gw-draft-resume-change-notice.php: Added new snippet that displays a notice when a user resumes draft from a new IP/UA.
#1164
Conversation
WalkthroughAdds a Gravity Forms filter that, when a Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant U as User Browser
participant WP as WordPress + Gravity Forms
participant Filter as gform_get_form_filter
participant DB as GF Drafts Table
U->>WP: Request form page (may include gf_token)
WP->>Filter: apply filter(form_markup, form)
alt gf_token present
Filter->>DB: SELECT * FROM drafts WHERE uuid = :token (prepared)
DB-->>Filter: draft row or none
alt Draft found && form_id matches
Filter->>Filter: json_decode(submission) → stored_ip, stored_ua
Filter->>WP: GFFormsModel::get_ip() and $_SERVER['HTTP_USER_AGENT']
alt IP changed or UA changed
Filter-->>WP: Build escaped contextual warning (IP / UA / both) and prepend to form_markup
else No change
Filter-->>WP: Return original form_markup
end
else Not found or form_id mismatch
Filter-->>WP: Return original form_markup
end
else No token
Filter-->>WP: Return original form_markup
end
WP-->>U: Rendered form (with or without warning)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
gravity-forms/gw-draft-resume-change-notice.php (3)
15-23: Avoid duplicate DB lookups when multiple forms render on the page.Cache the lookup per gf_token to prevent repeated queries on the same request.
Example (outside-selected lines for context only):
static $gw_notice_cache = array(); if ( isset( $gw_notice_cache[ $token ] ) ) { return $gw_notice_cache[ $token ] . $form_markup; } // ... compute $warning or '' ... $gw_notice_cache[ $token ] = $warning;
32-37: More robust UA retrieval (fallback).Some drafts store user_agent at the root. Add a fallback to reduce false negatives.
Apply:
- $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ''; + $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ( $submission_data['user_agent'] ?? '' );
60-64: Minor a11y: announce the notice politely and add a class hook.Expose a class and live region for screen readers.
Apply:
- $warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">'; + $warning = '<div role="status" aria-live="polite" class="gw-draft-resume-notice" style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">';
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
gravity-forms/gw-draft-resume-change-notice.php(1 hunks)
🧰 Additional context used
🪛 GitHub Check: PHPCS (Files Changed)
gravity-forms/gw-draft-resume-change-notice.php
[failure] 51-51:
String "🔒 Your location and device have both changed since last editing this draft" does not require double quotes; use single quotes instead
[failure] 50-50:
String "💻 Your browser or device has changed since last editing this draft" does not require double quotes; use single quotes instead
[failure] 49-49:
String "🌍 Your location has changed since last editing this draft" does not require double quotes; use single quotes instead
[warning] 39-39:
Equals sign not aligned with surrounding assignments; expected 1 space but found 2 spaces
[warning] 38-38:
Equals sign not aligned with surrounding assignments; expected 2 spaces but found 3 spaces
[warning] 35-35:
Equals sign not aligned with surrounding assignments; expected 2 spaces but found 1 space
[failure] 19-19:
Use placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s"
[failure] 13-13:
Tabs must be used to indent lines; spaces are not allowed
🪛 GitHub Actions: PHP Lint (PR)
gravity-forms/gw-draft-resume-change-notice.php
[error] 13-13: PHPCS: Tabs must be used to indent lines; spaces are not allowed. (Generic.WhiteSpace.DisallowSpaceIndent.SpacesUsed)
🔇 Additional comments (1)
gravity-forms/gw-draft-resume-change-notice.php (1)
10-12: Good early-bail and sanitization.The token gate and use of wp_unslash() + sanitize_text_field() look solid.
|
I realize this snippet would make more sense under the GPASC category since it was created to try and mitigate potential data loss when using the auto-save feature. |
…a notice when a user resumes draft from a new IP/UA.
…a notice when a user resumes draft from a new IP/UA.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (3)
gravity-forms/gw-draft-resume-change-notice.php (3)
55-61: Expose the final message via a filter for customization.Lets site owners tweak copy without editing the snippet.
if ( $ip_changed && ! $browser_changed ) { $message = $ip_changed_message; } elseif ( $browser_changed && ! $ip_changed ) { $message = $browser_changed_message; } + + // Allow customization of the final message. + $message = apply_filters( 'gw_draft_resume_change_notice_message', $message, $ip_changed, $browser_changed, $form, $draft );
13-13: Fix tab indentation (CI blocker).PHPCS fails on these lines due to leading spaces. Replace with tabs.
- $token = sanitize_text_field( wp_unslash( $_GET['gf_token'] ) ); + $token = sanitize_text_field( wp_unslash( $_GET['gf_token'] ) ); @@ - // Configure Messages + // Configure MessagesAlso applies to: 50-50
16-21: Silence WPCS false-positive for table identifier + trim stray whitespace.Add NotPrepared to the ignore and convert leading spaces to a tab; also remove trailing whitespace on the blank line above.
- $table = GFFormsModel::get_draft_submissions_table_name(); - - // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $table = GFFormsModel::get_draft_submissions_table_name(); + + // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF table; values use $wpdb->prepare(). $draft = $wpdb->get_row( $wpdb->prepare( "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
🧹 Nitpick comments (2)
gravity-forms/gw-draft-resume-change-notice.php (2)
62-66: Allow overriding the wrapper markup; inline styles are hard to theme.Offer a filter so themes can swap styles/classes (e.g., GF notice classes) without forking the snippet.
$warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">'; $warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>'; $warning .= '</div>'; + + // Allow customization of the warning markup/container. + $warning = apply_filters( 'gw_draft_resume_change_notice_markup', $warning, $message, $form, $draft );
37-45: Minor: normalize UA strings before comparison.Trim to avoid false positives from incidental whitespace.
- $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ''; - $current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? ''; + $stored_user_agent = isset( $submission_data['partial_entry']['user_agent'] ) ? trim( (string) $submission_data['partial_entry']['user_agent'] ) : ''; + $current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? trim( (string) $_SERVER['HTTP_USER_AGENT'] ) : '';
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
gravity-forms/gw-draft-resume-change-notice.php(1 hunks)
🧰 Additional context used
🪛 GitHub Check: PHPCS (Files Changed)
gravity-forms/gw-draft-resume-change-notice.php
[failure] 50-50:
Tabs must be used to indent lines; spaces are not allowed
[failure] 21-21:
Use placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s"
[failure] 17-17:
Whitespace found at end of line
[failure] 17-17:
Tabs must be used to indent lines; spaces are not allowed
[failure] 13-13:
Tabs must be used to indent lines; spaces are not allowed
🪛 GitHub Actions: PHP Lint (PR)
gravity-forms/gw-draft-resume-change-notice.php
[error] 13-13: PHPCS: Tabs must be used to indent lines; spaces are not allowed. (Generic.WhiteSpace.DisallowSpaceIndent.SpacesUsed)
🔇 Additional comments (1)
gravity-forms/gw-draft-resume-change-notice.php (1)
10-12: LGTM: sensible early‑exit guards.Bailouts on missing token, form_id mismatch, and unchanged IP/UA look correct and keep render fast.
Also applies to: 30-32, 46-48
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
gravity-forms/gw-draft-resume-change-notice.php (1)
1-69: Fix space indentation (use tabs) and remove whitespace-only lines so PHPCS passes.
- gravity-forms/gw-draft-resume-change-notice.php — replace leading spaces with tabs on lines 3, 4, 5, 6, 7, 18, 50; remove the whitespace-only line 17. Re-run PHPCS and confirm clean.
♻️ Duplicate comments (3)
gravity-forms/gw-draft-resume-change-notice.php (3)
55-61: Expose the final message via a filter.Allows sites to customize copy without editing the snippet.
Apply:
if ( $ip_changed && ! $browser_changed ) { $message = $ip_changed_message; } elseif ( $browser_changed && ! $ip_changed ) { $message = $browser_changed_message; } + // Allow customization of the final message. + $message = apply_filters( 'gw_draft_resume_change_notice_message', $message, $ip_changed, $browser_changed, $form, $draft );
18-24: WPCS: broaden ignore and place it precisely on the SQL line.The interpolated
$tabletriggers both InterpolatedNotPrepared and NotPrepared. Put the ignore directly above the SQL string line and include both codes; also fix indentation to tabs.Apply:
- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared - $draft = $wpdb->get_row( - $wpdb->prepare( - "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s", - $token - ) - ); + $draft = $wpdb->get_row( + // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF table; placeholder used for value. + $wpdb->prepare( + "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s", + $token + ) + );
50-53: Fix tab indentation (PHPCS blocker).Replace leading spaces with a tab.
Apply:
- // Configure Messages + // Configure Messages
🧹 Nitpick comments (2)
gravity-forms/gw-draft-resume-change-notice.php (2)
30-32: Use rgar() for resilience (minor).Avoid direct array access in case $form lacks 'id'.
Apply:
- if ( (int) $form['id'] !== (int) $draft->form_id ) { + if ( (int) rgar( $form, 'id' ) !== (int) $draft->form_id ) {
62-66: A11y + extensibility: add role/class and a markup filter.Improve screen reader support and let implementers override the HTML.
Apply:
- $warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">'; + $warning = '<div class="gw-draft-resume-change-notice" role="alert" aria-live="polite" style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">'; $warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>'; $warning .= '</div>'; + + // Allow customization of the full notice markup. + $warning = apply_filters( 'gw_draft_resume_change_notice_markup', $warning, $message, $ip_changed, $browser_changed, $form, $draft );
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
gravity-forms/gw-draft-resume-change-notice.php(1 hunks)
🧰 Additional context used
🪛 GitHub Check: PHPCS (Files Changed)
gravity-forms/gw-draft-resume-change-notice.php
[failure] 50-50:
Tabs must be used to indent lines; spaces are not allowed
[failure] 21-21:
Use placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s"
[failure] 17-17:
Whitespace found at end of line
[failure] 17-17:
Tabs must be used to indent lines; spaces are not allowed
🪛 GitHub Actions: PHP Lint (PR)
gravity-forms/gw-draft-resume-change-notice.php
[error] 17-17: PHPCS check failed (thenabeel/action-phpcs@v8): Tabs must be used to indent lines; spaces are not allowed. (Generic.WhiteSpace.DisallowSpaceIndent.SpacesUsed)
🔇 Additional comments (2)
gravity-forms/gw-draft-resume-change-notice.php (2)
10-14: Input handling + early return look good.Token presence check, sanitization, and bailout paths are correct.
37-45: Change detection logic is solid.Null‑coalesce and strict inequality keep it safe and predictable.
…a notice when a user resumes draft from a new IP/UA.
…a notice when a user resumes draft from a new IP/UA.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
gravity-forms/gw-draft-resume-change-notice.php (1)
53-63: Consider adding a filter for message customization.The message selection logic is correct. As suggested in a previous review, you could expose a filter to allow customization of the final message for different use cases.
Apply this diff to add the filter:
$message = $both_changed_message; if ( $ip_changed && ! $browser_changed ) { $message = $ip_changed_message; } elseif ( $browser_changed && ! $ip_changed ) { $message = $browser_changed_message; } + + // Allow customization of the notice message. + $message = apply_filters( 'gw_draft_resume_change_notice_message', $message, $ip_changed, $browser_changed, $form, $draft );
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
gravity-forms/gw-draft-resume-change-notice.php(1 hunks)
🧰 Additional context used
🪛 GitHub Actions: PHP Lint (PR)
gravity-forms/gw-draft-resume-change-notice.php
[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
[error] 22-22: String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead
🪛 GitHub Check: PHPCS (Files Changed)
gravity-forms/gw-draft-resume-change-notice.php
[failure] 22-22:
String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead
[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
🔇 Additional comments (3)
gravity-forms/gw-draft-resume-change-notice.php (3)
8-13: LGTM! Token handling is secure.The early return pattern and sanitization using
sanitize_text_field( wp_unslash() )properly handles the token input from the query string.
37-47: LGTM! Data extraction and comparison logic is sound.The defensive handling of JSON decoding, null coalescing for missing keys, and truthy checks before comparison properly prevent false positives when values are empty.
65-69: LGTM! Output is properly escaped.The warning HTML uses inline styles (avoiding external dependencies) and properly escapes the message with
esc_html()before output.
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | ||
| $draft = $wpdb->get_row( | ||
| $wpdb->prepare( | ||
| sprintf( | ||
| "SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s", | ||
| esc_sql( $table ) | ||
| ), | ||
| $uuid | ||
| ) | ||
| ); |
There was a problem hiding this comment.
Critical: undefined variable and incorrect prepare() usage.
Line 25 references $uuid but the variable is defined as $token on Line 13. This will cause a fatal error.
Additionally, the current sprintf/esc_sql/prepare combination is incorrect:
sprintfconsumes the%splaceholder, leaving%%s(which becomes%safter sprintf)$wpdb->preparethen expects a placeholder but the string already has the table name interpolated- This causes the "incorrect number of replacements" warning from PHPCS and the pipeline
Table names are identifiers and cannot be prepared with $wpdb->prepare. The correct approach is direct interpolation with a comprehensive phpcs:ignore comment.
Apply this diff to fix both issues:
- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
$draft = $wpdb->get_row(
$wpdb->prepare(
- sprintf(
- "SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s",
- esc_sql( $table )
- ),
- $uuid
+ "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
+ $token
)
);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| $draft = $wpdb->get_row( | |
| $wpdb->prepare( | |
| sprintf( | |
| "SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s", | |
| esc_sql( $table ) | |
| ), | |
| $uuid | |
| ) | |
| ); | |
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared. | |
| $draft = $wpdb->get_row( | |
| $wpdb->prepare( | |
| "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s", | |
| $token | |
| ) | |
| ); |
🧰 Tools
🪛 GitHub Actions: PHP Lint (PR)
[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
[error] 22-22: String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead
🪛 GitHub Check: PHPCS (Files Changed)
[failure] 22-22:
String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead
[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
🤖 Prompt for AI Agents
In gravity-forms/gw-draft-resume-change-notice.php around lines 18 to 27, the
query uses an undefined $uuid and misuses sprintf/esc_sql with $wpdb->prepare
causing replacement/count errors; change the variable to $token (the defined
name), stop using sprintf to insert the table name into the prepared statement,
instead build the SQL string by interpolating the esc_sql($table) directly (with
a phpcs:ignore comment for table name interpolation), and call $wpdb->prepare
with a SQL string that contains a single %s placeholder for the token and pass
$token as the parameter so only the token is prepared.
…a notice when a user resumes draft from a new IP/UA.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
gravity-forms/gw-draft-resume-change-notice.php (2)
53-63: Consider adding a filter for message customization.The messages are well-structured, but exposing them through a filter would allow developers to customize the text without modifying the snippet.
Add this after line 63:
$message = $browser_changed_message; } + + // Allow customization of the message. + $message = apply_filters( 'gw_draft_resume_change_notice_message', $message, $ip_changed, $browser_changed, $form, $draft );
65-67: Consider allowing style customization.The inline styles work well, but exposing them through a filter would provide greater flexibility for developers who want to match their site's design.
Replace the hardcoded styles with a filterable variable:
- $warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">'; - $warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>'; + $default_styles = array( + 'container' => 'background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;', + 'text' => 'color:#856404;', + ); + $styles = apply_filters( 'gw_draft_resume_change_notice_styles', $default_styles, $form ); + + $warning = '<div style="' . esc_attr( $styles['container'] ) . '">'; + $warning .= '<strong style="' . esc_attr( $styles['text'] ) . '">' . esc_html( $message ) . '</strong>'; $warning .= '</div>';
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
gravity-forms/gw-draft-resume-change-notice.php(1 hunks)
🧰 Additional context used
🪛 GitHub Actions: PHP Lint (PR)
gravity-forms/gw-draft-resume-change-notice.php
[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
🪛 GitHub Check: PHPCS (Files Changed)
gravity-forms/gw-draft-resume-change-notice.php
[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | ||
| $draft = $wpdb->get_row( | ||
| $wpdb->prepare( | ||
| sprintf( | ||
| 'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s', | ||
| esc_sql( $table ) | ||
| ), | ||
| $token | ||
| ) | ||
| ); |
There was a problem hiding this comment.
Fix the database query construction (pipeline blocker).
The current sprintf + esc_sql + $wpdb->prepare combination is incorrect and causes the PHPCS warning. After sprintf processes the table name, %%s becomes %s, but the table is already interpolated, causing a mismatch in replacement count.
Table names are identifiers and cannot be prepared with placeholders. Use direct interpolation with a comprehensive phpcs:ignore comment.
Apply this diff:
- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
$draft = $wpdb->get_row(
$wpdb->prepare(
- sprintf(
- 'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s',
- esc_sql( $table )
- ),
+ "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
$token
)
);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| $draft = $wpdb->get_row( | |
| $wpdb->prepare( | |
| sprintf( | |
| 'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s', | |
| esc_sql( $table ) | |
| ), | |
| $token | |
| ) | |
| ); | |
| // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared. | |
| $draft = $wpdb->get_row( | |
| $wpdb->prepare( | |
| "SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s", | |
| $token | |
| ) | |
| ); |
🧰 Tools
🪛 GitHub Actions: PHP Lint (PR)
[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
🪛 GitHub Check: PHPCS (Files Changed)
[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.
🤖 Prompt for AI Agents
In gravity-forms/gw-draft-resume-change-notice.php around lines 18 to 27, the
query builds the SQL using sprintf+esc_sql then passes it to $wpdb->prepare
which corrupts the placeholder count; instead interpolate the validated table
name directly into the query string and call $wpdb->prepare only for the %s
placeholder for uuid, and add a targeted phpcs:ignore comment
(WordPress.DB.PreparedSQL.InterpolatedNotPrepared) on the line that interpolates
the table name so PHPCS accepts the direct identifier interpolation.
| $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ''; | ||
| $current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? ''; |
There was a problem hiding this comment.
Consider sanitizing the current User-Agent.
While the current User-Agent is only used for comparison and not stored or displayed, sanitizing external input is a best practice. Consider using sanitize_text_field() for consistency.
Apply this diff:
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
- $current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
+ $current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ''; | |
| $current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? ''; | |
| $stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? ''; | |
| $current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) | |
| ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) | |
| : ''; |
🤖 Prompt for AI Agents
In gravity-forms/gw-draft-resume-change-notice.php around lines 40 to 41, the
current User-Agent from $_SERVER['HTTP_USER_AGENT'] is used raw for comparison;
sanitize it before use by passing the value through sanitize_text_field() (e.g.,
assign $current_user_agent = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ??
'' );) so comparisons use a sanitized string while leaving the stored_user_agent
unchanged.
Context
⛑️ Ticket(s): https://secure.helpscout.net/conversation/3062075880/88769?viewId=3808239
Summary
A new snippet to display a notice on top of the form when a saved draft is resumed from a different IP address and/or User-Agent than the one that created or last edited it.