<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Forms;

[2] Fix | Delete

[3] Fix | Delete

/**

[4] Fix | Delete

* Class Anti-Spam v3.

[5] Fix | Delete

*

[6] Fix | Delete

* This class is used for modern Anti-Spam approach.

[7] Fix | Delete

*

[8] Fix | Delete

* @since 1.9.0

[9] Fix | Delete

*/

[10] Fix | Delete

class AntiSpam {

[11] Fix | Delete

[12] Fix | Delete

/**

[13] Fix | Delete

* Field ID to insert the honeypot field before.

[14] Fix | Delete

*

[15] Fix | Delete

* @since 1.9.0

[16] Fix | Delete

*

[17] Fix | Delete

* @var int

[18] Fix | Delete

*/

[19] Fix | Delete

private $insert_before_field_id = 1;

[20] Fix | Delete

[21] Fix | Delete

/**

[22] Fix | Delete

* Array with IDs of all honeypot fields on the current page grouped by form IDs ([form_id => field_id]).

[23] Fix | Delete

*

[24] Fix | Delete

* @since 1.9.0.3

[25] Fix | Delete

*

[26] Fix | Delete

* @var array

[27] Fix | Delete

*/

[28] Fix | Delete

private $forms_data = [];

[29] Fix | Delete

[30] Fix | Delete

/**

[31] Fix | Delete

* Initialise the actions for the modern Anti-Spam.

[32] Fix | Delete

*

[33] Fix | Delete

* @since 1.9.0

[34] Fix | Delete

*/

[35] Fix | Delete

public function init() {

[36] Fix | Delete

[37] Fix | Delete

$this->hooks();

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

/**

[41] Fix | Delete

* Register hooks.

[42] Fix | Delete

*

[43] Fix | Delete

* @since 1.9.0

[44] Fix | Delete

*/

[45] Fix | Delete

private function hooks() {

[46] Fix | Delete

[47] Fix | Delete

// Frontend hooks.

[48] Fix | Delete

add_filter( 'wpforms_frontend_strings', [ $this, 'add_frontend_strings' ] );

[49] Fix | Delete

add_filter( 'wpforms_frontend_fields_base_level', [ $this, 'get_random_field' ], 20 );

[50] Fix | Delete

add_action( 'wpforms_display_field_before', [ $this, 'maybe_insert_honeypot_field' ], 1, 2 );

[51] Fix | Delete

add_action( 'wpforms_display_fields_after', [ $this, 'maybe_insert_honeypot_init_js' ] );

[52] Fix | Delete

[53] Fix | Delete

// Builder hooks.

[54] Fix | Delete

add_filter( 'wpforms_builder_panel_settings_init_form_data', [ $this, 'init_builder_settings_form_data' ] );

[55] Fix | Delete

add_filter( 'wpforms_admin_builder_templates_apply_to_new_form_modify_data', [ $this, 'update_template_form_data' ] );

[56] Fix | Delete

add_filter( 'wpforms_admin_builder_templates_apply_to_existing_form_modify_data', [ $this, 'update_template_form_data' ] );

[57] Fix | Delete

add_filter( 'wpforms_templates_class_base_template_modify_data', [ $this, 'update_template_form_data' ] );

[58] Fix | Delete

add_filter( 'wpforms_templates_class_base_template_replace_modify_data', [ $this, 'update_template_form_data' ] );

[59] Fix | Delete

add_filter( 'wpforms_form_handler_convert_form_data', [ $this, 'update_template_form_data' ] );

[60] Fix | Delete

}

[61] Fix | Delete

[62] Fix | Delete

/**

[63] Fix | Delete

* Store a random field id to insert a honeypot field later.

[64] Fix | Delete

*

[65] Fix | Delete

* @since 1.9.0

[66] Fix | Delete

*

[67] Fix | Delete

* @param array|mixed $fields_data Form fields data.

[68] Fix | Delete

*

[69] Fix | Delete

* @return array|mixed Form fields data.

[70] Fix | Delete

*/

[71] Fix | Delete

public function get_random_field( $fields_data ) {

[72] Fix | Delete

[73] Fix | Delete

if ( ! is_array( $fields_data ) ) {

[74] Fix | Delete

return $fields_data;

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete

$random_field_id = array_rand( $fields_data );

[78] Fix | Delete

[79] Fix | Delete

if ( ! empty( $random_field_id ) ) {

[80] Fix | Delete

$this->insert_before_field_id = $random_field_id;

[81] Fix | Delete

}

[82] Fix | Delete

[83] Fix | Delete

return $fields_data;

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

/**

[87] Fix | Delete

* Insert honeypot field before a random field.

[88] Fix | Delete

*

[89] Fix | Delete

* @since 1.9.0

[90] Fix | Delete

*

[91] Fix | Delete

* @param array $field Field.

[92] Fix | Delete

* @param array $form_data Form data.

[93] Fix | Delete

*/

[94] Fix | Delete

public function maybe_insert_honeypot_field( array $field, array $form_data ) {

[95] Fix | Delete

[96] Fix | Delete

if (

[97] Fix | Delete

$this->insert_before_field_id !== (int) $field['id'] ||

[98] Fix | Delete

! $this->is_honeypot_enabled( $form_data )

[99] Fix | Delete

) {

[100] Fix | Delete

return;

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

$honeypot_field_id = $this->get_honeypot_field_id( $form_data );

[104] Fix | Delete

$form_id = (int) $form_data['id'];

[105] Fix | Delete

$label = $this->get_honeypot_label( $form_data );

[106] Fix | Delete

$id_attr = sprintf( 'wpforms-%1$s-field_%2$s', $form_id, $honeypot_field_id );

[107] Fix | Delete

$is_amp = wpforms_is_amp();

[108] Fix | Delete

$this->forms_data[ $form_id ] = $honeypot_field_id;

[109] Fix | Delete

[110] Fix | Delete

if ( $is_amp ) {

[111] Fix | Delete

echo '<amp-layout layout="nodisplay">';

[112] Fix | Delete

}

[113] Fix | Delete

[114] Fix | Delete

?>

[115] Fix | Delete

<div id="<?php echo esc_attr( $id_attr ); ?>-container"

[116] Fix | Delete

class="wpforms-field wpforms-field-text"

[117] Fix | Delete

data-field-type="text"

[118] Fix | Delete

data-field-id="<?php echo esc_attr( $honeypot_field_id ); ?>"

[119] Fix | Delete

>

[120] Fix | Delete

<label class="wpforms-field-label" for="<?php echo esc_attr( $id_attr ); ?>" ><?php echo esc_html( $label ); ?></label>

[121] Fix | Delete

<input type="text" id="<?php echo esc_attr( $id_attr ); ?>" class="wpforms-field-medium" name="wpforms[fields][<?php echo esc_attr( $honeypot_field_id ); ?>]" >

[122] Fix | Delete

</div>

[123] Fix | Delete

<?php

[124] Fix | Delete

[125] Fix | Delete

if ( $is_amp ) {

[126] Fix | Delete

echo '</amp-layout>';

[127] Fix | Delete

}

[128] Fix | Delete

}

[129] Fix | Delete

[130] Fix | Delete

/**

[131] Fix | Delete

* Insert the inline styles.

[132] Fix | Delete

*

[133] Fix | Delete

* @since 1.9.0

[134] Fix | Delete

*

[135] Fix | Delete

* @param array $form_data Form data.

[136] Fix | Delete

*

[137] Fix | Delete

* @noinspection PhpUnusedParameterInspection

[138] Fix | Delete

*/

[139] Fix | Delete

public function maybe_insert_honeypot_init_js( array $form_data ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found

[140] Fix | Delete

[141] Fix | Delete

if (

[142] Fix | Delete

! $this->forms_data ||

[143] Fix | Delete

wpforms_is_amp()

[144] Fix | Delete

) {

[145] Fix | Delete

return;

[146] Fix | Delete

}

[147] Fix | Delete

[148] Fix | Delete

$ids = [];

[149] Fix | Delete

[150] Fix | Delete

foreach ( $this->forms_data as $form_id => $honeypot_field_id ) {

[151] Fix | Delete

$ids[] = sprintf(

[152] Fix | Delete

'#wpforms-%1$d-field_%2$d-container',

[153] Fix | Delete

$form_id,

[154] Fix | Delete

$honeypot_field_id

[155] Fix | Delete

);

[156] Fix | Delete

}

[157] Fix | Delete

[158] Fix | Delete

if ( ! $ids ) {

[159] Fix | Delete

return;

[160] Fix | Delete

}

[161] Fix | Delete

[162] Fix | Delete

$styles = sprintf(

[163] Fix | Delete

'%1$s { position: absolute !important; overflow: hidden !important; display: inline !important; height: 1px !important; width: 1px !important; z-index: -1000 !important; padding: 0 !important; } %1$s input { visibility: hidden; } #wpforms-conversational-form-page %1$s label { counter-increment: none; }',

[164] Fix | Delete

esc_attr( implode( ',', $ids ) )

[165] Fix | Delete

);

[166] Fix | Delete

[167] Fix | Delete

// There must be no empty lines inside the script. Otherwise, wpautop adds <p> tags which break script execution.

[168] Fix | Delete

printf(

[169] Fix | Delete

"<script>

[170] Fix | Delete

( function() {

[171] Fix | Delete

const style = document.createElement( 'style' );

[172] Fix | Delete

style.appendChild( document.createTextNode( '%s' ) );

[173] Fix | Delete

document.head.appendChild( style );

[174] Fix | Delete

document.currentScript?.remove();

[175] Fix | Delete

} )();

[176] Fix | Delete

</script>",

[177] Fix | Delete

esc_js( $styles )

[178] Fix | Delete

);

[179] Fix | Delete

}

[180] Fix | Delete

[181] Fix | Delete

/**

[182] Fix | Delete

* Get honeypot field label.

[183] Fix | Delete

*

[184] Fix | Delete

* @since 1.9.0

[185] Fix | Delete

*

[186] Fix | Delete

* @param array $form_data Form data.

[187] Fix | Delete

*/

[188] Fix | Delete

private function get_honeypot_label( array $form_data ): string {

[189] Fix | Delete

[190] Fix | Delete

$labels = [];

[191] Fix | Delete

[192] Fix | Delete

foreach ( $form_data['fields'] ?? [] as $field ) {

[193] Fix | Delete

if ( ! empty( $field['label'] ) ) {

[194] Fix | Delete

$labels[] = $field['label'];

[195] Fix | Delete

}

[196] Fix | Delete

}

[197] Fix | Delete

[198] Fix | Delete

$words = explode( ' ', implode( ' ', $labels ) );

[199] Fix | Delete

$count_words = count( $words );

[200] Fix | Delete

$label_keys = (array) array_rand( $words, min( $count_words, 3 ) );

[201] Fix | Delete

[202] Fix | Delete

shuffle( $label_keys );

[203] Fix | Delete

[204] Fix | Delete

$label_words = array_map(

[205] Fix | Delete

static function ( $key ) use ( $words ) {

[206] Fix | Delete

[207] Fix | Delete

return $words[ $key ];

[208] Fix | Delete

},

[209] Fix | Delete

$label_keys

[210] Fix | Delete

);

[211] Fix | Delete

[212] Fix | Delete

return implode( ' ', $label_words );

[213] Fix | Delete

}

[214] Fix | Delete

[215] Fix | Delete

/**

[216] Fix | Delete

* Add strings to the frontend.

[217] Fix | Delete

*

[218] Fix | Delete

* @since 1.9.0

[219] Fix | Delete

*

[220] Fix | Delete

* @param array|mixed $strings Frontend strings.

[221] Fix | Delete

*

[222] Fix | Delete

* @return array Frontend strings.

[223] Fix | Delete

*/

[224] Fix | Delete

public function add_frontend_strings( $strings ): array {

[225] Fix | Delete

[226] Fix | Delete

$strings = (array) $strings;

[227] Fix | Delete

[228] Fix | Delete

// Store the honeypot field ID for validation and adding inline styles.

[229] Fix | Delete

$strings['hn_data'] = $this->forms_data;

[230] Fix | Delete

[231] Fix | Delete

return $strings;

[232] Fix | Delete

}

[233] Fix | Delete

[234] Fix | Delete

/**

[235] Fix | Delete

* Validate whether the modern Anti-Spam is enabled.

[236] Fix | Delete

*

[237] Fix | Delete

* @since 1.9.0

[238] Fix | Delete

*

[239] Fix | Delete

* @param array $form_data Form data.

[240] Fix | Delete

* @param array $fields Fields.

[241] Fix | Delete

* @param array $entry Form submission raw data ($_POST).

[242] Fix | Delete

*

[243] Fix | Delete

* @return bool True if the entry is valid, false otherwise.

[244] Fix | Delete

* @noinspection PhpUnusedParameterInspection

[245] Fix | Delete

*/

[246] Fix | Delete

public function validate( array $form_data, array $fields, array &$entry ): bool {

[247] Fix | Delete

[248] Fix | Delete

// Bail out if the modern Anti-Spam is not enabled.

[249] Fix | Delete

if ( ! $this->is_honeypot_enabled( $form_data ) ) {

[250] Fix | Delete

return true;

[251] Fix | Delete

}

[252] Fix | Delete

[253] Fix | Delete

$honeypot_fields = array_diff_key( $entry['fields'], $form_data['fields'] );

[254] Fix | Delete

$is_valid = true;

[255] Fix | Delete

[256] Fix | Delete

// Compatibility with the WPML plugin (WPFML addon).

[257] Fix | Delete

// In case the form contains an Entry Preview field, they add an extra field with ID 0 to the entry.

[258] Fix | Delete

if (

[259] Fix | Delete

isset( $entry['fields'][0] ) &&

[260] Fix | Delete

defined( 'WPML_WP_FORMS_VERSION' ) &&

[261] Fix | Delete

wpforms_has_field_type( 'entry-preview', $form_data )

[262] Fix | Delete

) {

[263] Fix | Delete

unset( $honeypot_fields[0] );

[264] Fix | Delete

}

[265] Fix | Delete

[266] Fix | Delete

foreach ( $honeypot_fields as $key => $honeypot_field ) {

[267] Fix | Delete

// Remove the honeypot field from the entry.

[268] Fix | Delete

unset( $entry['fields'][ $key ] );

[269] Fix | Delete

[270] Fix | Delete

// If the honeypot field is not empty, the entry is invalid.

[271] Fix | Delete

if ( ! empty( $honeypot_field ) ) {

[272] Fix | Delete

$is_valid = false;

[273] Fix | Delete

}

[274] Fix | Delete

}

[275] Fix | Delete

[276] Fix | Delete

return $is_valid;

[277] Fix | Delete

}

[278] Fix | Delete

[279] Fix | Delete

/**

[280] Fix | Delete

* Check if the modern Anti-Spam is enabled.

[281] Fix | Delete

*

[282] Fix | Delete

* @since 1.9.0

[283] Fix | Delete

*

[284] Fix | Delete

* @param array $form_data Form data.

[285] Fix | Delete

*

[286] Fix | Delete

* @return bool True if the modern Anti-Spam is enabled, false otherwise.

[287] Fix | Delete

*/

[288] Fix | Delete

private function is_honeypot_enabled( array $form_data ): bool {

[289] Fix | Delete

[290] Fix | Delete

static $is_enabled;

[291] Fix | Delete

[292] Fix | Delete

if ( isset( $is_enabled ) ) {

[293] Fix | Delete

return $is_enabled;

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

/**

[297] Fix | Delete

* Filters whether the modern Anti-Spam is enabled.

[298] Fix | Delete

*

[299] Fix | Delete

* @since 1.9.0

[300] Fix | Delete

*

[301] Fix | Delete

* @param bool $is_enabled True if the modern Anti-Spam is enabled, false otherwise.

[302] Fix | Delete

*/

[303] Fix | Delete

$is_enabled = (bool) apply_filters( 'wpforms_forms_anti_spam_v3_is_honeypot_enabled', ! empty( $form_data['settings']['antispam_v3'] ) );

[304] Fix | Delete

[305] Fix | Delete

return $is_enabled;

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

/**

[309] Fix | Delete

* Get the honeypot field ID.

[310] Fix | Delete

*

[311] Fix | Delete

* @since 1.9.0

[312] Fix | Delete

*

[313] Fix | Delete

* @param array $form_data Form data.

[314] Fix | Delete

*

[315] Fix | Delete

* @return int Honeypot field ID.

[316] Fix | Delete

*/

[317] Fix | Delete

private function get_honeypot_field_id( array $form_data ): int {

[318] Fix | Delete

[319] Fix | Delete

$max_key = max( array_keys( $form_data['fields'] ) );

[320] Fix | Delete

[321] Fix | Delete

// Find the first available field ID.

[322] Fix | Delete

for ( $i = 1; $i <= $max_key; $i++ ) {

[323] Fix | Delete

if ( ! isset( $form_data['fields'][ $i ] ) ) {

[324] Fix | Delete

return $i;

[325] Fix | Delete

}

[326] Fix | Delete

}

[327] Fix | Delete

[328] Fix | Delete

// If no available field ID found, use the max ID + 1.

[329] Fix | Delete

return $max_key + 1;

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

/**

[333] Fix | Delete

* Update the form data on the builder settings panel.

[334] Fix | Delete

*

[335] Fix | Delete

* @since 1.9.0

[336] Fix | Delete

*

[337] Fix | Delete

* @param array|bool $form_data Form data.

[338] Fix | Delete

*

[339] Fix | Delete

* @return array|bool

[340] Fix | Delete

*/

[341] Fix | Delete

public function init_builder_settings_form_data( $form_data ) {

[342] Fix | Delete

[343] Fix | Delete

if ( ! $form_data ) {

[344] Fix | Delete

return $form_data;

[345] Fix | Delete

}

[346] Fix | Delete

[347] Fix | Delete

// Update default time limit duration for the existing form.

[348] Fix | Delete

if ( empty( $form_data['settings']['anti_spam']['time_limit']['enable'] ) ) {

[349] Fix | Delete

$form_data['settings']['anti_spam']['time_limit']['duration'] = '2';

[350] Fix | Delete

}

[351] Fix | Delete

[352] Fix | Delete

return $form_data;

[353] Fix | Delete

}

[354] Fix | Delete

[355] Fix | Delete

/**

[356] Fix | Delete

* Update the template form data. Set the modern Anti-Spam setting.

[357] Fix | Delete

*

[358] Fix | Delete

* @since 1.9.0

[359] Fix | Delete

*

[360] Fix | Delete

* @param array|mixed $form_data Form data.

[361] Fix | Delete

*

[362] Fix | Delete

* @return array

[363] Fix | Delete

*/

[364] Fix | Delete

public function update_template_form_data( $form_data ): array {

[365] Fix | Delete

[366] Fix | Delete

$form_data = (array) $form_data;

[367] Fix | Delete

[368] Fix | Delete

// Unset the old Anti-Spam setting.

[369] Fix | Delete

unset( $form_data['settings']['antispam'] );

[370] Fix | Delete

[371] Fix | Delete

// Enable the modern Anti-Spam setting.

[372] Fix | Delete

$form_data['settings']['antispam_v3'] = $form_data['settings']['antispam_v3'] ?? '1';

[373] Fix | Delete

$form_data['settings']['anti_spam'] = $form_data['settings']['anti_spam'] ?? [];

[374] Fix | Delete

[375] Fix | Delete

// Enable the time limit setting.

[376] Fix | Delete

$form_data['settings']['anti_spam']['time_limit'] = [

[377] Fix | Delete

'enable' => '1',

[378] Fix | Delete

'duration' => '2',

[379] Fix | Delete

];

[380] Fix | Delete

[381] Fix | Delete

return $form_data;

[382] Fix | Delete

}

[383] Fix | Delete

}

[384] Fix | Delete

[385] Fix | Delete