← All changes | includes/class-ajax.php +69 -97 1.6.27 → 1.6.1 View file →

		@@ -108,12 +108,9 @@
108	108	$settings = array();
109	109	$integrations = array();
110	110
111	111	if ( isset( $post_data['settings'] ) ) {
112		- $settings = json_decode( $post_data['settings'], true );
113		- $settings['message'] = sanitize_text_field( $settings['message'] );
114		- $settings['url'] = sanitize_url( $settings['url'] );
115		- $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] );
	112	+ $settings = (array) json_decode( $post_data['settings'] );
116	113	} else {
117	114	$settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : [];
118	115	}
119	116
		@@ -120,8 +117,11 @@
120	117	if ( isset( $post_data['integrations'] ) ) {
121	118	$integrations = (array) json_decode( $post_data['integrations'] );
122	119	}
123	120
	121	+ // $form_fields = wp_unslash( $form_fields );
	122	+ // $notifications = wp_unslash( $notifications );
	123	+
124	124	$form_fields = json_decode( $form_fields, true );
125	125	$notifications = json_decode( $notifications, true );
126	126	$data = [
127	127	'form_id' => absint( $form_data['wpuf_form_id'] ),
		@@ -134,22 +134,11 @@
134	134	];
135	135
136	136	$form_fields = weforms()->form->save( $data );
137	137
138		- // Update Old Entry meta_key if changed
139		- $form_id = $form_data['wpuf_form_id'];
140		- $form = weforms()->form->get( $form_id );
141		-
142		- $form->maybe_update_entries( $form_fields );
143		-
144	138	do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings );
145	139
146		- wp_send_json_success(
147		- array(
148		- 'form_fields' => $form_fields,
149		- 'settings' => $settings,
150		- )
151		- );
	140	+ wp_send_json_success( [ 'form_fields' => $form_fields ] );
152	141	}
153	142
154	143	/**
155	144	* Get all contact forms
		@@ -519,10 +508,9 @@
519	508	$metadata = $entry->get_metadata();
520	509	$payment = $entry->get_payment_data();
521	510
522	511	if ( isset( $payment->payment_data ) && is_serialized( $payment->payment_data ) ) {
523		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
524		- $payment->payment_data = @unserialize( $payment->payment_data, [ 'allowed_classes' => false ] );
	512	+ $payment->payment_data = unserialize( $payment->payment_data );
525	513	}
526	514
527	515	if ( false === $fields ) {
528	516	wp_send_json_error( __( 'No form fields found!', 'weforms' ) );
		@@ -536,9 +524,9 @@
536	524
537	525	$has_empty = false;
538	526	$answers = [];
539	527	$respondentPoints = isset( $form_settings['total_points'] ) ? floatval( $form_settings['total_points'] ) : 0;
540		- $fields_formatted = array();
	528	+
541	529	foreach ( $fields as $key => $field ) {
542	530	if ( $form_settings['quiz_form'] == 'yes' ) {
543	531	$selectedAnswers = isset( $field['selected_answers'] ) ? $field['selected_answers'] : '';
544	532	$givenAnswer = isset( $field['value'] ) ? $field['value'] : '';
		@@ -547,8 +535,9 @@
547	535	$fieldPoints = isset( $field['points'] ) ? floatval( $field['points'] ) : 0;
548	536
549	537	if ( $template == 'radio_field' || $template == 'dropdown_field' ) {
550	538	$answers[$field['name']] = true;
	539	+
551	540	if ( empty( $givenAnswer ) ) {
552	541	$answers[$field['name']] = false;
553	542	$respondentPoints -= $fieldPoints;
554	543	} else {
		@@ -582,16 +571,14 @@
582	571	}
583	572	}
584	573	} elseif ( empty( $field['value'] ) ) {
585	574	$has_empty = true;
586		- continue;
587		- } else {
588		- $field = WeForms_Form_Entry_Manager::format_entry_value( $field );
589		- array_push( $fields_formatted, $field );
	575	+ break;
590	576	}
591	577	}
	578	+
592	579	$response = [
593		- 'form_fields' => $fields_formatted,
	580	+ 'form_fields' => $fields,
594	581	'form_settings' => $form_settings,
595	582	'meta_data' => $metadata,
596	583	'payment_data' => $payment,
597	584	'has_empty' => $has_empty,
		@@ -598,9 +585,8 @@
598	585	'respondent_points' => $respondentPoints,
599	586	'answers' => $answers,
600	587	];
601	588
602		-
603	589	wp_send_json_success( $response );
604	590	}
605	591
606	592	/**
		@@ -709,24 +695,13 @@
709	695	* @return void
710	696	*/
711	697	public function handle_frontend_submission() {
712	698	check_ajax_referer( 'wpuf_form_add' );
	699	+
713	700	$form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0;
714	701	$page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0;
	702	+
715	703	$form = weforms()->form->get( $form_id );
716		-
717		- /**
718		- * Check if form submission is open. This resolves broken access control with unauthenticated users.
719		- * Access is now checked on frontend form rendering and submission.
720		- */
721		- $form_submission_status = $form->is_submission_open();
722		- if ( is_wp_error( $form_submission_status ) ) {
723		- wp_send_json( [
724		- 'success' => false,
725		- 'error' => __( 'Login Required for submission.', 'weforms' ),
726		- ] );
727		- }
728		-
729	704	$form_settings = $form->get_settings();
730	705	$form_fields = $form->get_fields();
731	706	$entry_fields = $form->prepare_entries();
732	707	$form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] );
		@@ -780,40 +755,23 @@
780	755	$this->validate_submission( $entry_fields, $form, $form_settings, $form_fields );
781	756
782	757	$entry_fields = apply_filters( 'weforms_before_entry_submission', $entry_fields, $form, $form_settings, $form_fields );
783	758
784		- //check for entry_fields for a return error
785		- if ( is_wp_error( $entry_fields ) ) {
	759	+ $entry_id = weforms_insert_entry( [
	760	+ 'form_id' => $form_id,
	761	+ ], $entry_fields );
	762	+
	763	+ if ( is_wp_error( $entry_id ) ) {
786	764	wp_send_json( [
787	765	'success' => false,
788		- 'error' => $entry_fields->get_error_message(),
	766	+ 'error' => $entry_id->get_error_message(),
789	767	] );
790		- } else {
791		- $entry_id = 1;
792		- $global_settings = weforms_get_settings();
793		- if ( empty( $form_settings['after_submission'] ) ) {
794		- $entry_id = weforms_insert_entry( [
795		- 'form_id' => $form_id,
796		- ], $entry_fields );
797		- if ( is_wp_error( $entry_id ) ) {
798		- wp_send_json( [
799		- 'success' => false,
800		- 'error' => $entry_id->get_error_message(),
801		- ] );
802		- }
803		- // Fire a hook for integration
804		- do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
805		- $notification = new WeForms_Notification( [
806		- 'form_id' => $form_id,
807		- 'page_id' => $page_id,
808		- 'entry_id' => $entry_id,
809		- ] );
810		- $notification->send_notifications();
811		- }
812	768	}
	769	+
813	770	// redirect URL
814	771	$show_message = false;
815		- $redirect_to = false;
	772	+ $redirect_to = false;
	773	+
816	774	if ( $form_settings['redirect_to'] == 'page' ) {
817	775	$redirect_to = get_permalink( $form_settings['page_id'] );
818	776	} elseif ( $form_settings['redirect_to'] == 'url' ) {
819	777	$redirect_to = $form_settings['url'];
		@@ -821,11 +779,17 @@
821	779	$show_message = true;
822	780	} else {
823	781	$show_message = true;
824	782	}
	783	+
	784	+ // Fire a hook for integration
	785	+ do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
	786	+
825	787	$field_search = $field_replace = [];
	788	+
826	789	foreach ( $form_fields as $r_field ) {
827	790	$field_search[] = '{' . $r_field['name'] . '}';
	791	+
828	792	if ( $r_field['template'] == 'name_field' ) {
829	793	$field_replace[] = implode( ' ', explode( '|', $entry_fields[ $r_field['name'] ] ) );
830	794	} else if ( $r_field['template'] == 'address_field' ) {
831	795	$field_replace[] = implode( ', ', $entry_fields[ $r_field['name'] ] );
		@@ -833,60 +797,68 @@
833	797	$field_replace[] = isset( $entry_fields[ $r_field['name'] ] ) ? $entry_fields[ $r_field['name'] ] : '';
834	798	}
835	799	}
836	800	$message = str_replace( $field_search, $field_replace, $form_settings['message'] );
	801	+
837	802	// send the response
838	803	$response = apply_filters( 'weforms_entry_submission_response', [
839		- 'success' => true,
840		- 'redirect_to' => $redirect_to,
	804	+ 'success' => true,
	805	+ 'redirect_to' => $redirect_to,
841	806	'show_message' => $show_message,
842		- 'message' => $message,
843		- 'data' => $_POST,
844		- 'form_id' => $form_id,
845		- 'entry_id' => $entry_id,
846		- 'entry_fields' =>$entry_fields,
	807	+ 'message' => $message,
	808	+ 'data' => $_POST,
	809	+ 'form_id' => $form_id,
	810	+ 'entry_id' => $entry_id,
847	811	] );
848	812
	813	+ $notification = new WeForms_Notification( [
	814	+ 'form_id' => $form_id,
	815	+ 'page_id' => $page_id,
	816	+ 'entry_id' => $entry_id,
	817	+ ] );
	818	+
	819	+ $notification->send_notifications();
	820	+
849	821	weforms_clear_buffer();
850	822	wp_send_json( $response );
851		- }
	823	+ }
852	824
853		- function validate_reCaptchav3( $secret ) {
854		- check_ajax_referer( 'wpuf_form_add' );
	825	+ function validate_reCaptchav3( $secret ) {
	826	+ check_ajax_referer( 'wpuf_form_add' );
855	827
856		- $post_data = wp_unslash($_POST);
857		- $token = $post_data['g-recaptcha-response'];
858		- $action = $post_data['g-action'];
859		- $google_captcha_url = esc_url( 'https://www.google.com/recaptcha/api/siteverify' );
	828	+ $post_data = wp_unslash($_POST);
	829	+ $token = $post_data['g-recaptcha-response'];
	830	+ $action = $post_data['g-action'];
	831	+ $google_captcha_url = esc_url( 'https://www.google.com/recaptcha/api/siteverify' );
860	832
861		- $response = wp_remote_post( $google_captcha_url,
862		- array(
863		- 'method' => 'POST',
864		- 'body' => array(
865		- 'secret' => $secret,
866		- 'response' => $token
867		- )
	833	+ $response = wp_remote_post( $google_captcha_url,
	834	+ array(
	835	+ 'method' => 'POST',
	836	+ 'body' => array(
	837	+ 'secret' => $secret,
	838	+ 'response' => $token
868	839	)
869		- );
	840	+ )
	841	+ );
870	842
871	843
872		- if ( is_wp_error( $response ) ) {
	844	+ if ( is_wp_error( $response ) ) {
	845	+ wp_send_json( [
	846	+ 'success' => false,
	847	+ 'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
	848	+ ] );
	849	+ } else {
	850	+ $api_response = json_decode( wp_remote_retrieve_body( $response ), true );
	851	+ if( $api_response["success"] == '1' && $api_response["action"] == $action ) {
	852	+ return true;
	853	+ } else {
873	854	wp_send_json( [
874	855	'success' => false,
875	856	'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
876	857	] );
877		- } else {
878		- $api_response = json_decode( wp_remote_retrieve_body( $response ), true );
879		- if( $api_response["success"] == '1' && $api_response["action"] == $action ) {
880		- return true;
881		- } else {
882		- wp_send_json( [
883		- 'success' => false,
884		- 'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
885		- ] );
886		- }
887	858	}
888	859	}
	860	+ }
889	861	/**
890	862	* reCaptcha Validation
891	863	*
892	864	* @return void