is_use_csrf() ) { return $html; } return ( $html . Csrf_Tools::get_field() ); } /** * @param array $request * * @return array * @throws Spam_Exception */ public function handle_request( array $request ): array { if ( ! jet_fb_live_args()->is_use_csrf() ) { return $request; } $this->token = $request[ Csrf_Tools::FIELD ] ?? false; $this->client = Csrf_Tools::client_id( jet_fb_live()->form_id ); // delete all old tokens Csrf_Token_Model::clear(); if ( ! Csrf_Tools::verify( $this->token, $this->client ) ) { // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped throw new Spam_Exception( self::SPAM_EXCEPTION ); } // delete verified token only on success add_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ) ); return $request; } public function handle_after_send() { if ( ! jet_fb_handler()->is_success ) { return; } Csrf_Tools::delete( $this->token, $this->client ); } public function handle_messages( array $messages ): array { $messages[ self::SPAM_EXCEPTION ] = array( 'label' => __( 'CSRF token validation failed', 'jet-form-builder' ), 'value' => __( 'Invalid token', 'jet-form-builder' ), ); return $messages; } }