Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-09-23 14:43
📁 admin	-	2025-09-23 14:43
📄 class-db.php <?php // phpcs:disable WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName // phpcs:disable Generic.Commenting.DocComment.MissingShort /** @noinspection AutoloadingIssuesInspection / /* @noinspection PhpIllegalPsrClassPathInspection / // phpcs:disable Generic.Commenting.DocComment.MissingShort use WPForms\Helpers\DB; /* * DB class. * * This handy class originated from Pippin's Easy Digital Downloads. * See https://github.com/easydigitaldownloads/easy-digital-downloads/blob/master/includes/class-edd-db.php * * Subclasses should define $table_name, $version, and $primary_key in __construct() method. * * @since 1.1.6 / abstract class WPForms_DB { /* * Maximum length of index key. * * Indexes have a maximum size of 767 bytes. Historically, we haven't needed to be concerned about that. * As of WP 4.2, however, WP moved to utf8mb4, which uses 4 bytes per character. This means that an index, which * used to have room for floor(767/3) = 255 characters, now only has room for floor(767/4) = 191 characters. * * @since 1.8.2 / const MAX_INDEX_LENGTH = 191; /* * The dedicated cache key to store the All Keys array. * * @since 1.9.0 / const ALL_KEYS = '_all_keys'; /* * Database table name. * * @since 1.1.6 * * @var string / public $table_name; /* * Database version. * * @since 1.1.6 * * @var string / public $version; /* * Primary key (unique field) for the database table. * * @since 1.1.6 * * @var string / public $primary_key; /* * Database type identifier. * * @since 1.5.1 * * @var string / public $type; /* * Cache group. * * @since 1.9.0 * * @var string / private $cache_group; /* * Cache disabled. * * @since 1.9.0 * * @var bool / private $cache_disabled; /* * WPForms_DB constructor. * * @since 1.9.0 / public function __construct() { $this->cache_group = static::class . '_cache'; $this->cache_disabled = defined( 'WPFORMS_DISABLE_DB_CACHE' ) && WPFORMS_DISABLE_DB_CACHE; $this->hooks(); } /* * Query filter. * * @since 1.9.0 * * @return void / private function hooks() { add_filter( 'query', [ $this, 'query_filter' ] ); } /* * Retrieve the list of columns for the database table. * Subclasses should define an array of columns here. * * @since 1.1.6 * * @return array List of columns. / public function get_columns() { return []; } /* * Retrieve column defaults. * Subclasses can define default for any/all columns defined in the get_columns() method. * * @since 1.1.6 * * @return array All defined column defaults. / public function get_column_defaults() { return []; } /* * Filter the query. * * @since 1.9.0 * * @param string\|mixed $query Query. * * @return string / public function query_filter( $query ): string { $query = (string) $query; if ( strpos( $query, $this->table_name ) === false ) { // Not a query for our table, bail out. return $query; } if ( ! $this->is_select( $query ) ) { // Flush cache on non-SELECT queries. $this->cache_flush_group(); } return $query; } /* * Retrieve a row from the database based on a given row ID. * * @since 1.1.6 * * @param int $row_id Row ID. * * @return null\|object / public function get( $row_id ) { global $wpdb; $key = md5( __METHOD__ . $row_id ); $row = $this->cache_get( $key, $found ); if ( $found ) { return $row; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $row = $wpdb->get_row( $wpdb->prepare( "SELECT FROM $this->table_name WHERE $this->primary_key = %d LIMIT 1;", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared (int) $row_id ) ); $this->cache_set( $key, $row ); return $row; } /** * Retrieve a row based on column and row ID. * * @since 1.1.6 * * @param string $column Column name. * @param int\|string $value Column value. * * @return object\|null Database query result, object or null on failure. / public function get_by( $column, $value ) { global $wpdb; if ( empty( $value ) \|\| ! array_key_exists( $column, $this->get_columns() ) ) { return null; } $key = md5( __METHOD__ . $column . $value ); $row = $this->cache_get( $key, $found ); if ( $found ) { return $row; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $row = $wpdb->get_row( $wpdb->prepare( "SELECT FROM $this->table_name WHERE $column = %s LIMIT 1;", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared $value ) ); $this->cache_set( $key, $row ); return $row; } /** * Retrieve a value based on column name and row ID. * * @since 1.1.6 * * @param string $column Column name. * @param int\|string $row_id Row ID. * * @return string\|null Database query result (as string), or null on failure. * @noinspection PhpUnused / public function get_column( $column, $row_id ) { global $wpdb; if ( empty( $row_id ) \|\| ! array_key_exists( $column, $this->get_columns() ) ) { return null; } $key = md5( __METHOD__ . $column . $row_id ); $var = $this->cache_get( $key, $found ); if ( $found ) { return $var; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $var = $wpdb->get_var( $wpdb->prepare( "SELECT $column FROM $this->table_name WHERE $this->primary_key = %d LIMIT 1;", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared (int) $row_id ) ); $this->cache_set( $key, $var ); return $var; } /* * Retrieve one column value based on another given column and matching value. * * @since 1.1.6 * * @param string $column Column name. * @param string $column_where Column to match against in the WHERE clause. * @param string $column_value Value to match to the column in the WHERE clause. * * @return string\|null Database query result (as string), or null on failure. * @noinspection PhpUnused / public function get_column_by( $column, $column_where, $column_value ) { global $wpdb; if ( empty( $column ) \|\| empty( $column_where ) \|\| empty( $column_value ) \|\| ! array_key_exists( $column_where, $this->get_columns() ) \|\| ! array_key_exists( $column, $this->get_columns() ) ) { return null; } $key = md5( __METHOD__ . $column . $column_where . $column_value ); $var = $this->cache_get( $key, $found ); if ( $found ) { return $var; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $var = $wpdb->get_var( $wpdb->prepare( "SELECT $column FROM $this->table_name WHERE $column_where = %s LIMIT 1;", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared $column_value ) ); $this->cache_set( $key, $var ); return $var; } /* * Clone of $wpdb->query() with caching. * * @since 1.9.0 * * @param string $query Database query. * * @return int\|bool Boolean true for CREATE, ALTER, TRUNCATE and DROP queries. Number of rows * affected/selected for all other queries. Boolean false on error. * * @noinspection PhpMissingParamTypeInspection / public function query( $query ) { global $wpdb; if ( ! $this->is_select( $query ) ) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->query( $query ); } $key = md5( __METHOD__ . $query ); $results = $this->cache_get( $key, $found ); if ( $found ) { return $results; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $results = $wpdb->query( $query ); $this->cache_set( $key, $results ); return $results; } /* * Clone of $wpdb->get_results() with caching. * * @since 1.9.0 * * @param string\|null $query SQL query. * @param string $output Any of ARRAY_A \| ARRAY_N \| OBJECT \| OBJECT_K constants. * * @return array\|object\|null Database query results. * @noinspection PhpMissingParamTypeInspection / public function get_results( $query = null, $output = OBJECT ) { global $wpdb; if ( ! $this->is_select( $query ) ) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->get_results( $query, $output ); } $key = md5( __METHOD__ . $query . $output ); $results = $this->cache_get( $key, $found ); if ( $found ) { return $results; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $results = $wpdb->get_results( $query, $output ); $this->cache_set( $key, $results ); return $results; } /* * Clone of $wpdb->get_col() with caching. * * @since 1.9.4 * * @param string\|null $query SQL query. * @param int $x Column to return. Indexed from 0. * * @return array Database query results. * @noinspection PhpMissingParamTypeInspection / public function get_col( $query = null, $x = 0 ) { global $wpdb; if ( ! $this->is_select( $query ) ) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->get_col( $query ); } $key = md5( __METHOD__ . $query . $x ); $col = $this->cache_get( $key, $found ); if ( $found ) { return $col; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $col = $wpdb->get_col( $query, $x ); $this->cache_set( $key, $col ); return $col; } /* * Clone of $wpdb->get_row() with caching. * * @since 1.9.0 * * @param string\|null $query SQL query. * @param string $output Optional. The required return type. One of OBJECT, ARRAY_A, or ARRAY_N, which * correspond to an stdClass object, an associative array, or a numeric array, * respectively. Default OBJECT. * @param int $y Optional. Row to return. Indexed from 0. Default 0. * * @return array\|int\|object\|stdClass\|null Database query result in format specified by $output or null on failure. * @noinspection PhpMissingParamTypeInspection / public function get_row( $query = null, $output = OBJECT, $y = 0 ) { global $wpdb; if ( ! $query ) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->get_row( $query, $output, $y ); } $key = md5( __METHOD__ . $query . $output . $y ); $row = $this->cache_get( $key, $found ); if ( $found ) { return $row; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $row = $wpdb->get_row( $query, $output, $y ); $this->cache_set( $key, $row ); return $row; } /* * Clone of $wpdb->get_var() with caching. * * @since 1.9.0 * * @param string\|null $query Optional. SQL query. Defaults to null, use the result from the previous query. * @param int $x Optional. Column of value to return. Indexed from 0. Default 0. * @param int $y Optional. Row of value to return. Indexed from 0. Default 0. * * @return string\|null Database query result (as string), or null on failure. * * @noinspection PhpMissingParamTypeInspection / public function get_var( $query = null, $x = 0, $y = 0 ) { global $wpdb; if ( ! $query ) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->get_var( $query, $x, $y ); } $key = md5( __METHOD__ . $query . $x . $y ); $var = $this->cache_get( $key, $found ); if ( $found ) { return $var; } // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $var = $wpdb->get_var( $query, $x, $y ); $this->cache_set( $key, $var ); return $var; } /* * Insert a new record into the database. * * @since 1.1.6 * * @param array $data Column data. * @param string $type Optional. Data type context. * * @return int ID for the newly inserted record. Zero otherwise. / public function add( $data, $type = '' ) { global $wpdb; // Set default values. $data = wp_parse_args( $data, $this->get_column_defaults() ); do_action( 'wpforms_pre_insert_' . $type, $data ); // Initialise column format array. $column_formats = $this->get_columns(); // Force fields to lower a case. $data = array_change_key_case( $data ); // Whitelist columns. $data = array_intersect_key( $data, $column_formats ); // Reorder $column_formats to match the order of columns given in $data. $data_keys = array_keys( $data ); $column_formats = array_merge( array_flip( $data_keys ), $column_formats ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery $wpdb->insert( $this->table_name, $data, $column_formats ); do_action( 'wpforms_post_insert_' . $type, $wpdb->insert_id, $data ); return $wpdb->insert_id; } /* * Insert a new record into the database. This runs the add() method. * * @see add() * * @since 1.1.6 * * @param array $data Column data. * * @return int ID for the newly inserted record. / public function insert( $data ) { return $this->add( $data ); } /* * Update an existing record in the database. * * @since 1.1.6 * * @param int\|string $row_id Row ID for the record being updated. * @param array $data Optional. Array of columns and associated data to update. Default empty array. * @param string $where Optional. Column to match against in the WHERE clause. If empty, $primary_key * will be used. Default empty. * @param string $type Optional. Data type context, e.g. 'affiliate', 'creative', etc. Default empty. * * @return bool False if the record could not be updated, true otherwise. / public function update( $row_id, $data = [], $where = '', $type = '' ) { global $wpdb; // Row ID must be a positive integer. $row_id = absint( $row_id ); if ( empty( $row_id ) ) { return false; } if ( empty( $where ) ) { $where = $this->primary_key; } /* * Fires before updating a record in the database. * * @since 1.5.9 * @since 1.9.2 Added $row_id parameter. * * @param array $data Array of columns and associated data to update. * @param int $row_id Row ID for the record being updated. / do_action( "wpforms_pre_update_{$type}", $data, $row_id ); // Initialise column format array. $column_formats = $this->get_columns(); // Force fields to the lower case. $data = array_change_key_case( $data ); // Whitelist columns. $data = array_intersect_key( $data, $column_formats ); // Reorder $column_formats to match the order of columns given in $data. $data_keys = array_keys( $data ); $column_formats = array_merge( array_flip( $data_keys ), $column_formats ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching if ( $wpdb->update( $this->table_name, $data, [ $where => $row_id ], $column_formats ) === false ) { return false; } /* * Fires after a record has been updated in the database. * * @since 1.1.6 * @since 1.9.2 Added $row_id parameter. * * @param array $data Array of columns and associated data that were updated. * @param int $row_id Row ID for the record that was updated. / do_action( "wpforms_post_update_{$type}", $data, $row_id ); return true; } /* * Delete a record from the database. * * @since 1.1.6 * * @param int\|string $row_id Row ID. * * @return bool False if the record could not be deleted, true otherwise. / public function delete( $row_id = 0 ): bool { global $wpdb; // Row ID must be a positive integer. $row_id = absint( $row_id ); if ( empty( $row_id ) ) { return false; } /* * Fires before a record is deleted from the database. * * @since 1.5.9 * * @param int $row_id Row ID. / do_action( 'wpforms_pre_delete', $row_id ); /* * Fires before a record is deleted from the database by type. * * @since 1.5.9 * @since 1.8.6 Added `$primary_key` parameter. * * @param int $row_id Column value. * @param string $primary_key Column name. / do_action( 'wpforms_pre_delete_' . $this->type, $row_id, $this->primary_key ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $result = $wpdb->query( $wpdb->prepare( "DELETE FROM $this->table_name WHERE $this->primary_key = %d", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared $row_id ) ); if ( $result === false ) { return false; } do_action( 'wpforms_post_delete', $row_id ); do_action( 'wpforms_post_delete_' . $this->type, $row_id ); return true; } /* * Delete a record from the database by column. * * @since 1.1.6 * * @param string $column Column name. * @param int\|string $column_value Column value. * * @return bool False if the record could not be deleted, true otherwise. / public function delete_by( $column, $column_value ) { global $wpdb; if ( empty( $column ) \|\| empty( $column_value ) \|\| ! array_key_exists( $column, $this->get_columns() ) ) { return false; } // This action is documented in includes/class-db.php method delete(). do_action( 'wpforms_pre_delete', $column_value ); // This action is documented in includes/class-db.php method delete(). do_action( 'wpforms_pre_delete_' . $this->type, $column_value, $column ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching $result = $wpdb->query( $wpdb->prepare( "DELETE FROM $this->table_name WHERE $column = %s", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared $column_value ) ); if ( $result === false ) { return false; } do_action( 'wpforms_post_delete', $column_value ); do_action( 'wpforms_post_delete_' . $this->type, $column_value ); return true; } /* * Delete record(s) from the database using WHERE IN syntax. * * @since 1.6.4 * * @param string $column Column name. * @param mixed $column_values Column values. * * @return int\|bool Number of deleted records, false otherwise. / public function delete_where_in( $column, $column_values ) { global $wpdb; if ( empty( $column ) \|\| empty( $column_values ) ) { return false; } if ( ! array_key_exists( $column, $this->get_columns() ) ) { return false; } $values = (array) $column_values; foreach ( $values as $key => $value ) { // Check if a string contains an integer and sanitize accordingly. if ( (string) (int) $value === $value ) { $values[ $key ] = (int) $value; $placeholders[ $key ] = '%d'; } else { $values[ $key ] = sanitize_text_field( $value ); $placeholders[ $key ] = '%s'; } } $placeholders = isset( $placeholders ) ? implode( ',', $placeholders ) : ''; $sql = "DELETE FROM $this->table_name WHERE $column IN ( $placeholders )"; // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared return $wpdb->query( $wpdb->prepare( $sql, $values ) ); } /* * Check if the given table exists. * * @since 1.1.6 * @since 1.5.9 Default value is now the current child class table name. * * @param string $table The table name. Defaults to the child class table name. * * @return bool If the table name exists. / public function table_exists( string $table = '' ): bool { $table = ! empty( $table ) ? sanitize_text_field( $table ) : $this->table_name; return DB::table_exists( $table ); } /* * Build WHERE for a query. * * @since 1.7.2.2 * * @param array $args Optional args. * @param array $keys Allowed arg items. * @param string\|string[] $formats Formats of arg items. * * @return string / protected function build_where( $args, $keys = [], $formats = [] ) { $formats = array_pad( $formats, count( $keys ), '%d' ); $where = ''; foreach ( $keys as $index => $key ) { // Value `$args[ $key ]` can be a natural number and a numeric string. // We should skip empty string values, but continue working with '0'. if ( empty( $args[ $key ] ) && $args[ $key ] !== '0' ) { continue; } $ids = wpforms_wpdb_prepare_in( $args[ $key ], $formats[ $index ] ); $where .= empty( $where ) ? 'WHERE' : 'AND'; $where .= " `{$key}` IN ( {$ids} ) "; } return $where; } /* * WP Cache Get wrapper. * * @since 1.9.0 * * @param int\|string $key Cache key. * @param bool\|null $found Whether the key was found in the cache. * * @return false\|mixed * @noinspection PhpMissingParamTypeInspection / private function cache_get( $key, &$found ) { if ( $this->cache_disabled ) { $found = false; return false; } $all_keys = wp_cache_get( self::ALL_KEYS, $this->cache_group, false, $found ); $all_keys = $found ? (array) $all_keys : []; if ( ! in_array( $key, $all_keys, true ) ) { $found = false; return false; } $data = wp_cache_get( $key, $this->cache_group, false, $found ); return $found ? $data : false; } /* * WP Cache Set wrapper. * * @since 1.9.0 * * @param string $key Cache key. * @param mixed $data Cache data. * * @return bool * @noinspection PhpReturnValueOfMethodIsNeverUsedInspection / private function cache_set( string $key, $data ): bool { if ( $this->cache_disabled ) { return false; } $all_keys = wp_cache_get( self::ALL_KEYS, $this->cache_group, false, $found ); $all_keys = $found ? array_unique( array_merge( (array) $all_keys, [ $key ] ) ) : [ $key ]; return ( wp_cache_set( $key, $data, $this->cache_group ) && wp_cache_set( self::ALL_KEYS, $all_keys, $this->cache_group ) ); } /* * Flush the cache group. * * @since 1.9.0 * * @return bool * @noinspection PhpReturnValueOfMethodIsNeverUsedInspection / private function cache_flush_group(): bool { if ( $this->cache_disabled ) { return false; } $all_keys = wp_cache_get( self::ALL_KEYS, $this->cache_group, false, $found ); if ( ! $found ) { return true; } $result = wp_cache_delete( self::ALL_KEYS, $this->cache_group ); foreach ( (array) $all_keys as $key ) { $result = wp_cache_delete( $key, $this->cache_group ) && $result; } return $result; } /* * Check if the query is a SELECT query. * * @since 1.9.0 * * @param string\|null $query SQL query. * * @return bool * @noinspection PhpMissingParamTypeInspection / private function is_select( $query ): bool { return stripos( trim( (string) $query ), 'SELECT' ) === 0; } /* * Get an instance of the current class. * Used to reload the class while going through the blogs of multisite. * * @see WPForms_Install::maybe_create_tables() * * @since 1.8.9 */ public static function get_instance(): WPForms_DB { return new static(); } }	23.42 KB	2025-09-23 14:43
📄 class-fields.php <?php if ( ! defined( 'ABSPATH' ) ) { exit; } /** * Load the field types. * * @since 1.0.0 / class WPForms_Fields { /* * Primary class constructor. * * @since 1.0.0 / public function __construct() { $this->init(); } /* * Initialize hooks. * * @since 1.2.8 * @since 1.8.2 Moved base class loading to \WPForms\WPForms::includes. / public function init() { $this->hooks(); } /* * Hooks. * * @since 1.7.7 / private function hooks() { // Load default fields on WP init. add_action( 'init', [ $this, 'load' ] ); } /* * Load default field types. * * @since 1.0.0 * @since 1.9.4 Removed Pro fields from the list. They loaded in the main Loader class. / public function load() { $fields = [ 'text', 'textarea', 'select', 'radio', 'checkbox', 'email', 'name', 'number', 'number-slider', 'internal-information', ]; // Include GDPR Checkbox field if GDPR enhancements are enabled. if ( wpforms_setting( 'gdpr' ) ) { $fields[] = 'gdpr-checkbox'; } /* * Filters array of fields to be loaded. * * @since 1.0.0 * * @param array $fields Field types. */ $fields = (array) apply_filters( // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName 'wpforms_load_fields', $fields ); foreach ( $fields as $field ) { $file = WPFORMS_PLUGIN_DIR . 'includes/fields/class-' . $field . '.php'; if ( file_exists( $file ) ) { require_once $file; } } // We have to put it here due to tests for restricted emails. new WPForms_Field_Email(); } } new WPForms_Fields();	1.58 KB	2025-09-23 14:43
📄 class-form.php <?php /** * All the form goodness and basics. * * Contains a bunch of helper methods as well. * * @since 1.0.0 / class WPForms_Form_Handler { /* * Tags taxonomy. * * @since 1.7.5 / const TAGS_TAXONOMY = 'wpforms_form_tag'; /* * Allowed post types. * * @since 1.8.8 / const POST_TYPES = [ 'wpforms', 'wpforms-template', ]; /* * Is form data slashing enabled. * * @since 1.9.0 * * @var bool / private $is_form_data_slashing_enabled; /* * Primary class constructor. * * @since 1.0.0 / public function __construct() { $this->is_form_data_slashing_enabled = wpforms_is_form_data_slashing_enabled(); $this->hooks(); } /* * Hooks. * * @since 1.7.5 / private function hooks() { // Register wpforms custom post type and taxonomy. add_action( 'init', [ $this, 'register_taxonomy' ] ); add_action( 'init', [ $this, 'register_cpt' ] ); // Add wpforms to new-content admin bar menu. add_action( 'admin_bar_menu', [ $this, 'admin_bar' ], 99 ); add_action( 'wpforms_create_form', [ $this, 'track_first_form' ], 10, 3 ); // @WPFormsBackCompat Support Zapier v1.5.0 and earlier. add_filter( 'wpforms_form_handler_add_notices', [ $this, '_zapier_disconnected_on_duplication' ], 10, 3 ); } /* * Register the custom post type to be used for forms. * * @since 1.0.0 / public function register_cpt() { // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Filters Custom Post Type arguments. * * @since 1.0.0 * * @param array $args Arguments. / $args = apply_filters( 'wpforms_post_type_args', [ 'label' => 'WPForms', 'public' => false, 'exclude_from_search' => true, 'show_ui' => false, 'show_in_admin_bar' => false, 'rewrite' => false, 'query_var' => false, 'can_export' => false, 'supports' => [ 'title', 'author', 'revisions' ], 'capability_type' => 'wpforms_form', // Not using 'capability_type' anywhere. It just has to be custom for security reasons. 'map_meta_cap' => false, // Don't let WP to map meta caps to have a granular control over this process via 'map_meta_cap' filter. ] ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName // Register the post type. register_post_type( 'wpforms', $args ); } /* * Register the new taxonomy for tags. * * @since 1.7.5 / public function register_taxonomy() { /* * Filters Tags taxonomy arguments. * * @since 1.7.5 * * @param array $args Arguments. / $args = apply_filters( 'wpforms_form_handler_register_taxonomy_args', [ 'hierarchical' => false, 'rewrite' => false, 'public' => false, ] ); register_taxonomy( self::TAGS_TAXONOMY, 'wpforms', $args ); } /* * Add "WPForms" item to new-content admin bar menu item. * * @since 1.1.7.2 * * @param WP_Admin_Bar $wp_admin_bar WP_Admin_Bar instance, passed by reference. / public function admin_bar( $wp_admin_bar ) { if ( ! is_admin_bar_showing() \|\| ! wpforms_current_user_can( 'create_forms' ) ) { return; } $args = [ 'id' => 'wpforms', 'title' => esc_html__( 'WPForms', 'wpforms-lite' ), 'href' => admin_url( 'admin.php?page=wpforms-builder' ), 'parent' => 'new-content', ]; $wp_admin_bar->add_node( $args ); } /* * Preserve the timestamp when the very first form has been created. * * @since 1.6.7.1 * * @param int $form_id Newly created form ID. * @param array $form Array past to create a new form in wp_posts table. * @param array $data Additional form data. / public function track_first_form( $form_id, $form, $data ) { // Do we have the value already? $time = get_option( 'wpforms_forms_first_created' ); // Check whether we have already saved this option - skip. if ( ! empty( $time ) ) { return; } // Check whether we have any forms other than the currently created one. $other_form = $this->get( '', [ 'posts_per_page' => 1, 'nopaging' => false, 'fields' => 'ids', 'post__not_in' => [ $form_id ], // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in 'update_post_meta_cache' => false, 'update_post_term_cache' => false, 'cap' => false, ] ); // As we have other forms - we are not certain about the situation, skip. if ( ! empty( $other_form ) ) { return; } add_option( 'wpforms_forms_first_created', time(), '', 'no' ); } /* * Fetch forms. * * @since 1.0.0 * * @param mixed $id Form ID. * @param array $args Additional arguments array. * * @return array\|bool\|null\|WP_Post / public function get( $id = '', array $args = [] ) { if ( $id === false ) { return false; } // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Allow developers to filter the WPForms_Form_Handler::get() arguments. * * @since 1.0.0 * * @param array $args Arguments array. * @param mixed $id Form ID. / $args = (array) apply_filters( 'wpforms_get_form_args', $args, $id ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName // By default, we should return only published forms. $defaults = [ 'post_status' => 'publish', ]; $args = (array) wp_parse_args( $args, $defaults ); $forms = empty( $id ) ? $this->get_multiple( $args ) : $this->get_single( $id, $args ); return ! empty( $forms ) ? $forms : false; } /* * Fetch a single form. * * @since 1.5.8 * * @param string\|int $id Form ID. * @param array $args Additional arguments array. * * @return array\|bool\|null\|WP_Post / protected function get_single( $id = '', array $args = [] ) { // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Allow developers to filter the get_single() arguments. * * @since 1.5.8 * * @param array $args Arguments array, same as for `get_post()` function. * @param string\|int $id Form ID. / $args = apply_filters( 'wpforms_get_single_form_args', $args, $id ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName if ( ! isset( $args['cap'] ) && wpforms()->obj( 'access' )->init_allowed() ) { $args['cap'] = 'view_form_single'; } if ( ! empty( $args['cap'] ) && ! wpforms_current_user_can( $args['cap'], $id ) ) { return false; } // If no ID provided, we can't get a single form. if ( empty( $id ) ) { return false; } // If ID is provided, we get a single form. $form = get_post( absint( $id ) ); // Check if the form exists. if ( empty( $form ) \|\| ! $form instanceof WP_Post ) { return false; } // Check if the form is of the allowed post type. if ( ! in_array( $form->post_type, self::POST_TYPES, true ) ) { return false; } // Decode the form content. if ( ! empty( $args['content_only'] ) ) { $form = wpforms_decode( $form->post_content ); } return $form; } /* * Fetch multiple forms. * * @since 1.5.8 * @since 1.7.2 Added support for $args['search']['term'] - search form title or description by term. * * @param array $args Additional arguments array. * * @return array / protected function get_multiple( array $args = [] ): array { // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Allow developers to filter the get_multiple() arguments. * * @since 1.5.8 * * @param array $args Arguments array. Almost the same as for `get_posts()` function. * Additional element: * ['search']['term'] - search the form title or description by term. / $args = (array) apply_filters( 'wpforms_get_multiple_forms_args', $args ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName // No ID provided, get multiple forms. $defaults = [ 'orderby' => 'id', 'order' => 'ASC', 'no_found_rows' => true, 'nopaging' => true, 'suppress_filters' => false, ]; $args = wp_parse_args( $args, $defaults ); $post_type = $args['post_type'] ?? []; // Post type should be one of the allowed post types. $post_type = array_intersect( (array) $post_type, self::POST_TYPES ); // If no valid (allowed) post types are provided, use the default one. $args['post_type'] = ! empty( $post_type ) ? $post_type : 'wpforms'; /* * Allow developers to execute some code before get_posts() call inside \WPForms_Form_Handler::get_multiple(). * * @since 1.7.2 * * @param array $args Arguments of the `get_posts()`. / do_action( 'wpforms_form_handler_get_multiple_before_get_posts', $args ); $forms = get_posts( $args ); /* * Allow developers to execute some code right after get_posts() call inside \WPForms_Form_Handler::get_multiple(). * * @since 1.7.2 * * @param array $args Arguments of the `get_posts`. * @param array $forms Forms data. Result of getting multiple forms. / do_action( 'wpforms_form_handler_get_multiple_after_get_posts', $args, $forms ); /* * Allow developers to filter the result of get_multiple(). * * @since 1.7.2 * * @param array $forms Result of getting multiple forms. / return apply_filters( 'wpforms_form_handler_get_multiple_forms_result', $forms ); } /* * Update the form status. * * @since 1.7.3 * * @param int $form_id Form ID. * @param string $status New status. * * @return bool / public function update_status( $form_id, $status ) { // Status updates are used only in trash and restore actions, // which are actually part of the deletion operation. // Therefore, we should check the `delete_form_single` and not `edit_form_single` permission. if ( ! wpforms_current_user_can( 'delete_form_single', $form_id ) ) { return false; } $form_id = absint( $form_id ); $status = empty( $status ) ? 'publish' : sanitize_key( $status ); /* * Filters the allowed form statuses. * * @since 1.7.3 * * @param array $allowed_statuses Array of allowed form statuses. Default: publish, trash. / $allowed = (array) apply_filters( 'wpforms_form_handler_update_status_allowed', [ 'publish', 'trash' ] ); if ( ! in_array( $status, $allowed, true ) ) { return false; } $result = wp_update_post( [ 'ID' => $form_id, 'post_status' => $status, ] ); /* * Allow developers to execute some code after changing form status. * * @since 1.8.1 * * @param string $form_id Form ID. * @param string $status New form status, `publish` or `trash`. / do_action( 'wpforms_form_handler_update_status', $form_id, $status ); return $result !== 0; } /* * Delete all forms in the Trash. * * @since 1.7.3 * * @return int\|bool Number of deleted forms OR false. / public function empty_trash() { $forms = $this->get_multiple( [ 'post_type' => self::POST_TYPES, 'post_status' => 'trash', 'fields' => 'ids', 'suppress_filters' => true, // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.SuppressFilters_suppress_filters ] ); if ( empty( $forms ) ) { return false; } return $this->delete( $forms ) ? count( $forms ) : false; } /* * Delete forms. * * @since 1.0.0 * * @param array $ids Form IDs. * * @return bool / public function delete( $ids = [] ) { if ( ! is_array( $ids ) ) { $ids = [ $ids ]; } $ids = array_map( 'absint', $ids ); foreach ( $ids as $id ) { // Check for permissions. if ( ! wpforms_current_user_can( 'delete_form_single', $id ) ) { return false; } if ( class_exists( 'WPForms_Entry_Handler', false ) ) { wpforms()->obj( 'entry' )->delete_by( 'form_id', $id ); wpforms()->obj( 'entry_meta' )->delete_by( 'form_id', $id ); wpforms()->obj( 'entry_fields' )->delete_by( 'form_id', $id ); } $form = wp_delete_post( $id, true ); if ( ! $form ) { return false; } } do_action( 'wpforms_delete_form', $ids ); return true; } /* * Add new form. * * @since 1.0.0 * * @param string $title Form title. * @param array $args Additional arguments. * @param array $data Form data. * * @return mixed / public function add( $title = '', $args = [], $data = [] ) { // Must have a title. if ( empty( $title ) ) { return false; } // Check for permissions. if ( ! wpforms_current_user_can( 'create_forms' ) ) { return false; } // This filter breaks forms if they contain HTML. remove_filter( 'content_save_pre', 'balanceTags', 50 ); // Add filter of the link rel attr to avoid JSON damage. add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 ); // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Filters form creation arguments. * * @since 1.0.0 * * @param array $args Form creation arguments. * @param array $data Additional data. / $args = apply_filters( 'wpforms_create_form_args', $args, $data ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName $form_content = [ 'field_id' => '0', 'settings' => [ 'form_title' => sanitize_text_field( $title ), 'form_desc' => '', ], ]; if ( $this->is_form_data_slashing_enabled ) { $form_content = wp_slash( $form_content ); } $args_form_data = isset( $args['post_content'] ) ? json_decode( wp_unslash( $args['post_content'] ), true ) : null; // Prevent $args['post_content'] from overwriting predefined $form_content. // Typically, it happens if the form was created with a form template and a user was not redirected to a form editing screen afterwards. // This is only possible if a user has 'wpforms_create_forms' and no 'wpforms_edit_own_forms' capability. if ( is_array( $args_form_data ) ) { $args['post_content'] = wpforms_encode( array_replace_recursive( $form_content, $args_form_data ) ); } // Merge args and create the form. $form = wp_parse_args( $args, [ 'post_title' => esc_html( $title ), 'post_status' => 'publish', 'post_type' => 'wpforms', 'post_content' => wpforms_encode( $form_content ), ] ); $form_id = wp_insert_post( $form ); // Set form tags. if ( ! empty( $form_id ) && ! empty( $args_form_data['settings']['form_tags'] ) ) { wp_set_post_terms( $form_id, implode( ',', $args_form_data['settings']['form_tags'] ), self::TAGS_TAXONOMY ); } // If user has no editing permissions the form considered to be created out of the WPForms form builder's context. if ( ! wpforms_current_user_can( 'edit_form_single', $form_id ) ) { $data['builder'] = false; } // If the form is created outside the context of the WPForms form // builder, then we define some additional default values. if ( ! empty( $form_id ) && isset( $data['builder'] ) && $data['builder'] === false ) { $form_data = json_decode( wp_unslash( $form['post_content'] ), true ); $form_data['id'] = $form_id; $form_data['settings']['submit_text'] = esc_html__( 'Submit', 'wpforms-lite' ); $form_data['settings']['submit_text_processing'] = esc_html__( 'Sending...', 'wpforms-lite' ); $form_data['settings']['notification_enable'] = '1'; $form_data['settings']['notifications'] = [ '1' => [ 'email' => '{admin_email}', 'subject' => sprintf( / translators: %s - form name. / esc_html__( 'New Entry: %s', 'wpforms-lite' ), esc_html( $title ) ), 'sender_name' => get_bloginfo( 'name' ), 'sender_address' => '{admin_email}', 'message' => '{all_fields}', ], ]; $form_data['settings']['confirmations'] = [ '1' => [ 'type' => 'message', 'message' => esc_html__( 'Thanks for contacting us! We will be in touch with you shortly.', 'wpforms-lite' ), 'message_scroll' => '1', ], ]; $this->update( $form_id, $form_data, [ 'cap' => 'create_forms' ] ); } // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Fires after the form was created. * * @since 1.0.0 * * @param int $form_id Form ID. * @param array $form Form data. * @param array $data Additional data. / do_action( 'wpforms_create_form', $form_id, $form, $data ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName return $form_id; } /* * Update form. * * @since 1.0.0 * * @param string\|int $form_id Form ID. * @param array $data Data retrieved from $_POST and processed. * @param array $args Empty by default. May have custom data not intended to be saved. * * @return int\|false / public function update( $form_id = '', array $data = [], array $args = [] ) { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks, Generic.Metrics.CyclomaticComplexity.TooHigh if ( empty( $data ) ) { return false; } if ( empty( $form_id ) && isset( $data['id'] ) ) { $form_id = $data['id']; } if ( ! isset( $args['cap'] ) ) { $args['cap'] = 'edit_form_single'; } if ( ! empty( $args['cap'] ) && ! wpforms_current_user_can( $args['cap'], $form_id ) ) { return false; } // This filter breaks forms if they contain HTML. remove_filter( 'content_save_pre', 'balanceTags', 50 ); // Add filter of the link rel attr to avoid JSON damage. add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 ); if ( $this->is_form_data_slashing_enabled ) { // Even though we are not going to unslash some data, // columns-json and calculation_code fields must be unslashed. $data = $this->unslash_field_keys( $data, [ 'columns-json', 'calculation_code' ] ); } else { // phpcs:ignore Generic.Commenting.DocComment.MissingShort /* @noinspection CallableParameterUseCaseInTypeContextInspection / $data = (array) wp_unslash( $data ); } $title = empty( $data['settings']['form_title'] ) ? get_the_title( $form_id ) : $data['settings']['form_title']; $desc = empty( $data['settings']['form_desc'] ) ? '' : $data['settings']['form_desc']; $data['field_id'] = ! empty( $data['field_id'] ) ? wpforms_validate_field_id( $data['field_id'] ) : '0'; // Preserve explicit "Do not store spam entries" state. $data['settings']['store_spam_entries'] = $data['settings']['store_spam_entries'] ?? '0'; // Use default submit button text if not provided. $data['settings']['submit_text'] = ! empty( $data['settings']['submit_text'] ) ? $data['settings']['submit_text'] : esc_html__( 'Submit', 'wpforms-lite' ); // Preserve form meta. $meta = $this->get_meta( $form_id ); if ( $meta ) { $data['meta'] = $meta; } // Update category and subcategory only if available. if ( ! empty( $args['category'] ) ) { $data['meta']['category'] = $args['category']; } if ( ! empty( $args['subcategory'] ) ) { $data['meta']['subcategory'] = $args['subcategory']; } // Preserve fields meta. if ( isset( $data['fields'] ) ) { $data['fields'] = $this->update__preserve_fields_meta( $data['fields'], $form_id ); } // Sanitize - don't allow tags for users who do not have the appropriate cap. // If we don't do this, forms for these users can get corrupt due to conflicts with wp_kses(). if ( ! current_user_can( 'unfiltered_html' ) ) { $data = map_deep( $data, 'wp_strip_all_tags' ); } // Sanitize notifications names. if ( isset( $data['settings']['notifications'] ) ) { $data['settings']['notifications'] = $this->update__sanitize_notifications_names( $data['settings']['notifications'] ); } unset( $notification ); /* * Allow changing post data before saving. * * @since 1.0.0 * * @param array $post_data Post data. * @param array $form_data Form data. * @param array $args Empty by default. May have custom data not intended to be saved. / $form = apply_filters( // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName 'wpforms_save_form_args', [ 'ID' => $form_id, 'post_title' => esc_html( $title ), 'post_excerpt' => $desc, 'post_content' => wpforms_encode( $data ), ], $data, $args ); if ( ! empty( $args['skip_revision'] ) ) { remove_action( 'post_updated', 'wp_save_post_revision' ); } $_form_id = wp_update_post( $form ); if ( ! empty( $args['skip_revision'] ) ) { add_action( 'post_updated', 'wp_save_post_revision' ); } if ( is_wp_error( $_form_id ) ) { return false; } /* * Fires after saving the form. * * @since 1.0.0 * * @param int $_form_id Form ID. * @param array $form Form. / do_action( 'wpforms_save_form', $_form_id, $form ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName return $_form_id; } /* * Preserve fields meta in 'update' method. * * @since 1.5.8 * * @param array $fields Form fields. * @param string\|int $form_id Form ID. * * @return array / protected function update__preserve_fields_meta( $fields, $form_id ) { foreach ( $fields as $i => $field_data ) { if ( isset( $field_data['id'] ) ) { $field_meta = $this->get_field_meta( $form_id, $field_data['id'] ); if ( $field_meta ) { $fields[ $i ]['meta'] = $field_meta; } } } return $fields; } /* * Sanitize notifications names meta in 'update' method. * * @since 1.5.8 * * @param array $notifications Form notifications. * * @return array / protected function update__sanitize_notifications_names( $notifications ) { foreach ( $notifications as $id => &$notification ) { if ( ! empty( $notification['notification_name'] ) ) { $notification['notification_name'] = sanitize_text_field( $notification['notification_name'] ); } } return $notifications; } /* * Duplicate forms. * * @since 1.1.4 * @since 1.8.8 Return array of new form IDs instead of true. * * @param array\|string $ids Form IDs to duplicate. * * @return bool\|array Array of new form IDs or false. / public function duplicate( $ids ) { // phpcs:disable WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks, Generic.Metrics.CyclomaticComplexity.TooHigh // Check for permissions. if ( ! wpforms_current_user_can( 'create_forms' ) ) { return false; } // Add filter of the link rel attr to avoid JSON damage. add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 ); // This filter breaks forms if they contain HTML. remove_filter( 'content_save_pre', 'balanceTags', 50 ); if ( ! is_array( $ids ) ) { $ids = [ $ids ]; } $ids = array_map( 'absint', $ids ); $duplicate_ids = []; foreach ( $ids as $id ) { // Get original entry. $form = get_post( $id ); if ( ! wpforms_current_user_can( 'view_form_single', $id ) ) { return false; } // Confirm form exists. if ( empty( $form ) ) { return false; } // Get the form data. $new_form_data = (array) wpforms_decode( $form->post_content ); if ( $this->is_form_data_slashing_enabled ) { $new_form_data = (array) wp_slash( $new_form_data ); } // Remove form ID from title if present. $new_form_data['settings']['form_title'] = str_replace( '(ID #' . absint( $id ) . ')', '', $new_form_data['settings']['form_title'] ); // Remove '(copy)' from the form template title if present. $new_form_data['settings']['form_title'] = str_replace( __( '(copy)', 'wpforms-lite' ), '', $new_form_data['settings']['form_title'] ); // Remove trailing spaces. $new_form_data['settings']['form_title'] = rtrim( $new_form_data['settings']['form_title'] ); // Remove `-template` suffix and all after it from the post name. $post_name = preg_replace( '/-template(-\d+)?/', '', $form->post_name ); // Add some notice messages before form preview area. $new_form_data = $this->add_notices( $new_form_data, (int) $id ); // Create the duplicate form. $new_form = [ 'post_content' => wpforms_encode( $new_form_data ), 'post_excerpt' => $form->post_excerpt, 'post_status' => $form->post_status, 'post_title' => $new_form_data['settings']['form_title'], 'post_type' => $form->post_type, 'post_name' => wpforms_is_form_template( $id ) ? $post_name . '-template' : $post_name, ]; $new_form_id = wp_insert_post( $new_form ); if ( ! $new_form_id \|\| is_wp_error( $new_form_id ) ) { return false; } // Set new form name. $new_form_data['settings']['form_title'] .= $form->post_type === 'wpforms-template' ? ' ' . __( '(copy)', 'wpforms-lite' ) : ' (ID #' . absint( $new_form_id ) . ')'; // Set new form ID. $new_form_data['id'] = absint( $new_form_id ); // Update new duplicate form. $new_form_id = $this->update( $new_form_id, $new_form_data, [ 'cap' => 'create_forms' ] ); if ( ! $new_form_id ) { return false; } // Add tags to the new form. if ( ! empty( $new_form_data['settings']['form_tags'] ) ) { wp_set_post_terms( $new_form_id, implode( ',', (array) $new_form_data['settings']['form_tags'] ), self::TAGS_TAXONOMY ); } /* * Fires after the form was duplicated. * * @since 1.8.2.2 * * @param int $id Original form ID. * @param int $new_form_id New form ID. * @param array $new_form_data New form data. / do_action( 'wpforms_form_handler_duplicate_form', $id, $new_form_id, $new_form_data ); $duplicate_ids[] = $new_form_id; } return $duplicate_ids; } /* * Convert form to a template and vice versa. * * @since 1.8.8 * * @param string\|int $form_id Form ID. * @param string $convert_to Convert to, `form` or `template`. * * @return false\|int New object ID or false on failure. / public function convert( $form_id, string $convert_to ) { if ( ! in_array( $convert_to, [ 'form', 'template' ], true ) ) { return false; } // Duplicate the form. $ids = $this->duplicate( $form_id ); if ( empty( $ids ) ) { return false; } $new_form_id = current( $ids ); $form = get_post( $new_form_id ); $form_data = wpforms_decode( $form->post_content ); if ( $this->is_form_data_slashing_enabled ) { $form_data = wp_slash( $form_data ); } /* * Filters the form data before converting it to a template or vice versa. * * @since 1.8.8 * * @param array $form_data Form data. * @param string\|int $form_id Form ID. * @param string $convert_to Convert to, `form` or `template`. / $form_data = apply_filters( 'wpforms_form_handler_convert_form_data', $form_data, $form_id, $convert_to ); // Set default post type. $post_type = 'wpforms'; // Remove numeric suffix from the post name. // Duplication always adds `-{numeric}` suffix. $post_name = preg_replace( '/-\d+$/', '', $form->post_name ); // Remove `-template` suffix and all after it from the post name. $post_name = preg_replace( '/-template(-\d+)?/', '', $post_name ); // Remove (copy) from the form title, if present. $form_data['settings']['form_title'] = str_replace( __( '(copy)', 'wpforms-lite' ), '', $form_data['settings']['form_title'] ); // Remove trailing spaces. $form_data['settings']['form_title'] = rtrim( $form_data['settings']['form_title'] ); // Remove template description. unset( $form_data['settings']['template_description'] ); if ( $convert_to === 'template' ) { $post_type = 'wpforms-template'; // Remove (ID #<Form ID>) from the form title, if present. $form_data['settings']['form_title'] = preg_replace( '/\(ID #\d+\)/', '', $form_data['settings']['form_title'] ); // Set empty template description. $form_data['settings']['template_description'] = ''; // Remove traces of any other template that may have been used to create the original form by setting itself as a template. $form_data['meta']['template'] = 'wpforms-user-template-' . $new_form_id; // Add `-template` suffix to the post name. $post_name .= '-template'; } wp_update_post( [ 'ID' => $new_form_id, 'post_title' => $form_data['settings']['form_title'], 'post_type' => $post_type, 'post_content' => wpforms_encode( $form_data ), 'post_name' => $post_name, ] ); return $new_form_id; } /* * Append notice(s) before form preview, if needed. * * @since 1.8.8 * * @param array $new_form_data New form data. * @param int $form_id Original form ID. * * @return array / private function add_notices( array $new_form_data, int $form_id ): array { /* * Add custom notices to be displayed in the preview area of the Form Builder * after a form or a form template has been duplicated or converted. * * @since 1.8.8 * * @param array $notices Array of notices. * @param array $new_form_data Form data of the newly duplicated form or form template. * @param int $form_id Original form ID. / $notices = apply_filters( 'wpforms_form_handler_add_notices', [], $new_form_data, $form_id ); if ( empty( $notices ) ) { return $new_form_data; } $current_field_id = ! empty( $new_form_data['fields'] ) ? max( array_keys( $new_form_data['fields'] ) ) : 0; $code_fields = array_column( $new_form_data['fields'], 'code' ); $next_field_id = $current_field_id; $warning = []; foreach ( $notices as $notice ) { // Skip the duplicate notice if it already exists. if ( ! empty( $notice['code'] ) && in_array( $notice['code'], $code_fields, true ) ) { continue; } $next_field_id = ++$current_field_id; $warning[ $next_field_id ] = [ 'id' => $next_field_id, 'type' => 'internal-information', 'code' => ! empty( $notice['code'] ) ? esc_attr( $notice['code'] ) : '', 'description' => '', ]; $warning[ $next_field_id ]['description'] .= ! empty( $notice['title'] ) ? '<strong>' . esc_html( $notice['title'] ) . '</strong>' : ''; $warning[ $next_field_id ]['description'] .= ! empty( $notice['message'] ) ? '<p>' . wp_kses_post( $notice['message'] ) . '</p>' : ''; // Do not add notice with empty body. if ( empty( $warning[ $next_field_id ]['description'] ) ) { unset( $warning[ $next_field_id ] ); --$next_field_id; // Reset next field ID to the previous value. } } if ( ! empty( $warning ) ) { $new_form_data['fields'] = $warning + $new_form_data['fields']; // Update next field ID to be used for future created fields. Otherwise, IIF field would be overwritten. $new_form_data['field_id'] = $next_field_id + 1; } return $new_form_data; } /* * Add a notice about Zapier zaps disconnected after form being duplicated or converted to/from template. * * @WPFormsBackCompat Support Zapier v1.5.0 and earlier. * * @since 1.8.8 * * @param array $notices Array of notices. * @param array $new_form_data Form data. * @param int $form_id Original form ID. * * @return array / public function _zapier_disconnected_on_duplication( $notices, array $new_form_data, int $form_id ): array { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore // Check if original form had any Zaps connected. $is_zapier_connected = get_post_meta( $form_id, 'wpforms_zapier', true ); if ( ! $is_zapier_connected ) { return $notices; } $notices['zapier'] = [ 'title' => esc_html__( 'Zaps Have Been Disabled', 'wpforms-lite' ), 'code' => 'disconnected_on_duplication', 'message' => sprintf( / translators: %s - URL the to list of Zaps. / __( 'Head over to the Zapier settings in the Marketing tab or visit your <a href="%s" target="_blank" rel="noopener noreferrer">Zapier account</a> to restore them.', 'wpforms-lite' ), esc_url( 'https://zapier.com/app/zaps' ) ), ]; return $notices; } /* * Get the next available field ID and increment by one. * * @since 1.0.0 * * @param string\|int $form_id Form ID. * @param array $args Additional arguments. * * @return mixed int or false / public function next_field_id( $form_id, $args = [] ) { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks if ( empty( $form_id ) ) { return false; } $defaults = [ 'content_only' => true, ]; if ( isset( $args['cap'] ) ) { $defaults['cap'] = $args['cap']; } $form = $this->get( $form_id, $defaults ); if ( $this->is_form_data_slashing_enabled ) { $form = wp_slash( $form ); } if ( empty( $form ) ) { return false; } $field_id = 0; $max_field_id = ! empty( $form['fields'] ) ? max( array_keys( $form['fields'] ) ) : 0; // We pass the `field_id` after duplicating the Layout field that contains a bunch of fields. // This is needed to avoid multiple AJAX calls after duplicating each field in the Layout. if ( isset( $args['field_id'] ) ) { $set_field_id = absint( $args['field_id'] ) - 1; $field_id = $set_field_id > $max_field_id ? $set_field_id : $max_field_id + 1; } elseif ( ! empty( $form['field_id'] ) ) { $field_id = absint( $form['field_id'] ); $field_id = $max_field_id > $field_id ? $max_field_id + 1 : $field_id; } $form['field_id'] = $field_id + 1; // Skip creating a revision for this action. remove_action( 'post_updated', 'wp_save_post_revision' ); $this->update( $form_id, $form ); // Restore the initial revisions state. add_action( 'post_updated', 'wp_save_post_revision', 10, 1 ); return $field_id; } /* * Get private meta information for a form. * * @since 1.0.0 * * @param string\|int $form_id Form ID. * @param string $field Field. * @param array $args Additional arguments. * * @return false\|array / public function get_meta( $form_id, $field = '', $args = [] ) { if ( empty( $form_id ) ) { return false; } $defaults = [ 'content_only' => true, ]; if ( isset( $args['cap'] ) ) { $defaults['cap'] = $args['cap']; } $data = $this->get( $form_id, $defaults ); if ( ! isset( $data['meta'] ) ) { return false; } if ( empty( $field ) ) { return $data['meta']; } if ( isset( $data['meta'][ $field ] ) ) { return $data['meta'][ $field ]; } return false; } /* * Update or add form meta information to a form. * * @since 1.4.0 * * @param string\|int $form_id Form ID. * @param string $meta_key Meta key. * @param mixed $meta_value Meta value. * @param array $args Additional arguments. * * @return false\|int\|WP_Error / public function update_meta( $form_id, $meta_key, $meta_value, $args = [] ) { if ( empty( $form_id ) \|\| empty( $meta_key ) ) { return false; } // Add filter of the link rel attr to avoid JSON damage. add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 ); // This filter breaks forms if they contain HTML. remove_filter( 'content_save_pre', 'balanceTags', 50 ); if ( ! isset( $args['cap'] ) ) { $args['cap'] = 'edit_form_single'; } $form = $this->get_single( absint( $form_id ), $args ); if ( empty( $form ) ) { return false; } $data = wpforms_decode( $form->post_content ); $meta_key = wpforms_sanitize_key( $meta_key ); $data['meta'][ $meta_key ] = $meta_value; $form = [ 'ID' => $form_id, 'post_content' => wpforms_encode( $data ), ]; /* * Allow changing form before updating form meta. * * @since 1.4.0 * * @param WP_Post $form Form post object. * @param array $data Form data. / $form = apply_filters( 'wpforms_update_form_meta_args', $form, $data ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName if ( ! empty( $args['skip_revision'] ) ) { remove_action( 'post_updated', 'wp_save_post_revision' ); } $form_id = wp_update_post( $form ); if ( ! empty( $args['skip_revision'] ) ) { add_action( 'post_updated', 'wp_save_post_revision' ); } do_action( 'wpforms_update_form_meta', $form_id, $form, $meta_key, $meta_value ); return $form_id; } /* * Delete form meta information from a form. * * @since 1.4.0 * * @param string\|int $form_id Form ID. * @param string $meta_key Meta key. * @param array $args Additional arguments. * * @return false\|int\|WP_Error / public function delete_meta( $form_id, $meta_key, $args = [] ) { if ( empty( $form_id ) \|\| empty( $meta_key ) ) { return false; } // Add filter of the link rel attr to avoid JSON damage. add_filter( 'wp_targeted_link_rel', '__return_empty_string', 50, 1 ); // This filter breaks forms if they contain HTML. remove_filter( 'content_save_pre', 'balanceTags', 50 ); if ( ! isset( $args['cap'] ) ) { $args['cap'] = 'edit_form_single'; } $form = $this->get_single( absint( $form_id ), $args ); if ( empty( $form ) ) { return false; } $data = wpforms_decode( $form->post_content ); $meta_key = wpforms_sanitize_key( $meta_key ); unset( $data['meta'][ $meta_key ] ); $form = [ 'ID' => $form_id, 'post_content' => wpforms_encode( $data ), ]; $form = apply_filters( 'wpforms_delete_form_meta_args', $form, $data ); $form_id = wp_update_post( $form ); do_action( 'wpforms_delete_form_meta', $form_id, $form, $meta_key ); return $form_id; } /* * Get private meta information for a form field. * * @since 1.0.0 * * @param string\|int $form_id Form ID. * @param string $field_id Field ID. * @param array $args Additional arguments. * * @return array\|false / public function get_field( $form_id, $field_id = '', $args = [] ) { if ( empty( $form_id ) ) { return false; } $defaults = [ 'content_only' => true, ]; if ( isset( $args['cap'] ) ) { $defaults['cap'] = $args['cap']; } $data = $this->get( $form_id, $defaults ); return isset( $data['fields'][ $field_id ] ) ? $data['fields'][ $field_id ] : false; } /* * Get private meta information for a form field. * * @since 1.0.0 * * @param string\|int $form_id Form ID. * @param string $field_id Field ID. * @param array $args Additional arguments. * * @return array\|false / public function get_field_meta( $form_id, $field_id = '', $args = [] ) { $field = $this->get_field( $form_id, $field_id, $args ); if ( ! $field ) { return false; } return isset( $field['meta'] ) ? $field['meta'] : false; } /* * Checks if any forms are present on the site. * * @since 1.8.8 * * @retun bool / public function forms_exist(): bool { return (bool) $this->get( '', [ 'numberposts' => 1, 'fields' => 'ids', 'no_found_rows' => true, 'suppress_filters' => true, // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.SuppressFilters_suppress_filters 'nopaging' => false, 'update_post_meta_cache' => false, 'update_post_term_cache' => false, ] ); } /* * Get forms count per page. * * @since 1.8.8 * * @return int / public function get_count_per_page(): int { // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Give developers an ability to modify number of forms per page. * * @since 1.8.8 * * @param array $count Forms count per page. / return (int) apply_filters( 'wpforms_forms_per_page', 20 ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName } /* * Unslash field keys. * * @since 1.9.0 * * @param array $data Form data. * @param array $keys Field keys. * * @return array / private function unslash_field_keys( array $data, array $keys ): array { if ( empty( $data['fields'] ) ) { return $data; } /* * Filter field keys to be unslashed before saving. * * Works used with filter wpforms_enable_form_data_slashing set to true. * * @since 1.9.0 * * @param array $keys Field keys. * * @return array */ $keys = (array) apply_filters( 'wpforms_form_handler_unslash_field_keys', $keys ); if ( empty( $keys ) ) { return $data; } foreach ( $data['fields'] as $id => $field ) { foreach ( $keys as $key ) { if ( isset( $field[ $key ] ) ) { $data['fields'][ $id ][ $key ] = wp_unslash( $field[ $key ] ); } } } return $data; } }	39.69 KB	2025-09-23 14:43
📄 class-install.php <?php // phpcs:disable Generic.Commenting.DocComment.MissingShort /** @noinspection PhpIllegalPsrClassPathInspection / /* @noinspection AutoloadingIssuesInspection / // phpcs:enable Generic.Commenting.DocComment.MissingShort use WPForms\Helpers\DB; if ( ! defined( 'ABSPATH' ) ) { exit; } /* * Handle plugin installation upon activation. * * @since 1.0.0 / class WPForms_Install { /* * Primary class constructor. * * @since 1.0.0 / public function __construct() { // When activated, trigger install method. register_activation_hook( WPFORMS_PLUGIN_FILE, [ $this, 'install' ] ); register_deactivation_hook( WPFORMS_PLUGIN_FILE, [ $this, 'deactivate' ] ); $this->hooks(); } /* * Hooks. * * @since 1.9.0 * * @return void / private function hooks() { // Watch for new multisite blogs. add_action( 'wp_initialize_site', [ $this, 'new_multisite_blog' ], 10, 2 ); // Watch for delayed admin install. add_action( 'admin_init', [ $this, 'admin' ] ); } /* * Perform certain actions on plugin activation. * * @since 1.0.0 * * @param bool $network_wide Whether to enable the plugin for all sites in the network * or just the current site. Multisite only. Default is false. * * @noinspection DisconnectedForeachInstructionInspection / public function install( $network_wide = false ) { // Check if we are on multisite and network activating. if ( $network_wide && is_multisite() ) { // Multisite - go through each subsite and run the installer. $sites = get_sites( [ 'fields' => 'ids', 'number' => 0, ] ); foreach ( $sites as $blog_id ) { switch_to_blog( $blog_id ); $this->run(); restore_current_blog(); } } else { // Normal single site. $this->run(); } set_transient( 'wpforms_just_activated', wpforms()->is_pro() ? 'pro' : 'lite', 60 ); // Abort, so we only set the transient for single site installs. if ( isset( $_GET['activate-multi'] ) \|\| is_network_admin() ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended return; } // Add transient to trigger redirect to the Welcome screen. set_transient( 'wpforms_activation_redirect', true, 30 ); } /* * Run manual installation. * * @since 1.5.4.2 * * @param bool $silent Silent install, disables welcome page. / public function manual( $silent = false ) { $this->install( is_plugin_active_for_network( plugin_basename( WPFORMS_PLUGIN_FILE ) ) ); if ( $silent ) { delete_transient( 'wpforms_activation_redirect' ); } } /* * Perform certain actions on plugin deactivation. * * @since 1.5.9 / public function deactivate() { // Unschedule all ActionScheduler actions by group. wpforms()->obj( 'tasks' )->cancel_all(); // Remove plugin cron jobs. wp_clear_scheduled_hook( 'wpforms_email_summaries_cron' ); // Check if the event is scheduled before attempting to clear it. // This event is only registered for the Lite edition of the plugin. // It's advisable to verify if the CRON event is scheduled using `wp_next_scheduled`. // This precaution ensures that you are not attempting to clear a scheduled // hook that may not exist, which could result in unexpected behavior. if ( wp_next_scheduled( 'wpforms_weekly_entries_count_cron' ) ) { wp_clear_scheduled_hook( 'wpforms_weekly_entries_count_cron' ); } } /* * Watch for delayed install procedure from WPForms admin. * * @since 1.5.4.2 / public function admin() { if ( ! is_admin() ) { return; } $install = get_option( 'wpforms_install', false ); if ( empty( $install ) ) { return; } $this->manual( true ); delete_option( 'wpforms_install' ); } /* * Run the actual installer. * * @since 1.5.4.2 / protected function run() { // Create custom database tables. $this->maybe_create_tables(); // Hook for Pro users. /* * Fires before WPForms plugin installation is performed. * * @since 1.3.0 / do_action( 'wpforms_install' ); / * Set the current version to be referenced in future updates. / // Used by Pro migrations. update_option( 'wpforms_version', WPFORMS_VERSION ); // Used by Lite migrations. update_option( 'wpforms_version_lite', WPFORMS_VERSION ); // Store the date when the initial activation was performed. $type = class_exists( 'WPForms_Lite', false ) ? 'lite' : 'pro'; $activated = (array) get_option( 'wpforms_activated', [] ); if ( empty( $activated[ $type ] ) ) { $activated[ $type ] = time(); update_option( 'wpforms_activated', $activated ); } } /* * When a new site is created in multisite, see if we are network activated, * and if so run the installer. * * @since 1.3.0 * @since 1.8.4 Added $new_site and $args parameters and removed $blog_id, $user_id, $domain, $path, $site_id, * and $meta parameters. * * @param WP_Site $new_site New site object. * @param array $args Arguments for the initialization. * * @noinspection PhpUnusedParameterInspection * @noinspection PhpMissingParamTypeInspection / public function new_multisite_blog( $new_site, $args ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed if ( is_plugin_active_for_network( plugin_basename( WPFORMS_PLUGIN_FILE ) ) ) { switch_to_blog( $new_site->blog_id ); $this->run(); restore_current_blog(); } } /* * Create database tables if they do not exist. * It covers new installations. * * @since 1.8.2 */ private function maybe_create_tables() { DB::create_custom_tables( true ); } } new WPForms_Install();	5.56 KB	2025-09-23 14:43
📄 class-process.php <?php // phpcs:disable Generic.Commenting.DocComment.MissingShort /** @noinspection PhpIllegalPsrClassPathInspection / /* @noinspection AutoloadingIssuesInspection / // phpcs:enable Generic.Commenting.DocComment.MissingShort // phpcs:ignore WPForms.PHP.UseStatement.UnusedUseStatement use WPForms\Emails\Mailer; use WPForms\Emails\Notifications; /* * Process and validate form entries. * * @since 1.0.0 / class WPForms_Process { /* * Store errors. * * @since 1.0.0 * * @var array / public $errors; /* * Store spam errors. * * @since 1.8.3 * * @var array / public $spam_errors; /* * Spam reason. * * @since 1.8.3 * * @var string / public $spam_reason; /* * Confirmation message. * * @since 1.5.3 * * @var string / public $confirmation_message; /* * Current confirmation. * * @since 1.6.9 * * @var array / private $confirmation; /* * Store formatted fields. * * @since 1.0.0 * * @var array / public $fields; /* * Store the ID of a successful entry. * * @since 1.2.3 * * @var int / public $entry_id = 0; /* * Form data and settings. * * @since 1.4.5 * * @var array / public $form_data; /* * If a valid return has been processed. * * @since 1.4.5 * * @var bool / public $valid_hash = false; /* * Email handler. * * @since 1.9.4 * * @var mixed\|Mailer\|WPForms_WP_Emails\|null / private $email_handler; /* * Primary class constructor. * * @since 1.0.0 / public function __construct() { $this->hooks(); } /* * Register hooks. * * @since 1.8.3 / private function hooks() { add_action( 'wp', [ $this, 'listen' ] ); add_action( 'wp_ajax_wpforms_submit', [ $this, 'ajax_submit' ] ); add_action( 'wp_ajax_nopriv_wpforms_submit', [ $this, 'ajax_submit' ] ); add_filter( 'wpforms_ajax_submit_redirect', [ $this, 'maybe_open_in_new_tab' ] ); add_filter( 'wpforms_smarttags_process_value', [ Notifications::class, 'filter_smarttags_process_value' ], PHP_INT_MAX, 6 ); } /* * Listen to see if this is a return callback or a posted form entry. * * @since 1.0.0 / public function listen() { // Catch the post_max_size overflow. if ( $this->post_max_size_overflow() ) { return; } // phpcs:disable WordPress.Security.NonceVerification if ( ! empty( $_GET['wpforms_return'] ) ) { // Additional redirect trigger for addons. $this->entry_confirmation_redirect( '', sanitize_text_field( wp_unslash( $_GET['wpforms_return'] ) ) ); } $form_id = ! empty( $_POST['wpforms']['id'] ) ? absint( $_POST['wpforms']['id'] ) : 0; if ( ! $form_id ) { return; } // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized $this->process( wp_unslash( $_POST['wpforms'] ) ); // phpcs:enable WordPress.Security.NonceVerification /* * Runs right after the processing form entry. * * @since 1.9.0 * * @param array $fields Entry fields data. * @param array $entry_id Entry ID. * @param array $form_data Form data. / do_action( 'wpforms_process_after', $this->fields, $this->entry_id, $this->form_data ); if ( ! wpforms_is_amp() ) { return; } // Send 400 Bad Request when there are errors. if ( empty( $this->errors[ $form_id ] ) ) { $this->entry_confirmation_redirect( $this->form_data ); wp_send_json( [ 'message' => $this->get_confirmation_message( $this->form_data, $this->fields, $this->entry_id ), ], 200 ); return; } $message_parts = [ $this->errors[ $form_id ]['header'] ]; if ( ! empty( $this->errors[ $form_id ]['recaptcha'] ) ) { $message_parts[] = $this->errors[ $form_id ]['recaptcha']; } if ( ! empty( $this->errors[ $form_id ]['footer'] ) ) { $message_parts[] = $this->errors[ $form_id ]['footer']; } wp_send_json( [ 'message' => implode( '<br>', $message_parts ), ], 400 ); } /* * Process the form entry. * * @since 1.0.0 * @since 1.6.4 Added hCaptcha support. * * @param array $entry Form submission raw data ($_POST). * * @noinspection HtmlUnknownTarget / public function process( $entry ) { // phpcs:ignore Generic.Metrics.CyclomaticComplexity.MaxExceeded, Generic.Metrics.NestingLevel.MaxExceeded $this->errors = []; $this->fields = []; / @var int $form_id Annotate the type explicitly. / $form_id = absint( $entry['id'] ); $form = wpforms()->obj( 'form' )->get( $form_id ); // Validate form is real and active (published). if ( ! $form \|\| $form->post_status !== 'publish' ) { $this->errors[ $form_id ]['header'] = esc_html__( 'Invalid form.', 'wpforms-lite' ); return; } /* * Filter form data obtained during the form process. * * @since 1.5.3 * * @param array $form_data Form data. * @param array $entry Form entry. / $this->form_data = (array) apply_filters( 'wpforms_process_before_form_data', wpforms_decode( $form->post_content ), $entry ); if ( ! empty( $this->form_data['settings']['ajax_submit'] ) && ! $this->is_valid_ajax_submit_action() ) { wpforms_log( 'Attempt to submit corrupted post data.', wp_unslash( $_POST ), [ 'type' => [ 'error', 'entry' ], 'form_id' => $this->form_data['id'], ] ); $this->errors[ $form_id ]['header'] = esc_html__( 'Attempt to submit corrupted post data.', 'wpforms-lite' ); return; } $store_spam_entries = ! empty( $this->form_data['settings']['store_spam_entries'] ); /* * Check the modern Anti-Spam (v3) protection. * * Run as early as possible to remove the honeypot field from the entry to prevent unnecessary field processing. * Bail early if the form is marked as spam and storing spam entries is disabled. * * Important! We should check first on modern Anti-Spam because it is skipped in case $store_spam_entries === true. / // phpcs:ignore Generic.Commenting.DocComment.MissingShort /* @noinspection NotOptimalIfConditionsInspection / if ( ! $this->modern_anti_spam_check( $entry ) && ! $store_spam_entries ) { return; } if ( ! isset( $this->form_data['fields'], $this->form_data['id'] ) ) { $error_id = uniqid( '', true ); // Logs missing form data. wpforms_log( / translators: %s - error unique ID. / sprintf( esc_html__( 'Missing form data on form submission process %s', 'wpforms-lite' ), $error_id ), esc_html__( 'Form data is not an array in `\WPForms_Process::process()`. It might be caused by incorrect data returned by `wpforms_process_before_form_data` filter. Verify whether you have a custom code using this filter and debug value it is returning.', 'wpforms-lite' ), [ 'type' => [ 'error', 'entry' ], 'form_id' => $form_id, ] ); $error_messages[] = esc_html__( 'Your form has not been submitted because data is missing from the entry.', 'wpforms-lite' ); if ( wpforms_setting( 'logs-enable' ) && wpforms_current_user_can( wpforms_get_capability_manage_options() ) ) { $error_messages[] = sprintf( wp_kses( / translators: %s - URL to the WForms Logs admin page. / __( 'Check the WPForms » Tools » <a href="%s">Logs</a> for more details.', 'wpforms-lite' ), [ 'a' => [ 'href' => [] ] ] ), esc_url( add_query_arg( [ 'page' => 'wpforms-tool', 'view' => 'logs', ], admin_url( 'admin.php' ) ) ) ); / translators: %s - error unique ID. / $error_messages[] = sprintf( esc_html__( 'Error ID: %s.', 'wpforms-lite' ), $error_id ); } $errors[ $form_id ]['header'] = implode( '<br>', $error_messages ); $this->errors = $errors; return; } /* * Filter form entry before processing. * Data are not validated or cleaned yet, so use them with caution. * * @since 1.4.0 * * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. / $entry = apply_filters( 'wpforms_process_before_filter', $entry, $this->form_data ); /* * Pre-process hook. * * @since 1.4.0 * * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. / do_action( 'wpforms_process_before', $entry, $this->form_data ); /* * Pre-process hook by form ID. * * @since 1.4.0 * * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. / do_action( "wpforms_process_before_{$form_id}", $entry, $this->form_data ); // Validate fields. foreach ( $this->form_data['fields'] as $field_properties ) { $field_id = $field_properties['id']; $field_type = $field_properties['type']; $field_submit = $entry['fields'][ $field_id ] ?? ''; /* * Field type validation hook. * * @since 1.4.0 * * @param string\|int $field_id Field ID as a numeric string. * @param mixed $field_submit Submitted field value (raw data). * @param array $form_data Form data. / do_action( "wpforms_process_validate_{$field_type}", $field_id, $field_submit, $this->form_data ); } // Check if combined upload size exceeds allowed maximum. $this->validate_combined_upload_size( $form ); /* * Filter initial errors. * Don't proceed if there are any errors thus far. * We provide a filter so that other features, such as conditional logic, can adjust blocking errors. * * @since 1.4.0 * * @param array $errors List of errors. * @param array $form_data Form data. / $errors = apply_filters( 'wpforms_process_initial_errors', $this->errors, $this->form_data ); if ( isset( $_POST['__amp_form_verify'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing if ( empty( $errors[ $form_id ] ) ) { wp_send_json( [], 200 ); } else { $verify_errors = []; foreach ( $errors[ $form_id ] as $field_id => $error_fields ) { $field = $this->form_data['fields'][ $field_id ]; $field_properties = wpforms()->obj( 'frontend' )->get_field_properties( $field, $this->form_data ); if ( is_string( $error_fields ) ) { $name = ''; if ( $field['type'] === 'checkbox' \|\| $field['type'] === 'radio' \|\| $field['type'] === 'select' ) { $first = current( $field_properties['inputs'] ); $name = $first['attr']['name']; } elseif ( isset( $field_properties['inputs']['primary']['attr']['name'] ) ) { $name = $field_properties['inputs']['primary']['attr']['name']; } $verify_errors[] = [ 'name' => $name, 'message' => $error_fields, ]; } else { foreach ( $error_fields as $error_field => $error_message ) { $name = $field_properties['inputs'][ $error_field ]['attr']['name'] ?? ''; $verify_errors[] = [ 'name' => $name, 'message' => $error_message, ]; } } } wp_send_json( [ 'verifyErrors' => $verify_errors, ], 400 ); } return; } if ( ! empty( $errors[ $form_id ] ) ) { if ( empty( $errors[ $form_id ]['header'] ) && empty( $errors[ $form_id ]['footer'] ) ) { $errors[ $form_id ]['header'] = esc_html__( 'Form has not been submitted, please see the errors below.', 'wpforms-lite' ); } $this->errors = $errors; return; } // If a logged-in user fails the nonce check, we want to log the entry, disable the errors and fail silently. // Please note that logs may be disabled, and in this case, nothing will be logged or reported. if ( is_user_logged_in() && ( empty( $entry['nonce'] ) \|\| ! wp_verify_nonce( $entry['nonce'], "wpforms::form_{$form_id}" ) ) ) { // Logs XSS attempt depending on log levels set. wpforms_log( 'Cross-site scripting attempt ' . uniqid( '', true ), [ true, $entry ], [ 'type' => [ 'security' ], 'form_id' => $this->form_data['id'], ] ); $this->errors[ $this->form_data['id'] ]['footer_styled'] = esc_html__( 'The form could not be submitted due to a security issue.', 'wpforms-lite' ); return; } // Format fields. foreach ( (array) $this->form_data['fields'] as $field_properties ) { $field_id = $field_properties['id']; $field_type = $field_properties['type']; $field_submit = $entry['fields'][ $field_id ] ?? ''; /* * Format field by type. * * @since 1.4.0 * * @param string $field_id Field ID. * @param string $field_submit Submitted field value. * @param array $form_data Form data and settings. / do_action( "wpforms_process_format_{$field_type}", $field_id, $field_submit, $this->form_data ); } $honeypot = wpforms()->obj( 'honeypot' )->validate( $this->form_data, $this->fields, $entry ); // If we trigger the honey pot, we want to log the entry, disable the errors, and fail silently. if ( $honeypot ) { $this->log_spam_entry( $entry, $honeypot ); // Fail silently. return; } $token = wpforms()->obj( 'token' )->validate( $this->form_data, $this->fields, $entry ); // If spam - return early. // For antispam, we want to make sure that we have a value, we are not using AMP, and the value is an error string. if ( $token && is_string( $token ) && ! wpforms_is_amp() ) { $this->errors[ $this->form_data['id'] ]['header'] = $token; $this->log_spam_entry( $entry, $token ); return; } // Detect direct POST requests when the AJAX submission is enabled. $this->direct_post_request_check( $entry ); $is_pro = wpforms()->is_pro(); if ( ! $this->is_bypass_spam_check( $entry ) ) { // Store spam entries detected by filtering. if ( $is_pro && ! empty( $this->form_data['settings']['anti_spam']['filtering_store_spam'] ) ) { $this->country_filter_check( $entry, $form_id ); $this->keyword_filter_check( $entry, $form_id ); } // Check if the form was submitted too quickly. $this->time_limit_check(); // Check for spam. $this->process_spam_check( $entry ); } // Convert spam errors to form errors if spam entries are not stored. if ( ! $store_spam_entries && ! empty( $this->spam_errors ) ) { $this->errors = $this->spam_errors; } // Store spam reason. if ( $this->spam_reason ) { $this->form_data['spam_reason'] = $this->spam_reason; } // Pass the form created date into the form data. $this->form_data['created'] = $form->post_date; /* * Format form data after all fields have been processed. * This hook is for internal purposes and should not be leveraged. * * @since 1.4.0 * * @param array $form_data Form data and settings. / do_action( 'wpforms_process_format_after', $this->form_data ); /* * Filter fields before processing. * Process hooks/filter - this is where most addons should hook * because at this point we have completed all field validations and formatted the data. * * @since 1.4.0 * * @param array $fields Form fields. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data and settings. / $this->fields = apply_filters( 'wpforms_process_filter', $this->fields, $entry, $this->form_data ); /* * Process form fields. * * @since 1.4.0 * * @param array $fields Form fields. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data and settings. / do_action( 'wpforms_process', $this->fields, $entry, $this->form_data ); /* * Process form fields by form ID. * * @since 1.4.0 * * @param array $fields Form fields. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data and settings. / do_action( "wpforms_process_{$form_id}", $this->fields, $entry, $this->form_data ); /* * Filter fields after processing. * * @since 1.4.0 * * @param array $fields Form fields. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data and settings. / $this->fields = apply_filters( 'wpforms_process_after_filter', $this->fields, $entry, $this->form_data ); // One last error check - don't proceed if there are any errors. if ( ! empty( $this->errors[ $form_id ] ) ) { if ( empty( $this->errors[ $form_id ]['header'] ) && empty( $this->errors[ $form_id ]['footer'] ) ) { $this->errors[ $form_id ]['header'] = esc_html__( 'Form has not been submitted, please see the errors below.', 'wpforms-lite' ); } return; } // Set raw post data. $this->form_data['post_data_raw'] = [ 'page_url' => isset( $_POST['page_url'] ) ? esc_url_raw( wp_unslash( $_POST['page_url'] ) ) : '', ]; // Success - add entry to a database. $this->entry_id = $this->entry_save( $this->fields, $entry, $this->form_data['id'], $this->form_data ); // Add payment to a database. $payment_id = $this->payment_save( $entry ); $this->form_data['entry_meta'] = [ 'page_url' => isset( $_POST['page_url'] ) ? esc_url_raw( wp_unslash( $_POST['page_url'] ) ) : '', 'page_title' => isset( $_POST['page_title'] ) ? sanitize_text_field( wp_unslash( $_POST['page_title'] ) ) : '', 'page_id' => isset( $_POST['page_id'] ) ? absint( $_POST['page_id'] ) : '', 'url_referer' => isset( $_POST['url_referer'] ) ? esc_url_raw( wp_unslash( $_POST['url_referer'] ) ) : '', 'user_id' => get_current_user_id(), ]; // Save meta data. $this->save_meta( $this->entry_id, $this->form_data['id'] ); /* * Runs right after adding entry to the database. * * @since 1.7.7 * @since 1.8.2 Added Payment ID param. * * @param array $fields Fields data. * @param array $entry User submitted data. * @param array $form_data Form data. * @param int $entry_id Entry ID. * @param int $payment_id Payment ID. / do_action( 'wpforms_process_entry_saved', $this->fields, $entry, $this->form_data, $this->entry_id, $payment_id ); // Fire the logic to send notification emails. $this->entry_email( $this->fields, $entry, $this->form_data, $this->entry_id, 'entry' ); // Pass completed and formatted fields in POST. $_POST['wpforms']['complete'] = $this->fields; // Pass entry ID in POST. $_POST['wpforms']['entry_id'] = $this->entry_id; // Logs entry depending on log levels set. if ( $is_pro ) { wpforms_log( $this->entry_id ? "Entry {$this->entry_id}" : 'Entry', $this->fields, [ 'type' => [ 'entry' ], 'parent' => $this->entry_id, 'form_id' => $this->form_data['id'], ] ); } // Mark submission as spam if one of the spam checks failed and spam entries are stored. $marked_as_spam = $this->spam_reason && $store_spam_entries; // Does not proceed if a form is marked as spam. if ( ! $marked_as_spam ) { $this->process_complete( $form_id, $this->form_data, $this->fields, $entry, $this->entry_id ); } $this->entry_confirmation_redirect( $this->form_data ); } /* * Run the modern Anti-Spam check. * * @since 1.9.0 * * @param array $entry Form submission raw data ($_POST). * * @return bool True if the modern Anti-Spam check was passed, false otherwise. / private function modern_anti_spam_check( array &$entry ): bool { // Skip if spam was already detected. if ( $this->spam_reason ) { return false; } /* * Allow bypassing the modern Anti-Spam check. * * @since 1.9.0 * * @param bool $bypass Whether to bypass the modern Anti-Spam check, default false. * @param array $form_data Form data. * @param array $entry Form submission raw data ($_POST). * * @return bool / if ( apply_filters( 'wpforms_process_anti_spam_honeypot_bypass', false, $this->form_data, $entry ) ) { return true; } // Skip if the modern Anti-Spam check was passed. if ( wpforms()->obj( 'anti_spam' )->validate( $this->form_data, $this->fields, $entry ) ) { return true; } $form_id = $this->form_data['id'] ?? 0; $this->spam_errors[ $form_id ]['header'] = esc_html__( 'Anti-spam Honeypot V2 verification was failed, please try again later.', 'wpforms-lite' ); $this->spam_reason = 'Honeypot V2'; // Log the spam entry depending on log levels set. $this->log_spam_entry( $entry, 'Anti-spam Honeypot V2 verification was failed.' ); return false; } /* * Detect direct POST requests when the AJAX submission is enabled. * For Anti-spam Modern (v3) enabled forms only. * * @since 1.9.0 * * @param array $entry Form submission raw data ($_POST). / private function direct_post_request_check( array $entry ) { if ( // Skip if spam was already detected. $this->spam_reason \|\| // Skip if the Anti-spam Modern (v3) is not enabled. empty( $this->form_data['settings']['antispam_v3'] ) ) { return; } /* * Allow bypassing the direct POST request check. * * @since 1.9.0 * * @param bool $bypass Whether to bypass the direct POST request check, default is false. * @param array $form_data Form data. * @param array $entry Form entry. / if ( apply_filters( 'wpforms_process_anti_spam_direct_post_bypass', false, $this->form_data, $entry ) ) { return; } // phpcs:disable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput $is_ajax_form = ! empty( $this->form_data['settings']['ajax_submit'] ); $is_post = ( $_SERVER['REQUEST_METHOD'] ?? 'GET' ) === 'POST'; $is_direct_post = ! wpforms_is_frontend_ajax() && $is_post; // phpcs:enable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput if ( ! ( $is_ajax_form && $is_direct_post ) ) { return; } $form_id = $this->form_data['id'] ?? 0; $this->spam_errors[ $form_id ]['header'] = esc_html__( 'Direct POST requests are not allowed when the AJAX submission is enabled.', 'wpforms-lite' ); $this->spam_reason = esc_html__( 'Direct POST request', 'wpforms-lite' ); // Log the spam entry depending on log levels set. $this->log_spam_entry( $entry, 'Direct POST request form submission' ); } /* * Run Country filter check. * * @since 1.9.2 * * @param array $entry Form submission raw data ($_POST). * @param int $form_id Form ID. / private function country_filter_check( array $entry, int $form_id ) { // Skip if spam was already detected. if ( $this->spam_reason ) { return; } $country_filter = wpforms()->obj( 'antispam_country_filter' ); // Skip if the Country check was passed. if ( $country_filter->is_valid( $this->form_data ) ) { return; } $this->spam_errors[ $form_id ]['footer'] = $country_filter->get_error_message( $this->form_data ); $this->spam_reason = 'Country Filter'; // Log the spam entry depending on log levels set. $this->log_spam_entry( $entry, 'Country filter verification was failed.' ); } /* * Run Keyword filter check. * * @since 1.9.2 * * @param array $entry Form submission raw data ($_POST). * @param int $form_id Form ID. / private function keyword_filter_check( array $entry, int $form_id ) { // Skip if spam was already detected. if ( $this->spam_reason ) { return; } $keyword_filter = wpforms()->obj( 'antispam_keyword_filter' ); // Skip if the Keyword check was passed. if ( $keyword_filter->is_valid( $this->form_data, $this->fields ) ) { return; } $this->spam_errors[ $form_id ]['footer'] = $keyword_filter->get_error_message( $this->form_data ); $this->spam_reason = 'Keyword Filter'; // Log the spam entry depending on log levels set. $this->log_spam_entry( $entry, 'Keyword filter verification was failed.' ); } /* * Save entry meta data. * * @since 1.8.7 * * @param int $entry_id Entry ID. * @param int $form_id Form ID. / protected function save_meta( $entry_id, $form_id ) { if ( ! wpforms()->is_pro() ) { return; } $meta_data = $this->form_data['entry_meta']; $entry_meta = wpforms()->obj( 'entry_meta' ); foreach ( $meta_data as $type => $value ) { $entry_meta->add( [ 'entry_id' => $entry_id, 'form_id' => $form_id, 'user_id' => get_current_user_id(), 'type' => $type, 'data' => $value, ], 'entry_meta' ); } } /* * Log spam entry. * * @since 1.8.3 * * @param array $entry Form submission raw data ($_POST). * @param string $message Spam message. / private function log_spam_entry( $entry, $message ) { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks // Log the spam entry message after processing the entry when the entry ID is generated. add_action( 'wpforms_process_after', static function ( $fields, $entry_id, $form_data ) use ( $entry, $message ) { wpforms_log( 'Spam Entry ' . uniqid( '', true ), [ $message, $entry ], [ 'type' => [ 'spam' ], 'form_id' => $form_data['id'] ?? 0, 'parent' => $entry_id, ] ); }, 10, 3 ); } /* * Check if the form was submitted too quickly. * * @since 1.8.3 / private function time_limit_check() { /* * Allow bypassing the time limit check. * * @since 1.8.3 * * @param bool $bypass Whether to bypass the time limit check, default false. * @param array $form_data Form data. * * @return bool / if ( apply_filters( 'wpforms_process_time_limit_check_bypass', false, $this->form_data ) ) { return; } $settings = $this->form_data['settings']; $time_limit = ! empty( $settings['anti_spam']['time_limit'] ) ? $settings['anti_spam']['time_limit'] : []; $enabled = ! empty( $time_limit['enable'] ); $duration = ! empty( $time_limit['duration'] ) ? absint( $time_limit['duration'] ) : 0; if ( ! $enabled \|\| $duration <= 0 ) { return; } //phpcs:disable WordPress.Security.NonceVerification.Missing $start = ! empty( $_POST['start_timestamp'] ) ? absint( $_POST['start_timestamp'] ) : 0; $end = ! empty( $_POST['end_timestamp'] ) ? absint( $_POST['end_timestamp'] ) : 0; //phpcs:enable WordPress.Security.NonceVerification.Missing // Filter out empty fields. $fields = array_filter( $this->fields, static function ( $field ) { return ! empty( $field['value'] ); } ); // Skip time limit check if the form was submitted with prefilled values. if ( $start === 0 && ! empty( $fields ) ) { return; } // If the form was submitted too quickly, add an error. if ( ( $end - $start ) < $duration \|\| $start === 0 ) { $this->errors[ $this->form_data['id'] ]['header'] = esc_html__( 'Please wait a little longer before submitting. We’re running a quick security check.', 'wpforms-lite' ); } } /* * Process complete. * * @since 1.8.3 * * @param int $form_id Form ID. * @param array $form_data Form data and settings. * @param array $fields Fields data. * @param array $entry Form submission raw data ($_POST). * @param int $entry_id Entry ID. / public function process_complete( $form_id, $form_data, $fields, $entry, $entry_id ) { /* * Runs right after the form has been successfully submitted. * * @since 1.0.0 * @since 1.8.3 Added $entry parameter. * * @param array $fields Fields data. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. * @param int $entry_id Entry ID. / do_action( 'wpforms_process_complete', $fields, $entry, $form_data, $entry_id ); /* * Runs right after the form has been successfully submitted by form ID. * * @since 1.0.0 * @since 1.8.3 Added $entry parameter. * * @param array $fields Fields data. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. * @param int $entry_id Entry ID. / do_action( "wpforms_process_complete_{$form_id}", $fields, $entry, $form_data, $entry_id ); } /* * Check for spam. * * @since 1.8.3 * * @param array $entry Form submission raw data ($_POST). / public function process_spam_check( $entry ) { // CAPTCHA check. $this->process_captcha( $entry ); if ( $this->spam_reason ) { return; } $akismet = wpforms()->obj( 'akismet' )->validate( $this->form_data, $entry ); // If Akismet marks the entry as spam, we want to log the entry and fail silently. if ( $akismet ) { $this->spam_errors[ $this->form_data['id'] ]['header'] = $akismet; // Log the spam entry depending on log levels set. $this->log_spam_entry( $entry, $akismet ); $this->spam_reason = esc_html__( 'Akismet', 'wpforms-lite' ); } } /* * Is bypass spam check. * * @since 1.8.3 * * @param array $entry Form submission raw data ($_POST). * * @return bool / protected function is_bypass_spam_check( $entry ) { /* * Filter to bypass CAPTCHA check. * * @since 1.6.6 * * @param bool $bypass_captcha Whether to bypass CAPTCHA check. * @param array $entry Form submission raw data ($_POST). * @param array $form_data Form data. / return apply_filters( 'wpforms_process_bypass_captcha', false, $entry, $this->form_data ); } /* * Process captcha. * * @since 1.8.0 * @since 1.8.3 Removed $captcha_settings parameter. * * @param array $entry Form submission raw data ($_POST). * * @return void / private function process_captcha( $entry ) { // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh // Skip if spam was already detected. if ( $this->spam_reason ) { return; } $captcha_settings = wpforms_get_captcha_settings(); if ( ! $this->allow_process_captcha( $entry, $captcha_settings ) ) { return; } $provider = $captcha_settings['provider']; $current_captcha = $this->get_captcha( $provider ); if ( empty( $current_captcha ) ) { return; } $verify_url_raw = $current_captcha['verify_url_raw']; $captcha_provider = $current_captcha['provider']; $post_key = $current_captcha['post_key']; / translators: %s - The CAPTCHA provider name. / $error = wpforms_setting( "{$provider}-fail-msg", sprintf( esc_html__( '%s verification failed, please try again later.', 'wpforms-lite' ), $captcha_provider ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing $token = ! empty( $_POST[ $post_key ] ) ? $_POST[ $post_key ] : false; $is_recaptcha_v3 = $provider === 'recaptcha' && $captcha_settings['recaptcha_type'] === 'v3'; if ( $is_recaptcha_v3 ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.NonceVerification.Missing $token = ! empty( $_POST['wpforms']['recaptcha'] ) ? $_POST['wpforms']['recaptcha'] : false; } $verify_query_arg = [ 'secret' => $captcha_settings['secret_key'], 'response' => $token, 'remoteip' => wpforms_get_ip(), ]; if ( ! $token ) { $this->errors[ $this->form_data['id'] ]['recaptcha'] = $error; return; } / * hCaptcha uses user IP to better detect bots and their attacks on a form. * Majority of our users have GDPR disabled. * So we remove this data from the request only when it's unnecessary, * depending on wpforms_is_collecting_ip_allowed($this->form_data) check. / if ( ! wpforms_is_collecting_ip_allowed( $this->form_data ) ) { unset( $verify_query_arg['remoteip'] ); } /* * Change query arguments for remote call to the captcha API. * * @since 1.8.0 * * @param array $verify_query_arg The query arguments for verify URL. * @param array $form_data Form data and settings. / $verify_query_arg = apply_filters( 'wpforms_process_captcha_verify_query_arg', $verify_query_arg, $this->form_data ); /* * Filter the CAPTCHA verify URL. * * @since 1.6.4 * @since 1.8.0 Added $form_data argument. * * @param string $verify_url The full `CAPTCHA verify URL`. * @param string $verify_url_raw The `CAPTCHA verify URL` without query. * @param array $verify_query_arg The query arguments for verify URL. * @param array $form_data Form data and settings. / $verify_url = apply_filters( 'wpforms_process_captcha_verify_url', $verify_url_raw, $verify_url_raw, $verify_query_arg, $this->form_data ); $response = wp_safe_remote_post( $verify_url, [ 'body' => $verify_query_arg ] ); $response_body = json_decode( wp_remote_retrieve_body( $response ), false ); if ( empty( $response_body->success ) \|\| ( $is_recaptcha_v3 && $response_body->score <= wpforms_setting( 'recaptcha-v3-threshold', '0.4' ) ) ) { if ( $is_recaptcha_v3 && isset( $response_body->score ) ) { $error .= ' (' . esc_html( $response_body->score ) . ')'; } $this->spam_errors[ $this->form_data['id'] ]['recaptcha'] = $error; $this->log_spam_entry( $entry, $error ); $this->spam_reason = $captcha_provider; } } /* * Check if CAPTCHA processing is allowed. * * @since 1.8.3 * * @param array $entry Form entry data. * @param array $captcha_settings CAPTCHA settings. * * @return bool * @noinspection PhpMissingParamTypeInspection * @noinspection PhpUnusedParameterInspection / private function allow_process_captcha( $entry, $captcha_settings ) { // Skip captcha processing if an AMP form. if ( isset( $_POST['__amp_form_verify'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing return false; } // Skip captcha processing if the provider is not set. if ( empty( $captcha_settings['provider'] ) ) { return false; } $provider = $captcha_settings['provider']; // Skip captcha processing if the provider is set to none. if ( $provider === 'none' ) { return false; } // Skip captcha processing if a site key or secret key is empty. if ( empty( $captcha_settings['site_key'] ) \|\| empty( $captcha_settings['secret_key'] ) ) { return false; } $form_data_settings = $this->form_data['settings'] ?? []; $is_recaptcha = isset( $form_data_settings['recaptcha'] ) && (int) $form_data_settings['recaptcha'] === 1; // Skip captcha processing if reCAPTCHA is disabled for this form. if ( ! $is_recaptcha ) { return false; } $recaptcha_type = $captcha_settings['recaptcha_type']; $is_recaptcha_v3 = $provider === 'recaptcha' && $recaptcha_type === 'v3'; // Skip captcha processing on AMP if not using reCAPTCHA v3. AMP requires Google reCAPTCHA v3. return $is_recaptcha_v3 \|\| ! wpforms_is_amp(); } /* * Get all available CAPTCHA providers. * * @since 1.8.3 * * @return array / private function get_captcha_providers() { /* * Filter the CAPTCHA providers. * * @since 1.8.3 * * @param array $providers The CAPTCHA providers. / return apply_filters( 'wpforms_process_captcha_providers', [ 'hcaptcha' => [ 'verify_url_raw' => 'https://hcaptcha.com/siteverify', 'provider' => 'hCaptcha', 'post_key' => 'h-captcha-response', ], 'recaptcha' => [ 'verify_url_raw' => 'https://www.google.com/recaptcha/api/siteverify', 'provider' => 'Google reCAPTCHA', 'post_key' => 'g-recaptcha-response', ], 'turnstile' => [ 'verify_url_raw' => 'https://challenges.cloudflare.com/turnstile/v0/siteverify', 'provider' => 'Cloudflare Turnstile', 'post_key' => 'cf-turnstile-response', // The key is specified by the API. ], ] ); } /* * Get CAPTCHA provider data. * * @since 1.8.3 * * @param string $provider CAPTCHA provider. * * @return array / private function get_captcha( $provider ) { $captcha_providers = $this->get_captcha_providers(); return $captcha_providers[ $provider ] ?? []; } /* * Check if combined upload size exceeds allowed maximum. * * @since 1.6.0 * * @param WP_Post $form Form post object. / public function validate_combined_upload_size( $form ): void { $form_id = (int) $form->ID; $upload_fields = wpforms_get_form_fields( $form, [ 'file-upload' ] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing if ( ! empty( $upload_fields ) && ! empty( $_FILES ) ) { // Get $_FILES keys generated by WPForms only. $files_keys = preg_filter( '/^/', 'wpforms_' . $form_id . '_', array_keys( $upload_fields ) ); // Filter uploads without errors. Individual errors are handled by WPForms\Pro\Forms\Fields\FileUpload\Field class. // phpcs:ignore WordPress.Security.NonceVerification.Missing $files = wp_list_filter( wp_array_slice_assoc( $_FILES, $files_keys ), [ 'error' => 0 ] ); $files_size = array_sum( wp_list_pluck( $files, 'size' ) ); $files_size_max = wpforms_max_upload( true ); if ( $files_size > $files_size_max ) { // Add new header error preserving previous ones. $this->errors[ $form_id ]['header'] = ! empty( $this->errors[ $form_id ]['header'] ) ? $this->errors[ $form_id ]['header'] . '<br>' : ''; $this->errors[ $form_id ]['header'] .= esc_html__( 'Uploaded files combined size exceeds allowed maximum.', 'wpforms-lite' ); } } } /* * Validate the form return hash. * * @since 1.0.0 * * @param string $hash Base64-encoded hash of form and entry IDs. * * @return array\|false False for invalid or form id. / public function validate_return_hash( $hash = '' ) { // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode $query_args = base64_decode( $hash ); parse_str( $query_args, $output ); // Verify hash matches. if ( wp_hash( $output['form_id'] . ',' . $output['entry_id'] ) !== $output['hash'] ) { return false; } // Get lead and verify it is attached to the form we received with it. $entry = wpforms()->obj( 'entry' )->get( $output['entry_id'], [ 'cap' => false ] ); if ( empty( $entry->form_id ) ) { return false; } if ( $output['form_id'] !== $entry->form_id ) { return false; } return [ 'form_id' => absint( $output['form_id'] ), 'entry_id' => absint( $output['form_id'] ), 'fields' => $entry !== null && isset( $entry->fields ) ? $entry->fields : [], ]; } /* * Check if the confirmation data are valid. * * @since 1.6.4 * * @param array $data The confirmation data. * * @return bool / protected function is_valid_confirmation( $data ) { if ( empty( $data['type'] ) ) { return false; } // Confirmation type: redirect, page or message. $type = $data['type']; return isset( $data[ $type ] ) && ! wpforms_is_empty_string( $data[ $type ] ); } /* * Redirect user to a page or URL specified in the form confirmation settings. * * @since 1.0.0 * * @param array $form_data Form data and settings. * @param string $hash Base64-encoded hash of form and entry IDs. / public function entry_confirmation_redirect( $form_data = [], $hash = '' ) { // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh, WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks // Maybe process return hash. if ( ! empty( $hash ) ) { $hash_data = $this->validate_return_hash( $hash ); if ( ! $hash_data \|\| ! is_array( $hash_data ) ) { return; } $this->valid_hash = true; $this->entry_id = absint( $hash_data['entry_id'] ); $this->fields = json_decode( $hash_data['fields'], true ); $this->form_data = wpforms()->obj( 'form' )->get( absint( $hash_data['form_id'] ), [ 'content_only' => true, ] ); } else { $this->form_data = $form_data; } // Backward compatibility. if ( empty( $this->form_data['settings']['confirmations'] ) ) { $this->form_data['settings']['confirmations'][1]['type'] = ! empty( $this->form_data['settings']['confirmation_type'] ) ? $this->form_data['settings']['confirmation_type'] : 'message'; $this->form_data['settings']['confirmations'][1]['message'] = ! empty( $this->form_data['settings']['confirmation_message'] ) ? $this->form_data['settings']['confirmation_message'] : esc_html__( 'Thanks for contacting us! We will be in touch with you shortly.', 'wpforms-lite' ); $this->form_data['settings']['confirmations'][1]['message_scroll'] = ! empty( $this->form_data['settings']['confirmation_message_scroll'] ) ? $this->form_data['settings']['confirmation_message_scroll'] : 1; $this->form_data['settings']['confirmations'][1]['page'] = ! empty( $this->form_data['settings']['confirmation_page'] ) ? $this->form_data['settings']['confirmation_page'] : ''; $this->form_data['settings']['confirmations'][1]['redirect'] = ! empty( $this->form_data['settings']['confirmation_redirect'] ) ? $this->form_data['settings']['confirmation_redirect'] : ''; } if ( empty( $this->form_data['settings']['confirmations'] ) \|\| ! is_array( $this->form_data['settings']['confirmations'] ) ) { return; } $confirmations = $this->form_data['settings']['confirmations']; // Reverse sort confirmations by id to process newer ones first. krsort( $confirmations ); $confirmation_id = $this->get_confirmation_id( $confirmations ); $this->confirmation = $confirmations[ $confirmation_id ] ?? []; $url = ''; // Redirect if needed, to either a page or URL, after form processing. if ( ! empty( $confirmations[ $confirmation_id ]['type'] ) && $confirmations[ $confirmation_id ]['type'] !== 'message' ) { if ( $confirmations[ $confirmation_id ]['type'] === 'redirect' ) { $rawurlencode_callback = static function ( $value ) { return $value === null ? null : rawurlencode( $value ); }; add_filter( 'wpforms_smarttags_process_field_id_value', $rawurlencode_callback ); $url = wpforms_process_smart_tags( $confirmations[ $confirmation_id ]['redirect'], $this->form_data, $this->fields, $this->entry_id, 'confirmation_redirect' ); remove_filter( 'wpforms_smarttags_process_field_id_value', $rawurlencode_callback ); } if ( $confirmations[ $confirmation_id ]['type'] === 'page' ) { $url = get_permalink( (int) $confirmations[ $confirmation_id ]['page'] ); } } if ( ! empty( $url ) ) { // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation $url = apply_filters( 'wpforms_process_redirect_url', $url, $this->form_data['id'], $this->fields, $this->form_data, $this->entry_id ); if ( wpforms_is_amp() ) { /* This filter is documented in wp-includes/pluggable.php / // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName, WPForms.Comments.PHPDocHooks.RequiredHookDocumentation $url = apply_filters( 'wp_redirect', $url, 302 ); $url = wp_sanitize_redirect( $url ); header( sprintf( 'AMP-Redirect-To: %s', $url ) ); header( 'Access-Control-Expose-Headers: AMP-Redirect-To', false ); wp_send_json( [ 'message' => __( 'Redirecting…', 'wpforms-lite' ), 'redirecting' => true, ], 200 ); } else { wp_redirect( esc_url_raw( $url ) ); // phpcs:ignore } // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation do_action( 'wpforms_process_redirect', $this->form_data['id'] ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation do_action( "wpforms_process_redirect_{$this->form_data['id']}", $this->form_data['id'] ); exit; } // Pass a message to a frontend if no redirection happened. if ( ! empty( $confirmations[ $confirmation_id ]['type'] ) && $confirmations[ $confirmation_id ]['type'] === 'message' ) { $this->confirmation_message = $confirmations[ $confirmation_id ]['message']; if ( ! empty( $confirmations[ $confirmation_id ]['message_scroll'] ) ) { wpforms()->obj( 'frontend' )->confirmation_message_scroll = true; } } } /* * Determine which confirmation to process. * * @since 1.9.2 * * @param array $confirmations List of confirmations. * * @return int Confirmation ID. / private function get_confirmation_id( array $confirmations ) { $default_confirmation_key = min( array_keys( $confirmations ) ); $confirmation_id = 0; foreach ( $confirmations as $confirmation_id => $confirmation ) { // Last confirmation should execute in any case. if ( $default_confirmation_key === $confirmation_id ) { break; } if ( ! $this->is_valid_confirmation( $confirmation ) ) { continue; } // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName /* * Process confirmation filter. * * @since 1.4.8 * * @param bool $process Whether to process the logic or not. * @param array $fields List of submitted fields. * @param array $form_data Form data and settings. * @param int $id Confirmation ID. / $process_confirmation = apply_filters( 'wpforms_entry_confirmation_process', true, $this->fields, $this->form_data, $confirmation_id ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName if ( $process_confirmation ) { break; } } return $confirmation_id; } /* * Get a confirmation message. * * @since 1.5.3 * * @param array $form_data Form data and settings. * @param array $fields Sanitized field data. * @param int $entry_id Entry id. * * @return string Confirmation message. / public function get_confirmation_message( $form_data, $fields, $entry_id ) { if ( empty( $this->confirmation_message ) ) { return ''; } $confirmation_message = wpforms_process_smart_tags( $this->confirmation_message, $form_data, $fields, $entry_id, 'confirmation' ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName return apply_filters( 'wpforms_frontend_confirmation_message', wpautop( $confirmation_message ), $form_data, $fields, $entry_id ); } /* * Get current confirmation. * * @since 1.6.9 * * @return array / public function get_current_confirmation() { return ! empty( $this->confirmation ) ? $this->confirmation : []; } /* * Catch the post_max_size overflow. * * @since 1.5.2 * * @return bool / public function post_max_size_overflow() { // phpcs:disable WordPress.Security.NonceVerification if ( empty( $_SERVER['CONTENT_LENGTH'] ) \|\| empty( $_GET['wpforms_form_id'] ) ) { return false; } $form_id = (int) $_GET['wpforms_form_id']; $total_size = (int) $_SERVER['CONTENT_LENGTH']; $post_max_size = wpforms_size_to_bytes( ini_get( 'post_max_size' ) ); if ( ! ( $total_size > $post_max_size && empty( $_POST ) && $form_id > 0 ) ) { return false; } // phpcs:enable WordPress.Security.NonceVerification $error_msg = esc_html__( 'Form has not been submitted, please see the errors below.', 'wpforms-lite' ); $error_msg .= '<br>' . sprintf( / translators: %1$.3f - total size of the selected files in megabytes, %2$.3f - allowed file upload limit in megabytes./ esc_html__( 'The total size of the selected files %1$.3f MB exceeds the allowed limit %2$.3f MB.', 'wpforms-lite' ), esc_html( $total_size / 1048576 ), esc_html( $post_max_size / 1048576 ) ); $this->errors[ $form_id ]['header'] = $error_msg; return true; } /* * Send entry email notifications. * * @since 1.0.0 * * @param array $fields List of fields. * @param array $entry Submitted form entry. * @param array $form_data Form data and settings. * @param int $entry_id Saved entry id. * @param string $context In which context this email is sent. / public function entry_email( $fields, $entry, $form_data, $entry_id, $context = '' ) { // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh // Check that the form was configured for email notifications. if ( empty( $form_data['settings']['notification_enable'] ) ) { return; } /* * Allow entry email notifications to be disabled. * * @since 1.0.0 * * @param bool $enabled Whether to send the email. * @param array $fields List of fields. * @param array $entry Form submission raw data. * @param array $form_data Form data and settings. / if ( ! apply_filters( 'wpforms_entry_email', true, $fields, $entry, $form_data ) ) { // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName return; } // Make sure we have an entry id. if ( empty( $this->entry_id ) ) { $this->entry_id = (int) $entry_id; } /* * Filter entry email notifications data. * * @since 1.0.0 * * @param array $fields List of fields. * @param array $entry Form submission raw data. * @param array $form_data Form data and settings. / $fields = apply_filters( 'wpforms_entry_email_data', $fields, $entry, $form_data ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName // Backwards compatibility for notifications before v1.4.3. if ( empty( $form_data['settings']['notifications'] ) && ! empty( $form_data['settings']['notification_email'] ) ) { $notifications[1] = [ 'email' => $form_data['settings']['notification_email'], 'subject' => $form_data['settings']['notification_subject'], 'sender_name' => $form_data['settings']['notification_fromname'], 'sender_address' => $form_data['settings']['notification_fromaddress'], 'replyto' => $form_data['settings']['notification_replyto'], 'message' => '{all_fields}', ]; } else { $notifications = $form_data['settings']['notifications']; } $notifications_count = count( $notifications ); $is_pro = wpforms()->is_pro(); foreach ( $notifications as $notification_id => $notification ) : if ( empty( $notification['email'] ) ) { continue; } // You can disable the email notification for a specific notification only if there are more than one notification. // BC: The notification should be enabled even when the `enabled` key doesn't exist. // The key is missed for old forms or forms created using the Lite version. if ( $is_pro && $notifications_count > 1 && isset( $notification['enable'] ) && (int) $notification['enable'] === 0 ) { continue; } /* * Allow entry email notifications to be disabled for a specific notification. * * @since 1.0.0 * * @param bool $enabled Whether to send the email. * @param array $fields List of fields. * @param array $form_data Form data and settings. * @param int $notification_id Notification ID. * @param string $context In which context this email is sent. / $process_email = apply_filters( 'wpforms_entry_email_process', true, $fields, $form_data, $notification_id, $context ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName if ( ! $process_email ) { continue; } $email = []; $is_carboncopy_enabled = wpforms_setting( 'email-carbon-copy', false ); // Setup email properties. $email['subject'] = ! empty( $notification['subject'] ) ? $notification['subject'] : sprintf( / translators: %s - form name. / esc_html__( 'New %s Entry', 'wpforms-lite' ), $form_data['settings']['form_title'] ); $email['address'] = explode( ',', wpforms_process_smart_tags( $notification['email'], $form_data, $fields, $this->entry_id, 'notification-send-to-email' ) ); $email['address'] = array_filter( array_map( 'sanitize_email', $email['address'] ) ); $email['sender_address'] = ! empty( $notification['sender_address'] ) ? $notification['sender_address'] : get_option( 'admin_email' ); $email['sender_name'] = ! empty( $notification['sender_name'] ) ? $notification['sender_name'] : get_bloginfo( 'name' ); $email['replyto'] = ! empty( $notification['replyto'] ) ? $notification['replyto'] : false; $email['message'] = ! empty( $notification['message'] ) ? $notification['message'] : '{all_fields}'; $email['template'] = ! empty( $notification['template'] ) ? $notification['template'] : ''; if ( $is_carboncopy_enabled && ! empty( $notification['carboncopy'] ) ) { $email['carboncopy'] = explode( ',', wpforms_process_smart_tags( $notification['carboncopy'], $form_data, $fields, $this->entry_id, 'notification-carboncopy' ) ); $email['carboncopy'] = array_filter( array_map( 'sanitize_email', $email['carboncopy'] ) ); } /* * Filter entry email notifications attributes. * * @since 1.0.0 * * @param array $email Email attributes. * @param array $fields List of fields. * @param array $entry Form submission raw data. * @param array $form_data Form data and settings. * @param int $notification_id Notification ID. / $email = apply_filters( 'wpforms_entry_email_atts', $email, $fields, $entry, $form_data, $notification_id ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName // Create new email. $emails = ( new Notifications() )->init( $email['template'] ); $emails->__set( 'form_data', $form_data ); $emails->__set( 'fields', $fields ); $emails->__set( 'notification_id', $notification_id ); $emails->__set( 'entry_id', $this->entry_id ); $emails->__set( 'from_name', $email['sender_name'] ); $emails->__set( 'from_address', $email['sender_address'] ); $emails->__set( 'reply_to', $email['replyto'] ); // Reset headers to support multiple notifications. They will be set on sending. $emails->__set( 'headers', null ); // Maybe include CC. if ( $is_carboncopy_enabled && ! empty( $email['carboncopy'] ) ) { $emails->__set( 'cc', $email['carboncopy'] ); } /* * Filter entry email notifications before sending. * * @since 1.0.0 * * @param object $emails WPForms_WP_Emails instance. / $emails = apply_filters( 'wpforms_entry_email_before_send', $emails ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName $this->email_handler = $emails; // Go. foreach ( $email['address'] as $address ) { $emails->send( trim( $address ), $email['subject'], $email['message'] ); } endforeach; } /* * Save entry to a database. * * @since 1.0.0 * * @param array $fields List of form fields. * @param array $entry User submitted data. * @param int $form_id Form ID. * @param array $form_data Prepared form settings. * * @return int / public function entry_save( $fields, $entry, $form_id, $form_data = [] ) { $fields = $this->remove_raw_data_before_save( $fields ); /* * Fires on entry save. * * @since 1.0.0 * * @param array $fields List of form fields. * @param array $entry Form submission raw data. * @param int $form_id Form ID. * @param array $form_data Prepared form settings. / do_action( 'wpforms_process_entry_save', $fields, $entry, $form_id, $form_data ); return $this->entry_id; } /* * Remove raw data from fields before saving. * This is needed to prevent raw password data from being saved to the database. * * @since 1.8.6 * * @param array $fields List of form fields. * * @return array / private function remove_raw_data_before_save( array $fields ): array { foreach ( $fields as $key => $field ) { if ( ! empty( $field['type'] ) && $field['type'] === 'password' ) { unset( $fields[ $key ]['value_raw'] ); } } return $fields; } /* * Save payment to the database. * * @since 1.8.2 * * @param array $entry User submitted data. * * @return int Payment ID. / private function payment_save( $entry ) { if ( ! wpforms_has_payment( 'entry', $this->fields ) ) { return 0; } $entry['entry_id'] = $this->entry_id; $form_submission = wpforms()->obj( 'submission' )->register( $this->fields, $entry, $this->form_data['id'], $this->form_data ); // Prepare the payment data. $payment_data = $form_submission->prepare_payment_data(); // Bail early in case payment field exists, // but no payment data was provided (e.g., old payment addon is used). if ( empty( $payment_data['gateway'] ) ) { return 0; } // Create payment. $payment_id = wpforms()->obj( 'payment' )->add( $payment_data ); if ( ! $payment_id ) { return 0; } // Insert payment meta. wpforms()->obj( 'payment_meta' )->bulk_add( $payment_id, $form_submission->prepare_payment_meta() ); /* * Fire after payment was saved to a database. * * @since 1.8.2 * * @param int $payment_id Payment id. * @param array $fields Form fields. * @param array $form_data Form data. / do_action( 'wpforms_process_payment_saved', $payment_id, $this->fields, $this->form_data ); return $payment_id; } /* * Process AJAX form submit. * * @since 1.5.3 / public function ajax_submit() { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks // phpcs:disable WordPress.Security.NonceVerification.Missing $form_id = isset( $_POST['wpforms']['id'] ) ? absint( $_POST['wpforms']['id'] ) : 0; if ( empty( $form_id ) ) { wp_send_json_error(); } if ( isset( $_POST['wpforms']['post_id'] ) ) { // We don't have a global $post when processing ajax requests. // Therefore, it's needed to set a global $post manually for compatibility with functions used in smart tag processing. global $post; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited $post = WP_Post::get_instance( absint( $_POST['wpforms']['post_id'] ) ); } // phpcs:enable WordPress.Security.NonceVerification.Missing add_filter( 'wp_redirect', [ $this, 'ajax_process_redirect' ], 999 ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName do_action( 'wpforms_ajax_submit_before_processing', $form_id ); // If redirect happens in listen(), ajax_process_redirect() gets executed because of the filter on `wp_redirect`. // The code, that is below listen(), runs only if no redirect happened. $this->listen(); $form_data = $this->form_data; if ( empty( $form_data ) ) { $form_data = wpforms()->obj( 'form' )->get( $form_id, [ 'content_only' => true ] ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName $form_data = apply_filters( 'wpforms_frontend_form_data', $form_data ); } if ( ! empty( $this->errors[ $form_id ] ) ) { $this->ajax_process_errors( $form_id, $form_data ); wp_send_json_error(); } ob_start(); wpforms()->obj( 'frontend' )->confirmation( $form_data ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName $response = apply_filters( 'wpforms_ajax_submit_success_response', [ 'confirmation' => ob_get_clean() ], $form_id, $form_data ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName do_action( 'wpforms_ajax_submit_completed', $form_id, $response ); wp_send_json_success( $response ); } /* * Process AJAX errors. * * @since 1.5.3 * * @todo This should be re-used/combined for AMP verify-xhr requests. * * @param int $form_id Form ID. * @param array $form_data Form data and settings. / protected function ajax_process_errors( $form_id, $form_data ) { $errors = $this->errors[ $form_id ] ?? []; // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName $errors = apply_filters( 'wpforms_ajax_submit_errors', $errors, $form_id, $form_data ); if ( empty( $errors ) ) { wp_send_json_error(); } // General errors are errors that cannot be populated with jQuery Validate plugin. $general_errors = array_intersect_key( $errors, array_flip( [ 'header', 'footer', 'header_styled', 'footer_styled', 'recaptcha' ] ) ); foreach ( $general_errors as $key => $error ) { ob_start(); wpforms()->obj( 'frontend' )->form_error( $key, $error, $form_data ); $general_errors[ $key ] = ob_get_clean(); } $fields = $form_data['fields'] ?? []; // Get registered fields errors only. $field_errors = array_intersect_key( $errors, $fields ); // Transform field ids to field names for jQuery Validate plugin. foreach ( $field_errors as $key => $error ) { $name = $this->ajax_error_field_name( $fields[ $key ], $form_data, $error ); if ( $name ) { $field_errors[ $name ] = $error; } unset( $field_errors[ $key ] ); } $response = []; if ( $general_errors ) { $response['errors']['general'] = $general_errors; } if ( $field_errors ) { $response['errors']['field'] = $field_errors; } // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName $response = apply_filters( 'wpforms_ajax_submit_errors_response', $response, $form_id, $form_data ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName do_action( 'wpforms_ajax_submit_completed', $form_id, $response ); wp_send_json_error( $response ); } /* * Get field name for an ajax error message. * * @since 1.6.3 * * @param array $field Field settings. * @param array $form_data Form data and settings. * @param string\|string[] $error Error message. * * @return string / private function ajax_error_field_name( array $field, array $form_data, $error ): string { $props = wpforms()->obj( 'frontend' )->get_field_properties( $field, $form_data ); /* * Filter the field name for an ajax error message. * * @since 1.6.3 * * @param string $name Error field name. * @param array $field Field. * @param array $props Field properties. * @param string\|string[] $error Error message. / return (string) apply_filters( 'wpforms_process_ajax_error_field_name', '', $field, $props, $error ); } /* * Process AJAX redirect. * * @since 1.5.3 * * @param string $url Redirect URL. / public function ajax_process_redirect( $url ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing $form_id = isset( $_POST['wpforms']['id'] ) ? absint( $_POST['wpforms']['id'] ) : 0; if ( empty( $form_id ) ) { wp_send_json_error(); } $response = [ 'form_id' => $form_id, 'redirect_url' => $url, ]; // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName $response = apply_filters( 'wpforms_ajax_submit_redirect', $response, $form_id, $url ); // phpcs:ignore WPForms.Comments.PHPDocHooks.RequiredHookDocumentation, WPForms.PHP.ValidateHooks.InvalidHookName do_action( 'wpforms_ajax_submit_completed', $form_id, $response ); wp_send_json_success( $response ); } /* * Conditionally add a new_tab key to the AJAX response. * * @since 1.9.2 * * @param array $response AJAX response. * * @return array AJAX response. / public function maybe_open_in_new_tab( array $response ): array { $open_in_new_tab = $this->confirmation['redirect_new_tab'] ?? false; if ( $open_in_new_tab ) { $response['new_tab'] = true; } return $response; } /* * Validate action value for ajax form submission. * * @since 1.9.3 * * @return bool / private function is_valid_ajax_submit_action(): bool { // In case of AMP form submission, the action is not set. if ( wpforms_is_amp( false ) ) { return true; } // phpcs:ignore WordPress.Security.NonceVerification.Missing return ! empty( $_POST['action'] ) && $_POST['action'] === 'wpforms_submit'; } /* * Get current email handler. * * @since 1.9.4 * * @return mixed\|Mailer\|WPForms_WP_Emails\|null */ public function get_email_handler() { return $this->email_handler; } }	62.71 KB	2025-09-23 14:43
📄 class-providers.php <?php // phpcs:disable Generic.Commenting.DocComment.MissingShort /** @noinspection PhpIllegalPsrClassPathInspection / /* @noinspection AutoloadingIssuesInspection / // phpcs:enable Generic.Commenting.DocComment.MissingShort if ( ! defined( 'ABSPATH' ) ) { exit; } use WPForms\Integrations\ConstantContact\V3\ConstantContact; /* * Load the providers. * * @since 1.3.6 / class WPForms_Providers { /* * Primary class constructor. * * @since 1.3.6 / public function __construct() { $this->init(); } /* * Load and init the base provider class. * * @since 1.3.6 / public function init() { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks // Parent class template. require_once WPFORMS_PLUGIN_DIR . 'includes/providers/class-base.php'; // Load default templates on WP init. add_action( 'wpforms_loaded', [ $this, 'load' ] ); } /* * Load default marketing providers. * * @since 1.3.6 / public function load() { $providers = []; if ( ConstantContact::get_current_version() === 2 ) { $providers[] = 'constant-contact'; } /* * Allow third-party plugins to load their own providers. * * @since 1.7.0 * * @param array $providers Array of providers to load. / $providers = (array) apply_filters( 'wpforms_load_providers', $providers ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName foreach ( $providers as $provider ) { $provider = sanitize_file_name( $provider ); $path = WPFORMS_PLUGIN_DIR . 'includes/providers/class-' . $provider . '.php'; if ( file_exists( $path ) ) { require_once $path; } /* * Allow third-party plugins to load their own providers. * * @since 1.7.0 */ do_action( "wpforms_load_{$provider}_provider" ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName } } } new WPForms_Providers();	1.84 KB	2025-09-23 14:43
📄 class-templates.php <?php if ( ! defined( 'ABSPATH' ) ) { exit; } /** * Pre-configured packaged templates. * * @since 1.0.0 / class WPForms_Templates { /* * Primary class constructor. * * @since 1.0.0 / public function __construct() { $this->init(); } /* * Load and init the base form template class. * * @since 1.2.8 / public function init() { // Parent class template. require_once WPFORMS_PLUGIN_DIR . 'includes/templates/class-base.php'; // Load default templates on WP init. add_action( 'init', [ $this, 'load' ] ); } /* * Load default form templates. * * @since 1.0.0 */ public function load() { $templates = apply_filters( 'wpforms_load_templates', [ 'blank', 'simple-contact-form', ] ); foreach ( $templates as $template ) { $template = sanitize_file_name( $template ); if ( file_exists( WPFORMS_PLUGIN_DIR . 'includes/templates/class-' . $template . '.php' ) ) { require_once WPFORMS_PLUGIN_DIR . 'includes/templates/class-' . $template . '.php'; } elseif ( file_exists( WPFORMS_PLUGIN_DIR . 'pro/includes/templates/class-' . $template . '.php' ) && wpforms()->is_pro() ) { require_once WPFORMS_PLUGIN_DIR . 'pro/includes/templates/class-' . $template . '.php'; } } } } new WPForms_Templates;	1.26 KB	2025-09-23 14:43
📄 class-widget.php <?php if ( ! defined( 'ABSPATH' ) ) { exit; } /** * WPForms widget. * * @since 1.0.2 / class WPForms_Widget extends WP_Widget { /* * Hold widget settings defaults, populated in constructor. * * @since 1.0.2 * * @var array / protected $defaults; /* * Constructor. * * @since 1.0.2 / public function __construct() { // Widget defaults. $this->defaults = [ 'title' => '', 'form_id' => '', 'show_title' => false, 'show_desc' => false, ]; // Widget Slug. $widget_slug = 'wpforms-widget'; // Widget basics. $widget_ops = [ 'classname' => $widget_slug, 'description' => esc_html_x( 'Display a form.', 'Widget', 'wpforms-lite' ), 'show_instance_in_rest' => false, ]; // Widget controls. $control_ops = [ 'id_base' => $widget_slug, ]; // Load widget. parent::__construct( $widget_slug, esc_html_x( 'WPForms', 'Widget', 'wpforms-lite' ), $widget_ops, $control_ops ); } /* * Output the HTML for this widget. * * @since 1.0.2 * * @param array $args An array of standard parameters for widgets in this theme. * @param array $instance An array of settings for this widget instance. / public function widget( $args, $instance ) { // Merge with defaults. $instance = wp_parse_args( (array) $instance, $this->defaults ); $args = wp_parse_args( $args, [ 'before_widget' => '', 'after_widget' => '', 'before_title' => '', 'after_title' => '', ] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped echo $args['before_widget']; if ( ! empty( $instance['title'] ) ) { // phpcs:ignore echo $args['before_title'] . apply_filters( 'widget_title', $instance['title'], $instance, $this->id_base ) . $args['after_title']; } if ( ! empty( $instance['form_id'] ) ) { wpforms()->obj( 'frontend' )->output( absint( $instance['form_id'] ), (bool) $instance['show_title'], (bool) $instance['show_desc'] ); } // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped echo $args['after_widget']; } /* * Deal with the settings when they are saved by the admin. Here is * where any validation should be dealt with. * * @since 1.0.2 * * @param array $new_instance An array of new settings as submitted by the admin. * @param array $old_instance An array of the previous settings. * * @return array The validated and (if necessary) amended settings / public function update( $new_instance, $old_instance ) { $new_instance['title'] = wp_strip_all_tags( $new_instance['title'] ); $new_instance['form_id'] = ! empty( $new_instance['form_id'] ) ? (int) $new_instance['form_id'] : 0; $new_instance['show_title'] = isset( $new_instance['show_title'] ) && $new_instance['show_title'] ? '1' : false; $new_instance['show_desc'] = isset( $new_instance['show_desc'] ) && $new_instance['show_desc'] ? '1' : false; return $new_instance; } /* * Display the form for this widget on the Widgets page of the WP Admin area. * * @since 1.0.2 * * @param array $instance An array of the current settings for this widget. / public function form( $instance ) { // Merge with defaults. $instance = wp_parse_args( (array) $instance, $this->defaults ); ?> <p> <label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"> <?php echo esc_html( _x( 'Title:', 'Widget', 'wpforms-lite' ) ); ?> </label> <input type="text" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" value="<?php echo esc_attr( $instance['title'] ); ?>" class="widefat"/> </p> <p> <label for="<?php echo esc_attr( $this->get_field_id( 'form_id' ) ); ?>"> <?php echo esc_html( _x( 'Form:', 'Widget', 'wpforms-lite' ) ); ?> </label> <select class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'form_id' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'form_id' ) ); ?>"> <?php $forms = wpforms()->obj( 'form' )->get(); if ( ! empty( $forms ) ) { echo '<option value="" selected disabled>' . esc_html_x( 'Select your form', 'Widget', 'wpforms-lite' ) . '</option>'; foreach ( $forms as $form ) { echo '<option value="' . esc_attr( $form->ID ) . '" ' . selected( $instance['form_id'], $form->ID, false ) . '>' . esc_html( $form->post_title ) . '</option>'; } } else { echo '<option value="">' . esc_html_x( 'No forms', 'Widget', 'wpforms-lite' ) . '</option>'; } ?> </select> </p> <p> <input type="checkbox" id="<?php echo esc_attr( $this->get_field_id( 'show_title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'show_title' ) ); ?>" <?php checked( '1', $instance['show_title'] ); ?>> <label for="<?php echo esc_attr( $this->get_field_id( 'show_title' ) ); ?>"> <?php echo esc_html( _x( 'Display form name', 'Widget', 'wpforms-lite' ) ); ?> </label> <br> <input type="checkbox" id="<?php echo esc_attr( $this->get_field_id( 'show_desc' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'show_desc' ) ); ?>" <?php checked( '1', $instance['show_desc'] ); ?>> <label for="<?php echo esc_attr( $this->get_field_id( 'show_desc' ) ); ?>"> <?php echo esc_html( _x( 'Display form description', 'Widget', 'wpforms-lite' ) ); ?> </label> </p> <?php } } /* * Register the WPForms widget. * * @since 1.0.2 */ function wpforms_register_widgets() { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks // Hide legacy widget. This filter is available from WP 5.8. // phpcs:disable WPForms.PHP.ValidateHooks.InvalidHookName, WPForms.Comments.PHPDocHooks.RequiredHookDocumentation add_filter( 'widget_types_to_hide_from_legacy_widget_block', static function ( $widget_types ) { $widget_types[] = 'wpforms-widget'; return $widget_types; } ); // phpcs:enable WPForms.PHP.ValidateHooks.InvalidHookName, WPForms.Comments.PHPDocHooks.RequiredHookDocumentation register_widget( 'WPForms_Widget' ); } add_action( 'widgets_init', 'wpforms_register_widgets' );	6 KB	2025-09-23 14:43
📄 deprecated.php <?php // phpcs:ignoreFile Generic.Files.OneObjectStructurePerFile.MultipleFound namespace WPForms { /** * The removed class helps prevent fatal errors for clients * that use some of the classes we are about to remove. * Use the class extending instead of class_alias function. * * @since 1.8.0 / class Removed { /* * List of removed classes in the next format: * Fully Qualified Class Name => version. * * @since 1.8.0 / const CLASSES = [ 'WPForms\Pro\Admin\Entries\DefaultScreen' => '1.8.2', 'WPForms\Pro\Integrations\AI\AI' => '1.9.4', 'WPForms\Pro\Integrations\AI\Helpers' => '1.9.4', 'WPForms_Install_Skin' => '1.9.5', 'WPForms_Install_Silent_Skin' => '1.5.6.1', 'WPForms\Helpers\PluginSilentUpgraderSkin' => '1.9.5', ]; /* * Inform clients that the class is removed. * * @since 1.8.0 / public function __construct() { self::trigger_error(); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $name Property name. / public function __get( $name ) { self::trigger_error( $name ); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $name Property name. * @param mixed $value Property value. / public function __set( $name, $value ) { self::trigger_error( $name ); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $name Property name. / public function __isset( $name ) { self::trigger_error( $name ); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $name Method name. * @param array $arguments List of arguments. / public function __call( $name, $arguments ) { self::trigger_error( $name ); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $name Method name. * @param array $arguments List of arguments. / public static function __callStatic( $name, $arguments ) { self::trigger_error( $name ); } /* * Inform clients that the class is removed. * * @since 1.8.0 * * @param string $element_name Property or method name. / private static function trigger_error( $element_name = '' ) { $current_class = static::class; $removed_element = $current_class; if ( $element_name ) { $removed_element .= '::' . $element_name; } $version = ! empty( self::CLASSES[ $current_class ] ) ? self::CLASSES[ $current_class ] : WPFORMS_VERSION; trigger_error( sprintf( '%1$s has been removed in %2$s of the WPForms plugin', esc_html( $removed_element ), esc_html( $version ) ), E_USER_WARNING ); } } } namespace WPForms\Forms { use WPForms\Removed; class Loader extends Removed {} } namespace { /* * Legacy `WPForms_Addons` class was refactored and moved to the new `WPForms\Pro\Admin\Pages\Addons` class. * This alias is a safeguard to those developers who use our internal class WPForms_Addons, * which we deleted. * * @since 1.6.7 / class_alias( wpforms()->is_pro() ? 'WPForms\Pro\Admin\Pages\Addons' : 'WPForms\Lite\Admin\Pages\Addons', 'WPForms_Addons' ); /* * This alias is a safeguard to those developers who decided to use our internal class WPForms_Smart_Tags, * which we deleted. * * @since 1.6.7 / class_alias( wpforms()->is_pro() ? 'WPForms\Pro\SmartTags\SmartTags' : 'WPForms\SmartTags\SmartTags', 'WPForms_Smart_Tags' ); /* * This alias is a safeguard to those developers who decided to use our internal class \WPForms\Providers\Loader, * which we deleted. * * @since 1.7.3 / class_alias( '\WPForms\Providers\Providers', '\WPForms\Providers\Loader' ); /* * Legacy `\WPForms\Admin\Notifications` class was refactored and moved to the new `\WPForms\Admin\Notifications\Notifications` class. * This alias is a safeguard to those developers who use our internal class \WPForms\Admin\Notifications, * which we deleted. * * @since 1.7.5 / class_alias( '\WPForms\Admin\Notifications\Notifications', '\WPForms\Admin\Notifications' ); /* * Legacy `\WPForms_Field_Payment_Checkbox` class was refactored and moved to the new `\WPForms\Forms\Fields\PaymentCheckbox\Field` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Payment_Checkbox, * which we deleted. * * @since 1.8.2 / class_alias( '\WPForms\Forms\Fields\PaymentCheckbox\Field', '\WPForms_Field_Payment_Checkbox' ); /* * Legacy `\WPForms_Field_Payment_Multiple` class was refactored and moved to the new `\WPForms\Forms\Fields\PaymentMultiple\Field` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Payment_Multiple, * which we deleted. * * @since 1.8.2 / class_alias( '\WPForms\Forms\Fields\PaymentMultiple\Field', '\WPForms_Field_Payment_Multiple' ); /* * Legacy `\WPForms_Field_Payment_Single` class was refactored and moved to the new `\WPForms\Forms\Fields\PaymentSingle\Field` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Payment_Single, * which we deleted. * * @since 1.8.2 / class_alias( '\WPForms\Forms\Fields\PaymentSingle\Field', '\WPForms_Field_Payment_Single' ); /* * Legacy `\WPForms_Field_Payment_Total` class was refactored and moved to the new `\WPForms\Forms\Fields\PaymentTotal\Field` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Payment_Total, * which we deleted. * * @since 1.8.2 / class_alias( '\WPForms\Forms\Fields\PaymentTotal\Field', '\WPForms_Field_Payment_Total' ); /* * Legacy `\WPForms_Field_Payment_Select` class was refactored and moved to the new `\WPForms\Forms\Fields\PaymentSelect\Field` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Payment_Select, * which we deleted. * * @since 1.8.2 / class_alias( '\WPForms\Forms\Fields\PaymentSelect\Field', '\WPForms_Field_Payment_Select' ); /* * Legacy `\WPForms\Migrations` class was refactored and moved to the new `\WPForms\Migrations\Migrations` class. * This alias is a safeguard to those developers who use our internal class \WPForms\Migrations, which we deleted. * * @since 1.7.5 / class_alias( '\WPForms\Migrations\Migrations', '\WPForms\Migrations' ); /* * Legacy `\WPForms_Frontend` class was refactored and moved to the new `\WPForms\Frontend\Frontend` class. * This alias is a safeguard to those developers who use our internal class \WPForms_Frontend, which we deleted. * * @since 1.8.1 / class_alias( '\WPForms\Frontend\Frontend', '\WPForms_Frontend' ); /* * This alias is a safeguard to those developers who use our internal class \WPForms_Overview, which we deleted. * * @since 1.8.6 / class_alias( '\WPForms\Admin\Forms\Page', '\WPForms_Overview' ); /* * This alias is a safeguard to those developers who use our internal class \WPForms_Overview_Table, which we deleted. * * @since 1.8.6 / class_alias( '\WPForms\Admin\Forms\ListTable', '\WPForms_Overview_Table' ); // Pro specific aliases. if ( wpforms()->is_pro() ) { /* * Legacy `\WPForms\Pro\Migrations` class was refactored and moved to the new `\WPForms\Pro\Migrations\Migrations` class. * This alias is a safeguard to those developers who use our internal class \WPForms\Migrations, which we deleted. * * @since 1.7.5 / class_alias( '\WPForms\Pro\Migrations\Migrations', '\WPForms\Pro\Migrations' ); /* * Legacy `\WPForms\Pro\Integrations\TranslationsPress\Translations` class was refactored and moved to the new * `\WPForms\Pro\Integrations\Translations\Translations` class. * This alias is a safeguard to those developers who use our internal class \WPForms\Pro\Integrations\TranslationsPress, which we deleted. * * @since 1.8.2.2 / class_alias( '\WPForms\Pro\Integrations\Translations\Translations', '\WPForms\Pro\Integrations\TranslationsPress\Translations' ); /* * This alias is a safeguard to those developers who use our internal class \WPForms_Entries_List, which we deleted. * * @since 1.8.6 / class_alias( '\WPForms\Pro\Admin\Entries\Page', '\WPForms_Entries_List' ); /* * This alias is a safeguard to those developers who use our internal class \WPForms_Entries_Table, which we deleted. * * @since 1.8.6 / class_alias( '\WPForms\Pro\Admin\Entries\ListTable', '\WPForms_Entries_Table' ); /* * This alias is a safeguard to those developers who use our internal class \WPForms_Field_Layout, which we deleted. * * @since 1.8.9 / class_alias( '\WPForms\Pro\Forms\Fields\Layout\Field', '\WPForms_Field_Layout' ); /* * These aliases are a safeguard to those developers who use our internal legacy field classes, which we deleted. * * @since 1.9.4 / class_alias( '\WPForms\Pro\Forms\Fields\Address\Field', '\WPForms_Field_Address' ); class_alias( '\WPForms\Pro\Forms\Fields\Content\Field', '\WPForms_Field_Content' ); class_alias( '\WPForms\Pro\Forms\Fields\DateTime\Field', '\WPForms_Field_Date_Time' ); class_alias( '\WPForms\Pro\Forms\Fields\Divider\Field', '\WPForms_Field_Divider' ); class_alias( '\WPForms\Pro\Forms\Fields\EntryPreview\Field', '\WPForms_Entry_Preview' ); class_alias( '\WPForms\Pro\Forms\Fields\FileUpload\Field', '\WPForms_Field_File_Upload' ); class_alias( '\WPForms\Pro\Forms\Fields\Hidden\Field', '\WPForms_Field_Hidden' ); class_alias( '\WPForms\Pro\Forms\Fields\Html\Field', '\WPForms_Field_HTML' ); class_alias( '\WPForms\Pro\Forms\Fields\Pagebreak\Field', '\WPForms_Field_Page_Break' ); class_alias( '\WPForms\Pro\Forms\Fields\Password\Field', '\WPForms_Field_Password' ); class_alias( '\WPForms\Pro\Forms\Fields\CreditCard\Field', '\WPForms_Field_CreditCard' ); class_alias( '\WPForms\Pro\Forms\Fields\Phone\Field', '\WPForms_Field_Phone' ); class_alias( '\WPForms\Pro\Forms\Fields\Rating\Field', '\WPForms_Rating_Text' ); class_alias( '\WPForms\Pro\Forms\Fields\Richtext\Field', '\WPForms_Field_Richtext' ); class_alias( '\WPForms\Pro\Forms\Fields\Url\Field', '\WPForms_Field_URL' ); /* * This alias is a safeguard to those developers who use our internal * class \WPForms\Pro\Integrations\AI\API\Forms, which we deleted. * * @since 1.9.4 / class_alias( '\WPForms\Integrations\AI\API\Forms', '\WPForms\Pro\Integrations\AI\API\Forms' ); /* * This alias is a safeguard to those developers who use our internal * class \WPForms\Pro\Integrations\AI\Admin\Ajax\Forms, which we deleted. * * @since 1.9.4 / class_alias( '\WPForms\Integrations\AI\Admin\Ajax\Forms', '\WPForms\Pro\Integrations\AI\Admin\Ajax\Forms' ); /* * This alias is a safeguard to those developers who use our internal * class \WPForms\Pro\Integrations\AI\Admin\Builder\Enqueues, which we deleted. * * @since 1.9.4 / class_alias( '\WPForms\Integrations\AI\Admin\Builder\Forms', '\WPForms\Pro\Integrations\AI\Admin\Builder\Enqueues' ); /* * This alias is a safeguard to those developers who use our internal * class \WPForms\Pro\Integrations\AI\Admin\Pages\Templates, which we deleted. * * @since 1.9.4 / class_alias( '\WPForms\Integrations\AI\Admin\Pages\Templates', '\WPForms\Pro\Integrations\AI\Admin\Pages\Templates' ); } /* * This adds backwards compatibility after scoping the stripe lib and using our own prefix `\WPForms\Vendor\Stripe`. * This alias is a safeguard for the users who update core plugin to 1.8.5 but have an older version of stripe pro addon. * Fire this right before autoloading of legacy classes so that there is no conflict with other stripe libs when aliasing. * * @since 1.8.5 / spl_autoload_register( static function ( $class_name ) { static $stripe_check_done = false; static $aliases = [ '\WPForms\Vendor\Stripe\Charge' => 'Stripe\Charge', '\WPForms\Vendor\Stripe\Customer' => 'Stripe\Customer', '\WPForms\Vendor\Stripe\Subscription' => 'Stripe\Subscription', '\WPForms\Vendor\Stripe\Invoice' => 'Stripe\Invoice', '\WPForms\Vendor\Stripe\Exception\CardException' => 'Stripe\Exception\CardException', '\WPForms\Vendor\Stripe\Source' => 'Stripe\Source', ]; if ( $stripe_check_done ) { return; } // If class not for aliasing, bail. if ( ! in_array( $class_name, $aliases, true ) ) { return; } $stripe_check_done = true; // If no Stripe Pro addon bail. if ( ! defined( 'WPFORMS_STRIPE_VERSION' ) ) { return; } // Version 3.2.0 has prefixed lib. // Versions 2.11.0 and below already have the lib bundled, so they don't require alias. if ( version_compare( WPFORMS_STRIPE_VERSION, '3.2.0', '>=' ) \|\| version_compare( WPFORMS_STRIPE_VERSION, '2.11.0', '<=' ) ) { return; } // We only need to alias if we are using the legacy API version. if ( ! \WPFormsStripe\Helpers::is_legacy_api_version() ) { return; } // If a lib is already loaded by a third party plugin, // checking the CardException class here as a niche to make sure it is the correct library. if ( class_exists( '\Stripe\Exception\CardException', false ) ) { return; } foreach ( $aliases as $prefixed => $alias ) { class_alias( $prefixed, '\\' . $alias ); } } ); } namespace WPForms\Pro\Admin\Entries { /* * The default Entries screen showed a chart and the form entries stats. * Replaced with "WPForms\Pro\Admin\Entries\Overview". * * @since 1.5.5 * @deprecated 1.8.2 */ class DefaultScreen extends \WPForms\Removed {} }	13.61 KB	2025-09-23 14:43
📁 emails	-	2025-09-23 14:43
📁 fields	-	2025-09-23 14:43
📁 functions	-	2025-09-23 14:43
📄 functions-list.php <?php /** * Helper functions to work with multidimensional arrays easier. * * @since 1.5.6 * @since 1.8.0 Moved to /includes/functions/list.php */	152 B	2025-09-23 14:43
📄 functions.php <?php /** * Global functions used in core plugin and addons. * * @since 1.0.0 * @since 1.8.0 Split into multiple files, see `includes/functions/`. */ if ( ! defined( 'ABSPATH' ) ) { exit; } require_once __DIR__ . '/functions/access.php'; require_once __DIR__ . '/functions/builder.php'; require_once __DIR__ . '/functions/checks.php'; require_once __DIR__ . '/functions/colors.php'; require_once __DIR__ . '/functions/data-presets.php'; require_once __DIR__ . '/functions/date-time.php'; require_once __DIR__ . '/functions/debug.php'; require_once __DIR__ . '/functions/education.php'; require_once __DIR__ . '/functions/escape-sanitize.php'; require_once __DIR__ . '/functions/filesystem-media.php'; require_once __DIR__ . '/functions/form-fields.php'; require_once __DIR__ . '/functions/forms.php'; require_once __DIR__ . '/functions/list.php'; require_once __DIR__ . '/functions/payments.php'; require_once __DIR__ . '/functions/plugins.php'; require_once __DIR__ . '/functions/privacy.php'; require_once __DIR__ . '/functions/providers.php'; require_once __DIR__ . '/functions/utilities.php';	1.08 KB	2025-09-23 14:43
📄 integrations.php <?php if ( ! defined( 'ABSPATH' ) ) { exit; } /** * Register and setup WPForms as a Visual Composer element. * * @since 1.3.0 / function wpforms_visual_composer_shortcode() { if ( ! is_user_logged_in() ) { return; } $wpf = wpforms()->obj( 'form' )->get( '', [ 'orderby' => 'title', ] ); if ( ! empty( $wpf ) ) { $forms = [ esc_html__( 'Select a form to display', 'wpforms-lite' ) => '', ]; foreach ( $wpf as $form ) { $forms[ $form->post_title ] = $form->ID; } } else { $forms = [ esc_html__( 'No forms found', 'wpforms-lite' ) => '', ]; } vc_map( [ 'name' => esc_html__( 'WPForms', 'wpforms-lite' ), 'base' => 'wpforms', 'icon' => WPFORMS_PLUGIN_URL . 'assets/images/sullie-vc.png', 'category' => esc_html__( 'Content', 'wpforms-lite' ), 'description' => esc_html__( 'Add your form', 'wpforms-lite' ), 'params' => [ [ 'type' => 'dropdown', 'heading' => esc_html__( 'Form', 'wpforms-lite' ), 'param_name' => 'id', 'value' => $forms, 'save_always' => true, 'description' => esc_html__( 'Select a form to add it to your post or page.', 'wpforms-lite' ), 'admin_label' => true, ], [ 'type' => 'dropdown', 'heading' => esc_html__( 'Display Form Name', 'wpforms-lite' ), 'param_name' => 'title', 'value' => [ esc_html__( 'No', 'wpforms-lite' ) => 'false', esc_html__( 'Yes', 'wpforms-lite' ) => 'true', ], 'save_always' => true, 'description' => esc_html__( 'Would you like to display the forms name?', 'wpforms-lite' ), 'dependency' => [ 'element' => 'id', 'not_empty' => true, ], ], [ 'type' => 'dropdown', 'heading' => esc_html__( 'Display Form Description', 'wpforms-lite' ), 'param_name' => 'description', 'value' => [ esc_html__( 'No', 'wpforms-lite' ) => 'false', esc_html__( 'Yes', 'wpforms-lite' ) => 'true', ], 'save_always' => true, 'description' => esc_html__( 'Would you like to display the form description?', 'wpforms-lite' ), 'dependency' => [ 'element' => 'id', 'not_empty' => true, ], ], ], ] ); } add_action( 'vc_before_init', 'wpforms_visual_composer_shortcode' ); /* * Load our basic CSS when in Visual Composer's frontend editor. * * @since 1.3.0 */ function wpforms_visual_composer_shortcode_css() { // Load CSS per global setting. if ( wpforms_setting( 'disable-css', '1' ) === '1' ) { wp_enqueue_style( 'wpforms-full', WPFORMS_PLUGIN_URL . 'assets/css/frontend/classic/wpforms-full.css', [], WPFORMS_VERSION ); } if ( wpforms_setting( 'disable-css', '1' ) === '2' ) { wp_enqueue_style( 'wpforms-base', WPFORMS_PLUGIN_URL . 'assets/css/frontend/classic/wpforms-base.css', [], WPFORMS_VERSION ); } } add_action( 'vc_load_iframe_jscss', 'wpforms_visual_composer_shortcode_css' );	2.94 KB	2025-09-23 14:43
📁 providers	-	2025-09-23 14:43
📁 templates	-	2025-09-23 14:43

Terminal