PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 7.6.2
Jetpack – WP Security, Backup, Speed, & Growth v7.6.2
16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 14.1.1 All 503 releases
jetpack / modules / widgets / simple-payments.php

simple-payments.php in Jetpack – WP Security, Backup, Speed, & Growth 7.6.2, at modules/widgets/simple-payments.php

548 lines 19.0 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 use Automattic\Jetpack\Tracking;
3
4 /**
5 * Disable direct access/execution to/of the widget code.
6 */
7 if ( ! defined( 'ABSPATH' ) ) {
8 exit;
9 }
10
11 if ( ! class_exists( 'Jetpack_Simple_Payments_Widget' ) ) {
12 /**
13 * Simple Payments Button
14 *
15 * Display a Simple Payments Button as a Widget.
16 */
17 class Jetpack_Simple_Payments_Widget extends WP_Widget {
18 // https://developer.paypal.com/docs/integration/direct/rest/currency-codes/
19 private static $supported_currency_list = array(
20 'USD' => '$',
21 'GBP' => '&#163;',
22 'JPY' => '&#165;',
23 'BRL' => 'R$',
24 'EUR' => '&#8364;',
25 'NZD' => 'NZ$',
26 'AUD' => 'A$',
27 'CAD' => 'C$',
28 'INR' => '',
29 'ILS' => '',
30 'RUB' => '',
31 'MXN' => 'MX$',
32 'SEK' => 'Skr',
33 'HUF' => 'Ft',
34 'CHF' => 'CHF',
35 'CZK' => '',
36 'DKK' => 'Dkr',
37 'HKD' => 'HK$',
38 'NOK' => 'Kr',
39 'PHP' => '',
40 'PLN' => 'PLN',
41 'SGD' => 'S$',
42 'TWD' => 'NT$',
43 'THB' => '฿',
44 );
45
46 /**
47 * Constructor.
48 */
49 function __construct() {
50 parent::__construct(
51 'jetpack_simple_payments_widget',
52 /** This filter is documented in modules/widgets/facebook-likebox.php */
53 apply_filters( 'jetpack_widget_name', __( 'Simple Payments', 'jetpack' ) ),
54 array(
55 'classname' => 'jetpack-simple-payments',
56 'description' => __( 'Add a Simple Payments Button as a Widget.', 'jetpack' ),
57 'customize_selective_refresh' => true,
58 )
59 );
60
61 global $pagenow;
62 if ( is_customize_preview() || 'widgets.php' === $pagenow ) {
63 add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_styles' ) );
64 }
65
66 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
67 if ( is_customize_preview() && $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
68 add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );
69
70 add_filter( 'customize_refresh_nonces', array( $this, 'filter_nonces' ) );
71 add_action( 'wp_ajax_customize-jetpack-simple-payments-buttons-get', array( $this, 'ajax_get_payment_buttons' ) );
72 add_action( 'wp_ajax_customize-jetpack-simple-payments-button-save', array( $this, 'ajax_save_payment_button' ) );
73 add_action( 'wp_ajax_customize-jetpack-simple-payments-button-delete', array( $this, 'ajax_delete_payment_button' ) );
74 }
75
76 if ( is_active_widget( false, false, $this->id_base ) || is_customize_preview() ) {
77 add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_style' ) );
78 }
79 }
80
81 /**
82 * Return an associative array of default values.
83 *
84 * These values are used in new widgets.
85 *
86 * @return array Default values for the widget options.
87 */
88 private function defaults() {
89 $current_user = wp_get_current_user();
90 $default_product_id = $this->get_first_product_id();
91
92 return array(
93 'title' => '',
94 'product_post_id' => $default_product_id,
95 'form_action' => '',
96 'form_product_id' => 0,
97 'form_product_title' => '',
98 'form_product_description' => '',
99 'form_product_image_id' => 0,
100 'form_product_image_src' => '',
101 'form_product_currency' => '',
102 'form_product_price' => '',
103 'form_product_multiple' => '',
104 'form_product_email' => $current_user->user_email,
105 );
106 }
107
108 /**
109 * Adds a nonce for customizing menus.
110 *
111 * @param array $nonces Array of nonces.
112 * @return array $nonces Modified array of nonces.
113 */
114 function filter_nonces( $nonces ) {
115 $nonces['customize-jetpack-simple-payments'] = wp_create_nonce( 'customize-jetpack-simple-payments' );
116 return $nonces;
117 }
118
119 function enqueue_style() {
120 wp_enqueue_style( 'jetpack-simple-payments-widget-style', plugins_url( 'simple-payments/style.css', __FILE__ ), array(), '20180518' );
121 }
122
123 function admin_enqueue_styles() {
124 wp_enqueue_style( 'jetpack-simple-payments-widget-customizer', plugins_url( 'simple-payments/customizer.css', __FILE__ ) );
125 }
126
127 function admin_enqueue_scripts() {
128 wp_enqueue_media();
129 wp_enqueue_script( 'jetpack-simple-payments-widget-customizer', plugins_url( '/simple-payments/customizer.js', __FILE__ ), array( 'jquery' ), false, true );
130 wp_localize_script(
131 'jetpack-simple-payments-widget-customizer', 'jpSimplePaymentsStrings', array(
132 'deleteConfirmation' => __( 'Are you sure you want to delete this item? It will be disabled and removed from all locations where it currently appears.', 'jetpack' ),
133 )
134 );
135 }
136
137 public function ajax_get_payment_buttons() {
138 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
139 wp_send_json_error( 'bad_nonce', 400 );
140 }
141
142 if ( ! current_user_can( 'customize' ) ) {
143 wp_send_json_error( 'customize_not_allowed', 403 );
144 }
145
146 $post_type_object = get_post_type_object( Jetpack_Simple_Payments::$post_type_product );
147 if ( ! current_user_can( $post_type_object->cap->create_posts ) || ! current_user_can( $post_type_object->cap->publish_posts ) ) {
148 wp_send_json_error( 'insufficient_post_permissions', 403 );
149 }
150
151 $product_posts = get_posts(
152 array(
153 'numberposts' => 100,
154 'orderby' => 'date',
155 'post_type' => Jetpack_Simple_Payments::$post_type_product,
156 'post_status' => 'publish',
157 )
158 );
159
160 $formatted_products = array_map( array( $this, 'format_product_post_for_ajax_reponse' ), $product_posts );
161
162 wp_send_json_success( $formatted_products );
163 }
164
165 public function format_product_post_for_ajax_reponse( $product_post ) {
166 return array(
167 'ID' => $product_post->ID,
168 'post_title' => $product_post->post_title,
169 );
170 }
171
172 public function ajax_save_payment_button() {
173 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
174 wp_send_json_error( 'bad_nonce', 400 );
175 }
176
177 if ( ! current_user_can( 'customize' ) ) {
178 wp_send_json_error( 'customize_not_allowed', 403 );
179 }
180
181 $post_type_object = get_post_type_object( Jetpack_Simple_Payments::$post_type_product );
182 if ( ! current_user_can( $post_type_object->cap->create_posts ) || ! current_user_can( $post_type_object->cap->publish_posts ) ) {
183 wp_send_json_error( 'insufficient_post_permissions', 403 );
184 }
185
186 if ( empty( $_POST['params'] ) || ! is_array( $_POST['params'] ) ) {
187 wp_send_json_error( 'missing_params', 400 );
188 }
189
190 $params = wp_unslash( $_POST['params'] );
191 $errors = $this->validate_ajax_params( $params );
192 if ( ! empty( $errors->errors ) ) {
193 wp_send_json_error( $errors );
194 }
195
196 $product_post_id = isset( $params['product_post_id'] ) ? intval( $params['product_post_id'] ) : 0;
197
198 $product_post = array(
199 'ID' => $product_post_id,
200 'post_type' => Jetpack_Simple_Payments::$post_type_product,
201 'post_status' => 'publish',
202 'post_title' => $params['post_title'],
203 'post_content' => $params['post_content'],
204 '_thumbnail_id' => ! empty( $params['image_id'] ) ? $params['image_id'] : -1,
205 'meta_input' => array(
206 'spay_currency' => $params['currency'],
207 'spay_price' => $params['price'],
208 'spay_multiple' => isset( $params['multiple'] ) ? intval( $params['multiple'] ) : 0,
209 'spay_email' => is_email( $params['email'] ),
210 ),
211 );
212
213 if ( empty( $product_post_id ) ) {
214 $product_post_id = wp_insert_post( $product_post );
215 } else {
216 $product_post_id = wp_update_post( $product_post );
217 }
218
219 if ( ! $product_post_id || is_wp_error( $product_post_id ) ) {
220 wp_send_json_error( $product_post_id );
221 }
222
223 $tracks_properties = array(
224 'id' => $product_post_id,
225 'currency' => $params['currency'],
226 'price' => $params['price'],
227 );
228 if ( 0 === $product_post['ID'] ) {
229 $this->record_event( 'created', 'create', $tracks_properties );
230 } else {
231 $this->record_event( 'updated', 'update', $tracks_properties );
232 }
233
234 wp_send_json_success(
235 array(
236 'product_post_id' => $product_post_id,
237 'product_post_title' => $params['post_title'],
238 )
239 );
240 }
241
242 public function ajax_delete_payment_button() {
243 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
244 wp_send_json_error( 'bad_nonce', 400 );
245 }
246
247 if ( ! current_user_can( 'customize' ) ) {
248 wp_send_json_error( 'customize_not_allowed', 403 );
249 }
250
251 if ( empty( $_POST['params'] ) || ! is_array( $_POST['params'] ) ) {
252 wp_send_json_error( 'missing_params', 400 );
253 }
254
255 $params = wp_unslash( $_POST['params'] );
256 $illegal_params = array_diff( array_keys( $params ), array( 'product_post_id' ) );
257 if ( ! empty( $illegal_params ) ) {
258 wp_send_json_error( 'illegal_params', 400 );
259 }
260
261 $product_id = (int) $params['product_post_id'];
262 $product_post = get_post( $product_id );
263
264 $return = array( 'status' => $product_post->post_status );
265
266 wp_delete_post( $product_id, true );
267 $status = get_post_status( $product_id );
268 if ( false === $status ) {
269 $return['status'] = 'deleted';
270 }
271
272 $this->record_event( 'deleted', 'delete', array( 'id' => $product_id ) );
273
274 wp_send_json_success( $return );
275 }
276
277 /**
278 * Returns the number of decimal places on string representing a price.
279 *
280 * @param string $number Price to check.
281 * @return number number of decimal places.
282 */
283 private function get_decimal_places( $number ) {
284 $parts = explode( '.', $number );
285 if ( count( $parts ) > 2 ) {
286 return null;
287 }
288
289 return isset( $parts[1] ) ? strlen( $parts[1] ) : 0;
290 }
291
292 public function validate_ajax_params( $params ) {
293 $errors = new WP_Error();
294
295 $illegal_params = array_diff( array_keys( $params ), array( 'product_post_id', 'post_title', 'post_content', 'image_id', 'currency', 'price', 'multiple', 'email' ) );
296 if ( ! empty( $illegal_params ) ) {
297 $errors->add( 'illegal_params', __( 'Invalid parameters.', 'jetpack' ) );
298 }
299
300 if ( empty( $params['post_title'] ) ) {
301 $errors->add( 'post_title', __( "People need to know what they're paying for! Please add a brief title.", 'jetpack' ) );
302 }
303
304 if ( empty( $params['price'] ) || ! is_numeric( $params['price'] ) || floatval( $params['price'] ) <= 0 ) {
305 $errors->add( 'price', __( 'Everything comes with a price tag these days. Please add a your product price.', 'jetpack' ) );
306 }
307
308 // Japan's Yen is the only supported currency with a zero decimal precision.
309 $precision = strtoupper( $params['currency'] ) === 'JPY' ? 0 : 2;
310 $price_decimal_places = $this->get_decimal_places( $params['price'] );
311 if ( is_null( $price_decimal_places ) || $price_decimal_places > $precision ) {
312 $errors->add( 'price', __( 'Invalid price', 'jetpack' ) );
313 }
314
315 if ( empty( $params['email'] ) || ! is_email( $params['email'] ) ) {
316 $errors->add( 'email', __( 'We want to make sure payments reach you, so please add an email address.', 'jetpack' ) );
317 }
318
319 return $errors;
320 }
321
322 function get_first_product_id() {
323 $product_posts = get_posts(
324 array(
325 'numberposts' => 1,
326 'orderby' => 'date',
327 'post_type' => Jetpack_Simple_Payments::$post_type_product,
328 'post_status' => 'publish',
329 )
330 );
331
332 return ! empty( $product_posts ) ? $product_posts[0]->ID : null;
333 }
334
335 /**
336 * Front-end display of widget.
337 *
338 * @see WP_Widget::widget()
339 *
340 * @param array $args Widget arguments.
341 * @param array $instance Saved values from database.
342 */
343 function widget( $args, $instance ) {
344 $instance = wp_parse_args( $instance, $this->defaults() );
345
346 echo $args['before_widget'];
347
348 /** This filter is documented in core/src/wp-includes/default-widgets.php */
349 $title = apply_filters( 'widget_title', $instance['title'] );
350 if ( ! empty( $title ) ) {
351 echo $args['before_title'] . $title . $args['after_title'];
352 }
353
354 echo '<div class="jetpack-simple-payments-content">';
355
356 if ( ! empty( $instance['form_action'] ) && in_array( $instance['form_action'], array( 'add', 'edit' ) ) && is_customize_preview() ) {
357 require( dirname( __FILE__ ) . '/simple-payments/widget.php' );
358 } else {
359 $jsp = Jetpack_Simple_Payments::getInstance();
360 $simple_payments_button = $jsp->parse_shortcode(
361 array(
362 'id' => $instance['product_post_id'],
363 )
364 );
365
366 if ( ! is_null( $simple_payments_button ) || is_customize_preview() ) {
367 echo $simple_payments_button;
368 }
369 }
370
371 echo '</div><!--simple-payments-->';
372
373 echo $args['after_widget'];
374
375 /** This action is already documented in modules/widgets/gravatar-profile.php */
376 do_action( 'jetpack_stats_extra', 'widget_view', 'simple_payments' );
377 }
378
379 /**
380 * Gets the latests field value from either the old instance or the new instance.
381 *
382 * @param array $mixed Array of values for the new form instance.
383 * @param array $mixed Array of values for the old form instance.
384 * @return mixed $mixed Field value.
385 */
386 private function get_latest_field_value( $new_instance, $old_instance, $field ) {
387 return ! empty( $new_instance[ $field ] )
388 ? sanitize_text_field( $new_instance[ $field ] )
389 : $old_instance[ $field ];
390 }
391
392 /**
393 * Gets the product fields from the product post. If no post found
394 * it returns the default values.
395 *
396 * @param int Product Post ID.
397 * @return array $fields Product Fields from the Product Post.
398 */
399 private function get_product_from_post( $product_post_id ) {
400 $product_post = get_post( $product_post_id );
401 $form_product_id = $product_post_id;
402 if ( ! empty( $product_post ) ) {
403 $form_product_image_id = get_post_thumbnail_id( $product_post_id );
404
405 return array(
406 'form_product_id' => $form_product_id,
407 'form_product_title' => get_the_title( $product_post ),
408 'form_product_description' => $product_post->post_content,
409 'form_product_image_id' => $form_product_image_id,
410 'form_product_image_src' => wp_get_attachment_image_url( $form_product_image_id, 'thumbnail' ),
411 'form_product_currency' => get_post_meta( $product_post_id, 'spay_currency', true ),
412 'form_product_price' => get_post_meta( $product_post_id, 'spay_price', true ),
413 'form_product_multiple' => get_post_meta( $product_post_id, 'spay_multiple', true ) || '0',
414 'form_product_email' => get_post_meta( $product_post_id, 'spay_email', true ),
415 );
416 }
417
418 return $this->defaults();
419 }
420
421 /**
422 * Record a Track event and bump a MC stat.
423 *
424 * @param string $stat_name
425 * @param string $event_action
426 * @param array $event_properties
427 */
428 private function record_event( $stat_name, $event_action, $event_properties = array() ) {
429 $current_user = wp_get_current_user();
430
431 // `bumps_stats_extra` only exists on .com
432 if ( function_exists( 'bump_stats_extras' ) ) {
433 require_lib( 'tracks/client' );
434 tracks_record_event( $current_user, 'simple_payments_button_' . $event_action, $event_properties );
435 /** This action is documented in modules/widgets/social-media-icons.php */
436 do_action( 'jetpack_bump_stats_extra', 'jetpack-simple_payments', $stat_name );
437 return;
438 }
439
440 $tracking = new Tracking();
441 $tracking->tracks_record_event( $current_user, 'jetpack_wpa_simple_payments_button_' . $event_action, $event_properties );
442 $jetpack = Jetpack::init();
443 // $jetpack->stat automatically prepends the stat group with 'jetpack-'
444 $jetpack->stat( 'simple_payments', $stat_name );
445 $jetpack->do_stats( 'server_side' );
446 }
447
448 /**
449 * Sanitize widget form values as they are saved.
450 *
451 * @see WP_Widget::update()
452 *
453 * @param array $new_instance Values just sent to be saved.
454 * @param array $old_instance Previously saved values from database.
455 *
456 * @return array Updated safe values to be saved.
457 */
458 function update( $new_instance, $old_instance ) {
459 $defaults = $this->defaults();
460 //do not overrite `product_post_id` for `$new_instance` with the defaults
461 $new_instance = wp_parse_args( $new_instance, array_diff_key( $defaults, array( 'product_post_id' => 0 ) ) );
462 $old_instance = wp_parse_args( $old_instance, $defaults );
463
464 $required_widget_props = array(
465 'title' => $this->get_latest_field_value( $new_instance, $old_instance, 'title' ),
466 'product_post_id' => $this->get_latest_field_value( $new_instance, $old_instance, 'product_post_id' ),
467 'form_action' => $this->get_latest_field_value( $new_instance, $old_instance, 'form_action' ),
468 );
469
470 if ( strcmp( $new_instance['form_action'], $old_instance['form_action'] ) !== 0 ) {
471 if ( $new_instance['form_action'] == 'edit' ) {
472 return array_merge( $this->get_product_from_post( (int) $old_instance['product_post_id'] ), $required_widget_props );
473 }
474
475 if ( $new_instance['form_action'] == 'clear' ) {
476 return array_merge( $this->defaults(), $required_widget_props );
477 }
478 }
479
480 $form_product_image_id = (int) $new_instance['form_product_image_id'];
481
482 $form_product_email = ! empty( $new_instance['form_product_email'] )
483 ? sanitize_text_field( $new_instance['form_product_email'] )
484 : $defaults['form_product_email'];
485
486 return array_merge(
487 $required_widget_props, array(
488 'form_product_id' => (int) $new_instance['form_product_id'],
489 'form_product_title' => sanitize_text_field( $new_instance['form_product_title'] ),
490 'form_product_description' => sanitize_text_field( $new_instance['form_product_description'] ),
491 'form_product_image_id' => $form_product_image_id,
492 'form_product_image_src' => wp_get_attachment_image_url( $form_product_image_id, 'thumbnail' ),
493 'form_product_currency' => sanitize_text_field( $new_instance['form_product_currency'] ),
494 'form_product_price' => sanitize_text_field( $new_instance['form_product_price'] ),
495 'form_product_multiple' => sanitize_text_field( $new_instance['form_product_multiple'] ),
496 'form_product_email' => $form_product_email,
497 )
498 );
499 }
500
501 /**
502 * Back-end widget form.
503 *
504 * @see WP_Widget::form()
505 *
506 * @param array $instance Previously saved values from database.
507 */
508 function form( $instance ) {
509 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
510 if ( ! method_exists( $jetpack_simple_payments, 'is_enabled_jetpack_simple_payments' ) ) {
511 return;
512 }
513 if ( ! $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
514 require dirname( __FILE__ ) . '/simple-payments/admin-warning.php';
515 return;
516 }
517
518 $instance = wp_parse_args( $instance, $this->defaults() );
519
520 $product_posts = get_posts(
521 array(
522 'numberposts' => 100,
523 'orderby' => 'date',
524 'post_type' => Jetpack_Simple_Payments::$post_type_product,
525 'post_status' => 'publish',
526 )
527 );
528
529 require dirname( __FILE__ ) . '/simple-payments/form.php';
530 }
531 }
532
533 // Register Jetpack_Simple_Payments_Widget widget.
534 function register_widget_jetpack_simple_payments() {
535 if ( ! class_exists( 'Jetpack_Simple_Payments' ) ) {
536 return;
537 }
538
539 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
540 if ( ! $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
541 return;
542 }
543
544 register_widget( 'Jetpack_Simple_Payments_Widget' );
545 }
546 add_action( 'widgets_init', 'register_widget_jetpack_simple_payments' );
547 }
548