PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 9.2.2
Jetpack – WP Security, Backup, Speed, & Growth v9.2.2
16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 14.1.1 14.2.2 14.3.1 All 501 releases
jetpack / modules / widgets / simple-payments.php
simple-payments.php
560 lines 19.8 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 use Automattic\Jetpack\Tracking;
3
4 /**
5 * Disable direct access/execution to/of the widget code.
6 */
7 if ( ! defined( 'ABSPATH' ) ) {
8 exit;
9 }
10
11 if ( ! class_exists( 'Jetpack_Simple_Payments_Widget' ) ) {
12 /**
13 * Pay with PayPal (aka Simple Payments)
14 *
15 * Display a Pay with PayPal button as a Widget.
16 */
17 class Jetpack_Simple_Payments_Widget extends WP_Widget {
18 /**
19 * Currencies should be supported by PayPal:
20 * @link https://developer.paypal.com/docs/api/reference/currency-codes/
21 *
22 * List has to be in sync with list at the block's client side and API's backend side:
23 * @link https://github.com/Automattic/jetpack/blob/31efa189ad223c0eb7ad085ac0650a23facf9ef5/extensions/blocks/simple-payments/constants.js#L9-L39
24 * @link https://github.com/Automattic/jetpack/blob/31efa189ad223c0eb7ad085ac0650a23facf9ef5/modules/simple-payments/simple-payments.php#L386-L415
25 *
26 * Indian Rupee (INR) is listed here for backwards compatibility with previously added widgets.
27 * It's not supported by Pay with PayPal because at the time of the creation of this file
28 * because it's limited to in-country PayPal India accounts only.
29 * Discussion: https://github.com/Automattic/wp-calypso/pull/28236
30 */
31 private static $supported_currency_list = array(
32 'USD' => '$',
33 'GBP' => '&#163;',
34 'JPY' => '&#165;',
35 'BRL' => 'R$',
36 'EUR' => '&#8364;',
37 'NZD' => 'NZ$',
38 'AUD' => 'A$',
39 'CAD' => 'C$',
40 'INR' => '',
41 'ILS' => '',
42 'RUB' => '',
43 'MXN' => 'MX$',
44 'SEK' => 'Skr',
45 'HUF' => 'Ft',
46 'CHF' => 'CHF',
47 'CZK' => '',
48 'DKK' => 'Dkr',
49 'HKD' => 'HK$',
50 'NOK' => 'Kr',
51 'PHP' => '',
52 'PLN' => 'PLN',
53 'SGD' => 'S$',
54 'TWD' => 'NT$',
55 'THB' => '฿',
56 );
57
58 /**
59 * Constructor.
60 */
61 function __construct() {
62 parent::__construct(
63 'jetpack_simple_payments_widget',
64 /** This filter is documented in modules/widgets/facebook-likebox.php */
65 apply_filters( 'jetpack_widget_name', __( 'Pay with PayPal', 'jetpack' ) ),
66 array(
67 'classname' => 'jetpack-simple-payments',
68 'description' => __( 'Add a Pay with PayPal button as a Widget.', 'jetpack' ),
69 'customize_selective_refresh' => true,
70 )
71 );
72
73 global $pagenow;
74 if ( is_customize_preview() || 'widgets.php' === $pagenow ) {
75 add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_styles' ) );
76 }
77
78 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
79 if ( is_customize_preview() && $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
80 add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );
81
82 add_filter( 'customize_refresh_nonces', array( $this, 'filter_nonces' ) );
83 add_action( 'wp_ajax_customize-jetpack-simple-payments-buttons-get', array( $this, 'ajax_get_payment_buttons' ) );
84 add_action( 'wp_ajax_customize-jetpack-simple-payments-button-save', array( $this, 'ajax_save_payment_button' ) );
85 add_action( 'wp_ajax_customize-jetpack-simple-payments-button-delete', array( $this, 'ajax_delete_payment_button' ) );
86 }
87
88 if ( is_active_widget( false, false, $this->id_base ) || is_customize_preview() ) {
89 add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_style' ) );
90 }
91 }
92
93 /**
94 * Return an associative array of default values.
95 *
96 * These values are used in new widgets.
97 *
98 * @return array Default values for the widget options.
99 */
100 private function defaults() {
101 $current_user = wp_get_current_user();
102 $default_product_id = $this->get_first_product_id();
103
104 return array(
105 'title' => '',
106 'product_post_id' => $default_product_id,
107 'form_action' => '',
108 'form_product_id' => 0,
109 'form_product_title' => '',
110 'form_product_description' => '',
111 'form_product_image_id' => 0,
112 'form_product_image_src' => '',
113 'form_product_currency' => '',
114 'form_product_price' => '',
115 'form_product_multiple' => '',
116 'form_product_email' => $current_user->user_email,
117 );
118 }
119
120 /**
121 * Adds a nonce for customizing menus.
122 *
123 * @param array $nonces Array of nonces.
124 * @return array $nonces Modified array of nonces.
125 */
126 function filter_nonces( $nonces ) {
127 $nonces['customize-jetpack-simple-payments'] = wp_create_nonce( 'customize-jetpack-simple-payments' );
128 return $nonces;
129 }
130
131 function enqueue_style() {
132 wp_enqueue_style( 'jetpack-simple-payments-widget-style', plugins_url( 'simple-payments/style.css', __FILE__ ), array(), '20180518' );
133 }
134
135 function admin_enqueue_styles() {
136 wp_enqueue_style( 'jetpack-simple-payments-widget-customizer', plugins_url( 'simple-payments/customizer.css', __FILE__ ) );
137 }
138
139 function admin_enqueue_scripts() {
140 wp_enqueue_media();
141 wp_enqueue_script( 'jetpack-simple-payments-widget-customizer', plugins_url( '/simple-payments/customizer.js', __FILE__ ), array( 'jquery' ), false, true );
142 wp_localize_script(
143 'jetpack-simple-payments-widget-customizer', 'jpSimplePaymentsStrings', array(
144 'deleteConfirmation' => __( 'Are you sure you want to delete this item? It will be disabled and removed from all locations where it currently appears.', 'jetpack' ),
145 )
146 );
147 }
148
149 public function ajax_get_payment_buttons() {
150 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
151 wp_send_json_error( 'bad_nonce', 400 );
152 }
153
154 if ( ! current_user_can( 'customize' ) ) {
155 wp_send_json_error( 'customize_not_allowed', 403 );
156 }
157
158 $post_type_object = get_post_type_object( Jetpack_Simple_Payments::$post_type_product );
159 if ( ! current_user_can( $post_type_object->cap->create_posts ) || ! current_user_can( $post_type_object->cap->publish_posts ) ) {
160 wp_send_json_error( 'insufficient_post_permissions', 403 );
161 }
162
163 $product_posts = get_posts(
164 array(
165 'numberposts' => 100,
166 'orderby' => 'date',
167 'post_type' => Jetpack_Simple_Payments::$post_type_product,
168 'post_status' => 'publish',
169 )
170 );
171
172 $formatted_products = array_map( array( $this, 'format_product_post_for_ajax_reponse' ), $product_posts );
173
174 wp_send_json_success( $formatted_products );
175 }
176
177 public function format_product_post_for_ajax_reponse( $product_post ) {
178 return array(
179 'ID' => $product_post->ID,
180 'post_title' => $product_post->post_title,
181 );
182 }
183
184 public function ajax_save_payment_button() {
185 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
186 wp_send_json_error( 'bad_nonce', 400 );
187 }
188
189 if ( ! current_user_can( 'customize' ) ) {
190 wp_send_json_error( 'customize_not_allowed', 403 );
191 }
192
193 $post_type_object = get_post_type_object( Jetpack_Simple_Payments::$post_type_product );
194 if ( ! current_user_can( $post_type_object->cap->create_posts ) || ! current_user_can( $post_type_object->cap->publish_posts ) ) {
195 wp_send_json_error( 'insufficient_post_permissions', 403 );
196 }
197
198 if ( empty( $_POST['params'] ) || ! is_array( $_POST['params'] ) ) {
199 wp_send_json_error( 'missing_params', 400 );
200 }
201
202 $params = wp_unslash( $_POST['params'] );
203 $errors = $this->validate_ajax_params( $params );
204 if ( ! empty( $errors->errors ) ) {
205 wp_send_json_error( $errors );
206 }
207
208 $product_post_id = isset( $params['product_post_id'] ) ? (int) $params['product_post_id'] : 0;
209
210 $product_post = array(
211 'ID' => $product_post_id,
212 'post_type' => Jetpack_Simple_Payments::$post_type_product,
213 'post_status' => 'publish',
214 'post_title' => $params['post_title'],
215 'post_content' => $params['post_content'],
216 '_thumbnail_id' => ! empty( $params['image_id'] ) ? $params['image_id'] : -1,
217 'meta_input' => array(
218 'spay_currency' => $params['currency'],
219 'spay_price' => $params['price'],
220 'spay_multiple' => isset( $params['multiple'] ) ? (int) $params['multiple'] : 0,
221 'spay_email' => is_email( $params['email'] ),
222 ),
223 );
224
225 if ( empty( $product_post_id ) ) {
226 $product_post_id = wp_insert_post( $product_post );
227 } else {
228 $product_post_id = wp_update_post( $product_post );
229 }
230
231 if ( ! $product_post_id || is_wp_error( $product_post_id ) ) {
232 wp_send_json_error( $product_post_id );
233 }
234
235 $tracks_properties = array(
236 'id' => $product_post_id,
237 'currency' => $params['currency'],
238 'price' => $params['price'],
239 );
240 if ( 0 === $product_post['ID'] ) {
241 $this->record_event( 'created', 'create', $tracks_properties );
242 } else {
243 $this->record_event( 'updated', 'update', $tracks_properties );
244 }
245
246 wp_send_json_success(
247 array(
248 'product_post_id' => $product_post_id,
249 'product_post_title' => $params['post_title'],
250 )
251 );
252 }
253
254 public function ajax_delete_payment_button() {
255 if ( ! check_ajax_referer( 'customize-jetpack-simple-payments', 'customize-jetpack-simple-payments-nonce', false ) ) {
256 wp_send_json_error( 'bad_nonce', 400 );
257 }
258
259 if ( ! current_user_can( 'customize' ) ) {
260 wp_send_json_error( 'customize_not_allowed', 403 );
261 }
262
263 if ( empty( $_POST['params'] ) || ! is_array( $_POST['params'] ) ) {
264 wp_send_json_error( 'missing_params', 400 );
265 }
266
267 $params = wp_unslash( $_POST['params'] );
268 $illegal_params = array_diff( array_keys( $params ), array( 'product_post_id' ) );
269 if ( ! empty( $illegal_params ) ) {
270 wp_send_json_error( 'illegal_params', 400 );
271 }
272
273 $product_id = (int) $params['product_post_id'];
274 $product_post = get_post( $product_id );
275
276 $return = array( 'status' => $product_post->post_status );
277
278 wp_delete_post( $product_id, true );
279 $status = get_post_status( $product_id );
280 if ( false === $status ) {
281 $return['status'] = 'deleted';
282 }
283
284 $this->record_event( 'deleted', 'delete', array( 'id' => $product_id ) );
285
286 wp_send_json_success( $return );
287 }
288
289 /**
290 * Returns the number of decimal places on string representing a price.
291 *
292 * @param string $number Price to check.
293 * @return number number of decimal places.
294 */
295 private function get_decimal_places( $number ) {
296 $parts = explode( '.', $number );
297 if ( count( $parts ) > 2 ) {
298 return null;
299 }
300
301 return isset( $parts[1] ) ? strlen( $parts[1] ) : 0;
302 }
303
304 public function validate_ajax_params( $params ) {
305 $errors = new WP_Error();
306
307 $illegal_params = array_diff( array_keys( $params ), array( 'product_post_id', 'post_title', 'post_content', 'image_id', 'currency', 'price', 'multiple', 'email' ) );
308 if ( ! empty( $illegal_params ) ) {
309 $errors->add( 'illegal_params', __( 'Invalid parameters.', 'jetpack' ) );
310 }
311
312 if ( empty( $params['post_title'] ) ) {
313 $errors->add( 'post_title', __( "People need to know what they're paying for! Please add a brief title.", 'jetpack' ) );
314 }
315
316 if ( empty( $params['price'] ) || ! is_numeric( $params['price'] ) || (float) $params['price'] <= 0 ) {
317 $errors->add( 'price', __( 'Everything comes with a price tag these days. Please add a your product price.', 'jetpack' ) );
318 }
319
320 // Japan's Yen is the only supported currency with a zero decimal precision.
321 $precision = strtoupper( $params['currency'] ) === 'JPY' ? 0 : 2;
322 $price_decimal_places = $this->get_decimal_places( $params['price'] );
323 if ( is_null( $price_decimal_places ) || $price_decimal_places > $precision ) {
324 $errors->add( 'price', __( 'Invalid price', 'jetpack' ) );
325 }
326
327 if ( empty( $params['email'] ) || ! is_email( $params['email'] ) ) {
328 $errors->add( 'email', __( 'We want to make sure payments reach you, so please add an email address.', 'jetpack' ) );
329 }
330
331 return $errors;
332 }
333
334 function get_first_product_id() {
335 $product_posts = get_posts(
336 array(
337 'numberposts' => 1,
338 'orderby' => 'date',
339 'post_type' => Jetpack_Simple_Payments::$post_type_product,
340 'post_status' => 'publish',
341 )
342 );
343
344 return ! empty( $product_posts ) ? $product_posts[0]->ID : null;
345 }
346
347 /**
348 * Front-end display of widget.
349 *
350 * @see WP_Widget::widget()
351 *
352 * @param array $args Widget arguments.
353 * @param array $instance Saved values from database.
354 */
355 function widget( $args, $instance ) {
356 $instance = wp_parse_args( $instance, $this->defaults() );
357
358 echo $args['before_widget'];
359
360 /** This filter is documented in core/src/wp-includes/default-widgets.php */
361 $title = apply_filters( 'widget_title', $instance['title'] );
362 if ( ! empty( $title ) ) {
363 echo $args['before_title'] . $title . $args['after_title'];
364 }
365
366 echo '<div class="jetpack-simple-payments-content">';
367
368 if ( ! empty( $instance['form_action'] ) && in_array( $instance['form_action'], array( 'add', 'edit' ) ) && is_customize_preview() ) {
369 require( dirname( __FILE__ ) . '/simple-payments/widget.php' );
370 } else {
371 $jsp = Jetpack_Simple_Payments::getInstance();
372 $simple_payments_button = $jsp->parse_shortcode(
373 array(
374 'id' => $instance['product_post_id'],
375 )
376 );
377
378 if ( ! is_null( $simple_payments_button ) || is_customize_preview() ) {
379 echo $simple_payments_button;
380 }
381 }
382
383 echo '</div><!--simple-payments-->';
384
385 echo $args['after_widget'];
386
387 /** This action is already documented in modules/widgets/gravatar-profile.php */
388 do_action( 'jetpack_stats_extra', 'widget_view', 'simple_payments' );
389 }
390
391 /**
392 * Gets the latests field value from either the old instance or the new instance.
393 *
394 * @param array $mixed Array of values for the new form instance.
395 * @param array $mixed Array of values for the old form instance.
396 * @return mixed $mixed Field value.
397 */
398 private function get_latest_field_value( $new_instance, $old_instance, $field ) {
399 return ! empty( $new_instance[ $field ] )
400 ? sanitize_text_field( $new_instance[ $field ] )
401 : $old_instance[ $field ];
402 }
403
404 /**
405 * Gets the product fields from the product post. If no post found
406 * it returns the default values.
407 *
408 * @param int Product Post ID.
409 * @return array $fields Product Fields from the Product Post.
410 */
411 private function get_product_from_post( $product_post_id ) {
412 $product_post = get_post( $product_post_id );
413 $form_product_id = $product_post_id;
414 if ( ! empty( $product_post ) ) {
415 $form_product_image_id = get_post_thumbnail_id( $product_post_id );
416
417 return array(
418 'form_product_id' => $form_product_id,
419 'form_product_title' => get_the_title( $product_post ),
420 'form_product_description' => $product_post->post_content,
421 'form_product_image_id' => $form_product_image_id,
422 'form_product_image_src' => wp_get_attachment_image_url( $form_product_image_id, 'thumbnail' ),
423 'form_product_currency' => get_post_meta( $product_post_id, 'spay_currency', true ),
424 'form_product_price' => get_post_meta( $product_post_id, 'spay_price', true ),
425 'form_product_multiple' => get_post_meta( $product_post_id, 'spay_multiple', true ) || '0',
426 'form_product_email' => get_post_meta( $product_post_id, 'spay_email', true ),
427 );
428 }
429
430 return $this->defaults();
431 }
432
433 /**
434 * Record a Track event and bump a MC stat.
435 *
436 * @param string $stat_name
437 * @param string $event_action
438 * @param array $event_properties
439 */
440 private function record_event( $stat_name, $event_action, $event_properties = array() ) {
441 $current_user = wp_get_current_user();
442
443 // `bumps_stats_extra` only exists on .com
444 if ( function_exists( 'bump_stats_extras' ) ) {
445 jetpack_require_lib( 'tracks/client' );
446 tracks_record_event( $current_user, 'simple_payments_button_' . $event_action, $event_properties );
447 /** This action is documented in modules/widgets/social-media-icons.php */
448 do_action( 'jetpack_bump_stats_extra', 'jetpack-simple_payments', $stat_name );
449 return;
450 }
451
452 $tracking = new Tracking();
453 $tracking->tracks_record_event( $current_user, 'jetpack_wpa_simple_payments_button_' . $event_action, $event_properties );
454 $jetpack = Jetpack::init();
455 // $jetpack->stat automatically prepends the stat group with 'jetpack-'
456 $jetpack->stat( 'simple_payments', $stat_name );
457 $jetpack->do_stats( 'server_side' );
458 }
459
460 /**
461 * Sanitize widget form values as they are saved.
462 *
463 * @see WP_Widget::update()
464 *
465 * @param array $new_instance Values just sent to be saved.
466 * @param array $old_instance Previously saved values from database.
467 *
468 * @return array Updated safe values to be saved.
469 */
470 function update( $new_instance, $old_instance ) {
471 $defaults = $this->defaults();
472 //do not overrite `product_post_id` for `$new_instance` with the defaults
473 $new_instance = wp_parse_args( $new_instance, array_diff_key( $defaults, array( 'product_post_id' => 0 ) ) );
474 $old_instance = wp_parse_args( $old_instance, $defaults );
475
476 $required_widget_props = array(
477 'title' => $this->get_latest_field_value( $new_instance, $old_instance, 'title' ),
478 'product_post_id' => $this->get_latest_field_value( $new_instance, $old_instance, 'product_post_id' ),
479 'form_action' => $this->get_latest_field_value( $new_instance, $old_instance, 'form_action' ),
480 );
481
482 if ( strcmp( $new_instance['form_action'], $old_instance['form_action'] ) !== 0 ) {
483 if ( $new_instance['form_action'] == 'edit' ) {
484 return array_merge( $this->get_product_from_post( (int) $old_instance['product_post_id'] ), $required_widget_props );
485 }
486
487 if ( $new_instance['form_action'] == 'clear' ) {
488 return array_merge( $this->defaults(), $required_widget_props );
489 }
490 }
491
492 $form_product_image_id = (int) $new_instance['form_product_image_id'];
493
494 $form_product_email = ! empty( $new_instance['form_product_email'] )
495 ? sanitize_text_field( $new_instance['form_product_email'] )
496 : $defaults['form_product_email'];
497
498 return array_merge(
499 $required_widget_props, array(
500 'form_product_id' => (int) $new_instance['form_product_id'],
501 'form_product_title' => sanitize_text_field( $new_instance['form_product_title'] ),
502 'form_product_description' => sanitize_text_field( $new_instance['form_product_description'] ),
503 'form_product_image_id' => $form_product_image_id,
504 'form_product_image_src' => wp_get_attachment_image_url( $form_product_image_id, 'thumbnail' ),
505 'form_product_currency' => sanitize_text_field( $new_instance['form_product_currency'] ),
506 'form_product_price' => sanitize_text_field( $new_instance['form_product_price'] ),
507 'form_product_multiple' => sanitize_text_field( $new_instance['form_product_multiple'] ),
508 'form_product_email' => $form_product_email,
509 )
510 );
511 }
512
513 /**
514 * Back-end widget form.
515 *
516 * @see WP_Widget::form()
517 *
518 * @param array $instance Previously saved values from database.
519 */
520 function form( $instance ) {
521 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
522 if ( ! method_exists( $jetpack_simple_payments, 'is_enabled_jetpack_simple_payments' ) ) {
523 return;
524 }
525 if ( ! $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
526 require dirname( __FILE__ ) . '/simple-payments/admin-warning.php';
527 return;
528 }
529
530 $instance = wp_parse_args( $instance, $this->defaults() );
531
532 $product_posts = get_posts(
533 array(
534 'numberposts' => 100,
535 'orderby' => 'date',
536 'post_type' => Jetpack_Simple_Payments::$post_type_product,
537 'post_status' => 'publish',
538 )
539 );
540
541 require dirname( __FILE__ ) . '/simple-payments/form.php';
542 }
543 }
544
545 // Register Jetpack_Simple_Payments_Widget widget.
546 function register_widget_jetpack_simple_payments() {
547 if ( ! class_exists( 'Jetpack_Simple_Payments' ) ) {
548 return;
549 }
550
551 $jetpack_simple_payments = Jetpack_Simple_Payments::getInstance();
552 if ( ! $jetpack_simple_payments->is_enabled_jetpack_simple_payments() ) {
553 return;
554 }
555
556 register_widget( 'Jetpack_Simple_Payments_Widget' );
557 }
558 add_action( 'widgets_init', 'register_widget_jetpack_simple_payments' );
559 }
560