Hi there,
I quickly made an account for this. We are experiencing an issue with the newest update 4.0.2. Forms that are placed inside a component (we have a site-wide application form for example) dont pass the new “trusted IDs” verification.
Environment: Bricksforge 4.0.2, Bricks 2.1.4, WordPress 7.1.3, PHP 8.3
Problem 1: trusted-ID check doesn’t resolve component children A Pro Form placed as a Bricks component (in our case: 2 instances inside a single template) can no longer be submitted after updating to 4.0.2. form_submit returns: {"success":false,"data":{"message":"An error occurred, please try again later.","error":"The following ID is not in the list of trusted IDs: firstname"}}
FormsHelper::initial_sanitization() (CVE-2026-14956 hardening) only trusts a fieldIds mapping if \Bricks\Helpers::get_element_settings($post_id, $original_id) finds the element. Bricks only resolves children of a component instance as "<elementId>-<instanceId>" (see Helpers::get_element_data(), “element inside a component instance”), so get_element_settings($post_id, 'qndneq') returns false while get_element_data($post_id, 'qndneq-wwgpqs') returns the field. Notably, build_form_structure() already resolves these fields correctly.
Local workaround we applied (after the existing get_element_settings fallback):
if (!$is_trusted && class_exists('\Bricks\Helpers') && !empty($_POST['formId']) && is_string($_POST['formId'])) {
$component_data = \Bricks\Helpers::get_element_data($post_id, $lookup_id . '-' . sanitize_text_field($_POST['formId']));
$component_element = isset($component_data['element']) && is_array($component_data['element']) ? $component_data['element'] : [];
$configured_id = !empty($component_element['settings']['id']) ? (string) $component_element['settings']['id'] : $lookup_id;
$is_trusted = strpos($component_element['name'] ?? '', 'brf-pro-forms-field-') === 0
&& str_replace(['[', ']'], '', (string) $custom_id) === $configured_id;
}
Side note: the generic check trusts any custom_id as long as original_id is a real element (e.g. {"subscriber":"<any real element id>"}). You may want to also bind custom_id to the field’s configured ID, as above.
Problem 2: TypeError in validate() FormsHelper::validate() line 2344 calls in_array($custom_id, $fields_to_validate). If the request has no fieldsToValidate, the value is null, and on PHP 8 that is a fatal TypeError (HTTP 500). Fix: in_array($custom_id, (array) $fields_to_validate).
Maybe you can look into this. We will have to keep our custom code until this gets fixed. Love bricks!