| @@ -108,9 +108,12 @@ | ||
| 108 | 108 | $settings = array(); |
| 109 | 109 | $integrations = array(); |
| 110 | 110 | |
| 111 | 111 | if ( isset( $post_data['settings'] ) ) { |
| 112 | - $settings = (array) json_decode( $post_data['settings'] ); | |
| 112 | + $settings = json_decode( $post_data['settings'], true ); | |
| 113 | + $settings['message'] = sanitize_text_field( $settings['message'] ); | |
| 114 | + $settings['url'] = sanitize_url( $settings['url'] ); | |
| 115 | + $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] ); | |
| 113 | 116 | } else { |
| 114 | 117 | $settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : []; |
| 115 | 118 | } |
| 116 | 119 | |
| @@ -139,9 +142,14 @@ | ||
| 139 | 142 | $form->maybe_update_entries( $form_fields ); |
| 140 | 143 | |
| 141 | 144 | do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings ); |
| 142 | 145 | |
| 143 | - wp_send_json_success( [ 'form_fields' => $form_fields ] ); | |
| 146 | + wp_send_json_success( | |
| 147 | + array( | |
| 148 | + 'form_fields' => $form_fields, | |
| 149 | + 'settings' => $settings, | |
| 150 | + ) | |
| 151 | + ); | |
| 144 | 152 | } |
| 145 | 153 | |
| 146 | 154 | /** |
| 147 | 155 | * Get all contact forms |
| @@ -573,9 +581,9 @@ | ||
| 573 | 581 | } |
| 574 | 582 | } |
| 575 | 583 | } elseif ( empty( $field['value'] ) ) { |
| 576 | 584 | $has_empty = true; |
| 577 | - break; | |
| 585 | + continue; | |
| 578 | 586 | } else { |
| 579 | 587 | $field = WeForms_Form_Entry_Manager::format_entry_value( $field ); |
| 580 | 588 | array_push( $fields_formatted, $field ); |
| 581 | 589 | } |
| @@ -700,13 +708,24 @@ | ||
| 700 | 708 | * @return void |
| 701 | 709 | */ |
| 702 | 710 | public function handle_frontend_submission() { |
| 703 | 711 | check_ajax_referer( 'wpuf_form_add' ); |
| 704 | - | |
| 705 | 712 | $form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0; |
| 706 | 713 | $page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0; |
| 714 | + $form = weforms()->form->get( $form_id ); | |
| 707 | 715 | |
| 708 | - $form = weforms()->form->get( $form_id ); | |
| 716 | + /** | |
| 717 | + * Check if form submission is open. This resolves broken access control with unauthenticated users. | |
| 718 | + * Access is now checked on frontend form rendering and submission. | |
| 719 | + */ | |
| 720 | + $form_submission_status = $form->is_submission_open(); | |
| 721 | + if ( is_wp_error( $form_submission_status ) ) { | |
| 722 | + wp_send_json( [ | |
| 723 | + 'success' => false, | |
| 724 | + 'error' => __( 'Login Required for submission.', 'weforms' ), | |
| 725 | + ] ); | |
| 726 | + } | |
| 727 | + | |
| 709 | 728 | $form_settings = $form->get_settings(); |
| 710 | 729 | $form_fields = $form->get_fields(); |
| 711 | 730 | $entry_fields = $form->prepare_entries(); |
| 712 | 731 | $form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] ); |
| @@ -760,28 +779,36 @@ | ||
| 760 | 779 | $this->validate_submission( $entry_fields, $form, $form_settings, $form_fields ); |
| 761 | 780 | |
| 762 | 781 | $entry_fields = apply_filters( 'weforms_before_entry_submission', $entry_fields, $form, $form_settings, $form_fields ); |
| 763 | 782 | |
| 764 | - $entry_id = 1; | |
| 765 | - $global_settings = weforms_get_settings(); | |
| 766 | - if ( empty( $form_settings['after_submission'] ) ) { | |
| 767 | - $entry_id = weforms_insert_entry( [ | |
| 768 | - 'form_id' => $form_id, | |
| 769 | - ], $entry_fields ); | |
| 770 | - if ( is_wp_error( $entry_id ) ) { | |
| 771 | - wp_send_json( [ | |
| 772 | - 'success' => false, | |
| 773 | - 'error' => $entry_id->get_error_message(), | |
| 783 | + //check for entry_fields for a return error | |
| 784 | + if ( is_wp_error( $entry_fields ) ) { | |
| 785 | + wp_send_json( [ | |
| 786 | + 'success' => false, | |
| 787 | + 'error' => $entry_fields->get_error_message(), | |
| 788 | + ] ); | |
| 789 | + } else { | |
| 790 | + $entry_id = 1; | |
| 791 | + $global_settings = weforms_get_settings(); | |
| 792 | + if ( empty( $form_settings['after_submission'] ) ) { | |
| 793 | + $entry_id = weforms_insert_entry( [ | |
| 794 | + 'form_id' => $form_id, | |
| 795 | + ], $entry_fields ); | |
| 796 | + if ( is_wp_error( $entry_id ) ) { | |
| 797 | + wp_send_json( [ | |
| 798 | + 'success' => false, | |
| 799 | + 'error' => $entry_id->get_error_message(), | |
| 800 | + ] ); | |
| 801 | + } | |
| 802 | + // Fire a hook for integration | |
| 803 | + do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings ); | |
| 804 | + $notification = new WeForms_Notification( [ | |
| 805 | + 'form_id' => $form_id, | |
| 806 | + 'page_id' => $page_id, | |
| 807 | + 'entry_id' => $entry_id, | |
| 774 | 808 | ] ); |
| 809 | + $notification->send_notifications(); | |
| 775 | 810 | } |
| 776 | - // Fire a hook for integration | |
| 777 | - do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings ); | |
| 778 | - $notification = new WeForms_Notification( [ | |
| 779 | - 'form_id' => $form_id, | |
| 780 | - 'page_id' => $page_id, | |
| 781 | - 'entry_id' => $entry_id, | |
| 782 | - ] ); | |
| 783 | - $notification->send_notifications(); | |
| 784 | 811 | } |
| 785 | 812 | // redirect URL |
| 786 | 813 | $show_message = false; |
| 787 | 814 | $redirect_to = false; |
| @@ -816,8 +843,9 @@ | ||
| 816 | 843 | 'form_id' => $form_id, |
| 817 | 844 | 'entry_id' => $entry_id, |
| 818 | 845 | 'entry_fields' =>$entry_fields, |
| 819 | 846 | ] ); |
| 847 | + | |
| 820 | 848 | weforms_clear_buffer(); |
| 821 | 849 | wp_send_json( $response ); |
| 822 | 850 | } |
| 823 | 851 | |
