← All changes | app/Modules/PaymentMethods/PayPalGateway/ConnectConfig.php +53 -5 1.6.3 → 1.6.5 View file →

		@@ -4,8 +4,9 @@
4	4
5	5	use FluentCart\App\App;
6	6	use FluentCart\App\Modules\PaymentMethods\PayPalGateway\API\API;
7	7	use FluentCart\App\Modules\PaymentMethods\PayPalGateway\API\PayPalPartner;
	8	+use FluentCart\App\Modules\PaymentMethods\PayPalGateway\API\PayPalPartnerRenderer;
8	9	use FluentCart\App\Modules\PaymentMethods\PayPalGateway\API\Webhook;
9	10	use FluentCart\App\Vite;
10	11	use FluentCart\Framework\Http\Request\Request;
11	12	use FluentCart\Framework\Support\Arr;
		@@ -19,10 +20,20 @@
19	20
20	21	$testAccountInfo = self::getAccountInfo($settings, 'test');
21	22	$liveAccountInfo = self::getAccountInfo($settings, 'live');
22	23
23		- $testConnectRedirect = admin_url('?fluent-cart=fluent_cart_payment_authenticate&payment_method=paypal&type=connect&mode=test');
24		- $liveConnectRedirect = admin_url('?fluent-cart=fluent_cart_payment_authenticate&payment_method=paypal&type=connect&mode=live');
	24	+ $testConnectRedirect = add_query_arg([
	25	+ 'fluent-cart' => 'paypal_connect',
	26	+ 'intent' => 'connect',
	27	+ 'mode' => 'test',
	28	+ '_wpnonce' => wp_create_nonce('fluent_cart_paypal_connect_test'),
	29	+ ], home_url());
	30	+ $liveConnectRedirect = add_query_arg([
	31	+ 'fluent-cart' => 'paypal_connect',
	32	+ 'intent' => 'connect',
	33	+ 'mode' => 'live',
	34	+ '_wpnonce' => wp_create_nonce('fluent_cart_paypal_connect_live'),
	35	+ ], home_url());
25	36
26	37	return [
27	38	'connect_config' => [
28	39	'test_redirect' => $testConnectRedirect,
		@@ -35,10 +46,29 @@
35	46	'settings' => $settings
36	47	];
37	48	}
38	49
	50	+ public static function handleConnect($data): void
	51	+ {
	52	+ $intent = Arr::get($data, 'intent');
	53	+ if ($intent === 'return') {
	54	+ self::parseConnectInfos($data);
	55	+ return;
	56	+ }
	57	+
	58	+ if ($intent !== 'connect') {
	59	+ wp_die(esc_html__('Invalid PayPal connection request.', 'fluent-cart'), '', ['response' => 400]);
	60	+ }
	61	+
	62	+ $mode = self::validateConnectRequest($data, 'connect');
	63	+ // WebRoutes terminates the request after dispatching this action.
	64	+ (new PayPalPartnerRenderer($mode))->template($data);
	65	+ }
	66	+
39	67	public static function parseConnectInfos($vendorData)
40	68	{
	69	+ $mode = self::validateConnectRequest($vendorData, 'return');
	70	+
41	71	if (!$vendorData || !Arr::get($vendorData, 'permissionsGranted')) {
42	72	echo '<div class="fct_message fct_message_error">' . esc_html(__('Invalid PayPal Request. Please try configuring paypal payment gateway again!', 'fluent-cart')) . '</div>';
43	73	die();
44	74	}
		@@ -44,10 +74,8 @@
44	74	}
45	75
46	76	$settingsInstance = App::gateway('paypal')->settings;
47	77
48		- $mode = Arr::get($vendorData, 'mode');
49		-
50	78	/*
51	79	* @todo will verify later
52	80	* we need to verify merchant manually after they create account
53	81	*
		@@ -80,9 +108,9 @@
80	108
81	109	*
82	110	*/
83	111
84		- // update all data that verified
	112	+ // Store metadata only after authorizing the connection return.
85	113	$data = [
86	114	$mode . '_email_address' => sanitize_text_field(Arr::get($vendorData, 'merchantId')),
87	115	$mode . '_account_status' => sanitize_text_field(Arr::get($vendorData, 'accountStatus')),
88	116	];
		@@ -88,8 +116,28 @@
88	116	];
89	117	$settingsInstance->updateNonSensitiveData($data);
90	118
91	119	wp_redirect(admin_url('admin.php?page=fluent-cart#/settings/payments/paypal'));
	120	+ }
	121	+
	122	+ public static function validateConnectRequest($data, string $intent): string
	123	+ {
	124	+ if (!current_user_can('manage_options')) {
	125	+ wp_die(esc_html__('You do not have permission to configure PayPal.', 'fluent-cart'), '', ['response' => 403]);
	126	+ }
	127	+
	128	+ $mode = Arr::get($data, 'mode');
	129	+ if (!in_array($mode, ['live', 'test'], true)) {
	130	+ wp_die(esc_html__('Invalid PayPal payment mode.', 'fluent-cart'), '', ['response' => 400]);
	131	+ }
	132	+
	133	+ $nonce = Arr::get($data, '_wpnonce');
	134	+ $action = $intent === 'return' ? 'fluent_cart_paypal_connect_return_' : 'fluent_cart_paypal_connect_';
	135	+ if (!is_string($nonce) || !wp_verify_nonce(sanitize_text_field($nonce), $action . $mode)) {
	136	+ wp_die(esc_html__('Security check failed. Please try connecting PayPal again.', 'fluent-cart'), '', ['response' => 403]);
	137	+ }
	138	+
	139	+ return $mode;
92	140	}
93	141
94	142	public function getSellerAuthToken(Request $request)
95	143	{