| @@ -1,4 +1,4 @@ | ||
| 1 | 1 | <?php /** |
| 2 | 2 | * @version 1.0 |
| 3 | 3 | * @description Booking Hash Functions |
| 4 | 4 | * @category Booking Hash |
| @@ -11,9 +11,25 @@ | ||
| 11 | 11 | */ |
| 12 | 12 | |
| 13 | 13 | if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly |
| 14 | 14 | |
| 15 | -// H A S H //FixIn: 9.2.3.3 | |
| 15 | +// H A S H // FixIn: 9.2.3.3. | |
| 16 | + | |
| 17 | +/** | |
| 18 | + * Generate an opaque booking hash without relying on database hashing functions. | |
| 19 | + * | |
| 20 | + * Booking hashes are used in customer-facing edit, cancellation, and payment | |
| 21 | + * links. Keep the historical 32-character hexadecimal shape so existing | |
| 22 | + * consumers continue to work, while deriving new values from WordPress random | |
| 23 | + * data and a PHP hashing algorithm supported by the plugin's PHP requirement. | |
| 24 | + * | |
| 25 | + * @return string A 32-character lowercase hexadecimal booking hash. | |
| 26 | + */ | |
| 27 | +function wpbc_hash__generate_booking_hash() { | |
| 28 | + $random_source = wp_generate_password( 64, true, true ) . '|' . microtime( true ) . '|' . wp_rand(); | |
| 29 | + | |
| 30 | + return substr( hash( 'sha256', $random_source ), 0, 32 ); | |
| 31 | +} | |
| 16 | 32 | |
| 17 | 33 | /** |
| 18 | 34 | * Get booking ID and resource ID by booking HASH |
| 19 | 35 | * |
| @@ -22,9 +38,9 @@ | ||
| 22 | 38 | * @return array|false - array( $booking_id, $resource_id ) | false if not found |
| 23 | 39 | */ |
| 24 | 40 | function wpbc_hash__get_booking_id__resource_id( $booking_hash ) { |
| 25 | 41 | |
| 26 | - if ( '' == $booking_hash ) { | |
| 42 | + if ( '' === $booking_hash ) { | |
| 27 | 43 | return false; |
| 28 | 44 | } |
| 29 | 45 | global $wpdb; |
| 30 | 46 | |
| @@ -30,21 +46,21 @@ | ||
| 30 | 46 | |
| 31 | 47 | if ( class_exists( 'wpdev_bk_personal' ) ) { |
| 32 | 48 | |
| 33 | 49 | $sql = $wpdb->prepare( "SELECT booking_id as id, booking_type as type FROM {$wpdb->prefix}booking as bk WHERE bk.hash = %s", $booking_hash ); |
| 34 | - | |
| 50 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 35 | 51 | $res = $wpdb->get_results( $sql ); |
| 36 | 52 | |
| 37 | - if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) && ( isset( $res[0]->type ) ) ) { //FixIn: 8.1.2.13 | |
| 53 | + if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) && ( isset( $res[0]->type ) ) ) { // FixIn: 8.1.2.13. | |
| 38 | 54 | return array( $res[0]->id, $res[0]->type ); |
| 39 | 55 | } |
| 40 | 56 | } else { |
| 41 | 57 | |
| 42 | 58 | $sql = $wpdb->prepare( "SELECT booking_id as id FROM {$wpdb->prefix}booking as bk WHERE bk.hash = %s", $booking_hash ); |
| 43 | - | |
| 59 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 44 | 60 | $res = $wpdb->get_results( $sql ); |
| 45 | 61 | |
| 46 | - if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) ) { //FixIn: 8.1.2.13 | |
| 62 | + if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) ) { // FixIn: 8.1.2.13. | |
| 47 | 63 | return array( $res[0]->id, 1 ); |
| 48 | 64 | } |
| 49 | 65 | } |
| 50 | 66 | |
| @@ -57,9 +73,9 @@ | ||
| 57 | 73 | * by booking ID |
| 58 | 74 | * |
| 59 | 75 | * @param $booking_id |
| 60 | 76 | * |
| 61 | - * @return array|false - array( $hash, $resource_id ) | false if not found | |
| 77 | + * @return array|false - array( $hash, $resource_id ) | false if not found | |
| 62 | 78 | */ |
| 63 | 79 | function wpbc_hash__get_booking_hash__resource_id( $booking_id ) { |
| 64 | 80 | |
| 65 | 81 | if ( '' == $booking_id ) { |
| @@ -69,9 +85,9 @@ | ||
| 69 | 85 | |
| 70 | 86 | if ( class_exists( 'wpdev_bk_personal' ) ) { |
| 71 | 87 | |
| 72 | 88 | $sql = $wpdb->prepare( "SELECT hash, booking_type as type FROM {$wpdb->prefix}booking as bk WHERE bk.booking_id = %d", $booking_id ); |
| 73 | - | |
| 89 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 74 | 90 | $res = $wpdb->get_results( $sql ); |
| 75 | 91 | |
| 76 | 92 | if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->hash ) ) && ( isset( $res[0]->type ) ) ) { |
| 77 | 93 | return array( $res[0]->hash, $res[0]->type ); |
| @@ -78,9 +94,9 @@ | ||
| 78 | 94 | } |
| 79 | 95 | } else { |
| 80 | 96 | |
| 81 | 97 | $sql = $wpdb->prepare( "SELECT hash FROM {$wpdb->prefix}booking as bk WHERE bk.booking_id = %d", $booking_id ); |
| 82 | - | |
| 98 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 83 | 99 | $res = $wpdb->get_results( $sql ); |
| 84 | 100 | |
| 85 | 101 | if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->hash ) ) ) { |
| 86 | 102 | return array( $res[0]->hash, 1 ); |
| @@ -91,9 +107,9 @@ | ||
| 91 | 107 | } |
| 92 | 108 | |
| 93 | 109 | |
| 94 | 110 | /** |
| 95 | - * Update booking hash to newly generated. Run after creation/modification of booking in post request | |
| 111 | + * Update booking hash to newly generated. Run after creation/modification of booking in post request | |
| 96 | 112 | * |
| 97 | 113 | * @param $booking_id |
| 98 | 114 | * @param $resource_id |
| 99 | 115 | * |
| @@ -98,17 +114,20 @@ | ||
| 98 | 114 | * @param $resource_id |
| 99 | 115 | * |
| 100 | 116 | * @return void |
| 101 | 117 | */ |
| 102 | -function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) { | |
| 103 | - global $wpdb; | |
| 104 | - | |
| 105 | - $update_sql = $wpdb->prepare( "UPDATE {$wpdb->prefix}booking AS bk SET bk.hash = MD5(%s) WHERE bk.booking_id = %d" | |
| 106 | - , time() . '_' . rand( 1000, 1000000 ) | |
| 107 | - , $booking_id | |
| 108 | - ); | |
| 118 | +function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) { | |
| 119 | + global $wpdb; | |
| 120 | + // FixIn: 10.12.1.5. | |
| 121 | + $update_sql = $wpdb->prepare( | |
| 122 | + "UPDATE {$wpdb->prefix}booking SET hash = %s WHERE booking_id = %d" | |
| 123 | + , wpbc_hash__generate_booking_hash() | |
| 124 | + , $booking_id | |
| 125 | + ); | |
| 126 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 109 | 127 | if ( false === $wpdb->query( $update_sql ) ) { |
| 110 | - ?><script type="text/javascript"> document.getElementById( 'submiting<?php echo $resource_id; ?>' ).innerHTML = '<div style="height:20px;width:100%;text-align:center;margin:15px auto;"><?php debuge_error( 'Error during updating hash in BD', __FILE__, __LINE__ ); ?></div>'; </script> <?php | |
| 128 | + ?> | |
| 129 | + <script type="text/javascript"> document.getElementById('submiting<?php echo esc_attr( $resource_id ); ?>').innerHTML = '<div style="height:20px;width:100%;text-align:center;margin:15px auto;"><?php debuge_error( 'Error during updating hash in BD', __FILE__, __LINE__ ); ?></div>'; </script> <?php | |
| 111 | 130 | die(); |
| 112 | 131 | } |
| 113 | 132 | } |
| 114 | 133 | |
| @@ -122,11 +141,11 @@ | ||
| 122 | 141 | * @return string - JavaScript code as text |
| 123 | 142 | */ |
| 124 | 143 | function wpbc_get_dates_selection_js_code( $to_select__dates_sql_arr, $resource_id ){ |
| 125 | 144 | |
| 126 | - $dates_selection_js_code = '<script type="text/javascript"> ' . wpbc_jq_ready_start(); //FixIn: 10.1.3.7 | |
| 145 | + $dates_selection_js_code = '<script type="text/javascript"> ' . wpbc_jq_ready_start(); // FixIn: 10.1.3.7. | |
| 127 | 146 | |
| 128 | - //FixIn: 10.0.0.50 | |
| 147 | + // FixIn: 10.0.0.50. | |
| 129 | 148 | $dates_selection_js_code .= ' var select_dates_in_calendar_id = ' . intval( $resource_id ) . ';'; |
| 130 | 149 | $dates_selection_js_code .= " jQuery( 'body' ).on( 'wpbc_calendar_ajx__loaded_data', function ( event, loaded_resource_id ){ "; // Fire on all booking dates loaded |
| 131 | 150 | $dates_selection_js_code .= " if ( loaded_resource_id == select_dates_in_calendar_id ){ "; |
| 132 | 151 | |
| @@ -137,13 +156,13 @@ | ||
| 137 | 156 | }, $to_select__dates_sql_arr ); |
| 138 | 157 | $string__dates_sql_arr = array_unique($string__dates_sql_arr); |
| 139 | 158 | $string__dates_sql_str = implode( ',', $string__dates_sql_arr ); |
| 140 | 159 | |
| 141 | - $dates_selection_js_code .= " wpbc_auto_select_dates_in_calendar( select_dates_in_calendar_id, [" . $string__dates_sql_str . "] ); "; | |
| 160 | + $dates_selection_js_code .= " setTimeout( function (){ wpbc_auto_select_dates_in_calendar( select_dates_in_calendar_id, [" . $string__dates_sql_str . "] ); }, 500 );"; | |
| 142 | 161 | $dates_selection_js_code .= " } "; |
| 143 | 162 | $dates_selection_js_code .= " } ); "; |
| 144 | 163 | |
| 145 | - $dates_selection_js_code .= wpbc_jq_ready_end() . '</script>'; //FixIn: 10.1.3.7 | |
| 164 | + $dates_selection_js_code .= wpbc_jq_ready_end() . '</script>'; // FixIn: 10.1.3.7. | |
| 146 | 165 | |
| 147 | 166 | return $dates_selection_js_code; |
| 148 | 167 | } |
| 149 | 168 | |
| @@ -189,9 +208,9 @@ | ||
| 189 | 208 | */ |
| 190 | 209 | function wpbc_get_booking_arr__from_hash_in_url( $booking_hash = false ){ |
| 191 | 210 | |
| 192 | 211 | if ( empty( $booking_hash ) ) { |
| 193 | - $booking_hash = ( isset( $_REQUEST['booking_hash'] ) ) ? $_REQUEST['booking_hash'] : ''; | |
| 212 | + $booking_hash = ( isset( $_REQUEST['booking_hash'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['booking_hash'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing */ | |
| 194 | 213 | } |
| 195 | 214 | |
| 196 | 215 | $booking_id = ''; |
| 197 | 216 | $resource_id = ''; |
| @@ -210,5 +229,36 @@ | ||
| 210 | 229 | ); |
| 211 | 230 | |
| 212 | 231 | return $result; |
| 213 | 232 | |
| 214 | -} | |
| 233 | +} | |
| 234 | + | |
| 235 | +// FixIn: 10.10.1.1. | |
| 236 | +/** | |
| 237 | + * Change hash of booking after approval / pending / trash / restore booking(s) | |
| 238 | + * | |
| 239 | + * @param integer|string $booking_id_csd - ID(s) of booking(s): integer or comma seperated integer string. | |
| 240 | + * @param bool $is_approve_or_pending - Status of the action: approved or pending | trashed or restored. | |
| 241 | + * | |
| 242 | + * @return void | |
| 243 | + */ | |
| 244 | +function wpbc_hook__change_hash__afteraction( $booking_id_csd, $is_approve_or_pending ) { | |
| 245 | + | |
| 246 | + $is_change_hash_after_approvement = get_bk_option( 'booking_is_change_hash_after_approvement' ); | |
| 247 | + | |
| 248 | + if ( 'Off' !== $is_change_hash_after_approvement ) { | |
| 249 | + | |
| 250 | + if ( is_numeric( $booking_id_csd ) ) { | |
| 251 | + wpbc_hash__update_booking_hash( intval( $booking_id_csd ) ); | |
| 252 | + } else { | |
| 253 | + $booking_id_csd = wpbc_clean_digit_or_csd( $booking_id_csd ); | |
| 254 | + $booking_id_arr = explode( ',', $booking_id_csd ); | |
| 255 | + foreach ( $booking_id_arr as $booking_id ) { | |
| 256 | + wpbc_hash__update_booking_hash( (int) $booking_id ); | |
| 257 | + } | |
| 258 | + } | |
| 259 | + } | |
| 260 | +} | |
| 261 | +add_action( 'wpbc_booking_approved', 'wpbc_hook__change_hash__afteraction', 10, 2 ); | |
| 262 | +add_action( 'wpbc_booking_action__approved', 'wpbc_hook__change_hash__afteraction', 10, 2 ); | |
| 263 | +add_action( 'wpbc_booking_trash', 'wpbc_hook__change_hash__afteraction', 10, 2 ); | |
| 264 | +add_action( 'wpbc_booking_action__trash', 'wpbc_hook__change_hash__afteraction', 10, 2 ); | |
