← All changes | includes/widgets/Form_Builder/helpers/Create_Submission.php +306 -0 51.1.2 → 51.1.86 View file →

		@@ -1,0 +1,306 @@
	1	+<?php
	2	+
	3	+namespace King_Addons;
	4	+
	5	+if (!defined('ABSPATH')) {
	6	+ exit;
	7	+}
	8	+
	9	+/**
	10	+ * Stores Form Builder submissions from the public AJAX endpoint.
	11	+ */
	12	+class Create_Submission
	13	+{
	14	+ /**
	15	+ * HMAC of the one-time access secret for this submission.
	16	+ */
	17	+ public const META_ACCESS_SECRET = 'king_addons_fb_access_secret';
	18	+
	19	+ /**
	20	+ * Plain secrets issued in this request, keyed by submission ID.
	21	+ *
	22	+ * @var array<int,string>
	23	+ */
	24	+ private static array $issued_secrets = [];
	25	+
	26	+ /**
	27	+ * Registers submission AJAX hooks and admin meta updates.
	28	+ */
	29	+ public function __construct()
	30	+ {
	31	+ add_action('wp_ajax_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
	32	+ add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
	33	+ add_action('save_post', [$this, 'update_submissions_post_meta']);
	34	+ }
	35	+
	36	+ /**
	37	+ * Creates a submission post from a public form request.
	38	+ *
	39	+ * Guests are allowed when the nonce is valid and the submitted page ID
	40	+ * belongs to a published Form Builder source page.
	41	+ *
	42	+ * @return void
	43	+ */
	44	+ public function add_to_submissions()
	45	+ {
	46	+
	47	+ $nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '';
	48	+
	49	+ if (!wp_verify_nonce($nonce, 'king-addons-js')) {
	50	+ wp_send_json_error(array(
	51	+ 'message' => esc_html__('Security check failed.', 'king-addons'),
	52	+ ));
	53	+ }
	54	+
	55	+ Form_Builder_Security::guard_spam();
	56	+
	57	+ $sanitized_form_page_id = absint($_POST['form_page_id'] ?? 0);
	58	+ if (!Form_Builder_Security::is_valid_submission_page($sanitized_form_page_id)) {
	59	+ wp_send_json_error(array(
	60	+ 'message' => esc_html__('Insufficient permissions.', 'king-addons'),
	61	+ ));
	62	+ }
	63	+
	64	+ $sanitized_form_name = sanitize_text_field(wp_unslash($_POST['form_name'] ?? ''));
	65	+ $form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? wp_unslash($_POST['form_content']) : [];
	66	+ $sanitized_form_id = sanitize_key(wp_unslash($_POST['form_id'] ?? ''));
	67	+ $sanitized_form_page = sanitize_text_field(wp_unslash($_POST['form_page'] ?? ''));
	68	+
	69	+ $post_id = self::insert_submission([
	70	+ 'form_name' => $sanitized_form_name,
	71	+ 'form_id' => $sanitized_form_id,
	72	+ 'form_page' => $sanitized_form_page,
	73	+ 'form_page_id' => $sanitized_form_page_id,
	74	+ 'form_content' => $form_content,
	75	+ ]);
	76	+
	77	+ if ($post_id) {
	78	+ wp_send_json_success(array(
	79	+ 'action' => 'king_addons_form_builder_submissions',
	80	+ 'post_id' => $post_id,
	81	+ 'access_secret' => self::issued_access_secret($post_id),
	82	+ 'message' => esc_html__('Submission created successfully', 'king-addons'),
	83	+ 'status' => 'success'
	84	+ ));
	85	+ } else {
	86	+ wp_send_json_success(array(
	87	+ 'action' => 'king_addons_form_builder_submissions',
	88	+ 'post_id' => $post_id,
	89	+ 'message' => esc_html__('Submit action failed', 'king-addons'),
	90	+ 'status' => 'error'
	91	+ ));
	92	+ }
	93	+ }
	94	+
	95	+ /**
	96	+ * Insert a Form Builder submission from already-sanitized request pieces.
	97	+ *
	98	+ * @param array<string,mixed> $args {
	99	+ * @type string $form_name
	100	+ * @type string $form_id
	101	+ * @type string $form_page
	102	+ * @type int $form_page_id
	103	+ * @type array $form_content
	104	+ * }
	105	+ *
	106	+ * @return int Submission post ID, or 0.
	107	+ */
	108	+ public static function insert_submission(array $args): int
	109	+ {
	110	+ $form_name = sanitize_text_field((string) ($args['form_name'] ?? ''));
	111	+ $form_id = sanitize_key((string) ($args['form_id'] ?? ''));
	112	+ $form_page = sanitize_text_field((string) ($args['form_page'] ?? ''));
	113	+ $form_page_id = absint($args['form_page_id'] ?? 0);
	114	+ $form_content = isset($args['form_content']) && is_array($args['form_content']) ? $args['form_content'] : [];
	115	+
	116	+ $post_id = wp_insert_post([
	117	+ 'post_status' => 'publish',
	118	+ 'post_type' => 'king-addons-fb-sub',
	119	+ 'post_title' => $form_name
	120	+ ? $form_name . ' - ' . current_time('mysql')
	121	+ : current_time('mysql'),
	122	+ ]);
	123	+
	124	+ if (!$post_id || is_wp_error($post_id)) {
	125	+ return 0;
	126	+ }
	127	+
	128	+ $post_id = (int) $post_id;
	129	+
	130	+ foreach ($form_content as $key => $value) {
	131	+ if (!is_array($value) || count($value) < 3) {
	132	+ continue;
	133	+ }
	134	+
	135	+ $sanitized_key = sanitize_key((string) $key);
	136	+ if ('' === $sanitized_key) {
	137	+ continue;
	138	+ }
	139	+
	140	+ update_post_meta($post_id, $sanitized_key, [
	141	+ sanitize_text_field((string) $value[0]),
	142	+ self::sanitize_field_value($value[1]),
	143	+ sanitize_text_field((string) $value[2]),
	144	+ ]);
	145	+ }
	146	+
	147	+ update_post_meta($post_id, 'king_addons_form_name', $form_name);
	148	+ update_post_meta($post_id, 'king_addons_form_id', $form_id);
	149	+ update_post_meta($post_id, 'king_addons_form_page', $form_page);
	150	+ update_post_meta($post_id, 'king_addons_form_page_id', $form_page_id);
	151	+ $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
	152	+ update_post_meta($post_id, 'king_addons_user_agent', $user_agent);
	153	+ update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP());
	154	+ self::issue_access_secret($post_id);
	155	+
	156	+ return $post_id;
	157	+ }
	158	+
	159	+ /**
	160	+ * Create a secret that later public requests must present to touch this submission.
	161	+ *
	162	+ * Only the HMAC is stored. The plaintext is kept for this request so the
	163	+ * creator can send it with the payment call.
	164	+ *
	165	+ * @param int $submission_id Submission post ID.
	166	+ * @return string Plaintext secret.
	167	+ */
	168	+ public static function issue_access_secret(int $submission_id): string
	169	+ {
	170	+ if ($submission_id < 1) {
	171	+ return '';
	172	+ }
	173	+
	174	+ try {
	175	+ $secret = bin2hex(random_bytes(32));
	176	+ } catch (\Exception $e) {
	177	+ $secret = wp_generate_password(64, false, false);
	178	+ }
	179	+
	180	+ update_post_meta($submission_id, self::META_ACCESS_SECRET, hash_hmac('sha256', $secret, self::access_secret_key()));
	181	+ self::$issued_secrets[$submission_id] = $secret;
	182	+
	183	+ return $secret;
	184	+ }
	185	+
	186	+ /**
	187	+ * Plaintext secret issued for this submission in the current request.
	188	+ *
	189	+ * @param int $submission_id Submission post ID.
	190	+ * @return string
	191	+ */
	192	+ public static function issued_access_secret(int $submission_id): string
	193	+ {
	194	+ return self::$issued_secrets[$submission_id] ?? '';
	195	+ }
	196	+
	197	+ /**
	198	+ * Whether the posted secret matches the one stored for this submission.
	199	+ *
	200	+ * @param int $submission_id Submission post ID.
	201	+ * @param string $secret Plaintext from the request.
	202	+ * @return bool
	203	+ */
	204	+ public static function verify_access_secret(int $submission_id, string $secret): bool
	205	+ {
	206	+ if ($submission_id < 1 || '' === $secret) {
	207	+ return false;
	208	+ }
	209	+
	210	+ $stored = (string) get_post_meta($submission_id, self::META_ACCESS_SECRET, true);
	211	+ if ('' === $stored) {
	212	+ return false;
	213	+ }
	214	+
	215	+ return hash_equals($stored, hash_hmac('sha256', $secret, self::access_secret_key()));
	216	+ }
	217	+
	218	+ /**
	219	+ * Key used to HMAC submission access secrets.
	220	+ *
	221	+ * @return string
	222	+ */
	223	+ private static function access_secret_key(): string
	224	+ {
	225	+ return 'king-addons-fb-sub|' . wp_salt('auth');
	226	+ }
	227	+
	228	+ /**
	229	+ * Saves admin edits to an existing submission.
	230	+ *
	231	+ * @param int $post_id Submission post ID.
	232	+ * @return void
	233	+ */
	234	+ public function update_submissions_post_meta($post_id)
	235	+ {
	236	+ // Security fix: Validate nonce and capabilities
	237	+ if (!current_user_can('edit_post', $post_id)) {
	238	+ return;
	239	+ }
	240	+
	241	+ if (isset($_POST['king_addons_submission_changes']) && !empty($_POST['king_addons_submission_changes'])) {
	242	+ // Security fix: Sanitize JSON input and validate structure
	243	+ $raw_changes = sanitize_textarea_field(stripslashes($_POST['king_addons_submission_changes']));
	244	+ $changes = json_decode($raw_changes, true);
	245	+
	246	+ if (!is_array($changes)) {
	247	+ return; // Invalid JSON structure
	248	+ }
	249	+
	250	+ foreach ($changes as $key => $value) {
	251	+ // Security fix: Validate and sanitize keys and values
	252	+ $sanitized_key = sanitize_key($key);
	253	+ if (empty($sanitized_key)) {
	254	+ continue; // Skip invalid keys
	255	+ }
	256	+
	257	+ // Sanitize values based on type
	258	+ if (is_array($value)) {
	259	+ $sanitized_value = array_map('sanitize_text_field', $value);
	260	+ } else {
	261	+ $sanitized_value = sanitize_text_field($value);
	262	+ }
	263	+
	264	+ update_post_meta($post_id, $sanitized_key, $sanitized_value);
	265	+ }
	266	+ }
	267	+ }
	268	+
	269	+ /**
	270	+ * Sanitize a submitted field value.
	271	+ *
	272	+ * Radio and checkbox groups arrive as rows of [value, checked, name, id].
	273	+ * A flat array_map(sanitize_text_field) turns each row into an empty
	274	+ * string, so the saved submission lost what the visitor actually picked.
	275	+ *
	276	+ * @param mixed $raw Raw value from form_content.
	277	+ *
	278	+ * @return string|array<int,string>
	279	+ */
	280	+ private static function sanitize_field_value($raw)
	281	+ {
	282	+ if (!is_array($raw)) {
	283	+ return sanitize_text_field((string) $raw);
	284	+ }
	285	+
	286	+ if (isset($raw[0]) && is_array($raw[0])) {
	287	+ $picked = [];
	288	+ foreach ($raw as $row) {
	289	+ if (!is_array($row)) {
	290	+ continue;
	291	+ }
	292	+ $option = sanitize_text_field((string) ($row[0] ?? ''));
	293	+ $checked = !empty($row[1]) && 'false' !== (string) $row[1] && '0' !== (string) $row[1];
	294	+ if ($checked && '' !== $option) {
	295	+ $picked[] = $option;
	296	+ }
	297	+ }
	298	+
	299	+ return implode(', ', $picked);
	300	+ }
	301	+
	302	+ return array_values(array_map('sanitize_text_field', $raw));
	303	+ }
	304	+}
	305	+
	306	+new Create_Submission();