Skip to content

gw-draft-resume-change-notice.php: Added new snippet that displays a notice when a user resumes draft from a new IP/UA. #1164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saifsultanc merged 6 commits into from
Nov 3, 2025
Merged

gw-draft-resume-change-notice.php: Added new snippet that displays a notice when a user resumes draft from a new IP/UA. #1164

Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c84ab52
`gw-draft-resume-change-notice.php`: Added new snippet.
SebastianWiz Sep 11, 2025
3018ec3
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Sep 15, 2025
ba8fb22
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Sep 15, 2025
aad73a5
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
42a33c0
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
ea46c47
`gw-draft-resume-change-notice.php`: Added new snippet that displays …
SebastianWiz Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions gravity-forms/gw-draft-resume-change-notice.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
<?php
/**
* Gravity Wiz // Gravity Forms // Draft Resume Change Notice
* https://gravitywiz.com/
*
* Use this snippet to display a notice when the user resumes draft from a different location, browser or device.
*/
add_filter( 'gform_get_form_filter', function( $form_markup, $form ) {

if ( empty( $_GET['gf_token'] ) ) {
return $form_markup;
}
$token = sanitize_text_field( wp_unslash( $_GET['gf_token'] ) );

global $wpdb;
$table = GFFormsModel::get_draft_submissions_table_name();

// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$draft = $wpdb->get_row(
$wpdb->prepare(

Check warning on line 20 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed) 

Incorrect number of replacements passed to $wpdb-&gt;prepare(). Found 1 replacement parameters, expected 0.
sprintf(
"SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s",

Check failure on line 22 in gravity-forms/gw-draft-resume-change-notice.php

View workflow job for this annotation

GitHub Actions / PHPCS (Files Changed) 

String &quot;SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s&quot; does not require double quotes; use single quotes instead
esc_sql( $table )
),
$uuid
)
);
Copy link

@coderabbitai coderabbitai bot Oct 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: undefined variable and incorrect prepare() usage.

Line 25 references $uuid but the variable is defined as $token on Line 13. This will cause a fatal error.

Additionally, the current sprintf/esc_sql/prepare combination is incorrect:

  • sprintf consumes the %s placeholder, leaving %%s (which becomes %s after sprintf)
  • $wpdb->prepare then expects a placeholder but the string already has the table name interpolated
  • This causes the "incorrect number of replacements" warning from PHPCS and the pipeline

Table names are identifiers and cannot be prepared with $wpdb->prepare. The correct approach is direct interpolation with a comprehensive phpcs:ignore comment.

Apply this diff to fix both issues:

-    // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+	// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
 	$draft = $wpdb->get_row(
 		$wpdb->prepare(
-			sprintf(
-				"SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s",
-				esc_sql( $table )
-			),
-			$uuid
+			"SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
+			$token
 		)
 	);
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$draft = $wpdb->get_row(
$wpdb->prepare(
sprintf(
"SELECT form_id, ip, submission FROM `%s` WHERE uuid = %%s",
esc_sql( $table )
),
$uuid
)
);
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared -- $table is a trusted GF identifier; token is prepared.
$draft = $wpdb->get_row(
$wpdb->prepare(
"SELECT form_id, ip, submission FROM {$table} WHERE uuid = %s",
$token
)
);
🧰 Tools
🪛 GitHub Actions: PHP Lint (PR)

[warning] 20-20: Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.

[error] 22-22: String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead

🪛 GitHub Check: PHPCS (Files Changed)

[failure] 22-22:
String "SELECT form_id, ip, submission FROM %s WHERE uuid = %%s" does not require double quotes; use single quotes instead

[warning] 20-20:
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 0.

🤖 Prompt for AI Agents 
In gravity-forms/gw-draft-resume-change-notice.php around lines 18 to 27, the
query uses an undefined $uuid and misuses sprintf/esc_sql with $wpdb->prepare
causing replacement/count errors; change the variable to $token (the defined
name), stop using sprintf to insert the table name into the prepared statement,
instead build the SQL string by interpolating the esc_sql($table) directly (with
a phpcs:ignore comment for table name interpolation), and call $wpdb->prepare
with a SQL string that contains a single %s placeholder for the token and pass
$token as the parameter so only the token is prepared.


if ( ! $draft ) {
return $form_markup;
}

if ( (int) $form['id'] !== (int) $draft->form_id ) {
return $form_markup;
}

$submission_data = json_decode( $draft->submission, true );
$submission_data = is_array( $submission_data ) ? $submission_data : array();

$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
Comment on lines +40 to +41
Copy link

@coderabbitai coderabbitai bot Oct 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Consider sanitizing the current User-Agent.

While the current User-Agent is only used for comparison and not stored or displayed, sanitizing external input is a best practice. Consider using sanitize_text_field() for consistency.

Apply this diff:

 	$stored_user_agent  = $submission_data['partial_entry']['user_agent'] ?? '';
-	$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
+	$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$stored_user_agent = $submission_data['partial_entry']['user_agent'] ?? '';
$current_user_agent = isset( $_SERVER['HTTP_USER_AGENT'] )
? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) )
: '';
🤖 Prompt for AI Agents 
In gravity-forms/gw-draft-resume-change-notice.php around lines 40 to 41, the
current User-Agent from $_SERVER['HTTP_USER_AGENT'] is used raw for comparison;
sanitize it before use by passing the value through sanitize_text_field() (e.g.,
assign $current_user_agent = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ??
'' );) so comparisons use a sanitized string while leaving the stored_user_agent
unchanged.


$stored_ip = $draft->ip ?? '';
$current_ip = GFFormsModel::get_ip();

$ip_changed = ( $stored_ip && $current_ip && $stored_ip !== $current_ip );
$browser_changed = ( $stored_user_agent && $current_user_agent && $stored_user_agent !== $current_user_agent );

if ( ! $ip_changed && ! $browser_changed ) {
return $form_markup;
}

// Configure Messages
$ip_changed_message = '🌍 Your location has changed since last editing this draft';
$browser_changed_message = '💻 Your browser or device has changed since last editing this draft';
$both_changed_message = '🔒 Your location AND device have both changed since last editing this draft';

$message = $both_changed_message;
if ( $ip_changed && ! $browser_changed ) {
$message = $ip_changed_message;
} elseif ( $browser_changed && ! $ip_changed ) {
$message = $browser_changed_message;
}

$warning = '<div style="background:#fff3cd;border:1px solid #ffc107;padding:15px;margin-bottom:15px;">';
$warning .= '<strong style="color:#856404;">' . esc_html( $message ) . '</strong>';
$warning .= '</div>';

return $warning . $form_markup;

}, 10, 2 );
Loading