Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

/**

[2] Fix | Delete

* Class representing contact form submission.

[3] Fix | Delete

[4] Fix | Delete

class WPCF7_Submission {

[5] Fix | Delete

[6] Fix | Delete

use WPCF7_PocketHolder;

[7] Fix | Delete

[8] Fix | Delete

private static $instance;

[9] Fix | Delete

[10] Fix | Delete

private $contact_form;

[11] Fix | Delete

private $status = 'init';

[12] Fix | Delete

private $posted_data = array();

[13] Fix | Delete

private $posted_data_hash = null;

[14] Fix | Delete

private $skip_spam_check = false;

[15] Fix | Delete

private $uploaded_files = array();

[16] Fix | Delete

private $extra_attachments = array();

[17] Fix | Delete

private $skip_mail = false;

[18] Fix | Delete

private $response = '';

[19] Fix | Delete

private $invalid_fields = array();

[20] Fix | Delete

private $meta = array();

[21] Fix | Delete

private $consent = array();

[22] Fix | Delete

private $spam_log = array();

[23] Fix | Delete

private $result_props = array();

[24] Fix | Delete

[25] Fix | Delete

[26] Fix | Delete

/**

[27] Fix | Delete

* Returns the singleton instance of this class.

[28] Fix | Delete

[29] Fix | Delete

public static function get_instance( $contact_form = null, $options = '' ) {

[30] Fix | Delete

if ( $contact_form instanceof WPCF7_ContactForm ) {

[31] Fix | Delete

if ( empty( self::$instance ) ) {

[32] Fix | Delete

self::$instance = new self( $contact_form, $options );

[33] Fix | Delete

self::$instance->proceed();

[34] Fix | Delete

return self::$instance;

[35] Fix | Delete

} else {

[36] Fix | Delete

return null;

[37] Fix | Delete

}

[38] Fix | Delete

} else {

[39] Fix | Delete

if ( empty( self::$instance ) ) {

[40] Fix | Delete

return null;

[41] Fix | Delete

} else {

[42] Fix | Delete

return self::$instance;

[43] Fix | Delete

}

[44] Fix | Delete

}

[45] Fix | Delete

}

[46] Fix | Delete

[47] Fix | Delete

[48] Fix | Delete

/**

[49] Fix | Delete

* Returns true if this submission is created via WP REST API.

[50] Fix | Delete

[51] Fix | Delete

public static function is_restful() {

[52] Fix | Delete

return defined( 'REST_REQUEST' ) && REST_REQUEST;

[53] Fix | Delete

}

[54] Fix | Delete

[55] Fix | Delete

[56] Fix | Delete

/**

[57] Fix | Delete

* Constructor.

[58] Fix | Delete

[59] Fix | Delete

private function __construct( WPCF7_ContactForm $contact_form, $options = '' ) {

[60] Fix | Delete

$options = wp_parse_args( $options, array(

[61] Fix | Delete

'skip_mail' => false,

[62] Fix | Delete

) );

[63] Fix | Delete

[64] Fix | Delete

$this->contact_form = $contact_form;

[65] Fix | Delete

$this->skip_mail = (bool) $options['skip_mail'];

[66] Fix | Delete

}

[67] Fix | Delete

[68] Fix | Delete

[69] Fix | Delete

/**

[70] Fix | Delete

* Destructor.

[71] Fix | Delete

[72] Fix | Delete

public function __destruct() {

[73] Fix | Delete

$this->remove_uploaded_files();

[74] Fix | Delete

}

[75] Fix | Delete

[76] Fix | Delete

[77] Fix | Delete

/**

[78] Fix | Delete

* The main logic of submission.

[79] Fix | Delete

[80] Fix | Delete

private function proceed() {

[81] Fix | Delete

[82] Fix | Delete

$callback = function () {

[83] Fix | Delete

$contact_form = $this->contact_form;

[84] Fix | Delete

[85] Fix | Delete

$this->setup_meta_data();

[86] Fix | Delete

$this->setup_posted_data();

[87] Fix | Delete

[88] Fix | Delete

if ( $this->is( 'init' ) and ! $this->validate() ) {

[89] Fix | Delete

$this->set_status( 'validation_failed' );

[90] Fix | Delete

$this->set_response( $contact_form->message( 'validation_error' ) );

[91] Fix | Delete

}

[92] Fix | Delete

[93] Fix | Delete

if ( $this->is( 'init' ) and ! $this->accepted() ) {

[94] Fix | Delete

$this->set_status( 'acceptance_missing' );

[95] Fix | Delete

$this->set_response( $contact_form->message( 'accept_terms' ) );

[96] Fix | Delete

}

[97] Fix | Delete

[98] Fix | Delete

if ( $this->is( 'init' ) and $this->spam() ) {

[99] Fix | Delete

$this->set_status( 'spam' );

[100] Fix | Delete

$this->set_response( $contact_form->message( 'spam' ) );

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

if ( $this->is( 'init' ) and ! $this->unship_uploaded_files() ) {

[104] Fix | Delete

$this->set_status( 'validation_failed' );

[105] Fix | Delete

$this->set_response( $contact_form->message( 'validation_error' ) );

[106] Fix | Delete

}

[107] Fix | Delete

[108] Fix | Delete

if ( $this->is( 'init' ) ) {

[109] Fix | Delete

$abort = ! $this->before_send_mail();

[110] Fix | Delete

[111] Fix | Delete

if ( $abort ) {

[112] Fix | Delete

if ( $this->is( 'init' ) ) {

[113] Fix | Delete

$this->set_status( 'aborted' );

[114] Fix | Delete

}

[115] Fix | Delete

[116] Fix | Delete

if ( '' === $this->get_response() ) {

[117] Fix | Delete

$this->set_response( $contact_form->filter_message(

[118] Fix | Delete

__( "Sending mail has been aborted.", 'contact-form-7' ) )

[119] Fix | Delete

);

[120] Fix | Delete

}

[121] Fix | Delete

} elseif ( $this->mail() ) {

[122] Fix | Delete

$this->set_status( 'mail_sent' );

[123] Fix | Delete

$this->set_response( $contact_form->message( 'mail_sent_ok' ) );

[124] Fix | Delete

[125] Fix | Delete

do_action( 'wpcf7_mail_sent', $contact_form );

[126] Fix | Delete

} else {

[127] Fix | Delete

$this->set_status( 'mail_failed' );

[128] Fix | Delete

$this->set_response( $contact_form->message( 'mail_sent_ng' ) );

[129] Fix | Delete

[130] Fix | Delete

do_action( 'wpcf7_mail_failed', $contact_form );

[131] Fix | Delete

}

[132] Fix | Delete

}

[133] Fix | Delete

};

[134] Fix | Delete

[135] Fix | Delete

wpcf7_switch_locale( $this->contact_form->locale(), $callback );

[136] Fix | Delete

}

[137] Fix | Delete

[138] Fix | Delete

[139] Fix | Delete

/**

[140] Fix | Delete

* Returns the current status property.

[141] Fix | Delete

[142] Fix | Delete

public function get_status() {

[143] Fix | Delete

return $this->status;

[144] Fix | Delete

}

[145] Fix | Delete

[146] Fix | Delete

[147] Fix | Delete

/**

[148] Fix | Delete

* Sets the status property.

[149] Fix | Delete

[150] Fix | Delete

* @param string $status The status.

[151] Fix | Delete

[152] Fix | Delete

public function set_status( $status ) {

[153] Fix | Delete

if ( preg_match( '/^[a-z][0-9a-z_]+$/', $status ) ) {

[154] Fix | Delete

$this->status = $status;

[155] Fix | Delete

return true;

[156] Fix | Delete

}

[157] Fix | Delete

[158] Fix | Delete

return false;

[159] Fix | Delete

}

[160] Fix | Delete

[161] Fix | Delete

[162] Fix | Delete

/**

[163] Fix | Delete

* Returns true if the specified status is identical to the current

[164] Fix | Delete

* status property.

[165] Fix | Delete

[166] Fix | Delete

* @param string $status The status to compare.

[167] Fix | Delete

[168] Fix | Delete

public function is( $status ) {

[169] Fix | Delete

return $this->status === $status;

[170] Fix | Delete

}

[171] Fix | Delete

[172] Fix | Delete

[173] Fix | Delete

/**

[174] Fix | Delete

* Returns an associative array of submission result properties.

[175] Fix | Delete

[176] Fix | Delete

* @return array Submission result properties.

[177] Fix | Delete

[178] Fix | Delete

public function get_result() {

[179] Fix | Delete

$result = array_merge( $this->result_props, array(

[180] Fix | Delete

'status' => $this->get_status(),

[181] Fix | Delete

'message' => $this->get_response(),

[182] Fix | Delete

) );

[183] Fix | Delete

[184] Fix | Delete

if ( $this->is( 'validation_failed' ) ) {

[185] Fix | Delete

$result['invalid_fields'] = $this->get_invalid_fields();

[186] Fix | Delete

}

[187] Fix | Delete

[188] Fix | Delete

switch ( $this->get_status() ) {

[189] Fix | Delete

case 'init':

[190] Fix | Delete

case 'validation_failed':

[191] Fix | Delete

case 'acceptance_missing':

[192] Fix | Delete

case 'spam':

[193] Fix | Delete

$result['posted_data_hash'] = '';

[194] Fix | Delete

break;

[195] Fix | Delete

default:

[196] Fix | Delete

$result['posted_data_hash'] = $this->get_posted_data_hash();

[197] Fix | Delete

break;

[198] Fix | Delete

}

[199] Fix | Delete

[200] Fix | Delete

$result = apply_filters( 'wpcf7_submission_result', $result, $this );

[201] Fix | Delete

[202] Fix | Delete

return $result;

[203] Fix | Delete

}

[204] Fix | Delete

[205] Fix | Delete

[206] Fix | Delete

/**

[207] Fix | Delete

* Adds items to the array of submission result properties.

[208] Fix | Delete

[209] Fix | Delete

* @param string|array|object $data Value to add to result properties.

[210] Fix | Delete

* @return array Added result properties.

[211] Fix | Delete

[212] Fix | Delete

public function add_result_props( $data = '' ) {

[213] Fix | Delete

$data = wp_parse_args( $data, array() );

[214] Fix | Delete

[215] Fix | Delete

$this->result_props = array_merge( $this->result_props, $data );

[216] Fix | Delete

[217] Fix | Delete

return $data;

[218] Fix | Delete

}

[219] Fix | Delete

[220] Fix | Delete

[221] Fix | Delete

/**

[222] Fix | Delete

* Retrieves the response property.

[223] Fix | Delete

[224] Fix | Delete

* @return string The current response property value.

[225] Fix | Delete

[226] Fix | Delete

public function get_response() {

[227] Fix | Delete

return $this->response;

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

[231] Fix | Delete

/**

[232] Fix | Delete

* Sets the response property.

[233] Fix | Delete

[234] Fix | Delete

* @param string $response New response property value.

[235] Fix | Delete

[236] Fix | Delete

public function set_response( $response ) {

[237] Fix | Delete

$this->response = $response;

[238] Fix | Delete

return true;

[239] Fix | Delete

}

[240] Fix | Delete

[241] Fix | Delete

[242] Fix | Delete

/**

[243] Fix | Delete

* Retrieves the contact form property.

[244] Fix | Delete

[245] Fix | Delete

* @return WPCF7_ContactForm A contact form object.

[246] Fix | Delete

[247] Fix | Delete

public function get_contact_form() {

[248] Fix | Delete

return $this->contact_form;

[249] Fix | Delete

}

[250] Fix | Delete

[251] Fix | Delete

[252] Fix | Delete

/**

[253] Fix | Delete

* Search an invalid field by field name.

[254] Fix | Delete

[255] Fix | Delete

* @param string $name The field name.

[256] Fix | Delete

* @return array|bool An associative array of validation error

[257] Fix | Delete

* or false when no invalid field.

[258] Fix | Delete

[259] Fix | Delete

public function get_invalid_field( $name ) {

[260] Fix | Delete

return $this->invalid_fields[$name] ?? false;

[261] Fix | Delete

}

[262] Fix | Delete

[263] Fix | Delete

[264] Fix | Delete

/**

[265] Fix | Delete

* Retrieves all invalid fields.

[266] Fix | Delete

[267] Fix | Delete

* @return array Invalid fields.

[268] Fix | Delete

[269] Fix | Delete

public function get_invalid_fields() {

[270] Fix | Delete

return $this->invalid_fields;

[271] Fix | Delete

}

[272] Fix | Delete

[273] Fix | Delete

[274] Fix | Delete

/**

[275] Fix | Delete

* Retrieves meta information.

[276] Fix | Delete

[277] Fix | Delete

* @param string $name Name of the meta information.

[278] Fix | Delete

* @return string|null The meta information of the given name if it exists,

[279] Fix | Delete

* null otherwise.

[280] Fix | Delete

[281] Fix | Delete

public function get_meta( $name ) {

[282] Fix | Delete

return $this->meta[$name] ?? null;

[283] Fix | Delete

}

[284] Fix | Delete

[285] Fix | Delete

[286] Fix | Delete

/**

[287] Fix | Delete

* Collects meta information about this submission.

[288] Fix | Delete

[289] Fix | Delete

private function setup_meta_data() {

[290] Fix | Delete

$this->meta = array(

[291] Fix | Delete

'timestamp' => time(),

[292] Fix | Delete

'remote_ip' => $this->get_remote_ip_addr(),

[293] Fix | Delete

'remote_port' => $_SERVER['REMOTE_PORT'] ?? '',

[294] Fix | Delete

'user_agent' => substr( $_SERVER['HTTP_USER_AGENT'] ?? '', 0, 254 ),

[295] Fix | Delete

'url' => $this->get_request_url(),

[296] Fix | Delete

'unit_tag' => wpcf7_sanitize_unit_tag( $_POST['_wpcf7_unit_tag'] ?? '' ),

[297] Fix | Delete

'container_post_id' => absint( $_POST['_wpcf7_container_post'] ?? 0 ),

[298] Fix | Delete

'current_user_id' => get_current_user_id(),

[299] Fix | Delete

'do_not_store' => $this->contact_form->is_true( 'do_not_store' ),

[300] Fix | Delete

);

[301] Fix | Delete

[302] Fix | Delete

return $this->meta;

[303] Fix | Delete

}

[304] Fix | Delete

[305] Fix | Delete

[306] Fix | Delete

/**

[307] Fix | Delete

* Retrieves user input data through this submission.

[308] Fix | Delete

[309] Fix | Delete

* @param string $name Optional field name.

[310] Fix | Delete

* @return string|array|null The user input of the field, or array of all

[311] Fix | Delete

* fields values if no field name specified.

[312] Fix | Delete

[313] Fix | Delete

public function get_posted_data( $name = '' ) {

[314] Fix | Delete

if ( ! empty( $name ) ) {

[315] Fix | Delete

return $this->posted_data[$name] ?? null;

[316] Fix | Delete

}

[317] Fix | Delete

[318] Fix | Delete

return $this->posted_data;

[319] Fix | Delete

}

[320] Fix | Delete

[321] Fix | Delete

[322] Fix | Delete

/**

[323] Fix | Delete

* Retrieves a user input string value through the specified field.

[324] Fix | Delete

[325] Fix | Delete

* @param string $name Field name.

[326] Fix | Delete

* @return string The user input. If the input is an array,

[327] Fix | Delete

* the first item in the array.

[328] Fix | Delete

[329] Fix | Delete

public function get_posted_string( $name ) {

[330] Fix | Delete

$data = $this->get_posted_data( $name );

[331] Fix | Delete

$data = wpcf7_array_flatten( $data );

[332] Fix | Delete

[333] Fix | Delete

if ( empty( $data ) ) {

[334] Fix | Delete

return '';

[335] Fix | Delete

}

[336] Fix | Delete

[337] Fix | Delete

// Returns the first array item.

[338] Fix | Delete

return trim( reset( $data ) );

[339] Fix | Delete

}

[340] Fix | Delete

[341] Fix | Delete

[342] Fix | Delete

/**

[343] Fix | Delete

* Constructs posted data property based on user input values.

[344] Fix | Delete

[345] Fix | Delete

private function setup_posted_data() {

[346] Fix | Delete

$posted_data = array_filter(

[347] Fix | Delete

(array) $_POST,

[348] Fix | Delete

static function ( $key ) {

[349] Fix | Delete

return ! str_starts_with( $key, '_' );

[350] Fix | Delete

[351] Fix | Delete

ARRAY_FILTER_USE_KEY

[352] Fix | Delete

);

[353] Fix | Delete

[354] Fix | Delete

$posted_data = wp_unslash( $posted_data );

[355] Fix | Delete

$posted_data = $this->sanitize_posted_data( $posted_data );

[356] Fix | Delete

[357] Fix | Delete

$tags = $this->contact_form->scan_form_tags( array(

[358] Fix | Delete

'feature' => array(

[359] Fix | Delete

'name-attr',

[360] Fix | Delete

'! not-for-mail',

[361] Fix | Delete

[362] Fix | Delete

) );

[363] Fix | Delete

[364] Fix | Delete

$tags = array_reduce( $tags, static function ( $carry, $tag ) {

[365] Fix | Delete

if ( $tag->name and ! isset( $carry[$tag->name] ) ) {

[366] Fix | Delete

$carry[$tag->name] = $tag;

[367] Fix | Delete

}

[368] Fix | Delete

[369] Fix | Delete

return $carry;

[370] Fix | Delete

}, array() );

[371] Fix | Delete

[372] Fix | Delete

foreach ( $tags as $tag ) {

[373] Fix | Delete

$value_orig = $value = $posted_data[$tag->name] ?? '';

[374] Fix | Delete

[375] Fix | Delete

if ( wpcf7_form_tag_supports( $tag->type, 'selectable-values' ) ) {

[376] Fix | Delete

$value = ( '' === $value ) ? array() : (array) $value;

[377] Fix | Delete

[378] Fix | Delete

if ( WPCF7_USE_PIPE ) {

[379] Fix | Delete

$pipes = $this->contact_form->get_pipes( $tag->name );

[380] Fix | Delete

[381] Fix | Delete

$value = array_map( static function ( $value ) use ( $pipes ) {

[382] Fix | Delete

return $pipes->do_pipe( $value );

[383] Fix | Delete

}, $value );

[384] Fix | Delete

}

[385] Fix | Delete

}

[386] Fix | Delete

[387] Fix | Delete

$value = apply_filters( "wpcf7_posted_data_{$tag->type}",

[388] Fix | Delete

$value,

[389] Fix | Delete

$value_orig,

[390] Fix | Delete

$tag

[391] Fix | Delete

);

[392] Fix | Delete

[393] Fix | Delete

$posted_data[$tag->name] = $value;

[394] Fix | Delete

[395] Fix | Delete

if ( $tag->has_option( 'consent_for:storage' ) and empty( $value ) ) {

[396] Fix | Delete

$this->meta['do_not_store'] = true;

[397] Fix | Delete

}

[398] Fix | Delete

}

[399] Fix | Delete

[400] Fix | Delete

$this->posted_data = apply_filters( 'wpcf7_posted_data', $posted_data );

[401] Fix | Delete

[402] Fix | Delete

$this->posted_data_hash = $this->create_posted_data_hash();

[403] Fix | Delete

[404] Fix | Delete

return $this->posted_data;

[405] Fix | Delete

}

[406] Fix | Delete

[407] Fix | Delete

[408] Fix | Delete

/**

[409] Fix | Delete

* Sanitizes user input data.

[410] Fix | Delete

[411] Fix | Delete

private function sanitize_posted_data( $value ) {

[412] Fix | Delete

if ( is_array( $value ) ) {

[413] Fix | Delete

$value = array_map( array( $this, 'sanitize_posted_data' ), $value );

[414] Fix | Delete

} elseif ( is_string( $value ) ) {

[415] Fix | Delete

$value = wp_check_invalid_utf8( $value );

[416] Fix | Delete

$value = wp_kses_no_null( $value );

[417] Fix | Delete

}

[418] Fix | Delete

[419] Fix | Delete

return $value;

[420] Fix | Delete

}

[421] Fix | Delete

[422] Fix | Delete

[423] Fix | Delete

/**

[424] Fix | Delete

* Returns the time-dependent variable for hash creation.

[425] Fix | Delete

[426] Fix | Delete

* @return float Float value rounded up to the next highest integer.

[427] Fix | Delete

[428] Fix | Delete

private function posted_data_hash_tick() {

[429] Fix | Delete

return ceil( time() / ( HOUR_IN_SECONDS / 2 ) );

[430] Fix | Delete

}

[431] Fix | Delete

[432] Fix | Delete

[433] Fix | Delete

/**

[434] Fix | Delete

* Creates a hash string based on posted data, the remote IP address,

[435] Fix | Delete

* contact form location, and window of time.

[436] Fix | Delete

[437] Fix | Delete

* @param string $tick Optional. If not specified, result of

[438] Fix | Delete

* posted_data_hash_tick() will be used.

[439] Fix | Delete

* @return string The hash.

[440] Fix | Delete

[441] Fix | Delete

private function create_posted_data_hash( $tick = '' ) {

[442] Fix | Delete

if ( '' === $tick ) {

[443] Fix | Delete

$tick = $this->posted_data_hash_tick();

[444] Fix | Delete

}

[445] Fix | Delete

[446] Fix | Delete

$hash = wp_hash(

[447] Fix | Delete

wpcf7_flat_join( array_merge(

[448] Fix | Delete

array(

[449] Fix | Delete

$tick,

[450] Fix | Delete

$this->get_meta( 'remote_ip' ),

[451] Fix | Delete

$this->get_meta( 'unit_tag' ),

[452] Fix | Delete

[453] Fix | Delete

$this->posted_data

[454] Fix | Delete

) ),

[455] Fix | Delete

'wpcf7_submission'

[456] Fix | Delete

);

[457] Fix | Delete

[458] Fix | Delete

return $hash;

[459] Fix | Delete

}

[460] Fix | Delete

[461] Fix | Delete

[462] Fix | Delete

/**

[463] Fix | Delete

* Returns the hash string created for this submission.

[464] Fix | Delete

[465] Fix | Delete

* @return string The current hash for the submission.

[466] Fix | Delete

[467] Fix | Delete

public function get_posted_data_hash() {

[468] Fix | Delete

return $this->posted_data_hash;

[469] Fix | Delete

}

[470] Fix | Delete

[471] Fix | Delete

[472] Fix | Delete

/**

[473] Fix | Delete

* Verifies that the given string is equivalent to the posted data hash.

[474] Fix | Delete

[475] Fix | Delete

* @param string $hash Optional. This value will be compared to the

[476] Fix | Delete

* current posted data hash for the submission. If not

[477] Fix | Delete

* specified, the value of $_POST['_wpcf7_posted_data_hash']

[478] Fix | Delete

* will be used.

[479] Fix | Delete

* @return int|bool 1 if $hash is created 0-30 minutes ago,

[480] Fix | Delete

* 2 if $hash is created 30-60 minutes ago,

[481] Fix | Delete

* false if $hash is invalid.

[482] Fix | Delete

[483] Fix | Delete

public function verify_posted_data_hash( $hash = '' ) {

[484] Fix | Delete

if ( '' === $hash and ! empty( $_POST['_wpcf7_posted_data_hash'] ) ) {

[485] Fix | Delete

$hash = trim( $_POST['_wpcf7_posted_data_hash'] );

[486] Fix | Delete

}

[487] Fix | Delete

[488] Fix | Delete

if ( '' === $hash ) {

[489] Fix | Delete

return false;

[490] Fix | Delete

}

[491] Fix | Delete

[492] Fix | Delete

$tick = $this->posted_data_hash_tick();

[493] Fix | Delete

[494] Fix | Delete

// Hash created 0-30 minutes ago.

[495] Fix | Delete

$expected_1 = $this->create_posted_data_hash( $tick );

[496] Fix | Delete

[497] Fix | Delete

if ( hash_equals( $expected_1, $hash ) ) {

[498] Fix | Delete

return 1;

[499] Fix | Delete