← All changes | includes/class-ajax.php +95 -68 1.6.2 → 1.6.21 View file →

		@@ -108,9 +108,12 @@
108	108	$settings = array();
109	109	$integrations = array();
110	110
111	111	if ( isset( $post_data['settings'] ) ) {
112		- $settings = (array) json_decode( $post_data['settings'] );
	112	+ $settings = json_decode( $post_data['settings'], true );
	113	+ $settings['message'] = sanitize_text_field( $settings['message'] );
	114	+ $settings['url'] = sanitize_url( $settings['url'] );
	115	+ $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] );
113	116	} else {
114	117	$settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : [];
115	118	}
116	119
		@@ -117,11 +120,8 @@
117	120	if ( isset( $post_data['integrations'] ) ) {
118	121	$integrations = (array) json_decode( $post_data['integrations'] );
119	122	}
120	123
121		- // $form_fields = wp_unslash( $form_fields );
122		- // $notifications = wp_unslash( $notifications );
123		-
124	124	$form_fields = json_decode( $form_fields, true );
125	125	$notifications = json_decode( $notifications, true );
126	126	$data = [
127	127	'form_id' => absint( $form_data['wpuf_form_id'] ),
		@@ -134,11 +134,22 @@
134	134	];
135	135
136	136	$form_fields = weforms()->form->save( $data );
137	137
	138	+ // Update Old Entry meta_key if changed
	139	+ $form_id = $form_data['wpuf_form_id'];
	140	+ $form = weforms()->form->get( $form_id );
	141	+
	142	+ $form->maybe_update_entries( $form_fields );
	143	+
138	144	do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings );
139	145
140		- wp_send_json_success( [ 'form_fields' => $form_fields ] );
	146	+ wp_send_json_success(
	147	+ array(
	148	+ 'form_fields' => $form_fields,
	149	+ 'settings' => $settings,
	150	+ )
	151	+ );
141	152	}
142	153
143	154	/**
144	155	* Get all contact forms
		@@ -524,9 +535,9 @@
524	535
525	536	$has_empty = false;
526	537	$answers = [];
527	538	$respondentPoints = isset( $form_settings['total_points'] ) ? floatval( $form_settings['total_points'] ) : 0;
528		-
	539	+ $fields_formatted = array();
529	540	foreach ( $fields as $key => $field ) {
530	541	if ( $form_settings['quiz_form'] == 'yes' ) {
531	542	$selectedAnswers = isset( $field['selected_answers'] ) ? $field['selected_answers'] : '';
532	543	$givenAnswer = isset( $field['value'] ) ? $field['value'] : '';
		@@ -535,9 +546,8 @@
535	546	$fieldPoints = isset( $field['points'] ) ? floatval( $field['points'] ) : 0;
536	547
537	548	if ( $template == 'radio_field' || $template == 'dropdown_field' ) {
538	549	$answers[$field['name']] = true;
539		-
540	550	if ( empty( $givenAnswer ) ) {
541	551	$answers[$field['name']] = false;
542	552	$respondentPoints -= $fieldPoints;
543	553	} else {
		@@ -571,14 +581,16 @@
571	581	}
572	582	}
573	583	} elseif ( empty( $field['value'] ) ) {
574	584	$has_empty = true;
575		- break;
	585	+ continue;
	586	+ } else {
	587	+ $field = WeForms_Form_Entry_Manager::format_entry_value( $field );
	588	+ array_push( $fields_formatted, $field );
576	589	}
577	590	}
578		-
579	591	$response = [
580		- 'form_fields' => $fields,
	592	+ 'form_fields' => $fields_formatted,
581	593	'form_settings' => $form_settings,
582	594	'meta_data' => $metadata,
583	595	'payment_data' => $payment,
584	596	'has_empty' => $has_empty,
		@@ -585,8 +597,9 @@
585	597	'respondent_points' => $respondentPoints,
586	598	'answers' => $answers,
587	599	];
588	600
	601	+
589	602	wp_send_json_success( $response );
590	603	}
591	604
592	605	/**
		@@ -695,13 +708,24 @@
695	708	* @return void
696	709	*/
697	710	public function handle_frontend_submission() {
698	711	check_ajax_referer( 'wpuf_form_add' );
699		-
700	712	$form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0;
701	713	$page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0;
	714	+ $form = weforms()->form->get( $form_id );
702	715
703		- $form = weforms()->form->get( $form_id );
	716	+ /**
	717	+ * Check if form submission is open. This resolves broken access control with unauthenticated users.
	718	+ * Access is now checked on frontend form rendering and submission.
	719	+ */
	720	+ $form_submission_status = $form->is_submission_open();
	721	+ if ( is_wp_error( $form_submission_status ) ) {
	722	+ wp_send_json( [
	723	+ 'success' => false,
	724	+ 'error' => __( 'Login Required for submission.', 'weforms' ),
	725	+ ] );
	726	+ }
	727	+
704	728	$form_settings = $form->get_settings();
705	729	$form_fields = $form->get_fields();
706	730	$entry_fields = $form->prepare_entries();
707	731	$form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] );
		@@ -755,23 +779,40 @@
755	779	$this->validate_submission( $entry_fields, $form, $form_settings, $form_fields );
756	780
757	781	$entry_fields = apply_filters( 'weforms_before_entry_submission', $entry_fields, $form, $form_settings, $form_fields );
758	782
759		- $entry_id = weforms_insert_entry( [
760		- 'form_id' => $form_id,
761		- ], $entry_fields );
762		-
763		- if ( is_wp_error( $entry_id ) ) {
	783	+ //check for entry_fields for a return error
	784	+ if ( is_wp_error( $entry_fields ) ) {
764	785	wp_send_json( [
765	786	'success' => false,
766		- 'error' => $entry_id->get_error_message(),
	787	+ 'error' => $entry_fields->get_error_message(),
767	788	] );
	789	+ } else {
	790	+ $entry_id = 1;
	791	+ $global_settings = weforms_get_settings();
	792	+ if ( empty( $form_settings['after_submission'] ) ) {
	793	+ $entry_id = weforms_insert_entry( [
	794	+ 'form_id' => $form_id,
	795	+ ], $entry_fields );
	796	+ if ( is_wp_error( $entry_id ) ) {
	797	+ wp_send_json( [
	798	+ 'success' => false,
	799	+ 'error' => $entry_id->get_error_message(),
	800	+ ] );
	801	+ }
	802	+ // Fire a hook for integration
	803	+ do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
	804	+ $notification = new WeForms_Notification( [
	805	+ 'form_id' => $form_id,
	806	+ 'page_id' => $page_id,
	807	+ 'entry_id' => $entry_id,
	808	+ ] );
	809	+ $notification->send_notifications();
	810	+ }
768	811	}
769		-
770	812	// redirect URL
771	813	$show_message = false;
772		- $redirect_to = false;
773		-
	814	+ $redirect_to = false;
774	815	if ( $form_settings['redirect_to'] == 'page' ) {
775	816	$redirect_to = get_permalink( $form_settings['page_id'] );
776	817	} elseif ( $form_settings['redirect_to'] == 'url' ) {
777	818	$redirect_to = $form_settings['url'];
		@@ -779,17 +820,11 @@
779	820	$show_message = true;
780	821	} else {
781	822	$show_message = true;
782	823	}
783		-
784		- // Fire a hook for integration
785		- do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings );
786		-
787	824	$field_search = $field_replace = [];
788		-
789	825	foreach ( $form_fields as $r_field ) {
790	826	$field_search[] = '{' . $r_field['name'] . '}';
791		-
792	827	if ( $r_field['template'] == 'name_field' ) {
793	828	$field_replace[] = implode( ' ', explode( '|', $entry_fields[ $r_field['name'] ] ) );
794	829	} else if ( $r_field['template'] == 'address_field' ) {
795	830	$field_replace[] = implode( ', ', $entry_fields[ $r_field['name'] ] );
		@@ -797,68 +832,60 @@
797	832	$field_replace[] = isset( $entry_fields[ $r_field['name'] ] ) ? $entry_fields[ $r_field['name'] ] : '';
798	833	}
799	834	}
800	835	$message = str_replace( $field_search, $field_replace, $form_settings['message'] );
801		-
802	836	// send the response
803	837	$response = apply_filters( 'weforms_entry_submission_response', [
804		- 'success' => true,
805		- 'redirect_to' => $redirect_to,
	838	+ 'success' => true,
	839	+ 'redirect_to' => $redirect_to,
806	840	'show_message' => $show_message,
807		- 'message' => $message,
808		- 'data' => $_POST,
809		- 'form_id' => $form_id,
810		- 'entry_id' => $entry_id,
	841	+ 'message' => $message,
	842	+ 'data' => $_POST,
	843	+ 'form_id' => $form_id,
	844	+ 'entry_id' => $entry_id,
	845	+ 'entry_fields' =>$entry_fields,
811	846	] );
812	847
813		- $notification = new WeForms_Notification( [
814		- 'form_id' => $form_id,
815		- 'page_id' => $page_id,
816		- 'entry_id' => $entry_id,
817		- ] );
818		-
819		- $notification->send_notifications();
820		-
821	848	weforms_clear_buffer();
822	849	wp_send_json( $response );
823		- }
	850	+ }
824	851
825		- function validate_reCaptchav3( $secret ) {
826		- check_ajax_referer( 'wpuf_form_add' );
	852	+ function validate_reCaptchav3( $secret ) {
	853	+ check_ajax_referer( 'wpuf_form_add' );
827	854
828		- $post_data = wp_unslash($_POST);
829		- $token = $post_data['g-recaptcha-response'];
830		- $action = $post_data['g-action'];
831		- $google_captcha_url = esc_url( 'https://www.google.com/recaptcha/api/siteverify' );
	855	+ $post_data = wp_unslash($_POST);
	856	+ $token = $post_data['g-recaptcha-response'];
	857	+ $action = $post_data['g-action'];
	858	+ $google_captcha_url = esc_url( 'https://www.google.com/recaptcha/api/siteverify' );
832	859
833		- $response = wp_remote_post( $google_captcha_url,
834		- array(
835		- 'method' => 'POST',
836		- 'body' => array(
837		- 'secret' => $secret,
838		- 'response' => $token
	860	+ $response = wp_remote_post( $google_captcha_url,
	861	+ array(
	862	+ 'method' => 'POST',
	863	+ 'body' => array(
	864	+ 'secret' => $secret,
	865	+ 'response' => $token
	866	+ )
839	867	)
840		- )
841		- );
	868	+ );
842	869
843	870
844		- if ( is_wp_error( $response ) ) {
845		- wp_send_json( [
846		- 'success' => false,
847		- 'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
848		- ] );
849		- } else {
850		- $api_response = json_decode( wp_remote_retrieve_body( $response ), true );
851		- if( $api_response["success"] == '1' && $api_response["action"] == $action ) {
852		- return true;
853		- } else {
	871	+ if ( is_wp_error( $response ) ) {
854	872	wp_send_json( [
855	873	'success' => false,
856	874	'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
857	875	] );
	876	+ } else {
	877	+ $api_response = json_decode( wp_remote_retrieve_body( $response ), true );
	878	+ if( $api_response["success"] == '1' && $api_response["action"] == $action ) {
	879	+ return true;
	880	+ } else {
	881	+ wp_send_json( [
	882	+ 'success' => false,
	883	+ 'error' => __( 'reCAPTCHA validation failed', 'weforms' ),
	884	+ ] );
	885	+ }
858	886	}
859	887	}
860		- }
861	888	/**
862	889	* reCaptcha Validation
863	890	*
864	891	* @return void