# jetformbuilder/3.6.6/modules/security/csrf/module.php

JetFormBuilder — Dynamic Blocks Form Builder, version 3.6.6. 122 lines.

- Page: https://pluginprobe.com/plugins/jetformbuilder/3.6.6/code/modules/security/csrf/module.php
- Raw: https://pluginprobe.com/plugins/jetformbuilder/3.6.6/raw/modules/security/csrf/module.php
- Modified: 2026-08-05T11:04:46+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/jetformbuilder/3.6.6/code/modules/security/csrf/module.php#L10-L20`.

```php
<?php


namespace JFB_Modules\Security\Csrf;

// If this file is called directly, abort.
if ( ! defined( 'WPINC' ) ) {
	die;
}

use JFB_Components\Module\Base_Module_After_Install_It;
use JFB_Components\Module\Base_Module_Dir_It;
use JFB_Components\Module\Base_Module_Dir_Trait;
use JFB_Components\Module\Base_Module_Handle_It;
use JFB_Components\Module\Base_Module_Handle_Trait;
use JFB_Components\Module\Base_Module_It;
use JFB_Components\Module\Base_Module_Url_It;
use JFB_Components\Module\Base_Module_Url_Trait;
use JFB_Modules\Security\Exceptions\Spam_Exception;

class Module implements Base_Module_It, Base_Module_Url_It, Base_Module_Handle_It, Base_Module_Dir_It {

	use Base_Module_Dir_Trait;
	use Base_Module_Url_Trait;
	use Base_Module_Handle_Trait;

	private $client_id = '';

	public function rep_item_id() {
		return 'csrf';
	}

	const SPAM_EXCEPTION = 'csrf_failed';
	public function __construct() {
		add_filter( 'jet-form-builder/security/spam-statuses', array( $this, 'add_spam_statuses' ) );
	}
	public function add_spam_statuses( $statuses ) {
		$statuses[] = self::SPAM_EXCEPTION;
		return $statuses;
	}

	public function condition(): bool {
		return true;
	}

	public function init_hooks() {
		add_filter( 'jet-form-builder/request-handler/request', array( $this, 'handle_request' ) );
		add_filter( 'jet-form-builder/message-types', array( $this, 'handle_messages' ) );
		add_filter( 'jet-form-builder/after-start-form', array( $this, 'on_render_form' ) );
	}

	public function remove_hooks() {
		remove_filter( 'jet-form-builder/request-handler/request', array( $this, 'handle_request' ) );
		remove_filter( 'jet-form-builder/message-types', array( $this, 'handle_messages' ) );
		remove_filter( 'jet-form-builder/after-start-form', array( $this, 'on_render_form' ) );
	}

	public function on_render_form( string $html ): string {
		if ( ! jet_fb_live_args()->is_use_csrf() ) {
			return $html;
		}

		return ( $html . Csrf_Tools::get_field() );
	}

	/**
	 * @param array $request
	 *
	 * @return array
	 * @throws Spam_Exception
	 */
	public function handle_request( array $request ): array {
		if ( ! jet_fb_live_args()->is_use_csrf() ) {
			return $request;
		}

		$token           = $request[ Csrf_Tools::FIELD ] ?? false;
		$this->client_id = Csrf_Tools::client_id( jet_fb_live()->form_id );

		// delete all old tokens
		Csrf_Token_Model::clear();

		if ( ! Csrf_Tools::consume( $token, $this->client_id ) ) {
			// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
			throw new Spam_Exception( self::SPAM_EXCEPTION );
		}

		add_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10, 2 );

		return $request;
	}

	public function handle_after_send( $handler, bool $is_success ) {
		remove_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10 );

		if ( ! $handler->is_ajax() ) {
			return;
		}

		try {
			$token = Csrf_Tools::add( Csrf_Tools::generate(), $this->client_id );
		} catch ( \Exception $exception ) {
			return;
		}

		$handler->add_response_data(
			array(
				Csrf_Tools::FIELD => $token,
			)
		);
	}

	public function handle_messages( array $messages ): array {
		$messages[ self::SPAM_EXCEPTION ] = array(
			'label' => __( 'CSRF token validation failed', 'jet-form-builder' ),
			'value' => __( 'Invalid token', 'jet-form-builder' ),
		);

		return $messages;
	}
}

```