← All changes | src/integrations/class-woocommerce.php +38 -30 5.5.1 → 6.3.0 View file →

		@@ -35,15 +35,8 @@
35	35
36	36	/**
37	37	* Detects if the request is coming from a WooCommerce login context.
38	38	*
39		- * Checks in the following order of reliability:
40		- * 1. Direct WooCommerce page detection (most reliable).
41		- * 2. WooCommerce endpoint detection.
42		- * 3. Form submission detection (more reliable than referer).
43		- * 4. AJAX detection.
44		- * 5. Fallback: Referer check (least reliable).
45		- *
46	39	* @return bool
47	40	*/
48	41	public function is_wc_login_context(): bool {
49	42	if ( ! $this->is_activated() ) {
		@@ -49,43 +42,38 @@
49	42	if ( ! $this->is_activated() ) {
50	43	return false;
51	44	}
52	45
53		- // 1. Direct WooCommerce page detection (most reliable).
54		- if ( function_exists( 'is_account_page' ) && is_account_page() ) {
	46	+ // Problem: REST_REQUEST constant is false during Store API requests, so we check the rest_route parameter instead.
	47	+ $request_uri = defender_get_data_from_request( 'REQUEST_URI', 's' );
	48	+ if ( '' !== $request_uri && str_contains( $request_uri, 'rest_route=/wc/store/v1/checkout' ) ) {
55	49	return true;
56	50	}
57	51
58		- // 2. WooCommerce endpoint detection.
59		- if ( function_exists( 'is_wc_endpoint_url' ) &&
60		- ( is_wc_endpoint_url( 'lost-password' ) || is_wc_endpoint_url( 'customer-logout' )
61		- ) ) {
62		- return true;
63		- }
	52	+ $post_data = defender_get_data_from_request( null, 'p' );
64	53
65		- // 3. Form submission detection (more reliable than referer).
66		- $post_data = defender_get_data_from_request( null, 'p' );
67		- if ( isset( $post_data['woocommerce-login-nonce'] ) ||
68		- isset( $post_data ['woocommerce_checkout_login'] ) ||
69		- ( isset( $post_data ['login'] ) && is_checkout() ) ||
70		- isset( $post_data['wc_reset_password'] ) ) {
71		- return true;
	54	+ if ( 0 === count( $post_data ) ) {
	55	+ return false;
72	56	}
73	57
74		- // 4. AJAX detection.
75		- if ( wp_doing_ajax() && isset( $post_data['wc-ajax'] ) ) {
	58	+ if (
	59	+ isset( $post_data['woocommerce-login-nonce'] ) ||
	60	+ isset( $post_data['woocommerce-register-nonce'] ) ||
	61	+ isset( $post_data['woocommerce_checkout_login'] ) ||
	62	+ ( isset( $post_data['login'] ) && is_checkout() ) ||
	63	+ ( isset( $post_data['register'] ) && isset( $post_data['email'] ) ) ||
	64	+ isset( $post_data['wc_reset_password'] )
	65	+ ) {
76	66	return true;
77	67	}
78	68
79		- // 5. Fallback: Referer check (least reliable).
80	69	$referer = wp_get_referer();
81		- if ( false !== $referer && function_exists( 'wc_get_page_id' ) ) {
	70	+ if ( $referer && function_exists( 'wc_get_page_id' ) ) {
82	71	$my_account_page_id = wc_get_page_id( 'myaccount' );
83	72	if ( $my_account_page_id > 0 ) {
84	73	$my_account_url = get_permalink( $my_account_page_id );
85		- if ( $my_account_url && strpos( $referer, $my_account_url ) === 0 ) {
86		- return true;
87		- }
	74	+
	75	+ return str_starts_with( $referer, $my_account_url );
88	76	}
89	77	}
90	78
91	79	return false;
		@@ -99,10 +87,30 @@
99	87	*/
100	88	public static function get_forms(): array {
101	89	return array(
102	90	self::WOO_LOGIN_FORM => esc_html__( 'Login', 'defender-security' ),
	91	+ self::WOO_LOST_PASSWORD_FORM => esc_html__( 'Lost Password', 'defender-security' ),
103	92	self::WOO_REGISTER_FORM => esc_html__( 'Registration', 'defender-security' ),
104		- self::WOO_LOST_PASSWORD_FORM => esc_html__( 'Lost Password', 'defender-security' ),
105	93	self::WOO_CHECKOUT_FORM => esc_html__( 'Checkout', 'defender-security' ),
106	94	);
	95	+ }
	96	+
	97	+ /**
	98	+ * Detects if current request originates from WooCommerce code path.
	99	+ *
	100	+ * @return bool
	101	+ */
	102	+ public function is_woocommerce_page(): bool {
	103	+ if ( ! $this->is_activated() ) {
	104	+ return false;
	105	+ }
	106	+
	107	+ $traces = debug_backtrace(); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace
	108	+ foreach ( $traces as $trace ) {
	109	+ if ( isset( $trace['file'] ) && str_contains( $trace['file'], 'woocommerce' ) ) {
	110	+ return true;
	111	+ }
	112	+ }
	113	+
	114	+ return false;
107	115	}
108	116	}