← All changes | classes/models/fields/FrmFieldCaptcha.php +190 -98 6.5.2 → trunk View file →

		@@ -9,8 +9,9 @@
9	9	class FrmFieldCaptcha extends FrmFieldType {
10	10
11	11	/**
12	12	* @var string
	13	+ *
13	14	* @since 3.0
14	15	*/
15	16	protected $type = 'captcha';
16	17
		@@ -28,15 +29,10 @@
28	29	*/
29	30	public static function get_captcha_image_name() {
30	31	$frm_settings = FrmAppHelper::get_settings();
31	32	$active_captcha = $frm_settings->active_captcha;
32		- if ( $active_captcha === 'recaptcha' && $frm_settings->re_type === 'v3' ) {
33		- $image_name = 'recaptcha_v3';
34		- } else {
35		- $image_name = $active_captcha;
36		- }
37	33
38		- return $image_name;
	34	+ return $active_captcha === 'recaptcha' && $frm_settings->re_type === 'v3' ? 'recaptcha_v3' : $active_captcha;
39	35	}
40	36
41	37	/**
42	38	* @return array
		@@ -41,13 +37,16 @@
41	37	/**
42	38	* @return array
43	39	*/
44	40	protected function field_settings_for_type() {
	41	+ $settings = FrmCaptchaFactory::get_settings_object();
45	42	return array(
46		- 'required' => false,
47		- 'invalid' => true,
48		- 'captcha_size' => true,
49		- 'default' => false,
	43	+ 'required' => false,
	44	+ 'invalid' => true,
	45	+ 'captcha_size' => $settings->should_show_captcha_size(),
	46	+ 'captcha_theme' => $settings->should_show_captcha_theme(),
	47	+ 'captcha_theme_auto_option' => $settings->should_show_captcha_theme_auto_option(),
	48	+ 'default' => false,
50	49	);
51	50	}
52	51
53	52	/**
		@@ -72,97 +71,159 @@
72	71	);
73	72	}
74	73
75	74	/**
76		- * Remove the "for" attribute for captcha
	75	+ * Modify the captcha field label so it is not orphaned.
77	76	*
78		- * @param array $args
	77	+ * The label is omitted when the label position is set to "none".
	78	+ * When the label is visible it is rendered as a <span> instead of a <label>,
	79	+ * since the captcha response input is inside an iframe and cannot be referenced.
	80	+ *
	81	+ * @param array $args
79	82	* @param string $html
80	83	*
81	84	* @return string
82	85	*/
83	86	protected function before_replace_html_shortcodes( $args, $html ) {
84		- $frm_settings = FrmAppHelper::get_settings();
85		- $replace_response = $frm_settings->active_captcha === 'recaptcha' ? 'g-recaptcha-response' : 'h-captcha-response';
86		- $replaced_for = str_replace( ' for="field_[key]"', ' for="' . $replace_response . '"', $html );
	87	+ if ( 'none' === FrmField::get_option( $this->field, 'label' ) ) {
	88	+ // Fully strip the label for a CAPTCHA if it is set to hidden.
	89	+ return preg_replace( '~\s*<label\b[^>]*for="field_\[key\]"[^>]*>.*?</label>\s*~s', '', $html );
	90	+ }
87	91
88		- return $replaced_for;
	92	+ // Convert a CAPTCHA label to a span to prevent an orphaned label issue in WAVE.
	93	+ return preg_replace(
	94	+ '~<label\b([^>]*?)\s*for="field_\[key\]"([^>]*?)>(.*?)</label>~s',
	95	+ '<span$1$2>$3</span>',
	96	+ $html
	97	+ );
89	98	}
90	99
91	100	/**
	101	+ * @param array $args
	102	+ * @param array $shortcode_atts
	103	+ *
92	104	* @return string
93	105	*/
94	106	public function front_field_input( $args, $shortcode_atts ) {
95		- $frm_settings = FrmAppHelper::get_settings();
96	107	if ( ! self::should_show_captcha() ) {
97	108	return '';
98	109	}
99	110
100		- $class_prefix = $this->class_prefix( $frm_settings );
101		- $captcha_class = $this->captcha_class( $frm_settings );
102		- $captcha_size = $this->captcha_size( $frm_settings );
103		- $allow_mutiple = $frm_settings->re_multi;
	111	+ $frm_settings = FrmAppHelper::get_settings();
	112	+ $settings = FrmCaptchaFactory::get_settings_object();
	113	+ $div_attributes = array(
	114	+ 'id' => $args['html_id'],
	115	+ 'class' => $this->class_prefix( $frm_settings ) . $this->captcha_class( $frm_settings ),
	116	+ 'data-sitekey' => $settings->get_pubkey(),
	117	+ );
104	118
105		- if ( $frm_settings->active_captcha === 'recaptcha' ) {
106		- $site_key = $frm_settings->pubkey;
107		- $recaptcha_options = ' data-size="' . esc_attr( $captcha_size ) . '" data-theme="' . esc_attr( $this->field['captcha_theme'] ) . '"';
108		- } else {
109		- $site_key = $frm_settings->hcaptcha_pubkey;
	119	+ if ( 'turnstile' === $frm_settings->active_captcha ) {
	120	+ $captcha_language = $this->get_captcha_language();
	121	+
	122	+ if ( $captcha_language ) {
	123	+ $div_attributes['data-language'] = $captcha_language;
	124	+ }
110	125	}
111	126
112		- $html = '<div id="' . esc_attr( $args['html_id'] ) . '" class="' . esc_attr( $class_prefix ) . $captcha_class . '" data-sitekey="' . esc_attr( $site_key ) . '"';
113		- $html .= ! empty( $recaptcha_options ) ? $recaptcha_options : '';
114		- if ( $captcha_size === 'invisible' && ! $allow_mutiple ) {
115		- $html .= ' data-callback="frmAfterRecaptcha"';
116		- }
117		- $html .= '></div>';
	127	+ $div_attributes = $settings->add_front_end_element_attributes( $div_attributes, $this->field );
118	128
119		- return $html;
	129	+ return '<div ' . FrmAppHelper::array_to_html_params( $div_attributes ) . '></div>';
120	130	}
121	131
122	132	/**
	133	+ * @since 6.25
	134	+ *
	135	+ * @return string
	136	+ */
	137	+ private function get_captcha_language() {
	138	+ /**
	139	+ * Allows updating the captcha language.
	140	+ *
	141	+ * @since 6.25
	142	+ *
	143	+ * @param string $lang
	144	+ * @param array $field
	145	+ */
	146	+ return apply_filters( 'frm_captcha_lang', get_bloginfo( 'language' ), $this->field );
	147	+ }
	148	+
	149	+ /**
	150	+ * Load the captcha script.
	151	+ *
	152	+ * @param array $args
	153	+ *
123	154	* @return void
124	155	*/
125	156	protected function load_field_scripts( $args ) {
126		- $api_js_url = $this->api_url();
127		-
128		- wp_register_script( 'captcha-api', $api_js_url, array( 'formidable' ), '3', true );
	157	+ wp_register_script( 'captcha-api', $this->api_url(), array( 'formidable' ), '3', true );
129	158	wp_enqueue_script( 'captcha-api' );
130	159	}
131	160
	161	+ /**
	162	+ * Get the URL for the script JS that is loaded on the front end.
	163	+ *
	164	+ * @return string
	165	+ */
132	166	protected function api_url() {
133	167	$frm_settings = FrmAppHelper::get_settings();
134		- if ( $frm_settings->active_captcha === 'recaptcha' ) {
	168	+ $active_mode = $frm_settings->active_captcha;
	169	+
	170	+ if ( 'recaptcha' === $active_mode ) {
135	171	return $this->recaptcha_api_url( $frm_settings );
136	172	}
137	173
138		- return $this->hcaptcha_api_url();
	174	+ if ( 'hcaptcha' === $active_mode ) {
	175	+ return $this->hcaptcha_api_url();
	176	+ }
	177	+
	178	+ return $this->turnstile_api_url();
139	179	}
140	180
141	181	/**
142	182	* @param FrmSettings $frm_settings
	183	+ *
	184	+ * @return string
143	185	*/
144	186	protected function recaptcha_api_url( $frm_settings ) {
145	187	$api_js_url = 'https://www.google.com/recaptcha/api.js?';
146	188
147		- $allow_mutiple = $frm_settings->re_multi;
148		- if ( $allow_mutiple ) {
	189	+ if ( $this->allow_multiple( $frm_settings ) ) {
149	190	$api_js_url .= '&onload=frmRecaptcha&render=explicit';
150	191	}
151	192
152	193	$lang = apply_filters( 'frm_recaptcha_lang', $frm_settings->re_lang, $this->field );
153		- if ( ! empty( $lang ) ) {
	194	+
	195	+ if ( $lang ) {
154	196	$api_js_url .= '&hl=' . $lang;
155	197	}
156	198
157		- $api_js_url = apply_filters( 'frm_recaptcha_js_url', $api_js_url );
	199	+ // Since this URL initially ends with ? and we never use add_query_arg, remove the extra
	200	+ // & that appears immediately after the ?
	201	+ $api_js_url = str_replace( '?&', '?', $api_js_url );
158	202
159		- return $api_js_url;
	203	+ /**
	204	+ * @param string $api_js_url
	205	+ */
	206	+ return apply_filters( 'frm_recaptcha_js_url', $api_js_url );
160	207	}
161	208
	209	+ /**
	210	+ * @since 6.0
	211	+ *
	212	+ * @return string
	213	+ */
162	214	protected function hcaptcha_api_url() {
163	215	$api_js_url = 'https://js.hcaptcha.com/1/api.js';
	216	+ $lang = $this->get_captcha_language();
164	217
	218	+ if ( $lang ) {
	219	+ // Language might be in the format of en-US, fr-FR, etc. In that case, we need to extract the first part to comply with the hcaptcha api request format.
	220	+ $lang_parts = explode( '-', $lang );
	221	+ $api_js_url .= '?hl=' . $lang_parts[0];
	222	+ }
	223	+
	224	+ $api_js_url = add_query_arg( 'onload', 'frmHcaptcha', $api_js_url );
	225	+
165	226	/**
166	227	* Allows updating hcaptcha js api url.
167	228	*
168	229	* @since 6.0
		@@ -168,11 +229,35 @@
168	229	* @since 6.0
169	230	*
170	231	* @param string $api_js_url
171	232	*/
172		- $api_js_url = apply_filters( 'frm_hcaptcha_js_url', $api_js_url );
	233	+ return apply_filters( 'frm_hcaptcha_js_url', $api_js_url );
	234	+ }
173	235
174		- return $api_js_url;
	236	+ /**
	237	+ * @since 6.8.4
	238	+ *
	239	+ * @return string
	240	+ */
	241	+ protected function turnstile_api_url() {
	242	+ $api_js_url = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=frmTurnstile&render=explicit';
	243	+
	244	+ /**
	245	+ * Allows updating hcaptcha js api url.
	246	+ *
	247	+ * @since 6.8.4
	248	+ *
	249	+ * @param string $api_js_url
	250	+ */
	251	+ $api_js_url = apply_filters( 'frm_turnstile_js_url', $api_js_url );
	252	+
	253	+ // Prevent render=explicit from happening twice in case someone patched
	254	+ // The double rendering issue using the frm_turnstile_js_url hook.
	255	+ return str_replace(
	256	+ '&render=explicit&render=explicit',
	257	+ '&render=explicit',
	258	+ $api_js_url
	259	+ );
175	260	}
176	261
177	262	/**
178	263	* @param FrmSettings $frm_settings
		@@ -181,19 +266,13 @@
181	266	*
182	267	* @psalm-return ''|'frm-'
183	268	*/
184	269	protected function class_prefix( $frm_settings ) {
185		- if ( $this->allow_multiple( $frm_settings ) && $frm_settings->active_captcha === 'recaptcha' ) {
186		- $class_prefix = 'frm-';
187		- } else {
188		- $class_prefix = '';
189		- }
190		-
191		- return $class_prefix;
	270	+ return FrmCaptchaFactory::get_settings_object()->get_class_prefix( $this->allow_multiple( $frm_settings ) );
192	271	}
193	272
194	273	/**
195		- * @param FrmSettings $frm_settings
	274	+ * @param FrmSettings $frm_settings This isn't used anymore. It's only there for backwards compatibility.
196	275	*
197	276	* @return string
198	277	*
199	278	* @psalm-return 'g-recaptcha'|'h-captcha'
		@@ -198,37 +277,32 @@
198	277	*
199	278	* @psalm-return 'g-recaptcha'|'h-captcha'
200	279	*/
201	280	protected function captcha_class( $frm_settings ) {
202		- return $frm_settings->active_captcha === 'recaptcha' ? 'g-recaptcha' : 'h-captcha';
	281	+ $settings = FrmCaptchaFactory::get_settings_object();
	282	+ return $settings->get_element_class_name();
203	283	}
204	284
205		- protected function allow_multiple( $frm_settings ) {
206		- return $frm_settings->re_multi;
207		- }
208		-
209	285	/**
210		- * @return string
	286	+ * @param FrmSettings $frm_settings
211	287	*
212		- * @param FrmSettings $frm_settings
	288	+ * @return bool
213	289	*/
214		- protected function captcha_size( $frm_settings ) {
215		- if ( in_array( $frm_settings->re_type, array( 'invisible', 'v3' ), true ) ) {
216		- return 'invisible';
217		- }
218		- // for reverse compatibility
219		- return $this->field['captcha_size'] === 'default' ? 'normal' : $this->field['captcha_size'];
	290	+ protected function allow_multiple( $frm_settings ) {
	291	+ return $frm_settings->re_multi;
220	292	}
221	293
222	294	/**
223	295	* @since 4.07
	296	+ *
224	297	* @param array $args
	298	+ *
225	299	* @return array
226	300	*/
227	301	protected function validate_against_api( $args ) {
228	302	$errors = array();
229	303	$frm_settings = FrmAppHelper::get_settings();
230		- $resp = $this->send_api_check( $frm_settings );
	304	+ $resp = $this->send_api_check();
231	305	$response = json_decode( wp_remote_retrieve_body( $resp ), true );
232	306
233	307	if ( is_wp_error( $resp ) ) {
234	308	$error_string = $resp->get_error_message();
		@@ -240,43 +314,49 @@
240	314	if ( ! is_array( $response ) ) {
241	315	return $errors;
242	316	}
243	317
244		- if ( $frm_settings->active_captcha === 'recaptcha' ) {
245		- if ( 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
246		- $threshold = floatval( $frm_settings->re_threshold );
247		- $score = floatval( $response['score'] );
	318	+ if ( $frm_settings->active_captcha === 'recaptcha' && 'v3' === $frm_settings->re_type && array_key_exists( 'score', $response ) ) {
	319	+ $threshold = floatval( $frm_settings->re_threshold );
	320	+ $score = floatval( $response['score'] );
248	321
249		- $this->set_score( $score );
	322	+ $this->set_score( $score );
250	323
251		- if ( $score < $threshold ) {
252		- $response['success'] = false;
253		- }
	324	+ if ( $score < $threshold ) {
	325	+ $response['success'] = false;
254	326	}
255	327	}
256	328
257		- if ( isset( $response['success'] ) && ! $response['success'] ) {
258		- // What happens when the CAPTCHA was entered incorrectly
259		- $invalid_message = FrmField::get_option( $this->field, 'invalid' );
260		- if ( $invalid_message === __( 'The reCAPTCHA was not entered correctly', 'formidable' ) ) {
261		- $invalid_message = '';
262		- }
263		- $errors[ 'field' . $args['id'] ] = ( $invalid_message === '' ? $frm_settings->re_msg : $invalid_message );
	329	+ if ( ! isset( $response['success'] ) || $response['success'] ) {
	330	+ return $errors;
264	331	}
265	332
	333	+ // What happens when the CAPTCHA was entered incorrectly
	334	+ $invalid_message = FrmField::get_option( $this->field, 'invalid' );
	335	+
	336	+ if ( $invalid_message === __( 'The reCAPTCHA was not entered correctly', 'formidable' ) ) {
	337	+ $invalid_message = '';
	338	+ }
	339	+
	340	+ $errors[ 'field' . $args['id'] ] = $invalid_message === '' ? $frm_settings->re_msg : $invalid_message;
	341	+
266	342	return $errors;
267	343	}
268	344
269	345	/**
270	346	* @param float $score
	347	+ *
271	348	* @return void
272	349	*/
273	350	private function set_score( $score ) {
274	351	global $frm_vars;
	352	+
275	353	if ( ! isset( $frm_vars['captcha_scores'] ) ) {
276	354	$frm_vars['captcha_scores'] = array();
277	355	}
	356	+
278	357	$form_id = is_object( $this->field ) ? $this->field->form_id : $this->field['form_id'];
	358	+
279	359	if ( ! isset( $frm_vars['captcha_scores'][ $form_id ] ) ) {
280	360	$frm_vars['captcha_scores'][ $form_id ] = $score;
281	361	}
282	362	}
		@@ -282,8 +362,9 @@
282	362	}
283	363
284	364	/**
285	365	* @param array $args
	366	+ *
286	367	* @return array
287	368	*/
288	369	public function validate( $args ) {
289	370	if ( ! $this->should_validate() ) {
		@@ -289,11 +370,11 @@
289	370	if ( ! $this->should_validate() ) {
290	371	return array();
291	372	}
292	373
293		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
294		- if ( ! isset( $_POST['g-recaptcha-response'] ) && ! isset( $_POST['h-captcha-response'] ) ) {
295		- // There was no captcha submitted.
	374	+ $missing_token = ! self::post_data_includes_token();
	375	+
	376	+ if ( $missing_token ) {
296	377	return array( 'field' . $args['id'] => __( 'The captcha is missing from this form', 'formidable' ) );
297	378	}
298	379
299	380	return $this->validate_against_api( $args );
		@@ -299,18 +380,28 @@
299	380	return $this->validate_against_api( $args );
300	381	}
301	382
302	383	/**
	384	+ * @since 6.8.4
	385	+ *
	386	+ * @return bool
	387	+ */
	388	+ protected static function post_data_includes_token() {
	389	+ $settings = FrmCaptchaFactory::get_settings_object();
	390	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	391	+ return ! empty( $_POST[ $settings->token_field ] );
	392	+ }
	393	+
	394	+ /**
	395	+ * Check if the active captcha type's public key is set.
	396	+ *
303	397	* @since 4.07
	398	+ *
304	399	* @return bool
305	400	*/
306	401	public static function should_show_captcha() {
307		- $frm_settings = FrmAppHelper::get_settings();
308		- if ( $frm_settings->active_captcha === 'recaptcha' ) {
309		- return ! empty( $frm_settings->pubkey );
310		- }
311		-
312		- return ! empty( $frm_settings->hcaptcha_pubkey );
	402	+ $settings = FrmCaptchaFactory::get_settings_object();
	403	+ return $settings->has_pubkey();
313	404	}
314	405
315	406	/**
316	407	* @return bool
		@@ -316,23 +407,23 @@
316	407	* @return bool
317	408	*/
318	409	protected function should_validate() {
319	410	$is_hidden_field = apply_filters( 'frm_is_field_hidden', false, $this->field, wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
	411	+
320	412	if ( FrmAppHelper::is_admin() || $is_hidden_field ) {
321	413	return false;
322	414	}
323	415
324		- // don't require the captcha if it shouldn't be shown
	416	+ // Don't require the captcha if it shouldn't be shown
325	417	return self::should_show_captcha();
326	418	}
327	419
328	420	/**
329		- * @param FrmSettings $frm_settings
	421	+ * @return array|WP_Error
330	422	*/
331		- protected function send_api_check( $frm_settings ) {
332		- $captcha_settings = new FrmFieldCaptchaSettings( $frm_settings );
333		-
334		- $arg_array = array(
	423	+ protected function send_api_check() {
	424	+ $captcha_settings = FrmCaptchaFactory::get_settings_object();
	425	+ $arg_array = array(
335	426	'body' => array(
336	427	'secret' => $captcha_settings->secret,
337	428	'response' => FrmAppHelper::get_param( $captcha_settings->token_field, '', 'post', 'sanitize_text_field' ),
338	429	'remoteip' => FrmAppHelper::get_ip_address(),
		@@ -348,13 +439,14 @@
348	439	* @since 6.0
349	440	*
350	441	* @param array $values
351	442	*
352		- * @return array $values
	443	+ * @return array Values.
353	444	*/
354	445	public static function update_field_name( $values ) {
355	446	if ( $values['type'] === 'captcha' ) {
356	447	$name = $values['name'];
	448	+
357	449	if ( in_array( $name, array( __( 'reCAPTCHA', 'formidable' ), __( 'hCaptcha', 'formidable' ) ), true ) ) {
358	450	$values['name'] = __( 'Captcha', 'formidable' );
359	451	}
360	452	}