*/
public static function sureforms_get_integration() {
- $suretrigger_connected = apply_filters( 'suretriggers_is_user_connected', '' );
+ $suretrigger_connected = apply_filters( 'suretriggers_is_user_connected', '' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- SureTriggers' own filter; the name must match SureTriggers exactly to integrate.
$logo_sure_triggers = file_get_contents( plugin_dir_path( SRFM_FILE ) . 'images/suretriggers.svg' );
$logo_full = file_get_contents( plugin_dir_path( SRFM_FILE ) . 'images/suretriggers_full.svg' );
$logo_sure_mails = file_get_contents( plugin_dir_path( SRFM_FILE ) . 'images/suremails.svg' );
@@ -2163,7 +2163,7 @@ public static function apply_filters_as_array( $filter_name, $default, ...$args
}
// Apply the filter with additional arguments.
- $filtered = apply_filters( $filter_name, $default, ...$args );
+ $filtered = apply_filters( $filter_name, $default, ...$args ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- Generic dynamic-filter dispatcher; the caller supplies the (already prefixed) hook name.
// Return filtered result if it's a non-empty array.
return is_array( $filtered ) && ! empty( $filtered ) ? $filtered : $default;
diff --git a/inc/lib/bsf-analytics/changelog.txt b/inc/lib/bsf-analytics/changelog.txt
index 88857c4d6..e6b2d6cf6 100644
--- a/inc/lib/bsf-analytics/changelog.txt
+++ b/inc/lib/bsf-analytics/changelog.txt
@@ -1,3 +1,9 @@
+v1.1.28 - 22-June-2026
+- Fix: Deactivation survey loaded a non-existent RTL stylesheet (`feedback.min-rtl.css`) producing a 404 in RTL locales. Registered the file suffix so the correct `feedback-rtl.min.css` is requested.
+
+v1.1.27 - 16-June-2026
+- Improvement: Added `SureDonation` slug to UTM analytics.
+
v1.1.26 - 20-April-2026
- Improvement: Switched from `Astra_Notices` to `BSF_Admin_Notices`.
diff --git a/inc/lib/bsf-analytics/modules/deactivation-survey/classes/class-deactivation-survey-feedback.php b/inc/lib/bsf-analytics/modules/deactivation-survey/classes/class-deactivation-survey-feedback.php
index c51db14ee..b3b779228 100644
--- a/inc/lib/bsf-analytics/modules/deactivation-survey/classes/class-deactivation-survey-feedback.php
+++ b/inc/lib/bsf-analytics/modules/deactivation-survey/classes/class-deactivation-survey-feedback.php
@@ -207,6 +207,7 @@ public static function load_form_styles() {
wp_enqueue_style( 'uds-feedback-style', $dir_path . 'assets/css/feedback' . $file_ext . '.css', array(), BSF_ANALYTICS_VERSION );
wp_style_add_data( 'uds-feedback-style', 'rtl', 'replace' );
+ wp_style_add_data( 'uds-feedback-style', 'suffix', $file_ext );
}
/**
diff --git a/inc/lib/bsf-analytics/modules/utm-analytics.php b/inc/lib/bsf-analytics/modules/utm-analytics.php
index c9763ec27..86479f048 100644
--- a/inc/lib/bsf-analytics/modules/utm-analytics.php
+++ b/inc/lib/bsf-analytics/modules/utm-analytics.php
@@ -49,6 +49,7 @@ class BSF_UTM_Analytics {
'surecontact',
'surecookie',
'suredash',
+ 'suredonation',
'sureforms',
'suremails',
'surerank',
diff --git a/inc/lib/bsf-analytics/version.json b/inc/lib/bsf-analytics/version.json
index 6f450d022..c25d50351 100644
--- a/inc/lib/bsf-analytics/version.json
+++ b/inc/lib/bsf-analytics/version.json
@@ -1,3 +1,3 @@
{
- "bsf-analytics-ver": "1.1.26"
+ "bsf-analytics-ver": "1.1.28"
}
diff --git a/inc/migrator/importers/ninja-importer.php b/inc/migrator/importers/ninja-importer.php
index e3523fc4c..7d62c5a6d 100644
--- a/inc/migrator/importers/ninja-importer.php
+++ b/inc/migrator/importers/ninja-importer.php
@@ -196,7 +196,7 @@ protected function get_source_forms() {
'SELECT id, title FROM %s ORDER BY id ASC',
esc_sql( $forms_table )
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$rows = $wpdb->get_results( $query, ARRAY_A );
if ( ! is_array( $rows ) ) {
return [];
@@ -347,7 +347,7 @@ protected function fetch_fields( $form_id ) {
esc_sql( $fields_table ),
(int) $form_id
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$rows = $wpdb->get_results( $fields_query, ARRAY_A );
if ( ! is_array( $rows ) || empty( $rows ) ) {
return [];
@@ -363,7 +363,7 @@ protected function fetch_fields( $form_id ) {
esc_sql( $field_meta_table ),
$ids_sql
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$meta_rows = $wpdb->get_results( $meta_query, ARRAY_A );
$meta_by_field = [];
@@ -408,7 +408,7 @@ protected function fetch_form_meta( $form_id ) {
esc_sql( $table ),
(int) $form_id
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$rows = $wpdb->get_results( $query, ARRAY_A );
$out = [];
if ( is_array( $rows ) ) {
@@ -449,7 +449,7 @@ protected function fetch_actions( $form_id ) {
esc_sql( $rels_table ),
(int) $form_id
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$rows = $wpdb->get_results( $query, ARRAY_A );
if ( ! is_array( $rows ) || empty( $rows ) ) {
$this->actions_cache = [];
@@ -465,7 +465,7 @@ protected function fetch_actions( $form_id ) {
esc_sql( $meta_table ),
$ids_sql
);
- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table names from $wpdb->prefix and IDs are int-cast/esc_sql'd; not user input.
$meta_rows = $wpdb->get_results( $meta_query, ARRAY_A );
$by_id = [];
if ( is_array( $meta_rows ) ) {
diff --git a/inc/page-builders/bricks/elements/form-widget.php b/inc/page-builders/bricks/elements/form-widget.php
index 79276ff75..76aab591c 100644
--- a/inc/page-builders/bricks/elements/form-widget.php
+++ b/inc/page-builders/bricks/elements/form-widget.php
@@ -519,15 +519,8 @@ public function render() {
- { Array.isArray( children ) &&
- Children.map( children, ( child, index ) => {
- if ( ! child ) {
- return child;
- }
- if ( ! child.key ) {
- throw new Error(
- 'props.key not found in , you must use `key` prop'
- );
- }
- return cloneElement( child, {
- index,
- isActive: child.key === currentTab,
- } );
- } ) }
+ { Children.map( children, ( child, index ) => {
+ if ( ! child ) {
+ return child;
+ }
+ if ( ! child.key ) {
+ throw new Error(
+ 'props.key not found in , you must use `key` prop'
+ );
+ }
+ return cloneElement( child, {
+ index,
+ isActive: child.key === currentTab,
+ } );
+ } ) }
);
};
diff --git a/src/components/page-break-settings/index.js b/src/components/page-break-settings/index.js
new file mode 100644
index 000000000..674d103f7
--- /dev/null
+++ b/src/components/page-break-settings/index.js
@@ -0,0 +1,126 @@
+/**
+ * Shared Page Break Settings controls.
+ *
+ * Reads and writes `_srfm_page_break_settings` post meta via the
+ * 'core/editor' store. Renders the same control set whether mounted in the
+ * Form Options document panel (GeneralSettings) or the Page Break block's
+ * own Inspector Controls.
+ */
+import { __ } from '@wordpress/i18n';
+import { useDispatch, useSelect } from '@wordpress/data';
+import { SelectControl, ToggleControl } from '@wordpress/components';
+import SRFMTextControl from '@Components/text-control';
+
+const PageBreakSettings = () => {
+ const pageBreakSettings = useSelect( ( select ) => {
+ const meta =
+ select( 'core/editor' ).getEditedPostAttribute( 'meta' );
+ return meta?._srfm_page_break_settings || {};
+ } );
+
+ const { editPost } = useDispatch( 'core/editor' );
+
+ function updatePageBreakSettings( option, value ) {
+ editPost( {
+ meta: {
+ _srfm_page_break_settings: {
+ ...pageBreakSettings,
+ [ option ]: value,
+ },
+ },
+ } );
+ }
+
+ return (
+ <>
+ { pageBreakSettings?.progress_indicator_type !== 'none' && (
+ <>
+
+ updatePageBreakSettings( 'toggle_label', value )
+ }
+ />
+ { pageBreakSettings?.toggle_label && (
+
+ updatePageBreakSettings(
+ 'first_page_label',
+ value
+ )
+ }
+ isFormSpecific={ true }
+ />
+ ) }
+
+ ) }
+
+ updatePageBreakSettings(
+ 'progress_indicator_type',
+ value
+ )
+ }
+ __nextHasNoMarginBottom
+ />
+
+ updatePageBreakSettings( 'next_button_text', value )
+ }
+ isFormSpecific={ true }
+ />
+
+ updatePageBreakSettings( 'back_button_text', value )
+ }
+ isFormSpecific={ true }
+ />
+
+ );
+};
+
+export default PageBreakSettings;
diff --git a/sureforms.php b/sureforms.php
index 0ee4fda8f..2dc072243 100644
--- a/sureforms.php
+++ b/sureforms.php
@@ -7,7 +7,7 @@
* Requires PHP: 7.4
* Author: SureForms
* Author URI: https://sureforms.com/
- * Version: 2.11.1
+ * Version: 2.12.0
* License: GPLv2 or later
* Text Domain: sureforms
*
@@ -25,7 +25,7 @@
define( 'SRFM_BASENAME', plugin_basename( SRFM_FILE ) );
define( 'SRFM_DIR', plugin_dir_path( SRFM_FILE ) );
define( 'SRFM_URL', plugins_url( '/', SRFM_FILE ) );
-define( 'SRFM_VER', '2.11.1' );
+define( 'SRFM_VER', '2.12.0' );
define( 'SRFM_SLUG', 'srfm' );
// ------ ADDITIONAL CONSTANTS ------- //
define( 'SRFM_FORMS_POST_TYPE', 'sureforms_form' );
@@ -35,7 +35,7 @@
define( 'SRFM_AI_MIDDLEWARE', 'https://credits.startertemplates.com/sureforms/' );
define( 'SRFM_MIDDLEWARE_BASE_URL', 'https://api.sureforms.com/' );
define( 'SRFM_BILLING_PORTAL', 'https://billing.sureforms.com/' );
-define( 'SRFM_PRO_RECOMMENDED_VER', '2.11.1' );
+define( 'SRFM_PRO_RECOMMENDED_VER', '2.12.0' );
define( 'SRFM_SURETRIGGERS_INTEGRATION_BASE_URL', 'https://app.ottokit.com/' );
diff --git a/templates/single-form.php b/templates/single-form.php
index 34020f3a9..c5c787de5 100644
--- a/templates/single-form.php
+++ b/templates/single-form.php
@@ -12,6 +12,8 @@
exit; // Exit if accessed directly.
}
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Template-scoped variables consumed only within this template, not true plugin globals.
+
$srfm_custom_post_id = absint( get_the_ID() );
$srfm_form_preview = isset( $_GET['form_preview'] ) ? boolval( wp_unslash( $_GET['form_preview'] ) ) : false; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is not required here.
$srfm_live_mode_data = Helper::get_instant_form_live_data();
diff --git a/tests/unit/inc/payments/stripe/test-stripe-helper.php b/tests/unit/inc/payments/stripe/test-stripe-helper.php
index 3a51a7d86..4a175e3ce 100644
--- a/tests/unit/inc/payments/stripe/test-stripe-helper.php
+++ b/tests/unit/inc/payments/stripe/test-stripe-helper.php
@@ -452,4 +452,31 @@ public function test_get_license_key_returns_empty_without_pro() {
$result = Stripe_Helper::get_license_key();
$this->assertSame( '', $result );
}
+
+ // ──────────────────────────────────────────────
+ // is_transaction_present (public) - payments table presence check
+ // ──────────────────────────────────────────────
+
+ public function test_is_transaction_present_matches_payments_table_state() {
+ global $wpdb;
+
+ $result = Stripe_Helper::is_transaction_present();
+ $this->assertIsBool( $result, 'is_transaction_present() must always return a boolean.' );
+
+ // The boolean must reflect the actual row state of the payments table:
+ // true only when at least one transaction row exists, false when the table
+ // is empty or absent. Computed from a direct count here (read-only, no mutation).
+ $table = \SRFM\Inc\Payments\Payments::get_instance()->get_tablename();
+ $expected = false;
+ if ( is_string( $table ) && '' !== $table ) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+ $table_exists = $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %s', $table ) ) === $table;
+ if ( $table_exists ) {
+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+ $expected = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$table}" ) > 0;
+ }
+ }
+
+ $this->assertSame( $expected, $result );
+ }
}
diff --git a/tests/unit/inc/payments/test-payment-helper.php b/tests/unit/inc/payments/test-payment-helper.php
index 09165e55a..ba1e32049 100644
--- a/tests/unit/inc/payments/test-payment-helper.php
+++ b/tests/unit/inc/payments/test-payment-helper.php
@@ -574,6 +574,125 @@ public function test_validate_amount_against_config_calc_number_fails_safe() {
$this->assertFalse( $result['valid'] );
}
+ // --- resolve_payment_user ---
+
+ public function test_resolve_payment_user_non_array_returns_zero() {
+ $this->assertSame( 0, Payment_Helper::resolve_payment_user( 'not-an-array' ) );
+ }
+
+ public function test_resolve_payment_user_empty_payment_returns_zero() {
+ $this->assertSame( 0, Payment_Helper::resolve_payment_user( [] ) );
+ }
+
+ public function test_resolve_payment_user_guest_unknown_email_returns_zero() {
+ // Guest checkout (no entry user_id) with an email matching no WP user resolves to 0.
+ $payment = [
+ 'entry_id' => 0,
+ 'customer_email' => 'no-such-user-' . uniqid() . '@example.com',
+ ];
+ $this->assertSame( 0, Payment_Helper::resolve_payment_user( $payment ) );
+ }
+
+ public function test_resolve_payment_user_matches_user_by_customer_email() {
+ // Falls back to a WP user matching customer_email when there is no entry user_id.
+ $user_id = self::factory()->user->create( [ 'user_email' => 'buyer-resolve@example.com' ] );
+ $payment = [
+ 'entry_id' => 0,
+ 'customer_email' => 'buyer-resolve@example.com',
+ ];
+ $this->assertSame( $user_id, Payment_Helper::resolve_payment_user( $payment ) );
+ }
+
+ // --- build_payment_context ---
+
+ public function test_build_payment_context_non_array_returns_defaults() {
+ $context = Payment_Helper::build_payment_context( 'not-an-array' );
+ $this->assertIsArray( $context );
+ foreach ( [ 'form_id', 'entry_id', 'user_id', 'customer_email', 'type', 'gateway', 'mode' ] as $key ) {
+ $this->assertArrayHasKey( $key, $context, "Context missing '{$key}'" );
+ }
+ $this->assertSame( 0, $context['form_id'] );
+ $this->assertSame( 0, $context['entry_id'] );
+ $this->assertSame( 0, $context['user_id'] );
+ $this->assertSame( '', $context['customer_email'] );
+ $this->assertSame( '', $context['type'] );
+ $this->assertSame( '', $context['gateway'] );
+ $this->assertSame( '', $context['mode'] );
+ }
+
+ public function test_build_payment_context_resolves_and_sanitizes_fields() {
+ $user_id = self::factory()->user->create( [ 'user_email' => 'buyer-context@example.com' ] );
+ $payment = [
+ 'form_id' => '42',
+ 'entry_id' => 0,
+ 'customer_email' => 'buyer-context@example.com',
+ 'type' => 'subscription',
+ 'gateway' => 'stripe',
+ 'mode' => 'test',
+ ];
+
+ $context = Payment_Helper::build_payment_context( $payment );
+
+ // Numeric strings are cast to int, strings sanitized, and user_id resolved via email.
+ $this->assertSame( 42, $context['form_id'] );
+ $this->assertSame( 0, $context['entry_id'] );
+ $this->assertSame( $user_id, $context['user_id'] );
+ $this->assertSame( 'buyer-context@example.com', $context['customer_email'] );
+ $this->assertSame( 'subscription', $context['type'] );
+ $this->assertSame( 'stripe', $context['gateway'] );
+ $this->assertSame( 'test', $context['mode'] );
+ }
+
+ /**
+ * An unresolved hidden-field amount source (a hidden field whose default is a
+ * non-numeric smart tag, so resolve_server_side_variable_amount() returns null and
+ * there is no Pro recompute handler) must FAIL SAFE when there is no positive
+ * minimum-amount floor. Without the guard the charge would fall through to a zero
+ * floor and accept any amount — the unauthenticated underpayment bypass flagged by
+ * the WordPress.org scanner. With a positive minimum, the documented dynamic-prefill
+ * behavior is preserved: charges at/above the floor are accepted, below are rejected.
+ */
+ public function test_validate_amount_against_config_unresolved_hidden_fails_safe() {
+ $form_id = self::factory()->post->create( [ 'post_content' => '' ] );
+
+ $config = static function ( $minimum_amount ) {
+ return [
+ 'pay123' => [
+ 'block_id' => 'pay123',
+ 'amount_type' => 'variable',
+ 'minimum_amount' => $minimum_amount,
+ 'variable_amount_field' => 'amount',
+ 'variable_amount_field_block_name' => 'srfm/hidden',
+ ],
+ 'hid456' => [
+ 'block_id' => 'hid456',
+ 'block_name' => 'srfm/hidden',
+ 'slug' => 'amount',
+ // Non-numeric smart-tag default => resolve_server_side_variable_amount() returns null.
+ 'defaultValue' => '{get_input:amount}',
+ ],
+ ];
+ };
+
+ // Submitted hidden value is present (so we pass the "value required" check) but must
+ // never be trusted as the price.
+ $form_data = [ 'srfm-hidden-hid456-lbl-QW1vdW50-amount' => '10' ];
+
+ // minimum_amount = 0: nothing safe to validate against => reject.
+ update_post_meta( $form_id, '_srfm_block_config', $config( 0 ) );
+ $no_floor = Payment_Helper::validate_amount_against_config( 'pay123', $form_id, $form_data, 10.0 );
+ $this->assertFalse( $no_floor['valid'] );
+
+ // minimum_amount = 50: dynamic-prefill preserved — at/above floor accepted, below rejected.
+ update_post_meta( $form_id, '_srfm_block_config', $config( 50 ) );
+
+ $above = Payment_Helper::validate_amount_against_config( 'pay123', $form_id, $form_data, 100.0 );
+ $this->assertTrue( $above['valid'] );
+
+ $below = Payment_Helper::validate_amount_against_config( 'pay123', $form_id, $form_data, 10.0 );
+ $this->assertFalse( $below['valid'] );
+ }
+
private function call_private_method( $object, $method_name, $parameters = [] ) {
$reflection = new \ReflectionClass( Payment_Helper::class );
$method = $reflection->getMethod( $method_name );
diff --git a/tests/unit/inc/test-admin-ajax.php b/tests/unit/inc/test-admin-ajax.php
index 7c5b59911..099f84f0d 100644
--- a/tests/unit/inc/test-admin-ajax.php
+++ b/tests/unit/inc/test-admin-ajax.php
@@ -227,4 +227,65 @@ public function test_download_export_file_path_must_be_in_temp_dir() {
$this->assertSame( 0, strpos( wp_normalize_path( $safe ), $temp_dir ) );
$this->assertNotSame( 0, strpos( wp_normalize_path( $unsafe ), $temp_dir ) );
}
+
+ // ---------------------------------------------------------------
+ // Tests for generate_data_for_suretriggers_integration() guards
+ // ---------------------------------------------------------------
+
+ /**
+ * The SureTriggers integration AJAX handler must reject requests that fail
+ * its capability, nonce, and required-parameter guards (each ends in a
+ * wp_send_json_error -> WPDieException in the test runner).
+ */
+ public function test_generate_data_for_suretriggers_integration() {
+ // 1. No logged-in user => capability check fails.
+ wp_set_current_user( 0 );
+ ob_start();
+ try {
+ $this->admin_ajax->generate_data_for_suretriggers_integration();
+ ob_end_clean();
+ $this->fail( 'Expected WPDieException for missing capability.' );
+ } catch ( \WPDieException $e ) {
+ $data = json_decode( (string) ob_get_clean(), true );
+ $this->assertIsArray( $data );
+ $this->assertFalse( $data['success'] );
+ $this->assertStringContainsString( 'permission', $data['data']['message'] );
+ }
+
+ // 2. Admin user but an invalid nonce => nonce check fails.
+ $admin_id = self::factory()->user->create( [ 'role' => 'administrator' ] );
+ wp_set_current_user( $admin_id );
+ $_POST['security'] = 'bad-nonce';
+ $_REQUEST['security'] = 'bad-nonce';
+ ob_start();
+ try {
+ $this->admin_ajax->generate_data_for_suretriggers_integration();
+ ob_end_clean();
+ $this->fail( 'Expected WPDieException for invalid nonce.' );
+ } catch ( \WPDieException $e ) {
+ $data = json_decode( (string) ob_get_clean(), true );
+ $this->assertFalse( $data['success'] );
+ $this->assertStringContainsString( 'nonce', strtolower( $data['data']['message'] ) );
+ }
+
+ // 3. Admin user + valid nonce, but no formId => required-param check fails.
+ $nonce = wp_create_nonce( 'suretriggers_nonce' );
+ $_POST['security'] = $nonce;
+ $_REQUEST['security'] = $nonce;
+ unset( $_POST['formId'] );
+ ob_start();
+ try {
+ $this->admin_ajax->generate_data_for_suretriggers_integration();
+ ob_end_clean();
+ $this->fail( 'Expected WPDieException for missing form id.' );
+ } catch ( \WPDieException $e ) {
+ $data = json_decode( (string) ob_get_clean(), true );
+ $this->assertFalse( $data['success'] );
+ $this->assertStringContainsString( 'Form ID', $data['data']['message'] );
+ }
+
+ // Cleanup.
+ unset( $_POST['security'], $_REQUEST['security'] );
+ wp_set_current_user( 0 );
+ }
}
diff --git a/tests/unit/inc/test-generate-form-markup.php b/tests/unit/inc/test-generate-form-markup.php
index 9fed14fb9..deb14b07b 100644
--- a/tests/unit/inc/test-generate-form-markup.php
+++ b/tests/unit/inc/test-generate-form-markup.php
@@ -294,4 +294,66 @@ public function test_get_redirect_url_query_params_disabled() {
wp_delete_post( $form_id, true );
}
+
+ /**
+ * Test get_google_captcha_script renders the widget + enqueues the right
+ * Google script per version, and falls back to the missing-sitekey error.
+ */
+ public function test_get_google_captcha_script() {
+ // Empty site key => missing-sitekey error, no widget rendered.
+ ob_start();
+ Generate_Form_Markup::get_google_captcha_script( 'v2-checkbox', '' );
+ $empty_output = ob_get_clean();
+ $this->assertStringContainsString( 'sitekey-error', $empty_output );
+ $this->assertStringNotContainsString( 'g-recaptcha', $empty_output );
+
+ // v2-checkbox => g-recaptcha widget carrying the site key, and the
+ // google-recaptcha script enqueued.
+ ob_start();
+ Generate_Form_Markup::get_google_captcha_script( 'v2-checkbox', 'test-site-key-v2' );
+ $v2_output = ob_get_clean();
+ $this->assertStringContainsString( 'g-recaptcha', $v2_output );
+ $this->assertStringContainsString( 'test-site-key-v2', $v2_output );
+ $this->assertTrue( wp_script_is( 'google-recaptcha', 'enqueued' ) );
+ wp_dequeue_script( 'google-recaptcha' );
+
+ // v3 => the dedicated v3 handle is enqueued.
+ ob_start();
+ Generate_Form_Markup::get_google_captcha_script( 'v3-reCAPTCHA', 'test-site-key-v3' );
+ ob_get_clean();
+ $this->assertTrue( wp_script_is( 'srfm-google-recaptchaV3', 'enqueued' ) );
+ wp_dequeue_script( 'srfm-google-recaptchaV3' );
+ }
+
+ /**
+ * Test get_cf_turnstile_script renders the Turnstile widget + enqueues the
+ * Cloudflare script, and falls back to the missing-sitekey error.
+ */
+ public function test_get_cf_turnstile_script() {
+ // The Turnstile enqueue passes a legacy $args shape that WordPress trunk
+ // flags via _doing_it_wrong (a PHP notice that PHPUnit would convert to a
+ // failure). Suppress just the triggered notice for the duration of this
+ // test so the rendered markup can still be asserted.
+ add_filter( 'doing_it_wrong_trigger_error', '__return_false' );
+
+ // Empty site key => missing-sitekey error, no widget.
+ ob_start();
+ Generate_Form_Markup::get_cf_turnstile_script( 'light', '' );
+ $empty_output = ob_get_clean();
+ $this->assertStringContainsString( 'sitekey-error', $empty_output );
+ $this->assertStringNotContainsString( 'cf-turnstile', $empty_output );
+
+ // Valid site key => cf-turnstile widget with the key + appearance mode,
+ // and the Cloudflare Turnstile script enqueued.
+ ob_start();
+ Generate_Form_Markup::get_cf_turnstile_script( 'dark', 'test-turnstile-key' );
+ $output = ob_get_clean();
+ $this->assertStringContainsString( 'cf-turnstile', $output );
+ $this->assertStringContainsString( 'test-turnstile-key', $output );
+ $this->assertStringContainsString( 'dark', $output );
+ $this->assertTrue( wp_script_is( SRFM_SLUG . '-cf-turnstile', 'enqueued' ) );
+ wp_dequeue_script( SRFM_SLUG . '-cf-turnstile' );
+
+ remove_filter( 'doing_it_wrong_trigger_error', '__return_false' );
+ }
}
diff --git a/tests/unit/modules/gutenberg/classes/test-class-spec-filesystem.php b/tests/unit/modules/gutenberg/classes/test-class-spec-filesystem.php
new file mode 100644
index 000000000..ee5a192c7
--- /dev/null
+++ b/tests/unit/modules/gutenberg/classes/test-class-spec-filesystem.php
@@ -0,0 +1,29 @@
+assertTrue( Spec_Filesystem::get_instance()->request_filesystem_credentials() );
+ }
+}