← All changes | templates/admin/manual-payment-verification.php +42 -39 2.3.6 → 2.4.0 View file →

		@@ -12,15 +12,15 @@
12	12
13	13	// Get invoice ID
14	14	$invoice_id = isset($_GET['invoice_id']) ? intval($_GET['invoice_id']) : 0;
15	15	if (!$invoice_id) {
16		- wp_die(__('Invoice ID is required', 'easy-invoice'));
	16	+ wp_die(esc_html__('Invoice ID is required', 'easy-invoice'));
17	17	}
18	18
19	19	// Get invoice
20	20	$invoice = new \EasyInvoice\Models\Invoice(get_post($invoice_id));
21	21	if (!$invoice->getPost()) {
22		- wp_die(__('Invalid invoice', 'easy-invoice'));
	22	+ wp_die(esc_html__('Invalid invoice', 'easy-invoice'));
23	23	}
24	24
25	25	// Get payment details
26	26	$payment_method = get_post_meta($invoice_id, '_payment_method', true);
		@@ -27,9 +27,11 @@
27	27	$payment_status = get_post_meta($invoice_id, '_payment_status', true);
28	28
29	29	// If not a manual payment or not pending, redirect to invoice view
30	30	if (!in_array($payment_method, ['bank', 'cheque']) || $payment_status !== 'pending') {
31		- wp_redirect(admin_url('admin.php?page=easy-invoice-invoices&action=view&id=' . $invoice_id));
	31	+ // `easy-invoice-invoices` is not a registered admin page, so this redirect
	32	+ // landed the admin on a 403. The invoice list is `easy-invoice-all`.
	33	+ wp_safe_redirect(admin_url('admin.php?page=easy-invoice-all'));
32	34	exit;
33	35	}
34	36
35	37	// Get payment proof details
		@@ -61,29 +63,29 @@
61	63	$formatted_payment_date = $payment_date ? date_i18n(get_option('date_format'), strtotime($payment_date)) : '';
62	64	?>
63	65
64	66	<div class="wrap">
65		- <h1><?php printf(__('Verify %s Payment', 'easy-invoice'), $payment_method_label); ?></h1>
	67	+ <h1><?php /* translators: %s: payment method. */ printf(esc_html__('Verify %s Payment', 'easy-invoice'), esc_html($payment_method_label)); ?></h1>
66	68
67	69	<div class="notice notice-info">
68		- <p><?php _e('Please review the payment details submitted by the customer and verify the payment.', 'easy-invoice'); ?></p>
	70	+ <p><?php esc_html_e('Please review the payment details submitted by the customer and verify the payment.', 'easy-invoice'); ?></p>
69	71	</div>
70	72
71	73	<div class="metabox-holder">
72	74	<div class="postbox">
73		- <h2 class="hndle"><span><?php _e('Invoice Details', 'easy-invoice'); ?></span></h2>
	75	+ <h2 class="hndle"><span><?php esc_html_e('Invoice Details', 'easy-invoice'); ?></span></h2>
74	76	<div class="inside">
75	77	<table class="form-table">
76	78	<tr>
77		- <th><?php _e('Invoice Number', 'easy-invoice'); ?></th>
	79	+ <th><?php esc_html_e('Invoice Number', 'easy-invoice'); ?></th>
78	80	<td><?php echo esc_html($invoice->getNumber()); ?></td>
79	81	</tr>
80	82	<tr>
81		- <th><?php _e('Customer', 'easy-invoice'); ?></th>
	83	+ <th><?php esc_html_e('Customer', 'easy-invoice'); ?></th>
82	84	<td><?php echo esc_html($invoice->getCustomerName()); ?></td>
83	85	</tr>
84	86	<tr>
85		- <th><?php _e('Amount', 'easy-invoice'); ?></th>
	87	+ <th><?php esc_html_e('Amount', 'easy-invoice'); ?></th>
86	88	<td><?php
87	89	$formatter = new \EasyInvoice\Helpers\InvoiceFormatter($invoice);
88	90	echo esc_html($formatter->format($invoice->getTotal()));
89	91	?></td>
		@@ -88,9 +90,9 @@
88	90	echo esc_html($formatter->format($invoice->getTotal()));
89	91	?></td>
90	92	</tr>
91	93	<tr>
92		- <th><?php _e('Due Date', 'easy-invoice'); ?></th>
	94	+ <th><?php esc_html_e('Due Date', 'easy-invoice'); ?></th>
93	95	<td><?php echo esc_html($invoice->getDueDate()); ?></td>
94	96	</tr>
95	97	</table>
96	98	</div>
		@@ -96,30 +98,30 @@
96	98	</div>
97	99	</div>
98	100
99	101	<div class="postbox">
100		- <h2 class="hndle"><span><?php printf(__('%s Payment Details', 'easy-invoice'), $payment_method_label); ?></span></h2>
	102	+ <h2 class="hndle"><span><?php /* translators: %s: payment method. */ printf(esc_html__('%s Payment Details', 'easy-invoice'), esc_html($payment_method_label)); ?></span></h2>
101	103	<div class="inside">
102	104	<table class="form-table">
103	105	<?php if ($payment_method === 'bank'): ?>
104	106	<tr>
105		- <th><?php _e('Transaction ID', 'easy-invoice'); ?></th>
	107	+ <th><?php esc_html_e('Transaction ID', 'easy-invoice'); ?></th>
106	108	<td><?php echo esc_html($transaction_id); ?></td>
107	109	</tr>
108	110	<?php elseif ($payment_method === 'cheque'): ?>
109	111	<tr>
110		- <th><?php _e('Cheque Number', 'easy-invoice'); ?></th>
	112	+ <th><?php esc_html_e('Cheque Number', 'easy-invoice'); ?></th>
111	113	<td><?php echo esc_html($transaction_id); ?></td>
112	114	</tr>
113	115	<?php if ($bank_name): ?>
114	116	<tr>
115		- <th><?php _e('Bank Name', 'easy-invoice'); ?></th>
	117	+ <th><?php esc_html_e('Bank Name', 'easy-invoice'); ?></th>
116	118	<td><?php echo esc_html($bank_name); ?></td>
117	119	</tr>
118	120	<?php endif; ?>
119	121	<?php if ($payment_date): ?>
120	122	<tr>
121		- <th><?php _e('Cheque Date', 'easy-invoice'); ?></th>
	123	+ <th><?php esc_html_e('Cheque Date', 'easy-invoice'); ?></th>
122	124	<td><?php echo esc_html($formatted_payment_date); ?></td>
123	125	</tr>
124	126	<?php endif; ?>
125	127	<?php endif; ?>
		@@ -125,9 +127,9 @@
125	127	<?php endif; ?>
126	128
127	129	<?php if ($submission_date): ?>
128	130	<tr>
129		- <th><?php _e('Submission Date', 'easy-invoice'); ?></th>
	131	+ <th><?php esc_html_e('Submission Date', 'easy-invoice'); ?></th>
130	132	<td><?php echo esc_html($formatted_submission_date); ?></td>
131	133	</tr>
132	134	<?php endif; ?>
133	135
		@@ -132,22 +134,22 @@
132	134	<?php endif; ?>
133	135
134	136	<?php if ($notes): ?>
135	137	<tr>
136		- <th><?php _e('Customer Notes', 'easy-invoice'); ?></th>
137		- <td><?php echo wpautop(esc_html($notes)); ?></td>
	138	+ <th><?php esc_html_e('Customer Notes', 'easy-invoice'); ?></th>
	139	+ <td><?php echo wp_kses_post(wpautop(esc_html($notes))); ?></td>
138	140	</tr>
139	141	<?php endif; ?>
140	142
141	143	<?php if ($proof_url): ?>
142	144	<tr>
143		- <th><?php _e('Payment Proof', 'easy-invoice'); ?></th>
	145	+ <th><?php esc_html_e('Payment Proof', 'easy-invoice'); ?></th>
144	146	<td>
145	147	<?php if (wp_check_filetype(basename($proof_url), null)['ext'] === 'pdf'): ?>
146		- <a href="<?php echo esc_url($proof_url); ?>" target="_blank" class="button"><?php _e('View PDF', 'easy-invoice'); ?></a>
	148	+ <a href="<?php echo esc_url($proof_url); ?>" target="_blank" class="button"><?php esc_html_e('View PDF', 'easy-invoice'); ?></a>
147	149	<?php else: ?>
148	150	<a href="<?php echo esc_url($proof_url); ?>" target="_blank">
149		- <img src="<?php echo esc_url($proof_url); ?>" alt="<?php _e('Payment Proof', 'easy-invoice'); ?>" style="max-width: 300px; max-height: 200px;">
	151	+ <img src="<?php echo esc_url($proof_url); ?>" alt="<?php echo esc_js(__('Payment Proof', 'easy-invoice')); ?>" style="max-width: 300px; max-height: 200px;">
150	152	</a>
151	153	<?php endif; ?>
152	154	</td>
153	155	</tr>
		@@ -156,9 +158,9 @@
156	158	</div>
157	159	</div>
158	160
159	161	<div class="postbox">
160		- <h2 class="hndle"><span><?php _e('Payment Verification', 'easy-invoice'); ?></span></h2>
	162	+ <h2 class="hndle"><span><?php esc_html_e('Payment Verification', 'easy-invoice'); ?></span></h2>
161	163	<div class="inside">
162	164	<form id="payment-verification-form" method="post">
163	165	<input type="hidden" name="action" value="easy_invoice_verify_manual_payment">
164	166	<input type="hidden" name="invoice_id" value="<?php echo esc_attr($invoice_id); ?>">
		@@ -166,32 +168,32 @@
166	168	<?php wp_nonce_field('easy_invoice_admin', 'nonce'); ?>
167	169
168	170	<table class="form-table">
169	171	<tr>
170		- <th><?php _e('Transaction ID', 'easy-invoice'); ?></th>
	172	+ <th><?php esc_html_e('Transaction ID', 'easy-invoice'); ?></th>
171	173	<td>
172	174	<input type="text" name="transaction_id" value="<?php echo esc_attr($transaction_id); ?>" class="regular-text">
173		- <p class="description"><?php _e('Enter the transaction ID for this payment.', 'easy-invoice'); ?></p>
	175	+ <p class="description"><?php esc_html_e('Enter the transaction ID for this payment.', 'easy-invoice'); ?></p>
174	176	</td>
175	177	</tr>
176	178	<tr>
177		- <th><?php _e('Admin Notes', 'easy-invoice'); ?></th>
	179	+ <th><?php esc_html_e('Admin Notes', 'easy-invoice'); ?></th>
178	180	<td>
179	181	<textarea name="notes" rows="3" class="large-text"></textarea>
180		- <p class="description"><?php _e('Add any notes about this payment (optional).', 'easy-invoice'); ?></p>
	182	+ <p class="description"><?php esc_html_e('Add any notes about this payment (optional).', 'easy-invoice'); ?></p>
181	183	</td>
182	184	</tr>
183	185	</table>
184	186
185	187	<div class="verification-actions">
186		- <button type="submit" class="button button-primary verify-payment-btn"><?php _e('Verify Payment', 'easy-invoice'); ?></button>
187		- <button type="button" class="button reject-payment-btn"><?php _e('Reject Payment', 'easy-invoice'); ?></button>
	188	+ <button type="submit" class="button button-primary verify-payment-btn"><?php esc_html_e('Verify Payment', 'easy-invoice'); ?></button>
	189	+ <button type="button" class="button reject-payment-btn"><?php esc_html_e('Reject Payment', 'easy-invoice'); ?></button>
188	190	</div>
189	191	</form>
190	192
191	193	<div id="reject-payment-form" style="display: none; margin-top: 20px; padding-top: 20px; border-top: 1px solid #ddd;">
192		- <h3><?php _e('Reject Payment', 'easy-invoice'); ?></h3>
193		- <p><?php _e('Please provide a reason for rejecting this payment:', 'easy-invoice'); ?></p>
	194	+ <h3><?php esc_html_e('Reject Payment', 'easy-invoice'); ?></h3>
	195	+ <p><?php esc_html_e('Please provide a reason for rejecting this payment:', 'easy-invoice'); ?></p>
194	196
195	197	<form method="post">
196	198	<input type="hidden" name="action" value="easy_invoice_reject_manual_payment">
197	199	<input type="hidden" name="invoice_id" value="<?php echo esc_attr($invoice_id); ?>">
		@@ -197,13 +199,13 @@
197	199	<input type="hidden" name="invoice_id" value="<?php echo esc_attr($invoice_id); ?>">
198	200	<?php wp_nonce_field('easy_invoice_admin', 'nonce'); ?>
199	201
200	202	<textarea name="reason" rows="3" class="large-text" required></textarea>
201		- <p class="description"><?php _e('This reason will be included in the email sent to the customer.', 'easy-invoice'); ?></p>
	203	+ <p class="description"><?php esc_html_e('This reason will be included in the email sent to the customer.', 'easy-invoice'); ?></p>
202	204
203	205	<div class="verification-actions" style="margin-top: 10px;">
204		- <button type="submit" class="button button-secondary"><?php _e('Confirm Rejection', 'easy-invoice'); ?></button>
205		- <button type="button" class="button cancel-rejection-btn"><?php _e('Cancel', 'easy-invoice'); ?></button>
	206	+ <button type="submit" class="button button-secondary"><?php esc_html_e('Confirm Rejection', 'easy-invoice'); ?></button>
	207	+ <button type="button" class="button cancel-rejection-btn"><?php esc_html_e('Cancel', 'easy-invoice'); ?></button>
206	208	</div>
207	209	</form>
208	210	</div>
209	211	</div>
		@@ -239,9 +241,9 @@
239	241
240	242	var formData = $(this).serialize();
241	243
242	244	// Show loading
243		- $('.verify-payment-btn').prop('disabled', true).text('<?php _e('Processing...', 'easy-invoice'); ?>');
	245	+ $('.verify-payment-btn').prop('disabled', true).text('<?php echo esc_js(__('Processing...', 'easy-invoice')); ?>');
244	246
245	247	$.ajax({
246	248	url: ajaxurl,
247	249	type: 'POST',
		@@ -253,9 +255,10 @@
253	255	EasyInvoiceToast.success(response.data.message);
254	256	} else {
255	257	alert(response.data.message);
256	258	}
257		- window.location.href = '<?php echo esc_js(admin_url('admin.php?page=easy-invoice-invoices&action=view&id=' . $invoice_id)); ?>';
	259	+ // See note above: `easy-invoice-invoices` 403s; the list page is `easy-invoice-all`.
	260	+ window.location.href = '<?php echo esc_js(admin_url('admin.php?page=easy-invoice-all')); ?>';
258	261	} else {
259	262	// Use toast system if available, otherwise fallback to alert
260	263	if (typeof EasyInvoiceToast !== 'undefined') {
261	264	EasyInvoiceToast.error(response.data.message);
		@@ -261,20 +264,20 @@
261	264	EasyInvoiceToast.error(response.data.message);
262	265	} else {
263	266	alert(response.data.message);
264	267	}
265		- $('.verify-payment-btn').prop('disabled', false).text('<?php _e('Verify Payment', 'easy-invoice'); ?>');
	268	+ $('.verify-payment-btn').prop('disabled', false).text('<?php echo esc_js(__('Verify Payment', 'easy-invoice')); ?>');
266	269	}
267	270	},
268	271	error: function() {
269	272	// Use toast system if available, otherwise fallback to alert
270	273	if (typeof EasyInvoiceToast !== 'undefined') {
271		- EasyInvoiceToast.error('<?php _e('An error occurred. Please try again.', 'easy-invoice'); ?>');
	274	+ EasyInvoiceToast.error('<?php echo esc_js(__('An error occurred. Please try again.', 'easy-invoice')); ?>');
272	275	} else {
273		- alert('<?php _e('An error occurred. Please try again.', 'easy-invoice'); ?>');
	276	+ alert('<?php echo esc_js(__('An error occurred. Please try again.', 'easy-invoice')); ?>');
274	277	}
275		- $('.verify-payment-btn').prop('disabled', false).text('<?php _e('Verify Payment', 'easy-invoice'); ?>');
	278	+ $('.verify-payment-btn').prop('disabled', false).text('<?php echo esc_js(__('Verify Payment', 'easy-invoice')); ?>');
276	279	}
277	280	});
278	281	});
279	282	});
280	283	</script>