update

wp-content/plugins/contact-form-7/includes/contact-form.php

@@ -3,6 +3,7 @@
 class WPCF7_ContactForm {
 
 	use WPCF7_SWV_SchemaHolder;
+	use WPCF7_PipesHolder;
 
 	const post_type = 'wpcf7_contact_form';
 
@@ -104,23 +105,23 @@ class WPCF7_ContactForm {
 	/**
 	 * Returns a contact form data filled by default template contents.
 	 *
-	 * @param string|array $args Optional. Contact form options.
+	 * @param string|array $options Optional. Contact form options.
 	 * @return WPCF7_ContactForm A new contact form object.
 	 */
-	public static function get_template( $args = '' ) {
-		$args = wp_parse_args( $args, array(
+	public static function get_template( $options = '' ) {
+		$options = wp_parse_args( $options, array(
 			'locale' => null,
 			'title' => __( 'Untitled', 'contact-form-7' ),
 		) );
 
-		if ( ! isset( $args['locale'] ) ) {
-			$args['locale'] = determine_locale();
+		if ( ! isset( $options['locale'] ) ) {
+			$options['locale'] = determine_locale();
 		}
 
-		$callback = static function ( $args ) {
+		$callback = static function ( $options ) {
 			$contact_form = new self;
-			$contact_form->title = $args['title'];
-			$contact_form->locale = $args['locale'];
+			$contact_form->title = $options['title'];
+			$contact_form->locale = $options['locale'];
 
 			$properties = $contact_form->get_properties();
 
@@ -138,13 +139,13 @@ class WPCF7_ContactForm {
 		};
 
 		$contact_form = wpcf7_switch_locale(
-			$args['locale'],
+			$options['locale'],
 			$callback,
-			$args
+			$options
 		);
 
 		self::$current = apply_filters( 'wpcf7_contact_form_default_pack',
-			$contact_form, $args
+			$contact_form, $options
 		);
 
 		return self::$current;
@@ -516,11 +517,11 @@ class WPCF7_ContactForm {
 	/**
 	 * Generates HTML that represents a form.
 	 *
-	 * @param string|array $args Optional. Form options.
+	 * @param string|array $options Optional. Form options.
 	 * @return string HTML output.
 	 */
-	public function form_html( $args = '' ) {
-		$args = wp_parse_args( $args, array(
+	public function form_html( $options = '' ) {
+		$options = wp_parse_args( $options, array(
 			'html_id' => '',
 			'html_name' => '',
 			'html_title' => '',
@@ -528,9 +529,9 @@ class WPCF7_ContactForm {
 			'output' => 'form',
 		) );
 
-		$this->shortcode_atts = $args;
+		$this->shortcode_atts = $options;
 
-		if ( 'raw_form' == $args['output'] ) {
+		if ( 'raw_form' == $options['output'] ) {
 			return sprintf(
 				'<pre class="wpcf7-raw-form"><code>%s</code></pre>',
 				esc_html( $this->prop( 'form' ) )
@@ -554,6 +555,28 @@ class WPCF7_ContactForm {
 
 		$this->unit_tag = self::generate_unit_tag( $this->id );
 
+		$action_url = wpcf7_get_request_uri();
+
+		if ( $frag = strstr( $action_url, '#' ) ) {
+			$action_url = substr( $action_url, 0, -strlen( $frag ) );
+		}
+
+		$action_url .= '#' . $this->unit_tag();
+
+		$action_url = apply_filters( 'wpcf7_form_action_url', $action_url );
+
+		if (
+			str_starts_with( $action_url, '//' ) or
+			! str_starts_with( $action_url, '/' ) and
+			! str_starts_with( $action_url, home_url() )
+		) {
+			return sprintf(
+				'<p class="wpcf7-invalid-action-url"><strong>%1$s</strong> %2$s</p>',
+				esc_html( __( 'Error:', 'contact-form-7' ) ),
+				esc_html( __( "Invalid action URL is detected.", 'contact-form-7' ) )
+			);
+		}
+
 		$lang_tag = str_replace( '_', '-', $this->locale );
 
 		if ( preg_match( '/^([a-z]+-[a-z]+)-/i', $lang_tag, $matches ) ) {
@@ -572,25 +595,15 @@ class WPCF7_ContactForm {
 
 		$html .= "\n" . $this->screen_reader_response() . "\n";
 
-		$url = wpcf7_get_request_uri();
-
-		if ( $frag = strstr( $url, '#' ) ) {
-			$url = substr( $url, 0, -strlen( $frag ) );
-		}
-
-		$url .= '#' . $this->unit_tag();
-
-		$url = apply_filters( 'wpcf7_form_action_url', $url );
-
 		$id_attr = apply_filters( 'wpcf7_form_id_attr',
-			preg_replace( '/[^A-Za-z0-9:._-]/', '', $args['html_id'] )
+			preg_replace( '/[^A-Za-z0-9:._-]/', '', $options['html_id'] )
 		);
 
 		$name_attr = apply_filters( 'wpcf7_form_name_attr',
-			preg_replace( '/[^A-Za-z0-9:._-]/', '', $args['html_name'] )
+			preg_replace( '/[^A-Za-z0-9:._-]/', '', $options['html_name'] )
 		);
 
-		$title_attr = apply_filters( 'wpcf7_form_title_attr', $args['html_title'] );
+		$title_attr = apply_filters( 'wpcf7_form_title_attr', $options['html_title'] );
 
 		$class = 'wpcf7-form';
 
@@ -607,8 +620,8 @@ class WPCF7_ContactForm {
 			$class .= ' init';
 		}
 
-		if ( $args['html_class'] ) {
-			$class .= ' ' . $args['html_class'];
+		if ( $options['html_class'] ) {
+			$class .= ' ' . $options['html_class'];
 		}
 
 		if ( $this->in_demo_mode() ) {
@@ -626,7 +639,7 @@ class WPCF7_ContactForm {
 		$autocomplete = apply_filters( 'wpcf7_form_autocomplete', '' );
 
 		$atts = array(
-			'action' => esc_url( $url ),
+			'action' => esc_url( $action_url ),
 			'method' => 'post',
 			'class' => ( '' !== $class ) ? $class : null,
 			'id' => ( '' !== $id_attr ) ? $id_attr : null,
@@ -951,13 +964,13 @@ class WPCF7_ContactForm {
 	/**
 	 * Collects mail-tags available for this contact form.
 	 *
-	 * @param string|array $args Optional. Search options.
+	 * @param string|array $options Optional. Search options.
 	 * @return array Mail-tag names.
 	 */
-	public function collect_mail_tags( $args = '' ) {
+	public function collect_mail_tags( $options = '' ) {
 		$manager = WPCF7_FormTagsManager::get_instance();
 
-		$args = wp_parse_args( $args, array(
+		$options = wp_parse_args( $options, array(
 			'include' => array(),
 			'exclude' => $manager->collect_tag_types( 'not-for-mail' ),
 		) );
@@ -970,12 +983,12 @@ class WPCF7_ContactForm {
 
 			if ( empty( $type ) ) {
 				continue;
-			} elseif ( ! empty( $args['include'] ) ) {
-				if ( ! in_array( $type, $args['include'] ) ) {
+			} elseif ( ! empty( $options['include'] ) ) {
+				if ( ! in_array( $type, $options['include'] ) ) {
 					continue;
 				}
-			} elseif ( ! empty( $args['exclude'] ) ) {
-				if ( in_array( $type, $args['exclude'] ) ) {
+			} elseif ( ! empty( $options['exclude'] ) ) {
+				if ( in_array( $type, $options['exclude'] ) ) {
 					continue;
 				}
 			}
@@ -987,7 +1000,7 @@ class WPCF7_ContactForm {
 		$mailtags = array_filter( $mailtags );
 		$mailtags = array_values( $mailtags );
 
-		return apply_filters( 'wpcf7_collect_mail_tags', $mailtags, $args, $this );
+		return apply_filters( 'wpcf7_collect_mail_tags', $mailtags, $options, $this );
 	}
 
 
@@ -1033,11 +1046,11 @@ class WPCF7_ContactForm {
 	/**
 	 * Submits this contact form.
 	 *
-	 * @param string|array $args Optional. Submission options. Default empty.
+	 * @param string|array $options Optional. Submission options. Default empty.
 	 * @return array Result of submission.
 	 */
-	public function submit( $args = '' ) {
-		$args = wp_parse_args( $args, array(
+	public function submit( $options = '' ) {
+		$options = wp_parse_args( $options, array(
 			'skip_mail' =>
 				( $this->in_demo_mode()
 				|| $this->is_true( 'skip_mail' )
@@ -1059,7 +1072,7 @@ class WPCF7_ContactForm {
 		}
 
 		$submission = WPCF7_Submission::get_instance( $this, array(
-			'skip_mail' => $args['skip_mail'],
+			'skip_mail' => $options['skip_mail'],
 		) );
 
 		$result = array(
@@ -1330,14 +1343,14 @@ class WPCF7_ContactForm {
 	/**
 	 * Returns a WordPress shortcode for this contact form.
 	 */
-	public function shortcode( $args = '' ) {
-		$args = wp_parse_args( $args, array(
+	public function shortcode( $options = '' ) {
+		$options = wp_parse_args( $options, array(
 			'use_old_format' => false
 		) );
 
 		$title = str_replace( array( '"', '[', ']' ), '', $this->title );
 
-		if ( $args['use_old_format'] ) {
+		if ( $options['use_old_format'] ) {
 			$old_unit_id = (int) get_post_meta( $this->id, '_old_cf7_unit_id', true );
 
 			if ( $old_unit_id ) {
@@ -1358,7 +1371,7 @@ class WPCF7_ContactForm {
 		}
 
 		return apply_filters( 'wpcf7_contact_form_shortcode',
-			$shortcode, $args, $this
+			$shortcode, $options, $this
 		);
 	}
 }