<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Helper functions related to privacy, geolocation and user data.

[2] Fix | Delete

*

[3] Fix | Delete

* @since 1.8.0

[4] Fix | Delete

*/

[5] Fix | Delete

[6] Fix | Delete

/**

[7] Fix | Delete

* Get the user IP address.

[8] Fix | Delete

*

[9] Fix | Delete

* @since 1.2.5

[10] Fix | Delete

* @since 1.7.3 Improve the IP detection quality by taking care of proxies (e.g. when the site is behind Cloudflare).

[11] Fix | Delete

*

[12] Fix | Delete

* Code based on the:

[13] Fix | Delete

* - WordPress method \WP_Community_Events::get_unsafe_client_ip

[14] Fix | Delete

* - Cloudflare documentation https://support.cloudflare.com/hc/en-us/articles/206776727

[15] Fix | Delete

*

[16] Fix | Delete

* @return string

[17] Fix | Delete

*/

[18] Fix | Delete

function wpforms_get_ip(): string {

[19] Fix | Delete

[20] Fix | Delete

$ip = '127.0.0.1';

[21] Fix | Delete

[22] Fix | Delete

$address_headers = [

[23] Fix | Delete

'HTTP_TRUE_CLIENT_IP',

[24] Fix | Delete

'HTTP_CF_CONNECTING_IP',

[25] Fix | Delete

'HTTP_X_REAL_IP',

[26] Fix | Delete

'HTTP_CLIENT_IP',

[27] Fix | Delete

'HTTP_X_FORWARDED_FOR',

[28] Fix | Delete

'HTTP_X_FORWARDED',

[29] Fix | Delete

'HTTP_X_CLUSTER_CLIENT_IP',

[30] Fix | Delete

'HTTP_FORWARDED_FOR',

[31] Fix | Delete

'HTTP_FORWARDED',

[32] Fix | Delete

'REMOTE_ADDR',

[33] Fix | Delete

];

[34] Fix | Delete

[35] Fix | Delete

foreach ( $address_headers as $header ) {

[36] Fix | Delete

if ( empty( $_SERVER[ $header ] ) ) {

[37] Fix | Delete

continue;

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

/*

[41] Fix | Delete

* HTTP_X_FORWARDED_FOR can contain a chain of comma-separated addresses, with or without spaces.

[42] Fix | Delete

* The first address is the original client. It can't be trusted for authenticity,

[43] Fix | Delete

* but we don't need to for this purpose.

[44] Fix | Delete

*/

[45] Fix | Delete

[46] Fix | Delete

// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

[47] Fix | Delete

$address_chain = explode( ',', wp_unslash( $_SERVER[ $header ] ) );

[48] Fix | Delete

$ip = filter_var( trim( $address_chain[0] ), FILTER_VALIDATE_IP );

[49] Fix | Delete

[50] Fix | Delete

break;

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

/**

[54] Fix | Delete

* Filter detected IP address.

[55] Fix | Delete

*

[56] Fix | Delete

* @since 1.2.5

[57] Fix | Delete

*

[58] Fix | Delete

* @param string $ip IP address.

[59] Fix | Delete

*/

[60] Fix | Delete

return (string) filter_var( apply_filters( 'wpforms_get_ip', $ip ), FILTER_VALIDATE_IP );

[61] Fix | Delete

}

[62] Fix | Delete

[63] Fix | Delete

/**

[64] Fix | Delete

* Determine if collecting user's IP is allowed by GDPR setting (globally or per form).

[65] Fix | Delete

* Majority of our users have GDPR disabled.

[66] Fix | Delete

* So we remove this data from the request only when it's not needed:

[67] Fix | Delete

* 1) when GDPR is enabled AND globally disabled user details storage;

[68] Fix | Delete

* 2) when GDPR is enabled AND IP address processing is disabled on per form basis.

[69] Fix | Delete

*

[70] Fix | Delete

* @since 1.6.6

[71] Fix | Delete

*

[72] Fix | Delete

* @param array $form_data Form settings.

[73] Fix | Delete

*

[74] Fix | Delete

* @return bool

[75] Fix | Delete

*/

[76] Fix | Delete

function wpforms_is_collecting_ip_allowed( $form_data = [] ) {

[77] Fix | Delete

[78] Fix | Delete

if (

[79] Fix | Delete

wpforms_setting( 'gdpr', false ) &&

[80] Fix | Delete

(

[81] Fix | Delete

wpforms_setting( 'gdpr-disable-details', false ) ||

[82] Fix | Delete

( ! empty( $form_data ) && ! empty( $form_data['settings']['disable_ip'] ) )

[83] Fix | Delete

)

[84] Fix | Delete

) {

[85] Fix | Delete

return false;

[86] Fix | Delete

}

[87] Fix | Delete

[88] Fix | Delete

return true;

[89] Fix | Delete

}

[90] Fix | Delete

[91] Fix | Delete

/**

[92] Fix | Delete

* Determine if collecting cookies is allowed by GDPR setting.

[93] Fix | Delete

*

[94] Fix | Delete

* @since 1.7.5

[95] Fix | Delete

*

[96] Fix | Delete

* @return bool

[97] Fix | Delete

*/

[98] Fix | Delete

function wpforms_is_collecting_cookies_allowed() {

[99] Fix | Delete

[100] Fix | Delete

return ! ( wpforms_setting( 'gdpr', false ) && wpforms_setting( 'gdpr-disable-uuid', false ) );

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete