← All changes | includes/class-ajax.php +26 -53 1.6.28 → 1.6.14 View file →

		@@ -108,12 +108,11 @@
108	108	$settings = array();
109	109	$integrations = array();
110	110
111	111	if ( isset( $post_data['settings'] ) ) {
112		- $settings = json_decode( $post_data['settings'], true );
113		- $settings['message'] = sanitize_text_field( $settings['message'] );
114		- $settings['url'] = sanitize_url( $settings['url'] );
115		- $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] );
	112	+ $settings = (array) json_decode( $post_data['settings'] );
	113	+ $settings['message'] = sanitize_text_field( $settings['message'] );
	114	+ error_log(print_r($settings, true));
116	115	} else {
117	116	$settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : [];
118	117	}
119	118
		@@ -142,14 +141,9 @@
142	141	$form->maybe_update_entries( $form_fields );
143	142
144	143	do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings );
145	144
146		- wp_send_json_success(
147		- array(
148		- 'form_fields' => $form_fields,
149		- 'settings' => $settings,
150		- )
151		- );
	145	+ wp_send_json_success( [ 'form_fields' => $form_fields ] );
152	146	}
153	147
154	148	/**
155	149	* Get all contact forms
		@@ -519,10 +513,9 @@
519	513	$metadata = $entry->get_metadata();
520	514	$payment = $entry->get_payment_data();
521	515
522	516	if ( isset( $payment->payment_data ) && is_serialized( $payment->payment_data ) ) {
523		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
524		- $payment->payment_data = @unserialize( $payment->payment_data, [ 'allowed_classes' => false ] );
	517	+ $payment->payment_data = unserialize( $payment->payment_data );
525	518	}
526	519
527	520	if ( false === $fields ) {
528	521	wp_send_json_error( __( 'No form fields found!', 'weforms' ) );
		@@ -582,9 +575,9 @@
582	575	}
583	576	}
584	577	} elseif ( empty( $field['value'] ) ) {
585	578	$has_empty = true;
586		- continue;
	579	+ break;
587	580	} else {
588	581	$field = WeForms_Form_Entry_Manager::format_entry_value( $field );
589	582	array_push( $fields_formatted, $field );
590	583	}
		@@ -709,24 +702,13 @@
709	702	* @return void
710	703	*/
711	704	public function handle_frontend_submission() {
712	705	check_ajax_referer( 'wpuf_form_add' );
	706	+
713	707	$form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0;
714	708	$page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0;
	709	+
715	710	$form = weforms()->form->get( $form_id );
716		-
717		- /**
718		- * Check if form submission is open. This resolves broken access control with unauthenticated users.
719		- * Access is now checked on frontend form rendering and submission.
720		- */
721		- $form_submission_status = $form->is_submission_open();
722		- if ( is_wp_error( $form_submission_status ) ) {
723		- wp_send_json( [
724		- 'success' => false,
725		- 'error' => __( 'Login Required for submission.', 'weforms' ),
726		- ] );
727		- }
728		-
729	711	$form_settings = $form->get_settings();
730	712	$form_fields = $form->get_fields();
731	713	$entry_fields = $form->prepare_entries();
732	714	$form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] );
		@@ -780,36 +762,28 @@
780	762	$this->validate_submission( $entry_fields, $form, $form_settings, $form_fields );
781	763
782	764	$entry_fields = apply_filters( 'weforms_before_entry_submission', $entry_fields, $form, $form_settings, $form_fields );
783	765
784		- //check for entry_fields for a return error
785		- if ( is_wp_error( $entry_fields ) ) {
786		- wp_send_json( [
787		- 'success' => false,
788		- 'error' => $entry_fields->get_error_message(),
789		- ] );
790		- } else {
791		- $entry_id = 1;
792		- $global_settings = weforms_get_settings();
793		- if ( empty( $form_settings['after_submission'] ) ) {
794		- $entry_id = weforms_insert_entry( [
795		- 'form_id' => $form_id,
796		- ], $entry_fields );
797		- if ( is_wp_error( $entry_id ) ) {
798		- wp_send_json( [
799		- 'success' => false,
800		- 'error' => $entry_id->get_error_message(),
801		- ] );
802		- }
803		- // Fire a hook for integration
804		- do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
805		- $notification = new WeForms_Notification( [
806		- 'form_id' => $form_id,
807		- 'page_id' => $page_id,
808		- 'entry_id' => $entry_id,
	766	+ $entry_id = 1;
	767	+ $global_settings = weforms_get_settings();
	768	+ if ( empty( $form_settings['after_submission'] ) ) {
	769	+ $entry_id = weforms_insert_entry( [
	770	+ 'form_id' => $form_id,
	771	+ ], $entry_fields );
	772	+ if ( is_wp_error( $entry_id ) ) {
	773	+ wp_send_json( [
	774	+ 'success' => false,
	775	+ 'error' => $entry_id->get_error_message(),
809	776	] );
810		- $notification->send_notifications();
811	777	}
	778	+ // Fire a hook for integration
	779	+ do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
	780	+ $notification = new WeForms_Notification( [
	781	+ 'form_id' => $form_id,
	782	+ 'page_id' => $page_id,
	783	+ 'entry_id' => $entry_id,
	784	+ ] );
	785	+ $notification->send_notifications();
812	786	}
813	787	// redirect URL
814	788	$show_message = false;
815	789	$redirect_to = false;
		@@ -844,9 +818,8 @@
844	818	'form_id' => $form_id,
845	819	'entry_id' => $entry_id,
846	820	'entry_fields' =>$entry_fields,
847	821	] );
848		-
849	822	weforms_clear_buffer();
850	823	wp_send_json( $response );
851	824	}
852	825