← All changes | includes/wishlist/Wishlist_Session.php +75 -22 51.1.79 → 51.1.87 View file →

		@@ -14,19 +14,52 @@
14	14	private const COOKIE_NAME = 'ka_wishlist_session';
15	15	private const COOKIE_TTL_SECONDS = 2592000; // 30 days
16	16
17	17	/**
18		- * Get or create a session key tied to a browser.
	18	+ * Cookie name used for guest wishlist identity.
19	19	*
20		- * @return string Session key.
	20	+ * @return string Cookie name.
21	21	*/
22		- public function get_session_key(): string
	22	+ public static function cookie_name(): string
23	23	{
24		- $existing = isset($_COOKIE[self::COOKIE_NAME]) ? sanitize_text_field(wp_unslash($_COOKIE[self::COOKIE_NAME])) : '';
25		- if (!empty($existing)) {
	24	+ return self::COOKIE_NAME;
	25	+ }
	26	+
	27	+ /**
	28	+ * Read the existing session cookie without creating one.
	29	+ *
	30	+ * @return string Session key or empty string.
	31	+ */
	32	+ public function get_existing_key(): string
	33	+ {
	34	+ if (empty($_COOKIE[self::COOKIE_NAME])) {
	35	+ return '';
	36	+ }
	37	+
	38	+ return sanitize_text_field(wp_unslash($_COOKIE[self::COOKIE_NAME]));
	39	+ }
	40	+
	41	+ /**
	42	+ * Get a session key tied to a browser.
	43	+ *
	44	+ * Pass $create = true only when a guest actually needs a persistent
	45	+ * wishlist (add/toggle). Reading a page must not Set-Cookie, or public
	46	+ * caches such as LiteSpeed cannot store the homepage for first visitors.
	47	+ *
	48	+ * @param bool $create Whether to mint and persist a cookie if none exists.
	49	+ * @return string Session key, or empty string when none exists and $create is false.
	50	+ */
	51	+ public function get_session_key(bool $create = false): string
	52	+ {
	53	+ $existing = $this->get_existing_key();
	54	+ if ($existing !== '') {
26	55	return $existing;
27	56	}
28	57
	58	+ if (!$create) {
	59	+ return '';
	60	+ }
	61	+
29	62	$session_key = wp_generate_uuid4();
30	63	$this->persist_cookie($session_key);
31	64
32	65	return $session_key;
		@@ -39,18 +72,16 @@
39	72	* @return void
40	73	*/
41	74	public function persist_cookie(string $session_key): void
42	75	{
	76	+ if ($session_key === '' || headers_sent()) {
	77	+ return;
	78	+ }
	79	+
43	80	setcookie(
44	81	self::COOKIE_NAME,
45	82	$session_key,
46		- [
47		- 'expires' => time() + self::COOKIE_TTL_SECONDS,
48		- 'path' => COOKIEPATH ? COOKIEPATH : '/',
49		- 'secure' => is_ssl(),
50		- 'httponly' => true,
51		- 'samesite' => 'Lax',
52		- ]
	83	+ $this->cookie_options(time() + self::COOKIE_TTL_SECONDS)
53	84	);
54	85	$_COOKIE[self::COOKIE_NAME] = $session_key;
55	86	}
56	87
		@@ -60,21 +91,43 @@
60	91	* @return void
61	92	*/
62	93	public function clear(): void
63	94	{
	95	+ self::expire_if_present();
	96	+ }
	97	+
	98	+ /**
	99	+ * Drop a leftover guest cookie without minting a new one.
	100	+ *
	101	+ * @return void
	102	+ */
	103	+ public static function expire_if_present(): void
	104	+ {
	105	+ if (empty($_COOKIE[self::COOKIE_NAME]) || headers_sent()) {
	106	+ return;
	107	+ }
	108	+
64	109	setcookie(
65	110	self::COOKIE_NAME,
66	111	'',
67		- [
68		- 'expires' => time() - YEAR_IN_SECONDS,
69		- 'path' => COOKIEPATH ? COOKIEPATH : '/',
70		- 'secure' => is_ssl(),
71		- 'httponly' => true,
72		- 'samesite' => 'Lax',
73		- ]
	112	+ (new self())->cookie_options(time() - YEAR_IN_SECONDS)
74	113	);
75	114	unset($_COOKIE[self::COOKIE_NAME]);
76	115	}
	116	+
	117	+ /**
	118	+ * Shared cookie flags for set and expire.
	119	+ *
	120	+ * @param int $expires Unix expiry timestamp.
	121	+ * @return array<string, mixed> setcookie options.
	122	+ */
	123	+ private function cookie_options(int $expires): array
	124	+ {
	125	+ return [
	126	+ 'expires' => $expires,
	127	+ 'path' => COOKIEPATH ? COOKIEPATH : '/',
	128	+ 'secure' => is_ssl(),
	129	+ 'httponly' => true,
	130	+ 'samesite' => 'Lax',
	131	+ ];
	132	+ }
77	133	}
78		-
79		-
80		-