.
753 - * @since 6.21 This changed from private to public.
754 - *
755 - * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
756 - *
757 - * @return array
758 - */
759 - public static function get_spam_check_user_info( $values ) {
760 - if ( ! is_user_logged_in() ) {
761 - return self::get_spam_check_user_info_for_guest( $values );
762 - }
394 + private static function get_spam_check_user_info( $values ) {
395 + $datas = array();
763 396
764 - $user = wp_get_current_user();
397 + if ( is_user_logged_in() ) {
398 + $user = wp_get_current_user();
765 399
766 - return array(
767 - 'user_ID' => $user->ID,
768 - 'user_id' => $user->ID,
769 - 'comment_author' => $user->display_name,
770 - 'comment_author_email' => $user->user_email,
771 - 'comment_author_url' => $user->user_url,
772 - );
773 - }
400 + $datas['user_ID'] = $user->ID;
401 + $datas['user_id'] = $user->ID;
402 + $datas['comment_author'] = $user->display_name;
403 + $datas['comment_author_email'] = $user->user_email;
404 + $datas['comment_author_url'] = $user->user_url;
405 + } else {
406 + $datas['comment_author'] = '';
407 + $datas['comment_author_email'] = '';
408 + $datas['comment_author_url'] = '';
774 409
775 - /**
776 - * Gets user info for Akismet spam check for guest.
777 - *
778 - * @since 5.0.13
779 - *
780 - * @param array $values Entry values after flattened.
781 - *
782 - * @return array
783 - */
784 - private static function get_spam_check_user_info_for_guest( $values ) {
785 - $datas = array(
786 - 'comment_author' => '',
787 - 'comment_author_email' => '',
788 - 'comment_author_url' => '',
789 - 'name_field_ids' => $values['name_field_ids'],
790 - 'missing_keys' => array( 'comment_author_email', 'comment_author_url', 'comment_author' ),
791 - 'frm_duplicated' => array(),
792 - );
793 -
794 - if ( isset( $values['item_meta'] ) ) {
795 - $values = $values['item_meta'];
796 - }
797 -
798 - $values = array_filter( $values );
799 -
800 - self::recursive_add_akismet_guest_info( $datas, $values );
801 - unset( $datas['name_field_ids'] );
802 - unset( $datas['missing_keys'] );
803 -
804 - return $datas;
805 - }
806 -
807 - /**
808 - * Recursive adds akismet guest info.
809 - *
810 - * @since 5.0.13
811 - *
812 - * @param array $datas Guest data.
813 - * @param array $values The values.
814 - * @param int|null $custom_index Custom index (or field ID).
815 - *
816 - * @return void
817 - */
818 - private static function recursive_add_akismet_guest_info( &$datas, $values, $custom_index = null ) {
819 - foreach ( $values as $index => $value ) {
820 - if ( ! $datas['missing_keys'] ) {
821 - // Found all info.
822 - return;
410 + if ( isset( $values['item_meta'] ) ) {
411 + $values = $values['item_meta'];
823 412 }
824 413
825 - if ( is_array( $value ) ) {
826 - self::recursive_add_akismet_guest_info( $datas, $value, $index );
827 - continue;
828 - }
829 -
830 - $field_id = ! is_null( $custom_index ) ? $custom_index : $index;
831 -
832 - foreach ( $datas['missing_keys'] as $key_index => $key ) {
833 - $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'], $values );
834 -
835 - if ( $found ) {
836 - $datas[ $key ] = $value;
837 - $datas['frm_duplicated'][] = $field_id;
838 - unset( $datas['missing_keys'][ $key_index ] );
414 + $values = array_filter( $values );
415 + foreach ( $values as $value ) {
416 + if ( ! is_array( $value ) ) {
417 + if ( $datas['comment_author_email'] == '' && strpos( $value, '@' ) && is_email( $value ) ) {
418 + $datas['comment_author_email'] = $value;
419 + } elseif ( $datas['comment_author_url'] == '' && strpos( $value, 'http' ) === 0 ) {
420 + $datas['comment_author_url'] = $value;
421 + } elseif ( $datas['comment_author'] == '' && ! is_numeric( $value ) && strlen( $value ) < 200 ) {
422 + $datas['comment_author'] = $value;
423 + }
839 424 }
840 425 }
841 - }//end foreach
842 - }
843 -
844 - /**
845 - * Checks if given value is an akismet guest info.
846 - *
847 - * @since 5.0.13
848 - *
849 - * @param string $key Guest info key.
850 - * @param string $value Value to check.
851 - * @param int $field_id Field ID.
852 - * @param array $name_field_ids Name field IDs.
853 - * @param array $values Array of posted values.
854 - *
855 - * @return bool
856 - */
857 - private static function is_akismet_guest_info_value( $key, &$value, $field_id, $name_field_ids, $values ) {
858 - if ( ! $value || is_numeric( $value ) ) {
859 - return false;
860 426 }
861 427
862 - switch ( $key ) {
863 - case 'comment_author_email':
864 - return strpos( $value, '@' ) && is_email( $value );
865 -
866 - case 'comment_author_url':
867 - return 0 === strpos( $value, 'http' );
868 -
869 - case 'comment_author':
870 - if ( $name_field_ids && in_array( $field_id, $name_field_ids, true ) ) {
871 - // If there is name field in the form, we should always use it as author name.
872 - return true;
873 - }
874 -
875 - $form_id = FrmAppHelper::get_post_param( 'form_id', 0, 'absint' );
876 - $fields = self::get_name_text_fields( $form_id );
877 -
878 - foreach ( $fields as $index => $field ) {
879 - if ( 'Name' !== $field->name ) {
880 - continue;
881 - }
882 -
883 - if ( isset( $fields[ $index + 1 ] ) && 'Last' === $fields[ $index + 1 ]->name ) {
884 - if ( empty( $values[ absint( $fields[ $index + 1 ]->id ) ] ) ) {
885 - continue;
886 - }
887 -
888 - $value .= ' ' . $values[ $fields[ $index + 1 ]->id ];
889 - return true;
890 - }
891 - }
892 - }//end switch
893 -
894 - return false;
428 + return $datas;
895 429 }
896 430
897 - /**
898 - * Returns fields that have 'Name' and 'Last' as their name.
899 - *
900 - * @since 6.17
901 - *
902 - * @param int $form_id
903 - *
904 - * @return array
905 - */
906 - private static function get_name_text_fields( $form_id ) {
907 - $name_text_fields_is_initialized = is_array( self::$name_text_fields );
908 -
909 - if ( $name_text_fields_is_initialized && isset( self::$name_text_fields[ $form_id ] ) ) {
910 - return self::$name_text_fields[ $form_id ];
911 - }
912 -
913 - if ( ! $name_text_fields_is_initialized ) {
914 - self::$name_text_fields = array();
915 - }
916 - self::$name_text_fields[ $form_id ] = FrmDb::get_results(
917 - 'frm_fields',
918 - array(
919 - 'form_id' => $form_id,
920 - 'type' => 'text',
921 - 'name' => array( 'Name', 'Last' ),
922 - ),
923 - 'id,name',
924 - array( 'order_by' => 'field_order ASC' )
925 - );
926 -
927 - return self::$name_text_fields[ $form_id ];
928 - }
929 -
930 - /**
931 - * @param array $datas
932 - *
933 - * @return void
934 - */
935 431 private static function add_server_values_to_akismet( &$datas ) {
936 432 foreach ( $_SERVER as $key => $value ) {
937 433 $include_value = is_string( $value ) && ! preg_match( '/^HTTP_COOKIE/', $key ) && preg_match( '/^(HTTP_|REMOTE_ADDR|REQUEST_URI|DOCUMENT_URI)/', $key );
938 434
@@ -944,216 +440,35 @@
944 440 }
945 441 }
946 442
947 443 /**
948 - * Adds comment content to Akismet data.
949 - *
950 - * @since 5.0.09
951 - *
952 - * @param array $datas The array of values being sent to Akismet.
953 - * @param array $values Entry values.
954 - *
955 - * @return void
444 + * @deprecated 3.0
445 + * @codeCoverageIgnore
956 446 */
957 - private static function add_comment_content_to_akismet( &$datas, $values ) {
958 - if ( isset( $datas['frm_duplicated'] ) ) {
959 - foreach ( $datas['frm_duplicated'] as $index ) {
960 - if ( isset( $values['item_meta'][ $index ] ) ) {
961 - unset( $values['item_meta'][ $index ] );
962 - } else {
963 - unset( $values[ $index ] );
964 - }
965 - }
966 - unset( $datas['frm_duplicated'] );
967 - }
968 -
969 - $datas['comment_content'] = FrmEntriesHelper::entry_array_to_string( $values );
447 + public static function validate_url_field( &$errors, $field, $value, $args ) {
448 + FrmDeprecated::validate_url_field( $errors, $field, $value, $args );
970 449 }
971 450
972 451 /**
973 - * Skips adding field values to Akismet.
974 - *
975 - * @since 5.0.09
976 - *
977 - * @param array $values Entry values.
978 - *
979 - * @return void
452 + * @deprecated 3.0
453 + * @codeCoverageIgnore
980 454 */
981 - private static function skip_adding_values_to_akismet( &$values ) {
982 - $skipped_fields = self::get_akismet_skipped_field_ids( $values );
983 -
984 - foreach ( $skipped_fields as $skipped_field ) {
985 - if ( ! isset( $values['item_meta'][ $skipped_field->id ] ) ) {
986 - continue;
987 - }
988 -
989 - if ( self::should_really_skip_field( $skipped_field, $values ) ) {
990 - unset( $values['item_meta'][ $skipped_field->id ] );
991 -
992 - if ( isset( $values['item_meta']['other'][ $skipped_field->id ] ) ) {
993 - unset( $values['item_meta']['other'][ $skipped_field->id ] );
994 - }
995 - }
996 - }
455 + public static function validate_email_field( &$errors, $field, $value, $args ) {
456 + FrmDeprecated::validate_email_field( $errors, $field, $value, $args );
997 457 }
998 458
999 459 /**
1000 - * Checks if a skip field should be really skipped.
1001 - *
1002 - * @since 5.02.04
1003 - *
1004 - * @param object $field_data Object contains `id` and `options`.
1005 - * @param array $values Entry values.
1006 - *
1007 - * @return bool
460 + * @deprecated 3.0
461 + * @codeCoverageIgnore
1008 462 */
1009 - private static function should_really_skip_field( $field_data, $values ) {
1010 - if ( empty( $field_data->options ) ) {
1011 - // This is skipped field types.
1012 - return true;
1013 - }
1014 -
1015 - FrmAppHelper::unserialize_or_decode( $field_data->options );
1016 -
1017 - if ( ! $field_data->options ) {
1018 - // Check if an error happens when unserializing, or empty options.
1019 - return true;
1020 - }
1021 -
1022 - end( $field_data->options );
1023 - $last_key = key( $field_data->options );
1024 -
1025 - // If a choice field has no Other option.
1026 - if ( is_numeric( $last_key ) || 0 !== strpos( $last_key, 'other_' ) ) {
1027 - return true;
1028 - }
1029 -
1030 - // If a choice field has Other option, but Other is not selected.
1031 - if ( empty( $values['item_meta']['other'][ $field_data->id ] ) ) {
1032 - return true;
1033 - }
1034 -
1035 - // Check if submitted value is same as one of field option.
1036 - foreach ( $field_data->options as $option ) {
1037 - $option_value = ! is_array( $option ) ? $option : ( $option['value'] ?? '' );
1038 -
1039 - if ( $values['item_meta']['other'][ $field_data->id ] === $option_value ) {
1040 - return true;
1041 - }
1042 - }
1043 -
1044 - return false;
463 + public static function validate_number_field( &$errors, $field, $value, $args ) {
464 + FrmDeprecated::validate_number_field( $errors, $field, $value, $args );
1045 465 }
1046 466
1047 467 /**
1048 - * Gets field IDs that are skipped from sending to Akismet spam check.
1049 - *
1050 - * @since 5.0.09
1051 - * @since 5.0.13 Move out get_all_form_ids_and_flatten_meta() call and get `form_ids` from `$values`.
1052 - * @since 5.2.04 This method returns array of object contains `id` and `options` instead of array of `id` only.
1053 - *
1054 - * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
1055 - *
1056 - * @return array
468 + * @deprecated 3.0
469 + * @codeCoverageIgnore
1057 470 */
1058 - private static function get_akismet_skipped_field_ids( $values ) {
1059 - if ( empty( $values['form_ids'] ) ) {
1060 - return array();
1061 - }
1062 -
1063 - $skipped_types = array( 'divider', 'form', 'hidden', 'user_id', 'file', 'date', 'time', 'scale', 'star', 'range', 'toggle', 'data', 'lookup', 'likert', 'nps' );
1064 - $has_other_types = array( 'radio', 'checkbox', 'select' );
1065 -
1066 - $where = array(
1067 - array(
1068 - 'form_id' => $values['form_ids'],
1069 - 'type' => array_merge( $skipped_types, $has_other_types ),
1070 - ),
1071 - );
1072 -
1073 - return FrmDb::get_results( 'frm_fields', $where, 'id,options' );
1074 - }
1075 -
1076 - /**
1077 - * Prepares values array for spam check.
1078 - *
1079 - * @since 5.0.13
1080 - * @since 6.21 This changed from private to public.
1081 - *
1082 - * @param array $values Entry values.
1083 - *
1084 - * @return void
1085 - */
1086 - public static function prepare_values_for_spam_check( &$values ) {
1087 - $form_ids = self::get_all_form_ids_and_flatten_meta( $values );
1088 - $values['form_ids'] = $form_ids;
1089 - }
1090 -
1091 - /**
1092 - * Gets all form IDs (include child form IDs) and flatten item_meta array. Used for skipping values sent to Akismet.
1093 - * This also removes some unused data from the item_meta.
1094 - *
1095 - * @since 5.0.09
1096 - * @since 5.0.13 Convert name field value to string.
1097 - *
1098 - * @param array $values Entry values.
1099 - *
1100 - * @return array Form IDs.
1101 - */
1102 - private static function get_all_form_ids_and_flatten_meta( &$values ) {
1103 - $values['name_field_ids'] = array();
1104 -
1105 - // Blacklist check for File field in the old version doesn't contain `form_id`.
1106 - $form_ids = isset( $values['form_id'] ) ? array( absint( $values['form_id'] ) ) : array();
1107 -
1108 - foreach ( $values['item_meta'] as $field_id => $value ) {
1109 - if ( ! is_numeric( $field_id ) ) {
1110 - // Maybe `other`.
1111 - continue;
1112 - }
1113 -
1114 - // Convert name array to string.
1115 - if ( isset( $value['first'] ) && isset( $value['last'] ) ) {
1116 - $values['item_meta'][ $field_id ] = trim( implode( ' ', $value ) );
1117 - $values['name_field_ids'][] = $field_id;
1118 - continue;
1119 - }
1120 -
1121 - if ( ! is_array( $value ) || empty( $value['form'] ) ) {
1122 - continue;
1123 - }
1124 -
1125 - $form_ids[] = absint( $value['form'] );
1126 -
1127 - foreach ( $value as $subindex => $subvalue ) {
1128 - if ( ! is_numeric( $subindex ) || ! is_array( $subvalue ) ) {
1129 - continue;
1130 - }
1131 -
1132 - foreach ( $subvalue as $subsubindex => $subsubvalue ) {
1133 - if ( ! $subsubvalue ) {
1134 - continue;
1135 - }
1136 -
1137 - if ( ! isset( $values['item_meta'][ $subsubindex ] ) ) {
1138 - $values['item_meta'][ $subsubindex ] = array();
1139 - }
1140 -
1141 - // Convert name array to string.
1142 - if ( isset( $subsubvalue['first'] ) && isset( $subsubvalue['last'] ) ) {
1143 - $subsubvalue = trim( implode( ' ', $subsubvalue ) );
1144 -
1145 - $values['name_field_ids'][] = $subsubindex;
1146 - }
1147 -
1148 - if ( is_array( $values['item_meta'][ $subsubindex ] ) ) {
1149 - $values['item_meta'][ $subsubindex ][] = $subsubvalue;
1150 - }
1151 - }
1152 - }//end foreach
1153 -
1154 - unset( $values['item_meta'][ $field_id ] );
1155 - }//end foreach
1156 -
1157 - return $form_ids;
471 + public static function validate_recaptcha( &$errors, $field, $args ) {
472 + FrmDeprecated::validate_recaptcha( $errors, $field, $args );
1158 473 }
1159 474 }