JezK

Edit File: AntiSpam.php

<?php

namespace WPForms\Forms;

/**
 * Class Anti-Spam v3.
 *
 * This class is used for modern Anti-Spam approach.
 *
 * @since 1.9.0
 */
class AntiSpam {

/**
	 * Field ID to insert the honeypot field before.
	 *
	 * @since 1.9.0
	 *
	 * @var int
	 */
	private $insert_before_field_id = 1;

/**
	 * Array with IDs of all honeypot fields on the current page grouped by form IDs ([form_id => field_id]).
	 *
	 * @since 1.9.0.3
	 *
	 * @var array
	 */
	private $forms_data = [];

/**
	 * Initialise the actions for the modern Anti-Spam.
	 *
	 * @since 1.9.0
	 */
	public function init() {

$this->hooks();
	}

/**
	 * Register hooks.
	 *
	 * @since 1.9.0
	 */
	private function hooks() {

// Frontend hooks.
		add_filter( 'wpforms_frontend_strings', [ $this, 'add_frontend_strings' ] );
		add_filter( 'wpforms_frontend_fields_base_level', [ $this, 'get_random_field' ], 20 );
		add_action( 'wpforms_display_field_before', [ $this, 'maybe_insert_honeypot_field' ], 1, 2 );
		add_action( 'wpforms_display_fields_after', [ $this, 'maybe_insert_honeypot_init_js' ] );

// Builder hooks.
		add_filter( 'wpforms_builder_panel_settings_init_form_data', [ $this, 'init_builder_settings_form_data' ] );
		add_filter( 'wpforms_admin_builder_templates_apply_to_new_form_modify_data', [ $this, 'update_template_form_data' ] );
		add_filter( 'wpforms_admin_builder_templates_apply_to_existing_form_modify_data', [ $this, 'update_template_form_data' ] );
		add_filter( 'wpforms_templates_class_base_template_modify_data', [ $this, 'update_template_form_data' ] );
		add_filter( 'wpforms_templates_class_base_template_replace_modify_data', [ $this, 'update_template_form_data' ] );
		add_filter( 'wpforms_form_handler_convert_form_data', [ $this, 'update_template_form_data' ] );
	}

/**
	 * Store a random field id to insert a honeypot field later.
	 *
	 * @since 1.9.0
	 *
	 * @param array|mixed $fields_data Form fields data.
	 *
	 * @return array|mixed Form fields data.
	 */
	public function get_random_field( $fields_data ) {

if ( ! is_array( $fields_data ) ) {
			return $fields_data;
		}

$random_field_id = array_rand( $fields_data );

if ( ! empty( $random_field_id ) ) {
			$this->insert_before_field_id = $random_field_id;
		}

return $fields_data;
	}

/**
	 * Insert honeypot field before a random field.
	 *
	 * @since 1.9.0
	 *
	 * @param array $field     Field.
	 * @param array $form_data Form data.
	 */
	public function maybe_insert_honeypot_field( array $field, array $form_data ) {

if (
			$this->insert_before_field_id !== (int) $field['id'] ||
			! $this->is_honeypot_enabled( $form_data )
		) {
			return;
		}

$honeypot_field_id            = $this->get_honeypot_field_id( $form_data );
		$form_id                      = (int) $form_data['id'];
		$label                        = $this->get_honeypot_label( $form_data );
		$id_attr                      = sprintf( 'wpforms-%1$s-field_%2$s', $form_id, $honeypot_field_id );
		$is_amp                       = wpforms_is_amp();
		$this->forms_data[ $form_id ] = $honeypot_field_id;

if ( $is_amp ) {
			echo '<amp-layout layout="nodisplay">';
		}

?>
		<div id="<?php echo esc_attr( $id_attr ); ?>-container"
			class="wpforms-field wpforms-field-text"
			data-field-type="text"
			data-field-id="<?php echo esc_attr( $honeypot_field_id ); ?>"
			>
			<label class="wpforms-field-label" for="<?php echo esc_attr( $id_attr ); ?>" ><?php echo esc_html( $label ); ?></label>
			<input type="text" id="<?php echo esc_attr( $id_attr ); ?>" class="wpforms-field-medium" name="wpforms[fields][<?php echo esc_attr( $honeypot_field_id ); ?>]" >
		</div>
		<?php

if ( $is_amp ) {
			echo '</amp-layout>';
		}
	}

/**
	 * Insert the inline styles.
	 *
	 * @since 1.9.0
	 *
	 * @param array $form_data Form data.
	 *
	 * @noinspection PhpUnusedParameterInspection
	 */
	public function maybe_insert_honeypot_init_js( array $form_data ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found

if (
			! $this->forms_data ||
			wpforms_is_amp()
		) {
			return;
		}

$ids = [];

foreach ( $this->forms_data as $form_id => $honeypot_field_id ) {
			$ids[] = sprintf(
				'#wpforms-%1$d-field_%2$d-container',
				$form_id,
				$honeypot_field_id
			);
		}

if ( ! $ids ) {
			return;
		}

$styles = sprintf(
			'%1$s { position: absolute !important; overflow: hidden !important; display: inline !important; height: 1px !important; width: 1px !important; z-index: -1000 !important; padding: 0 !important; } %1$s input { visibility: hidden; } #wpforms-conversational-form-page %1$s label { counter-increment: none; }',
			esc_attr( implode( ',', $ids ) )
		);

// There must be no empty lines inside the script. Otherwise, wpautop adds <p> tags which break script execution.
		printf(
			"<script>
				( function() {
					const style = document.createElement( 'style' );
					style.appendChild( document.createTextNode( '%s' ) );
					document.head.appendChild( style );
					document.currentScript?.remove();
				} )();
			</script>",
			esc_js( $styles )
		);
	}

/**
	 * Get honeypot field label.
	 *
	 * @since 1.9.0
	 *
	 * @param array $form_data Form data.
	 */
	private function get_honeypot_label( array $form_data ): string {

$labels = [];

foreach ( $form_data['fields'] ?? [] as $field ) {
			if ( ! empty( $field['label'] ) ) {
				$labels[] = $field['label'];
			}
		}

$words       = explode( ' ', implode( ' ', $labels ) );
		$count_words = count( $words );
		$label_keys  = (array) array_rand( $words, min( $count_words, 3 ) );

shuffle( $label_keys );

$label_words = array_map(
			static function ( $key ) use ( $words ) {

return $words[ $key ];
			},
			$label_keys
		);

return implode( ' ', $label_words );
	}

/**
	 * Add strings to the frontend.
	 *
	 * @since 1.9.0
	 *
	 * @param array|mixed $strings Frontend strings.
	 *
	 * @return array Frontend strings.
	 */
	public function add_frontend_strings( $strings ): array {

$strings = (array) $strings;

// Store the honeypot field ID for validation and adding inline styles.
		$strings['hn_data'] = $this->forms_data;

return $strings;
	}

/**
	 * Validate whether the modern Anti-Spam is enabled.
	 *
	 * @since 1.9.0
	 *
	 * @param array $form_data Form data.
	 * @param array $fields    Fields.
	 * @param array $entry     Form submission raw data ($_POST).
	 *
	 * @return bool True if the entry is valid, false otherwise.
	 * @noinspection PhpUnusedParameterInspection
	 */
	public function validate( array $form_data, array $fields, array &$entry ): bool {

// Bail out if the modern Anti-Spam is not enabled.
		if ( ! $this->is_honeypot_enabled( $form_data ) ) {
			return true;
		}

$honeypot_fields = array_diff_key( $entry['fields'], $form_data['fields'] );
		$is_valid        = true;

// Compatibility with the WPML plugin (WPFML addon).
		// In case the form contains an Entry Preview field, they add an extra field with ID 0 to the entry.
		if (
			isset( $entry['fields'][0] ) &&
			defined( 'WPML_WP_FORMS_VERSION' ) &&
			wpforms_has_field_type( 'entry-preview', $form_data )
		) {
			unset( $honeypot_fields[0] );
		}

foreach ( $honeypot_fields as $key => $honeypot_field ) {
			// Remove the honeypot field from the entry.
			unset( $entry['fields'][ $key ] );

// If the honeypot field is not empty, the entry is invalid.
			if ( ! empty( $honeypot_field ) ) {
				$is_valid = false;
			}
		}

return $is_valid;
	}

/**
	 * Check if the modern Anti-Spam is enabled.
	 *
	 * @since 1.9.0
	 *
	 * @param array $form_data Form data.
	 *
	 * @return bool True if the modern Anti-Spam is enabled, false otherwise.
	 */
	private function is_honeypot_enabled( array $form_data ): bool {

static $is_enabled;

if ( isset( $is_enabled ) ) {
			return $is_enabled;
		}

/**
		 * Filters whether the modern Anti-Spam is enabled.
		 *
		 * @since 1.9.0
		 *
		 * @param bool $is_enabled True if the modern Anti-Spam is enabled, false otherwise.
		 */
		$is_enabled = (bool) apply_filters( 'wpforms_forms_anti_spam_v3_is_honeypot_enabled', ! empty( $form_data['settings']['antispam_v3'] ) );

return $is_enabled;
	}

/**
	 * Get the honeypot field ID.
	 *
	 * @since 1.9.0
	 *
	 * @param array $form_data Form data.
	 *
	 * @return int Honeypot field ID.
	 */
	private function get_honeypot_field_id( array $form_data ): int {

$max_key = max( array_keys( $form_data['fields'] ) );

// Find the first available field ID.
		for ( $i = 1; $i <= $max_key; $i++ ) {
			if ( ! isset( $form_data['fields'][ $i ] ) ) {
				return $i;
			}
		}

// If no available field ID found, use the max ID + 1.
		return $max_key + 1;
	}

/**
	 * Update the form data on the builder settings panel.
	 *
	 * @since 1.9.0
	 *
	 * @param array|bool $form_data Form data.
	 *
	 * @return array|bool
	 */
	public function init_builder_settings_form_data( $form_data ) {

if ( ! $form_data ) {
			return $form_data;
		}

// Update default time limit duration for the existing form.
		if ( empty( $form_data['settings']['anti_spam']['time_limit']['enable'] ) ) {
			$form_data['settings']['anti_spam']['time_limit']['duration'] = '2';
		}

return $form_data;
	}

/**
	 * Update the template form data. Set the modern Anti-Spam setting.
	 *
	 * @since 1.9.0
	 *
	 * @param array|mixed $form_data Form data.
	 *
	 * @return array
	 */
	public function update_template_form_data( $form_data ): array {

$form_data = (array) $form_data;

// Unset the old Anti-Spam setting.
		unset( $form_data['settings']['antispam'] );

// Enable the modern Anti-Spam setting.
		$form_data['settings']['antispam_v3'] = $form_data['settings']['antispam_v3'] ?? '1';
		$form_data['settings']['anti_spam']   = $form_data['settings']['anti_spam'] ?? [];

// Enable the time limit setting.
		$form_data['settings']['anti_spam']['time_limit'] = [
			'enable'   => '1',
			'duration' => '2',
		];

return $form_data;
	}
}