← All changes | includes/_booking_hash/booking_hash.php +63 -16 10.10 → 11.8.4 View file →

		@@ -1,4 +1,4 @@
1	1	<?php /**
2	2	* @version 1.0
3	3	* @description Booking Hash Functions
4	4	* @category Booking Hash
		@@ -11,9 +11,25 @@
11	11	*/
12	12
13	13	if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
14	14
15		-// H A S H // FixIn: 9.2.3.3.
	15	+// H A S H // FixIn: 9.2.3.3.
	16	+
	17	+/**
	18	+ * Generate an opaque booking hash without relying on database hashing functions.
	19	+ *
	20	+ * Booking hashes are used in customer-facing edit, cancellation, and payment
	21	+ * links. Keep the historical 32-character hexadecimal shape so existing
	22	+ * consumers continue to work, while deriving new values from WordPress random
	23	+ * data and a PHP hashing algorithm supported by the plugin's PHP requirement.
	24	+ *
	25	+ * @return string A 32-character lowercase hexadecimal booking hash.
	26	+ */
	27	+function wpbc_hash__generate_booking_hash() {
	28	+ $random_source = wp_generate_password( 64, true, true ) . '|' . microtime( true ) . '|' . wp_rand();
	29	+
	30	+ return substr( hash( 'sha256', $random_source ), 0, 32 );
	31	+}
16	32
17	33	/**
18	34	* Get booking ID and resource ID by booking HASH
19	35	*
		@@ -22,9 +38,9 @@
22	38	* @return array|false - array( $booking_id, $resource_id ) | false if not found
23	39	*/
24	40	function wpbc_hash__get_booking_id__resource_id( $booking_hash ) {
25	41
26		- if ( '' == $booking_hash ) {
	42	+ if ( '' === $booking_hash ) {
27	43	return false;
28	44	}
29	45	global $wpdb;
30	46
		@@ -30,9 +46,9 @@
30	46
31	47	if ( class_exists( 'wpdev_bk_personal' ) ) {
32	48
33	49	$sql = $wpdb->prepare( "SELECT booking_id as id, booking_type as type FROM {$wpdb->prefix}booking as bk WHERE bk.hash = %s", $booking_hash );
34		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	50	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
35	51	$res = $wpdb->get_results( $sql );
36	52
37	53	if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) && ( isset( $res[0]->type ) ) ) { // FixIn: 8.1.2.13.
38	54	return array( $res[0]->id, $res[0]->type );
		@@ -39,9 +55,9 @@
39	55	}
40	56	} else {
41	57
42	58	$sql = $wpdb->prepare( "SELECT booking_id as id FROM {$wpdb->prefix}booking as bk WHERE bk.hash = %s", $booking_hash );
43		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	59	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
44	60	$res = $wpdb->get_results( $sql );
45	61
46	62	if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->id ) ) ) { // FixIn: 8.1.2.13.
47	63	return array( $res[0]->id, 1 );
		@@ -69,9 +85,9 @@
69	85
70	86	if ( class_exists( 'wpdev_bk_personal' ) ) {
71	87
72	88	$sql = $wpdb->prepare( "SELECT hash, booking_type as type FROM {$wpdb->prefix}booking as bk WHERE bk.booking_id = %d", $booking_id );
73		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	89	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
74	90	$res = $wpdb->get_results( $sql );
75	91
76	92	if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->hash ) ) && ( isset( $res[0]->type ) ) ) {
77	93	return array( $res[0]->hash, $res[0]->type );
		@@ -78,9 +94,9 @@
78	94	}
79	95	} else {
80	96
81	97	$sql = $wpdb->prepare( "SELECT hash FROM {$wpdb->prefix}booking as bk WHERE bk.booking_id = %d", $booking_id );
82		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	98	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
83	99	$res = $wpdb->get_results( $sql );
84	100
85	101	if ( ( ! empty( $res ) ) && ( is_array( $res ) ) && ( isset( $res[0]->hash ) ) ) {
86	102	return array( $res[0]->hash, 1 );
		@@ -98,17 +114,17 @@
98	114	* @param $resource_id
99	115	*
100	116	* @return void
101	117	*/
102		-function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) {
103		- global $wpdb;
104		-
105		- $update_sql = $wpdb->prepare(
106		- "UPDATE {$wpdb->prefix}booking AS bk SET bk.hash = MD5(%s) WHERE bk.booking_id = %d"
107		- , time() . '_' . wp_rand( 1000, 1000000 )
108		- , $booking_id
109		- );
110		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	118	+function wpbc_hash__update_booking_hash( $booking_id, $resource_id = '1' ) {
	119	+ global $wpdb;
	120	+ // FixIn: 10.12.1.5.
	121	+ $update_sql = $wpdb->prepare(
	122	+ "UPDATE {$wpdb->prefix}booking SET hash = %s WHERE booking_id = %d"
	123	+ , wpbc_hash__generate_booking_hash()
	124	+ , $booking_id
	125	+ );
	126	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
111	127	if ( false === $wpdb->query( $update_sql ) ) {
112	128	?>
113	129	<script type="text/javascript"> document.getElementById('submiting<?php echo esc_attr( $resource_id ); ?>').innerHTML = '<div style=&quot;height:20px;width:100%;text-align:center;margin:15px auto;&quot;><?php debuge_error( 'Error during updating hash in BD', __FILE__, __LINE__ ); ?></div>'; </script> <?php
114	130	die();
		@@ -213,5 +229,36 @@
213	229	);
214	230
215	231	return $result;
216	232
217		-}
	233	+}
	234	+
	235	+// FixIn: 10.10.1.1.
	236	+/**
	237	+ * Change hash of booking after approval / pending / trash / restore booking(s)
	238	+ *
	239	+ * @param integer|string $booking_id_csd - ID(s) of booking(s): integer or comma seperated integer string.
	240	+ * @param bool $is_approve_or_pending - Status of the action: approved or pending | trashed or restored.
	241	+ *
	242	+ * @return void
	243	+ */
	244	+function wpbc_hook__change_hash__afteraction( $booking_id_csd, $is_approve_or_pending ) {
	245	+
	246	+ $is_change_hash_after_approvement = get_bk_option( 'booking_is_change_hash_after_approvement' );
	247	+
	248	+ if ( 'Off' !== $is_change_hash_after_approvement ) {
	249	+
	250	+ if ( is_numeric( $booking_id_csd ) ) {
	251	+ wpbc_hash__update_booking_hash( intval( $booking_id_csd ) );
	252	+ } else {
	253	+ $booking_id_csd = wpbc_clean_digit_or_csd( $booking_id_csd );
	254	+ $booking_id_arr = explode( ',', $booking_id_csd );
	255	+ foreach ( $booking_id_arr as $booking_id ) {
	256	+ wpbc_hash__update_booking_hash( (int) $booking_id );
	257	+ }
	258	+ }
	259	+ }
	260	+}
	261	+add_action( 'wpbc_booking_approved', 'wpbc_hook__change_hash__afteraction', 10, 2 );
	262	+add_action( 'wpbc_booking_action__approved', 'wpbc_hook__change_hash__afteraction', 10, 2 );
	263	+add_action( 'wpbc_booking_trash', 'wpbc_hook__change_hash__afteraction', 10, 2 );
	264	+add_action( 'wpbc_booking_action__trash', 'wpbc_hook__change_hash__afteraction', 10, 2 );