formidable / classes / models / FrmAntiSpam.php

FrmAntiSpam.php in Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 5.5.6, at classes/models/FrmAntiSpam.php

327 lines 8.9 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	die( 'You are not allowed to call this page directly.' );
4	}
5
6	/**
7	* Class FrmAntiSpam.
8	*
9	* This token class generates tokens that are used in our Anti-Spam checking.
10	*
11	* @since 4.11
12	*/
13	class FrmAntiSpam extends FrmValidate {
14
15	/**
16	* @return string
17	*/
18	protected function get_option_key() {
19	return 'antispam';
20	}
21
22	/**
23	* @param int $form_id
24	*/
25	public static function maybe_init( $form_id ) {
26	$antispam = new self( $form_id );
27	if ( $antispam->run_antispam() ) {
28	$antispam->init();
29	}
30	}
31
32	/**
33	* Initialise the actions for the Anti-spam.
34	*
35	* @since 4.11
36	*/
37	public function init() {
38	add_filter( 'frm_form_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
39	add_filter( 'frm_form_div_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
40	}
41
42	/**
43	* Return a valid token.
44	*
45	* @since 4.11
46	*
47	* @param mixed $current True to use current time, otherwise a timestamp string.
48	*
49	* @return string Token.
50	*/
51	private function get( $current = true ) {
52	// If $current was not passed, or it is true, we use the current timestamp.
53	// If $current was passed in as a string, we'll use that passed in timestamp.
54	if ( $current !== true ) {
55	$time = $current;
56	} else {
57	$time = time();
58	}
59
60	// Format the timestamp to be less exact, as we want to deal in days.
61	// June 19th, 2020 would get formatted as: 1906202017125.
62	// Day of the month, month number, year, day number of the year, week number of the year.
63	$token_date = gmdate( 'dmYzW', $time );
64
65	// Combine our token date and our token salt, and md5 it.
66	$form_token_string = md5( $token_date . $this->get_antispam_secret_key() );
67
68	return $form_token_string;
69	}
70
71	private function get_antispam_secret_key() {
72	$secret_key = get_option( 'frm_antispam_secret_key' );
73
74	// If we already have the secret, send it back.
75	if ( false !== $secret_key ) {
76	return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
77	}
78
79	// We don't have a secret, so let's generate one.
80	$secret_key = is_callable( 'sodium_crypto_secretbox_keygen' ) ? sodium_crypto_secretbox_keygen() : wp_generate_password( 32, true, true );
81	add_option( 'frm_antispam_secret_key', base64_encode( $secret_key ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
82
83	return $secret_key;
84	}
85
86	/**
87	* Generate the array of valid tokens to check for. These include two days
88	* before the current date to account for long cache times.
89	*
90	* These two filters are available if a user wants to extend the times.
91	* 'frm_form_token_check_before_today'
92	* 'frm_form_token_check_after_today'
93	*
94	* @since 4.11
95	*
96	* @return array Array of all valid tokens to check against.
97	*/
98	private function get_valid_tokens() {
99	$current_date = time();
100
101	// Create our array of times to check before today. A user with a longer
102	// cache time can extend this. A user with a shorter cache time can remove times.
103	$valid_token_times_before = apply_filters(
104	'frm_form_token_check_before_today',
105	array(
106	( 2 * DAY_IN_SECONDS ), // Two days ago.
107	( 1 * DAY_IN_SECONDS ), // One day ago.
108	)
109	);
110
111	// Mostly to catch edge cases like the form page loading and submitting on two different days.
112	// This probably won't be filtered by users too much, but they could extend it.
113	$valid_token_times_after = apply_filters(
114	'frm_form_token_check_after_today',
115	array(
116	( 45 * MINUTE_IN_SECONDS ), // Add in 45 minutes past today to catch some midnight edge cases.
117	)
118	);
119
120	// Built up our valid tokens.
121	$valid_tokens = array();
122
123	// Add in all the previous times we check.
124	foreach ( $valid_token_times_before as $time ) {
125	$valid_tokens[] = $this->get( $current_date - $time );
126	}
127
128	// Add in our current date.
129	$valid_tokens[] = $this->get( $current_date );
130
131	// Add in the times after our check.
132	foreach ( $valid_token_times_after as $time ) {
133	$valid_tokens[] = $this->get( $current_date + $time );
134	}
135
136	return $valid_tokens;
137	}
138
139	/**
140	* Check if the given token is valid or not.
141	*
142	* Tokens are valid for some period of time (see frm_token_validity_in_hours
143	* and frm_token_validity_in_days to extend the validation period).
144	* By default tokens are valid for day.
145	*
146	* @since 4.11
147	*
148	* @param string $token Token to validate.
149	*
150	* @return bool Whether the token is valid or not.
151	*/
152	private function verify( $token ) {
153	// Check to see if our token is inside of the valid tokens.
154	return in_array( $token, $this->get_valid_tokens(), true );
155	}
156
157	/**
158	* Add the token field to the form.
159	*
160	* @since 4.11
161	*
162	* @param string $attributes
163	*
164	* @return string
165	*/
166	public function add_token_to_form( $attributes ) {
167	$attributes .= ' data-token="' . esc_attr( $this->get() ) . '"';
168	return $attributes;
169	}
170
171	/**
172	* @param int $form_id
173	*/
174	public static function maybe_echo_token( $form_id ) {
175	$antispam = new self( $form_id );
176	if ( $antispam->run_antispam() ) {
177	echo 'data-token="' . esc_attr( $antispam->get() ) . '"';
178	}
179	}
180
181	/**
182	* @return bool
183	*/
184	public function run_antispam() {
185	return $this->is_option_on() && apply_filters( 'frm_run_antispam', true, $this->form_id );
186	}
187
188	/**
189	* Validate Anti-spam if enabled.
190	*
191	* @since 4.11
192	*
193	* @return bool\|string True or a string with the error.
194	*/
195	public function validate() {
196	if ( ! $this->run_antispam() ) {
197	return true;
198	}
199
200	$token = FrmAppHelper::get_param( 'antispam_token', '', 'post', 'sanitize_text_field' );
201
202	// If the antispam setting is enabled and we don't have a token, bail.
203	if ( ! $token ) {
204	if ( FrmAppHelper::is_admin_page( 'formidable-entries' ) ) {
205	// add an exception for the entries page.
206	return true;
207	}
208	return $this->process_antispam_filter( $this->get_missing_token_message() );
209	}
210
211	// Verify the token.
212	if ( ! $this->verify( $token ) ) {
213	return $this->process_antispam_filter( $this->get_invalid_token_message() );
214	}
215
216	return $this->process_antispam_filter( true );
217	}
218
219	/**
220	* @return bool True if saving a draft.
221	*/
222	private function is_saving_a_draft() {
223	global $frm_vars;
224	if ( empty( $frm_vars['form_params'] ) ) {
225	return false;
226	}
227	$form_params = $frm_vars['form_params'];
228	if ( ! isset( $form_params[ $this->form_id ] ) ) {
229	return false;
230	}
231	$this_form_params = $form_params[ $this->form_id ];
232	return ! empty( $this_form_params['action'] ) && 'update' === $this_form_params['action'];
233	}
234
235	/**
236	* Helper to run our filter on all the responses for the antispam checks.
237	*
238	* @since 4.11
239	*
240	* @param bool\|string $is_valid Is valid entry or not.
241	*
242	* @return bool\|string Is valid or message.
243	*/
244	private function process_antispam_filter( $is_valid ) {
245	return apply_filters( 'frm_process_antispam', $is_valid );
246	}
247
248	/**
249	* Helper to get the missing token message.
250	*
251	* @since 4.11
252	*
253	* @return string missing token message.
254	*/
255	private function get_missing_token_message() {
256	return esc_html__( 'This page isn\'t loading JavaScript properly, and the form will not be able to submit.', 'formidable' ) . $this->maybe_get_support_text();
257	}
258
259	/**
260	* Helper to get the invalid token message.
261	*
262	* @since 4.11
263	*
264	* @return string Invalid token message.
265	*/
266	private function get_invalid_token_message() {
267	return esc_html__( 'Form token is invalid. Please refresh the page.', 'formidable' ) . $this->maybe_get_support_text();
268	}
269
270	/**
271	* If a user is a super admin, add a support link to the message.
272	*
273	* @since 4.11
274	*
275	* @return string Support text if super admin, empty string if not.
276	*/
277	private function maybe_get_support_text() {
278	// If user isn't a super admin, don't return any text.
279	if ( ! is_super_admin() ) {
280	return '';
281	}
282
283	// If the user is an admin, return text with a link to support.
284	// We add a space here to seperate the sentences, but outside of the localized
285	// text to avoid it being removed.
286	return ' ' . sprintf(
287	// translators: %1$s start link, %2$s end link.
288	esc_html__( 'Please check out our %1$stroubleshooting guide%2$s for details on resolving this issue.', 'formidable' ),
289	'<a href="https://formidableforms.com/knowledgebase/add-spam-protection/">',
290	'</a>'
291	);
292	}
293
294	/**
295	* Clear third party cache plugins to avoid data-tokens missing or appearing when the antispam setting is changed.
296	*/
297	public static function clear_caches() {
298	self::clear_w3_total_cache();
299	self::clear_wp_fastest_cache();
300	self::clear_wp_super_cache();
301	self::clear_wp_optimize();
302	}
303
304	private static function clear_w3_total_cache() {
305	if ( is_callable( 'w3tc_flush_all' ) ) {
306	w3tc_flush_all();
307	}
308	}
309
310	private static function clear_wp_fastest_cache() {
311	do_action( 'wpfc_clear_all_cache' );
312	}
313
314	private static function clear_wp_super_cache() {
315	if ( function_exists( 'wp_cache_clean_cache' ) ) {
316	global $file_prefix;
317	wp_cache_clean_cache( $file_prefix, true );
318	}
319	}
320
321	private static function clear_wp_optimize() {
322	if ( class_exists( 'WP_Optimize' ) ) {
323	WP_Optimize()->get_page_cache()->purge();
324	}
325	}
326	}
327