fixes broken access control in form submission

Author: avonville

assets/wpuf/js/frontend-form.js

@@ -450,7 +450,7 @@
                                 type: 'warning',
                                 showCancelButton: false,
                                 confirmButtonColor: '#d54e21',
-                                confirmButtonText: 'OK',
+                                confirmButtonText: 'Ok',
                                 cancelButtonClass: 'btn btn-danger',
                             });
 

includes/class-ajax.php

@@ -711,8 +711,20 @@ public function handle_frontend_submission() {
         check_ajax_referer( 'wpuf_form_add' );
         $form_id       = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : 0;
         $page_id       = isset( $_POST['page_id'] ) ? intval( $_POST['page_id'] ) : 0;
-
         $form          = weforms()->form->get( $form_id );
+
+        /**
+         * Check if form submission is open. This resolves broken access control with unauthenticated users.
+         * Access is now checked on frontend form rendering and submission.
+         */
+        $form_submission_status = $form->is_submission_open();
+        if ( is_wp_error( $form_submission_status ) ) {
+            wp_send_json( [
+                'success'     => false,
+                'error'       => __( 'Login Required for submission.', 'weforms' ),
+            ] );
+        }
+
         $form_settings = $form->get_settings();
         $form_fields   = $form->get_fields();
         $entry_fields  = $form->prepare_entries();
@@ -1241,4 +1253,16 @@ public function delete_logs() {
 
         wp_send_json_success();
     }
+
+    /**
+     * Show form error
+     *
+     * @param string $message
+     * @param string $type
+     *
+     * @return string
+     */
+    public function show_error( $message, $type = 'info' ) {
+        return sprintf( '<div class="wpuf-%s">%s</div>', $type, $message );
+    }
 }