← All changes
|
app/Http/Controllers/FrontendControllers/CustomerController.php
+34
-2
1.4.2
→
1.6.5
View file →
| @@ -10,8 +10,9 @@ | ||
| 10 | 10 | use FluentCart\App\Http\Controllers\Controller; |
| 11 | 11 | use FluentCart\App\Http\Requests\CustomerRequest; |
| 12 | 12 | use FluentCart\App\Http\Requests\FrontendRequests\CustomerAddressRequest; |
| 13 | 13 | use FluentCart\App\Models\CustomerAddresses; |
| 14 | +use FluentCart\App\Services\CustomerIdentity\EmailVerificationService; | |
| 14 | 15 | use FluentCart\App\Services\Localization\LocalizationManager; |
| 15 | 16 | use FluentCart\App\Services\Renderer\AddressSelectRenderer; |
| 16 | 17 | use FluentCart\App\Services\Renderer\CheckoutFieldsSchema; |
| 17 | 18 | use FluentCart\Framework\Http\Request\Request; |
| @@ -60,9 +61,24 @@ | ||
| 60 | 61 | return $this->sendError([ |
| 61 | 62 | 'message' => __('You are not authorized to view this customer', 'fluent-cart') |
| 62 | 63 | ]); |
| 63 | 64 | } |
| 64 | - return CustomerResource::find($customerId, ['with' => $request->get('with', [])]); | |
| 65 | + // The customer never chooses its own eager loads. Forwarding the request's | |
| 66 | + // `with` here let a logged-in customer walk relations off their own record | |
| 67 | + // — `wpUser` for the WordPress user row, or `orders`/`subscriptions` for | |
| 68 | + // gateway identifiers the account pages never show. The ownership check | |
| 69 | + // above limits it to their own data, which is not the same as safe. | |
| 70 | + // | |
| 71 | + // These four are the customer's own addresses, which is what a profile | |
| 72 | + // detail view is for. Anything wider belongs to the admin endpoint. | |
| 73 | + return CustomerResource::find($customerId, [ | |
| 74 | + 'with' => [ | |
| 75 | + 'billing_address', | |
| 76 | + 'shipping_address', | |
| 77 | + 'primary_billing_address', | |
| 78 | + 'primary_shipping_address', | |
| 79 | + ], | |
| 80 | + ]); | |
| 65 | 81 | } |
| 66 | 82 | |
| 67 | 83 | public function getAddress(Request $request, $customerId) |
| 68 | 84 | { |
| @@ -73,9 +89,19 @@ | ||
| 73 | 89 | } |
| 74 | 90 | |
| 75 | 91 | public function updateAddressSelect(Request $request, $customerAddressId) |
| 76 | 92 | { |
| 77 | - $customer = CustomerResource::getCurrentCustomer(); | |
| 93 | + if (is_user_logged_in() && EmailVerificationService::isRequired(get_current_user_id())) { | |
| 94 | + return $this->sendError([ | |
| 95 | + 'message' => __('Please verify your email before using saved addresses.', 'fluent-cart') | |
| 96 | + ], 403); | |
| 97 | + } | |
| 98 | + | |
| 99 | + // The imported CustomerResource is the FrontendResource variant, which has | |
| 100 | + // no getCurrentCustomer — calling it there hits BaseResourceApi::__callStatic | |
| 101 | + // and 500s for every caller. The current-customer resolver lives on the | |
| 102 | + // core resource, same as getDetails/createAddress above. | |
| 103 | + $customer = \FluentCart\Api\Resource\CustomerResource::getCurrentCustomer(); | |
| 78 | 104 | if (!$customer) { |
| 79 | 105 | return $this->sendError([ |
| 80 | 106 | 'message' => __('Address not found', 'fluent-cart') |
| 81 | 107 | ]); |
| @@ -156,8 +182,14 @@ | ||
| 156 | 182 | |
| 157 | 183 | |
| 158 | 184 | public function createAddress(Request $request) //CustomerAddressRequest |
| 159 | 185 | { |
| 186 | + if (is_user_logged_in() && EmailVerificationService::isRequired(get_current_user_id())) { | |
| 187 | + return $this->sendError([ | |
| 188 | + 'message' => __('Please verify your email before using saved addresses.', 'fluent-cart') | |
| 189 | + ], 403); | |
| 190 | + } | |
| 191 | + | |
| 160 | 192 | $customer = \FluentCart\Api\Resource\CustomerResource::getCurrentCustomer(); |
| 161 | 193 | |
| 162 | 194 | if (empty($customer)) { |
| 163 | 195 | return $this->sendError([ |