formidable / classes / models / FrmHoneypot.php

FrmHoneypot.php in Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 6.8.2, at classes/models/FrmHoneypot.php

148 lines 3.9 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	die( 'You are not allowed to call this page directly.' );
4	}
5
6	class FrmHoneypot extends FrmValidate {
7
8	/**
9	* @return string
10	*/
11	protected function get_option_key() {
12	return 'honeypot';
13	}
14
15	/**
16	* @return bool
17	*/
18	public function validate() {
19	if ( ! $this->is_option_on() \|\| ! $this->check_honeypot_filter() ) {
20	// never flag as honeypot spam if disabled.
21	return true;
22	}
23	return ! $this->is_honeypot_spam();
24	}
25
26	/**
27	* @return boolean
28	*/
29	private function is_honeypot_spam() {
30	$is_honeypot_spam = $this->is_legacy_honeypot_spam();
31	if ( ! $is_honeypot_spam ) {
32	// Check the newer honeypot input name which is randomly generated so it's more difficult to detect.
33	$class_name = self::get_honeypot_class_name();
34	$honeypot_value = FrmAppHelper::get_param( $class_name, '', 'get', 'sanitize_text_field' );
35	$is_honeypot_spam = '' !== $honeypot_value;
36	}
37
38	$form = $this->get_form();
39	$atts = compact( 'form' );
40	return apply_filters( 'frm_process_honeypot', $is_honeypot_spam, $atts );
41	}
42
43	/**
44	* Check the old frm_verify key. We'll continue to consider any entry with an frm_verify value as spam.
45	*
46	* @return bool
47	*/
48	private function is_legacy_honeypot_spam() {
49	$legacy_honeypot_value = FrmAppHelper::get_param( 'frm_verify', '', 'get', 'sanitize_text_field' );
50	return '' !== $legacy_honeypot_value;
51	}
52
53	/**
54	* @return mixed either true, or false.
55	*/
56	private function check_honeypot_filter() {
57	$form = $this->get_form();
58	return apply_filters( 'frm_run_honeypot', true, compact( 'form' ) );
59	}
60
61	/**
62	* @return string
63	*/
64	private function check_honeypot_setting() {
65	$form = $this->get_form();
66	$key = $this->get_option_key();
67	return $form->options[ $key ];
68	}
69
70	/**
71	* @param int $form_id
72	*
73	* @return void
74	*/
75	public static function maybe_render_field( $form_id ) {
76	$honeypot = new self( $form_id );
77	if ( $honeypot->should_render_field() ) {
78	$honeypot->render_field();
79	}
80	}
81
82	/**
83	* @return bool
84	*/
85	public function should_render_field() {
86	return $this->is_option_on() && $this->check_honeypot_filter();
87	}
88
89	/**
90	* @return void
91	*/
92	public function render_field() {
93	$honeypot = $this->check_honeypot_setting();
94	$form = $this->get_form();
95	$class_name = self::get_honeypot_class_name();
96	$input_attrs = array(
97	'id' => 'frm_email_' . absint( $form->id ),
98	'type' => 'strict' === $honeypot ? 'email' : 'text',
99	'class' => 'frm_verify',
100	'name' => $class_name,
101	'value' => FrmAppHelper::get_param( $class_name, '', 'get', 'wp_kses_post' ),
102	);
103
104	if ( 'strict' !== $honeypot ) {
105	$input_attrs['autocomplete'] = 'false';
106	}
107	?>
108	<div class="<?php echo esc_attr( $class_name ); ?>">
109	<label for="frm_email_<?php echo esc_attr( $form->id ); ?>" <?php FrmFormsHelper::maybe_hide_inline(); ?>>
110	<?php esc_html_e( 'If you are human, leave this field blank.', 'formidable' ); ?>
111	</label>
112	<input <?php FrmAppHelper::array_to_html_params( $input_attrs, true ); ?> <?php FrmFormsHelper::maybe_hide_inline(); ?> />
113	</div>
114	<?php
115	}
116
117	/**
118	* Generate a random class name for our honeypot so it is less easy to detect.
119	*
120	* @return string The generated class name.
121	*/
122	public static function generate_class_name() {
123	$class_name = self::get_honeypot_class_name();
124	if ( 'frm_verify' !== $class_name ) {
125	// Re-use the option.
126	// We can't generate a new class too often or the field may not be hidden.
127	return $class_name;
128	}
129
130	$prefix = 'frm__';
131	$class_name = $prefix . uniqid();
132	update_option( 'frm_honeypot_class', $class_name );
133	return $class_name;
134	}
135
136	/**
137	* @return string The current class name to use the for Honeypot field.
138	*/
139	private static function get_honeypot_class_name() {
140	$option = get_option( 'frm_honeypot_class' );
141	if ( ! is_string( $option ) ) {
142	// For backward compatibility use the old class name.
143	return 'frm_verify';
144	}
145	return $option;
146	}
147	}
148