← All changes | modules/validation/handlers/validation-handler.php +35 -43 3.6.0.1 → 3.6.6 View file →

		@@ -1,7 +1,8 @@
1	1	<?php
2	2	namespace JFB_Modules\Validation\Handlers;
3	3
	4	+use Jet_Form_Builder\Blocks\Block_Helper;
4	5	use JFB_Modules\Validation\Rest_Api\Rest_Validation_Endpoint;
5	6	use Jet_Form_Builder\Exceptions\Repository_Exception;
6	7	use Jet_Form_Builder\Request\Exceptions\Plain_Value_Exception;
7	8	use Jet_Form_Builder\Classes\Arrayable\Array_Tools;
		@@ -7,60 +8,21 @@
7	8	use Jet_Form_Builder\Classes\Arrayable\Array_Tools;
8	9
9	10	class Validation_Handler {
10	11
11		- /**
12		- * Form post type constant for validation.
13		- *
14		- * @since 3.5.6.2
15		- */
16		- const FORM_POST_TYPE = 'jet-form-builder';
	12	+ const MAIN_SIGNATURES_KEY = '_jfb_validation_sigs';
17	13
18	14	/**
19	15	* Validate that the given ID belongs to a published JetFormBuilder form.
20		- * Supports revision IDs by resolving them to their parent form.
21	16	*
22	17	* @since 3.5.6.2
23	18	*
24		- * @param int $form_id The form ID to validate (can be a revision ID).
	19	+ * @param int $form_id The form ID to validate.
25	20	*
26	21	* @return bool True if valid, false otherwise.
27	22	*/
28	23	public static function validate_form_post_type( int $form_id ): bool {
29		- if ( ! $form_id ) {
30		- return false;
31		- }
32		-
33		- $post = get_post( $form_id );
34		-
35		- if ( ! $post ) {
36		- return false;
37		- }
38		-
39		- // Handle revisions: resolve to parent form and validate the parent
40		- if ( 'revision' === $post->post_type ) {
41		- $parent_id = wp_get_post_parent_id( $form_id );
42		- if ( ! $parent_id ) {
43		- return false;
44		- }
45		-
46		- $post = get_post( $parent_id );
47		- if ( ! $post ) {
48		- return false;
49		- }
50		- }
51		-
52		- // Must be a JetFormBuilder form
53		- if ( self::FORM_POST_TYPE !== $post->post_type ) {
54		- return false;
55		- }
56		-
57		- // Only allow published forms
58		- if ( 'publish' !== $post->post_status ) {
59		- return false;
60		- }
61		-
62		- return true;
	24	+ return Block_Helper::is_valid_form_post( $form_id );
63	25	}
64	26
65	27	/**
66	28	* Validate the signature from request body.
		@@ -101,9 +63,9 @@
101	63	* @param string|array $field_path The field path from request.
102	64	*
103	65	* @return string|array Normalized path without row indexes.
104	66	*/
105		- protected static function normalize_field_path( $field_path ) {
	67	+ public static function normalize_field_path( $field_path ) {
106	68	if ( ! is_array( $field_path ) ) {
107	69	return sanitize_text_field( (string) $field_path );
108	70	}
109	71
		@@ -116,8 +78,38 @@
116	78	}
117	79	}
118	80
119	81	return $normalized;
	82	+ }
	83	+
	84	+ public static function get_signature_key( $field_path, int $rule_index ): string {
	85	+ $normalized = self::normalize_field_path( $field_path );
	86	+ $path_string = is_array( $normalized ) ? implode( '.', $normalized ) : (string) $normalized;
	87	+
	88	+ return md5( $path_string . '|' . $rule_index );
	89	+ }
	90	+
	91	+ public static function validate_main_signature( array $body, int $form_id, $field_path, int $rule_index ): bool {
	92	+ $signatures = $body[ self::MAIN_SIGNATURES_KEY ] ?? array();
	93	+
	94	+ if ( ! is_array( $signatures ) ) {
	95	+ return false;
	96	+ }
	97	+
	98	+ $key = self::get_signature_key( $field_path, $rule_index );
	99	+ $signature = sanitize_text_field( $signatures[ $key ] ?? '' );
	100	+
	101	+ if ( empty( $signature ) || empty( $form_id ) ) {
	102	+ return false;
	103	+ }
	104	+
	105	+ $expected = Rest_Validation_Endpoint::generate_signature(
	106	+ $form_id,
	107	+ self::normalize_field_path( $field_path ),
	108	+ $rule_index
	109	+ );
	110	+
	111	+ return hash_equals( $expected, $signature );
120	112	}
121	113
122	114	public static function validate( $body ) {
123	115	remove_all_actions( 'jet-form-builder/validate-field' );