jetformbuilder / modules / security / csrf / module.php

module.php in JetFormBuilder — Dynamic Blocks Form Builder 3.6.5.3, at modules/security/csrf/module.php

122 lines 3.3 KB

Raw Download Zip

1	<?php
2
3
4	namespace JFB_Modules\Security\Csrf;
5
6	// If this file is called directly, abort.
7	if ( ! defined( 'WPINC' ) ) {
8	die;
9	}
10
11	use JFB_Components\Module\Base_Module_After_Install_It;
12	use JFB_Components\Module\Base_Module_Dir_It;
13	use JFB_Components\Module\Base_Module_Dir_Trait;
14	use JFB_Components\Module\Base_Module_Handle_It;
15	use JFB_Components\Module\Base_Module_Handle_Trait;
16	use JFB_Components\Module\Base_Module_It;
17	use JFB_Components\Module\Base_Module_Url_It;
18	use JFB_Components\Module\Base_Module_Url_Trait;
19	use JFB_Modules\Security\Exceptions\Spam_Exception;
20
21	class Module implements Base_Module_It, Base_Module_Url_It, Base_Module_Handle_It, Base_Module_Dir_It {
22
23	use Base_Module_Dir_Trait;
24	use Base_Module_Url_Trait;
25	use Base_Module_Handle_Trait;
26
27	private $client_id = '';
28
29	public function rep_item_id() {
30	return 'csrf';
31	}
32
33	const SPAM_EXCEPTION = 'csrf_failed';
34	public function __construct() {
35	add_filter( 'jet-form-builder/security/spam-statuses', array( $this, 'add_spam_statuses' ) );
36	}
37	public function add_spam_statuses( $statuses ) {
38	$statuses[] = self::SPAM_EXCEPTION;
39	return $statuses;
40	}
41
42	public function condition(): bool {
43	return true;
44	}
45
46	public function init_hooks() {
47	add_filter( 'jet-form-builder/request-handler/request', array( $this, 'handle_request' ) );
48	add_filter( 'jet-form-builder/message-types', array( $this, 'handle_messages' ) );
49	add_filter( 'jet-form-builder/after-start-form', array( $this, 'on_render_form' ) );
50	}
51
52	public function remove_hooks() {
53	remove_filter( 'jet-form-builder/request-handler/request', array( $this, 'handle_request' ) );
54	remove_filter( 'jet-form-builder/message-types', array( $this, 'handle_messages' ) );
55	remove_filter( 'jet-form-builder/after-start-form', array( $this, 'on_render_form' ) );
56	}
57
58	public function on_render_form( string $html ): string {
59	if ( ! jet_fb_live_args()->is_use_csrf() ) {
60	return $html;
61	}
62
63	return ( $html . Csrf_Tools::get_field() );
64	}
65
66	/**
67	* @param array $request
68	*
69	* @return array
70	* @throws Spam_Exception
71	*/
72	public function handle_request( array $request ): array {
73	if ( ! jet_fb_live_args()->is_use_csrf() ) {
74	return $request;
75	}
76
77	$token = $request[ Csrf_Tools::FIELD ] ?? false;
78	$this->client_id = Csrf_Tools::client_id( jet_fb_live()->form_id );
79
80	// delete all old tokens
81	Csrf_Token_Model::clear();
82
83	if ( ! Csrf_Tools::consume( $token, $this->client_id ) ) {
84	// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
85	throw new Spam_Exception( self::SPAM_EXCEPTION );
86	}
87
88	add_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10, 2 );
89
90	return $request;
91	}
92
93	public function handle_after_send( $handler, bool $is_success ) {
94	remove_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10 );
95
96	if ( ! $handler->is_ajax() ) {
97	return;
98	}
99
100	try {
101	$token = Csrf_Tools::add( Csrf_Tools::generate(), $this->client_id );
102	} catch ( \Exception $exception ) {
103	return;
104	}
105
106	$handler->add_response_data(
107	array(
108	Csrf_Tools::FIELD => $token,
109	)
110	);
111	}
112
113	public function handle_messages( array $messages ): array {
114	$messages[ self::SPAM_EXCEPTION ] = array(
115	'label' => __( 'CSRF token validation failed', 'jet-form-builder' ),
116	'value' => __( 'Invalid token', 'jet-form-builder' ),
117	);
118
119	return $messages;
120	}
121	}
122