| @@ -72,8 +72,13 @@ | ||
| 72 | 72 | if ( ! wp_verify_nonce( $nonce, $nonce_action ) ) { |
| 73 | 73 | wp_send_json_error( __( 'Security check failed', 'suredonation' ) ); |
| 74 | 74 | } |
| 75 | 75 | |
| 76 | + // Reject bot submissions caught by the honeypot before processing. | |
| 77 | + if ( Helper::is_honeypot_spam() ) { | |
| 78 | + wp_send_json_error( __( 'Your submission was flagged as spam. Please try again.', 'suredonation' ) ); | |
| 79 | + } | |
| 80 | + | |
| 76 | 81 | // Validate campaign only if not standalone. |
| 77 | 82 | $campaign = null; |
| 78 | 83 | if ( ! $is_standalone ) { |
| 79 | 84 | if ( ! $campaign_id ) { |
| @@ -108,12 +113,12 @@ | ||
| 108 | 113 | if ( empty( $form_id ) || empty( $block_id ) ) { |
| 109 | 114 | wp_send_json_error( __( 'Invalid form configuration.', 'suredonation' ) ); |
| 110 | 115 | } |
| 111 | 116 | |
| 112 | - // Validate amount against block configuration. Pass the offline | |
| 113 | - // gateway so the Stripe-only minimum floor is not applied here. | |
| 117 | + // Validate field values + amount against block configuration. Pass the | |
| 118 | + // offline gateway so the Stripe-only minimum floor is not applied here. | |
| 114 | 119 | $currency = Payment_Helper::get_currency(); |
| 115 | - $validation_result = Payment_Helper::validate_payment_amount( $amount, $currency, $form_id, $block_id, 'offline' ); | |
| 120 | + $validation_result = Payment_Helper::validate_submission( Payment_Helper::get_submitted_fields(), $amount, $currency, $form_id, $block_id, 'offline' ); | |
| 116 | 121 | if ( ! $validation_result['valid'] ) { |
| 117 | 122 | wp_send_json_error( esc_html( $validation_result['message'] ) ); |
| 118 | 123 | } |
| 119 | 124 | |
