← All changes | includes/widgets/Form_Builder/helpers/Create_Submission.php +217 -42 51.1.38 → 51.1.86 View file →

		@@ -5,11 +5,28 @@
5	5	if (!defined('ABSPATH')) {
6	6	exit;
7	7	}
8	8
	9	+/**
	10	+ * Stores Form Builder submissions from the public AJAX endpoint.
	11	+ */
9	12	class Create_Submission
10	13	{
	14	+ /**
	15	+ * HMAC of the one-time access secret for this submission.
	16	+ */
	17	+ public const META_ACCESS_SECRET = 'king_addons_fb_access_secret';
11	18
	19	+ /**
	20	+ * Plain secrets issued in this request, keyed by submission ID.
	21	+ *
	22	+ * @var array<int,string>
	23	+ */
	24	+ private static array $issued_secrets = [];
	25	+
	26	+ /**
	27	+ * Registers submission AJAX hooks and admin meta updates.
	28	+ */
12	29	public function __construct()
13	30	{
14	31	add_action('wp_ajax_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
15	32	add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
		@@ -15,15 +32,21 @@
15	32	add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']);
16	33	add_action('save_post', [$this, 'update_submissions_post_meta']);
17	34	}
18	35
	36	+ /**
	37	+ * Creates a submission post from a public form request.
	38	+ *
	39	+ * Guests are allowed when the nonce is valid and the submitted page ID
	40	+ * belongs to a published Form Builder source page.
	41	+ *
	42	+ * @return void
	43	+ */
19	44	public function add_to_submissions()
20	45	{
21	46
22		- $nonce = $_POST['nonce'];
	47	+ $nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '';
23	48
24		- // Security fix: Generate nonce server-side instead of relying on client-provided nonce
25		- $server_nonce = wp_create_nonce('king-addons-js');
26	49	if (!wp_verify_nonce($nonce, 'king-addons-js')) {
27	50	wp_send_json_error(array(
28	51	'message' => esc_html__('Security check failed.', 'king-addons'),
29	52	));
		@@ -28,60 +51,37 @@
28	51	'message' => esc_html__('Security check failed.', 'king-addons'),
29	52	));
30	53	}
31	54
32		- // Add capability check
33		- if (!current_user_can('read')) {
	55	+ Form_Builder_Security::guard_spam();
	56	+
	57	+ $sanitized_form_page_id = absint($_POST['form_page_id'] ?? 0);
	58	+ if (!Form_Builder_Security::is_valid_submission_page($sanitized_form_page_id)) {
34	59	wp_send_json_error(array(
35	60	'message' => esc_html__('Insufficient permissions.', 'king-addons'),
36	61	));
37	62	}
38	63
39		- $new = [
40		- 'post_status' => 'publish',
41		- 'post_type' => 'king-addons-fb-sub'
42		- ];
	64	+ $sanitized_form_name = sanitize_text_field(wp_unslash($_POST['form_name'] ?? ''));
	65	+ $form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? wp_unslash($_POST['form_content']) : [];
	66	+ $sanitized_form_id = sanitize_key(wp_unslash($_POST['form_id'] ?? ''));
	67	+ $sanitized_form_page = sanitize_text_field(wp_unslash($_POST['form_page'] ?? ''));
43	68
44		- $post_id = wp_insert_post($new);
45		-
46		- // Security fix: Validate and sanitize form_content before saving to database
47		- $form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? $_POST['form_content'] : [];
48		-
49		- foreach ($form_content as $key => $value) {
50		- if (!is_array($value) || count($value) < 3) {
51		- continue; // Skip malformed fields
52		- }
53		-
54		- // Sanitize all form field data before saving
55		- $sanitized_key = sanitize_key($key);
56		- $sanitized_value = [
57		- sanitize_text_field($value[0]), // field type
58		- is_array($value[1]) ? array_map('sanitize_text_field', $value[1]) : sanitize_text_field($value[1]), // field value
59		- sanitize_text_field($value[2]) // field label
60		- ];
61		-
62		- update_post_meta($post_id, $sanitized_key, $sanitized_value);
63		- }
	69	+ $post_id = self::insert_submission([
	70	+ 'form_name' => $sanitized_form_name,
	71	+ 'form_id' => $sanitized_form_id,
	72	+ 'form_page' => $sanitized_form_page,
	73	+ 'form_page_id' => $sanitized_form_page_id,
	74	+ 'form_content' => $form_content,
	75	+ ]);
64	76
65		- $sanitized_form_name = sanitize_text_field($_POST['form_name'] ?? '');
66		- $sanitized_form_id = sanitize_text_field($_POST['form_id'] ?? '');
67		- $sanitized_form_page = sanitize_text_field($_POST['form_page'] ?? '');
68		- $sanitized_form_page_id = sanitize_text_field($_POST['form_page_id'] ?? '');
69		-
70		- update_post_meta($post_id, 'king_addons_form_name', $sanitized_form_name);
71		- update_post_meta($post_id, 'king_addons_form_id', $sanitized_form_id);
72		- update_post_meta($post_id, 'king_addons_form_page', $sanitized_form_page);
73		- update_post_meta($post_id, 'king_addons_form_page_id', $sanitized_form_page_id);
74		- update_post_meta($post_id, 'king_addons_user_agent', sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])));
75		- update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP());
76		-
77	77	if ($post_id) {
78	78	wp_send_json_success(array(
79	79	'action' => 'king_addons_form_builder_submissions',
80	80	'post_id' => $post_id,
	81	+ 'access_secret' => self::issued_access_secret($post_id),
81	82	'message' => esc_html__('Submission created successfully', 'king-addons'),
82	83	'status' => 'success'
83		- // Security fix: Removed unsanitized form_content from response to prevent XSS
84	84	));
85	85	} else {
86	86	wp_send_json_success(array(
87	87	'action' => 'king_addons_form_builder_submissions',
		@@ -91,8 +91,147 @@
91	91	));
92	92	}
93	93	}
94	94
	95	+ /**
	96	+ * Insert a Form Builder submission from already-sanitized request pieces.
	97	+ *
	98	+ * @param array<string,mixed> $args {
	99	+ * @type string $form_name
	100	+ * @type string $form_id
	101	+ * @type string $form_page
	102	+ * @type int $form_page_id
	103	+ * @type array $form_content
	104	+ * }
	105	+ *
	106	+ * @return int Submission post ID, or 0.
	107	+ */
	108	+ public static function insert_submission(array $args): int
	109	+ {
	110	+ $form_name = sanitize_text_field((string) ($args['form_name'] ?? ''));
	111	+ $form_id = sanitize_key((string) ($args['form_id'] ?? ''));
	112	+ $form_page = sanitize_text_field((string) ($args['form_page'] ?? ''));
	113	+ $form_page_id = absint($args['form_page_id'] ?? 0);
	114	+ $form_content = isset($args['form_content']) && is_array($args['form_content']) ? $args['form_content'] : [];
	115	+
	116	+ $post_id = wp_insert_post([
	117	+ 'post_status' => 'publish',
	118	+ 'post_type' => 'king-addons-fb-sub',
	119	+ 'post_title' => $form_name
	120	+ ? $form_name . ' - ' . current_time('mysql')
	121	+ : current_time('mysql'),
	122	+ ]);
	123	+
	124	+ if (!$post_id || is_wp_error($post_id)) {
	125	+ return 0;
	126	+ }
	127	+
	128	+ $post_id = (int) $post_id;
	129	+
	130	+ foreach ($form_content as $key => $value) {
	131	+ if (!is_array($value) || count($value) < 3) {
	132	+ continue;
	133	+ }
	134	+
	135	+ $sanitized_key = sanitize_key((string) $key);
	136	+ if ('' === $sanitized_key) {
	137	+ continue;
	138	+ }
	139	+
	140	+ update_post_meta($post_id, $sanitized_key, [
	141	+ sanitize_text_field((string) $value[0]),
	142	+ self::sanitize_field_value($value[1]),
	143	+ sanitize_text_field((string) $value[2]),
	144	+ ]);
	145	+ }
	146	+
	147	+ update_post_meta($post_id, 'king_addons_form_name', $form_name);
	148	+ update_post_meta($post_id, 'king_addons_form_id', $form_id);
	149	+ update_post_meta($post_id, 'king_addons_form_page', $form_page);
	150	+ update_post_meta($post_id, 'king_addons_form_page_id', $form_page_id);
	151	+ $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
	152	+ update_post_meta($post_id, 'king_addons_user_agent', $user_agent);
	153	+ update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP());
	154	+ self::issue_access_secret($post_id);
	155	+
	156	+ return $post_id;
	157	+ }
	158	+
	159	+ /**
	160	+ * Create a secret that later public requests must present to touch this submission.
	161	+ *
	162	+ * Only the HMAC is stored. The plaintext is kept for this request so the
	163	+ * creator can send it with the payment call.
	164	+ *
	165	+ * @param int $submission_id Submission post ID.
	166	+ * @return string Plaintext secret.
	167	+ */
	168	+ public static function issue_access_secret(int $submission_id): string
	169	+ {
	170	+ if ($submission_id < 1) {
	171	+ return '';
	172	+ }
	173	+
	174	+ try {
	175	+ $secret = bin2hex(random_bytes(32));
	176	+ } catch (\Exception $e) {
	177	+ $secret = wp_generate_password(64, false, false);
	178	+ }
	179	+
	180	+ update_post_meta($submission_id, self::META_ACCESS_SECRET, hash_hmac('sha256', $secret, self::access_secret_key()));
	181	+ self::$issued_secrets[$submission_id] = $secret;
	182	+
	183	+ return $secret;
	184	+ }
	185	+
	186	+ /**
	187	+ * Plaintext secret issued for this submission in the current request.
	188	+ *
	189	+ * @param int $submission_id Submission post ID.
	190	+ * @return string
	191	+ */
	192	+ public static function issued_access_secret(int $submission_id): string
	193	+ {
	194	+ return self::$issued_secrets[$submission_id] ?? '';
	195	+ }
	196	+
	197	+ /**
	198	+ * Whether the posted secret matches the one stored for this submission.
	199	+ *
	200	+ * @param int $submission_id Submission post ID.
	201	+ * @param string $secret Plaintext from the request.
	202	+ * @return bool
	203	+ */
	204	+ public static function verify_access_secret(int $submission_id, string $secret): bool
	205	+ {
	206	+ if ($submission_id < 1 || '' === $secret) {
	207	+ return false;
	208	+ }
	209	+
	210	+ $stored = (string) get_post_meta($submission_id, self::META_ACCESS_SECRET, true);
	211	+ if ('' === $stored) {
	212	+ return false;
	213	+ }
	214	+
	215	+ return hash_equals($stored, hash_hmac('sha256', $secret, self::access_secret_key()));
	216	+ }
	217	+
	218	+ /**
	219	+ * Key used to HMAC submission access secrets.
	220	+ *
	221	+ * @return string
	222	+ */
	223	+ private static function access_secret_key(): string
	224	+ {
	225	+ return 'king-addons-fb-sub|' . wp_salt('auth');
	226	+ }
	227	+
	228	+ /**
	229	+ * Saves admin edits to an existing submission.
	230	+ *
	231	+ * @param int $post_id Submission post ID.
	232	+ * @return void
	233	+ */
95	234	public function update_submissions_post_meta($post_id)
96	235	{
97	236	// Security fix: Validate nonce and capabilities
98	237	if (!current_user_can('edit_post', $post_id)) {
		@@ -124,8 +263,44 @@
124	263
125	264	update_post_meta($post_id, $sanitized_key, $sanitized_value);
126	265	}
127	266	}
	267	+ }
	268	+
	269	+ /**
	270	+ * Sanitize a submitted field value.
	271	+ *
	272	+ * Radio and checkbox groups arrive as rows of [value, checked, name, id].
	273	+ * A flat array_map(sanitize_text_field) turns each row into an empty
	274	+ * string, so the saved submission lost what the visitor actually picked.
	275	+ *
	276	+ * @param mixed $raw Raw value from form_content.
	277	+ *
	278	+ * @return string|array<int,string>
	279	+ */
	280	+ private static function sanitize_field_value($raw)
	281	+ {
	282	+ if (!is_array($raw)) {
	283	+ return sanitize_text_field((string) $raw);
	284	+ }
	285	+
	286	+ if (isset($raw[0]) && is_array($raw[0])) {
	287	+ $picked = [];
	288	+ foreach ($raw as $row) {
	289	+ if (!is_array($row)) {
	290	+ continue;
	291	+ }
	292	+ $option = sanitize_text_field((string) ($row[0] ?? ''));
	293	+ $checked = !empty($row[1]) && 'false' !== (string) $row[1] && '0' !== (string) $row[1];
	294	+ if ($checked && '' !== $option) {
	295	+ $picked[] = $option;
	296	+ }
	297	+ }
	298	+
	299	+ return implode(', ', $picked);
	300	+ }
	301	+
	302	+ return array_values(array_map('sanitize_text_field', $raw));
128	303	}
129	304	}
130	305
131	306	new Create_Submission();