Use array format for WP_Error status data in token endpoint

Author: mrcasual

includes/class-gf-zero-spam-token-endpoint.php

@@ -96,7 +96,8 @@ public function handle_ajax() {
 		nocache_headers();
 
 		if ( is_wp_error( $result ) ) {
-			$status = (int) $result->get_error_data();
+			$error_data = $result->get_error_data();
+			$status     = is_array( $error_data ) && isset( $error_data['status'] ) ? (int) $error_data['status'] : 500;
 
 			wp_send_json_error( $result->get_error_message(), $status );
 		}
@@ -115,20 +116,20 @@ public function handle_ajax() {
 	 */
 	private function handle_token_request( int $form_id ) {
 		if ( $form_id < 1 ) {
-			return new WP_Error( 'missing_form_id', __( 'A valid form_id is required.', 'gravity-forms-zero-spam' ), 400 );
+			return new WP_Error( 'missing_form_id', __( 'A valid form_id is required.', 'gravity-forms-zero-spam' ), [ 'status' => 400 ] );
 		}
 
 		$form = GFAPI::get_form( $form_id );
 
 		if ( ! $form ) {
-			return new WP_Error( 'invalid_form', __( 'Form not found.', 'gravity-forms-zero-spam' ), 400 );
+			return new WP_Error( 'invalid_form', __( 'Form not found.', 'gravity-forms-zero-spam' ), [ 'status' => 400 ] );
 		}
 
 		// Check if Zero Spam is enabled for this form.
 		$enabled = gf_apply_filters( 'gf_zero_spam_check_key_field', $form_id, true, $form, [] );
 
 		if ( false === $enabled ) {
-			return new WP_Error( 'zero_spam_disabled', __( 'Zero Spam is not enabled for this form.', 'gravity-forms-zero-spam' ), 400 );
+			return new WP_Error( 'zero_spam_disabled', __( 'Zero Spam is not enabled for this form.', 'gravity-forms-zero-spam' ), [ 'status' => 400 ] );
 		}
 
 		$rate_check = $this->check_rate_limit();
@@ -193,7 +194,7 @@ private function check_rate_limit() {
 		$limit = (int) apply_filters( 'gf_zero_spam_rate_limit', self::RATE_LIMIT );
 
 		if ( $count >= $limit ) {
-			return new WP_Error( 'rate_limited', __( 'Too many requests. Please try again later.', 'gravity-forms-zero-spam' ), 429 );
+			return new WP_Error( 'rate_limited', __( 'Too many requests. Please try again later.', 'gravity-forms-zero-spam' ), [ 'status' => 429 ] );
 		}
 
 		set_transient( $key, $count + 1, 60 );

readme.txt

@@ -112,7 +112,7 @@ You can enable a spam summary report email. This email will be sent to the email
 
 = develop =
 
-* Added: Stronger spam prevention using signed tokens that can't be copied from the page source by bots
+* Added: Stronger spam prevention using signed, time-limited tokens fetched at submit time
 * API: Added `gf_zero_spam_client_ip` filter to override the visitor IP used for rate limiting (useful for sites behind Cloudflare or load balancers)
 * API: Added `gf_zero_spam_rate_limit` filter to adjust the maximum token requests allowed per IP per minute (default: 30)