From 84434c7761235107068bf8c2fe159e613523d9f1 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 08:44:26 -0600 Subject: [PATCH 01/11] Add failing tests for array input to phone validation and request sanitizing --- tests/phpunit/entries/test_FrmEntryValidate.php | 17 +++++++++++++++++ tests/phpunit/misc/test_FrmAppHelper.php | 11 +++++++++++ 2 files changed, 28 insertions(+) diff --git a/tests/phpunit/entries/test_FrmEntryValidate.php b/tests/phpunit/entries/test_FrmEntryValidate.php index 5a39c3b176..715c18687e 100644 --- a/tests/phpunit/entries/test_FrmEntryValidate.php +++ b/tests/phpunit/entries/test_FrmEntryValidate.php @@ -37,6 +37,23 @@ public function test_validate() { * * @covers FrmEntryValidate::validate */ + /** + * @covers FrmEntryValidate::validate_phone_field + */ + public function test_validate_phone_field_rejects_array_value() { + $field = $this->factory->field->create_and_get( + array( + 'type' => 'phone', + 'form_id' => $this->factory->form->create(), + ) + ); + $errors = array(); + + FrmEntryValidate::validate_phone_field( $errors, $field, array( 'x' ), array( 'id' => $field->id ) ); + + $this->assertArrayHasKey( 'field' . $field->id, $errors ); + } + public function test_pre_validate_entry_filter() { $form_id = $this->factory->form->create(); $field_id = $this->factory->field->create( diff --git a/tests/phpunit/misc/test_FrmAppHelper.php b/tests/phpunit/misc/test_FrmAppHelper.php index 84d0864862..5e4d6b9085 100644 --- a/tests/phpunit/misc/test_FrmAppHelper.php +++ b/tests/phpunit/misc/test_FrmAppHelper.php @@ -251,6 +251,17 @@ public function test_sanitize_request() { $this->assertSame( $values['content'], wp_kses_post( $values['content'] ) ); } + /** + * @covers FrmAppHelper::sanitize_request + */ + public function test_sanitize_request_ignores_array_value() { + $values = array( 'frm_action' => array( 'x' ) ); + + FrmAppHelper::sanitize_request( array( 'frm_action' => 'sanitize_title' ), $values ); + + $this->assertSame( '', $values['frm_action'] ); + } + public function test_kses() { $start_value = ''; $safe_value = 'Hello, click here'; From 896f2a868b7cdfb77f21c0776c1a153c33e72c95 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 08:44:36 -0600 Subject: [PATCH 02/11] Place phone test before the next test's docblock --- tests/phpunit/entries/test_FrmEntryValidate.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/phpunit/entries/test_FrmEntryValidate.php b/tests/phpunit/entries/test_FrmEntryValidate.php index 715c18687e..ae38a3d6d1 100644 --- a/tests/phpunit/entries/test_FrmEntryValidate.php +++ b/tests/phpunit/entries/test_FrmEntryValidate.php @@ -32,11 +32,6 @@ public function test_validate() { remove_filter( 'frm_validate_entry', $add_a_custom_error ); } - /** - * @since 7.0 - * - * @covers FrmEntryValidate::validate - */ /** * @covers FrmEntryValidate::validate_phone_field */ @@ -54,6 +49,11 @@ public function test_validate_phone_field_rejects_array_value() { $this->assertArrayHasKey( 'field' . $field->id, $errors ); } + /** + * @since 7.0 + * + * @covers FrmEntryValidate::validate + */ public function test_pre_validate_entry_filter() { $form_id = $this->factory->form->create(); $field_id = $this->factory->field->create( From cc4ead280b2c3982f90a9c4d7015c818ed51f2d8 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 08:48:35 -0600 Subject: [PATCH 03/11] Handle array input in phone validation and request sanitizing --- classes/helpers/FrmAppHelper.php | 2 +- classes/models/FrmEntryValidate.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/classes/helpers/FrmAppHelper.php b/classes/helpers/FrmAppHelper.php index fa9234fec0..d2f1351c36 100644 --- a/classes/helpers/FrmAppHelper.php +++ b/classes/helpers/FrmAppHelper.php @@ -929,7 +929,7 @@ public static function sanitize_request( $sanitize_method, &$values ) { foreach ( $temp_values as $k => $val ) { if ( isset( $sanitize_method[ $k ] ) ) { - $values[ $k ] = call_user_func( $sanitize_method[ $k ], $val ); + $values[ $k ] = is_array( $val ) ? '' : call_user_func( $sanitize_method[ $k ], $val ); } } } diff --git a/classes/models/FrmEntryValidate.php b/classes/models/FrmEntryValidate.php index 4172b40080..1ed176bb1f 100644 --- a/classes/models/FrmEntryValidate.php +++ b/classes/models/FrmEntryValidate.php @@ -494,7 +494,7 @@ public static function validate_phone_field( &$errors, $field, $value, $args ) { $pattern = self::phone_format( $field ); - if ( ! preg_match( $pattern, $value ) ) { + if ( is_array( $value ) || ! preg_match( $pattern, $value ) ) { $errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $field, 'invalid' ); } } From 65775a3a5e32d2882b61d946ad4a3766eaf4f9cd Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 08:55:27 -0600 Subject: [PATCH 04/11] Fix PHPCS and PHP CS Fixer findings --- classes/models/FrmEntryValidate.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/classes/models/FrmEntryValidate.php b/classes/models/FrmEntryValidate.php index 1ed176bb1f..c474f55a9b 100644 --- a/classes/models/FrmEntryValidate.php +++ b/classes/models/FrmEntryValidate.php @@ -478,10 +478,10 @@ public static function validate_field_types( &$errors, $posted_field, $value, $a } /** - * @param array $errors - * @param object $field - * @param string $value - * @param array $args + * @param array $errors + * @param object $field + * @param array|string $value + * @param array $args * * @return void */ From 8b6fbe357bae4ebe3ead7f0d6c10cf52dbbb8822 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 07:01:03 -0700 Subject: [PATCH 05/11] Handle array input in is_true, field value output and form state --- classes/helpers/FrmAppHelper.php | 7 ++++++- classes/models/FrmFormState.php | 3 ++- classes/models/fields/FrmFieldType.php | 3 ++- tests/phpunit/fields/test_FrmFieldType.php | 16 ++++++++++++++++ tests/phpunit/forms/test_FrmFormState.php | 21 +++++++++++++++++++++ tests/phpunit/misc/test_FrmAppHelper.php | 22 ++++++++++++++++++++++ 6 files changed, 69 insertions(+), 3 deletions(-) create mode 100644 tests/phpunit/forms/test_FrmFormState.php diff --git a/classes/helpers/FrmAppHelper.php b/classes/helpers/FrmAppHelper.php index d2f1351c36..1c78f55227 100644 --- a/classes/helpers/FrmAppHelper.php +++ b/classes/helpers/FrmAppHelper.php @@ -1900,11 +1900,16 @@ public static function save_combined_js() { * * @since 1.07.10 * - * @param bool|int|string $value The value to compare. + * @param array|bool|int|string $value The value to compare. * * @return bool */ public static function is_true( $value ) { + if ( is_array( $value ) ) { + // An array is never a true flag, and casting one to a string triggers a warning. + return false; + } + return true === $value || '1' === (string) $value || 'true' === $value || 'yes' === $value; } diff --git a/classes/models/FrmFormState.php b/classes/models/FrmFormState.php index 33005ec6a9..b2d5e3be02 100644 --- a/classes/models/FrmFormState.php +++ b/classes/models/FrmFormState.php @@ -133,7 +133,8 @@ public static function maybe_render_state_field( $form ) { private static function get_state_from_request() { $encrypted_state = FrmAppHelper::get_post_param( 'frm_state', '', 'sanitize_text_field' ); - if ( ! $encrypted_state ) { + if ( ! $encrypted_state || ! is_string( $encrypted_state ) ) { + // An array value (frm_state[]=x) would be a TypeError in openssl_decrypt. return false; } diff --git a/classes/models/fields/FrmFieldType.php b/classes/models/fields/FrmFieldType.php index b3e5e84a7b..002a29985d 100644 --- a/classes/models/fields/FrmFieldType.php +++ b/classes/models/fields/FrmFieldType.php @@ -1450,7 +1450,8 @@ protected function prepare_esc_value() { } if ( is_array( $value ) ) { - $value = implode( ', ', $value ); + // Flatten first. A nested array in the request would otherwise trigger an "Array to string conversion" warning. + $value = implode( ', ', FrmAppHelper::array_flatten( $value, 'reset' ) ); } return str_contains( $value, '<' ) ? htmlentities( $value ) : $value; diff --git a/tests/phpunit/fields/test_FrmFieldType.php b/tests/phpunit/fields/test_FrmFieldType.php index d5d13315fd..683f698c6f 100644 --- a/tests/phpunit/fields/test_FrmFieldType.php +++ b/tests/phpunit/fields/test_FrmFieldType.php @@ -38,6 +38,22 @@ public function test_html_min_number() { $this->assertStringContainsString( ' step="any"', $form ); } + /** + * @covers FrmFieldType::prepare_esc_value + */ + public function test_prepare_esc_value_flattens_nested_array() { + $field_type = new FrmFieldText( + array( + 'id' => 1, + 'value' => array( 'a', array( 'b', array( 'c' ) ) ), + ) + ); + + $value = $this->run_private_method( array( $field_type, 'prepare_esc_value' ) ); + + $this->assertSame( 'a, b, c', $value ); + } + public function test_sanitize_value() { $this->set_current_user_to_1(); $frm_field_type = new FrmFieldDefault(); diff --git a/tests/phpunit/forms/test_FrmFormState.php b/tests/phpunit/forms/test_FrmFormState.php new file mode 100644 index 0000000000..cd2c398b33 --- /dev/null +++ b/tests/phpunit/forms/test_FrmFormState.php @@ -0,0 +1,21 @@ +run_private_method( array( 'FrmFormState', 'get_state_from_request' ) ); + + unset( $_POST['frm_state'] ); + + $this->assertFalse( $result ); + } +} diff --git a/tests/phpunit/misc/test_FrmAppHelper.php b/tests/phpunit/misc/test_FrmAppHelper.php index 5e4d6b9085..18c1606048 100644 --- a/tests/phpunit/misc/test_FrmAppHelper.php +++ b/tests/phpunit/misc/test_FrmAppHelper.php @@ -262,6 +262,28 @@ public function test_sanitize_request_ignores_array_value() { $this->assertSame( '', $values['frm_action'] ); } + /** + * @covers FrmAppHelper::is_true + */ + public function test_is_true_array_value_is_false_without_warning() { + $warnings = array(); + + // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_set_error_handler + set_error_handler( + function ( $errno, $errstr ) use ( &$warnings ) { + $warnings[] = $errstr; + return true; + } + ); + + $result = FrmAppHelper::is_true( array( 'x' ) ); + + restore_error_handler(); + + $this->assertFalse( $result ); + $this->assertSame( array(), $warnings ); + } + public function test_kses() { $start_value = ''; $safe_value = 'Hello, click here'; From 79f6ade3b04362e15c676bdca7d8b0a3dafd92dd Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 07:07:06 -0700 Subject: [PATCH 06/11] Fix PHPCS consecutive assignment spacing in FrmFormState test --- tests/phpunit/forms/test_FrmFormState.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/phpunit/forms/test_FrmFormState.php b/tests/phpunit/forms/test_FrmFormState.php index cd2c398b33..5817f2e177 100644 --- a/tests/phpunit/forms/test_FrmFormState.php +++ b/tests/phpunit/forms/test_FrmFormState.php @@ -11,8 +11,7 @@ class test_FrmFormState extends FrmUnitTest { public function test_get_state_from_request_ignores_array_value() { $_POST['frm_state'] = array( 'x' ); - - $result = $this->run_private_method( array( 'FrmFormState', 'get_state_from_request' ) ); + $result = $this->run_private_method( array( 'FrmFormState', 'get_state_from_request' ) ); unset( $_POST['frm_state'] ); From 161519ad7fec8b095b884e666b0ba8fdca0113c0 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 12:28:54 -0700 Subject: [PATCH 07/11] Add tests for array form_id and entry params (red) --- .../entries/test_FrmEntriesController.php | 16 ++++++++++++++++ tests/phpunit/forms/test_FrmFormsHelper.php | 18 ++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/tests/phpunit/entries/test_FrmEntriesController.php b/tests/phpunit/entries/test_FrmEntriesController.php index aa1011b373..55e78175ef 100644 --- a/tests/phpunit/entries/test_FrmEntriesController.php +++ b/tests/phpunit/entries/test_FrmEntriesController.php @@ -122,4 +122,20 @@ public function test_spam_reason_in_sidebar() { $this->assertStringNotContainsString( 'Spam_source', $html ); $this->assertStringNotContainsString( 'Test_sample', $html ); } + + /** + * @covers FrmEntriesController::process_entry + */ + public function test_process_entry_ignores_array_form_id() { + $_POST['form_id'] = array( '1' ); + $_POST['item_key'] = 'abc'; + + try { + FrmEntriesController::process_entry(); + } finally { + unset( $_POST['form_id'], $_POST['item_key'] ); + } + + $this->assertArrayNotHasKey( 'created_entries', $GLOBALS['frm_vars'] ?? array() ); + } } diff --git a/tests/phpunit/forms/test_FrmFormsHelper.php b/tests/phpunit/forms/test_FrmFormsHelper.php index 929857e96e..42824c349a 100644 --- a/tests/phpunit/forms/test_FrmFormsHelper.php +++ b/tests/phpunit/forms/test_FrmFormsHelper.php @@ -632,4 +632,22 @@ public function test_count_fields_without_submit() { $this->assertSame( 2, FrmFormsHelper::count_fields_without_submit( $fields ) ); $this->assertSame( 0, FrmFormsHelper::count_fields_without_submit( array() ) ); } + + /** + * @covers FrmFormsHelper::replace_shortcodes + */ + public function test_replace_shortcodes_ignores_array_entry_param() { + $form = new stdClass(); + $form->name = 'Test'; + $form->form_key = 'test'; + $_GET['entry'] = array( 'x' ); + + try { + $html = FrmFormsHelper::replace_shortcodes( '[entry_key]', $form ); + } finally { + unset( $_GET['entry'] ); + } + + $this->assertSame( '', $html ); + } } From 4c84e8e6e856bbd2ffee59353dfd209554c36917 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 12:29:19 -0700 Subject: [PATCH 08/11] Guard array form_id and entry params in process_entry, AJAX submit and replace_shortcodes --- classes/controllers/FrmEntriesAJAXSubmitController.php | 2 +- classes/controllers/FrmEntriesController.php | 2 +- classes/helpers/FrmFormsHelper.php | 3 ++- tests/phpunit/forms/test_FrmFormsHelper.php | 6 +++--- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/classes/controllers/FrmEntriesAJAXSubmitController.php b/classes/controllers/FrmEntriesAJAXSubmitController.php index 201cf50d79..0af56c5fdf 100644 --- a/classes/controllers/FrmEntriesAJAXSubmitController.php +++ b/classes/controllers/FrmEntriesAJAXSubmitController.php @@ -42,7 +42,7 @@ public static function ajax_create() { $form_id = FrmAppHelper::get_post_param( 'form_id', 0, 'absint' ); - if ( ! $form_id ) { + if ( ! $form_id || is_array( $form_id ) ) { echo json_encode( $response ); wp_die(); } diff --git a/classes/controllers/FrmEntriesController.php b/classes/controllers/FrmEntriesController.php index e68c5a7a9a..5ffc4f18ea 100644 --- a/classes/controllers/FrmEntriesController.php +++ b/classes/controllers/FrmEntriesController.php @@ -772,7 +772,7 @@ public static function destroy() { public static function process_entry( $errors = '', $ajax = false ) { $form_id = FrmAppHelper::get_post_param( 'form_id', '', 'absint' ); - if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || ! isset( $_POST['item_key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing + if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || is_array( $form_id ) || ! isset( $_POST['item_key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing return; } diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php index 02e8038ff9..22d4d64df1 100644 --- a/classes/helpers/FrmFormsHelper.php +++ b/classes/helpers/FrmFormsHelper.php @@ -1291,7 +1291,8 @@ public static function replace_shortcodes( $html, $form, $title = false, $descri } elseif ( $code === 'form_description' ) { $replace_with = FrmAppHelper::use_wpautop( $form->description ); } elseif ( $code === 'entry_key' && ! empty( $_GET ) && isset( $_GET['entry'] ) ) { - $replace_with = FrmAppHelper::simple_get( 'entry', 'sanitize_title' ); + $entry_key = FrmAppHelper::simple_get( 'entry', 'sanitize_title' ); + $replace_with = is_array( $entry_key ) ? '' : $entry_key; } else { $replace_with = ''; } diff --git a/tests/phpunit/forms/test_FrmFormsHelper.php b/tests/phpunit/forms/test_FrmFormsHelper.php index 42824c349a..65ce7bf487 100644 --- a/tests/phpunit/forms/test_FrmFormsHelper.php +++ b/tests/phpunit/forms/test_FrmFormsHelper.php @@ -637,10 +637,10 @@ public function test_count_fields_without_submit() { * @covers FrmFormsHelper::replace_shortcodes */ public function test_replace_shortcodes_ignores_array_entry_param() { - $form = new stdClass(); - $form->name = 'Test'; + $form = new stdClass(); + $form->name = 'Test'; $form->form_key = 'test'; - $_GET['entry'] = array( 'x' ); + $_GET['entry'] = array( 'x' ); try { $html = FrmFormsHelper::replace_shortcodes( '[entry_key]', $form ); From eddafb8b59d1ae23675959d0a0f5b9d3f4bf1156 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 12:29:37 -0700 Subject: [PATCH 09/11] Make process_entry array test create a real form --- tests/phpunit/entries/test_FrmEntriesController.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/phpunit/entries/test_FrmEntriesController.php b/tests/phpunit/entries/test_FrmEntriesController.php index 55e78175ef..c763993727 100644 --- a/tests/phpunit/entries/test_FrmEntriesController.php +++ b/tests/phpunit/entries/test_FrmEntriesController.php @@ -127,7 +127,10 @@ public function test_spam_reason_in_sidebar() { * @covers FrmEntriesController::process_entry */ public function test_process_entry_ignores_array_form_id() { - $_POST['form_id'] = array( '1' ); + global $frm_vars; + + $form_id = $this->factory->form->create(); + $_POST['form_id'] = array( (string) $form_id ); $_POST['item_key'] = 'abc'; try { @@ -136,6 +139,6 @@ public function test_process_entry_ignores_array_form_id() { unset( $_POST['form_id'], $_POST['item_key'] ); } - $this->assertArrayNotHasKey( 'created_entries', $GLOBALS['frm_vars'] ?? array() ); + $this->assertFalse( isset( $frm_vars['form_params'][ $form_id ] ), 'An array form_id should stop before the form is processed.' ); } } From 9feacea35b3fff65ba1bb3670abdca435ce8311f Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 12:33:02 -0700 Subject: [PATCH 10/11] Split process_entry guard to satisfy the line length limit --- classes/controllers/FrmEntriesController.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/classes/controllers/FrmEntriesController.php b/classes/controllers/FrmEntriesController.php index 5ffc4f18ea..eaa74ad2af 100644 --- a/classes/controllers/FrmEntriesController.php +++ b/classes/controllers/FrmEntriesController.php @@ -772,7 +772,12 @@ public static function destroy() { public static function process_entry( $errors = '', $ajax = false ) { $form_id = FrmAppHelper::get_post_param( 'form_id', '', 'absint' ); - if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || is_array( $form_id ) || ! isset( $_POST['item_key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing + // An array form_id (form_id[]=1) passes absint as an array, which breaks the array offsets below. + if ( is_array( $form_id ) ) { + return; + } + + if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || ! isset( $_POST['item_key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing return; } From 5b59dfed790eaa4dbfbdf5954532a84cd0baf688 Mon Sep 17 00:00:00 2001 From: "vivi-the-going-merry[bot]" <308115520+vivi-the-going-merry[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 12:35:51 -0700 Subject: [PATCH 11/11] Keep FrmEntriesController under the file length limit --- classes/controllers/FrmEntriesController.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/classes/controllers/FrmEntriesController.php b/classes/controllers/FrmEntriesController.php index eaa74ad2af..2da2467fd6 100644 --- a/classes/controllers/FrmEntriesController.php +++ b/classes/controllers/FrmEntriesController.php @@ -772,12 +772,8 @@ public static function destroy() { public static function process_entry( $errors = '', $ajax = false ) { $form_id = FrmAppHelper::get_post_param( 'form_id', '', 'absint' ); - // An array form_id (form_id[]=1) passes absint as an array, which breaks the array offsets below. - if ( is_array( $form_id ) ) { - return; - } - - if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || ! isset( $_POST['item_key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing + // phpcs:ignore WordPress.Security.NonceVerification.Missing + if ( FrmAppHelper::is_admin() || empty( $_POST ) || ! $form_id || is_array( $form_id ) || ! isset( $_POST['item_key'] ) ) { return; }