easy-invoice / includes / Services / ProCompatibilityNotice.php

ProCompatibilityNotice.php in Easy Invoice – Invoice Generator, PDF Quotes & Payments 2.4.1, at includes/Services/ProCompatibilityNotice.php

98 lines 3.6 KB

Raw Download Zip

1	<?php
2	/**
3	* Admin notice for an Easy Invoice Pro build older than this plugin expects.
4	*
5	* @package Easy_Invoice
6	* @subpackage Services
7	*/
8
9	namespace EasyInvoice\Services;
10
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	/**
16	* Warns the site owner while client payments are being accepted through the
17	* older, weaker authorisation path.
18	*
19	* Why this exists
20	* ---------------
21	* From 2.4.0 the payment endpoint authorises on a per-invoice access token. Easy
22	* Invoice Pro only began forwarding that token in 2.3.0. Because the free plugin
23	* updates from WordPress.org and Pro arrives from the licence server, a site can
24	* legitimately run a newer free against an older Pro.
25	*
26	* PaymentController::legacyProPaymentFallbackAllowed() keeps those payments working
27	* rather than taking a customer's money without recording it. That fallback is
28	* deliberately no weaker than the behaviour already shipped in 2.3.8, but it is still
29	* weaker than the current one, so the owner should know it is in use and that updating
30	* Pro closes it.
31	*
32	* The notice is entirely self-clearing: it appears only while an old Pro is actually
33	* installed AND the fallback has actually been exercised by a real payment, and it
34	* stops appearing the moment Pro is updated. There is deliberately no dismiss button —
35	* dismissing would hide a live security-relevant state that the owner can fix in one
36	* click, and the condition ends on its own.
37	*/
38	class ProCompatibilityNotice {
39
40	/** Option recording the Pro version last seen using the fallback. */
41	const OPTION = 'easy_invoice_legacy_pro_payment_seen';
42
43	/**
44	* Wire up the notice.
45	*
46	* @return void
47	*/
48	public static function init() {
49	add_action( 'admin_notices', [ __CLASS__, 'render' ] );
50	}
51
52	/**
53	* Output the notice when an outdated Pro is both present and in use.
54	*
55	* @return void
56	*/
57	public static function render() {
58	if ( ! current_user_can( 'manage_options' ) ) {
59	return;
60	}
61
62	$seen = (string) get_option( self::OPTION, '' );
63	if ( $seen === '' ) {
64	return;
65	}
66
67	// Pro updated (or was removed) since the fallback last ran — condition over.
68	if ( ! function_exists( 'easy_invoice_has_pro' ) \|\| ! easy_invoice_has_pro() ) {
69	delete_option( self::OPTION );
70	return;
71	}
72
73	$current = defined( 'EASY_INVOICE_PRO_VERSION' ) ? (string) EASY_INVOICE_PRO_VERSION : '0';
74	if ( version_compare( $current, \EasyInvoice\Controllers\PaymentController::PRO_TOKEN_FORWARDING_VERSION, '>=' ) ) {
75	delete_option( self::OPTION );
76	return;
77	}
78
79	?>
80	<div class="notice notice-warning">
81	<p>
82	<strong><?php esc_html_e( 'Easy Invoice: please update Easy Invoice Pro.', 'easy-invoice' ); ?></strong>
83	</p>
84	<p>
85	<?php
86	printf(
87	/* translators: 1: installed Pro version, 2: required Pro version. */
88	esc_html__( 'Easy Invoice Pro %1$s is older than this version of Easy Invoice. Its payment scripts cannot send the per-invoice access key that this plugin now checks, so client card payments are being accepted using the older authorisation instead. Updating Easy Invoice Pro to %2$s or later restores the stronger check. Payments are working in the meantime — nothing is being lost.', 'easy-invoice' ),
89	esc_html( $current ),
90	esc_html( \EasyInvoice\Controllers\PaymentController::PRO_TOKEN_FORWARDING_VERSION )
91	);
92	?>
93	</p>
94	</div>
95	<?php
96	}
97	}
98