Rock gated content by truongwp · Pull Request #3088 · Strategy11/formidable-forms

truongwp · 2026-04-27T13:33:13Z

No description provided.

Resolve conflicts in: - FrmAppHelper.php: keep db_version = 106 (required for gated tokens table) - formidable_admin.js: keep HEAD (includes gated content JS changes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coderabbitai · 2026-04-27T13:33:24Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7f077c09-8d79-4e5f-b1ac-abb3108b1b62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch rock-gated-content

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

deepsource-io · 2026-04-27T13:36:35Z

DeepSource Code Review

We reviewed changes in 1d27050...6cd6c74 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		May 11, 2026 7:46a.m.	Review ↗
JavaScript		May 11, 2026 7:46a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-04-27T13:37:50Z

+	 */
+	function frmGcFilterFileFields( formSelect ) {
+		const typeDiv    = formSelect.closest( '.frm-gc-type-settings' );
+		const fieldSelect = typeDiv && typeDiv.querySelector( '[data-frm-gc-field="id"]' );


Prefer using an optional chain expression instead, as it's more concise and easier to read

The optional chaining operator can be used to perform null checks before accessing a property, or calling a function.

deepsource-io · 2026-04-27T13:37:50Z

+
+		// If the currently selected field option is now hidden, reset the select.
+		const selected = fieldSelect.options[ fieldSelect.selectedIndex ];
+		if ( selected && selected.hidden ) {


Prefer using an optional chain expression instead, as it's more concise and easier to read

The optional chaining operator can be used to perform null checks before accessing a property, or calling a function.

deepsource-io · 2026-04-27T13:37:50Z

+		const copyBtn = event.target.closest( '.frm_gc_copy_shortcode' );
+		if ( copyBtn ) {
+			const text = copyBtn.dataset.frmCopy;
+			if ( navigator.clipboard && navigator.clipboard.writeText ) {


Prefer using an optional chain expression instead, as it's more concise and easier to read

The optional chaining operator can be used to perform null checks before accessing a property, or calling a function.

deepsource-io · 2026-04-27T13:38:44Z

+	 * @param array $atts Shortcode attributes.
+	 * @return string Shortcode output, or empty string when no token is available.
+	 */
+	public static function shortcode( $atts ) {


`shortcode` has a cyclomatic complexity of 19 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-27T13:38:44Z

+				 * @param string $type      Item type slug.
+				 * @param string $raw_token Raw access token.
+				 */
+				$base_url = (string) apply_filters( 'frm_gated_content_item_url', '', (int) $item_id, $type, $raw_token );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T13:38:44Z

+		 * @param int    $item_id   Content item ID being checked.
+		 * @param string $item_type Content item type being checked.
+		 */
+		return (bool) apply_filters( 'frm_gated_content_validate', $is_valid, $row, $item_id, $item_type );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T13:38:44Z

+		}
+
+		/** This filter is documented in classes/helpers/FrmGatedTokenHelper.php */
+		return (bool) apply_filters( 'frm_gated_content_validate', $is_valid, $row, $item_id, $item_type );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T13:38:46Z

+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$raw_token = FrmGatedTokenHelper::get_raw_token_for_action( $action_id );
+		$this->assertNotNull(


Call to an undefined method test_FrmGatedContentController::assertNotNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T13:38:46Z

+			$raw_token,
+			'payment-success event must trigger token generation for a gated content action.'
+		);
+		$this->assertSame( 48, strlen( $raw_token ) );


Call to an undefined method test_FrmGatedContentController::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T13:38:46Z

+	 * @covers FrmGatedContentController::trigger
+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T13:38:46Z

+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();
+		$entry_id = $this->factory->entry->create( array( 'form_id' => $form_id ) );


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T13:38:46Z

+
+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$this->assertNull(


Call to an undefined method test_FrmGatedContentController::assertNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T15:30:03Z

+	 * @param array $atts Shortcode attributes.
+	 * @return string Shortcode output, or empty string when no token is available.
+	 */
+	public static function shortcode( $atts ) {


`shortcode` has a cyclomatic complexity of 19 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-27T15:30:03Z

+				 * @param string $type      Item type slug.
+				 * @param string $raw_token Raw access token.
+				 */
+				$base_url = (string) apply_filters( 'frm_gated_content_item_url', '', $item_id, $type, $raw_token );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T15:30:03Z

+		 * @param int    $item_id   Content item ID being checked.
+		 * @param string $item_type Content item type being checked.
+		 */
+		return (bool) apply_filters( 'frm_gated_content_validate', $is_valid, $row, $item_id, $item_type );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T15:30:03Z

+		}
+
+		/** This filter is documented in classes/helpers/FrmGatedTokenHelper.php */
+		return (bool) apply_filters( 'frm_gated_content_validate', $is_valid, $row, $item_id, $item_type );


Function apply_filters invoked with 5 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-27T15:30:03Z

+	 *                       from the token row); cookie and IP paths are skipped.
+	 * @return string|null Token hash, or null if no valid token could be resolved.
+	 */
+	public static function obtain_token( $action_id = 0 ) {


`obtain_token` has a cyclomatic complexity of 17 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-27T15:30:04Z

+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$raw_token = FrmGatedTokenHelper::get_raw_token_for_action( $action_id );
+		$this->assertNotNull(


Call to an undefined method test_FrmGatedContentController::assertNotNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T15:30:04Z

+			$raw_token,
+			'payment-success event must trigger token generation for a gated content action.'
+		);
+		$this->assertSame( 48, strlen( $raw_token ) );


Call to an undefined method test_FrmGatedContentController::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T15:30:04Z

+	 * @covers FrmGatedContentController::trigger
+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T15:30:04Z

+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();
+		$entry_id = $this->factory->entry->create( array( 'form_id' => $form_id ) );


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T15:30:04Z

+
+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$this->assertNull(


Call to an undefined method test_FrmGatedContentController::assertNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-28T07:15:12Z

+	 *                       from the token row); cookie path is skipped.
+	 * @return string|null Token hash, or null if no valid token could be resolved.
+	 */
+	public static function obtain_token( $action_id = 0 ) {


`obtain_token` has a cyclomatic complexity of 16 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-28T07:15:12Z

+		FrmGatedTokenHelper::generate( $this->action_id, 1 );
+
+		$cached = FrmGatedTokenHelper::get_raw_token_for_action( $this->action_id );
+		$this->assertNotNull( $cached, 'Token transient not set after generate().' );


Call to an undefined method test_FrmGatedTokenHelper::assertNotNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-28T07:34:19Z

+	 *                       from the token row); cookie path is skipped.
+	 * @return string|null Token hash, or null if no valid token could be resolved.
+	 */
+	public static function obtain_token( $action_id = 0 ) {


`obtain_token` has a cyclomatic complexity of 17 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-28T10:03:14Z

+		$is_valid = self::action_contains_item( $action, $item_id, $item_type );
+
+		/** This filter is documented in classes/helpers/FrmGatedTokenHelper.php */
+		return (bool) apply_filters( 'frm_gated_content_validate', $is_valid, compact( 'row', 'item_id', 'item_type' ) );


Function apply_filters invoked with 3 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-28T11:51:38Z

+		}
+
+		$row = FrmGatedTokenHelper::get_row_by_token( $candidate );
+		if ( $row


Method FrmGatedContentController::resolve_raw_token() should return string|null but return statement is missing

This issue is raised if a method with a return type does not have a return statement of an appropriate type.

deepsource-io · 2026-04-28T11:51:38Z

+		 *     @type string $raw_token Raw access token.
+		 * }
+		 */
+		$base_url = (string) apply_filters( 'frm_gated_content_item_url', $base_url, compact( 'item_id', 'type', 'raw_token' ) );


Function apply_filters invoked with 3 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-28T11:51:38Z

+		 *     @type string $type    Item type slug.
+		 * }
+		 */
+		return (string) apply_filters( 'frm_gated_content_item_title', $title, compact( 'item_id', 'type' ) );


Function apply_filters invoked with 3 parameters, 2 required

The function call is not valid, which will result in a fatal runtime error.

deepsource-io · 2026-04-28T16:29:43Z

+
+	// Show/hide "Keep old token when entry is updated" when the event multi-select changes.
+	jQuery( document ).on( 'frm-multiselect-changed', 'select[id^="event_"]', function() {
+		const section = document.querySelector( '.frm_gc_update_section[data-frm-gc-event-id="' + this.id + '"]' );


Unexpected string concatenation

In ES2015 (ES6), we can use template literals instead of string concatenation.

truongwp and others added 18 commits April 16, 2026 21:33

Add Gated content form action

30b8547

Create gated_tokens db table

56ccb14

Add gated token helper

347fa2d

Add code to trigger the gated content action

b84c0b4

Add code to obtain gated content token

709c312

Add gated content shortcode

60852cd

Handle password protected posts

e0e06c1

Fix open access for password protected pages not working

b0a3830

Add show=url to shortcode

69ebb2f

Support private pages

f12e90c

Use frm_clone_icon

3d338a6

Necessary code to add more gated content type

9b550ac

Add unit tests

32eeae2

Add support for running gated content in payment success

5b5b5b8

Update unit tests

334d5f9

Merge master into branch, keeping db_version 106 and built JS

6f0f023

Resolve conflicts in: - FrmAppHelper.php: keep db_version = 106 (required for gated tokens table) - formidable_admin.js: keep HEAD (includes gated content JS changes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix JS error when sorting fields and PHP error when duplicating form

20314c4

Use transient to temporarily store the gated content token

b95e703

deepsource-io Bot reviewed Apr 27, 2026

View reviewed changes

truongwp added 7 commits April 27, 2026 21:11

Fix PHPStan

27dab71

Fix PHPStan

e7b8988

Remove md5()

2c012f7

Fix deepsource error

d4c35aa

Fix Psalm

ccc67e3

Fix PHPStan

2a8d369

Revert deepsource config file

877e9e6

deepsource-io Bot reviewed Apr 27, 2026

View reviewed changes

truongwp added 9 commits April 28, 2026 11:26

Fix empty redirect URL

ae4744a

Revoke old token before updating

cf17c3b

Update unit tests

0d917fc

Schedule delete expired gated content tokens

18c8086

Update obtain_token() method

0bb1615

Reduce extra DB query

d8e35dc

Update data-item-count

a559c55

Remove deprecated function

d9910b0

Improve code

91d6480

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

truongwp added 2 commits April 28, 2026 14:27

Improve code

1e6b04a

Move some features to Pro

dcdc4ab

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

truongwp added 3 commits April 28, 2026 14:45

Remove unnecessary since

29a1e45

Improve code

b9603d7

Add back the static variable for tokens

432fb4f

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

truongwp added 3 commits April 28, 2026 18:20

Add cache

ede69c0

Improve code

418bc99

Remove unused code

010c8b0

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

Show extra settings in Gated content action

bb0487d

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

Improve code

6a7eb60

truongwp added the deploy Deploy website on push label Apr 30, 2026

truongwp added 5 commits May 7, 2026 15:52

Change icon and color of gated content action

2848b6f

Change gated content item column layout

753612e

Improve styling of gated content action

21242ec

Fix the file dropdown in Gated content not live updated

bbe8e5b

Gated content: Remove unnecessary code

6cd6c74


		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );

		$this->assertNull(

Conversation

truongwp commented Apr 27, 2026

Uh oh!

coderabbitai Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

deepsource-io Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Prefer using an optional chain expression instead, as it's more concise and easier to read

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Prefer using an optional chain expression instead, as it's more concise and easier to read

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Prefer using an optional chain expression instead, as it's more concise and easier to read

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

`shortcode` has a cyclomatic complexity of 19 with "High" risk

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmGatedContentController::assertNotNull()

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmGatedContentController::assertSame()

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Access to an undefined property test_FrmGatedContentController::$factory

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Access to an undefined property test_FrmGatedContentController::$factory

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmGatedContentController::assertNull()

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

`shortcode` has a cyclomatic complexity of 19 with "High" risk

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

Function apply_filters invoked with 5 parameters, 2 required

Uh oh!

deepsource-io Bot Apr 27, 2026

Choose a reason for hiding this comment

coderabbitai Bot commented Apr 27, 2026 •

edited

Loading

deepsource-io Bot commented Apr 27, 2026 •

edited

Loading