← All changes | classes/models/FrmEntryValidate.php +57 -56 6.5 → 6.13 View file →

		@@ -6,9 +6,9 @@
6	6	class FrmEntryValidate {
7	7
8	8	/**
9	9	* @param array $values
10		- * @param string[]|bool $exclude
	10	+ * @param bool|string[] $exclude
11	11	* @return array
12	12	*/
13	13	public static function validate( $values, $exclude = false ) {
14	14	FrmEntry::sanitize_entry_post( $values );
		@@ -24,8 +24,9 @@
24	24	$frm_settings = FrmAppHelper::get_settings();
25	25	$errors['form'] = $frm_settings->admin_permission;
26	26	}
27	27
	28	+ self::maybe_fix_item_meta();
28	29	self::set_item_key( $values );
29	30
30	31	$posted_fields = self::get_fields_to_validate( $values, $exclude );
31	32
		@@ -60,8 +61,23 @@
60	61
61	62	return $errors;
62	63	}
63	64
	65	+ /**
	66	+ * In case $_POST['item_meta'] is not an array, change it to an empty array.
	67	+ * This helps to avoid some warnings and errors when $_POST['item_meta'] is updated.
	68	+ *
	69	+ * @since 6.6
	70	+ *
	71	+ * @return void
	72	+ */
	73	+ private static function maybe_fix_item_meta() {
	74	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
	75	+ if ( ! isset( $_POST['item_meta'] ) || ! is_array( $_POST['item_meta'] ) ) {
	76	+ $_POST['item_meta'] = array();
	77	+ }
	78	+ }
	79	+
64	80	private static function set_item_key( &$values ) {
65	81	if ( ! isset( $values['item_key'] ) || $values['item_key'] == '' ) {
66	82	global $wpdb;
67	83	$values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
		@@ -95,13 +111,17 @@
95	111
96	112	public static function validate_field( $posted_field, &$errors, $values, $args = array() ) {
97	113	$defaults = array(
98	114	'id' => $posted_field->id,
99		- 'parent_field_id' => '', // the id of the repeat or embed form
100		- 'key_pointer' => '', // the pointer in the posted array
101		- 'exclude' => array(), // exclude these field types from validation
	115	+ // The id of the repeat or embed form.
	116	+ 'parent_field_id' => '',
	117	+ // The pointer in the posted array.
	118	+ 'key_pointer' => '',
	119	+ // Exclude these field types from validation.
	120	+ 'exclude' => array(),
	121	+
102	122	);
103		- $args = wp_parse_args( $args, $defaults );
	123	+ $args = wp_parse_args( $args, $defaults );
104	124
105	125	if ( empty( $args['parent_field_id'] ) ) {
106	126	$value = isset( $values['item_meta'][ $args['id'] ] ) ? $values['item_meta'][ $args['id'] ] : '';
107	127	} else {
		@@ -142,8 +162,12 @@
142	162	}
143	163
144	164	$errors = apply_filters( 'frm_validate_' . $posted_field->type . '_field_entry', $errors, $posted_field, $value, $args );
145	165	$errors = apply_filters( 'frm_validate_field_entry', $errors, $posted_field, $value, $args );
	166	+
	167	+ if ( ! FrmAppHelper::pro_is_installed() && empty( $args['other'] ) ) {
	168	+ FrmEntriesHelper::get_posted_value( $posted_field, $value, $args );
	169	+ }
146	170	}
147	171
148	172	/**
149	173	* Maybe add item_name to $_POST to save it in items table.
		@@ -149,9 +173,10 @@
149	173	* Maybe add item_name to $_POST to save it in items table.
150	174	*
151	175	* @since 5.2.02
152	176	*
153		- * @param object $field Field object.
	177	+ * @param array|string $value Field value.
	178	+ * @param object $field Field object.
154	179	*/
155	180	private static function maybe_add_item_name( $value, $field ) {
156	181	$item_name = false;
157	182	if ( 'name' === $field->type ) {
		@@ -195,9 +220,9 @@
195	220	}
196	221	}
197	222
198	223	public static function validate_phone_field( &$errors, $field, $value, $args ) {
199		- if ( $field->type == 'phone' || ( $field->type == 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
	224	+ if ( $field->type === 'phone' || ( $field->type === 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
200	225
201	226	$pattern = self::phone_format( $field );
202	227
203	228	if ( ! preg_match( $pattern, $value ) ) {
		@@ -212,8 +237,11 @@
212	237	} else {
213	238	$pattern = FrmField::get_option( $field, 'format' );
214	239	}
215	240
	241	+ // Ampersands are saved as &.
	242	+ // Reverse it here so we are checking for the correct character.
	243	+ $pattern = html_entity_decode( $pattern );
216	244	$pattern = apply_filters( 'frm_phone_pattern', $pattern, $field );
217	245
218	246	// Create a regexp if format is not already a regexp
219	247	if ( strpos( $pattern, '^' ) !== 0 ) {
		@@ -272,14 +300,14 @@
272	300
273	301	/**
274	302	* Check for spam
275	303	*
276		- * @param boolean $exclude
	304	+ * @param bool $exclude
277	305	* @param array $values
278		- * @param array $errors by reference
	306	+ * @param array $errors By reference.
279	307	*/
280	308	public static function spam_check( $exclude, $values, &$errors ) {
281		- if ( ! empty( $exclude ) || ! isset( $values['item_meta'] ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
	309	+ if ( ! empty( $exclude ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
282	310	// only check spam if there are no other errors
283	311	return;
284	312	}
285	313
		@@ -326,9 +354,9 @@
326	354	}
327	355
328	356	/**
329	357	* @param array $values
330		- * @return boolean
	358	+ * @return bool
331	359	*/
332	360	private static function is_honeypot_spam( $values ) {
333	361	$honeypot = new FrmHoneypot( $values['form_id'] );
334	362	return ! $honeypot->validate();
		@@ -334,9 +362,9 @@
334	362	return ! $honeypot->validate();
335	363	}
336	364
337	365	/**
338		- * @return boolean
	366	+ * @return bool
339	367	*/
340	368	private static function is_spam_bot() {
341	369	$ip = FrmAppHelper::get_ip_address();
342	370
		@@ -344,9 +372,9 @@
344	372	}
345	373
346	374	/**
347	375	* @param array $values
348		- * @return boolean
	376	+ * @return bool
349	377	*/
350	378	private static function is_akismet_spam( $values ) {
351	379	global $wpcom_api_key;
352	380
		@@ -390,11 +418,11 @@
390	418	*/
391	419	private static function check_disallowed_words( $author, $email, $url, $content, $ip, $user_agent ) {
392	420	if ( function_exists( 'wp_check_comment_disallowed_list' ) ) {
393	421	return wp_check_comment_disallowed_list( $author, $email, $url, $content, $ip, $user_agent );
394		- } else {
395		- return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
396	422	}
	423	+ // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_blacklist_checkFound
	424	+ return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
397	425	}
398	426
399	427	/**
400	428	* For WP 5.5 compatibility.
		@@ -404,8 +432,9 @@
404	432	private static function get_disallowed_words() {
405	433	$keys = get_option( 'disallowed_keys' );
406	434	if ( false === $keys ) {
407	435	// Fallback for WP < 5.5.
	436	+ // phpcs:ignore WordPress.WP.DeprecatedParameterValues.Found
408	437	$keys = get_option( 'blacklist_keys' );
409	438	}
410	439	return $keys;
411	440	}
		@@ -412,9 +441,9 @@
412	441
413	442	/**
414	443	* Check entries for Akismet spam
415	444	*
416		- * @return boolean true if is spam
	445	+ * @return bool true if is spam
417	446	*/
418	447	public static function akismet( $values ) {
419	448	if ( empty( $values['item_meta'] ) ) {
420	449	return false;
		@@ -436,9 +465,9 @@
436	465
437	466	$query_string = _http_build_query( $datas, '', '&' );
438	467	$response = Akismet::http_post( $query_string, 'comment-check' );
439	468
440		- return ( is_array( $response ) && $response[1] == 'true' );
	469	+ return ( is_array( $response ) && $response[1] === 'true' );
441	470	}
442	471
443	472	/**
444	473	* @since 2.0
		@@ -541,9 +570,10 @@
541	570	*/
542	571	private static function recursive_add_akismet_guest_info( &$datas, $values, $custom_index = null ) {
543	572	foreach ( $values as $index => $value ) {
544	573	if ( ! $datas['missing_keys'] ) {
545		- return; // Found all info.
	574	+ // Found all info.
	575	+ return;
546	576	}
547	577
548	578	if ( is_array( $value ) ) {
549	579	self::recursive_add_akismet_guest_info( $datas, $value, $index );
		@@ -558,9 +588,9 @@
558	588	$datas['frm_duplicated'][] = $field_id;
559	589	unset( $datas['missing_keys'][ $key_index ] );
560	590	}
561	591	}
562		- }
	592	+ }//end foreach
563	593	}
564	594
565	595	/**
566	596	* Checks if given value is an akismet guest info.
		@@ -665,14 +695,16 @@
665	695	* @param array $values Entry values.
666	696	* @return bool
667	697	*/
668	698	private static function should_really_skip_field( $field_data, $values ) {
669		- if ( empty( $field_data->options ) ) { // This is skipped field types.
	699	+ if ( empty( $field_data->options ) ) {
	700	+ // This is skipped field types.
670	701	return true;
671	702	}
672	703
673	704	FrmAppHelper::unserialize_or_decode( $field_data->options );
674		- if ( ! $field_data->options ) { // Check if an error happens when unserializing, or empty options.
	705	+ if ( ! $field_data->options ) {
	706	+ // Check if an error happens when unserializing, or empty options.
675	707	return true;
676	708	}
677	709
678	710	end( $field_data->options );
		@@ -754,9 +786,10 @@
754	786
755	787	// Blacklist check for File field in the old version doesn't contain `form_id`.
756	788	$form_ids = isset( $values['form_id'] ) ? array( absint( $values['form_id'] ) ) : array();
757	789	foreach ( $values['item_meta'] as $field_id => $value ) {
758		- if ( ! is_numeric( $field_id ) ) { // Maybe `other`.
	790	+ if ( ! is_numeric( $field_id ) ) {
	791	+ // Maybe `other`.
759	792	continue;
760	793	}
761	794
762	795	// Convert name array to string.
		@@ -794,44 +827,12 @@
794	827	}
795	828
796	829	$values['item_meta'][ $subsubindex ][] = $subsubvalue;
797	830	}
798		- }
	831	+ }//end foreach
799	832
800	833	unset( $values['item_meta'][ $field_id ] );
801		- }
	834	+ }//end foreach
802	835
803	836	return $form_ids;
804		- }
805		-
806		- /**
807		- * @deprecated 3.0
808		- * @codeCoverageIgnore
809		- */
810		- public static function validate_url_field( &$errors, $field, $value, $args ) {
811		- FrmDeprecated::validate_url_field( $errors, $field, $value, $args );
812		- }
813		-
814		- /**
815		- * @deprecated 3.0
816		- * @codeCoverageIgnore
817		- */
818		- public static function validate_email_field( &$errors, $field, $value, $args ) {
819		- FrmDeprecated::validate_email_field( $errors, $field, $value, $args );
820		- }
821		-
822		- /**
823		- * @deprecated 3.0
824		- * @codeCoverageIgnore
825		- */
826		- public static function validate_number_field( &$errors, $field, $value, $args ) {
827		- FrmDeprecated::validate_number_field( $errors, $field, $value, $args );
828		- }
829		-
830		- /**
831		- * @deprecated 3.0
832		- * @codeCoverageIgnore
833		- */
834		- public static function validate_recaptcha( &$errors, $field, $args ) {
835		- FrmDeprecated::validate_recaptcha( $errors, $field, $args );
836	837	}
837	838	}