← All changes | includes/Frontend/ActionController.php +56 -10 1.5.1 → 2.0.0 View file →

		@@ -4,8 +4,9 @@
4	4	namespace SpringDevs\Subscription\Frontend;
5	5
6	6	use SpringDevs\Subscription\Illuminate\Action;
7	7	use SpringDevs\Subscription\Illuminate\Helper;
	8	+use SpringDevs\Subscription\Illuminate\Subscription\Subscription;
8	9
9	10	/**
10	11	* Class ActionController
11	12	*
		@@ -26,14 +27,49 @@
26	27	public function control_action_subscrpt() {
27	28	if ( ! ( isset( $_GET['subscrpt_id'] ) && isset( $_GET['action'] ) && isset( $_GET['wpnonce'] ) ) ) {
28	29	return;
29	30	}
	31	+
30	32	$subscrpt_id = sanitize_text_field( wp_unslash( $_GET['subscrpt_id'] ) );
31	33	$action = sanitize_text_field( wp_unslash( $_GET['action'] ) );
32	34	$wpnonce = sanitize_text_field( wp_unslash( $_GET['wpnonce'] ) );
	35	+
	36	+ // Nonce check
33	37	if ( ! wp_verify_nonce( $wpnonce, 'subscrpt_nonce' ) ) {
34		- wp_die( esc_html( __( 'Sorry !! You cannot permit to access.', 'wp_subscription' ) ) );
	38	+ $error_notice = __( "You don't have permission to modify this subscription. If you believe this is an error, please contact support.", 'subscription' );
	39	+ wc_add_notice( $error_notice, 'error' );
	40	+
	41	+ $view_subscription_endpoint = Subscription::get_user_endpoint( 'view_subs' );
	42	+ $redirect_url = wc_get_endpoint_url( $view_subscription_endpoint, $subscrpt_id, wc_get_page_permalink( 'myaccount' ) );
	43	+ return wp_safe_redirect( $redirect_url );
35	44	}
	45	+
	46	+ // User check
	47	+ $subs_post = get_post( $subscrpt_id );
	48	+ $author_id = $subs_post ? (int) $subs_post->post_author : 0;
	49	+ $current_user_id = get_current_user_id();
	50	+ $user_is_admin = current_user_can( 'manage_options' );
	51	+
	52	+ if ( ! $user_is_admin && (int) $author_id !== (int) $current_user_id ) {
	53	+ $error_notice = __( "You don't have permission to modify this subscription. If you believe this is an error, please contact support.", 'subscription' );
	54	+ wc_add_notice( $error_notice, 'error' );
	55	+
	56	+ $view_subscription_endpoint = Subscription::get_user_endpoint( 'view_subs' );
	57	+ $redirect_url = wc_get_endpoint_url( $view_subscription_endpoint, $subscrpt_id, wc_get_page_permalink( 'myaccount' ) );
	58	+ return wp_safe_redirect( $redirect_url );
	59	+ }
	60	+
	61	+ // Get view subscription endpoint slug.
	62	+ $view_subs_endpoint = Subscription::get_user_endpoint( 'view_subs' );
	63	+
	64	+ // Check maximum payment limit for renewal-related actions (including early renewal)
	65	+ $renewal_actions = apply_filters( 'subscrpt_renewal_actions', array( 'renew', 'renew-on', 'early-renew' ) );
	66	+ if ( in_array( $action, $renewal_actions, true ) && subscrpt_is_max_payments_reached( $subscrpt_id ) ) {
	67	+ wc_add_notice( __( 'This subscription has reached its maximum payment limit and cannot be renewed further.', 'subscription' ), 'error' );
	68	+ wp_safe_redirect( wc_get_endpoint_url( $view_subs_endpoint, $subscrpt_id, wc_get_page_permalink( 'myaccount' ) ) );
	69	+ exit;
	70	+ }
	71	+
36	72	if ( 'renew' === $action && ! subscrpt_is_auto_renew_enabled() ) {
37	73	$this->manual_renew_product( $subscrpt_id );
38	74	} elseif ( 'cancelled' === $action ) {
39	75	$status = get_post_status( $subscrpt_id );
		@@ -44,9 +80,9 @@
44	80	Action::status( 'pe_cancelled', $subscrpt_id );
45	81	} else {
46	82	Action::status( $action, $subscrpt_id );
47	83	}
48		- } elseif ( 'reactive' === $action ) {
	84	+ } elseif ( 'reactivate' === $action ) {
49	85	Action::status( 'active', $subscrpt_id );
50	86	} elseif ( 'renew-on' === $action ) {
51	87	update_post_meta( $subscrpt_id, '_subscrpt_auto_renew', 1 );
52	88	} elseif ( 'renew-off' === $action ) {
		@@ -53,12 +89,20 @@
53	89	update_post_meta( $subscrpt_id, '_subscrpt_auto_renew', 0 );
54	90	} elseif ( 'renew' === $action && subscrpt_is_auto_renew_enabled() ) {
55	91	Helper::create_renewal_order( $subscrpt_id );
56	92	} else {
	93	+ // Safety check: If this is any kind of renewal action and limit is reached, block it
	94	+ if ( subscrpt_is_max_payments_reached( $subscrpt_id ) &&
	95	+ ( strpos( $action, 'renew' ) !== false || strpos( $action, 'renewal' ) !== false ) ) {
	96	+ wc_add_notice( __( 'This subscription has reached its maximum payment limit and cannot be renewed further.', 'subscription' ), 'error' );
	97	+ wp_safe_redirect( wc_get_endpoint_url( $view_subs_endpoint, $subscrpt_id, wc_get_page_permalink( 'myaccount' ) ) );
	98	+ exit;
	99	+ }
	100	+
57	101	do_action( 'subscrpt_execute_actions', $subscrpt_id, $action );
58	102	}
59		- // phpcs:ignore
60		- echo ( "<script>location.href = '" . wc_get_endpoint_url( 'view-subscription', $subscrpt_id, wc_get_page_permalink( 'myaccount' ) ) . "';</script>" );
	103	+ wp_safe_redirect( wc_get_endpoint_url( $view_subs_endpoint, $subscrpt_id, wc_get_page_permalink( 'myaccount' ) ) );
	104	+ exit;
61	105	}
62	106
63	107	/**
64	108	* Manually Renew Subscription.
		@@ -83,9 +127,14 @@
83	127	array(),
84	128	array( 'renew_subscrpt' => true )
85	129	);
86	130
87		- wc_add_notice( get_option( 'subscrpt_manual_renew_cart_notice' ), 'success' );
	131	+ // Empty unless the store set one, and wc_add_notice( '' ) renders an empty
	132	+ // green box rather than nothing, so only add it when there is a message.
	133	+ $cart_notice = subscrpt_get_manual_renew_cart_notice();
	134	+ if ( '' !== $cart_notice ) {
	135	+ wc_add_notice( $cart_notice, 'success' );
	136	+ }
88	137	$this->redirect( wc_get_cart_url() );
89	138	}
90	139
91	140	/**
		@@ -93,11 +142,8 @@
93	142	*
94	143	* @param String $url URL.
95	144	*/
96	145	public function redirect( $url ) {
97		- ?>
98		- <script>
99		- window.location.href = '<?php echo esc_url_raw( $url ); ?>';
100		- </script>
101		- <?php
	146	+ wp_safe_redirect( esc_url( $url ) );
	147	+ exit;
102	148	}
103	149	}