| @@ -25,14 +25,25 @@ | ||
| 25 | 25 | } |
| 26 | 26 | |
| 27 | 27 | $settingsFields = apply_filters('fluent_cart/integration/get_integration_settings_fields_' . $args['provider'], [], $args); |
| 28 | 28 | |
| 29 | + // An unregistered provider leaves the settings-fields filter unanswered. | |
| 30 | + // Without this guard the foreach below iterated null (warning, silently | |
| 31 | + // skipped) and every submitted key passed through unvalidated — callers | |
| 32 | + // then persisted integration feeds keyed by arbitrary provider names. | |
| 33 | + if (empty($settingsFields)) { | |
| 34 | + return new \WP_Error( | |
| 35 | + 'integration_validation_error', | |
| 36 | + __('Unknown integration provider.', 'fluent-cart') | |
| 37 | + ); | |
| 38 | + } | |
| 39 | + | |
| 29 | 40 | $fields = Arr::get($settingsFields, 'fields'); |
| 30 | 41 | |
| 31 | 42 | $validKeys = ['enabled', 'conditional_variation_ids']; |
| 32 | 43 | |
| 33 | 44 | $errors = []; |
| 34 | - foreach ($fields as $field) { | |
| 45 | + foreach ((array) $fields as $field) { | |
| 35 | 46 | $key = (string)Arr::get($field, 'key'); |
| 36 | 47 | if (!$key) { |
| 37 | 48 | continue; |
| 38 | 49 | } |