← All changes | includes/class-ajax.php +23 -5 1.6.17 → 1.6.21 View file →

		@@ -108,11 +108,12 @@
108	108	$settings = array();
109	109	$integrations = array();
110	110
111	111	if ( isset( $post_data['settings'] ) ) {
112		- $settings = (array) json_decode( $post_data['settings'] );
113		- $settings['message'] = sanitize_text_field( $settings['message'] );
114		- error_log(print_r($settings, true));
	112	+ $settings = json_decode( $post_data['settings'], true );
	113	+ $settings['message'] = sanitize_text_field( $settings['message'] );
	114	+ $settings['url'] = sanitize_url( $settings['url'] );
	115	+ $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] );
115	116	} else {
116	117	$settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : [];
117	118	}
118	119
		@@ -141,9 +142,14 @@
141	142	$form->maybe_update_entries( $form_fields );
142	143
143	144	do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings );
144	145
145		- wp_send_json_success( [ 'form_fields' => $form_fields ] );
	146	+ wp_send_json_success(
	147	+ array(
	148	+ 'form_fields' => $form_fields,
	149	+ 'settings' => $settings,
	150	+ )
	151	+ );
146	152	}
147	153
148	154	/**
149	155	* Get all contact forms
		@@ -704,10 +710,22 @@
704	710	public function handle_frontend_submission() {
705	711	check_ajax_referer( 'wpuf_form_add' );
706	712	$form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0;
707	713	$page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0;
	714	+ $form = weforms()->form->get( $form_id );
708	715
709		- $form = weforms()->form->get( $form_id );
	716	+ /**
	717	+ * Check if form submission is open. This resolves broken access control with unauthenticated users.
	718	+ * Access is now checked on frontend form rendering and submission.
	719	+ */
	720	+ $form_submission_status = $form->is_submission_open();
	721	+ if ( is_wp_error( $form_submission_status ) ) {
	722	+ wp_send_json( [
	723	+ 'success' => false,
	724	+ 'error' => __( 'Login Required for submission.', 'weforms' ),
	725	+ ] );
	726	+ }
	727	+
710	728	$form_settings = $form->get_settings();
711	729	$form_fields = $form->get_fields();
712	730	$entry_fields = $form->prepare_entries();
713	731	$form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] );