← All changes | classes/models/FrmEntryValidate.php +118 -65 6.4 → 6.17 View file →

		@@ -5,10 +5,17 @@
5	5
6	6	class FrmEntryValidate {
7	7
8	8	/**
	9	+ * @since 6.17
	10	+ *
	11	+ * @var array|null
	12	+ */
	13	+ private static $name_text_fields;
	14	+
	15	+ /**
9	16	* @param array $values
10		- * @param string[]|bool $exclude
	17	+ * @param bool|string[] $exclude
11	18	* @return array
12	19	*/
13	20	public static function validate( $values, $exclude = false ) {
14	21	FrmEntry::sanitize_entry_post( $values );
		@@ -24,8 +31,9 @@
24	31	$frm_settings = FrmAppHelper::get_settings();
25	32	$errors['form'] = $frm_settings->admin_permission;
26	33	}
27	34
	35	+ self::maybe_fix_item_meta();
28	36	self::set_item_key( $values );
29	37
30	38	$posted_fields = self::get_fields_to_validate( $values, $exclude );
31	39
		@@ -54,14 +62,29 @@
54	62
55	63	if ( is_array( $filtered_errors ) ) {
56	64	$errors = $filtered_errors;
57	65	} else {
58		- _doing_it_wrong( __FUNCTION__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
	66	+ _doing_it_wrong( __METHOD__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
59	67	}
60	68
61	69	return $errors;
62	70	}
63	71
	72	+ /**
	73	+ * In case $_POST['item_meta'] is not an array, change it to an empty array.
	74	+ * This helps to avoid some warnings and errors when $_POST['item_meta'] is updated.
	75	+ *
	76	+ * @since 6.6
	77	+ *
	78	+ * @return void
	79	+ */
	80	+ private static function maybe_fix_item_meta() {
	81	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
	82	+ if ( ! isset( $_POST['item_meta'] ) || ! is_array( $_POST['item_meta'] ) ) {
	83	+ $_POST['item_meta'] = array();
	84	+ }
	85	+ }
	86	+
64	87	private static function set_item_key( &$values ) {
65	88	if ( ! isset( $values['item_key'] ) || $values['item_key'] == '' ) {
66	89	global $wpdb;
67	90	$values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
		@@ -95,13 +118,17 @@
95	118
96	119	public static function validate_field( $posted_field, &$errors, $values, $args = array() ) {
97	120	$defaults = array(
98	121	'id' => $posted_field->id,
99		- 'parent_field_id' => '', // the id of the repeat or embed form
100		- 'key_pointer' => '', // the pointer in the posted array
101		- 'exclude' => array(), // exclude these field types from validation
	122	+ // The id of the repeat or embed form.
	123	+ 'parent_field_id' => '',
	124	+ // The pointer in the posted array.
	125	+ 'key_pointer' => '',
	126	+ // Exclude these field types from validation.
	127	+ 'exclude' => array(),
	128	+
102	129	);
103		- $args = wp_parse_args( $args, $defaults );
	130	+ $args = wp_parse_args( $args, $defaults );
104	131
105	132	if ( empty( $args['parent_field_id'] ) ) {
106	133	$value = isset( $values['item_meta'][ $args['id'] ] ) ? $values['item_meta'][ $args['id'] ] : '';
107	134	} else {
		@@ -142,8 +169,12 @@
142	169	}
143	170
144	171	$errors = apply_filters( 'frm_validate_' . $posted_field->type . '_field_entry', $errors, $posted_field, $value, $args );
145	172	$errors = apply_filters( 'frm_validate_field_entry', $errors, $posted_field, $value, $args );
	173	+
	174	+ if ( ! FrmAppHelper::pro_is_installed() && empty( $args['other'] ) ) {
	175	+ FrmEntriesHelper::get_posted_value( $posted_field, $value, $args );
	176	+ }
146	177	}
147	178
148	179	/**
149	180	* Maybe add item_name to $_POST to save it in items table.
		@@ -149,9 +180,10 @@
149	180	* Maybe add item_name to $_POST to save it in items table.
150	181	*
151	182	* @since 5.2.02
152	183	*
153		- * @param object $field Field object.
	184	+ * @param array|string $value Field value.
	185	+ * @param object $field Field object.
154	186	*/
155	187	private static function maybe_add_item_name( $value, $field ) {
156	188	$item_name = false;
157	189	if ( 'name' === $field->type ) {
		@@ -195,9 +227,9 @@
195	227	}
196	228	}
197	229
198	230	public static function validate_phone_field( &$errors, $field, $value, $args ) {
199		- if ( $field->type == 'phone' || ( $field->type == 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
	231	+ if ( $field->type === 'phone' || ( $field->type === 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
200	232
201	233	$pattern = self::phone_format( $field );
202	234
203	235	if ( ! preg_match( $pattern, $value ) ) {
		@@ -212,8 +244,11 @@
212	244	} else {
213	245	$pattern = FrmField::get_option( $field, 'format' );
214	246	}
215	247
	248	+ // Ampersands are saved as &.
	249	+ // Reverse it here so we are checking for the correct character.
	250	+ $pattern = html_entity_decode( $pattern );
216	251	$pattern = apply_filters( 'frm_phone_pattern', $pattern, $field );
217	252
218	253	// Create a regexp if format is not already a regexp
219	254	if ( strpos( $pattern, '^' ) !== 0 ) {
		@@ -272,14 +307,14 @@
272	307
273	308	/**
274	309	* Check for spam
275	310	*
276		- * @param boolean $exclude
	311	+ * @param bool $exclude
277	312	* @param array $values
278		- * @param array $errors by reference
	313	+ * @param array $errors By reference.
279	314	*/
280	315	public static function spam_check( $exclude, $values, &$errors ) {
281		- if ( ! empty( $exclude ) || ! isset( $values['item_meta'] ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
	316	+ if ( ! empty( $exclude ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
282	317	// only check spam if there are no other errors
283	318	return;
284	319	}
285	320
		@@ -326,9 +361,9 @@
326	361	}
327	362
328	363	/**
329	364	* @param array $values
330		- * @return boolean
	365	+ * @return bool
331	366	*/
332	367	private static function is_honeypot_spam( $values ) {
333	368	$honeypot = new FrmHoneypot( $values['form_id'] );
334	369	return ! $honeypot->validate();
		@@ -334,9 +369,9 @@
334	369	return ! $honeypot->validate();
335	370	}
336	371
337	372	/**
338		- * @return boolean
	373	+ * @return bool
339	374	*/
340	375	private static function is_spam_bot() {
341	376	$ip = FrmAppHelper::get_ip_address();
342	377
		@@ -344,9 +379,9 @@
344	379	}
345	380
346	381	/**
347	382	* @param array $values
348		- * @return boolean
	383	+ * @return bool
349	384	*/
350	385	private static function is_akismet_spam( $values ) {
351	386	global $wpcom_api_key;
352	387
		@@ -390,11 +425,11 @@
390	425	*/
391	426	private static function check_disallowed_words( $author, $email, $url, $content, $ip, $user_agent ) {
392	427	if ( function_exists( 'wp_check_comment_disallowed_list' ) ) {
393	428	return wp_check_comment_disallowed_list( $author, $email, $url, $content, $ip, $user_agent );
394		- } else {
395		- return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
396	429	}
	430	+ // phpcs:ignore WordPress.WP.DeprecatedFunctions.wp_blacklist_checkFound
	431	+ return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
397	432	}
398	433
399	434	/**
400	435	* For WP 5.5 compatibility.
		@@ -404,8 +439,9 @@
404	439	private static function get_disallowed_words() {
405	440	$keys = get_option( 'disallowed_keys' );
406	441	if ( false === $keys ) {
407	442	// Fallback for WP < 5.5.
	443	+ // phpcs:ignore WordPress.WP.DeprecatedParameterValues.Found
408	444	$keys = get_option( 'blacklist_keys' );
409	445	}
410	446	return $keys;
411	447	}
		@@ -412,9 +448,9 @@
412	448
413	449	/**
414	450	* Check entries for Akismet spam
415	451	*
416		- * @return boolean true if is spam
	452	+ * @return bool true if is spam
417	453	*/
418	454	public static function akismet( $values ) {
419	455	if ( empty( $values['item_meta'] ) ) {
420	456	return false;
		@@ -436,9 +472,9 @@
436	472
437	473	$query_string = _http_build_query( $datas, '', '&' );
438	474	$response = Akismet::http_post( $query_string, 'comment-check' );
439	475
440		- return ( is_array( $response ) && $response[1] == 'true' );
	476	+ return ( is_array( $response ) && $response[1] === 'true' );
441	477	}
442	478
443	479	/**
444	480	* @since 2.0
		@@ -447,8 +483,9 @@
447	483	self::add_site_info_to_akismet( $datas );
448	484	self::add_server_values_to_akismet( $datas );
449	485
450	486	self::prepare_values_for_spam_check( $values );
	487	+ self::skip_adding_values_to_akismet( $values );
451	488
452	489	self::add_user_info_to_akismet( $datas, $values );
453	490	self::add_comment_content_to_akismet( $datas, $values );
454	491	}
		@@ -541,9 +578,10 @@
541	578	*/
542	579	private static function recursive_add_akismet_guest_info( &$datas, $values, $custom_index = null ) {
543	580	foreach ( $values as $index => $value ) {
544	581	if ( ! $datas['missing_keys'] ) {
545		- return; // Found all info.
	582	+ // Found all info.
	583	+ return;
546	584	}
547	585
548	586	if ( is_array( $value ) ) {
549	587	self::recursive_add_akismet_guest_info( $datas, $value, $index );
		@@ -551,9 +589,9 @@
551	589	}
552	590
553	591	$field_id = ! is_null( $custom_index ) ? $custom_index : $index;
554	592	foreach ( $datas['missing_keys'] as $key_index => $key ) {
555		- $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'] );
	593	+ $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'], $values );
556	594	if ( $found ) {
557	595	$datas[ $key ] = $value;
558	596	$datas['frm_duplicated'][] = $field_id;
559	597	unset( $datas['missing_keys'][ $key_index ] );
		@@ -558,9 +596,9 @@
558	596	$datas['frm_duplicated'][] = $field_id;
559	597	unset( $datas['missing_keys'][ $key_index ] );
560	598	}
561	599	}
562		- }
	600	+ }//end foreach
563	601	}
564	602
565	603	/**
566	604	* Checks if given value is an akismet guest info.
		@@ -570,11 +608,13 @@
570	608	* @param string $key Guest info key.
571	609	* @param string $value Value to check.
572	610	* @param int $field_id Field ID.
573	611	* @param array $name_field_ids Name field IDs.
	612	+ * @param array $values Array of posted values.
	613	+ *
574	614	* @return bool
575	615	*/
576		- private static function is_akismet_guest_info_value( $key, $value, $field_id, $name_field_ids ) {
	616	+ private static function is_akismet_guest_info_value( $key, &$value, $field_id, $name_field_ids, $values ) {
577	617	if ( ! $value || is_numeric( $value ) ) {
578	618	return false;
579	619	}
580	620
		@@ -585,16 +625,60 @@
585	625	case 'comment_author_url':
586	626	return 0 === strpos( $value, 'http' );
587	627
588	628	case 'comment_author':
589		- if ( $name_field_ids ) {
	629	+ if ( $name_field_ids && in_array( $field_id, $name_field_ids, true ) ) {
590	630	// If there is name field in the form, we should always use it as author name.
591		- return in_array( $field_id, $name_field_ids, true );
	631	+ return true;
592	632	}
593		- return strlen( $value ) < 200;
	633	+ $form_id = FrmAppHelper::get_post_param( 'form_id', 0, 'absint' );
	634	+ $fields = self::get_name_text_fields( $form_id );
	635	+
	636	+ foreach ( $fields as $index => $field ) {
	637	+ if ( 'Name' !== $field->name ) {
	638	+ continue;
	639	+ }
	640	+ if ( isset( $fields[ $index + 1 ] ) && 'Last' === $fields[ $index + 1 ]->name ) {
	641	+ if ( empty( $values[ absint( $fields[ $index + 1 ]->id ) ] ) ) {
	642	+ continue;
	643	+ }
	644	+ $value .= ' ' . $values[ $fields[ $index + 1 ]->id ];
	645	+ return true;
	646	+ }
	647	+ }
	648	+ }//end switch
	649	+
	650	+ return false;
	651	+ }
	652	+
	653	+ /**
	654	+ * Returns fields that have 'Name' and 'Last' as their name.
	655	+ *
	656	+ * @since 6.17
	657	+ *
	658	+ * @param int $form_id
	659	+ * @return array
	660	+ */
	661	+ private static function get_name_text_fields( $form_id ) {
	662	+ $name_text_fields_is_initialized = is_array( self::$name_text_fields );
	663	+ if ( $name_text_fields_is_initialized && isset( self::$name_text_fields[ $form_id ] ) ) {
	664	+ return self::$name_text_fields[ $form_id ];
594	665	}
	666	+ if ( ! $name_text_fields_is_initialized ) {
	667	+ self::$name_text_fields = array();
	668	+ }
	669	+ self::$name_text_fields[ $form_id ] = FrmDb::get_results(
	670	+ 'frm_fields',
	671	+ array(
	672	+ 'form_id' => $form_id,
	673	+ 'type' => 'text',
	674	+ 'name' => array( 'Name', 'Last' ),
	675	+ ),
	676	+ 'id,name',
	677	+ array( 'order_by' => 'field_order ASC' )
	678	+ );
595	679
596		- return false;
	680	+ return self::$name_text_fields[ $form_id ];
597	681	}
598	682
599	683	private static function add_server_values_to_akismet( &$datas ) {
600	684	foreach ( $_SERVER as $key => $value ) {
		@@ -627,10 +711,8 @@
627	711	}
628	712	unset( $datas['frm_duplicated'] );
629	713	}
630	714
631		- self::skip_adding_values_to_akismet( $values );
632		-
633	715	$datas['comment_content'] = FrmEntriesHelper::entry_array_to_string( $values );
634	716	}
635	717
636	718	/**
		@@ -665,14 +747,16 @@
665	747	* @param array $values Entry values.
666	748	* @return bool
667	749	*/
668	750	private static function should_really_skip_field( $field_data, $values ) {
669		- if ( empty( $field_data->options ) ) { // This is skipped field types.
	751	+ if ( empty( $field_data->options ) ) {
	752	+ // This is skipped field types.
670	753	return true;
671	754	}
672	755
673	756	FrmAppHelper::unserialize_or_decode( $field_data->options );
674		- if ( ! $field_data->options ) { // Check if an error happens when unserializing, or empty options.
	757	+ if ( ! $field_data->options ) {
	758	+ // Check if an error happens when unserializing, or empty options.
675	759	return true;
676	760	}
677	761
678	762	end( $field_data->options );
		@@ -754,9 +838,10 @@
754	838
755	839	// Blacklist check for File field in the old version doesn't contain `form_id`.
756	840	$form_ids = isset( $values['form_id'] ) ? array( absint( $values['form_id'] ) ) : array();
757	841	foreach ( $values['item_meta'] as $field_id => $value ) {
758		- if ( ! is_numeric( $field_id ) ) { // Maybe `other`.
	842	+ if ( ! is_numeric( $field_id ) ) {
	843	+ // Maybe `other`.
759	844	continue;
760	845	}
761	846
762	847	// Convert name array to string.
		@@ -794,44 +879,12 @@
794	879	}
795	880
796	881	$values['item_meta'][ $subsubindex ][] = $subsubvalue;
797	882	}
798		- }
	883	+ }//end foreach
799	884
800	885	unset( $values['item_meta'][ $field_id ] );
801		- }
	886	+ }//end foreach
802	887
803	888	return $form_ids;
804		- }
805		-
806		- /**
807		- * @deprecated 3.0
808		- * @codeCoverageIgnore
809		- */
810		- public static function validate_url_field( &$errors, $field, $value, $args ) {
811		- FrmDeprecated::validate_url_field( $errors, $field, $value, $args );
812		- }
813		-
814		- /**
815		- * @deprecated 3.0
816		- * @codeCoverageIgnore
817		- */
818		- public static function validate_email_field( &$errors, $field, $value, $args ) {
819		- FrmDeprecated::validate_email_field( $errors, $field, $value, $args );
820		- }
821		-
822		- /**
823		- * @deprecated 3.0
824		- * @codeCoverageIgnore
825		- */
826		- public static function validate_number_field( &$errors, $field, $value, $args ) {
827		- FrmDeprecated::validate_number_field( $errors, $field, $value, $args );
828		- }
829		-
830		- /**
831		- * @deprecated 3.0
832		- * @codeCoverageIgnore
833		- */
834		- public static function validate_recaptcha( &$errors, $field, $args ) {
835		- FrmDeprecated::validate_recaptcha( $errors, $field, $args );
836	889	}
837	890	}