PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 5.2.02.01
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v5.2.02.01
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/fields/FrmFieldCaptcha.php +61 -271 6.355.2.02.01 View file →
@@ -9,9 +9,8 @@
9 9 class FrmFieldCaptcha extends FrmFieldType {
10 10
11 11 /**
12 12 * @var string
13 - *
14 13 * @since 3.0
15 14 */
16 15 protected $type = 'captcha';
17 16
@@ -22,31 +21,16 @@
22 21 return FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/field-captcha.php';
23 22 }
24 23
25 24 /**
26 - * Returns the image name for a captcha.
27 - *
28 - * @return string
29 - */
30 - public static function get_captcha_image_name() {
31 - $frm_settings = FrmAppHelper::get_settings();
32 - $active_captcha = $frm_settings->active_captcha;
33 -
34 - return $active_captcha === 'recaptcha' && $frm_settings->re_type === 'v3' ? 'recaptcha_v3' : $active_captcha;
35 - }
36 -
37 - /**
38 25 * @return array
39 26 */
40 27 protected function field_settings_for_type() {
41 - $settings = FrmCaptchaFactory::get_settings_object();
42 28 return array(
43 - 'required' => false,
44 - 'invalid' => true,
45 - 'captcha_size' => $settings->should_show_captcha_size(),
46 - 'captcha_theme' => $settings->should_show_captcha_theme(),
47 - 'captcha_theme_auto_option' => $settings->should_show_captcha_theme_auto_option(),
48 - 'default' => false,
29 + 'required' => false,
30 + 'invalid' => true,
31 + 'captcha_size' => true,
32 + 'default' => false,
49 33 );
50 34 }
51 35
52 36 /**
@@ -71,243 +55,104 @@
71 55 );
72 56 }
73 57
74 58 /**
75 - * Modify the captcha field label so it is not orphaned.
59 + * Remove the "for" attribute for captcha
76 60 *
77 - * The label is omitted when the label position is set to "none".
78 - * When the label is visible it is rendered as a <span> instead of a <label>,
79 - * since the captcha response input is inside an iframe and cannot be referenced.
80 - *
81 - * @param array $args
61 + * @param array $args
82 62 * @param string $html
83 63 *
84 64 * @return string
85 65 */
86 66 protected function before_replace_html_shortcodes( $args, $html ) {
87 - if ( 'none' === FrmField::get_option( $this->field, 'label' ) ) {
88 - // Fully strip the label for a CAPTCHA if it is set to hidden.
89 - return preg_replace( '~\s*<label\b[^>]*for="field_\[key\]"[^>]*>.*?</label>\s*~s', '', $html );
90 - }
91 -
92 - // Convert a CAPTCHA label to a span to prevent an orphaned label issue in WAVE.
93 - return preg_replace(
94 - '~<label\b([^>]*?)\s*for="field_\[key\]"([^>]*?)>(.*?)</label>~s',
95 - '<span$1$2>$3</span>',
96 - $html
97 - );
67 + return str_replace( ' for="field_[key]"', ' for="g-recaptcha-response"', $html );
98 68 }
99 69
100 - /**
101 - * @param array $args
102 - * @param array $shortcode_atts
103 - *
104 - * @return string
105 - */
106 70 public function front_field_input( $args, $shortcode_atts ) {
107 - if ( ! self::should_show_captcha() ) {
71 + $frm_settings = FrmAppHelper::get_settings();
72 + if ( empty( $frm_settings->pubkey ) ) {
108 73 return '';
109 74 }
110 75
111 - $frm_settings = FrmAppHelper::get_settings();
112 - $settings = FrmCaptchaFactory::get_settings_object();
113 - $div_attributes = array(
114 - 'id' => $args['html_id'],
115 - 'class' => $this->class_prefix( $frm_settings ) . $this->captcha_class( $frm_settings ),
116 - 'data-sitekey' => $settings->get_pubkey(),
117 - );
76 + $class_prefix = $this->class_prefix();
77 + $captcha_size = $this->captcha_size();
78 + $allow_mutiple = $frm_settings->re_multi;
118 79
119 - if ( 'turnstile' === $frm_settings->active_captcha ) {
120 - $captcha_language = $this->get_captcha_language();
121 -
122 - if ( $captcha_language ) {
123 - $div_attributes['data-language'] = $captcha_language;
124 - }
80 + $html = '<div id="' . esc_attr( $args['html_id'] ) . '" class="' . esc_attr( $class_prefix ) . 'g-recaptcha" data-sitekey="' . esc_attr( $frm_settings->pubkey ) . '" data-size="' . esc_attr( $captcha_size ) . '" data-theme="' . esc_attr( $this->field['captcha_theme'] ) . '"';
81 + if ( $captcha_size == 'invisible' && ! $allow_mutiple ) {
82 + $html .= ' data-callback="frmAfterRecaptcha"';
125 83 }
84 + $html .= '></div>';
126 85
127 - $div_attributes = $settings->add_front_end_element_attributes( $div_attributes, $this->field );
128 -
129 - return '<div ' . FrmAppHelper::array_to_html_params( $div_attributes ) . '></div>';
86 + return $html;
130 87 }
131 88
132 - /**
133 - * @since 6.25
134 - *
135 - * @return string
136 - */
137 - private function get_captcha_language() {
138 - /**
139 - * Allows updating the captcha language.
140 - *
141 - * @since 6.25
142 - *
143 - * @param string $lang
144 - * @param array $field
145 - */
146 - return apply_filters( 'frm_captcha_lang', get_bloginfo( 'language' ), $this->field );
147 - }
89 + protected function load_field_scripts( $args ) {
90 + $api_js_url = $this->api_url();
148 91
149 - /**
150 - * Load the captcha script.
151 - *
152 - * @param array $args
153 - *
154 - * @return void
155 - */
156 - protected function load_field_scripts( $args ) {
157 - wp_register_script( 'captcha-api', $this->api_url(), array( 'formidable' ), '3', true );
158 - wp_enqueue_script( 'captcha-api' );
92 + wp_register_script( 'recaptcha-api', $api_js_url, array( 'formidable' ), '3', true );
93 + wp_enqueue_script( 'recaptcha-api' );
159 94 }
160 95
161 - /**
162 - * Get the URL for the script JS that is loaded on the front end.
163 - *
164 - * @return string
165 - */
166 96 protected function api_url() {
167 - $frm_settings = FrmAppHelper::get_settings();
168 - $active_mode = $frm_settings->active_captcha;
169 -
170 - if ( 'recaptcha' === $active_mode ) {
171 - return $this->recaptcha_api_url( $frm_settings );
172 - }
173 -
174 - if ( 'hcaptcha' === $active_mode ) {
175 - return $this->hcaptcha_api_url();
176 - }
177 -
178 - return $this->turnstile_api_url();
179 - }
180 -
181 - /**
182 - * @param FrmSettings $frm_settings
183 - *
184 - * @return string
185 - */
186 - protected function recaptcha_api_url( $frm_settings ) {
187 97 $api_js_url = 'https://www.google.com/recaptcha/api.js?';
188 98
189 - if ( $this->allow_multiple( $frm_settings ) ) {
99 + $frm_settings = FrmAppHelper::get_settings();
100 + $allow_mutiple = $frm_settings->re_multi;
101 + if ( $allow_mutiple ) {
190 102 $api_js_url .= '&onload=frmRecaptcha&render=explicit';
191 103 }
192 104
193 105 $lang = apply_filters( 'frm_recaptcha_lang', $frm_settings->re_lang, $this->field );
194 -
195 - if ( $lang ) {
106 + if ( ! empty( $lang ) ) {
196 107 $api_js_url .= '&hl=' . $lang;
197 108 }
198 109
199 - // Since this URL initially ends with ? and we never use add_query_arg, remove the extra
200 - // & that appears immediately after the ?
201 - $api_js_url = str_replace( '?&', '?', $api_js_url );
202 -
203 - /**
204 - * @param string $api_js_url
205 - */
206 110 return apply_filters( 'frm_recaptcha_js_url', $api_js_url );
207 111 }
208 112
209 - /**
210 - * @since 6.0
211 - *
212 - * @return string
213 - */
214 - protected function hcaptcha_api_url() {
215 - $api_js_url = 'https://js.hcaptcha.com/1/api.js';
216 - $lang = $this->get_captcha_language();
217 -
218 - if ( $lang ) {
219 - // Language might be in the format of en-US, fr-FR, etc. In that case, we need to extract the first part to comply with the hcaptcha api request format.
220 - $lang_parts = explode( '-', $lang );
221 - $api_js_url .= '?hl=' . $lang_parts[0];
113 + protected function class_prefix() {
114 + if ( $this->allow_multiple() ) {
115 + $class_prefix = 'frm-';
116 + } else {
117 + $class_prefix = '';
222 118 }
223 119
224 - $api_js_url = add_query_arg( 'onload', 'frmHcaptcha', $api_js_url );
225 -
226 - /**
227 - * Allows updating hcaptcha js api url.
228 - *
229 - * @since 6.0
230 - *
231 - * @param string $api_js_url
232 - */
233 - return apply_filters( 'frm_hcaptcha_js_url', $api_js_url );
120 + return $class_prefix;
234 121 }
235 122
236 - /**
237 - * @since 6.8.4
238 - *
239 - * @return string
240 - */
241 - protected function turnstile_api_url() {
242 - $api_js_url = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=frmTurnstile&render=explicit';
123 + protected function allow_multiple() {
124 + $frm_settings = FrmAppHelper::get_settings();
243 125
244 - /**
245 - * Allows updating hcaptcha js api url.
246 - *
247 - * @since 6.8.4
248 - *
249 - * @param string $api_js_url
250 - */
251 - $api_js_url = apply_filters( 'frm_turnstile_js_url', $api_js_url );
252 -
253 - // Prevent render=explicit from happening twice in case someone patched
254 - // The double rendering issue using the frm_turnstile_js_url hook.
255 - return str_replace(
256 - '&render=explicit&render=explicit',
257 - '&render=explicit',
258 - $api_js_url
259 - );
126 + return $frm_settings->re_multi;
260 127 }
261 128
262 129 /**
263 - * @param FrmSettings $frm_settings
264 - *
265 130 * @return string
266 - *
267 - * @psalm-return ''|'frm-'
268 131 */
269 - protected function class_prefix( $frm_settings ) {
270 - return FrmCaptchaFactory::get_settings_object()->get_class_prefix( $this->allow_multiple( $frm_settings ) );
132 + protected function captcha_size() {
133 + $frm_settings = FrmAppHelper::get_settings();
134 + if ( in_array( $frm_settings->re_type, array( 'invisible', 'v3' ), true ) ) {
135 + return 'invisible';
136 + }
137 + // for reverse compatibility
138 + return $this->field['captcha_size'] === 'default' ? 'normal' : $this->field['captcha_size'];
271 139 }
272 140
273 141 /**
274 - * @param FrmSettings $frm_settings This isn't used anymore. It's only there for backwards compatibility.
275 - *
276 - * @return string
277 - *
278 - * @psalm-return 'g-recaptcha'|'h-captcha'
279 - */
280 - protected function captcha_class( $frm_settings ) {
281 - $settings = FrmCaptchaFactory::get_settings_object();
282 - return $settings->get_element_class_name();
283 - }
284 -
285 - /**
286 - * @param FrmSettings $frm_settings
287 - *
288 - * @return bool
289 - */
290 - protected function allow_multiple( $frm_settings ) {
291 - return $frm_settings->re_multi;
292 - }
293 -
294 - /**
295 142 * @since 4.07
296 - *
297 143 * @param array $args
298 - *
299 144 * @return array
300 145 */
301 146 protected function validate_against_api( $args ) {
302 147 $errors = array();
303 148 $frm_settings = FrmAppHelper::get_settings();
304 - $resp = $this->send_api_check();
149 + $resp = $this->send_api_check( $frm_settings );
305 150 $response = json_decode( wp_remote_retrieve_body( $resp ), true );
306 151
307 152 if ( is_wp_error( $resp ) ) {
308 153 $error_string = $resp->get_error_message();
309 - $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your captcha', 'formidable' );
154 + $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your recaptcha', 'formidable' );
310 155 $errors[ 'field' . $args['id'] ] .= ' ' . $error_string;
311 156 return $errors;
312 157 }
313 158
@@ -314,9 +159,9 @@
314 159 if ( ! is_array( $response ) ) {
315 160 return $errors;
316 161 }
317 162
318 - if ( $frm_settings->active_captcha === 'recaptcha' && 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
163 + if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
319 164 $threshold = floatval( $frm_settings->re_threshold );
320 165 $score = floatval( $response['score'] );
321 166
322 167 $this->set_score( $score );
@@ -325,38 +170,27 @@
325 170 $response['success'] = false;
326 171 }
327 172 }
328 173
329 - if ( ! isset( $response['success'] ) || $response['success'] ) {
330 - return $errors;
174 + if ( isset( $response['success'] ) && ! $response['success'] ) {
175 + // What happens when the CAPTCHA was entered incorrectly
176 + $invalid_message = FrmField::get_option( $this->field, 'invalid' );
177 + $errors[ 'field' . $args['id'] ] = ( $invalid_message == '' ? $frm_settings->re_msg : $invalid_message );
331 178 }
332 179
333 - // What happens when the CAPTCHA was entered incorrectly
334 - $invalid_message = FrmField::get_option( $this->field, 'invalid' );
335 -
336 - if ( $invalid_message === __( 'The reCAPTCHA was not entered correctly', 'formidable' ) ) {
337 - $invalid_message = '';
338 - }
339 -
340 - $errors[ 'field' . $args['id'] ] = $invalid_message === '' ? $frm_settings->re_msg : $invalid_message;
341 -
342 180 return $errors;
343 181 }
344 182
345 183 /**
346 184 * @param float $score
347 - *
348 185 * @return void
349 186 */
350 187 private function set_score( $score ) {
351 188 global $frm_vars;
352 -
353 189 if ( ! isset( $frm_vars['captcha_scores'] ) ) {
354 190 $frm_vars['captcha_scores'] = array();
355 191 }
356 -
357 192 $form_id = is_object( $this->field ) ? $this->field->form_id : $this->field['form_id'];
358 -
359 193 if ( ! isset( $frm_vars['captcha_scores'][ $form_id ] ) ) {
360 194 $frm_vars['captcha_scores'][ $form_id ] = $score;
361 195 }
362 196 }
@@ -362,9 +196,8 @@
362 196 }
363 197
364 198 /**
365 199 * @param array $args
366 - *
367 200 * @return array
368 201 */
369 202 public function validate( $args ) {
370 203 if ( ! $this->should_validate() ) {
@@ -370,11 +203,11 @@
370 203 if ( ! $this->should_validate() ) {
371 204 return array();
372 205 }
373 206
374 - $missing_token = ! self::post_data_includes_token();
375 -
376 - if ( $missing_token ) {
207 + // phpcs:ignore WordPress.Security.NonceVerification.Missing
208 + if ( ! isset( $_POST['g-recaptcha-response'] ) ) {
209 + // There was no captcha submitted.
377 210 return array( 'field' . $args['id'] => __( 'The captcha is missing from this form', 'formidable' ) );
378 211 }
379 212
380 213 return $this->validate_against_api( $args );
@@ -380,77 +213,34 @@
380 213 return $this->validate_against_api( $args );
381 214 }
382 215
383 216 /**
384 - * @since 6.8.4
385 - *
386 - * @return bool
387 - */
388 - protected static function post_data_includes_token() {
389 - $settings = FrmCaptchaFactory::get_settings_object();
390 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
391 - return ! empty( $_POST[ $settings->token_field ] );
392 - }
393 -
394 - /**
395 - * Check if the active captcha type's public key is set.
396 - *
397 217 * @since 4.07
398 - *
399 218 * @return bool
400 219 */
401 - public static function should_show_captcha() {
402 - $settings = FrmCaptchaFactory::get_settings_object();
403 - return $settings->has_pubkey();
220 + private function should_show_captcha() {
221 + $frm_settings = FrmAppHelper::get_settings();
222 + return ! empty( $frm_settings->pubkey );
404 223 }
405 224
406 - /**
407 - * @return bool
408 - */
409 225 protected function should_validate() {
410 226 $is_hidden_field = apply_filters( 'frm_is_field_hidden', false, $this->field, wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
411 -
412 227 if ( FrmAppHelper::is_admin() || $is_hidden_field ) {
413 228 return false;
414 229 }
415 230
416 - // Don't require the captcha if it shouldn't be shown
417 - return self::should_show_captcha();
231 + // don't require the captcha if it shouldn't be shown
232 + return $this->should_show_captcha();
418 233 }
419 234
420 - /**
421 - * @return array|WP_Error
422 - */
423 - protected function send_api_check() {
424 - $captcha_settings = FrmCaptchaFactory::get_settings_object();
425 - $arg_array = array(
235 + protected function send_api_check( $frm_settings ) {
236 + $arg_array = array(
426 237 'body' => array(
427 - 'secret' => $captcha_settings->secret,
428 - 'response' => FrmAppHelper::get_param( $captcha_settings->token_field, '', 'post', 'sanitize_text_field' ),
238 + 'secret' => $frm_settings->privkey,
239 + 'response' => FrmAppHelper::get_param( 'g-recaptcha-response', '', 'post', 'sanitize_text_field' ),
429 240 'remoteip' => FrmAppHelper::get_ip_address(),
430 241 ),
431 242 );
432 243
433 - return wp_remote_post( $captcha_settings->endpoint, $arg_array );
434 - }
435 -
436 - /**
437 - * Updates field name in page builder to the currently activated captcha if it is set to the default.
438 - *
439 - * @since 6.0
440 - *
441 - * @param array $values
442 - *
443 - * @return array Values.
444 - */
445 - public static function update_field_name( $values ) {
446 - if ( $values['type'] === 'captcha' ) {
447 - $name = $values['name'];
448 -
449 - if ( in_array( $name, array( __( 'reCAPTCHA', 'formidable' ), __( 'hCaptcha', 'formidable' ) ), true ) ) {
450 - $values['name'] = __( 'Captcha', 'formidable' );
451 - }
452 - }
453 -
454 - return $values;
244 + return wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', $arg_array );
455 245 }
456 246 }