fix: enforce submission gate in AJAX submit_post (unauthenticated post via subscription-gated form)

includes/Ajax/Frontend_Form_Ajax.php

@@ -35,7 +35,7 @@
     public function submit_post() {
         check_ajax_referer( 'wpuf_form_add' );
         add_filter( 'wpuf_form_fields', [ $this, 'add_field_settings' ] );
         @header( 'Content-Type: application/json; charset=' . get_option( 'blog_charset' ) );
 
         $form_id               = isset( $_POST['form_id'] ) ? intval( wp_unslash( $_POST['form_id'] ) ) : 0;
         $form                  = new Form( $form_id );
@@ -123,9 +123,9 @@
             foreach ( $protected_shortcodes as $shortcode ) {
                 $search_for = '[' . $shortcode;
                 if ( strpos( $current_data, $search_for ) !== false ) {
                     wpuf()->ajax->send_error( sprintf(
                         // translators: %s is shortcode
                         __( 'Using %s as shortcode is restricted', 'wp-user-frontend' ), $shortcode ) );
                 }
             }
         }
@@ -177,6 +177,24 @@
             wpuf()->ajax->send_error( __( 'You must be logged in to submit posts.', 'wp-user-frontend' ) );
         }
 
+        // Enforce the form's submission gate (mandatory subscription, pack ownership,
+        // post-count limit) for new posts. The renderer checks this before showing the
+        // form, but the AJAX handler must re-check server-side — otherwise a scraped
+        // site-wide guest nonce can be replayed against a subscription-gated form to
+        // create a post with no order and no pending-payment status.
+        if ( ! isset( $_POST['post_id'] ) ) {
+            [ $user_can_post, $submission_info ] = $form->is_submission_open( $form, $this->form_settings );
+            $user_can_post                       = apply_filters( 'wpuf_can_post', $user_can_post, $form_id, $this->form_settings );
+
+            if ( 'yes' !== $user_can_post ) {
+                wpuf()->ajax->send_error(
+                    ! empty( $submission_info )
+                        ? $submission_info
+                        : __( 'You are not allowed to submit to this form.', 'wp-user-frontend' )
+                );
+            }
+        }
+
         [ $post_vars, $taxonomy_vars, $meta_vars ] = $this->get_input_fields( $this->form_fields );
 
         if ( ! isset( $_POST['post_id'] ) ) {
@@ -193,9 +211,9 @@
             $this->on_edit_no_check_recaptcha( $post_vars );
         }
 
         $is_update           = false;
         // $default_post_author = wpuf_get_option( 'default_post_owner', 'wpuf_frontend_posting', 1 );
         $post_author         = $this->wpuf_get_post_user();
 
         $allowed_tags = wp_kses_allowed_html( 'post' );
         $postarr = [
@@ -207,7 +225,7 @@
             'post_excerpt' => isset( $_POST['post_excerpt'] ) ? strip_shortcodes( wp_kses( wp_unslash( $_POST['post_excerpt'] ), $allowed_tags ) ) : '',
         ];
 
         // $charging_enabled = wpuf_get_option( 'charge_posting', 'wpuf_payment' );
         $charging_enabled = '';
         $form             = new Form( $form_id );
         $payment_options  = $form->is_charging_enabled();
@@ -228,7 +246,7 @@
         //if date is set and assigned as publish date
         if ( isset( $_POST['wpuf_is_publish_time'] ) ) {
             if ( ! empty( $_POST[ $_POST['wpuf_is_publish_time'] ] ) ) {
                 // $postarr['post_date'] = date( 'Y-m-d H:i:s', strtotime( str_replace( array( ':', '/' ), '-', $_POST[$_POST['wpuf_is_publish_time']] ) ) );
                 $date_time = explode( ' ', sanitize_text_field( wp_unslash( ( $_POST[ $_POST['wpuf_is_publish_time'] ] ) ) ) );
 
                 if ( ! empty( $date_time[0] ) ) {
@@ -303,7 +321,7 @@
             if ( 'pending' === get_post_meta( $post_id, '_wpuf_payment_status', true ) ) {
                 $postarr['post_status'] = 'pending';
             }
         } else {
             if ( isset( $this->form_settings['comment_status'] ) ) {
                 $postarr['comment_status'] = $this->form_settings['comment_status'];
             }
@@ -396,7 +414,7 @@
             // find our if any images in post content and associate them
             if ( ! empty( $postarr['post_content'] ) ) {
                 $dom = new DOMDocument();
                 @$dom->loadHTML( $postarr['post_content'] );
                 $images = $dom->getElementsByTagName( 'img' );
 
                 if ( $images->length ) {
@@ -452,7 +470,7 @@
             } else {
                 $redirect_to = get_permalink( $post_id );
             }
         } else {
             if ( $this->form_settings['redirect_to'] === 'page' ) {
                 $redirect_to = get_permalink( $this->form_settings['page_id'] );
             } elseif ( $this->form_settings['redirect_to'] === 'url' ) {
@@ -465,8 +483,8 @@
         }
 
         if ( $charging_enabled === 'yes' && isset( $this->form_settings['payment_options'] )
              && 'enable_pay_per_post' === $this->form_settings['payment_options']
              && ! $is_update
         ) {
             $redirect_to = add_query_arg(
                 [
@@ -528,13 +546,13 @@
                 $to     = implode(
                     ',',
                     array_filter(
                         array_map( static function ( $addr ) {
                             $addr = trim( $addr );
                             return is_email( $addr ) ? $addr : null;
                         }, explode( ',', $to_raw ) )
                     )
                 );
                 if ( empty( $to ) ) {
                     // Nothing valid to send to – skip mail sending
                 } else {
                     $subject   = $this->prepare_mail_body( $edit_subject, $post_author, $post_id );
@@ -678,7 +696,7 @@
 
         // 3) Very old separate fields (only for edit notifications)
         if ( ! $enabled && 'edit' === $type && ! empty( $this->form_settings['notification_' . $type ] )
              && wpuf_is_checkbox_or_toggle_on( $this->form_settings['notification_' . $type ] ) ) {
             $enabled = true;
             $body    = isset( $this->form_settings['notification_' . $type . '_body' ] ) ? $this->form_settings['notification_' . $type . '_body' ] : '';
             $to      = isset( $this->form_settings['notification_' . $type . '_to' ] ) ? $this->form_settings['notification_' . $type . '_to' ] : '';