| @@ -224,15 +224,9 @@ | ||
| 224 | 224 | return $data; |
| 225 | 225 | } |
| 226 | 226 | |
| 227 | 227 | public function listen_for_submit() { |
| 228 | - // Check nonce only if enabled in settings | |
| 229 | - $nonce_check_failed = false; | |
| 230 | - if ( $this->settings['enable_nonce'] ) { | |
| 231 | - $nonce_check_failed = ! check_ajax_referer( 'html_forms_submit', '_wpnonce', false ); | |
| 232 | - } | |
| 233 | - | |
| 234 | - if ( $nonce_check_failed || empty( $_POST['_hf_form_id'] ) ) { | |
| 228 | + if ( ! check_ajax_referer( 'html_forms_submit', '_wpnonce', false ) || empty( $_POST['_hf_form_id'] ) ) { | |
| 235 | 229 | wp_send_json( |
| 236 | 230 | array( |
| 237 | 231 | 'message' => array( |
| 238 | 232 | 'type' => 'warning', |
| @@ -377,9 +371,9 @@ | ||
| 377 | 371 | } |
| 378 | 372 | ); |
| 379 | 373 | } |
| 380 | 374 | |
| 381 | - private function get_response_for_error_code( $error_code, Form $form, $data = array(), ?Submission $submission = null ) { | |
| 375 | + private function get_response_for_error_code( $error_code, Form $form, $data = array(), Submission $submission = null ) { | |
| 382 | 376 | // return success response for empty error code string or spam (to trick bots) |
| 383 | 377 | if ( $error_code === '' || $error_code === 'spam' ) { |
| 384 | 378 | $response = array( |
| 385 | 379 | 'message' => array( |
| @@ -389,15 +383,9 @@ | ||
| 389 | 383 | 'hide_form' => (bool) $form->settings['hide_after_success'], |
| 390 | 384 | ); |
| 391 | 385 | |
| 392 | 386 | if ( ! empty( $form->settings['redirect_url'] ) && $submission !== null ) { |
| 393 | - $url = hf_replace_data_variables( $form->settings['redirect_url'], $submission, 'urlencode' ); | |
| 394 | - | |
| 395 | - // Validate the scheme again to prevent javascript: XSS | |
| 396 | - $scheme = wp_parse_url( $url, PHP_URL_SCHEME ); | |
| 397 | - if ( $scheme === null || in_array( strtolower( $scheme ), array( 'http', 'https' ), true ) ) { | |
| 398 | - $response['redirect_url'] = $url; | |
| 399 | - } | |
| 387 | + $response['redirect_url'] = hf_replace_data_variables( $form->settings['redirect_url'], $submission, 'urlencode' ); | |
| 400 | 388 | } |
| 401 | 389 | |
| 402 | 390 | return apply_filters( 'hf_form_response', $response, $form, $data ); |
| 403 | 391 | } |
