| @@ -241,13 +241,30 @@ | ||
| 241 | 241 | return true; |
| 242 | 242 | } |
| 243 | 243 | |
| 244 | 244 | protected function get_price_from_request() { |
| 245 | - $number = jet_fb_context()->get_value( $this->price_field ); | |
| 245 | + if ( ! $this->is_price_field_protection_enabled() ) { | |
| 246 | + $number = jet_fb_context()->get_value( $this->price_field ); | |
| 246 | 247 | |
| 247 | - return $this->get_price( is_numeric( $number ) ? $number : 0 ); | |
| 248 | + return $this->get_price( is_numeric( $number ) ? $number : 0 ); | |
| 249 | + } | |
| 250 | + | |
| 251 | + $number = ( new Trusted_Price_Resolver( (int) jet_fb_handler()->form_id ) ) | |
| 252 | + ->resolve( $this->price_field ); | |
| 253 | + | |
| 254 | + return $this->get_price( $number ); | |
| 248 | 255 | } |
| 249 | 256 | |
| 257 | + public function is_price_field_protection_enabled(): bool { | |
| 258 | + return filter_var( | |
| 259 | + $this->gateway( | |
| 260 | + 'protect_price_field', | |
| 261 | + $this->current_scenario( 'protect_price_field', false ) | |
| 262 | + ), | |
| 263 | + FILTER_VALIDATE_BOOLEAN | |
| 264 | + ); | |
| 265 | + } | |
| 266 | + | |
| 250 | 267 | protected function get_price( $price ) { |
| 251 | 268 | return (float) $price; |
| 252 | 269 | } |
| 253 | 270 | |
| @@ -303,9 +320,13 @@ | ||
| 303 | 320 | return; |
| 304 | 321 | } |
| 305 | 322 | |
| 306 | 323 | global $wpdb; |
| 307 | - $sql = "SELECT * FROM $wpdb->postmeta WHERE meta_key = '" . self::GATEWAY_META_KEY . "' AND meta_value LIKE '%$payment%';"; | |
| 324 | + $sql = $wpdb->prepare( | |
| 325 | + "SELECT * FROM $wpdb->postmeta WHERE meta_key = %s AND meta_value LIKE %s", | |
| 326 | + self::GATEWAY_META_KEY, | |
| 327 | + '%' . $wpdb->esc_like( $payment ) . '%' | |
| 328 | + ); | |
| 308 | 329 | |
| 309 | 330 | // phpcs:ignore WordPress.DB |
| 310 | 331 | return $wpdb->get_row( $sql, ARRAY_A ); |
| 311 | 332 | } |
