← All changes | classes/models/fields/FrmFieldCaptcha.php +58 -283 6.26.1 → 5.2.07 View file →

		@@ -9,9 +9,8 @@
9	9	class FrmFieldCaptcha extends FrmFieldType {
10	10
11	11	/**
12	12	* @var string
13		- *
14	13	* @since 3.0
15	14	*/
16	15	protected $type = 'captcha';
17	16
		@@ -22,37 +21,16 @@
22	21	return FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/field-captcha.php';
23	22	}
24	23
25	24	/**
26		- * Returns the image name for a captcha.
27		- *
28		- * @return string
29		- */
30		- public static function get_captcha_image_name() {
31		- $frm_settings = FrmAppHelper::get_settings();
32		- $active_captcha = $frm_settings->active_captcha;
33		-
34		- if ( $active_captcha === 'recaptcha' && $frm_settings->re_type === 'v3' ) {
35		- $image_name = 'recaptcha_v3';
36		- } else {
37		- $image_name = $active_captcha;
38		- }
39		-
40		- return $image_name;
41		- }
42		-
43		- /**
44	25	* @return array
45	26	*/
46	27	protected function field_settings_for_type() {
47		- $settings = FrmCaptchaFactory::get_settings_object();
48	28	return array(
49		- 'required' => false,
50		- 'invalid' => true,
51		- 'captcha_size' => $settings->should_show_captcha_size(),
52		- 'captcha_theme' => $settings->should_show_captcha_theme(),
53		- 'captcha_theme_auto_option' => $settings->should_show_captcha_theme_auto_option(),
54		- 'default' => false,
	29	+ 'required' => false,
	30	+ 'invalid' => true,
	31	+ 'captcha_size' => true,
	32	+ 'default' => false,
55	33	);
56	34	}
57	35
58	36	/**
		@@ -77,230 +55,93 @@
77	55	);
78	56	}
79	57
80	58	/**
81		- * Replace the "for" attribute for captcha field so it matches the response ID.
	59	+ * Remove the "for" attribute for captcha
82	60	*
83		- * @param array $args
	61	+ * @param array $args
84	62	* @param string $html
85	63	*
86	64	* @return string
87	65	*/
88	66	protected function before_replace_html_shortcodes( $args, $html ) {
89		- $settings = FrmCaptchaFactory::get_settings_object();
90		- return str_replace( ' for="field_[key]"', ' for="' . esc_attr( $settings->token_field ) . '"', $html );
	67	+ return str_replace( ' for="field_[key]"', ' for="g-recaptcha-response"', $html );
91	68	}
92	69
93		- /**
94		- * @param array $args
95		- * @param array $shortcode_atts
96		- *
97		- * @return string
98		- */
99	70	public function front_field_input( $args, $shortcode_atts ) {
100	71	$frm_settings = FrmAppHelper::get_settings();
101		-
102		- if ( ! self::should_show_captcha() ) {
	72	+ if ( empty( $frm_settings->pubkey ) ) {
103	73	return '';
104	74	}
105	75
106		- $settings = FrmCaptchaFactory::get_settings_object();
107		- $div_attributes = array(
108		- 'id' => $args['html_id'],
109		- 'class' => $this->class_prefix( $frm_settings ) . $this->captcha_class( $frm_settings ),
110		- 'data-sitekey' => $settings->get_pubkey(),
111		- );
	76	+ $class_prefix = $this->class_prefix();
	77	+ $captcha_size = $this->captcha_size();
	78	+ $allow_mutiple = $frm_settings->re_multi;
112	79
113		- if ( 'turnstile' === $frm_settings->active_captcha ) {
114		- $captcha_language = $this->get_captcha_language();
115		-
116		- if ( $captcha_language ) {
117		- $div_attributes['data-language'] = $captcha_language;
118		- }
	80	+ $html = '<div id="' . esc_attr( $args['html_id'] ) . '" class="' . esc_attr( $class_prefix ) . 'g-recaptcha" data-sitekey="' . esc_attr( $frm_settings->pubkey ) . '" data-size="' . esc_attr( $captcha_size ) . '" data-theme="' . esc_attr( $this->field['captcha_theme'] ) . '"';
	81	+ if ( $captcha_size == 'invisible' && ! $allow_mutiple ) {
	82	+ $html .= ' data-callback="frmAfterRecaptcha"';
119	83	}
	84	+ $html .= '></div>';
120	85
121		- $div_attributes = $settings->add_front_end_element_attributes( $div_attributes, $this->field );
122		- $html = '<div ' . FrmAppHelper::array_to_html_params( $div_attributes ) . '></div>';
123		-
124	86	return $html;
125	87	}
126	88
127		- /**
128		- * @since 6.25
129		- *
130		- * @return string
131		- */
132		- private function get_captcha_language() {
133		- /**
134		- * Allows updating the captcha language.
135		- *
136		- * @since 6.25
137		- *
138		- * @param string $lang
139		- * @param array $field
140		- */
141		- return apply_filters( 'frm_captcha_lang', get_bloginfo( 'language' ), $this->field );
142		- }
143		-
144		- /**
145		- * Load the captcha script.
146		- *
147		- * @param array $args
148		- *
149		- * @return void
150		- */
151	89	protected function load_field_scripts( $args ) {
152	90	$api_js_url = $this->api_url();
153	91
154		- wp_register_script( 'captcha-api', $api_js_url, array( 'formidable' ), '3', true );
155		- wp_enqueue_script( 'captcha-api' );
	92	+ wp_register_script( 'recaptcha-api', $api_js_url, array( 'formidable' ), '3', true );
	93	+ wp_enqueue_script( 'recaptcha-api' );
156	94	}
157	95
158		- /**
159		- * Get the URL for the script JS that is loaded on the front end.
160		- *
161		- * @return string
162		- */
163	96	protected function api_url() {
164		- $frm_settings = FrmAppHelper::get_settings();
165		- $active_mode = $frm_settings->active_captcha;
166		-
167		- if ( 'recaptcha' === $active_mode ) {
168		- return $this->recaptcha_api_url( $frm_settings );
169		- }
170		-
171		- if ( 'hcaptcha' === $active_mode ) {
172		- return $this->hcaptcha_api_url();
173		- }
174		-
175		- return $this->turnstile_api_url();
176		- }
177		-
178		- /**
179		- * @param FrmSettings $frm_settings
180		- *
181		- * @return string
182		- */
183		- protected function recaptcha_api_url( $frm_settings ) {
184	97	$api_js_url = 'https://www.google.com/recaptcha/api.js?';
185	98
186		- if ( $this->allow_multiple( $frm_settings ) ) {
	99	+ $frm_settings = FrmAppHelper::get_settings();
	100	+ $allow_mutiple = $frm_settings->re_multi;
	101	+ if ( $allow_mutiple ) {
187	102	$api_js_url .= '&onload=frmRecaptcha&render=explicit';
188	103	}
189	104
190	105	$lang = apply_filters( 'frm_recaptcha_lang', $frm_settings->re_lang, $this->field );
191		-
192		- if ( $lang ) {
	106	+ if ( ! empty( $lang ) ) {
193	107	$api_js_url .= '&hl=' . $lang;
194	108	}
195	109
196		- // Since this URL initially ends with ? and we never use add_query_arg, remove the extra
197		- // & that appears immediately after the ?
198		- $api_js_url = str_replace( '?&', '?', $api_js_url );
199		-
200		- /**
201		- * @param string $api_js_url
202		- */
203		- $api_js_url = apply_filters( 'frm_recaptcha_js_url', $api_js_url );
204		-
205		- return $api_js_url;
	110	+ return apply_filters( 'frm_recaptcha_js_url', $api_js_url );
206	111	}
207	112
208		- /**
209		- * @since 6.0
210		- *
211		- * @return string
212		- */
213		- protected function hcaptcha_api_url() {
214		- $api_js_url = 'https://js.hcaptcha.com/1/api.js';
215		-
216		- $lang = $this->get_captcha_language();
217		-
218		- if ( $lang ) {
219		- // Language might be in the format of en-US, fr-FR, etc. In that case, we need to extract the first part to comply with the hcaptcha api request format.
220		- $lang_parts = explode( '-', $lang );
221		- $api_js_url .= '?hl=' . $lang_parts[0];
	113	+ protected function class_prefix() {
	114	+ if ( $this->allow_multiple() ) {
	115	+ $class_prefix = 'frm-';
	116	+ } else {
	117	+ $class_prefix = '';
222	118	}
223	119
224		- $api_js_url = add_query_arg( 'onload', 'frmHcaptcha', $api_js_url );
225		-
226		- /**
227		- * Allows updating hcaptcha js api url.
228		- *
229		- * @since 6.0
230		- *
231		- * @param string $api_js_url
232		- */
233		- $api_js_url = apply_filters( 'frm_hcaptcha_js_url', $api_js_url );
234		-
235		- return $api_js_url;
	120	+ return $class_prefix;
236	121	}
237	122
238		- /**
239		- * @since 6.8.4
240		- *
241		- * @return string
242		- */
243		- protected function turnstile_api_url() {
244		- $api_js_url = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=frmTurnstile&render=explicit';
	123	+ protected function allow_multiple() {
	124	+ $frm_settings = FrmAppHelper::get_settings();
245	125
246		- /**
247		- * Allows updating hcaptcha js api url.
248		- *
249		- * @since 6.8.4
250		- *
251		- * @param string $api_js_url
252		- */
253		- $api_js_url = apply_filters( 'frm_turnstile_js_url', $api_js_url );
254		-
255		- // Prevent render=explicit from happening twice in case someone patched
256		- // the double rendering issue using the frm_turnstile_js_url hook.
257		- $api_js_url = str_replace(
258		- '&render=explicit&render=explicit',
259		- '&render=explicit',
260		- $api_js_url
261		- );
262		-
263		- return $api_js_url;
	126	+ return $frm_settings->re_multi;
264	127	}
265	128
266	129	/**
267		- * @param FrmSettings $frm_settings
268		- *
269	130	* @return string
270		- *
271		- * @psalm-return ''|'frm-'
272	131	*/
273		- protected function class_prefix( $frm_settings ) {
274		- return FrmCaptchaFactory::get_settings_object()->get_class_prefix( $this->allow_multiple( $frm_settings ) );
	132	+ protected function captcha_size() {
	133	+ $frm_settings = FrmAppHelper::get_settings();
	134	+ if ( in_array( $frm_settings->re_type, array( 'invisible', 'v3' ), true ) ) {
	135	+ return 'invisible';
	136	+ }
	137	+ // for reverse compatibility
	138	+ return $this->field['captcha_size'] === 'default' ? 'normal' : $this->field['captcha_size'];
275	139	}
276	140
277	141	/**
278		- * @param FrmSettings $frm_settings This isn't used anymore. It's only there for backwards compatibility.
279		- *
280		- * @return string
281		- *
282		- * @psalm-return 'g-recaptcha'|'h-captcha'
283		- */
284		- protected function captcha_class( $frm_settings ) {
285		- $settings = FrmCaptchaFactory::get_settings_object();
286		- return $settings->get_element_class_name();
287		- }
288		-
289		- /**
290		- * @param FrmSettings $frm_settings
291		- *
292		- * @return bool
293		- */
294		- protected function allow_multiple( $frm_settings ) {
295		- return $frm_settings->re_multi;
296		- }
297		-
298		- /**
299	142	* @since 4.07
300		- *
301	143	* @param array $args
302		- *
303	144	* @return array
304	145	*/
305	146	protected function validate_against_api( $args ) {
306	147	$errors = array();
		@@ -309,9 +150,9 @@
309	150	$response = json_decode( wp_remote_retrieve_body( $resp ), true );
310	151
311	152	if ( is_wp_error( $resp ) ) {
312	153	$error_string = $resp->get_error_message();
313		- $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your captcha', 'formidable' );
	154	+ $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your recaptcha', 'formidable' );
314	155	$errors[ 'field' . $args['id'] ] .= ' ' . $error_string;
315	156	return $errors;
316	157	}
317	158
		@@ -318,29 +159,23 @@
318	159	if ( ! is_array( $response ) ) {
319	160	return $errors;
320	161	}
321	162
322		- if ( $frm_settings->active_captcha === 'recaptcha' ) {
323		- if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
324		- $threshold = floatval( $frm_settings->re_threshold );
325		- $score = floatval( $response['score'] );
	163	+ if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
	164	+ $threshold = floatval( $frm_settings->re_threshold );
	165	+ $score = floatval( $response['score'] );
326	166
327		- $this->set_score( $score );
	167	+ $this->set_score( $score );
328	168
329		- if ( $score < $threshold ) {
330		- $response['success'] = false;
331		- }
	169	+ if ( $score < $threshold ) {
	170	+ $response['success'] = false;
332	171	}
333	172	}
334	173
335	174	if ( isset( $response['success'] ) && ! $response['success'] ) {
336	175	// What happens when the CAPTCHA was entered incorrectly
337		- $invalid_message = FrmField::get_option( $this->field, 'invalid' );
338		-
339		- if ( $invalid_message === __( 'The reCAPTCHA was not entered correctly', 'formidable' ) ) {
340		- $invalid_message = '';
341		- }
342		- $errors[ 'field' . $args['id'] ] = ( $invalid_message === '' ? $frm_settings->re_msg : $invalid_message );
	176	+ $invalid_message = FrmField::get_option( $this->field, 'invalid' );
	177	+ $errors[ 'field' . $args['id'] ] = ( $invalid_message == '' ? $frm_settings->re_msg : $invalid_message );
343	178	}
344	179
345	180	return $errors;
346	181	}
		@@ -346,20 +181,16 @@
346	181	}
347	182
348	183	/**
349	184	* @param float $score
350		- *
351	185	* @return void
352	186	*/
353	187	private function set_score( $score ) {
354	188	global $frm_vars;
355		-
356	189	if ( ! isset( $frm_vars['captcha_scores'] ) ) {
357	190	$frm_vars['captcha_scores'] = array();
358	191	}
359		-
360	192	$form_id = is_object( $this->field ) ? $this->field->form_id : $this->field['form_id'];
361		-
362	193	if ( ! isset( $frm_vars['captcha_scores'][ $form_id ] ) ) {
363	194	$frm_vars['captcha_scores'][ $form_id ] = $score;
364	195	}
365	196	}
		@@ -365,9 +196,8 @@
365	196	}
366	197
367	198	/**
368	199	* @param array $args
369		- *
370	200	* @return array
371	201	*/
372	202	public function validate( $args ) {
373	203	if ( ! $this->should_validate() ) {
		@@ -373,11 +203,11 @@
373	203	if ( ! $this->should_validate() ) {
374	204	return array();
375	205	}
376	206
377		- $missing_token = ! self::post_data_includes_token();
378		-
379		- if ( $missing_token ) {
	207	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	208	+ if ( ! isset( $_POST['g-recaptcha-response'] ) ) {
	209	+ // There was no captcha submitted.
380	210	return array( 'field' . $args['id'] => __( 'The captcha is missing from this form', 'formidable' ) );
381	211	}
382	212
383	213	return $this->validate_against_api( $args );
		@@ -383,89 +213,34 @@
383	213	return $this->validate_against_api( $args );
384	214	}
385	215
386	216	/**
387		- * @since 6.8.4
388		- *
389		- * @return bool
390		- */
391		- protected static function post_data_includes_token() {
392		- $settings = FrmCaptchaFactory::get_settings_object();
393		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
394		- return ! empty( $_POST[ $settings->token_field ] );
395		- }
396		-
397		- /**
398		- * Check if the active captcha type's public key is set.
399		- *
400	217	* @since 4.07
401		- *
402	218	* @return bool
403	219	*/
404		- public static function should_show_captcha() {
405		- $settings = FrmCaptchaFactory::get_settings_object();
406		- return $settings->has_pubkey();
	220	+ private function should_show_captcha() {
	221	+ $frm_settings = FrmAppHelper::get_settings();
	222	+ return ! empty( $frm_settings->pubkey );
407	223	}
408	224
409		- /**
410		- * @return bool
411		- */
412	225	protected function should_validate() {
413	226	$is_hidden_field = apply_filters( 'frm_is_field_hidden', false, $this->field, wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
414		-
415	227	if ( FrmAppHelper::is_admin() || $is_hidden_field ) {
416	228	return false;
417	229	}
418	230
419	231	// don't require the captcha if it shouldn't be shown
420		- return self::should_show_captcha();
	232	+ return $this->should_show_captcha();
421	233	}
422	234
423		- /**
424		- * @param FrmSettings $frm_settings
425		- *
426		- * @return array|WP_Error
427		- */
428	235	protected function send_api_check( $frm_settings ) {
429		- $captcha_settings = FrmCaptchaFactory::get_settings_object();
430		- $arg_array = array(
	236	+ $arg_array = array(
431	237	'body' => array(
432		- 'secret' => $captcha_settings->secret,
433		- 'response' => FrmAppHelper::get_param( $captcha_settings->token_field, '', 'post', 'sanitize_text_field' ),
	238	+ 'secret' => $frm_settings->privkey,
	239	+ 'response' => FrmAppHelper::get_param( 'g-recaptcha-response', '', 'post', 'sanitize_text_field' ),
434	240	'remoteip' => FrmAppHelper::get_ip_address(),
435	241	),
436	242	);
437	243
438		- return wp_remote_post( $captcha_settings->endpoint, $arg_array );
439		- }
440		-
441		- /**
442		- * Updates field name in page builder to the currently activated captcha if it is set to the default.
443		- *
444		- * @since 6.0
445		- *
446		- * @param array $values
447		- *
448		- * @return array $values
449		- */
450		- public static function update_field_name( $values ) {
451		- if ( $values['type'] === 'captcha' ) {
452		- $name = $values['name'];
453		-
454		- if ( in_array( $name, array( __( 'reCAPTCHA', 'formidable' ), __( 'hCaptcha', 'formidable' ) ), true ) ) {
455		- $values['name'] = __( 'Captcha', 'formidable' );
456		- }
457		- }
458		-
459		- return $values;
460		- }
461		-
462		- /**
463		- * @param FrmSettings $frm_settings
464		- *
465		- * @return string
466		- */
467		- protected function captcha_size( $frm_settings ) {
468		- _deprecated_function( __METHOD__, '6.8.4' );
469		- return 'normal';
	244	+ return wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', $arg_array );
470	245	}
471	246	}