| @@ -91,23 +91,19 @@ | ||
| 91 | 91 | } |
| 92 | 92 | } |
| 93 | 93 | |
| 94 | 94 | // Get form data. |
| 95 | - $amount = isset( $_POST['amount'] ) ? floatval( $_POST['amount'] ) : 0; | |
| 96 | - $cover_fees = isset( $_POST['cover_fees'] ) && 'true' === $_POST['cover_fees']; | |
| 97 | - // The anonymous flag is display-only: the donor's real name is stored as | |
| 98 | - // usual below and only public surfaces mask it. | |
| 99 | - $donor_name = sanitize_text_field( wp_unslash( $_POST['donor_name'] ?? '' ) ); | |
| 95 | + $amount = isset( $_POST['amount'] ) ? floatval( $_POST['amount'] ) : 0; | |
| 96 | + $cover_fees = isset( $_POST['cover_fees'] ) && 'true' === $_POST['cover_fees']; | |
| 97 | + $is_anonymous = isset( $_POST['is_anonymous'] ) ? true : false; | |
| 98 | + $donor_name = $is_anonymous ? __( 'Anonymous', 'suredonation' ) : sanitize_text_field( wp_unslash( $_POST['donor_name'] ?? '' ) ); | |
| 100 | 99 | $donor_email = sanitize_email( wp_unslash( $_POST['donor_email'] ?? '' ) ); |
| 100 | + $donor_phone = sanitize_text_field( wp_unslash( $_POST['donor_phone'] ?? '' ) ); | |
| 101 | 101 | $donor_comment = sanitize_textarea_field( wp_unslash( $_POST['donor_comment'] ?? '' ) ); |
| 102 | 102 | |
| 103 | 103 | // Get form_id and block_id for amount validation. |
| 104 | - $form_id = isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0; | |
| 105 | - $is_anonymous = Payment_Helper::get_submitted_is_anonymous( $form_id ); | |
| 106 | - // Derive the donor phone from the validated mapped field, not a separate | |
| 107 | - // unvalidated $_POST['donor_phone'] (see Payment_Helper::get_mapped_donor_phone). | |
| 108 | - $donor_phone = Payment_Helper::get_mapped_donor_phone( $form_id ); | |
| 109 | - $block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : ''; | |
| 104 | + $form_id = isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0; | |
| 105 | + $block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : ''; | |
| 110 | 106 | |
| 111 | 107 | // Validate required fields. |
| 112 | 108 | if ( $amount <= 0 ) { |
| 113 | 109 | wp_send_json_error( __( 'Invalid donation amount', 'suredonation' ) ); |
| @@ -125,18 +121,16 @@ | ||
| 125 | 121 | if ( ! $validation_result['valid'] ) { |
| 126 | 122 | wp_send_json_error( esc_html( $validation_result['message'] ) ); |
| 127 | 123 | } |
| 128 | 124 | |
| 129 | - // Name and email are required whether or not the donation is anonymous — | |
| 130 | - // the flag only masks the name on public surfaces, so there still has to | |
| 131 | - // be a real name to mask (matches the gateway handlers, which validate | |
| 132 | - // these through validate_submission() regardless of the flag). | |
| 133 | - if ( empty( $donor_name ) ) { | |
| 134 | - wp_send_json_error( __( 'Donor name is required', 'suredonation' ) ); | |
| 125 | + if ( ! $is_anonymous ) { | |
| 126 | + if ( empty( $donor_name ) ) { | |
| 127 | + wp_send_json_error( __( 'Donor name is required', 'suredonation' ) ); | |
| 128 | + } | |
| 129 | + if ( empty( $donor_email ) || ! is_email( $donor_email ) ) { | |
| 130 | + wp_send_json_error( __( 'Valid email address is required', 'suredonation' ) ); | |
| 131 | + } | |
| 135 | 132 | } |
| 136 | - if ( empty( $donor_email ) || ! is_email( $donor_email ) ) { | |
| 137 | - wp_send_json_error( __( 'Valid email address is required', 'suredonation' ) ); | |
| 138 | - } | |
| 139 | 133 | |
| 140 | 134 | // Server-side fee calculation — ignore client-supplied base_amount to prevent manipulation. |
| 141 | 135 | $base_amount = $amount; |
| 142 | 136 | $fees_covered = 0; |
| @@ -154,11 +148,13 @@ | ||
| 154 | 148 | $fees_covered = 0; |
| 155 | 149 | } |
| 156 | 150 | } |
| 157 | 151 | |
| 158 | - // Get or create donor. The email is validated as non-empty above, so | |
| 159 | - // there is no guard here — anonymous or not, this path always has one. | |
| 160 | - $donor_id = Donors::get_or_create( $donor_email, $donor_name, $donor_phone ); | |
| 152 | + // Get or create donor. | |
| 153 | + $donor_id = 0; | |
| 154 | + if ( ! empty( $donor_email ) ) { | |
| 155 | + $donor_id = Donors::get_or_create( $donor_email, $donor_name, $donor_phone ); | |
| 156 | + } | |
| 161 | 157 | |
| 162 | 158 | // Get payment mode. |
| 163 | 159 | $payment_mode = 'live'; |
| 164 | 160 | if ( class_exists( 'SureDonation\Inc\Payments\Payment_Helper' ) ) { |
| @@ -191,11 +187,8 @@ | ||
| 191 | 187 | |
| 192 | 188 | if ( ! $donation_id ) { |
| 193 | 189 | wp_send_json_error( __( 'Failed to create donation', 'suredonation' ) ); |
| 194 | 190 | } |
| 195 | - | |
| 196 | - // Persist the submitted field values for the entry record. | |
| 197 | - Donations::set_submitted_fields( $donation_id, Payment_Helper::get_submitted_field_data() ); | |
| 198 | 191 | |
| 199 | 192 | // Note: Donation status will be updated by payment gateway webhooks or manual confirmation. |
| 200 | 193 | |
| 201 | 194 | // This donation is created as pending/manual, so send the "processing" |
