← All changes
|
app/Services/ShortCodeParser/Parsers/UserParser.php
+17
-1
1.4.2
→
1.8.0
View file →
| @@ -27,8 +27,14 @@ | ||
| 27 | 27 | 'site_url' => 'getSiteUrl', |
| 28 | 28 | 'site_name' => 'getSiteName', |
| 29 | 29 | ]; |
| 30 | 30 | |
| 31 | + // Anything unlisted would fall through to Arr::get() on the whole parser data | |
| 32 | + // and could walk into the order, its customer and their WP user. | |
| 33 | + protected array $allowedAccessors = [ | |
| 34 | + 'ID', 'id', 'first_name', 'last_name', 'display_name', 'email', 'user_email', 'user_login', | |
| 35 | + ]; | |
| 36 | + | |
| 31 | 37 | protected function setUser() |
| 32 | 38 | { |
| 33 | 39 | $this->user = get_user_by('ID', $this->userId) ?: null; |
| 34 | 40 | } |
| @@ -34,9 +40,13 @@ | ||
| 34 | 40 | } |
| 35 | 41 | |
| 36 | 42 | public function parse($accessor = null, $code = null): ?string |
| 37 | 43 | { |
| 38 | - return $this->get($accessor,$code); | |
| 44 | + if (!in_array($accessor, $this->allowedAccessors, true)) { | |
| 45 | + return ''; | |
| 46 | + } | |
| 47 | + | |
| 48 | + return $this->get($accessor, $code); | |
| 39 | 49 | } |
| 40 | 50 | |
| 41 | 51 | public function getID() |
| 42 | 52 | { |
| @@ -64,8 +74,14 @@ | ||
| 64 | 74 | |
| 65 | 75 | public function getUserEmail() |
| 66 | 76 | { |
| 67 | 77 | return $this->getDataFromUser('user_email'); |
| 78 | + } | |
| 79 | + | |
| 80 | + // Half of the login credentials: admin previews only, never customer-facing renders. | |
| 81 | + public function getUserLogin() | |
| 82 | + { | |
| 83 | + return current_user_can('manage_options') ? $this->getDataFromUser('user_login') : ''; | |
| 68 | 84 | } |
| 69 | 85 | |
| 70 | 86 | private function getDataFromUser(string $key) |
| 71 | 87 | { |