Skip to content
68 changes: 68 additions & 0 deletions gravity-forms/gw-draft-resume-change-notice.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
<?php
/**
* Gravity Wiz // Gravity Forms // Draft Resume Change Notice
* https://gravitywiz.com/
*
* Use this snippet to display a notice when the user resumes draft from a different location, browser or device.
*/
add_filter( 'gform_get_form_filter', function( $form_markup, $form ) {

if ( empty( $_GET['gf_token'] ) ) {
return $form_markup;
}
$token = sanitize_text_field( wp_unslash( $_GET['gf_token'] ) );

global $wpdb;
$table = GFFormsModel::get_draft_submissions_table_name();

Check failure on line 17 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed)

Whitespace found at end of line

Check failure on line 17 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed)

Tabs must be used to indent lines; spaces are not allowed
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$draft = $wpdb->get_row(
$wpdb->prepare(
"SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",

Check failure on line 21 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed)

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $table at &quot;SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s&quot;
$token
)
);

if ( ! $draft ) {
return $form_markup;
}

if ( (int) $form['id'] !== (int) $draft->form_id ) {
return $form_markup;
}

$submission_data = json_decode( $draft->submission, true );
$submission_data = is_array( $submission_data ) ? $submission_data : array();

$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
Comment on lines +40 to +41
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Consider sanitizing the current User-Agent.

While the current User-Agent is only used for comparison and not stored or displayed, sanitizing external input is a best practice. Consider using sanitize_text_field() for consistency.

Apply this diff:

 	$stored_user_agent  = $submission_data['partial_entry']['user_agent'] ?? '';
-	$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
+	$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] )
? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) )
: '';
🤖 Prompt for AI Agents
In gravity-forms/gw-draft-resume-change-notice.php around lines 40 to 41, the
current User-Agent from $_SERVER['HTTP_USER_AGENT'] is used raw for comparison;
sanitize it before use by passing the value through sanitize_text_field() (e.g.,
assign $current_user_agent = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ??
'' );) so comparisons use a sanitized string while leaving the stored_user_agent
unchanged.


$stored_ip = $draft->ip ?? '';
$current_ip = GFFormsModel::get_ip();

$ip_changed = ( $stored_ip && $current_ip && $stored_ip !== $current_ip );
$browser_changed = ( $stored_user_agent && $current_user_agent && $stored_user_agent !== $current_user_agent );

if ( ! $ip_changed && ! $browser_changed ) {
return $form_markup;
}

// Configure Messages

Check failure on line 50 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed)

Tabs must be used to indent lines; spaces are not allowed
$ip_changed_message = '🌍 Your location has changed since last editing this draft';
$browser_changed_message = '💻 Your browser or device has changed since last editing this draft';
$both_changed_message = '🔒 Your location AND device have both changed since last editing this draft';

$message = $both_changed_message;
if ( $ip_changed && ! $browser_changed ) {
$message = $ip_changed_message;
} elseif ( $browser_changed && ! $ip_changed ) {
$message = $browser_changed_message;
}

$warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">';
$warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>';
$warning .= '</div>';

return $warning . $form_markup;

}, 10, 2 );
Loading