| @@ -108,9 +108,12 @@ | ||
| 108 | 108 | $settings = array(); |
| 109 | 109 | $integrations = array(); |
| 110 | 110 | |
| 111 | 111 | if ( isset( $post_data['settings'] ) ) { |
| 112 | - $settings = (array) json_decode( $post_data['settings'] ); | |
| 112 | + $settings = json_decode( $post_data['settings'], true ); | |
| 113 | + $settings['message'] = sanitize_text_field( $settings['message'] ); | |
| 114 | + $settings['url'] = sanitize_url( $settings['url'] ); | |
| 115 | + $settings['limit_message'] = sanitize_text_field( $settings['limit_message'] ); | |
| 113 | 116 | } else { |
| 114 | 117 | $settings = isset( $form_data['wpuf_settings'] ) ? $form_data['wpuf_settings'] : []; |
| 115 | 118 | } |
| 116 | 119 | |
| @@ -134,14 +137,19 @@ | ||
| 134 | 137 | |
| 135 | 138 | // Update Old Entry meta_key if changed |
| 136 | 139 | $form_id = $form_data['wpuf_form_id']; |
| 137 | 140 | $form = weforms()->form->get( $form_id ); |
| 138 | - | |
| 141 | + | |
| 139 | 142 | $form->maybe_update_entries( $form_fields ); |
| 140 | 143 | |
| 141 | 144 | do_action( 'weforms_update_form', $form_data['wpuf_form_id'], $form_fields, $settings ); |
| 142 | 145 | |
| 143 | - wp_send_json_success( [ 'form_fields' => $form_fields ] ); | |
| 146 | + wp_send_json_success( | |
| 147 | + array( | |
| 148 | + 'form_fields' => $form_fields, | |
| 149 | + 'settings' => $settings, | |
| 150 | + ) | |
| 151 | + ); | |
| 144 | 152 | } |
| 145 | 153 | |
| 146 | 154 | /** |
| 147 | 155 | * Get all contact forms |
| @@ -527,9 +535,9 @@ | ||
| 527 | 535 | |
| 528 | 536 | $has_empty = false; |
| 529 | 537 | $answers = []; |
| 530 | 538 | $respondentPoints = isset( $form_settings['total_points'] ) ? floatval( $form_settings['total_points'] ) : 0; |
| 531 | - | |
| 539 | + $fields_formatted = array(); | |
| 532 | 540 | foreach ( $fields as $key => $field ) { |
| 533 | 541 | if ( $form_settings['quiz_form'] == 'yes' ) { |
| 534 | 542 | $selectedAnswers = isset( $field['selected_answers'] ) ? $field['selected_answers'] : ''; |
| 535 | 543 | $givenAnswer = isset( $field['value'] ) ? $field['value'] : ''; |
| @@ -538,9 +546,8 @@ | ||
| 538 | 546 | $fieldPoints = isset( $field['points'] ) ? floatval( $field['points'] ) : 0; |
| 539 | 547 | |
| 540 | 548 | if ( $template == 'radio_field' || $template == 'dropdown_field' ) { |
| 541 | 549 | $answers[$field['name']] = true; |
| 542 | - | |
| 543 | 550 | if ( empty( $givenAnswer ) ) { |
| 544 | 551 | $answers[$field['name']] = false; |
| 545 | 552 | $respondentPoints -= $fieldPoints; |
| 546 | 553 | } else { |
| @@ -574,14 +581,16 @@ | ||
| 574 | 581 | } |
| 575 | 582 | } |
| 576 | 583 | } elseif ( empty( $field['value'] ) ) { |
| 577 | 584 | $has_empty = true; |
| 578 | - break; | |
| 585 | + continue; | |
| 586 | + } else { | |
| 587 | + $field = WeForms_Form_Entry_Manager::format_entry_value( $field ); | |
| 588 | + array_push( $fields_formatted, $field ); | |
| 579 | 589 | } |
| 580 | 590 | } |
| 581 | - | |
| 582 | 591 | $response = [ |
| 583 | - 'form_fields' => $fields, | |
| 592 | + 'form_fields' => $fields_formatted, | |
| 584 | 593 | 'form_settings' => $form_settings, |
| 585 | 594 | 'meta_data' => $metadata, |
| 586 | 595 | 'payment_data' => $payment, |
| 587 | 596 | 'has_empty' => $has_empty, |
| @@ -588,8 +597,9 @@ | ||
| 588 | 597 | 'respondent_points' => $respondentPoints, |
| 589 | 598 | 'answers' => $answers, |
| 590 | 599 | ]; |
| 591 | 600 | |
| 601 | + | |
| 592 | 602 | wp_send_json_success( $response ); |
| 593 | 603 | } |
| 594 | 604 | |
| 595 | 605 | /** |
| @@ -698,13 +708,24 @@ | ||
| 698 | 708 | * @return void |
| 699 | 709 | */ |
| 700 | 710 | public function handle_frontend_submission() { |
| 701 | 711 | check_ajax_referer( 'wpuf_form_add' ); |
| 702 | - | |
| 703 | 712 | $form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0; |
| 704 | 713 | $page_id = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0; |
| 714 | + $form = weforms()->form->get( $form_id ); | |
| 705 | 715 | |
| 706 | - $form = weforms()->form->get( $form_id ); | |
| 716 | + /** | |
| 717 | + * Check if form submission is open. This resolves broken access control with unauthenticated users. | |
| 718 | + * Access is now checked on frontend form rendering and submission. | |
| 719 | + */ | |
| 720 | + $form_submission_status = $form->is_submission_open(); | |
| 721 | + if ( is_wp_error( $form_submission_status ) ) { | |
| 722 | + wp_send_json( [ | |
| 723 | + 'success' => false, | |
| 724 | + 'error' => __( 'Login Required for submission.', 'weforms' ), | |
| 725 | + ] ); | |
| 726 | + } | |
| 727 | + | |
| 707 | 728 | $form_settings = $form->get_settings(); |
| 708 | 729 | $form_fields = $form->get_fields(); |
| 709 | 730 | $entry_fields = $form->prepare_entries(); |
| 710 | 731 | $form_entries = weforms_get_form_entries( $form_id, [ 'number' => '', 'offset' => '' ] ); |
| @@ -758,29 +779,37 @@ | ||
| 758 | 779 | $this->validate_submission( $entry_fields, $form, $form_settings, $form_fields ); |
| 759 | 780 | |
| 760 | 781 | $entry_fields = apply_filters( 'weforms_before_entry_submission', $entry_fields, $form, $form_settings, $form_fields ); |
| 761 | 782 | |
| 762 | - $entry_id = 1; | |
| 763 | - $global_settings = weforms_get_settings(); | |
| 764 | - if ( empty( $global_settings['after_submission'] ) ) { | |
| 765 | - $entry_id = weforms_insert_entry( [ | |
| 766 | - 'form_id' => $form_id, | |
| 767 | - ], $entry_fields ); | |
| 768 | - if ( is_wp_error( $entry_id ) ) { | |
| 783 | + //check for entry_fields for a return error | |
| 784 | + if ( is_wp_error( $entry_fields ) ) { | |
| 769 | 785 | wp_send_json( [ |
| 770 | 786 | 'success' => false, |
| 771 | - 'error' => $entry_id->get_error_message(), | |
| 787 | + 'error' => $entry_fields->get_error_message(), | |
| 772 | 788 | ] ); |
| 789 | + } else { | |
| 790 | + $entry_id = 1; | |
| 791 | + $global_settings = weforms_get_settings(); | |
| 792 | + if ( empty( $form_settings['after_submission'] ) ) { | |
| 793 | + $entry_id = weforms_insert_entry( [ | |
| 794 | + 'form_id' => $form_id, | |
| 795 | + ], $entry_fields ); | |
| 796 | + if ( is_wp_error( $entry_id ) ) { | |
| 797 | + wp_send_json( [ | |
| 798 | + 'success' => false, | |
| 799 | + 'error' => $entry_id->get_error_message(), | |
| 800 | + ] ); | |
| 801 | + } | |
| 802 | + // Fire a hook for integration | |
| 803 | + do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings ); | |
| 804 | + $notification = new WeForms_Notification( [ | |
| 805 | + 'form_id' => $form_id, | |
| 806 | + 'page_id' => $page_id, | |
| 807 | + 'entry_id' => $entry_id, | |
| 808 | + ] ); | |
| 809 | + $notification->send_notifications(); | |
| 810 | + } | |
| 773 | 811 | } |
| 774 | - // Fire a hook for integration | |
| 775 | - do_action( 'weforms_entry_submission', $entry_id, $form_id, $page_id, $form_settings ); | |
| 776 | - $notification = new WeForms_Notification( [ | |
| 777 | - 'form_id' => $form_id, | |
| 778 | - 'page_id' => $page_id, | |
| 779 | - 'entry_id' => $entry_id, | |
| 780 | - ] ); | |
| 781 | - $notification->send_notifications(); | |
| 782 | - } | |
| 783 | 812 | // redirect URL |
| 784 | 813 | $show_message = false; |
| 785 | 814 | $redirect_to = false; |
| 786 | 815 | if ( $form_settings['redirect_to'] == 'page' ) { |
| @@ -814,8 +843,9 @@ | ||
| 814 | 843 | 'form_id' => $form_id, |
| 815 | 844 | 'entry_id' => $entry_id, |
| 816 | 845 | 'entry_fields' =>$entry_fields, |
| 817 | 846 | ] ); |
| 847 | + | |
| 818 | 848 | weforms_clear_buffer(); |
| 819 | 849 | wp_send_json( $response ); |
| 820 | 850 | } |
| 821 | 851 | |
