| 1 |
<?php |
| 2 |
|
| 3 |
|
| 4 |
namespace JFB_Modules\Security\Wp_Nonce; |
| 5 |
|
| 6 |
use JFB_Components\Module\Base_Module_It; |
| 7 |
use JFB_Modules\Security\Exceptions\Spam_Exception; |
| 8 |
|
| 9 |
// If this file is called directly, abort. |
| 10 |
if ( ! defined( 'WPINC' ) ) { |
| 11 |
die; |
| 12 |
} |
| 13 |
|
| 14 |
class Module implements Base_Module_It { |
| 15 |
|
| 16 |
const KEY = '_wpnonce'; |
| 17 |
const NONCE_ACTION_PREF = 'jet-form-builder-wp-nonce-'; |
| 18 |
const SPAM_EXCEPTION = 'nonce_failed'; |
| 19 |
|
| 20 |
public function __construct() { |
| 21 |
add_filter( 'jet-form-builder/security/spam-statuses', array( $this, 'add_spam_statuses' ) ); |
| 22 |
} |
| 23 |
public function add_spam_statuses( $statuses ) { |
| 24 |
$statuses[] = self::SPAM_EXCEPTION; |
| 25 |
return $statuses; |
| 26 |
} |
| 27 |
|
| 28 |
public function rep_item_id() { |
| 29 |
return 'wp-nonce'; |
| 30 |
} |
| 31 |
|
| 32 |
public function condition(): bool { |
| 33 |
return true; |
| 34 |
} |
| 35 |
|
| 36 |
public function init_hooks() { |
| 37 |
add_filter( |
| 38 |
'jet-form-builder/request-handler/request', |
| 39 |
array( $this, 'handle_request' ) |
| 40 |
); |
| 41 |
add_filter( |
| 42 |
'jet-form-builder/message-types', |
| 43 |
array( $this, 'handle_messages' ) |
| 44 |
); |
| 45 |
add_filter( |
| 46 |
'jet-form-builder/after-start-form', |
| 47 |
array( $this, 'on_render_form' ) |
| 48 |
); |
| 49 |
} |
| 50 |
|
| 51 |
public function remove_hooks() { |
| 52 |
remove_filter( |
| 53 |
'jet-form-builder/request-handler/request', |
| 54 |
array( $this, 'handle_request' ) |
| 55 |
); |
| 56 |
remove_filter( |
| 57 |
'jet-form-builder/message-types', |
| 58 |
array( $this, 'handle_messages' ) |
| 59 |
); |
| 60 |
remove_filter( |
| 61 |
'jet-form-builder/after-start-form', |
| 62 |
array( $this, 'on_render_form' ) |
| 63 |
); |
| 64 |
} |
| 65 |
|
| 66 |
public function on_render_form( string $html ): string { |
| 67 |
if ( ! jet_fb_live_args()->is_use_nonce() ) { |
| 68 |
return $html; |
| 69 |
} |
| 70 |
|
| 71 |
return ( $html . $this->get_nonce_field() ); |
| 72 |
} |
| 73 |
|
| 74 |
public function get_nonce_id(): string { |
| 75 |
$form_id = jet_fb_live()->form_id; |
| 76 |
|
| 77 |
return self::NONCE_ACTION_PREF . $form_id; |
| 78 |
} |
| 79 |
|
| 80 |
public function get_nonce_field(): string { |
| 81 |
$form_id = jet_fb_live()->form_id; |
| 82 |
$field_id = self::KEY . '_' . $form_id; |
| 83 |
return sprintf( |
| 84 |
'<input type="hidden" id="%1$s" name="%2$s" value="%3$s" />', |
| 85 |
esc_attr( $field_id ), |
| 86 |
esc_attr( self::KEY ), |
| 87 |
esc_attr( wp_create_nonce( $this->get_nonce_id() ) ) |
| 88 |
) . wp_referer_field( false ); |
| 89 |
} |
| 90 |
|
| 91 |
public function verify( $nonce ): bool { |
| 92 |
return ( ! jet_fb_live_args()->is_use_nonce() || wp_verify_nonce( $nonce, $this->get_nonce_id() ) ); |
| 93 |
} |
| 94 |
|
| 95 |
/** |
| 96 |
* @param array $request |
| 97 |
* |
| 98 |
* @return array |
| 99 |
* @throws Spam_Exception |
| 100 |
*/ |
| 101 |
public function handle_request( array $request ): array { |
| 102 |
$nonce = $request[ self::KEY ] ?? ''; |
| 103 |
|
| 104 |
if ( ! $this->verify( $nonce ) ) { |
| 105 |
// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped |
| 106 |
throw new Spam_Exception( self::SPAM_EXCEPTION ); |
| 107 |
} |
| 108 |
|
| 109 |
return $request; |
| 110 |
} |
| 111 |
|
| 112 |
public function handle_messages( array $messages ): array { |
| 113 |
$messages[ self::SPAM_EXCEPTION ] = array( |
| 114 |
'label' => __( 'WP nonce validation failed', 'jet-form-builder' ), |
| 115 |
'value' => __( 'Invalid nonce', 'jet-form-builder' ), |
| 116 |
); |
| 117 |
|
| 118 |
return $messages; |
| 119 |
} |
| 120 |
|
| 121 |
} |
| 122 |
|
