formidable / classes / models / FrmAntiSpam.php

FrmAntiSpam.php in Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 6.32.1, at classes/models/FrmAntiSpam.php

335 lines 8.6 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	die( 'You are not allowed to call this page directly.' );
4	}
5
6	/**
7	* Class FrmAntiSpam.
8	*
9	* This token class generates tokens that are used in our Anti-Spam checking.
10	*
11	* @since 4.11
12	*/
13	class FrmAntiSpam extends FrmValidate {
14
15	/**
16	* @return string
17	*/
18	protected function get_option_key() {
19	return 'antispam';
20	}
21
22	/**
23	* @param int $form_id
24	*
25	* @return void
26	*/
27	public static function maybe_init( $form_id ) {
28	$antispam = new self( $form_id );
29
30	if ( $antispam->run_antispam() ) {
31	$antispam->init();
32	}
33	}
34
35	/**
36	* Initialise the actions for the Anti-spam.
37	*
38	* @since 4.11
39	*
40	* @return void
41	*/
42	public function init() {
43	add_filter( 'frm_form_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
44	add_filter( 'frm_form_div_attributes', array( $this, 'add_token_to_form' ), 10, 1 );
45	}
46
47	/**
48	* Return a valid token.
49	*
50	* @since 4.11
51	*
52	* @param mixed $current True to use current time, otherwise a timestamp string.
53	*
54	* @return string Token.
55	*/
56	private function get( $current = true ) {
57	// If $current was not passed, or it is true, we use the current timestamp.
58	// If $current was passed in as a string, we'll use that passed in timestamp.
59	$time = $current === true ? time() : $current;
60
61	// Format the timestamp to be less exact, as we want to deal in days.
62	// June 19th, 2020 would get formatted as: 1906202017125.
63	// Day of the month, month number, year, day number of the year, week number of the year.
64	$token_date = gmdate( 'dmYzW', $time );
65
66	// Combine our token date and our token salt, and md5 it.
67	return md5( $token_date . $this->get_antispam_secret_key() );
68	}
69
70	/**
71	* @return string
72	*/
73	private function get_antispam_secret_key() {
74	$secret_key = get_option( 'frm_antispam_secret_key' );
75
76	// If we already have the secret, send it back.
77	if ( false !== $secret_key ) {
78	return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
79	}
80
81	// We don't have a secret, so let's generate one.
82	$secret_key = is_callable( 'sodium_crypto_secretbox_keygen' ) ? sodium_crypto_secretbox_keygen() : wp_generate_password( 32, true, true );
83	add_option( 'frm_antispam_secret_key', base64_encode( $secret_key ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
84
85	return $secret_key;
86	}
87
88	/**
89	* Generate the array of valid tokens to check for. These include two days
90	* before the current date to account for long cache times.
91	*
92	* These two filters are available if a user wants to extend the times.
93	* 'frm_form_token_check_before_today'
94	* 'frm_form_token_check_after_today'
95	*
96	* @since 4.11
97	*
98	* @return array Array of all valid tokens to check against.
99	*/
100	private function get_valid_tokens() {
101	$current_date = time();
102
103	// Create our array of times to check before today. A user with a longer
104	// Cache time can extend this. A user with a shorter cache time can remove times.
105	$valid_token_times_before = apply_filters(
106	'frm_form_token_check_before_today',
107	array(
108	// Two days ago.
109	2 * DAY_IN_SECONDS,
110	// One day ago.
111	DAY_IN_SECONDS,
112	)
113	);
114
115	// Mostly to catch edge cases like the form page loading and submitting on two different days.
116	// This probably won't be filtered by users too much, but they could extend it.
117	$valid_token_times_after = apply_filters(
118	'frm_form_token_check_after_today',
119	array(
120	// Add in 45 minutes past today to catch some midnight edge cases.
121	45 * MINUTE_IN_SECONDS,
122	)
123	);
124
125	// Built up our valid tokens.
126	$valid_tokens = array();
127
128	// Add in all the previous times we check.
129	foreach ( $valid_token_times_before as $time ) {
130	$valid_tokens[] = $this->get( $current_date - $time );
131	}
132
133	// Add in our current date.
134	$valid_tokens[] = $this->get( $current_date );
135
136	// Add in the times after our check.
137	foreach ( $valid_token_times_after as $time ) {
138	$valid_tokens[] = $this->get( $current_date + $time );
139	}
140
141	return $valid_tokens;
142	}
143
144	/**
145	* Check if the given token is valid or not.
146	*
147	* Tokens are valid for some period of time (see frm_token_validity_in_hours
148	* and frm_token_validity_in_days to extend the validation period).
149	* By default tokens are valid for day.
150	*
151	* @since 4.11
152	*
153	* @param string $token Token to validate.
154	*
155	* @return bool Whether the token is valid or not.
156	*/
157	private function verify( $token ) {
158	// Check to see if our token is inside of the valid tokens.
159	return in_array( $token, $this->get_valid_tokens(), true );
160	}
161
162	/**
163	* Add the token field to the form.
164	*
165	* @since 4.11
166	*
167	* @param string $attributes
168	*
169	* @return string
170	*/
171	public function add_token_to_form( $attributes ) {
172	return $attributes . ( ' data-token="' . esc_attr( $this->get() ) . '"' );
173	}
174
175	/**
176	* @param int $form_id
177	*
178	* @return void
179	*/
180	public static function maybe_echo_token( $form_id ) {
181	$antispam = new self( $form_id );
182
183	if ( $antispam->run_antispam() ) {
184	echo 'data-token="' . esc_attr( $antispam->get() ) . '"';
185	}
186	}
187
188	/**
189	* @return bool
190	*/
191	public function run_antispam() {
192	return $this->is_option_on() && apply_filters( 'frm_run_antispam', true, $this->form_id );
193	}
194
195	/**
196	* Validate Anti-spam if enabled.
197	*
198	* @since 4.11
199	*
200	* @return bool\|string True or a string with the error.
201	*/
202	public function validate() {
203	if ( ! $this->run_antispam() ) {
204	return true;
205	}
206
207	$token = FrmAppHelper::get_param( 'antispam_token', '', 'post', 'sanitize_text_field' );
208
209	// If the antispam setting is enabled and we don't have a token, bail.
210	if ( ! $token ) {
211	if ( FrmAppHelper::is_admin_page( 'formidable-entries' ) ) {
212	// Add an exception for the entries page.
213	return true;
214	}
215
216	return $this->process_antispam_filter( $this->get_missing_token_message() );
217	}
218
219	// Verify the token.
220	if ( ! $this->verify( $token ) ) {
221	return $this->process_antispam_filter( $this->get_invalid_token_message() );
222	}
223
224	return $this->process_antispam_filter( true );
225	}
226
227	/**
228	* Helper to run our filter on all the responses for the antispam checks.
229	*
230	* @since 4.11
231	*
232	* @param bool\|string $is_valid Is valid entry or not.
233	*
234	* @return bool\|string Is valid or message.
235	*/
236	private function process_antispam_filter( $is_valid ) {
237	return apply_filters( 'frm_process_antispam', $is_valid );
238	}
239
240	/**
241	* Helper to get the missing token message.
242	*
243	* @since 4.11
244	*
245	* @return string missing token message.
246	*/
247	private function get_missing_token_message() {
248	return esc_html__( 'This page isn\'t loading JavaScript properly, and the form will not be able to submit.', 'formidable' ) . $this->maybe_get_support_text();
249	}
250
251	/**
252	* Helper to get the invalid token message.
253	*
254	* @since 4.11
255	*
256	* @return string Invalid token message.
257	*/
258	private function get_invalid_token_message() {
259	return esc_html__( 'Form token is invalid. Please refresh the page.', 'formidable' ) . $this->maybe_get_support_text();
260	}
261
262	/**
263	* If a user is a super admin, add a support link to the message.
264	*
265	* @since 4.11
266	*
267	* @return string Support text if super admin, empty string if not.
268	*/
269	private function maybe_get_support_text() {
270	// If user isn't a super admin, don't return any text.
271	if ( ! is_super_admin() ) {
272	return '';
273	}
274
275	// If the user is an admin, return text with a link to support.
276	// We add a space here to separate the sentences, but outside of the localized
277	// Text to avoid it being removed.
278	return ' ' . sprintf(
279	// translators: %1$s start link, %2$s end link.
280	esc_html__( 'Please check out our %1$stroubleshooting guide%2$s for details on resolving this issue.', 'formidable' ),
281	'<a href="https://formidableforms.com/knowledgebase/add-spam-protection/">',
282	'</a>'
283	);
284	}
285
286	/**
287	* Clear third party cache plugins to avoid data-tokens missing or appearing when the antispam setting is changed.
288	*
289	* @return void
290	*/
291	public static function clear_caches() {
292	self::clear_w3_total_cache();
293	self::clear_wp_fastest_cache();
294	self::clear_wp_super_cache();
295	self::clear_wp_optimize();
296	}
297
298	/**
299	* @return void
300	*/
301	private static function clear_w3_total_cache() {
302	if ( is_callable( 'w3tc_flush_all' ) ) {
303	w3tc_flush_all();
304	}
305	}
306
307	/**
308	* @return void
309	*/
310	private static function clear_wp_fastest_cache() {
311	do_action( 'wpfc_clear_all_cache' );
312	}
313
314	/**
315	* @return void
316	*/
317	private static function clear_wp_super_cache() {
318	if ( ! function_exists( 'wp_cache_clean_cache' ) ) {
319	return;
320	}
321
322	global $file_prefix;
323	wp_cache_clean_cache( $file_prefix, true );
324	}
325
326	/**
327	* @return void
328	*/
329	private static function clear_wp_optimize() {
330	if ( class_exists( 'WP_Optimize' ) ) {
331	WP_Optimize()->get_page_cache()->purge();
332	}
333	}
334	}
335