PluginProbe
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More / 6.8
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More v6.8
6.35 6.34 6.33.1 6.33 6.32.1 6.32 6.31 6.25 6.25.1 6.26 6.26.1 6.27 6.28 6.29 6.3 6.3.1 6.3.2 6.30 6.4 6.4.1 6.4.2 6.5 6.5.1 6.5.2 6.5.3 All 141 releases
← All changes | classes/models/FrmEntryValidate.php +162 -454 6.346.8 View file →
@@ -5,18 +5,10 @@
5 5
6 6 class FrmEntryValidate {
7 7
8 8 /**
9 - * @since 6.17
10 - *
11 - * @var array|null
12 - */
13 - private static $name_text_fields;
14 -
15 - /**
16 9 * @param array $values
17 - * @param bool|string[] $exclude
18 - *
10 + * @param string[]|bool $exclude
19 11 * @return array
20 12 */
21 13 public static function validate( $values, $exclude = false ) {
22 14 FrmEntry::sanitize_entry_post( $values );
@@ -23,12 +15,13 @@
23 15 $errors = array();
24 16
25 17 if ( ! isset( $values['form_id'] ) || ! isset( $values['item_meta'] ) ) {
26 18 $errors['form'] = __( 'There was a problem with your submission. Please try again.', 'formidable' );
19 +
27 20 return $errors;
28 21 }
29 22
30 - if ( FrmAppHelper::is_admin() && is_user_logged_in() && ( ! isset( $values[ 'frm_submit_entry_' . $values['form_id'] ] ) || ! wp_verify_nonce( $values[ 'frm_submit_entry_' . $values['form_id'] ], 'frm_submit_entry_nonce' ) ) ) { // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
23 + if ( FrmAppHelper::is_admin() && is_user_logged_in() && ( ! isset( $values[ 'frm_submit_entry_' . $values['form_id'] ] ) || ! wp_verify_nonce( $values[ 'frm_submit_entry_' . $values['form_id'] ], 'frm_submit_entry_nonce' ) ) ) {
31 24 $frm_settings = FrmAppHelper::get_settings();
32 25 $errors['form'] = $frm_settings->admin_permission;
33 26 }
34 27
@@ -44,9 +37,9 @@
44 37 self::validate_field( $posted_field, $errors, $values, $args );
45 38 unset( $posted_field );
46 39 }
47 40
48 - if ( ! $errors ) {
41 + if ( empty( $errors ) ) {
49 42 self::spam_check( $exclude, $values, $errors );
50 43 }
51 44
52 45 /**
@@ -62,9 +55,9 @@
62 55
63 56 if ( is_array( $filtered_errors ) ) {
64 57 $errors = $filtered_errors;
65 58 } else {
66 - _doing_it_wrong( __METHOD__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
59 + _doing_it_wrong( __FUNCTION__, 'Only arrays should be returned when using the frm_validate_entry filter.', '6.3' );
67 60 }
68 61
69 62 return $errors;
70 63 }
@@ -83,30 +76,16 @@
83 76 $_POST['item_meta'] = array();
84 77 }
85 78 }
86 79
87 - /**
88 - * @param array $values
89 - *
90 - * @return void
91 - */
92 80 private static function set_item_key( &$values ) {
93 - // phpcs:ignore Universal.Operators.StrictComparisons
94 - if ( isset( $values['item_key'] ) && $values['item_key'] != '' ) {
95 - return;
81 + if ( ! isset( $values['item_key'] ) || $values['item_key'] == '' ) {
82 + global $wpdb;
83 + $values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
84 + $_POST['item_key'] = $values['item_key'];
96 85 }
97 -
98 - global $wpdb;
99 - $values['item_key'] = FrmAppHelper::get_unique_key( '', $wpdb->prefix . 'frm_items', 'item_key' );
100 - $_POST['item_key'] = $values['item_key'];
101 86 }
102 87
103 - /**
104 - * @param array $values
105 - * @param array|string $exclude
106 - *
107 - * @return array
108 - */
109 88 private static function get_fields_to_validate( $values, $exclude ) {
110 89 $where = apply_filters( 'frm_posted_field_ids', array( 'fi.form_id' => $values['form_id'] ) );
111 90
112 91 // Don't get subfields
@@ -112,9 +91,9 @@
112 91 // Don't get subfields
113 92 $where['fr.parent_form_id'] = array( null, 0 );
114 93
115 94 // Don't get excluded fields (like file upload fields in the ajax validation)
116 - if ( $exclude ) {
95 + if ( ! empty( $exclude ) ) {
117 96 $where['fi.type not'] = $exclude;
118 97 }
119 98
120 99 $fields = FrmField::getAll( $where, 'field_order' );
@@ -129,16 +108,8 @@
129 108 */
130 109 return apply_filters( 'frm_fields_to_validate', $fields, compact( 'values', 'exclude', 'where' ) );
131 110 }
132 111
133 - /**
134 - * @param object $posted_field
135 - * @param array $errors
136 - * @param array $values
137 - * @param array $args
138 - *
139 - * @return void
140 - */
141 112 public static function validate_field( $posted_field, &$errors, $values, $args = array() ) {
142 113 $defaults = array(
143 114 'id' => $posted_field->id,
144 115 // The id of the repeat or embed form.
@@ -148,18 +119,23 @@
148 119 // Exclude these field types from validation.
149 120 'exclude' => array(),
150 121
151 122 );
152 - $args = wp_parse_args( $args, $defaults );
153 - $value = ! empty( $args['parent_field_id'] ) ? $values : ( $values['item_meta'][ $args['id'] ] ?? '' );
123 + $args = wp_parse_args( $args, $defaults );
154 124
125 + if ( empty( $args['parent_field_id'] ) ) {
126 + $value = isset( $values['item_meta'][ $args['id'] ] ) ? $values['item_meta'][ $args['id'] ] : '';
127 + } else {
128 + // value is from a nested form
129 + $value = $values;
130 + }
131 +
155 132 // Check for values in "Other" fields
156 133 FrmEntriesHelper::maybe_set_other_validation( $posted_field, $value, $args );
157 134
158 135 self::maybe_clear_value_for_default_blank_setting( $posted_field, $value );
159 136
160 - $should_trim = is_array( $value ) && count( $value ) === 1 && isset( $value[0] ) && $posted_field->type !== 'checkbox';
161 -
137 + $should_trim = is_array( $value ) && count( $value ) == 1 && isset( $value[0] ) && $posted_field->type !== 'checkbox';
162 138 if ( $should_trim ) {
163 139 $value = reset( $value );
164 140 }
165 141
@@ -166,9 +142,8 @@
166 142 if ( ! is_array( $value ) ) {
167 143 $value = trim( $value );
168 144 }
169 145
170 - // phpcs:ignore Universal.Operators.StrictComparisons
171 146 if ( $posted_field->required == '1' && FrmAppHelper::is_empty_value( $value ) ) {
172 147 $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'blank' );
173 148 } elseif ( ! isset( $_POST['item_name'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
174 149 self::maybe_add_item_name( $value, $posted_field );
@@ -175,9 +150,8 @@
175 150 }
176 151
177 152 FrmEntriesHelper::set_posted_value( $posted_field, $value, $args );
178 153
179 - self::validate_options( $errors, $posted_field, $value, $args );
180 154 self::validate_field_types( $errors, $posted_field, $value, $args );
181 155
182 156 // Field might want to modify value before other parts of the system
183 157 // e.g. trim off excess values like in the case of fields with limit.
@@ -182,9 +156,8 @@
182 156 // Field might want to modify value before other parts of the system
183 157 // e.g. trim off excess values like in the case of fields with limit.
184 158 $value = apply_filters( 'frm_modify_posted_field_value', $value, $errors, $posted_field, $args );
185 159
186 - // phpcs:ignore Universal.Operators.StrictComparisons
187 160 if ( $value != '' ) {
188 161 self::validate_phone_field( $errors, $posted_field, $value, $args );
189 162 }
190 163
@@ -196,205 +169,17 @@
196 169 }
197 170 }
198 171
199 172 /**
200 - * @since 6.21
201 - *
202 - * @param array $errors
203 - * @param object $posted_field
204 - * @param array|string $value
205 - * @param array $args
206 - *
207 - * @return void
208 - */
209 - private static function validate_options( &$errors, $posted_field, $value, $args ) {
210 - if ( empty( $posted_field->options ) ) {
211 - return;
212 - }
213 -
214 - $option_is_valid = self::option_is_valid( $posted_field, $value, $posted_field->options );
215 -
216 - /**
217 - * @since 6.21
218 - *
219 - * @param bool $option_is_valid
220 - * @param array|string $value
221 - * @param object $field
222 - */
223 - $option_is_valid = (bool) apply_filters( 'frm_option_is_valid', $option_is_valid, $value, $posted_field );
224 -
225 - if ( ! $option_is_valid ) {
226 - $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $posted_field, 'invalid' );
227 - }
228 - }
229 -
230 - /**
231 - * Validate that value matches one of the options for the field.
232 - *
233 - * @since 6.21
234 - *
235 - * @param stdClass $field
236 - * @param array|string $value
237 - * @param array $options
238 - *
239 - * @return bool
240 - */
241 - private static function option_is_valid( $field, $value, $options ) { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
242 - if ( '' === $value ) {
243 - return true;
244 - }
245 -
246 - $field_object = FrmFieldFactory::get_field_type( $field->type, $field );
247 -
248 - if ( ! $field_object->field_type_has_options_settings() ) {
249 - return true;
250 - }
251 -
252 - if ( in_array( $field->type, array( 'likert', 'ranking' ), true ) ) {
253 - // Ignore these field types automatically.
254 - return true;
255 - }
256 -
257 - if ( 'product' === $field->type && 'user_def' === FrmField::get_option( $field, 'data_type' ) ) {
258 - return true;
259 - }
260 -
261 - if ( ! empty( $field->field_options['post_field'] ) ) {
262 - return true;
263 - }
264 -
265 - $value = (array) $value;
266 -
267 - foreach ( $value as $current_value ) {
268 - $match = false;
269 -
270 - foreach ( $options as $key => $option ) {
271 - if ( str_starts_with( $key, 'other_' ) ) {
272 - // Always return true if an other option is found.
273 - return true;
274 - }
275 -
276 - if ( is_array( $option ) ) {
277 - $separate_value = FrmField::get_option( $field, 'separate_value' );
278 - $option_value = $separate_value ? $option['value'] : $option['label'];
279 - } else {
280 - $option_value = $option;
281 - }
282 -
283 - /**
284 - * @var string $current_value
285 - */
286 - $match = trim( $current_value ) === trim( $option_value );
287 -
288 - if ( $match ) {
289 - break;
290 - }
291 -
292 - $match = trim( $current_value ) === trim( do_shortcode( $option_value ) );
293 -
294 - if ( $match ) {
295 - break;
296 - }
297 -
298 - $match = self::is_filtered_match( $current_value, $option_value );
299 -
300 - if ( $match ) {
301 - break;
302 - }
303 -
304 - if ( ! is_numeric( $current_value ) ) {
305 - continue;
306 - }
307 -
308 - $match = (int) $current_value === (int) $option_value;
309 -
310 - if ( $match ) {
311 - break;
312 - }
313 - }//end foreach
314 -
315 - if ( ! $match ) {
316 - return self::options_are_dynamic_based_on_hook( $field, $value );
317 - }
318 - }//end foreach
319 -
320 - return true;
321 - }
322 -
323 - /**
324 - * Make an extra check after passing $option_value through the_content filter.
325 - * This is to help catch cases where the option's formatting has been modified using
326 - * the_content filter.
327 - *
328 - * @since 6.22
329 - *
330 - * @param string $value
331 - * @param string $option_value
332 - *
333 - * @return bool
334 - */
335 - private static function is_filtered_match( $value, $option_value ) {
336 - // First remove the wpautop filter so it doesn't add extra tags to $option_value.
337 - $filter_priority = has_filter( 'the_content', 'wpautop' );
338 -
339 - if ( is_numeric( $filter_priority ) ) {
340 - remove_filter( 'the_content', 'wpautop', $filter_priority );
341 - }
342 -
343 - $filtered_option = apply_filters( 'the_content', $option_value );
344 -
345 - if ( is_numeric( $filter_priority ) ) {
346 - add_filter( 'the_content', 'wpautop', $filter_priority );
347 - }
348 -
349 - return trim( $value ) === trim( $filtered_option );
350 - }
351 -
352 - /**
353 - * Do not validate options if they have been modified with a hook.
354 - * This is to help avoid issues where the options could be based on a URL param for example.
355 - *
356 - * @since 6.21
357 - *
358 - * @param object $field_object The field object.
359 - * @param array|string $value The value to validate.
360 - *
361 - * @return bool
362 - */
363 - private static function options_are_dynamic_based_on_hook( $field_object, $value ) {
364 - $values = (array) $field_object;
365 - $values['value'] = $value;
366 - FrmFieldsHelper::prepare_new_front_field( $values, $field_object );
367 -
368 - $separate_value = FrmField::get_option( $field_object, 'separate_value' );
369 - $map_callback = function ( $option ) use ( $separate_value ) {
370 - if ( is_array( $option ) ) {
371 - $option_value = $separate_value ? $option['value'] : $option['label'];
372 - } else {
373 - $option_value = $option;
374 - }
375 - return do_shortcode( $option_value );
376 - };
377 -
378 - $values_options = array_map( $map_callback, $values['options'] );
379 - $field_object_options = array_map( $map_callback, $field_object->options );
380 -
381 - return $values_options !== $field_object_options;
382 - }
383 -
384 - /**
385 173 * Maybe add item_name to $_POST to save it in items table.
386 174 *
387 175 * @since 5.2.02
388 176 *
389 - * @param array|string $value Field value.
177 + * @param string|array $value Field value.
390 178 * @param object $field Field object.
391 - *
392 - * @return void
393 179 */
394 180 private static function maybe_add_item_name( $value, $field ) {
395 181 $item_name = false;
396 -
397 182 if ( 'name' === $field->type ) {
398 183 $field_obj = FrmFieldFactory::get_field_object( $field );
399 184 $item_name = $field_obj->get_display_value( $value );
400 185 } elseif ( 'text' === $field->type ) {
@@ -402,9 +187,9 @@
402 187 }
403 188
404 189 if ( false !== $item_name ) {
405 190 // Item name has a max length of 255 characters so truncate it so it doesn't fail to save in the database.
406 - $_POST['item_name'] = FrmAppHelper::truncate( $item_name, 255, 1, '', true );
191 + $_POST['item_name'] = substr( $item_name, 0, 255 );
407 192 }
408 193 }
409 194
410 195 /**
@@ -411,14 +196,11 @@
411 196 * Set $value to an empty string if it matches its label
412 197 *
413 198 * @param object $field
414 199 * @param string $value
415 - *
416 - * @return void
417 200 */
418 201 private static function maybe_clear_value_for_default_blank_setting( $field, &$value ) {
419 202 $position = FrmField::get_option( $field, 'label' );
420 -
421 203 if ( ! $position ) {
422 204 $position = FrmStylesController::get_style_val( 'position', $field->form_id );
423 205 }
424 206
@@ -426,16 +208,8 @@
426 208 $value = '';
427 209 }
428 210 }
429 211
430 - /**
431 - * @param array $errors
432 - * @param object $posted_field
433 - * @param mixed $value
434 - * @param array $args
435 - *
436 - * @return void
437 - */
438 212 public static function validate_field_types( &$errors, $posted_field, $value, $args ) {
439 213 $field_obj = FrmFieldFactory::get_field_object( $posted_field );
440 214 $args['value'] = $value;
441 215 $args['errors'] = $errors;
@@ -440,41 +214,24 @@
440 214 $args['value'] = $value;
441 215 $args['errors'] = $errors;
442 216
443 217 $new_errors = $field_obj->validate( $args );
444 -
445 - if ( $new_errors ) {
218 + if ( ! empty( $new_errors ) ) {
446 219 $errors = array_merge( $errors, $new_errors );
447 220 }
448 221 }
449 222
450 - /**
451 - * @param array $errors
452 - * @param object $field
453 - * @param string $value
454 - * @param array $args
455 - *
456 - * @return void
457 - */
458 223 public static function validate_phone_field( &$errors, $field, $value, $args ) {
459 - $format_value = FrmField::get_option( $field, 'format' );
224 + if ( $field->type == 'phone' || ( $field->type == 'text' && FrmField::is_option_true_in_object( $field, 'format' ) ) ) {
460 225
461 - if ( $field->type !== 'phone' && ( $field->type !== 'text' || ! $format_value || FrmCurrencyHelper::is_currency_format( $format_value ) ) ) {
462 - return;
463 - }
226 + $pattern = self::phone_format( $field );
464 227
465 - $pattern = self::phone_format( $field );
466 -
467 - if ( ! preg_match( $pattern, $value ) ) {
468 - $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $field, 'invalid' );
228 + if ( ! preg_match( $pattern, $value ) ) {
229 + $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $field, 'invalid' );
230 + }
469 231 }
470 232 }
471 233
472 - /**
473 - * @param object $field
474 - *
475 - * @return string
476 - */
477 234 public static function phone_format( $field ) {
478 235 if ( FrmField::is_option_empty( $field, 'format' ) ) {
479 236 $pattern = self::default_phone_format();
480 237 } else {
@@ -480,25 +237,22 @@
480 237 } else {
481 238 $pattern = FrmField::get_option( $field, 'format' );
482 239 }
483 240
484 - // Ampersands are saved as &.
485 - // Reverse it here so we are checking for the correct character.
486 - $pattern = html_entity_decode( $pattern );
487 241 $pattern = apply_filters( 'frm_phone_pattern', $pattern, $field );
488 242
489 243 // Create a regexp if format is not already a regexp
490 - if ( ! str_starts_with( $pattern, '^' ) ) {
244 + if ( strpos( $pattern, '^' ) !== 0 ) {
491 245 $pattern = self::create_regular_expression_from_format( $pattern );
492 246 }
493 247
494 - return '/' . $pattern . '/';
248 + $pattern = '/' . $pattern . '/';
249 +
250 + return $pattern;
495 251 }
496 252
497 253 /**
498 254 * @since 3.01
499 - *
500 - * @return string
501 255 */
502 256 private static function default_phone_format() {
503 257 return '^((\+\d{1,3}(-|.| )?\(?\d\)?(-| |.)?\d{1,5})|(\(?\d{2,6}\)?))(-|.| )?(\d{3,4})(-|.| )?(\d{4})(( x| ext)\d{1,5}){0,1}$';
504 258 }
@@ -524,57 +278,44 @@
524 278 $pattern = str_replace( 'a', '[a-zA-Z]', $pattern );
525 279 $pattern = str_replace( '*', 'w', $pattern );
526 280 $pattern = str_replace( '/', '\/', $pattern );
527 281
528 - if ( str_contains( $pattern, '\?' ) ) {
282 + if ( strpos( $pattern, '\?' ) !== false ) {
529 283 $parts = explode( '\?', $pattern );
530 284 $pattern = '';
531 -
532 285 foreach ( $parts as $part ) {
533 - if ( $pattern ) {
286 + if ( empty( $pattern ) ) {
287 + $pattern .= $part;
288 + } else {
534 289 $pattern .= '(' . $part . ')?';
535 - } else {
536 - $pattern .= $part;
537 290 }
538 291 }
539 292 }
293 + $pattern = '^' . $pattern . '$';
540 294
541 - return '^' . $pattern . '$';
295 + return $pattern;
542 296 }
543 297
544 298 /**
545 - * Check for spam.
299 + * Check for spam
546 300 *
547 - * @param bool $exclude
548 - * @param array $values
549 - * @param array $errors By reference.
550 - *
551 - * @return void
301 + * @param boolean $exclude
302 + * @param array $values
303 + * @param array $errors By reference.
552 304 */
553 305 public static function spam_check( $exclude, $values, &$errors ) {
554 - if ( defined( 'WP_IMPORTING' ) && WP_IMPORTING ) {
555 - // Do not check spam on importing.
306 + if ( ! empty( $exclude ) || ! isset( $values['item_meta'] ) || empty( $values['item_meta'] ) || ! empty( $errors ) ) {
307 + // only check spam if there are no other errors
556 308 return;
557 309 }
558 310
559 - if ( $exclude || empty( $values['item_meta'] ) || $errors ) {
560 - // Only check spam if there are no other errors
561 - return;
562 - }
563 -
564 311 $antispam_check = self::is_antispam_check( $values['form_id'] );
565 - $spam_msg = FrmAntiSpamController::get_default_spam_message();
566 -
567 312 if ( is_string( $antispam_check ) ) {
568 313 $errors['spam'] = $antispam_check;
569 314 } elseif ( self::is_honeypot_spam( $values ) || self::is_spam_bot() ) {
570 - $errors['spam'] = $spam_msg;
571 - } else {
572 - $is_spam = FrmAntiSpamController::is_spam( $values );
573 -
574 - if ( $is_spam ) {
575 - $errors['spam'] = $is_spam;
576 - }
315 + $errors['spam'] = __( 'Your entry appears to be spam!', 'formidable' );
316 + } elseif ( self::blacklist_check( $values ) ) {
317 + $errors['spam'] = __( 'Your entry appears to be blocked spam!', 'formidable' );
577 318 }
578 319
579 320 if ( isset( $errors['spam'] ) || self::form_is_in_progress( $values ) ) {
580 321 return;
@@ -590,17 +331,14 @@
590 331 *
591 332 * @since 5.0.13
592 333 *
593 334 * @param array $values The values.
594 - *
595 335 * @return bool
596 336 */
597 337 private static function form_is_in_progress( $values ) {
598 - // phpcs:disable Generic.WhiteSpace.ScopeIndent
599 338 return FrmAppHelper::pro_is_installed() &&
600 339 ( isset( $values[ 'frm_page_order_' . $values['form_id'] ] ) || FrmAppHelper::get_post_param( 'frm_next_page' ) ) &&
601 340 FrmField::get_all_types_in_form( $values['form_id'], 'break' );
602 - // phpcs:enable Generic.WhiteSpace.ScopeIndent
603 341 }
604 342
605 343 /**
606 344 * @param int $form_id
@@ -613,10 +351,9 @@
613 351 }
614 352
615 353 /**
616 354 * @param array $values
617 - *
618 - * @return bool
355 + * @return boolean
619 356 */
620 357 private static function is_honeypot_spam( $values ) {
621 358 $honeypot = new FrmHoneypot( $values['form_id'] );
622 359 return ! $honeypot->validate();
@@ -622,51 +359,87 @@
622 359 return ! $honeypot->validate();
623 360 }
624 361
625 362 /**
626 - * @return bool
363 + * @return boolean
627 364 */
628 365 private static function is_spam_bot() {
629 - return ! FrmAppHelper::get_ip_address();
366 + $ip = FrmAppHelper::get_ip_address();
367 +
368 + return empty( $ip );
630 369 }
631 370
632 371 /**
633 372 * @param array $values
634 - *
635 - * @return bool
373 + * @return boolean
636 374 */
637 375 private static function is_akismet_spam( $values ) {
638 376 global $wpcom_api_key;
639 - return is_callable( 'Akismet::http_post' ) && ( get_option( 'wordpress_api_key' ) || $wpcom_api_key ) && self::akismet( $values );
377 +
378 + return ( is_callable( 'Akismet::http_post' ) && ( get_option( 'wordpress_api_key' ) || $wpcom_api_key ) && self::akismet( $values ) );
640 379 }
641 380
642 381 /**
643 382 * @param int $form_id
644 - *
645 383 * @return bool
646 384 */
647 385 private static function is_akismet_enabled_for_user( $form_id ) {
648 386 $form = FrmForm::getOne( $form_id );
649 - return ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() );
387 +
388 + return ( ! empty( $form->options['akismet'] ) && ( $form->options['akismet'] !== 'logged' || ! is_user_logged_in() ) );
650 389 }
651 390
391 + public static function blacklist_check( $values ) {
392 + if ( ! apply_filters( 'frm_check_blacklist', true, $values ) ) {
393 + return false;
394 + }
395 +
396 + $mod_keys = trim( self::get_disallowed_words() );
397 + if ( empty( $mod_keys ) ) {
398 + return false;
399 + }
400 +
401 + $content = FrmEntriesHelper::entry_array_to_string( $values );
402 +
403 + self::prepare_values_for_spam_check( $values );
404 + $ip = FrmAppHelper::get_ip_address();
405 + $user_agent = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
406 + $user_info = self::get_spam_check_user_info( $values );
407 +
408 + return self::check_disallowed_words( $user_info['comment_author'], $user_info['comment_author_email'], $user_info['comment_author_url'], $content, $ip, $user_agent );
409 + }
410 +
652 411 /**
653 - * Checks spam using WordPress disallowed words and Frm denylist.
412 + * For WP 5.5 compatibility.
654 413 *
655 - * @param array $values Entry values.
414 + * @since 4.06.02
415 + */
416 + private static function check_disallowed_words( $author, $email, $url, $content, $ip, $user_agent ) {
417 + if ( function_exists( 'wp_check_comment_disallowed_list' ) ) {
418 + return wp_check_comment_disallowed_list( $author, $email, $url, $content, $ip, $user_agent );
419 + } else {
420 + return wp_blacklist_check( $author, $email, $url, $content, $ip, $user_agent );
421 + }
422 + }
423 +
424 + /**
425 + * For WP 5.5 compatibility.
656 426 *
657 - * @return bool
427 + * @since 4.06.02
658 428 */
659 - public static function blacklist_check( $values ) {
660 - return FrmAntiSpamController::contains_wp_disallowed_words( $values ) || FrmAntiSpamController::is_denylist_spam( $values );
429 + private static function get_disallowed_words() {
430 + $keys = get_option( 'disallowed_keys' );
431 + if ( false === $keys ) {
432 + // Fallback for WP < 5.5.
433 + $keys = get_option( 'blacklist_keys' );
434 + }
435 + return $keys;
661 436 }
662 437
663 438 /**
664 439 * Check entries for Akismet spam
665 440 *
666 - * @param array $values Entry values.
667 - *
668 - * @return bool true if is spam
441 + * @return boolean true if is spam
669 442 */
670 443 public static function akismet( $values ) {
671 444 if ( empty( $values['item_meta'] ) ) {
672 445 return false;
@@ -688,18 +461,13 @@
688 461
689 462 $query_string = _http_build_query( $datas, '', '&' );
690 463 $response = Akismet::http_post( $query_string, 'comment-check' );
691 464
692 - return is_array( $response ) && $response[1] === 'true';
465 + return ( is_array( $response ) && $response[1] == 'true' );
693 466 }
694 467
695 468 /**
696 469 * @since 2.0
697 - *
698 - * @param array $datas The array of values being sent to Akismet.
699 - * @param array $values Entry values.
700 - *
701 - * @return void
702 470 */
703 471 private static function parse_akismet_array( &$datas, $values ) {
704 472 self::add_site_info_to_akismet( $datas );
705 473 self::add_server_values_to_akismet( $datas );
@@ -704,19 +472,13 @@
704 472 self::add_site_info_to_akismet( $datas );
705 473 self::add_server_values_to_akismet( $datas );
706 474
707 475 self::prepare_values_for_spam_check( $values );
708 - self::skip_adding_values_to_akismet( $values );
709 476
710 477 self::add_user_info_to_akismet( $datas, $values );
711 478 self::add_comment_content_to_akismet( $datas, $values );
712 479 }
713 480
714 - /**
715 - * @param array $datas
716 - *
717 - * @return void
718 - */
719 481 private static function add_site_info_to_akismet( &$datas ) {
720 482 $datas['blog'] = FrmAppHelper::site_url();
721 483 $datas['user_ip'] = preg_replace( '/[^0-9., ]/', '', FrmAppHelper::get_ip_address() );
722 484 $datas['user_agent'] = FrmAppHelper::get_server_value( 'HTTP_USER_AGENT' );
@@ -728,14 +490,8 @@
728 490 $datas['is_test'] = 'true';
729 491 }
730 492 }
731 493
732 - /**
733 - * @param array $datas
734 - * @param array $values
735 - *
736 - * @return void
737 - */
738 494 private static function add_user_info_to_akismet( &$datas, $values ) {
739 495 $user_info = self::get_spam_check_user_info( $values );
740 496 $datas = $datas + $user_info;
741 497
@@ -747,15 +503,13 @@
747 503 /**
748 504 * Gets user info for Akismet spam check.
749 505 *
750 506 * @since 5.0.13 Separate code for guest. Handle value of embedded|repeater.
751 - * @since 6.21 This changed from private to public.
752 507 *
753 508 * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
754 - *
755 509 * @return array
756 510 */
757 - public static function get_spam_check_user_info( $values ) {
511 + private static function get_spam_check_user_info( $values ) {
758 512 if ( ! is_user_logged_in() ) {
759 513 return self::get_spam_check_user_info_for_guest( $values );
760 514 }
761 515
@@ -775,9 +529,8 @@
775 529 *
776 530 * @since 5.0.13
777 531 *
778 532 * @param array $values Entry values after flattened.
779 - *
780 533 * @return array
781 534 */
782 535 private static function get_spam_check_user_info_for_guest( $values ) {
783 536 $datas = array(
@@ -809,10 +562,8 @@
809 562 *
810 563 * @param array $datas Guest data.
811 564 * @param array $values The values.
812 565 * @param int|null $custom_index Custom index (or field ID).
813 - *
814 - * @return void
815 566 */
816 567 private static function recursive_add_akismet_guest_info( &$datas, $values, $custom_index = null ) {
817 568 foreach ( $values as $index => $value ) {
818 569 if ( ! $datas['missing_keys'] ) {
@@ -825,19 +576,15 @@
825 576 continue;
826 577 }
827 578
828 579 $field_id = ! is_null( $custom_index ) ? $custom_index : $index;
829 -
830 580 foreach ( $datas['missing_keys'] as $key_index => $key ) {
831 - $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'], $values );
832 -
833 - if ( ! $found ) {
834 - continue;
581 + $found = self::is_akismet_guest_info_value( $key, $value, $field_id, $datas['name_field_ids'] );
582 + if ( $found ) {
583 + $datas[ $key ] = $value;
584 + $datas['frm_duplicated'][] = $field_id;
585 + unset( $datas['missing_keys'][ $key_index ] );
835 586 }
836 -
837 - $datas[ $key ] = $value;
838 - $datas['frm_duplicated'][] = $field_id;
839 - unset( $datas['missing_keys'][ $key_index ] );
840 587 }
841 588 }//end foreach
842 589 }
843 590
@@ -849,13 +596,11 @@
849 596 * @param string $key Guest info key.
850 597 * @param string $value Value to check.
851 598 * @param int $field_id Field ID.
852 599 * @param array $name_field_ids Name field IDs.
853 - * @param array $values Array of posted values.
854 - *
855 600 * @return bool
856 601 */
857 - private static function is_akismet_guest_info_value( $key, &$value, $field_id, $name_field_ids, $values ) {
602 + private static function is_akismet_guest_info_value( $key, $value, $field_id, $name_field_ids ) {
858 603 if ( ! $value || is_numeric( $value ) ) {
859 604 return false;
860 605 }
861 606
@@ -860,79 +605,24 @@
860 605 }
861 606
862 607 switch ( $key ) {
863 608 case 'comment_author_email':
864 - return str_contains( $value, '@' ) && is_email( $value );
609 + return strpos( $value, '@' ) && is_email( $value );
865 610
866 611 case 'comment_author_url':
867 - return str_starts_with( $value, 'http' );
612 + return 0 === strpos( $value, 'http' );
868 613
869 614 case 'comment_author':
870 - if ( $name_field_ids && in_array( $field_id, $name_field_ids, true ) ) {
615 + if ( $name_field_ids ) {
871 616 // If there is name field in the form, we should always use it as author name.
872 - return true;
617 + return in_array( $field_id, $name_field_ids, true );
873 618 }
619 + return strlen( $value ) < 200;
620 + }
874 621
875 - $form_id = FrmAppHelper::get_post_param( 'form_id', 0, 'absint' );
876 - $fields = self::get_name_text_fields( $form_id );
877 -
878 - foreach ( $fields as $index => $field ) {
879 - if ( 'Name' !== $field->name ) {
880 - continue;
881 - }
882 -
883 - if ( isset( $fields[ $index + 1 ] ) && 'Last' === $fields[ $index + 1 ]->name ) {
884 - if ( empty( $values[ absint( $fields[ $index + 1 ]->id ) ] ) ) {
885 - continue;
886 - }
887 -
888 - $value .= ' ' . $values[ $fields[ $index + 1 ]->id ];
889 - return true;
890 - }
891 - }
892 - }//end switch
893 -
894 622 return false;
895 623 }
896 624
897 - /**
898 - * Returns fields that have 'Name' and 'Last' as their name.
899 - *
900 - * @since 6.17
901 - *
902 - * @param int $form_id
903 - *
904 - * @return array
905 - */
906 - private static function get_name_text_fields( $form_id ) {
907 - $name_text_fields_is_initialized = is_array( self::$name_text_fields );
908 -
909 - if ( $name_text_fields_is_initialized && isset( self::$name_text_fields[ $form_id ] ) ) {
910 - return self::$name_text_fields[ $form_id ];
911 - }
912 -
913 - if ( ! $name_text_fields_is_initialized ) {
914 - self::$name_text_fields = array();
915 - }
916 - self::$name_text_fields[ $form_id ] = FrmDb::get_results(
917 - 'frm_fields',
918 - array(
919 - 'form_id' => $form_id,
920 - 'type' => 'text',
921 - 'name' => array( 'Name', 'Last' ),
922 - ),
923 - 'id,name',
924 - array( 'order_by' => 'field_order ASC' )
925 - );
926 -
927 - return self::$name_text_fields[ $form_id ];
928 - }
929 -
930 - /**
931 - * @param array $datas
932 - *
933 - * @return void
934 - */
935 625 private static function add_server_values_to_akismet( &$datas ) {
936 626 foreach ( $_SERVER as $key => $value ) {
937 627 $include_value = is_string( $value ) && ! preg_match( '/^HTTP_COOKIE/', $key ) && preg_match( '/^(HTTP_|REMOTE_ADDR|REQUEST_URI|DOCUMENT_URI)/', $key );
938 628
@@ -950,10 +640,8 @@
950 640 * @since 5.0.09
951 641 *
952 642 * @param array $datas The array of values being sent to Akismet.
953 643 * @param array $values Entry values.
954 - *
955 - * @return void
956 644 */
957 645 private static function add_comment_content_to_akismet( &$datas, $values ) {
958 646 if ( isset( $datas['frm_duplicated'] ) ) {
959 647 foreach ( $datas['frm_duplicated'] as $index ) {
@@ -965,8 +653,10 @@
965 653 }
966 654 unset( $datas['frm_duplicated'] );
967 655 }
968 656
657 + self::skip_adding_values_to_akismet( $values );
658 +
969 659 $datas['comment_content'] = FrmEntriesHelper::entry_array_to_string( $values );
970 660 }
971 661
972 662 /**
@@ -974,28 +664,22 @@
974 664 *
975 665 * @since 5.0.09
976 666 *
977 667 * @param array $values Entry values.
978 - *
979 - * @return void
980 668 */
981 669 private static function skip_adding_values_to_akismet( &$values ) {
982 670 $skipped_fields = self::get_akismet_skipped_field_ids( $values );
983 -
984 671 foreach ( $skipped_fields as $skipped_field ) {
985 672 if ( ! isset( $values['item_meta'][ $skipped_field->id ] ) ) {
986 673 continue;
987 674 }
988 675
989 - if ( ! self::should_really_skip_field( $skipped_field, $values ) ) {
990 - continue;
676 + if ( self::should_really_skip_field( $skipped_field, $values ) ) {
677 + unset( $values['item_meta'][ $skipped_field->id ] );
678 + if ( isset( $values['item_meta']['other'][ $skipped_field->id ] ) ) {
679 + unset( $values['item_meta']['other'][ $skipped_field->id ] );
680 + }
991 681 }
992 -
993 - unset( $values['item_meta'][ $skipped_field->id ] );
994 -
995 - if ( isset( $values['item_meta']['other'][ $skipped_field->id ] ) ) {
996 - unset( $values['item_meta']['other'][ $skipped_field->id ] );
997 - }
998 682 }
999 683 }
1000 684
1001 685 /**
@@ -1004,9 +688,8 @@
1004 688 * @since 5.02.04
1005 689 *
1006 690 * @param object $field_data Object contains `id` and `options`.
1007 691 * @param array $values Entry values.
1008 - *
1009 692 * @return bool
1010 693 */
1011 694 private static function should_really_skip_field( $field_data, $values ) {
1012 695 if ( empty( $field_data->options ) ) {
@@ -1014,18 +697,18 @@
1014 697 return true;
1015 698 }
1016 699
1017 700 FrmAppHelper::unserialize_or_decode( $field_data->options );
1018 -
1019 701 if ( ! $field_data->options ) {
1020 702 // Check if an error happens when unserializing, or empty options.
1021 703 return true;
1022 704 }
1023 705
1024 - $last_key = array_key_last( $field_data->options );
706 + end( $field_data->options );
707 + $last_key = key( $field_data->options );
1025 708
1026 709 // If a choice field has no Other option.
1027 - if ( is_numeric( $last_key ) || ! str_starts_with( $last_key, 'other_' ) ) {
710 + if ( is_numeric( $last_key ) || 0 !== strpos( $last_key, 'other_' ) ) {
1028 711 return true;
1029 712 }
1030 713
1031 714 // If a choice field has Other option, but Other is not selected.
@@ -1034,10 +717,9 @@
1034 717 }
1035 718
1036 719 // Check if submitted value is same as one of field option.
1037 720 foreach ( $field_data->options as $option ) {
1038 - $option_value = is_array( $option ) ? ( $option['value'] ?? '' ) : $option;
1039 -
721 + $option_value = ! is_array( $option ) ? $option : ( isset( $option['value'] ) ? $option['value'] : '' );
1040 722 if ( $values['item_meta']['other'][ $field_data->id ] === $option_value ) {
1041 723 return true;
1042 724 }
1043 725 }
@@ -1052,9 +734,8 @@
1052 734 * @since 5.0.13 Move out get_all_form_ids_and_flatten_meta() call and get `form_ids` from `$values`.
1053 735 * @since 5.2.04 This method returns array of object contains `id` and `options` instead of array of `id` only.
1054 736 *
1055 737 * @param array $values Entry values after running through {@see FrmEntryValidate::prepare_values_for_spam_check()}.
1056 - *
1057 738 * @return array
1058 739 */
1059 740 private static function get_akismet_skipped_field_ids( $values ) {
1060 741 if ( empty( $values['form_ids'] ) ) {
@@ -1077,16 +758,14 @@
1077 758 /**
1078 759 * Prepares values array for spam check.
1079 760 *
1080 761 * @since 5.0.13
1081 - * @since 6.21 This changed from private to public.
1082 762 *
1083 763 * @param array $values Entry values.
1084 - *
1085 - * @return void
1086 764 */
1087 - public static function prepare_values_for_spam_check( &$values ) {
1088 - $values['form_ids'] = self::get_all_form_ids_and_flatten_meta( $values );
765 + private static function prepare_values_for_spam_check( &$values ) {
766 + $form_ids = self::get_all_form_ids_and_flatten_meta( $values );
767 + $values['form_ids'] = $form_ids;
1089 768 }
1090 769
1091 770 /**
1092 771 * Gets all form IDs (include child form IDs) and flatten item_meta array. Used for skipping values sent to Akismet.
@@ -1095,17 +774,15 @@
1095 774 * @since 5.0.09
1096 775 * @since 5.0.13 Convert name field value to string.
1097 776 *
1098 777 * @param array $values Entry values.
1099 - *
1100 778 * @return array Form IDs.
1101 779 */
1102 - private static function get_all_form_ids_and_flatten_meta( &$values ) { // phpcs:ignore SlevomatCodingStandard.Complexity.Cognitive.ComplexityTooHigh
780 + private static function get_all_form_ids_and_flatten_meta( &$values ) {
1103 781 $values['name_field_ids'] = array();
1104 782
1105 783 // Blacklist check for File field in the old version doesn't contain `form_id`.
1106 784 $form_ids = isset( $values['form_id'] ) ? array( absint( $values['form_id'] ) ) : array();
1107 -
1108 785 foreach ( $values['item_meta'] as $field_id => $value ) {
1109 786 if ( ! is_numeric( $field_id ) ) {
1110 787 // Maybe `other`.
1111 788 continue;
@@ -1139,15 +816,14 @@
1139 816 }
1140 817
1141 818 // Convert name array to string.
1142 819 if ( isset( $subsubvalue['first'] ) && isset( $subsubvalue['last'] ) ) {
1143 - $subsubvalue = trim( implode( ' ', $subsubvalue ) );
820 + $subsubvalue = trim( implode( ' ', $subsubvalue ) );
821 +
1144 822 $values['name_field_ids'][] = $subsubindex;
1145 823 }
1146 824
1147 - if ( is_array( $values['item_meta'][ $subsubindex ] ) ) {
1148 - $values['item_meta'][ $subsubindex ][] = $subsubvalue;
1149 - }
825 + $values['item_meta'][ $subsubindex ][] = $subsubvalue;
1150 826 }
1151 827 }//end foreach
1152 828
1153 829 unset( $values['item_meta'][ $field_id ] );
@@ -1153,6 +829,38 @@
1153 829 unset( $values['item_meta'][ $field_id ] );
1154 830 }//end foreach
1155 831
1156 832 return $form_ids;
833 + }
834 +
835 + /**
836 + * @deprecated 3.0
837 + * @codeCoverageIgnore
838 + */
839 + public static function validate_url_field( &$errors, $field, $value, $args ) {
840 + FrmDeprecated::validate_url_field( $errors, $field, $value, $args );
841 + }
842 +
843 + /**
844 + * @deprecated 3.0
845 + * @codeCoverageIgnore
846 + */
847 + public static function validate_email_field( &$errors, $field, $value, $args ) {
848 + FrmDeprecated::validate_email_field( $errors, $field, $value, $args );
849 + }
850 +
851 + /**
852 + * @deprecated 3.0
853 + * @codeCoverageIgnore
854 + */
855 + public static function validate_number_field( &$errors, $field, $value, $args ) {
856 + FrmDeprecated::validate_number_field( $errors, $field, $value, $args );
857 + }
858 +
859 + /**
860 + * @deprecated 3.0
861 + * @codeCoverageIgnore
862 + */
863 + public static function validate_recaptcha( &$errors, $field, $args ) {
864 + FrmDeprecated::validate_recaptcha( $errors, $field, $args );
1157 865 }
1158 866 }