Skip to content

gw-draft-resume-change-notice.php: Added new snippet that displays a notice when a user resumes draft from a new IP/UA. #1164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 3, 2025
Merged

gw-draft-resume-change-notice.php: Added new snippet that displays a notice when a user resumes draft from a new IP/UA. #1164

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c84ab52
`gw-draft-resume-change-notice.php`: Added new snippet.
SebastianWiz Sep 11, 2025
3018ec3
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Sep 15, 2025
ba8fb22
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Sep 15, 2025
aad73a5
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
42a33c0
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
ea46c47
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions gravity-forms/gw-draft-resume-change-notice.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
<?php
/**
* Gravity Wiz // Gravity Forms // Draft Resume Change Notice
* https://gravitywiz.com/
*
* Use this snippet to display a notice when the user resumes draft from a different location, browser or device.
*/
add_filter( 'gform_get_form_filter', function( $form_markup, $form ) {

if ( empty( $_GET['gf_token'] ) ) {
return $form_markup;
}
$token = sanitize_text_field( wp_unslash( $_GET['gf_token'] ) );

global $wpdb;
$table = GFFormsModel::get_draft_submissions_table_name();

// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$draft = $wpdb->get_row(
$wpdb->prepare(

Check warning on line 20 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed) 

Incorrect number of replacements passed to $wpdb-&gt;prepare(). Found 1 replacement parameters, expected 0.
sprintf(
'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s',
esc_sql( $table )
),
$token
)
);
Copy link

@coderabbitai coderabbitai bot Oct 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix the database query construction (pipeline blocker).

The current sprintf + esc_sql + $wpdb->prepare combination is incorrect and causes the PHPCS warning. After sprintf processes the table name, %%s becomes %s, but the table is already interpolated, causing a mismatch in replacement count.

Table names are identifiers and cannot be prepared with placeholders. Use direct interpolation with a comprehensive phpcs:ignore comment.

Apply this diff:

-    // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+	// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
 	$draft = $wpdb->get_row(
 		$wpdb->prepare(
-			sprintf(
-				'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s',
-				esc_sql( $table )
-			),
+			"SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
 			$token
 		)
 	);
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$draft = $wpdb->get_row(
$wpdb->prepare(
sprintf(
'SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s',
esc_sql( $table )
),
$token
)
);
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
$draft = $wpdb->get_row(
$wpdb->prepare(
"SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
$token
)
);
🧰 Tools
🪛 GitHub Actions: PHP Lint (PR)

[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.

🪛 GitHub Check: PHPCS (Files Changed)

[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.

🤖 Prompt for AI Agents 
In gravity-forms/gw-draft-resume-change-notice.php around lines 18 to 27, the
query builds the SQL using sprintf+esc_sql then passes it to $wpdb->prepare
which corrupts the placeholder count; instead interpolate the validated table
name directly into the query string and call $wpdb->prepare only for the %s
placeholder for uuid, and add a targeted phpcs:ignore comment
(WordPress.DB.PreparedSQL.InterpolatedNotPrepared) on the line that interpolates
the table name so PHPCS accepts the direct identifier interpolation.


if ( ! $draft ) {
return $form_markup;
}

if ( (int) $form['id'] !== (int) $draft->form_id ) {
return $form_markup;
}

$submission_data = json_decode( $draft->submission, true );
$submission_data = is_array( $submission_data ) ? $submission_data : array();

$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
Comment on lines +40 to +41
Copy link

@coderabbitai coderabbitai bot Oct 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Consider sanitizing the current User-Agent.

While the current User-Agent is only used for comparison and not stored or displayed, sanitizing external input is a best practice. Consider using sanitize_text_field() for consistency.

Apply this diff:

 	$stored_user_agent  = $submission_data['partial_entry']['user_agent'] ?? '';
-	$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
+	$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] )
? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) )
: '';
🤖 Prompt for AI Agents 
In gravity-forms/gw-draft-resume-change-notice.php around lines 40 to 41, the
current User-Agent from $_SERVER['HTTP_USER_AGENT'] is used raw for comparison;
sanitize it before use by passing the value through sanitize_text_field() (e.g.,
assign $current_user_agent = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ??
'' );) so comparisons use a sanitized string while leaving the stored_user_agent
unchanged.


$stored_ip = $draft->ip ?? '';
$current_ip = GFFormsModel::get_ip();

$ip_changed = ( $stored_ip && $current_ip && $stored_ip !== $current_ip );
$browser_changed = ( $stored_user_agent && $current_user_agent && $stored_user_agent !== $current_user_agent );

if ( ! $ip_changed && ! $browser_changed ) {
return $form_markup;
}

// Configure Messages
$ip_changed_message = '🌍 Your location has changed since last editing this draft';
$browser_changed_message = '💻 Your browser or device has changed since last editing this draft';
$both_changed_message = '🔒 Your location AND device have both changed since last editing this draft';

$message = $both_changed_message;
if ( $ip_changed && ! $browser_changed ) {
$message = $ip_changed_message;
} elseif ( $browser_changed && ! $ip_changed ) {
$message = $browser_changed_message;
}

$warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">';
$warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>';
$warning .= '</div>';

return $warning . $form_markup;

}, 10, 2 );
Loading