king-addons / includes / widgets / Form_Builder / helpers / Form_Builder_Security.php

Form_Builder_Security.php in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder 51.1.83, at includes/widgets/Form_Builder/helpers/Form_Builder_Security.php

119 lines 3.4 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons;
4
5	if (!defined('ABSPATH')) {
6	exit;
7	}
8
9	/**
10	* Shared Form Builder checks for public AJAX requests.
11	*/
12	class Form_Builder_Security
13	{
14	/**
15	* Checks whether a published document contains the Form Builder widget.
16	*
17	* @param mixed $page_id Page or post ID from the request.
18	* @return bool True when the document is published and includes Form Builder.
19	*/
20	public static function page_has_form_builder($page_id): bool
21	{
22	$page_id = absint($page_id);
23	if ($page_id <= 0) {
24	return false;
25	}
26
27	$post = get_post($page_id);
28	if (!$post \|\| 'publish' !== $post->post_status) {
29	return false;
30	}
31
32	$elementor_data = get_post_meta($page_id, '_elementor_data', true);
33	if (empty($elementor_data)) {
34	return false;
35	}
36
37	if (!is_string($elementor_data)) {
38	$elementor_data = wp_json_encode($elementor_data);
39	}
40
41	return false !== strpos($elementor_data, 'king-addons-form-builder');
42	}
43
44	/**
45	* Stops a submission that failed the form's spam challenge.
46	*
47	* Every submit action is its own public AJAX endpoint, so each one calls
48	* this: checking the challenge only in the browser would leave them open.
49	*
50	* @return void Sends a JSON error and exits when the check fails.
51	*/
52	public static function guard_spam(): void
53	{
54	if (!class_exists('King_Addons\\Form_Spam_Protection')) {
55	return;
56	}
57
58	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- the caller checked the nonce.
59	$form_id = isset($_POST['king_addons_form_id'])
60	? sanitize_text_field(wp_unslash($_POST['king_addons_form_id']))
61	: '';
62
63	if ('' === $form_id) {
64	return;
65	}
66
67	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- the caller checked the nonce.
68	$result = Form_Spam_Protection::verify($form_id, $_POST);
69
70	if (true === $result) {
71	return;
72	}
73
74	wp_send_json_error([
75	'message' => esc_html__('Your submission was rejected by the spam check.', 'king-addons'),
76	'status' => 'error',
77	'reason' => $result,
78	]);
79	}
80
81	/**
82	* Validates a page ID for public form submissions.
83	*
84	* Accepts a published page that contains Form Builder. Also accepts a
85	* published source page or template when the widget is injected by Theme
86	* Builder, Header/Footer, or a popup and is therefore not stored on the
87	* queried page.
88	*
89	* @param mixed $page_id Page or post ID from the request.
90	* @return bool True when the page ID is safe to store with a submission.
91	*/
92	public static function is_valid_submission_page($page_id): bool
93	{
94	if (self::page_has_form_builder($page_id)) {
95	return true;
96	}
97
98	$page_id = absint($page_id);
99	if ($page_id <= 0) {
100	return false;
101	}
102
103	$post = get_post($page_id);
104	if (!$post \|\| 'publish' !== $post->post_status) {
105	return false;
106	}
107
108	if (is_post_publicly_viewable($post)) {
109	return true;
110	}
111
112	return in_array(
113	$post->post_type,
114	['elementor_library', 'king-addons-el-hf', 'king_addons_popup'],
115	true
116	);
117	}
118	}
119