PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 5.4
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v5.4
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/fields/FrmFieldCaptcha.php +64 -265 6.285.4 View file →
@@ -9,9 +9,8 @@
9 9 class FrmFieldCaptcha extends FrmFieldType {
10 10
11 11 /**
12 12 * @var string
13 - *
14 13 * @since 3.0
15 14 */
16 15 protected $type = 'captcha';
17 16
@@ -22,31 +21,16 @@
22 21 return FrmAppHelper::plugin_path() . '/classes/views/frm-fields/back-end/field-captcha.php';
23 22 }
24 23
25 24 /**
26 - * Returns the image name for a captcha.
27 - *
28 - * @return string
29 - */
30 - public static function get_captcha_image_name() {
31 - $frm_settings = FrmAppHelper::get_settings();
32 - $active_captcha = $frm_settings->active_captcha;
33 -
34 - return $active_captcha === 'recaptcha' && $frm_settings->re_type === 'v3' ? 'recaptcha_v3' : $active_captcha;
35 - }
36 -
37 - /**
38 25 * @return array
39 26 */
40 27 protected function field_settings_for_type() {
41 - $settings = FrmCaptchaFactory::get_settings_object();
42 28 return array(
43 - 'required' => false,
44 - 'invalid' => true,
45 - 'captcha_size' => $settings->should_show_captcha_size(),
46 - 'captcha_theme' => $settings->should_show_captcha_theme(),
47 - 'captcha_theme_auto_option' => $settings->should_show_captcha_theme_auto_option(),
48 - 'default' => false,
29 + 'required' => false,
30 + 'invalid' => true,
31 + 'captcha_size' => true,
32 + 'default' => false,
49 33 );
50 34 }
51 35
52 36 /**
@@ -71,232 +55,104 @@
71 55 );
72 56 }
73 57
74 58 /**
75 - * Replace the "for" attribute for captcha field so it matches the response ID.
59 + * Remove the "for" attribute for captcha
76 60 *
77 - * @param array $args
61 + * @param array $args
78 62 * @param string $html
79 63 *
80 64 * @return string
81 65 */
82 66 protected function before_replace_html_shortcodes( $args, $html ) {
83 - $settings = FrmCaptchaFactory::get_settings_object();
84 - return str_replace( ' for="field_[key]"', ' for="' . esc_attr( $settings->token_field ) . '"', $html );
67 + return str_replace( ' for="field_[key]"', ' for="g-recaptcha-response"', $html );
85 68 }
86 69
87 - /**
88 - * @param array $args
89 - * @param array $shortcode_atts
90 - *
91 - * @return string
92 - */
93 70 public function front_field_input( $args, $shortcode_atts ) {
94 - if ( ! self::should_show_captcha() ) {
71 + $frm_settings = FrmAppHelper::get_settings();
72 + if ( empty( $frm_settings->pubkey ) ) {
95 73 return '';
96 74 }
97 75
98 - $frm_settings = FrmAppHelper::get_settings();
99 - $settings = FrmCaptchaFactory::get_settings_object();
100 - $div_attributes = array(
101 - 'id' => $args['html_id'],
102 - 'class' => $this->class_prefix( $frm_settings ) . $this->captcha_class( $frm_settings ),
103 - 'data-sitekey' => $settings->get_pubkey(),
104 - );
76 + $class_prefix = $this->class_prefix();
77 + $captcha_size = $this->captcha_size();
78 + $allow_mutiple = $frm_settings->re_multi;
105 79
106 - if ( 'turnstile' === $frm_settings->active_captcha ) {
107 - $captcha_language = $this->get_captcha_language();
108 -
109 - if ( $captcha_language ) {
110 - $div_attributes['data-language'] = $captcha_language;
111 - }
80 + $html = '<div id="' . esc_attr( $args['html_id'] ) . '" class="' . esc_attr( $class_prefix ) . 'g-recaptcha" data-sitekey="' . esc_attr( $frm_settings->pubkey ) . '" data-size="' . esc_attr( $captcha_size ) . '" data-theme="' . esc_attr( $this->field['captcha_theme'] ) . '"';
81 + if ( $captcha_size == 'invisible' && ! $allow_mutiple ) {
82 + $html .= ' data-callback="frmAfterRecaptcha"';
112 83 }
84 + $html .= '></div>';
113 85
114 - $div_attributes = $settings->add_front_end_element_attributes( $div_attributes, $this->field );
115 -
116 - return '<div ' . FrmAppHelper::array_to_html_params( $div_attributes ) . '></div>';
86 + return $html;
117 87 }
118 88
119 - /**
120 - * @since 6.25
121 - *
122 - * @return string
123 - */
124 - private function get_captcha_language() {
125 - /**
126 - * Allows updating the captcha language.
127 - *
128 - * @since 6.25
129 - *
130 - * @param string $lang
131 - * @param array $field
132 - */
133 - return apply_filters( 'frm_captcha_lang', get_bloginfo( 'language' ), $this->field );
134 - }
135 -
136 - /**
137 - * Load the captcha script.
138 - *
139 - * @param array $args
140 - *
141 - * @return void
142 - */
143 89 protected function load_field_scripts( $args ) {
144 90 $api_js_url = $this->api_url();
145 91
146 - wp_register_script( 'captcha-api', $api_js_url, array( 'formidable' ), '3', true );
147 - wp_enqueue_script( 'captcha-api' );
92 + wp_register_script( 'recaptcha-api', $api_js_url, array( 'formidable' ), '3', true );
93 + wp_enqueue_script( 'recaptcha-api' );
148 94 }
149 95
150 - /**
151 - * Get the URL for the script JS that is loaded on the front end.
152 - *
153 - * @return string
154 - */
155 96 protected function api_url() {
156 - $frm_settings = FrmAppHelper::get_settings();
157 - $active_mode = $frm_settings->active_captcha;
158 -
159 - if ( 'recaptcha' === $active_mode ) {
160 - return $this->recaptcha_api_url( $frm_settings );
161 - }
162 -
163 - if ( 'hcaptcha' === $active_mode ) {
164 - return $this->hcaptcha_api_url();
165 - }
166 -
167 - return $this->turnstile_api_url();
168 - }
169 -
170 - /**
171 - * @param FrmSettings $frm_settings
172 - *
173 - * @return string
174 - */
175 - protected function recaptcha_api_url( $frm_settings ) {
176 97 $api_js_url = 'https://www.google.com/recaptcha/api.js?';
177 98
178 - if ( $this->allow_multiple( $frm_settings ) ) {
99 + $frm_settings = FrmAppHelper::get_settings();
100 + $allow_mutiple = $frm_settings->re_multi;
101 + if ( $allow_mutiple ) {
179 102 $api_js_url .= '&onload=frmRecaptcha&render=explicit';
180 103 }
181 104
182 105 $lang = apply_filters( 'frm_recaptcha_lang', $frm_settings->re_lang, $this->field );
183 -
184 - if ( $lang ) {
106 + if ( ! empty( $lang ) ) {
185 107 $api_js_url .= '&hl=' . $lang;
186 108 }
187 109
188 - // Since this URL initially ends with ? and we never use add_query_arg, remove the extra
189 - // & that appears immediately after the ?
190 - $api_js_url = str_replace( '?&', '?', $api_js_url );
191 -
192 - /**
193 - * @param string $api_js_url
194 - */
195 110 return apply_filters( 'frm_recaptcha_js_url', $api_js_url );
196 111 }
197 112
198 - /**
199 - * @since 6.0
200 - *
201 - * @return string
202 - */
203 - protected function hcaptcha_api_url() {
204 - $api_js_url = 'https://js.hcaptcha.com/1/api.js';
205 - $lang = $this->get_captcha_language();
206 -
207 - if ( $lang ) {
208 - // Language might be in the format of en-US, fr-FR, etc. In that case, we need to extract the first part to comply with the hcaptcha api request format.
209 - $lang_parts = explode( '-', $lang );
210 - $api_js_url .= '?hl=' . $lang_parts[0];
113 + protected function class_prefix() {
114 + if ( $this->allow_multiple() ) {
115 + $class_prefix = 'frm-';
116 + } else {
117 + $class_prefix = '';
211 118 }
212 119
213 - $api_js_url = add_query_arg( 'onload', 'frmHcaptcha', $api_js_url );
214 -
215 - /**
216 - * Allows updating hcaptcha js api url.
217 - *
218 - * @since 6.0
219 - *
220 - * @param string $api_js_url
221 - */
222 - return apply_filters( 'frm_hcaptcha_js_url', $api_js_url );
120 + return $class_prefix;
223 121 }
224 122
225 - /**
226 - * @since 6.8.4
227 - *
228 - * @return string
229 - */
230 - protected function turnstile_api_url() {
231 - $api_js_url = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=frmTurnstile&render=explicit';
123 + protected function allow_multiple() {
124 + $frm_settings = FrmAppHelper::get_settings();
232 125
233 - /**
234 - * Allows updating hcaptcha js api url.
235 - *
236 - * @since 6.8.4
237 - *
238 - * @param string $api_js_url
239 - */
240 - $api_js_url = apply_filters( 'frm_turnstile_js_url', $api_js_url );
241 -
242 - // Prevent render=explicit from happening twice in case someone patched
243 - // The double rendering issue using the frm_turnstile_js_url hook.
244 - return str_replace(
245 - '&render=explicit&render=explicit',
246 - '&render=explicit',
247 - $api_js_url
248 - );
126 + return $frm_settings->re_multi;
249 127 }
250 128
251 129 /**
252 - * @param FrmSettings $frm_settings
253 - *
254 130 * @return string
255 - *
256 - * @psalm-return ''|'frm-'
257 131 */
258 - protected function class_prefix( $frm_settings ) {
259 - return FrmCaptchaFactory::get_settings_object()->get_class_prefix( $this->allow_multiple( $frm_settings ) );
132 + protected function captcha_size() {
133 + $frm_settings = FrmAppHelper::get_settings();
134 + if ( in_array( $frm_settings->re_type, array( 'invisible', 'v3' ), true ) ) {
135 + return 'invisible';
136 + }
137 + // for reverse compatibility
138 + return $this->field['captcha_size'] === 'default' ? 'normal' : $this->field['captcha_size'];
260 139 }
261 140
262 141 /**
263 - * @param FrmSettings $frm_settings This isn't used anymore. It's only there for backwards compatibility.
264 - *
265 - * @return string
266 - *
267 - * @psalm-return 'g-recaptcha'|'h-captcha'
268 - */
269 - protected function captcha_class( $frm_settings ) {
270 - $settings = FrmCaptchaFactory::get_settings_object();
271 - return $settings->get_element_class_name();
272 - }
273 -
274 - /**
275 - * @param FrmSettings $frm_settings
276 - *
277 - * @return bool
278 - */
279 - protected function allow_multiple( $frm_settings ) {
280 - return $frm_settings->re_multi;
281 - }
282 -
283 - /**
284 142 * @since 4.07
285 - *
286 143 * @param array $args
287 - *
288 144 * @return array
289 145 */
290 146 protected function validate_against_api( $args ) {
291 147 $errors = array();
292 148 $frm_settings = FrmAppHelper::get_settings();
293 - $resp = $this->send_api_check();
149 + $resp = $this->send_api_check( $frm_settings );
294 150 $response = json_decode( wp_remote_retrieve_body( $resp ), true );
295 151
296 152 if ( is_wp_error( $resp ) ) {
297 153 $error_string = $resp->get_error_message();
298 - $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your captcha', 'formidable' );
154 + $errors[ 'field' . $args['id'] ] = __( 'There was a problem verifying your recaptcha', 'formidable' );
299 155 $errors[ 'field' . $args['id'] ] .= ' ' . $error_string;
300 156 return $errors;
301 157 }
302 158
@@ -303,51 +159,38 @@
303 159 if ( ! is_array( $response ) ) {
304 160 return $errors;
305 161 }
306 162
307 - if ( $frm_settings->active_captcha === 'recaptcha' ) {
308 - if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
309 - $threshold = floatval( $frm_settings->re_threshold );
310 - $score = floatval( $response['score'] );
163 + if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
164 + $threshold = floatval( $frm_settings->re_threshold );
165 + $score = floatval( $response['score'] );
311 166
312 - $this->set_score( $score );
167 + $this->set_score( $score );
313 168
314 - if ( $score < $threshold ) {
315 - $response['success'] = false;
316 - }
169 + if ( $score < $threshold ) {
170 + $response['success'] = false;
317 171 }
318 172 }
319 173
320 - if ( ! isset( $response['success'] ) || $response['success'] ) {
321 - return $errors;
174 + if ( isset( $response['success'] ) && ! $response['success'] ) {
175 + // What happens when the CAPTCHA was entered incorrectly
176 + $invalid_message = FrmField::get_option( $this->field, 'invalid' );
177 + $errors[ 'field' . $args['id'] ] = ( $invalid_message == '' ? $frm_settings->re_msg : $invalid_message );
322 178 }
323 179
324 - // What happens when the CAPTCHA was entered incorrectly
325 - $invalid_message = FrmField::get_option( $this->field, 'invalid' );
326 -
327 - if ( $invalid_message === __( 'The reCAPTCHA was not entered correctly', 'formidable' ) ) {
328 - $invalid_message = '';
329 - }
330 -
331 - $errors[ 'field' . $args['id'] ] = $invalid_message === '' ? $frm_settings->re_msg : $invalid_message;
332 -
333 180 return $errors;
334 181 }
335 182
336 183 /**
337 184 * @param float $score
338 - *
339 185 * @return void
340 186 */
341 187 private function set_score( $score ) {
342 188 global $frm_vars;
343 -
344 189 if ( ! isset( $frm_vars['captcha_scores'] ) ) {
345 190 $frm_vars['captcha_scores'] = array();
346 191 }
347 -
348 192 $form_id = is_object( $this->field ) ? $this->field->form_id : $this->field['form_id'];
349 -
350 193 if ( ! isset( $frm_vars['captcha_scores'][ $form_id ] ) ) {
351 194 $frm_vars['captcha_scores'][ $form_id ] = $score;
352 195 }
353 196 }
@@ -353,9 +196,8 @@
353 196 }
354 197
355 198 /**
356 199 * @param array $args
357 - *
358 200 * @return array
359 201 */
360 202 public function validate( $args ) {
361 203 if ( ! $this->should_validate() ) {
@@ -361,11 +203,11 @@
361 203 if ( ! $this->should_validate() ) {
362 204 return array();
363 205 }
364 206
365 - $missing_token = ! self::post_data_includes_token();
366 -
367 - if ( $missing_token ) {
207 + // phpcs:ignore WordPress.Security.NonceVerification.Missing
208 + if ( ! isset( $_POST['g-recaptcha-response'] ) ) {
209 + // There was no captcha submitted.
368 210 return array( 'field' . $args['id'] => __( 'The captcha is missing from this form', 'formidable' ) );
369 211 }
370 212
371 213 return $this->validate_against_api( $args );
@@ -371,77 +213,34 @@
371 213 return $this->validate_against_api( $args );
372 214 }
373 215
374 216 /**
375 - * @since 6.8.4
376 - *
377 - * @return bool
378 - */
379 - protected static function post_data_includes_token() {
380 - $settings = FrmCaptchaFactory::get_settings_object();
381 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
382 - return ! empty( $_POST[ $settings->token_field ] );
383 - }
384 -
385 - /**
386 - * Check if the active captcha type's public key is set.
387 - *
388 217 * @since 4.07
389 - *
390 218 * @return bool
391 219 */
392 - public static function should_show_captcha() {
393 - $settings = FrmCaptchaFactory::get_settings_object();
394 - return $settings->has_pubkey();
220 + private function should_show_captcha() {
221 + $frm_settings = FrmAppHelper::get_settings();
222 + return ! empty( $frm_settings->pubkey );
395 223 }
396 224
397 - /**
398 - * @return bool
399 - */
400 225 protected function should_validate() {
401 226 $is_hidden_field = apply_filters( 'frm_is_field_hidden', false, $this->field, wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
402 -
403 227 if ( FrmAppHelper::is_admin() || $is_hidden_field ) {
404 228 return false;
405 229 }
406 230
407 - // Don't require the captcha if it shouldn't be shown
408 - return self::should_show_captcha();
231 + // don't require the captcha if it shouldn't be shown
232 + return $this->should_show_captcha();
409 233 }
410 234
411 - /**
412 - * @return array|WP_Error
413 - */
414 - protected function send_api_check() {
415 - $captcha_settings = FrmCaptchaFactory::get_settings_object();
416 - $arg_array = array(
235 + protected function send_api_check( $frm_settings ) {
236 + $arg_array = array(
417 237 'body' => array(
418 - 'secret' => $captcha_settings->secret,
419 - 'response' => FrmAppHelper::get_param( $captcha_settings->token_field, '', 'post', 'sanitize_text_field' ),
238 + 'secret' => $frm_settings->privkey,
239 + 'response' => FrmAppHelper::get_param( 'g-recaptcha-response', '', 'post', 'sanitize_text_field' ),
420 240 'remoteip' => FrmAppHelper::get_ip_address(),
421 241 ),
422 242 );
423 243
424 - return wp_remote_post( $captcha_settings->endpoint, $arg_array );
425 - }
426 -
427 - /**
428 - * Updates field name in page builder to the currently activated captcha if it is set to the default.
429 - *
430 - * @since 6.0
431 - *
432 - * @param array $values
433 - *
434 - * @return array Values.
435 - */
436 - public static function update_field_name( $values ) {
437 - if ( $values['type'] === 'captcha' ) {
438 - $name = $values['name'];
439 -
440 - if ( in_array( $name, array( __( 'reCAPTCHA', 'formidable' ), __( 'hCaptcha', 'formidable' ) ), true ) ) {
441 - $values['name'] = __( 'Captcha', 'formidable' );
442 - }
443 - }
444 -
445 - return $values;
244 + return wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', $arg_array );
446 245 }
447 246 }