formidable / classes / models / FrmAntiSpam.php

FrmAntiSpam.php in Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 6.26.1, at classes/models/FrmAntiSpam.php

339 lines 8.7 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	die( 'You are not allowed to call this page directly.' );
4	}
5
6	/**
7	* Class FrmAntiSpam.
8	*
9	* This token class generates tokens that are used in our Anti-Spam checking.
10	*
11	* @since 4.11
12	*/
13	class FrmAntiSpam extends FrmValidate {
14
15	/**
16	* @return string
17	*/
18	protected function get_option_key() {
19	return 'antispam';
20	}
21
22	/**
23	* @param int $form_id
24	*
25	* @return void
26	*/
27	public static function maybe_init( $form_id ) {
28	$antispam = new self( $form_id );
29
30	if ( $antispam->run_antispam() ) {
31	$antispam->init();
32	}
33	}
34
35	/**
36	* Initialise the actions for the Anti-spam.
37	*
38	* @since 4.11
39	*
40	* @return void
41	*/
42	public function init() {
43	add_filter( 'frm_form_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
44	add_filter( 'frm_form_div_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
45	}
46
47	/**
48	* Return a valid token.
49	*
50	* @since 4.11
51	*
52	* @param mixed $current True to use current time, otherwise a timestamp string.
53	*
54	* @return string Token.
55	*/
56	private function get( $current = true ) {
57	// If $current was not passed, or it is true, we use the current timestamp.
58	// If $current was passed in as a string, we'll use that passed in timestamp.
59	if ( $current !== true ) {
60	$time = $current;
61	} else {
62	$time = time();
63	}
64
65	// Format the timestamp to be less exact, as we want to deal in days.
66	// June 19th, 2020 would get formatted as: 1906202017125.
67	// Day of the month, month number, year, day number of the year, week number of the year.
68	$token_date = gmdate( 'dmYzW', $time );
69
70	// Combine our token date and our token salt, and md5 it.
71	$form_token_string = md5( $token_date . $this->get_antispam_secret_key() );
72
73	return $form_token_string;
74	}
75
76	/**
77	* @return string
78	*/
79	private function get_antispam_secret_key() {
80	$secret_key = get_option( 'frm_antispam_secret_key' );
81
82	// If we already have the secret, send it back.
83	if ( false !== $secret_key ) {
84	return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
85	}
86
87	// We don't have a secret, so let's generate one.
88	$secret_key = is_callable( 'sodium_crypto_secretbox_keygen' ) ? sodium_crypto_secretbox_keygen() : wp_generate_password( 32, true, true );
89	add_option( 'frm_antispam_secret_key', base64_encode( $secret_key ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
90
91	return $secret_key;
92	}
93
94	/**
95	* Generate the array of valid tokens to check for. These include two days
96	* before the current date to account for long cache times.
97	*
98	* These two filters are available if a user wants to extend the times.
99	* 'frm_form_token_check_before_today'
100	* 'frm_form_token_check_after_today'
101	*
102	* @since 4.11
103	*
104	* @return array Array of all valid tokens to check against.
105	*/
106	private function get_valid_tokens() {
107	$current_date = time();
108
109	// Create our array of times to check before today. A user with a longer
110	// cache time can extend this. A user with a shorter cache time can remove times.
111	$valid_token_times_before = apply_filters(
112	'frm_form_token_check_before_today',
113	array(
114	// Two days ago.
115	2 * DAY_IN_SECONDS,
116	// One day ago.
117	1 * DAY_IN_SECONDS,
118	)
119	);
120
121	// Mostly to catch edge cases like the form page loading and submitting on two different days.
122	// This probably won't be filtered by users too much, but they could extend it.
123	$valid_token_times_after = apply_filters(
124	'frm_form_token_check_after_today',
125	array(
126	// Add in 45 minutes past today to catch some midnight edge cases.
127	45 * MINUTE_IN_SECONDS,
128	)
129	);
130
131	// Built up our valid tokens.
132	$valid_tokens = array();
133
134	// Add in all the previous times we check.
135	foreach ( $valid_token_times_before as $time ) {
136	$valid_tokens[] = $this->get( $current_date - $time );
137	}
138
139	// Add in our current date.
140	$valid_tokens[] = $this->get( $current_date );
141
142	// Add in the times after our check.
143	foreach ( $valid_token_times_after as $time ) {
144	$valid_tokens[] = $this->get( $current_date + $time );
145	}
146
147	return $valid_tokens;
148	}
149
150	/**
151	* Check if the given token is valid or not.
152	*
153	* Tokens are valid for some period of time (see frm_token_validity_in_hours
154	* and frm_token_validity_in_days to extend the validation period).
155	* By default tokens are valid for day.
156	*
157	* @since 4.11
158	*
159	* @param string $token Token to validate.
160	*
161	* @return bool Whether the token is valid or not.
162	*/
163	private function verify( $token ) {
164	// Check to see if our token is inside of the valid tokens.
165	return in_array( $token, $this->get_valid_tokens(), true );
166	}
167
168	/**
169	* Add the token field to the form.
170	*
171	* @since 4.11
172	*
173	* @param string $attributes
174	*
175	* @return string
176	*/
177	public function add_token_to_form( $attributes ) {
178	$attributes .= ' data-token="' . esc_attr( $this->get() ) . '"';
179	return $attributes;
180	}
181
182	/**
183	* @param int $form_id
184	*
185	* @return void
186	*/
187	public static function maybe_echo_token( $form_id ) {
188	$antispam = new self( $form_id );
189
190	if ( $antispam->run_antispam() ) {
191	echo 'data-token="' . esc_attr( $antispam->get() ) . '"';
192	}
193	}
194
195	/**
196	* @return bool
197	*/
198	public function run_antispam() {
199	return $this->is_option_on() && apply_filters( 'frm_run_antispam', true, $this->form_id );
200	}
201
202	/**
203	* Validate Anti-spam if enabled.
204	*
205	* @since 4.11
206	*
207	* @return bool\|string True or a string with the error.
208	*/
209	public function validate() {
210	if ( ! $this->run_antispam() ) {
211	return true;
212	}
213
214	$token = FrmAppHelper::get_param( 'antispam_token', '', 'post', 'sanitize_text_field' );
215
216	// If the antispam setting is enabled and we don't have a token, bail.
217	if ( ! $token ) {
218	if ( FrmAppHelper::is_admin_page( 'formidable-entries' ) ) {
219	// add an exception for the entries page.
220	return true;
221	}
222	return $this->process_antispam_filter( $this->get_missing_token_message() );
223	}
224
225	// Verify the token.
226	if ( ! $this->verify( $token ) ) {
227	return $this->process_antispam_filter( $this->get_invalid_token_message() );
228	}
229
230	return $this->process_antispam_filter( true );
231	}
232
233	/**
234	* Helper to run our filter on all the responses for the antispam checks.
235	*
236	* @since 4.11
237	*
238	* @param bool\|string $is_valid Is valid entry or not.
239	*
240	* @return bool\|string Is valid or message.
241	*/
242	private function process_antispam_filter( $is_valid ) {
243	return apply_filters( 'frm_process_antispam', $is_valid );
244	}
245
246	/**
247	* Helper to get the missing token message.
248	*
249	* @since 4.11
250	*
251	* @return string missing token message.
252	*/
253	private function get_missing_token_message() {
254	return esc_html__( 'This page isn\'t loading JavaScript properly, and the form will not be able to submit.', 'formidable' ) . $this->maybe_get_support_text();
255	}
256
257	/**
258	* Helper to get the invalid token message.
259	*
260	* @since 4.11
261	*
262	* @return string Invalid token message.
263	*/
264	private function get_invalid_token_message() {
265	return esc_html__( 'Form token is invalid. Please refresh the page.', 'formidable' ) . $this->maybe_get_support_text();
266	}
267
268	/**
269	* If a user is a super admin, add a support link to the message.
270	*
271	* @since 4.11
272	*
273	* @return string Support text if super admin, empty string if not.
274	*/
275	private function maybe_get_support_text() {
276	// If user isn't a super admin, don't return any text.
277	if ( ! is_super_admin() ) {
278	return '';
279	}
280
281	// If the user is an admin, return text with a link to support.
282	// We add a space here to separate the sentences, but outside of the localized
283	// text to avoid it being removed.
284	return ' ' . sprintf(
285	// translators: %1$s start link, %2$s end link.
286	esc_html__( 'Please check out our %1$stroubleshooting guide%2$s for details on resolving this issue.', 'formidable' ),
287	'<a href="https://formidableforms.com/knowledgebase/add-spam-protection/">',
288	'</a>'
289	);
290	}
291
292	/**
293	* Clear third party cache plugins to avoid data-tokens missing or appearing when the antispam setting is changed.
294	*
295	* @return void
296	*/
297	public static function clear_caches() {
298	self::clear_w3_total_cache();
299	self::clear_wp_fastest_cache();
300	self::clear_wp_super_cache();
301	self::clear_wp_optimize();
302	}
303
304	/**
305	* @return void
306	*/
307	private static function clear_w3_total_cache() {
308	if ( is_callable( 'w3tc_flush_all' ) ) {
309	w3tc_flush_all();
310	}
311	}
312
313	/**
314	* @return void
315	*/
316	private static function clear_wp_fastest_cache() {
317	do_action( 'wpfc_clear_all_cache' );
318	}
319
320	/**
321	* @return void
322	*/
323	private static function clear_wp_super_cache() {
324	if ( function_exists( 'wp_cache_clean_cache' ) ) {
325	global $file_prefix;
326	wp_cache_clean_cache( $file_prefix, true );
327	}
328	}
329
330	/**
331	* @return void
332	*/
333	private static function clear_wp_optimize() {
334	if ( class_exists( 'WP_Optimize' ) ) {
335	WP_Optimize()->get_page_cache()->purge();
336	}
337	}
338	}
339