';
$cols = 12;
$html_before_conf_password_field = sprintf( '
', esc_attr( $cols ) );
$html .= apply_filters( 'forminator_before_conf_password_field_markup', $html_before_conf_password_field );
$html .= '
';
// Counter.
if ( ! empty( $confirm_password_description ) || ( ! empty( $limit ) && ! empty( $limit_type ) ) ) {
$html .= sprintf( '
', $id . '-description' );
if ( ! empty( $confirm_password_description ) ) {
$html .= self::convert_markdown( wp_kses_post( $confirm_password_description ) );
}
if ( ( ! empty( $limit ) && ! empty( $limit_type ) ) ) {
$html .= sprintf( '0 / %s', esc_attr( $limit ), esc_attr( $limit_type ), esc_html( $limit ) );
}
$html .= '';
}
}
return apply_filters( 'forminator_field_password_markup', $html, $field );
}
/**
* Get password visibility toggle button markup.
*
* @param string $input_id The ID of the password input.
* @param array $field Field settings.
*
* @return string
*/
private function get_password_toggle_markup( $input_id, $field = array() ) {
$show_label = esc_attr__( 'Show password', 'forminator' );
$hide_label = esc_attr__( 'Hide password', 'forminator' );
$eye_show = 'forminator-icon-eye';
$eye_hide = 'forminator-icon-eye-hide';
$markup = sprintf(
'
',
esc_attr( $input_id ),
$show_label,
$hide_label,
$show_label,
$show_label,
$eye_show,
$eye_hide,
$show_label
);
/**
* Filter the password toggle button markup.
*
* @since 1.54.0
*
* @param string $markup The toggle button HTML markup.
* @param string $input_id The ID of the password input.
* @param array $field The field settings array.
*/
return apply_filters( 'forminator_password_toggle_markup', $markup, $input_id, $field );
}
/**
* Calculate the password score
*
* @since 1.11
*
* @param string $password Password.
* @param string $level Strength level: 'short', 'bad', 'good', or 'strong'.
*
* @return bool
*/
private function get_password_strength( $password = '', $level = 'strong' ) {
if ( ! in_array( $level, self::$strength_levels, true ) ) {
$level = 'strong';
}
$symbol_size = 0;
$strlen = mb_strlen( $password );
// Password is optional and empty so don't check strength.
if ( 0 === $strlen ) {
return true;
}
$min_lengths = array(
'short' => 4,
'bad' => 6,
'good' => 8,
'strong' => 8,
);
if ( $strlen < $min_lengths[ $level ] ) {
return false;
}
// 'short' level only checks minimum length.
if ( 'short' === $level ) {
return true;
}
// Enforce required character classes before scoring.
$has_digit = (bool) preg_match( '/[0-9]/', $password );
$has_lower = (bool) preg_match( '/[a-z]/', $password );
$has_upper = (bool) preg_match( '/[A-Z]/', $password );
$has_special = (bool) preg_match( '/[^a-zA-Z0-9]/', $password );
if ( 'bad' === $level && ! ( ( $has_lower || $has_upper ) && $has_digit ) ) {
return false;
}
if ( 'good' === $level && ! ( $has_lower && $has_upper && $has_digit ) ) {
return false;
}
if ( 'strong' === $level && ! ( $has_lower && $has_upper && $has_digit && $has_special ) ) {
return false;
}
if ( $has_digit ) {
$symbol_size += 10;
}
if ( $has_lower ) {
$symbol_size += 20;
}
if ( $has_upper ) {
$symbol_size += 20;
}
if ( $has_special ) {
$symbol_size += 30;
}
if ( preg_match( '/[=!\-@.,_*#&?^`%$+\/{\[\]|}^?~]/', $password ) ) {
$symbol_size += 30;
}
$nat_log = log( pow( $symbol_size, $strlen ) );
$score = $nat_log / log( 2 );
$thresholds = array(
'bad' => 25,
'good' => 40,
'strong' => 54,
);
return $score >= $thresholds[ $level ];
}
/**
* Get all default validation messages keyed by strength level.
*
* This is the single source of truth shared by validation and the admin UI
*
* @since 1.55
*
* @return array
*/
public static function get_strength_messages() {
return array(
'short' => __( 'Password must be at least 4 characters.', 'forminator' ),
'bad' => __( 'Password must be at least 6 characters, with letters and numbers.', 'forminator' ),
'good' => __( 'Password must be at least 8 characters, with uppercase, lowercase, and numbers.', 'forminator' ),
'strong' => __( 'Password must be at least 8 characters, with uppercase, lowercase, numbers, and symbols.', 'forminator' ),
);
}
/**
* Get default validation message for a password strength level.
*
* @since 1.55
*
* @param string $level Strength level: 'short', 'bad', 'good', or 'strong'.
*
* @return string
*/
private function get_default_strength_message( $level = 'strong' ) {
if ( ! in_array( $level, self::$strength_levels, true ) ) {
$level = 'strong';
}
$messages = self::get_strength_messages();
return $messages[ $level ];
}
/**
* Return field inline validation rules
*
* @since 1.0
* @return string
*/
public function get_validation_rules() {
$field = $this->field;
$id = self::get_property( 'element_id', $field );
$is_required = $this->is_required( $field );
$has_limit = $this->has_limit( $field );
$rules = '';
$is_confirm = self::get_property( 'confirm-password', $field, '', 'bool' );
$min_password_strength = self::get_property( 'strength', $field );
$module_id = isset( $this->form_settings['form_id'] ) ? $this->form_settings['form_id'] : '';
$module_selector = '';
if ( ! empty( $module_id ) ) {
$module_selector = "#forminator-module-{$module_id}";
$render_id = Forminator_Render_Form::get_render_id( $module_id );
$module_selector .= "[data-forminator-render='{$render_id}']";
}
if ( ! isset( $field['limit'] ) ) {
$field['limit'] = 0;
}
$rules = '"' . $this->get_id( $field ) . '": {';
if ( $is_required || $has_limit ) {
if ( $is_required ) {
$rules .= '"required": true,';
}
if ( $has_limit ) {
if ( isset( $field['limit_type'] ) && 'characters' === trim( $field['limit_type'] ) ) {
$rules .= '"maxlength": ' . $field['limit'] . ',';
} else {
$rules .= '"maxwords": ' . $field['limit'] . ',';
}
}
}
// Min password strength.
if ( in_array( $min_password_strength, self::$strength_levels, true ) ) {
$rules .= '"forminatorPasswordStrength": "' . esc_js( $min_password_strength ) . '",';
}
$rules .= '},';
if ( $is_confirm ) {
$rules .= '"' . $this->confirm_prefix . '_' . $this->get_id( $field ) . '": {';
if ( $is_required ) {
$rules .= '"required": true,';
}
$rules .= '"equalTo": "' . $module_selector . ' #' . self::get_field_id( $this->get_id( $field ) ) . '",' . "\n";
$rules .= '},';
}
return apply_filters( 'forminator_field_text_validation_rules', $rules, $id, $field );
}
/**
* Return field inline validation errors
*
* @since 1.0
* @return string
*/
public function get_validation_messages() {
$field = $this->field;
$id = self::get_property( 'element_id', $field );
$is_required = $this->is_required( $field );
$has_limit = $this->has_limit( $field );
$messages = '';
$required_message = self::get_property( 'required_message', $field, self::$default_required_messages[ $this->type ] );
$is_confirm = self::get_property( 'confirm-password', $field, '', 'bool' );
$min_password_strength = self::get_property( 'strength', $field );
$messages .= '"' . $this->get_id( $field ) . '": {';
if ( $is_required || $has_limit ) {
if ( $is_required ) {
$required_error = apply_filters(
'forminator_password_field_required_validation_message',
$required_message,
$id,
$field
);
$messages .= '"required": "' . forminator_addcslashes( $required_error ) . '",' . "\n";
}
if ( $has_limit ) {
if ( isset( $field['limit_type'] ) && 'characters' === trim( $field['limit_type'] ) ) {
$max_length_error = apply_filters(
'forminator_text_field_characters_validation_message',
esc_html__( 'You exceeded the allowed amount of characters. Please check again.', 'forminator' ),
$id,
$field
);
$messages .= '"maxlength": "' . forminator_addcslashes( $max_length_error ) . '",' . "\n";
} else {
$max_words_error = apply_filters(
'forminator_text_field_words_validation_message',
esc_html__( 'You exceeded the allowed amount of words. Please check again.', 'forminator' ),
$id,
$field
);
$messages .= '"maxwords": "' . forminator_addcslashes( $max_words_error ) . '",' . "\n";
}
}
}
// Min password strength.
if ( in_array( $min_password_strength, self::$strength_levels, true ) ) {
$strength_validation_message = self::get_property( 'strength_validation_message', $field, '' );
$min_strength_error = apply_filters(
'forminator_text_field_min_password_strength_validation_message',
! empty( $strength_validation_message ) ? $strength_validation_message : $this->get_default_strength_message( $min_password_strength ),
$id,
$field
);
$messages .= '"forminatorPasswordStrength": "' . forminator_addcslashes( $min_strength_error ) . '",' . "\n";
}
$messages .= '},';
if ( $is_confirm ) {
$required_confirm_message = self::get_property( 'required_confirm_message', $field, '' );
$messages .= '"' . $this->confirm_prefix . '_' . $this->get_id( $field ) . '": {';
if ( $is_required ) {
$required_error = apply_filters(
'forminator_confirm_password_field_required_validation_message',
! empty( $required_confirm_message ) ? $required_confirm_message : esc_html__( 'You must confirm your chosen password.', 'forminator' ),
$id,
$field
);
$messages .= '"required": "' . forminator_addcslashes( $required_error ) . '",' . "\n";
}
$validation_message_not_match = self::get_property( 'validation_message', $field, '' );
$not_match_error = apply_filters(
'forminator_confirm_password_field_not_match_validation_message',
! empty( $validation_message_not_match ) ? $validation_message_not_match : esc_html__( 'Your passwords don\'t match.', 'forminator' ),
$id,
$field
);
$messages .= '"equalTo": "' . forminator_addcslashes( $not_match_error ) . '",' . "\n";
$messages .= '},';
}
return $messages;
}
/**
* Field back-end validation
*
* @since 1.0
*
* @param array $field Field.
* @param array|string $data Data.
*/
public function validate( $field, $data ) {
$id = self::get_property( 'element_id', $field );
$min_password_strength = self::get_property( 'strength', $field );
$is_confirm = self::get_property( 'confirm-password', $field, '', 'bool' );
// TODO: Remove old property "validation".
if ( ! isset( $field['limit'] ) ) {
$field['limit'] = 0;
}
if ( $this->is_required( $field ) ) {
$required_message = self::get_property( 'required_message', $field, self::$default_required_messages[ $this->type ] );
if ( empty( $data ) ) {
$this->validation_message[ $id ] = apply_filters(
'forminator_password_field_required_validation_message',
$required_message,
$id,
$field
);
}
}
if ( $this->has_limit( $field ) ) {
if ( ( isset( $field['limit_type'] ) && 'characters' === trim( $field['limit_type'] ) ) && ( strlen( $data ) > $field['limit'] ) ) {
$this->validation_message[ $id ] = apply_filters(
'forminator_text_field_characters_validation_message',
esc_html__( 'You exceeded the allowed amount of characters. Please check again.', 'forminator' ),
$id,
$field
);
} elseif ( ( isset( $field['limit_type'] ) && 'words' === trim( $field['limit_type'] ) ) ) {
$words = preg_split( '/\s+/', $data );
if ( is_array( $words ) && count( $words ) > $field['limit'] ) {
$this->validation_message[ $id ] = apply_filters(
'forminator_text_field_words_validation_message',
esc_html__( 'You exceeded the allowed amount of words. Please check again.', 'forminator' ),
$id,
$field
);
}
}
}
if ( in_array( $min_password_strength, self::$strength_levels, true ) ) {
$strength_validation_message = self::get_property( 'strength_validation_message', $field, '' );
if ( ! $this->get_password_strength( $data, $min_password_strength ) ) {
$this->validation_message[ $id ] = apply_filters(
'forminator_text_field_min_password_strength_validation_message',
! empty( $strength_validation_message ) ? $strength_validation_message : $this->get_default_strength_message( $min_password_strength ),
$id,
$field
);
}
}
$password = Forminator_CForm_Front_Action::$prepared_data[ $id ];
$confirm_password = ! empty( Forminator_CForm_Front_Action::$prepared_data[ 'confirm_' . $id ] ) ? Forminator_CForm_Front_Action::$prepared_data[ 'confirm_' . $id ] : '';
if ( $is_confirm && ! empty( $data ) && $password !== $confirm_password ) {
$validation_message_not_match = self::get_property( 'validation_message', $field, '' );
$validation_message_not_match_message = apply_filters(
'forminator_confirm_password_field_not_match_validation_message',
! empty( $validation_message_not_match ) ? $validation_message_not_match : esc_html__( 'Your passwords don\'t match.', 'forminator' ),
$id,
$field
);
$this->validation_message[ $id ] = $validation_message_not_match_message;
$this->validation_message[ 'confirm_' . $id ] = $validation_message_not_match_message;
}
}
/**
* Sanitize data
*
* @since 1.0.2
*
* @param array $field Field.
* @param array|string $data - the data to be sanitized.
*
* @return array|string $data - the data after sanitization
*/
public function sanitize( $field, $data ) {
$original_data = $data;
if ( is_array( $data ) ) {
$data = $this->sanitize_array_field( $data );
} else {
$data = $this->sanitize_field( $data );
}
return apply_filters( 'forminator_field_text_sanitize', $data, $field, $original_data );
}
/**
* Sanitize password array field.
*
* @param array $data Array values.
*
* @return mixed
*/
private function sanitize_array_field( $data ) {
foreach ( $data as &$value ) {
if ( is_array( $value ) ) {
$value = $this->sanitize_array_field( $value );
} else {
$value = $this->sanitize_field( $value );
}
}
return $data;
}
/**
* Sanitize password field.
*
* @param string $data Password value.
*
* @return string
*/
private function sanitize_field( $data ) {
// Password doesn't required sanitize as it is hashed while processing/save. Also it fails to support tags and characters like %1d, %20.
// Add slashes as we removed from original post while sanitize post data (It fails to support quotation marks).
return wp_slash( $data );
}
/**
* Remove password-N fields
*
* @param array $data Submitted data.
* @return array
*/
public static function remove_password_field_values( $data ) {
foreach ( $data as $key => $value ) {
if ( false !== stripos( $key, 'password-' ) ) {
unset( $data[ $key ] );
}
}
return $data;
}
}