PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.7
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.7
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/FrmEntryValidate.php +146 -438 6.276.7 View file →
@@ -5,18 +5,10 @@
5 5
6 6 class FrmEntryValidate {
7 7
8 8 /**
9 - * @since 6.17
10 - *
11 - * @var array|null
12 - */
13 - private static $name_text_fields;
14 -
15 - /**
16 9 * @param array $values
17 - * @param bool|string[] $exclude
18 - *
10 + * @param string[]|bool $exclude
19 11 * @return array
20 12 */
21 13 public static function validate( $values, $exclude = false ) {
22 14 FrmEntry::sanitize_entry_post( $values );
@@ -23,12 +15,13 @@
23 15 $errors = array();
24 16
25 17 if ( ! isset( $values['form_id'] ) || ! isset( $values['item_meta'] ) ) {
26 18 $errors['form'] = __( 'There was a problem with your submission. Please try again.', 'formidable' );
19 +
27 20 return $errors;
28 21 }
29 22
30 - if ( FrmAppHelper::is_admin() && is_user_logged_in() && ( ! isset( $values[ 'frm_submit_entry_' . $values['form_id'] ] ) || ! wp_verify_nonce( $values[ 'frm_submit_entry_' . $values['form_id'] ], 'frm_submit_entry_nonce' ) ) ) { // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
23 + if ( FrmAppHelper::is_admin() && is_user_logged_in() && ( ! isset( $values[ 'frm_submit_entry_' . $values['form_id'] ] ) || ! wp_verify_nonce( $values[ 'frm_submit_entry_' . $values['form_id'] ], 'frm_submit_entry_nonce' ) ) ) {
31 24 $frm_settings = FrmAppHelper::get_settings();
32 25 $errors['form'] = $frm_settings->admin_permission;
33 26 }
34 27
@@ -44,9 +37,9 @@
44 37 self::validate_field( $posted_field, $errors, $values, $args );
45 38 unset( $posted_field );
46 39 }
47 40
48 - if ( ! $errors ) {
41 + if ( empty( $errors ) ) {
49 42 self::spam_check( $exclude, $values, $errors );
50 43 }
51 44
52 45 /**
@@ -62,9 +55,9 @@
62 55
63 56 if ( is_array( $filtered_errors ) ) {
64 57 $errors = $filtered_errors;
65 58 } else {
66 - _doing_it_wrong( __METHOD__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
59 + _doing_it_wrong( __FUNCTION__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
67 60 }
68 61
69 62 return $errors;
70 63 }
@@ -83,15 +76,9 @@
83 76 $_POST['item_meta'] = array();
84 77 }
85 78 }
86 79
87 - /**
88 - * @param array $values
89 - *
90 - * @return void
91 - */
92 80 private static function set_item_key( &$values ) {
93 - // phpcs:ignore Universal.Operators.StrictComparisons
94 81 if ( ! isset( $values['item_key'] ) || $values['item_key'] == '' ) {
95 82 global $wpdb;
96 83 $values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
97 84 $_POST['item_key'] = $values['item_key'];
@@ -97,14 +84,8 @@
97 84 $_POST['item_key'] = $values['item_key'];
98 85 }
99 86 }
100 87
101 - /**
102 - * @param array $values
103 - * @param array|string $exclude
104 - *
105 - * @return array
106 - */
107 88 private static function get_fields_to_validate( $values, $exclude ) {
108 89 $where = apply_filters( 'frm_posted_field_ids', array( 'fi.form_id' => $values['form_id'] ) );
109 90
110 91 // Don't get subfields
@@ -110,9 +91,9 @@
110 91 // Don't get subfields
111 92 $where['fr.parent_form_id'] = array( null, 0 );
112 93
113 94 // Don't get excluded fields (like file upload fields in the ajax validation)
114 - if ( $exclude ) {
95 + if ( ! empty( $exclude ) ) {
115 96 $where['fi.type not'] = $exclude;
116 97 }
117 98
118 99 $fields = FrmField::getAll( $where, 'field_order' );
@@ -127,29 +108,23 @@
127 108 */
128 109 return apply_filters( 'frm_fields_to_validate', $fields, compact( 'values', 'exclude', 'where' ) );
129 110 }
130 111
131 - /**
132 - * @param object $posted_field
133 - * @param array $errors
134 - * @param array $values
135 - * @param array $args
136 - *
137 - * @return void
138 - */
139 112 public static function validate_field( $posted_field, &$errors, $values, $args = array() ) {
140 113 $defaults = array(
141 114 'id' => $posted_field->id,
142 - // The id of the repeat or embed form.
143 - 'parent_field_id' => '',
144 - // The pointer in the posted array.
145 - 'key_pointer' => '',
146 - // Exclude these field types from validation.
147 - 'exclude' => array(),
115 + 'parent_field_id' => '', // the id of the repeat or embed form
116 + 'key_pointer' => '', // the pointer in the posted array
117 + 'exclude' => array(), // exclude these field types from validation
118 + );
119 + $args = wp_parse_args( $args, $defaults );
148 120
149 - );
150 - $args = wp_parse_args( $args, $defaults );
151 - $value = empty( $args['parent_field_id'] ) ? ( $values['item_meta'][ $args['id'] ] ?? '' ) : $values;
121 + if ( empty( $args['parent_field_id'] ) ) {
122 + $value = isset( $values['item_meta'][ $args['id'] ] ) ? $values['item_meta'][ $args['id'] ] : '';
123 + } else {
124 + // value is from a nested form
125 + $value = $values;
126 + }
152 127
153 128 // Check for values in "Other" fields
154 129 FrmEntriesHelper::maybe_set_other_validation( $posted_field, $value, $args );
155 130
@@ -154,10 +129,9 @@
154 129 FrmEntriesHelper::maybe_set_other_validation( $posted_field, $value, $args );
155 130
156 131 self::maybe_clear_value_for_default_blank_setting( $posted_field, $value );
157 132
158 - $should_trim = is_array( $value ) && count( $value ) === 1 && isset( $value[0] ) && $posted_field->type !== 'checkbox';
159 -
133 + $should_trim = is_array( $value ) && count( $value ) == 1 && isset( $value[0] ) && $posted_field->type !== 'checkbox';
160 134 if ( $should_trim ) {
161 135 $value = reset( $value );
162 136 }
163 137
@@ -164,9 +138,8 @@
164 138 if ( ! is_array( $value ) ) {
165 139 $value = trim( $value );
166 140 }
167 141
168 - // phpcs:ignore Universal.Operators.StrictComparisons
169 142 if ( $posted_field->required == '1' && FrmAppHelper::is_empty_value( $value ) ) {
170 143 $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'blank' );
171 144 } elseif ( ! isset( $_POST['item_name'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
172 145 self::maybe_add_item_name( $value, $posted_field );
@@ -173,9 +146,8 @@
173 146 }
174 147
175 148 FrmEntriesHelper::set_posted_value( $posted_field, $value, $args );
176 149
177 - self::validate_options( $errors, $posted_field, $value, $args );
178 150 self::validate_field_types( $errors, $posted_field, $value, $args );
179 151
180 152 // Field might want to modify value before other parts of the system
181 153 // e.g. trim off excess values like in the case of fields with limit.
@@ -180,9 +152,8 @@
180 152 // Field might want to modify value before other parts of the system
181 153 // e.g. trim off excess values like in the case of fields with limit.
182 154 $value = apply_filters( 'frm_modify_posted_field_value', $value, $errors, $posted_field, $args );
183 155
184 - // phpcs:ignore Universal.Operators.StrictComparisons
185 156 if ( $value != '' ) {
186 157 self::validate_phone_field( $errors, $posted_field, $value, $args );
187 158 }
188 159
@@ -187,207 +158,19 @@
187 158 }
188 159
189 160 $errors = apply_filters( 'frm_validate_' . $posted_field->type . '_field_entry', $errors, $posted_field, $value, $args );
190 161 $errors = apply_filters( 'frm_validate_field_entry', $errors, $posted_field, $value, $args );
191 -
192 - if ( ! FrmAppHelper::pro_is_installed() && empty( $args['other'] ) ) {
193 - FrmEntriesHelper::get_posted_value( $posted_field, $value, $args );
194 - }
195 162 }
196 163
197 164 /**
198 - * @since 6.21
199 - *
200 - * @param array $errors
201 - * @param object $posted_field
202 - * @param array|string $value
203 - * @param array $args
204 - *
205 - * @return void
206 - */
207 - private static function validate_options( &$errors, $posted_field, $value, $args ) {
208 - if ( empty( $posted_field->options ) ) {
209 - return;
210 - }
211 -
212 - $option_is_valid = self::option_is_valid( $posted_field, $value, $posted_field->options );
213 -
214 - /**
215 - * @since 6.21
216 - *
217 - * @param bool $option_is_valid
218 - * @param array|string $value
219 - * @param object $field
220 - */
221 - $option_is_valid = (bool) apply_filters( 'frm_option_is_valid', $option_is_valid, $value, $posted_field );
222 -
223 - if ( ! $option_is_valid ) {
224 - $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'invalid' );
225 - }
226 - }
227 -
228 - /**
229 - * Validate that value matches one of the options for the field.
230 - *
231 - * @since 6.21
232 - *
233 - * @param stdClass $field
234 - * @param array|string $value
235 - * @param array $options
236 - *
237 - * @return bool
238 - */
239 - private static function option_is_valid( $field, $value, $options ) { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
240 - if ( '' === $value ) {
241 - return true;
242 - }
243 -
244 - $field_object = FrmFieldFactory::get_field_type( $field->type, $field );
245 -
246 - if ( ! $field_object->field_type_has_options_settings() ) {
247 - return true;
248 - }
249 -
250 - if ( in_array( $field->type, array( 'likert', 'ranking' ), true ) ) {
251 - // Ignore these field types automatically.
252 - return true;
253 - }
254 -
255 - if ( 'product' === $field->type && 'user_def' === FrmField::get_option( $field, 'data_type' ) ) {
256 - return true;
257 - }
258 -
259 - if ( ! empty( $field->field_options['post_field'] ) ) {
260 - return true;
261 - }
262 -
263 - $value = (array) $value;
264 -
265 - foreach ( $value as $current_value ) {
266 - $match = false;
267 -
268 - foreach ( $options as $key => $option ) {
269 - if ( str_starts_with( $key, 'other_' ) ) {
270 - // Always return true if an other option is found.
271 - return true;
272 - }
273 -
274 - if ( is_array( $option ) ) {
275 - $separate_value = FrmField::get_option( $field, 'separate_value' );
276 - $option_value = $separate_value ? $option['value'] : $option['label'];
277 - } else {
278 - $option_value = $option;
279 - }
280 -
281 - $match = trim( $current_value ) === trim( $option_value );
282 -
283 - if ( $match ) {
284 - break;
285 - }
286 -
287 - $match = trim( $current_value ) === trim( do_shortcode( $option_value ) );
288 -
289 - if ( $match ) {
290 - break;
291 - }
292 -
293 - $match = self::is_filtered_match( $current_value, $option_value );
294 -
295 - if ( $match ) {
296 - break;
297 - }
298 -
299 - if ( is_numeric( $current_value ) ) {
300 - $match = (int) $current_value === (int) $option_value;
301 -
302 - if ( $match ) {
303 - break;
304 - }
305 - }
306 - }//end foreach
307 -
308 - if ( ! $match ) {
309 - return self::options_are_dynamic_based_on_hook( $field, $value );
310 - }
311 - }//end foreach
312 -
313 - return true;
314 - }
315 -
316 - /**
317 - * Make an extra check after passing $option_value through the_content filter.
318 - * This is to help catch cases where the option's formatting has been modified using
319 - * the_content filter.
320 - *
321 - * @since 6.22
322 - *
323 - * @param string $value
324 - * @param string $option_value
325 - *
326 - * @return bool
327 - */
328 - private static function is_filtered_match( $value, $option_value ) {
329 - // First remove the wpautop filter so it doesn't add extra tags to $option_value.
330 - $filter_priority = has_filter( 'the_content', 'wpautop' );
331 -
332 - if ( is_numeric( $filter_priority ) ) {
333 - remove_filter( 'the_content', 'wpautop', $filter_priority );
334 - }
335 -
336 - $filtered_option = apply_filters( 'the_content', $option_value );
337 -
338 - if ( is_numeric( $filter_priority ) ) {
339 - add_filter( 'the_content', 'wpautop', $filter_priority );
340 - }
341 -
342 - return trim( $value ) === trim( $filtered_option );
343 - }
344 -
345 - /**
346 - * Do not validate options if they have been modified with a hook.
347 - * This is to help avoid issues where the options could be based on a URL param for example.
348 - *
349 - * @since 6.21
350 - *
351 - * @param object $field_object The field object.
352 - * @param array|string $value The value to validate.
353 - *
354 - * @return bool
355 - */
356 - private static function options_are_dynamic_based_on_hook( $field_object, $value ) {
357 - $values = (array) $field_object;
358 - $values['value'] = $value;
359 - FrmFieldsHelper::prepare_new_front_field( $values, $field_object );
360 -
361 - $separate_value = FrmField::get_option( $field_object, 'separate_value' );
362 - $map_callback = function ( $option ) use ( $separate_value ) {
363 - if ( is_array( $option ) ) {
364 - $option_value = $separate_value ? $option['value'] : $option['label'];
365 - } else {
366 - $option_value = $option;
367 - }
368 - return do_shortcode( $option_value );
369 - };
370 -
371 - $values_options = array_map( $map_callback, $values['options'] );
372 - $field_object_options = array_map( $map_callback, $field_object->options );
373 -
374 - return $values_options !== $field_object_options;
375 - }
376 -
377 - /**
378 165 * Maybe add item_name to $_POST to save it in items table.
379 166 *
380 167 * @since 5.2.02
381 168 *
382 - * @param array|string $value Field value.
383 - * @param object $field Field object.
384 - *
385 - * @return void
169 + * @param object $field Field object.
386 170 */
387 171 private static function maybe_add_item_name( $value, $field ) {
388 172 $item_name = false;
389 -
390 173 if ( 'name' === $field->type ) {
391 174 $field_obj = FrmFieldFactory::get_field_object( $field );
392 175 $item_name = $field_obj->get_display_value( $value );
393 176 } elseif ( 'text' === $field->type ) {
@@ -404,14 +187,11 @@
404 187 * Set $value to an empty string if it matches its label
405 188 *
406 189 * @param object $field
407 190 * @param string $value
408 - *
409 - * @return void
410 191 */
411 192 private static function maybe_clear_value_for_default_blank_setting( $field, &$value ) {
412 193 $position = FrmField::get_option( $field, 'label' );
413 -
414 194 if ( ! $position ) {
415 195 $position = FrmStylesController::get_style_val( 'position', $field->form_id );
416 196 }
417 197
@@ -419,16 +199,8 @@
419 199 $value = '';
420 200 }
421 201 }
422 202
423 - /**
424 - * @param array $errors
425 - * @param object $posted_field
426 - * @param mixed $value
427 - * @param array $args
428 - *
429 - * @return void
430 - */
431 203 public static function validate_field_types( &$errors, $posted_field, $value, $args ) {
432 204 $field_obj = FrmFieldFactory::get_field_object( $posted_field );
433 205 $args['value'] = $value;
434 206 $args['errors'] = $errors;
@@ -433,26 +205,16 @@
433 205 $args['value'] = $value;
434 206 $args['errors'] = $errors;
435 207
436 208 $new_errors = $field_obj->validate( $args );
437 -
438 - if ( $new_errors ) {
209 + if ( ! empty( $new_errors ) ) {
439 210 $errors = array_merge( $errors, $new_errors );
440 211 }
441 212 }
442 213
443 - /**
444 - * @param array $errors
445 - * @param object $field
446 - * @param string $value
447 - * @param array $args
448 - *
449 - * @return void
450 - */
451 214 public static function validate_phone_field( &$errors, $field, $value, $args ) {
452 - $format_value = FrmField::get_option( $field, 'format' );
215 + if ( $field->type == 'phone' || ( $field->type == 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
453 216
454 - if ( $field->type === 'phone' || ( $field->type === 'text' && $format_value && ! FrmCurrencyHelper::is_currency_format( $format_value ) ) ) {
455 217 $pattern = self::phone_format( $field );
456 218
457 219 if ( ! preg_match( $pattern, $value ) ) {
458 220 $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $field, 'invalid' );
@@ -459,13 +221,8 @@
459 221 }
460 222 }
461 223 }
462 224
463 - /**
464 - * @param object $field
465 - *
466 - * @return string
467 - */
468 225 public static function phone_format( $field ) {
469 226 if ( FrmField::is_option_empty( $field, 'format' ) ) {
470 227 $pattern = self::default_phone_format();
471 228 } else {
@@ -471,25 +228,22 @@
471 228 } else {
472 229 $pattern = FrmField::get_option( $field, 'format' );
473 230 }
474 231
475 - // Ampersands are saved as &.
476 - // Reverse it here so we are checking for the correct character.
477 - $pattern = html_entity_decode( $pattern );
478 232 $pattern = apply_filters( 'frm_phone_pattern', $pattern, $field );
479 233
480 234 // Create a regexp if format is not already a regexp
481 - if ( ! str_starts_with( $pattern, '^' ) ) {
235 + if ( strpos( $pattern, '^' ) !== 0 ) {
482 236 $pattern = self::create_regular_expression_from_format( $pattern );
483 237 }
484 238
485 - return '/' . $pattern . '/';
239 + $pattern = '/' . $pattern . '/';
240 +
241 + return $pattern;
486 242 }
487 243
488 244 /**
489 245 * @since 3.01
490 - *
491 - * @return string
492 246 */
493 247 private static function default_phone_format() {
494 248 return '^((\+\d{1,3}(-|.| )?\(?\d\)?(-| |.)?\d{1,5})|(\(?\d{2,6}\)?))(-|.| )?(\d{3,4})(-|.| )?(\d{4})(( x| ext)\d{1,5}){0,1}$';
495 249 }
@@ -515,14 +269,13 @@
515 269 $pattern = str_replace( 'a', '[a-zA-Z]', $pattern );
516 270 $pattern = str_replace( '*', 'w', $pattern );
517 271 $pattern = str_replace( '/', '\/', $pattern );
518 272
519 - if ( str_contains( $pattern, '\?' ) ) {
273 + if ( strpos( $pattern, '\?' ) !== false ) {
520 274 $parts = explode( '\?', $pattern );
521 275 $pattern = '';
522 -
523 276 foreach ( $parts as $part ) {
524 - if ( ! $pattern ) {
277 + if ( empty( $pattern ) ) {
525 278 $pattern .= $part;
526 279 } else {
527 280 $pattern .= '(' . $part . ')?';
528 281 }
@@ -527,45 +280,33 @@
527 280 $pattern .= '(' . $part . ')?';
528 281 }
529 282 }
530 283 }
284 + $pattern = '^' . $pattern . '$';
531 285
532 - return '^' . $pattern . '$';
286 + return $pattern;
533 287 }
534 288
535 289 /**
536 - * Check for spam.
290 + * Check for spam
537 291 *
538 - * @param bool $exclude
292 + * @param boolean $exclude
539 293 * @param array $values
540 - * @param array $errors By reference.
541 - *
542 - * @return void
294 + * @param array $errors by reference
543 295 */
544 296 public static function spam_check( $exclude, $values, &$errors ) {
545 - if ( defined( 'WP_IMPORTING' ) && WP_IMPORTING ) {
546 - // Do not check spam on importing.
547 - return;
548 - }
549 -
550 - if ( $exclude || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
297 + if ( ! empty( $exclude ) || ! isset( $values['item_meta'] ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
551 298 // only check spam if there are no other errors
552 299 return;
553 300 }
554 301
555 302 $antispam_check = self::is_antispam_check( $values['form_id'] );
556 - $spam_msg = FrmAntiSpamController::get_default_spam_message();
557 -
558 303 if ( is_string( $antispam_check ) ) {
559 304 $errors['spam'] = $antispam_check;
560 305 } elseif ( self::is_honeypot_spam( $values ) || self::is_spam_bot() ) {
561 - $errors['spam'] = $spam_msg;
562 - } else {
563 - $is_spam = FrmAntiSpamController::is_spam( $values );
564 -
565 - if ( $is_spam ) {
566 - $errors['spam'] = $is_spam;
567 - }
306 + $errors['spam'] = __( 'Your entry appears to be spam!', 'formidable' );
307 + } elseif ( self::blacklist_check( $values ) ) {
308 + $errors['spam'] = __( 'Your entry appears to be blocked spam!', 'formidable' );
568 309 }
569 310
570 311 if ( isset( $errors['spam'] ) || self::form_is_in_progress( $values ) ) {
571 312 return;
@@ -581,9 +322,8 @@
581 322 *
582 323 * @since 5.0.13
583 324 *
584 325 * @param array $values The values.
585 - *
586 326 * @return bool
587 327 */
588 328 private static function form_is_in_progress( $values ) {
589 329 return FrmAppHelper::pro_is_installed() &&
@@ -602,10 +342,9 @@
602 342 }
603 343
604 344 /**
605 345 * @param array $values
606 - *
607 - * @return bool
346 + * @return boolean
608 347 */
609 348 private static function is_honeypot_spam( $values ) {
610 349 $honeypot = new FrmHoneypot( $values['form_id'] );
611 350 return ! $honeypot->validate();
@@ -611,52 +350,87 @@
611 350 return ! $honeypot->validate();
612 351 }
613 352
614 353 /**
615 - * @return bool
354 + * @return boolean
616 355 */
617 356 private static function is_spam_bot() {
618 357 $ip = FrmAppHelper::get_ip_address();
358 +
619 359 return empty( $ip );
620 360 }
621 361
622 362 /**
623 363 * @param array $values
624 - *
625 - * @return bool
364 + * @return boolean
626 365 */
627 366 private static function is_akismet_spam( $values ) {
628 367 global $wpcom_api_key;
629 - return is_callable( 'Akismet::http_post' ) && ( get_option( 'wordpress_api_key' ) || $wpcom_api_key ) && self::akismet( $values );
368 +
369 + return ( is_callable( 'Akismet::http_post' ) && ( get_option( 'wordpress_api_key' ) || $wpcom_api_key ) && self::akismet( $values ) );
630 370 }
631 371
632 372 /**
633 373 * @param int $form_id
634 - *
635 374 * @return bool
636 375 */
637 376 private static function is_akismet_enabled_for_user( $form_id ) {
638 377 $form = FrmForm::getOne( $form_id );
639 - return ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() );
378 +
379 + return ( ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() ) );
640 380 }
641 381
382 + public static function blacklist_check( $values ) {
383 + if ( ! apply_filters( 'frm_check_blacklist', true, $values ) ) {
384 + return false;
385 + }
386 +
387 + $mod_keys = trim( self::get_disallowed_words() );
388 + if ( empty( $mod_keys ) ) {
389 + return false;
390 + }
391 +
392 + $content = FrmEntriesHelper::entry_array_to_string( $values );
393 +
394 + self::prepare_values_for_spam_check( $values );
395 + $ip = FrmAppHelper::get_ip_address();
396 + $user_agent = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
397 + $user_info = self::get_spam_check_user_info( $values );
398 +
399 + return self::check_disallowed_words( $user_info['comment_author'], $user_info['comment_author_email'], $user_info['comment_author_url'], $content, $ip, $user_agent );
400 + }
401 +
642 402 /**
643 - * Checks spam using WordPress disallowed words and Frm denylist.
403 + * For WP 5.5 compatibility.
644 404 *
645 - * @param array $values Entry values.
405 + * @since 4.06.02
406 + */
407 + private static function check_disallowed_words( $author, $email, $url, $content, $ip, $user_agent ) {
408 + if ( function_exists( 'wp_check_comment_disallowed_list' ) ) {
409 + return wp_check_comment_disallowed_list( $author, $email, $url, $content, $ip, $user_agent );
410 + } else {
411 + return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
412 + }
413 + }
414 +
415 + /**
416 + * For WP 5.5 compatibility.
646 417 *
647 - * @return bool
418 + * @since 4.06.02
648 419 */
649 - public static function blacklist_check( $values ) {
650 - return FrmAntiSpamController::contains_wp_disallowed_words( $values ) || FrmAntiSpamController::is_denylist_spam( $values );
420 + private static function get_disallowed_words() {
421 + $keys = get_option( 'disallowed_keys' );
422 + if ( false === $keys ) {
423 + // Fallback for WP < 5.5.
424 + $keys = get_option( 'blacklist_keys' );
425 + }
426 + return $keys;
651 427 }
652 428
653 429 /**
654 430 * Check entries for Akismet spam
655 431 *
656 - * @param array $values Entry values.
657 - *
658 - * @return bool true if is spam
432 + * @return boolean true if is spam
659 433 */
660 434 public static function akismet( $values ) {
661 435 if ( empty( $values['item_meta'] ) ) {
662 436 return false;
@@ -678,18 +452,13 @@
678 452
679 453 $query_string = _http_build_query( $datas, '', '&' );
680 454 $response = Akismet::http_post( $query_string, 'comment-check' );
681 455
682 - return is_array( $response ) && $response[1] === 'true';
456 + return ( is_array( $response ) && $response[1] == 'true' );
683 457 }
684 458
685 459 /**
686 460 * @since 2.0
687 - *
688 - * @param array $datas The array of values being sent to Akismet.
689 - * @param array $values Entry values.
690 - *
691 - * @return void
692 461 */
693 462 private static function parse_akismet_array( &$datas, $values ) {
694 463 self::add_site_info_to_akismet( $datas );
695 464 self::add_server_values_to_akismet( $datas );
@@ -694,19 +463,13 @@
694 463 self::add_site_info_to_akismet( $datas );
695 464 self::add_server_values_to_akismet( $datas );
696 465
697 466 self::prepare_values_for_spam_check( $values );
698 - self::skip_adding_values_to_akismet( $values );
699 467
700 468 self::add_user_info_to_akismet( $datas, $values );
701 469 self::add_comment_content_to_akismet( $datas, $values );
702 470 }
703 471
704 - /**
705 - * @param array $datas
706 - *
707 - * @return void
708 - */
709 472 private static function add_site_info_to_akismet( &$datas ) {
710 473 $datas['blog'] = FrmAppHelper::site_url();
711 474 $datas['user_ip'] = preg_replace( '/[^0-9., ]/', '', FrmAppHelper::get_ip_address() );
712 475 $datas['user_agent'] = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
@@ -718,14 +481,8 @@
718 481 $datas['is_test'] = 'true';
719 482 }
720 483 }
721 484
722 - /**
723 - * @param array $datas
724 - * @param array $values
725 - *
726 - * @return void
727 - */
728 485 private static function add_user_info_to_akismet( &$datas, $values ) {
729 486 $user_info = self::get_spam_check_user_info( $values );
730 487 $datas = $datas + $user_info;
731 488
@@ -737,15 +494,13 @@
737 494 /**
738 495 * Gets user info for Akismet spam check.
739 496 *
740 497 * @since 5.0.13 Separate code for guest. Handle value of embedded|repeater.
741 - * @since 6.21 This changed from private to public.
742 498 *
743 499 * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
744 - *
745 500 * @return array
746 501 */
747 - public static function get_spam_check_user_info( $values ) {
502 + private static function get_spam_check_user_info( $values ) {
748 503 if ( ! is_user_logged_in() ) {
749 504 return self::get_spam_check_user_info_for_guest( $values );
750 505 }
751 506
@@ -765,9 +520,8 @@
765 520 *
766 521 * @since 5.0.13
767 522 *
768 523 * @param array $values Entry values after flattened.
769 - *
770 524 * @return array
771 525 */
772 526 private static function get_spam_check_user_info_for_guest( $values ) {
773 527 $datas = array(
@@ -799,16 +553,13 @@
799 553 *
800 554 * @param array $datas Guest data.
801 555 * @param array $values The values.
802 556 * @param int|null $custom_index Custom index (or field ID).
803 - *
804 - * @return void
805 557 */
806 558 private static function recursive_add_akismet_guest_info( &$datas, $values, $custom_index = null ) {
807 559 foreach ( $values as $index => $value ) {
808 560 if ( ! $datas['missing_keys'] ) {
809 - // Found all info.
810 - return;
561 + return; // Found all info.
811 562 }
812 563
813 564 if ( is_array( $value ) ) {
814 565 self::recursive_add_akismet_guest_info( $datas, $value, $index );
@@ -815,12 +566,10 @@
815 566 continue;
816 567 }
817 568
818 569 $field_id = ! is_null( $custom_index ) ? $custom_index : $index;
819 -
820 570 foreach ( $datas['missing_keys'] as $key_index => $key ) {
821 - $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'], $values );
822 -
571 + $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'] );
823 572 if ( $found ) {
824 573 $datas[ $key ] = $value;
825 574 $datas['frm_duplicated'][] = $field_id;
826 575 unset( $datas['missing_keys'][ $key_index ] );
@@ -825,9 +574,9 @@
825 574 $datas['frm_duplicated'][] = $field_id;
826 575 unset( $datas['missing_keys'][ $key_index ] );
827 576 }
828 577 }
829 - }//end foreach
578 + }
830 579 }
831 580
832 581 /**
833 582 * Checks if given value is an akismet guest info.
@@ -837,13 +586,11 @@
837 586 * @param string $key Guest info key.
838 587 * @param string $value Value to check.
839 588 * @param int $field_id Field ID.
840 589 * @param array $name_field_ids Name field IDs.
841 - * @param array $values Array of posted values.
842 - *
843 590 * @return bool
844 591 */
845 - private static function is_akismet_guest_info_value( $key, &$value, $field_id, $name_field_ids, $values ) {
592 + private static function is_akismet_guest_info_value( $key, $value, $field_id, $name_field_ids ) {
846 593 if ( ! $value || is_numeric( $value ) ) {
847 594 return false;
848 595 }
849 596
@@ -848,79 +595,24 @@
848 595 }
849 596
850 597 switch ( $key ) {
851 598 case 'comment_author_email':
852 - return str_contains( $value, '@' ) && is_email( $value );
599 + return strpos( $value, '@' ) && is_email( $value );
853 600
854 601 case 'comment_author_url':
855 - return str_starts_with( $value, 'http' );
602 + return 0 === strpos( $value, 'http' );
856 603
857 604 case 'comment_author':
858 - if ( $name_field_ids && in_array( $field_id, $name_field_ids, true ) ) {
605 + if ( $name_field_ids ) {
859 606 // If there is name field in the form, we should always use it as author name.
860 - return true;
607 + return in_array( $field_id, $name_field_ids, true );
861 608 }
609 + return strlen( $value ) < 200;
610 + }
862 611
863 - $form_id = FrmAppHelper::get_post_param( 'form_id', 0, 'absint' );
864 - $fields = self::get_name_text_fields( $form_id );
865 -
866 - foreach ( $fields as $index => $field ) {
867 - if ( 'Name' !== $field->name ) {
868 - continue;
869 - }
870 -
871 - if ( isset( $fields[ $index + 1 ] ) && 'Last' === $fields[ $index + 1 ]->name ) {
872 - if ( empty( $values[ absint( $fields[ $index + 1 ]->id ) ] ) ) {
873 - continue;
874 - }
875 -
876 - $value .= ' ' . $values[ $fields[ $index + 1 ]->id ];
877 - return true;
878 - }
879 - }
880 - }//end switch
881 -
882 612 return false;
883 613 }
884 614
885 - /**
886 - * Returns fields that have 'Name' and 'Last' as their name.
887 - *
888 - * @since 6.17
889 - *
890 - * @param int $form_id
891 - *
892 - * @return array
893 - */
894 - private static function get_name_text_fields( $form_id ) {
895 - $name_text_fields_is_initialized = is_array( self::$name_text_fields );
896 -
897 - if ( $name_text_fields_is_initialized && isset( self::$name_text_fields[ $form_id ] ) ) {
898 - return self::$name_text_fields[ $form_id ];
899 - }
900 -
901 - if ( ! $name_text_fields_is_initialized ) {
902 - self::$name_text_fields = array();
903 - }
904 - self::$name_text_fields[ $form_id ] = FrmDb::get_results(
905 - 'frm_fields',
906 - array(
907 - 'form_id' => $form_id,
908 - 'type' => 'text',
909 - 'name' => array( 'Name', 'Last' ),
910 - ),
911 - 'id,name',
912 - array( 'order_by' => 'field_order ASC' )
913 - );
914 -
915 - return self::$name_text_fields[ $form_id ];
916 - }
917 -
918 - /**
919 - * @param array $datas
920 - *
921 - * @return void
922 - */
923 615 private static function add_server_values_to_akismet( &$datas ) {
924 616 foreach ( $_SERVER as $key => $value ) {
925 617 $include_value = is_string( $value ) && ! preg_match( '/^HTTP_COOKIE/', $key ) && preg_match( '/^(HTTP_|REMOTE_ADDR|REQUEST_URI|DOCUMENT_URI)/', $key );
926 618
@@ -938,10 +630,8 @@
938 630 * @since 5.0.09
939 631 *
940 632 * @param array $datas The array of values being sent to Akismet.
941 633 * @param array $values Entry values.
942 - *
943 - * @return void
944 634 */
945 635 private static function add_comment_content_to_akismet( &$datas, $values ) {
946 636 if ( isset( $datas['frm_duplicated'] ) ) {
947 637 foreach ( $datas['frm_duplicated'] as $index ) {
@@ -953,8 +643,10 @@
953 643 }
954 644 unset( $datas['frm_duplicated'] );
955 645 }
956 646
647 + self::skip_adding_values_to_akismet( $values );
648 +
957 649 $datas['comment_content'] = FrmEntriesHelper::entry_array_to_string( $values );
958 650 }
959 651
960 652 /**
@@ -962,14 +654,11 @@
962 654 *
963 655 * @since 5.0.09
964 656 *
965 657 * @param array $values Entry values.
966 - *
967 - * @return void
968 658 */
969 659 private static function skip_adding_values_to_akismet( &$values ) {
970 660 $skipped_fields = self::get_akismet_skipped_field_ids( $values );
971 -
972 661 foreach ( $skipped_fields as $skipped_field ) {
973 662 if ( ! isset( $values['item_meta'][ $skipped_field->id ] ) ) {
974 663 continue;
975 664 }
@@ -975,9 +664,8 @@
975 664 }
976 665
977 666 if ( self::should_really_skip_field( $skipped_field, $values ) ) {
978 667 unset( $values['item_meta'][ $skipped_field->id ] );
979 -
980 668 if ( isset( $values['item_meta']['other'][ $skipped_field->id ] ) ) {
981 669 unset( $values['item_meta']['other'][ $skipped_field->id ] );
982 670 }
983 671 }
@@ -990,28 +678,25 @@
990 678 * @since 5.02.04
991 679 *
992 680 * @param object $field_data Object contains `id` and `options`.
993 681 * @param array $values Entry values.
994 - *
995 682 * @return bool
996 683 */
997 684 private static function should_really_skip_field( $field_data, $values ) {
998 - if ( empty( $field_data->options ) ) {
999 - // This is skipped field types.
685 + if ( empty( $field_data->options ) ) { // This is skipped field types.
1000 686 return true;
1001 687 }
1002 688
1003 689 FrmAppHelper::unserialize_or_decode( $field_data->options );
1004 -
1005 - if ( ! $field_data->options ) {
1006 - // Check if an error happens when unserializing, or empty options.
690 + if ( ! $field_data->options ) { // Check if an error happens when unserializing, or empty options.
1007 691 return true;
1008 692 }
1009 693
1010 - $last_key = array_key_last( $field_data->options );
694 + end( $field_data->options );
695 + $last_key = key( $field_data->options );
1011 696
1012 697 // If a choice field has no Other option.
1013 - if ( is_numeric( $last_key ) || ! str_starts_with( $last_key, 'other_' ) ) {
698 + if ( is_numeric( $last_key ) || 0 !== strpos( $last_key, 'other_' ) ) {
1014 699 return true;
1015 700 }
1016 701
1017 702 // If a choice field has Other option, but Other is not selected.
@@ -1020,10 +705,9 @@
1020 705 }
1021 706
1022 707 // Check if submitted value is same as one of field option.
1023 708 foreach ( $field_data->options as $option ) {
1024 - $option_value = ! is_array( $option ) ? $option : ( $option['value'] ?? '' );
1025 -
709 + $option_value = ! is_array( $option ) ? $option : ( isset( $option['value'] ) ? $option['value'] : '' );
1026 710 if ( $values['item_meta']['other'][ $field_data->id ] === $option_value ) {
1027 711 return true;
1028 712 }
1029 713 }
@@ -1038,9 +722,8 @@
1038 722 * @since 5.0.13 Move out get_all_form_ids_and_flatten_meta() call and get `form_ids` from `$values`.
1039 723 * @since 5.2.04 This method returns array of object contains `id` and `options` instead of array of `id` only.
1040 724 *
1041 725 * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
1042 - *
1043 726 * @return array
1044 727 */
1045 728 private static function get_akismet_skipped_field_ids( $values ) {
1046 729 if ( empty( $values['form_ids'] ) ) {
@@ -1063,15 +746,12 @@
1063 746 /**
1064 747 * Prepares values array for spam check.
1065 748 *
1066 749 * @since 5.0.13
1067 - * @since 6.21 This changed from private to public.
1068 750 *
1069 751 * @param array $values Entry values.
1070 - *
1071 - * @return void
1072 752 */
1073 - public static function prepare_values_for_spam_check( &$values ) {
753 + private static function prepare_values_for_spam_check( &$values ) {
1074 754 $form_ids = self::get_all_form_ids_and_flatten_meta( $values );
1075 755 $values['form_ids'] = $form_ids;
1076 756 }
1077 757
@@ -1082,20 +762,17 @@
1082 762 * @since 5.0.09
1083 763 * @since 5.0.13 Convert name field value to string.
1084 764 *
1085 765 * @param array $values Entry values.
1086 - *
1087 766 * @return array Form IDs.
1088 767 */
1089 - private static function get_all_form_ids_and_flatten_meta( &$values ) { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
768 + private static function get_all_form_ids_and_flatten_meta( &$values ) {
1090 769 $values['name_field_ids'] = array();
1091 770
1092 771 // Blacklist check for File field in the old version doesn't contain `form_id`.
1093 772 $form_ids = isset( $values['form_id'] ) ? array( absint( $values['form_id'] ) ) : array();
1094 -
1095 773 foreach ( $values['item_meta'] as $field_id => $value ) {
1096 - if ( ! is_numeric( $field_id ) ) {
1097 - // Maybe `other`.
774 + if ( ! is_numeric( $field_id ) ) { // Maybe `other`.
1098 775 continue;
1099 776 }
1100 777
1101 778 // Convert name array to string.
@@ -1126,20 +803,51 @@
1126 803 }
1127 804
1128 805 // Convert name array to string.
1129 806 if ( isset( $subsubvalue['first'] ) && isset( $subsubvalue['last'] ) ) {
1130 - $subsubvalue = trim( implode( ' ', $subsubvalue ) );
807 + $subsubvalue = trim( implode( ' ', $subsubvalue ) );
808 +
1131 809 $values['name_field_ids'][] = $subsubindex;
1132 810 }
1133 811
1134 - if ( is_array( $values['item_meta'][ $subsubindex ] ) ) {
1135 - $values['item_meta'][ $subsubindex ][] = $subsubvalue;
1136 - }
812 + $values['item_meta'][ $subsubindex ][] = $subsubvalue;
1137 813 }
1138 - }//end foreach
814 + }
1139 815
1140 816 unset( $values['item_meta'][ $field_id ] );
1141 - }//end foreach
817 + }
1142 818
1143 819 return $form_ids;
820 + }
821 +
822 + /**
823 + * @deprecated 3.0
824 + * @codeCoverageIgnore
825 + */
826 + public static function validate_url_field( &$errors, $field, $value, $args ) {
827 + FrmDeprecated::validate_url_field( $errors, $field, $value, $args );
828 + }
829 +
830 + /**
831 + * @deprecated 3.0
832 + * @codeCoverageIgnore
833 + */
834 + public static function validate_email_field( &$errors, $field, $value, $args ) {
835 + FrmDeprecated::validate_email_field( $errors, $field, $value, $args );
836 + }
837 +
838 + /**
839 + * @deprecated 3.0
840 + * @codeCoverageIgnore
841 + */
842 + public static function validate_number_field( &$errors, $field, $value, $args ) {
843 + FrmDeprecated::validate_number_field( $errors, $field, $value, $args );
844 + }
845 +
846 + /**
847 + * @deprecated 3.0
848 + * @codeCoverageIgnore
849 + */
850 + public static function validate_recaptcha( &$errors, $field, $args ) {
851 + FrmDeprecated::validate_recaptcha( $errors, $field, $args );
1144 852 }
1145 853 }