← All changes | includes/gateways/class-charitable-gateway-paypal.php +33 -31 1.7.0.2 → 1.8.13 View file →

		@@ -3,12 +3,12 @@
3	3	* Paypal Payment Gateway class.
4	4	*
5	5	* @package Charitable/Classes/Charitable_Gateway_Paypal
6	6	* @author David Bisset
7		- * @copyright Copyright (c) 2022, WP Charitable LLC
	7	+ * @copyright Copyright (c) 2023, WP Charitable LLC
8	8	* @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
9	9	* @since 1.0.0
10		- * @version 1.6.55
	10	+ * @version 1.8.9.1
11	11	*/
12	12
13	13	// Exit if accessed directly.
14	14	if ( ! defined( 'ABSPATH' ) ) {
		@@ -332,24 +332,24 @@
332	332	*/
333	333	public static function process_ipn() {
334	334	/* We only accept POST requests */
335	335	if ( ! self::is_valid_request() ) {
336		- die( __( 'Invalid Request', 'charitable' ) );
	336	+ die( esc_html( __( 'Invalid Request', 'charitable' ) ) );
337	337	}
338	338
339	339	$gateway = new Charitable_Gateway_Paypal();
340	340	$data = $gateway->get_encoded_ipn_data();
341	341
342		- if ( defined( 'CHARITABLE_DEBUG' ) && CHARITABLE_DEBUG ) {
343		- error_log( var_export( $data, true ) );
	342	+ if ( charitable_is_debug() ) {
	343	+ error_log( var_export( $data, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log, WordPress.PHP.DevelopmentFunctions.error_log_var_export
344	344	}
345	345
346	346	if ( empty( $data ) ) {
347		- die( __( 'Empty Data', 'charitable' ) );
	347	+ die( esc_html( __( 'Empty Data', 'charitable' ) ) );
348	348	}
349	349
350	350	if ( ! $gateway->paypal_ipn_verification( $data ) ) {
351		- die( __( 'IPN Verification Failure', 'charitable' ) );
	351	+ die( esc_html( __( 'IPN Verification Failure', 'charitable' ) ) );
352	352	}
353	353
354	354	$defaults = array(
355	355	'payment_status' => '',
		@@ -363,9 +363,9 @@
363	363	? absint( $custom['donation_id'] )
364	364	: absint( $custom );
365	365
366	366	if ( ! $donation_id ) {
367		- die( __( 'Missing Donation ID', 'charitable' ) );
	367	+ die( esc_html( __( 'Missing Donation ID', 'charitable' ) ) );
368	368	}
369	369
370	370	/**
371	371	* By default, all transactions are handled by the web_accept handler.
		@@ -398,9 +398,9 @@
398	398	$gateway = new Charitable_Gateway_Paypal();
399	399	$donation = charitable_get_donation( $donation_id );
400	400
401	401	if ( 'paypal' != $donation->get_gateway() ) {
402		- die( __( 'Incorrect Gateway', 'charitable' ) );
	402	+ die( esc_html( __( 'Incorrect Gateway', 'charitable' ) ) );
403	403	}
404	404
405	405	$custom = json_decode( $data['custom'], true );
406	406
		@@ -408,9 +408,9 @@
408	408	$donation_key = $data['invoice'];
409	409	} elseif ( is_array( $custom ) && array_key_exists( 'donation_key', $custom ) ) {
410	410	$donation_key = $custom['donation_key'];
411	411	} else {
412		- die( __( 'Missing Donation Key', 'charitable' ) );
	412	+ die( esc_html( __( 'Missing Donation Key', 'charitable' ) ) );
413	413	}
414	414
415	415	$amount = $data['mc_gross'];
416	416	$payment_status = strtolower( $data['payment_status'] );
		@@ -419,12 +419,12 @@
419	419
420	420	/* Verify that the business email matches the PayPal email in the settings */
421	421	if ( strcasecmp( $business_email, trim( self::get_paypal_email() ) ) != 0 ) {
422	422
423		- $message = sprintf( '%s %s', __( 'Invalid Business email in the IPN response. IPN data:', 'charitable' ), json_encode( $data ) );
	423	+ $message = sprintf( '%s %s', __( 'Invalid Business email in the IPN response. IPN data:', 'charitable' ), wp_json_encode( $data ) );
424	424	$donation->log()->add( $message );
425	425	$donation->update_status( 'charitable-failed' );
426		- die( __( 'Incorrect Business Email', 'charitable' ) );
	426	+ die( esc_html( __( 'Incorrect Business Email', 'charitable' ) ) );
427	427
428	428	}
429	429
430	430	/* Verify that the currency matches. */
		@@ -429,13 +429,13 @@
429	429
430	430	/* Verify that the currency matches. */
431	431	if ( $donation->get_currency() !== $currency_code ) {
432	432
433		- $message = sprintf( '%s %s', __( 'The currency in the IPN response does not match the site currency. IPN data:', 'charitable' ), json_encode( $data ) );
	433	+ $message = sprintf( '%s %s', __( 'The currency in the IPN response does not match the site currency. IPN data:', 'charitable' ), wp_json_encode( $data ) );
434	434	$donation->log()->add( $message );
435	435	$donation->update_status( 'charitable-failed' );
436	436
437		- die( __( 'Incorrect Currency', 'charitable' ) );
	437	+ die( esc_html( __( 'Incorrect Currency', 'charitable' ) ) );
438	438
439	439	}
440	440
441	441	/* Process a refunded donation. */
		@@ -457,9 +457,9 @@
457	457	}
458	458
459	459	$donation->process_refund( $amount, $message );
460	460
461		- die( __( 'Refund Processed', 'charitable' ) );
	461	+ die( esc_html( __( 'Refund Processed', 'charitable' ) ) );
462	462
463	463	}
464	464
465	465	/* Mark a payment as failed. */
		@@ -468,25 +468,25 @@
468	468	$message = sprintf( '%s: %s', __( 'The donation has failed with the following status', 'charitable' ), $payment_status );
469	469	$donation->log()->add( $message );
470	470	$donation->update_status( 'charitable-failed' );
471	471
472		- die( __( 'Payment Failed', 'charitable' ) );
	472	+ die( esc_html( __( 'Payment Failed', 'charitable' ) ) );
473	473
474	474	}
475	475
476	476	/* If we have already processed this donation, stop here. */
477	477	if ( 'charitable-completed' == get_post_status( $donation_id ) ) {
478		- die( __( 'Donation Processed Already', 'charitable' ) );
	478	+ die( esc_html( __( 'Donation Processed Already', 'charitable' ) ) );
479	479	}
480	480
481	481	/* Verify that the donation key matches the one stored for the donation. */
482	482	if ( $donation_key != $donation->get_donation_key() ) {
483	483
484		- $message = sprintf( '%s %s', __( 'Donation key in the IPN response does not match the donation. IPN data:', 'charitable' ), json_encode( $data ) );
	484	+ $message = sprintf( '%s %s', __( 'Donation key in the IPN response does not match the donation. IPN data:', 'charitable' ), wp_json_encode( $data ) );
485	485	$donation->log()->add( $message );
486	486	$donation->update_status( 'charitable-failed' );
487	487
488		- die( __( 'Invalid Donation Key', 'charitable' ) );
	488	+ die( esc_html( __( 'Invalid Donation Key', 'charitable' ) ) );
489	489
490	490	}
491	491
492	492	/* Verify that the amount in the IPN matches the amount we expected. */
		@@ -491,13 +491,13 @@
491	491
492	492	/* Verify that the amount in the IPN matches the amount we expected. */
493	493	if ( $amount < $donation->get_total_donation_amount( true ) ) {
494	494
495		- $message = sprintf( '%s %s', __( 'The amount in the IPN response does not match the expected donation amount. IPN data:', 'charitable' ), json_encode( $data ) );
	495	+ $message = sprintf( '%s %s', __( 'The amount in the IPN response does not match the expected donation amount. IPN data:', 'charitable' ), wp_json_encode( $data ) );
496	496	$donation->log()->add( $message );
497	497	$donation->update_status( 'charitable-failed' );
498	498
499		- die( __( 'Incorrect Amount', 'charitable' ) );
	499	+ die( esc_html( __( 'Incorrect Amount', 'charitable' ) ) );
500	500
501	501	}
502	502
503	503	/* Save the transation ID */
		@@ -509,9 +509,9 @@
509	509	$message = sprintf( '%s: %s', __( 'PayPal Transaction ID', 'charitable' ), $data['txn_id'] );
510	510	$donation->log()->add( $message );
511	511	$donation->update_status( 'charitable-completed' );
512	512
513		- die( __( 'Donation Completed', 'charitable' ) );
	513	+ die( esc_html__( 'Donation Completed', 'charitable' ) );
514	514
515	515	}
516	516
517	517	/* If the donation is set to pending but has a pending_reason provided, save that to the log. */
		@@ -525,13 +525,13 @@
525	525	}
526	526
527	527	$donation->update_status( 'charitable-pending' );
528	528
529		- die( __( 'Donation Pending', 'charitable' ) );
	529	+ die( esc_html( __( 'Donation Pending', 'charitable' ) ) );
530	530
531	531	}
532	532
533		- die( __( 'Unknown Response', 'charitable' ) );
	533	+ die( esc_html( __( 'Unknown Response', 'charitable' ) ) );
534	534	}
535	535
536	536	/**
537	537	* Return the posted IPN data.
		@@ -546,9 +546,9 @@
546	546	/* Fallback just in case post_max_size is lower than needed. */
547	547	if ( ini_get( 'allow_url_fopen' ) ) {
548	548	$post_data = file_get_contents( 'php://input' );
549	549	} else {
550		- ini_set( 'post_max_size', '12M' );
	550	+ ini_set( 'post_max_size', '12M' ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged
551	551	}
552	552
553	553	if ( strlen( $post_data ) ) {
554	554	$arg_separator = ini_get( 'arg_separator.output' );
		@@ -560,8 +560,9 @@
560	560	return $data;
561	561	}
562	562
563	563	/* Return an empty array if there are no POST variables. */
	564	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
564	565	if ( empty( $_POST ) ) {
565	566	return array();
566	567	}
567	568
		@@ -569,8 +570,9 @@
569	570	'cmd' => '_notify-validate',
570	571	);
571	572
572	573	return array_merge( $data, $_POST );
	574	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
573	575
574	576	}
575	577
576	578	/**
		@@ -732,10 +734,10 @@
732	734	'timeout' => 30,
733	735	'httpversion' => '1.1',
734	736	);
735	737
736		- if ( defined( 'CHARITABLE_DEBUG' ) && CHARITABLE_DEBUG ) {
737		- error_log( var_export( $args, true ) );
	738	+ if ( charitable_is_debug() ) {
	739	+ error_log( var_export( $args, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log, WordPress.PHP.DevelopmentFunctions.error_log_var_export
738	740	}
739	741
740	742	/* Post the arguments to PayPal. */
741	743	$request = wp_remote_post( self::get_api_endpoint( $donation->get_test_mode( false ) ), $args );
		@@ -755,12 +757,12 @@
755	757	$message = wp_remote_retrieve_response_message( $request );
756	758
757	759	wp_parse_str( wp_remote_retrieve_body( $request ), $body );
758	760
759		- if ( defined( 'CHARITABLE_DEBUG' ) && CHARITABLE_DEBUG ) {
760		- error_log( var_export( $body, true ) );
761		- error_log( 'Response Code: ' . $code );
762		- error_log( 'Response Message: ' . $message );
	761	+ if ( charitable_is_debug() ) {
	762	+ error_log( var_export( $body, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log, WordPress.PHP.DevelopmentFunctions.error_log_var_export
	763	+ error_log( 'Response Code: ' . $code ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
	764	+ error_log( 'Response Message: ' . $message ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
763	765	}
764	766
765	767	if ( 200 === (int) $code
766	768	&& 'OK' === $message