| @@ -6,10 +6,12 @@ | ||
| 6 | 6 | */ |
| 7 | 7 | |
| 8 | 8 | namespace SureDonation\Inc; |
| 9 | 9 | |
| 10 | +use SureDonation\Inc\API\Settings_API; | |
| 10 | 11 | use SureDonation\Inc\Database\Tables\Donations; |
| 11 | 12 | use SureDonation\Inc\Emails\Email_Handler; |
| 13 | +use SureDonation\Inc\Field_Validation; | |
| 12 | 14 | use SureDonation\Inc\Payments\Payment_Helper; |
| 13 | 15 | |
| 14 | 16 | // Exit if accessed directly. |
| 15 | 17 | if ( ! defined( 'ABSPATH' ) ) { |
| @@ -91,8 +93,70 @@ | ||
| 91 | 93 | return update_option( self::OPTION_NAME, $options ); |
| 92 | 94 | } |
| 93 | 95 | |
| 94 | 96 | /** |
| 97 | + * Whether honeypot spam protection is enabled in the global settings. | |
| 98 | + * | |
| 99 | + * @return bool True when the honeypot is enabled. | |
| 100 | + * @since 1.1.0 | |
| 101 | + */ | |
| 102 | + public static function is_honeypot_enabled() { | |
| 103 | + $spam_settings = self::get_suredonation_option( Settings_API::SPAM_OPTION_KEY, [] ); | |
| 104 | + | |
| 105 | + return is_array( $spam_settings ) && ! empty( $spam_settings['honeypot'] ); | |
| 106 | + } | |
| 107 | + | |
| 108 | + /** | |
| 109 | + * Output the hidden honeypot field when spam protection is enabled. | |
| 110 | + * | |
| 111 | + * Genuine visitors never see or fill this hidden field, so it is submitted | |
| 112 | + * with an empty value. A filled value (a bot that auto-fills every input) or | |
| 113 | + * a missing field (a bot that strips unknown inputs) is flagged as spam at | |
| 114 | + * submission time. | |
| 115 | + * | |
| 116 | + * @return void | |
| 117 | + * @see Helper::is_honeypot_spam() | |
| 118 | + * @since 1.1.0 | |
| 119 | + */ | |
| 120 | + public static function render_honeypot_field() { | |
| 121 | + if ( ! self::is_honeypot_enabled() ) { | |
| 122 | + return; | |
| 123 | + } | |
| 124 | + | |
| 125 | + echo '<input type="hidden" name="suredonation_honeypot" value="" />'; | |
| 126 | + } | |
| 127 | + | |
| 128 | + /** | |
| 129 | + * Determine whether the current submission tripped the honeypot. | |
| 130 | + * | |
| 131 | + * Returns false when honeypot protection is disabled. When enabled, a real | |
| 132 | + * submission always carries the hidden field with an empty value; a missing | |
| 133 | + * field or any non-empty value is treated as spam. | |
| 134 | + * | |
| 135 | + * The honeypot field holds no sensitive data and is only inspected for | |
| 136 | + * emptiness. Nonce/referer verification is performed by the calling | |
| 137 | + * submission handler before this method runs. | |
| 138 | + * | |
| 139 | + * @return bool True when the submission should be rejected as spam. | |
| 140 | + * @since 1.1.0 | |
| 141 | + */ | |
| 142 | + public static function is_honeypot_spam() { | |
| 143 | + if ( ! self::is_honeypot_enabled() ) { | |
| 144 | + return false; | |
| 145 | + } | |
| 146 | + | |
| 147 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verified by the calling submission handler; value only checked for emptiness. | |
| 148 | + if ( ! isset( $_POST['suredonation_honeypot'] ) ) { | |
| 149 | + return true; | |
| 150 | + } | |
| 151 | + | |
| 152 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- See note above. | |
| 153 | + $value = sanitize_text_field( wp_unslash( $_POST['suredonation_honeypot'] ) ); | |
| 154 | + | |
| 155 | + return '' !== $value; | |
| 156 | + } | |
| 157 | + | |
| 158 | + /** | |
| 95 | 159 | * Get all campaign meta as an array. |
| 96 | 160 | * |
| 97 | 161 | * @param int $campaign_id Campaign post ID. |
| 98 | 162 | * @return array<string, mixed> Campaign meta values. |
| @@ -140,8 +204,40 @@ | ||
| 140 | 204 | return update_post_meta( $campaign_id, self::SUREDONATION_CAMPAIGN_META_KEY, wp_json_encode( $meta ) ); |
| 141 | 205 | } |
| 142 | 206 | |
| 143 | 207 | /** |
| 208 | + * Whether a (possibly nested) block tree contains a block of the given name. | |
| 209 | + * | |
| 210 | + * Walks parse_blocks() output, descending into innerBlocks so a block nested | |
| 211 | + * inside a layout wrapper (Group/Columns) is still found. Note that a block | |
| 212 | + * inside a synced pattern is not reachable: those parse as `core/block` with | |
| 213 | + * no innerBlocks. | |
| 214 | + * | |
| 215 | + * Lives here rather than on Form_Renderer or Payment_Helper — both need it, | |
| 216 | + * they sit in unrelated namespaces, and this is a generic block utility with | |
| 217 | + * no rendering or payment semantics. | |
| 218 | + * | |
| 219 | + * @param array<int|string, mixed> $blocks Parsed blocks (parse_blocks output). | |
| 220 | + * @param string $target Block name to look for. | |
| 221 | + * @return bool | |
| 222 | + * @since 1.5.1 | |
| 223 | + */ | |
| 224 | + public static function block_tree_contains( $blocks, $target ) { | |
| 225 | + foreach ( $blocks as $block ) { | |
| 226 | + if ( ! is_array( $block ) ) { | |
| 227 | + continue; | |
| 228 | + } | |
| 229 | + if ( isset( $block['blockName'] ) && $block['blockName'] === $target ) { | |
| 230 | + return true; | |
| 231 | + } | |
| 232 | + if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) && self::block_tree_contains( $block['innerBlocks'], $target ) ) { | |
| 233 | + return true; | |
| 234 | + } | |
| 235 | + } | |
| 236 | + return false; | |
| 237 | + } | |
| 238 | + | |
| 239 | + /** | |
| 144 | 240 | * Checks if current value is string or else returns default value |
| 145 | 241 | * |
| 146 | 242 | * @param mixed $data data which need to be checked if is string. |
| 147 | 243 | * @return string |
| @@ -375,13 +471,39 @@ | ||
| 375 | 471 | return $slug . '-' . $index; |
| 376 | 472 | } |
| 377 | 473 | |
| 378 | 474 | /** |
| 475 | + * Generate a unique block ID for a server-created block. | |
| 476 | + * | |
| 477 | + * Mirrors the client-side generateBlockId() used in each block's edit.js | |
| 478 | + * (a 7-character base36 string). Blocks created programmatically (e.g. the | |
| 479 | + * default form auto-generated when a campaign is published) never run the | |
| 480 | + * editor, so they would otherwise have no block_id. The server-side payment | |
| 481 | + * validation config is keyed on block_id, so without one no config is stored | |
| 482 | + * and donations fail with "Invalid form configuration." until the form is | |
| 483 | + * opened and saved in the editor. | |
| 484 | + * | |
| 485 | + * @return string A 7-character base36 identifier. | |
| 486 | + * @since 1.1.1 | |
| 487 | + */ | |
| 488 | + public static function generate_block_id() { | |
| 489 | + $chars = '0123456789abcdefghijklmnopqrstuvwxyz'; | |
| 490 | + $block_id = ''; | |
| 491 | + for ( $i = 0; $i < 7; $i++ ) { | |
| 492 | + $block_id .= $chars[ wp_rand( 0, 35 ) ]; | |
| 493 | + } | |
| 494 | + return $block_id; | |
| 495 | + } | |
| 496 | + | |
| 497 | + /** | |
| 379 | 498 | * Get client IP address for logging purposes. |
| 380 | 499 | * |
| 381 | - * Checks forwarded headers first (for proxied/load-balanced environments) | |
| 382 | - * then falls back to REMOTE_ADDR. This is suitable for informational | |
| 383 | - * logging only — do NOT use for security-critical IP validation. | |
| 500 | + * Uses REMOTE_ADDR only — forwarded headers (HTTP_X_FORWARDED_FOR, | |
| 501 | + * HTTP_CLIENT_IP) are deliberately ignored because they are trivially | |
| 502 | + * spoofable. Note: behind a proxy/CDN that does not restore the real client | |
| 503 | + * IP, this returns the proxy's address. Suitable for informational logging | |
| 504 | + * and best-effort geolocation only — do NOT use for security-critical IP | |
| 505 | + * validation. | |
| 384 | 506 | * |
| 385 | 507 | * @return string Client IP address. |
| 386 | 508 | * @since 0.0.1 |
| 387 | 509 | */ |
| @@ -408,9 +530,9 @@ | ||
| 408 | 530 | * @param string $action Unique action identifier namespacing the bucket. |
| 409 | 531 | * @param int $max Maximum attempts permitted within the window. |
| 410 | 532 | * @param int $window Window length in seconds. |
| 411 | 533 | * @return bool True if the request is within limits; false if the limit is exceeded. |
| 412 | - * @since x.x.x | |
| 534 | + * @since 1.1.0 | |
| 413 | 535 | */ |
| 414 | 536 | public static function check_rate_limit( $action, $max = 15, $window = MINUTE_IN_SECONDS ) { |
| 415 | 537 | $ip = self::get_client_ip(); |
| 416 | 538 | if ( '' === $ip ) { |
| @@ -453,54 +575,89 @@ | ||
| 453 | 575 | */ |
| 454 | 576 | public static function get_allowed_form_html() { |
| 455 | 577 | // Note: data-* wildcard doesn't work in wp_kses, so we list each data attribute explicitly. |
| 456 | 578 | $common_data_attrs = [ |
| 457 | - 'data-block-id' => true, | |
| 458 | - 'data-form-id' => true, | |
| 459 | - 'data-gateway' => true, | |
| 460 | - 'data-stripe-key' => true, | |
| 461 | - 'data-currency' => true, | |
| 462 | - 'data-payment-mode' => true, | |
| 463 | - 'data-amount-type' => true, | |
| 464 | - 'data-fixed-amount' => true, | |
| 465 | - 'data-payment-type' => true, | |
| 466 | - 'data-customer-name-field' => true, | |
| 467 | - 'data-customer-email-field' => true, | |
| 468 | - 'data-nonce' => true, | |
| 469 | - 'data-variable-amount-field' => true, | |
| 470 | - 'data-minimum-amount' => true, | |
| 471 | - 'data-subscription-plan-name' => true, | |
| 472 | - 'data-subscription-interval' => true, | |
| 473 | - 'data-subscription-billing-cycles' => true, | |
| 474 | - 'data-currency-symbol' => true, | |
| 475 | - 'data-message-format' => true, | |
| 476 | - 'data-payment-methods' => true, | |
| 477 | - 'data-method' => true, | |
| 478 | - 'data-slug' => true, | |
| 479 | - 'data-required' => true, | |
| 480 | - 'data-fee-percentage' => true, | |
| 481 | - 'data-fee-fixed' => true, | |
| 482 | - 'data-fee-mode' => true, | |
| 483 | - 'data-gateway-fees' => true, | |
| 484 | - 'data-invalid-email-msg' => true, | |
| 485 | - 'data-sd-mask' => true, | |
| 486 | - 'data-custom-sd-mask' => true, | |
| 579 | + 'data-block-id' => true, | |
| 580 | + 'data-form-id' => true, | |
| 581 | + 'data-gateway' => true, | |
| 582 | + 'data-stripe-key' => true, | |
| 583 | + 'data-currency' => true, | |
| 584 | + 'data-payment-mode' => true, | |
| 585 | + 'data-amount-type' => true, | |
| 586 | + 'data-fixed-amount' => true, | |
| 587 | + 'data-payment-type' => true, | |
| 588 | + 'data-customer-name-field' => true, | |
| 589 | + 'data-customer-email-field' => true, | |
| 590 | + 'data-nonce' => true, | |
| 591 | + 'data-variable-amount-field' => true, | |
| 592 | + 'data-minimum-amount' => true, | |
| 593 | + 'data-subscription-plan-name' => true, | |
| 594 | + 'data-subscription-interval' => true, | |
| 595 | + 'data-subscription-billing-cycles' => true, | |
| 596 | + // Dual-mode ("both") payment block: per-choice amount configuration read by | |
| 597 | + // the chooser when the donor switches between one-time and recurring. | |
| 598 | + 'data-original-payment-type' => true, | |
| 599 | + 'data-default-payment-choice' => true, | |
| 600 | + 'data-one-time-amount-type' => true, | |
| 601 | + 'data-one-time-fixed-amount' => true, | |
| 602 | + 'data-one-time-minimum-amount' => true, | |
| 603 | + 'data-one-time-variable-amount-field' => true, | |
| 604 | + 'data-subscription-amount-type' => true, | |
| 605 | + 'data-subscription-fixed-amount' => true, | |
| 606 | + 'data-subscription-minimum-amount' => true, | |
| 607 | + 'data-subscription-variable-amount-field' => true, | |
| 608 | + 'data-currency-symbol' => true, | |
| 609 | + 'data-message-format' => true, | |
| 610 | + 'data-payment-methods' => true, | |
| 611 | + 'data-payment-available' => true, | |
| 612 | + 'data-method' => true, | |
| 613 | + 'data-slug' => true, | |
| 614 | + 'data-required' => true, | |
| 615 | + 'data-fee-percentage' => true, | |
| 616 | + 'data-fee-fixed' => true, | |
| 617 | + 'data-fee-mode' => true, | |
| 618 | + 'data-gateway-fees' => true, | |
| 619 | + 'data-invalid-email-msg' => true, | |
| 620 | + 'data-invalid-url-msg' => true, | |
| 621 | + 'data-sd-mask' => true, | |
| 622 | + 'data-custom-sd-mask' => true, | |
| 623 | + // Dropdown (tom-select) field. | |
| 624 | + 'data-multiple' => true, | |
| 625 | + 'data-searchable' => true, | |
| 626 | + 'data-preselected' => true, | |
| 627 | + 'data-min-selection' => true, | |
| 628 | + 'data-max-selection' => true, | |
| 629 | + 'data-placeholder' => true, | |
| 630 | + // Phone (intl-tel-input) field. | |
| 631 | + 'data-default-country' => true, | |
| 632 | + 'data-auto-country' => true, | |
| 633 | + 'data-enable-country-filter' => true, | |
| 634 | + 'data-country-filter-type' => true, | |
| 635 | + 'data-include-countries' => true, | |
| 636 | + 'data-exclude-countries' => true, | |
| 487 | 637 | ]; |
| 488 | 638 | |
| 489 | - return [ | |
| 490 | - 'div' => array_merge( | |
| 639 | + $allowed = [ | |
| 640 | + 'div' => array_merge( | |
| 491 | 641 | [ |
| 492 | 642 | 'id' => true, |
| 493 | 643 | 'class' => true, |
| 494 | 644 | 'style' => true, |
| 495 | 645 | 'role' => true, |
| 646 | + 'tabindex' => true, | |
| 496 | 647 | 'aria-live' => true, |
| 497 | 648 | 'aria-atomic' => true, |
| 649 | + 'aria-hidden' => true, | |
| 498 | 650 | 'aria-labelledby' => true, |
| 651 | + 'aria-label' => true, | |
| 652 | + // The dual-mode payment chooser hides the inactive amount panel with | |
| 653 | + // `hidden`; without it here kses strips the attribute and both panels | |
| 654 | + // render at once. | |
| 655 | + 'hidden' => true, | |
| 499 | 656 | ], |
| 500 | 657 | $common_data_attrs |
| 501 | 658 | ), |
| 502 | - 'form' => array_merge( | |
| 659 | + 'form' => array_merge( | |
| 503 | 660 | [ |
| 504 | 661 | 'id' => true, |
| 505 | 662 | 'class' => true, |
| 506 | 663 | 'method' => true, |
| @@ -507,22 +664,22 @@ | ||
| 507 | 664 | 'action' => true, |
| 508 | 665 | ], |
| 509 | 666 | $common_data_attrs |
| 510 | 667 | ), |
| 511 | - 'fieldset' => [ | |
| 668 | + 'fieldset' => [ | |
| 512 | 669 | 'id' => true, |
| 513 | 670 | 'class' => true, |
| 514 | 671 | ], |
| 515 | - 'legend' => [ | |
| 672 | + 'legend' => [ | |
| 516 | 673 | 'id' => true, |
| 517 | 674 | 'class' => true, |
| 518 | 675 | ], |
| 519 | - 'label' => [ | |
| 676 | + 'label' => [ | |
| 520 | 677 | 'id' => true, |
| 521 | 678 | 'class' => true, |
| 522 | 679 | 'for' => true, |
| 523 | 680 | ], |
| 524 | - 'input' => array_merge( | |
| 681 | + 'input' => array_merge( | |
| 525 | 682 | [ |
| 526 | 683 | 'id' => true, |
| 527 | 684 | 'class' => true, |
| 528 | 685 | 'type' => true, |
| @@ -536,15 +693,20 @@ | ||
| 536 | 693 | 'checked' => true, |
| 537 | 694 | 'disabled' => true, |
| 538 | 695 | 'readonly' => true, |
| 539 | 696 | 'required' => true, |
| 697 | + 'tabindex' => true, | |
| 698 | + 'autocomplete' => true, | |
| 699 | + 'inputmode' => true, | |
| 540 | 700 | 'aria-describedby' => true, |
| 541 | 701 | 'aria-required' => true, |
| 542 | 702 | 'aria-hidden' => true, |
| 703 | + // Payment-type chooser radios point at the amount panel they reveal. | |
| 704 | + 'aria-controls' => true, | |
| 543 | 705 | ], |
| 544 | 706 | $common_data_attrs |
| 545 | 707 | ), |
| 546 | - 'button' => array_merge( | |
| 708 | + 'button' => array_merge( | |
| 547 | 709 | [ |
| 548 | 710 | 'id' => true, |
| 549 | 711 | 'class' => true, |
| 550 | 712 | 'type' => true, |
| @@ -551,9 +713,9 @@ | ||
| 551 | 713 | 'disabled' => true, |
| 552 | 714 | ], |
| 553 | 715 | $common_data_attrs |
| 554 | 716 | ), |
| 555 | - 'select' => array_merge( | |
| 717 | + 'select' => array_merge( | |
| 556 | 718 | [ |
| 557 | 719 | 'id' => true, |
| 558 | 720 | 'class' => true, |
| 559 | 721 | 'name' => true, |
| @@ -558,19 +720,23 @@ | ||
| 558 | 720 | 'class' => true, |
| 559 | 721 | 'name' => true, |
| 560 | 722 | 'disabled' => true, |
| 561 | 723 | 'required' => true, |
| 724 | + 'multiple' => true, | |
| 725 | + 'tabindex' => true, | |
| 726 | + 'autocomplete' => true, | |
| 562 | 727 | 'aria-describedby' => true, |
| 563 | 728 | 'aria-required' => true, |
| 564 | 729 | ], |
| 565 | 730 | $common_data_attrs |
| 566 | 731 | ), |
| 567 | - 'option' => [ | |
| 732 | + 'option' => [ | |
| 568 | 733 | 'value' => true, |
| 734 | + 'class' => true, | |
| 569 | 735 | 'selected' => true, |
| 570 | 736 | 'disabled' => true, |
| 571 | 737 | ], |
| 572 | - 'textarea' => array_merge( | |
| 738 | + 'textarea' => array_merge( | |
| 573 | 739 | [ |
| 574 | 740 | 'id' => true, |
| 575 | 741 | 'class' => true, |
| 576 | 742 | 'name' => true, |
| @@ -585,9 +751,9 @@ | ||
| 585 | 751 | 'aria-required' => true, |
| 586 | 752 | ], |
| 587 | 753 | $common_data_attrs |
| 588 | 754 | ), |
| 589 | - 'span' => array_merge( | |
| 755 | + 'span' => array_merge( | |
| 590 | 756 | [ |
| 591 | 757 | 'id' => true, |
| 592 | 758 | 'class' => true, |
| 593 | 759 | 'style' => true, |
| @@ -594,15 +760,39 @@ | ||
| 594 | 760 | 'aria-hidden' => true, |
| 595 | 761 | ], |
| 596 | 762 | $common_data_attrs |
| 597 | 763 | ), |
| 598 | - 'p' => [ | |
| 764 | + 'p' => [ | |
| 599 | 765 | 'id' => true, |
| 600 | 766 | 'class' => true, |
| 601 | 767 | 'style' => true, |
| 602 | 768 | 'role' => true, |
| 603 | 769 | ], |
| 604 | - 'a' => [ | |
| 770 | + 'h1' => [ | |
| 771 | + 'id' => true, | |
| 772 | + 'class' => true, | |
| 773 | + ], | |
| 774 | + 'h2' => [ | |
| 775 | + 'id' => true, | |
| 776 | + 'class' => true, | |
| 777 | + ], | |
| 778 | + 'h3' => [ | |
| 779 | + 'id' => true, | |
| 780 | + 'class' => true, | |
| 781 | + ], | |
| 782 | + 'h4' => [ | |
| 783 | + 'id' => true, | |
| 784 | + 'class' => true, | |
| 785 | + ], | |
| 786 | + 'h5' => [ | |
| 787 | + 'id' => true, | |
| 788 | + 'class' => true, | |
| 789 | + ], | |
| 790 | + 'h6' => [ | |
| 791 | + 'id' => true, | |
| 792 | + 'class' => true, | |
| 793 | + ], | |
| 794 | + 'a' => [ | |
| 605 | 795 | 'id' => true, |
| 606 | 796 | 'class' => true, |
| 607 | 797 | 'href' => true, |
| 608 | 798 | 'target' => true, |
| @@ -608,25 +798,60 @@ | ||
| 608 | 798 | 'target' => true, |
| 609 | 799 | 'rel' => true, |
| 610 | 800 | 'style' => true, |
| 611 | 801 | ], |
| 612 | - 'strong' => [ | |
| 802 | + 'strong' => [ | |
| 613 | 803 | 'class' => true, |
| 614 | 804 | ], |
| 615 | - 'em' => [ | |
| 805 | + 'em' => [ | |
| 616 | 806 | 'class' => true, |
| 617 | 807 | ], |
| 618 | - 'ol' => [ | |
| 808 | + 'ol' => [ | |
| 619 | 809 | 'class' => true, |
| 620 | 810 | ], |
| 621 | - 'ul' => [ | |
| 811 | + 'ul' => [ | |
| 622 | 812 | 'class' => true, |
| 623 | 813 | ], |
| 624 | - 'li' => [ | |
| 814 | + 'li' => [ | |
| 625 | 815 | 'class' => true, |
| 626 | 816 | ], |
| 627 | - 'br' => [], | |
| 628 | - 'svg' => [ | |
| 817 | + 'br' => [], | |
| 818 | + 'hr' => [ | |
| 819 | + 'class' => true, | |
| 820 | + ], | |
| 821 | + // img/figure/figcaption back the Image block (inc/blocks/image) — the | |
| 822 | + // render depends on these entries, so don't drop them in a cleanup. | |
| 823 | + 'img' => [ | |
| 824 | + 'src' => true, | |
| 825 | + 'fetchpriority' => true, | |
| 826 | + 'srcset' => true, | |
| 827 | + 'sizes' => true, | |
| 828 | + 'alt' => true, | |
| 829 | + 'class' => true, | |
| 830 | + 'style' => true, | |
| 831 | + 'width' => true, | |
| 832 | + 'height' => true, | |
| 833 | + 'loading' => true, | |
| 834 | + 'decoding' => true, | |
| 835 | + 'title' => true, | |
| 836 | + // Lazy-load optimizers (WP Rocket, Perfmatters, Optimole, the | |
| 837 | + // Bricks theme, …) rewrite wp_get_attachment_image() output into | |
| 838 | + // these data-* attributes with a data: placeholder in src; allow | |
| 839 | + // them so kses doesn't strip the real URLs the lazy JS swaps back. | |
| 840 | + 'data-src' => true, | |
| 841 | + 'data-srcset' => true, | |
| 842 | + 'data-sizes' => true, | |
| 843 | + 'data-lazy-src' => true, | |
| 844 | + 'data-lazy-srcset' => true, | |
| 845 | + 'data-lazy-sizes' => true, | |
| 846 | + ], | |
| 847 | + 'figure' => [ | |
| 848 | + 'class' => true, | |
| 849 | + ], | |
| 850 | + 'figcaption' => [ | |
| 851 | + 'class' => true, | |
| 852 | + ], | |
| 853 | + 'svg' => [ | |
| 629 | 854 | 'class' => true, |
| 630 | 855 | 'width' => true, |
| 631 | 856 | 'height' => true, |
| 632 | 857 | 'viewbox' => true, |
| @@ -633,9 +858,9 @@ | ||
| 633 | 858 | 'fill' => true, |
| 634 | 859 | 'xmlns' => true, |
| 635 | 860 | 'aria-hidden' => true, |
| 636 | 861 | ], |
| 637 | - 'circle' => [ | |
| 862 | + 'circle' => [ | |
| 638 | 863 | 'cx' => true, |
| 639 | 864 | 'cy' => true, |
| 640 | 865 | 'r' => true, |
| 641 | 866 | 'stroke' => true, |
| @@ -641,9 +866,9 @@ | ||
| 641 | 866 | 'stroke' => true, |
| 642 | 867 | 'stroke-width' => true, |
| 643 | 868 | 'fill' => true, |
| 644 | 869 | ], |
| 645 | - 'rect' => [ | |
| 870 | + 'rect' => [ | |
| 646 | 871 | 'x' => true, |
| 647 | 872 | 'y' => true, |
| 648 | 873 | 'width' => true, |
| 649 | 874 | 'height' => true, |
| @@ -650,9 +875,9 @@ | ||
| 650 | 875 | 'rx' => true, |
| 651 | 876 | 'stroke' => true, |
| 652 | 877 | 'stroke-width' => true, |
| 653 | 878 | ], |
| 654 | - 'path' => [ | |
| 879 | + 'path' => [ | |
| 655 | 880 | 'class' => true, |
| 656 | 881 | 'd' => true, |
| 657 | 882 | 'stroke' => true, |
| 658 | 883 | 'stroke-width' => true, |
| @@ -660,8 +885,19 @@ | ||
| 660 | 885 | 'stroke-linejoin' => true, |
| 661 | 886 | 'fill' => true, |
| 662 | 887 | ], |
| 663 | 888 | ]; |
| 889 | + | |
| 890 | + /** | |
| 891 | + * Filter the allowed HTML tags/attributes for SureDonation form markup. | |
| 892 | + * | |
| 893 | + * Lets extensions (e.g. the SureDonation Pro date/time pickers) permit the | |
| 894 | + * extra tags or data attributes their fields render. | |
| 895 | + * | |
| 896 | + * @since 1.1.1 | |
| 897 | + * @param array<string, array<string, bool>> $allowed Allowed tags/attributes. | |
| 898 | + */ | |
| 899 | + return apply_filters( 'suredonation_allowed_form_html', $allowed ); | |
| 664 | 900 | } |
| 665 | 901 | |
| 666 | 902 | /** |
| 667 | 903 | * Get the nonce action string for a donation form. |
| @@ -709,21 +945,36 @@ | ||
| 709 | 945 | ? $data['message'] |
| 710 | 946 | : esc_html__( 'Thank you for your donation!', 'suredonation' ); |
| 711 | 947 | |
| 712 | 948 | return [ |
| 713 | - 'ajaxUrl' => admin_url( 'admin-ajax.php' ), | |
| 714 | - 'confirmationType' => $confirmation_type, | |
| 715 | - 'successTitle' => esc_html__( 'Thank You!', 'suredonation' ), | |
| 716 | - 'successMessage' => wp_kses_post( self::get_string_value( $success_message ) ), | |
| 949 | + 'ajaxUrl' => admin_url( 'admin-ajax.php' ), | |
| 950 | + 'confirmationType' => $confirmation_type, | |
| 951 | + 'successTitle' => esc_html__( 'Thank You!', 'suredonation' ), | |
| 952 | + 'successMessage' => wp_kses_post( self::get_string_value( $success_message ) ), | |
| 717 | 953 | // Shown when payment succeeded at the gateway but our server-side |
| 718 | 954 | // finalize did not complete; the webhook will finalize it, so the |
| 719 | 955 | // donor must not be prompted to pay again. |
| 720 | - 'processingMessage' => esc_html__( 'Payment received. We are finalizing your donation and will email you a confirmation shortly. Please do not pay again.', 'suredonation' ), | |
| 721 | - 'redirectUrl' => ! empty( $redirect_url ) ? esc_url( self::get_string_value( $redirect_url ) ) : '', | |
| 722 | - 'submissionAction' => $data['submission_action'], | |
| 956 | + 'processingMessage' => esc_html__( 'Payment received. We are finalizing your donation and will email you a confirmation shortly. Please do not pay again.', 'suredonation' ), | |
| 957 | + // Shown when the card form itself could not be rendered — almost | |
| 958 | + // always because the connected Stripe account is not allowed to | |
| 959 | + // charge cards. Deliberately says nothing about the account: the | |
| 960 | + // cause is the site's to fix, and the gateway's own wording would | |
| 961 | + // put its account state on a public page. | |
| 962 | + 'cardUnavailableMessage' => esc_html__( 'Card payments are unavailable right now. Please choose another payment method or contact the site owner.', 'suredonation' ), | |
| 963 | + 'redirectUrl' => ! empty( $redirect_url ) ? esc_url( self::get_string_value( $redirect_url ) ) : '', | |
| 964 | + 'submissionAction' => $data['submission_action'], | |
| 723 | 965 | // translators: %s: formatted fee amount with currency symbol. |
| 724 | - 'feeIncludesText' => __( '(includes %s processing fee)', 'suredonation' ), | |
| 725 | - 'amountPlaceholder' => __( 'Complete the form to view the amount.', 'suredonation' ), | |
| 966 | + 'feeIncludesText' => __( '(includes %s processing fee)', 'suredonation' ), | |
| 967 | + 'amountPlaceholder' => __( 'Complete the form to view the amount.', 'suredonation' ), | |
| 968 | + // Shown when a failed recurring confirmation forces the Stripe | |
| 969 | + // Payment Element to rebuild after switching to one-time — see | |
| 970 | + // StripeGateway.updatePaymentType(). Assigned via textContent | |
| 971 | + // (GatewayBase.showError()), which doesn't decode HTML entities, | |
| 972 | + // so this must not be esc_html__() or an apostrophe in | |
| 973 | + // translation would render as the literal "'". | |
| 974 | + 'reenterCardMessage' => __( 'Please re-enter your card details to continue.', 'suredonation' ), | |
| 975 | + // Currency symbol placement for client-side amount/fee formatting. | |
| 976 | + 'currencySignPosition' => Payment_Helper::get_currency_sign_position(), | |
| 726 | 977 | ]; |
| 727 | 978 | } |
| 728 | 979 | |
| 729 | 980 | /** |
| @@ -816,9 +1067,9 @@ | ||
| 816 | 1067 | 'title' => __( 'Success Badge', 'suredonation' ), |
| 817 | 1068 | ], |
| 818 | 1069 | ]; |
| 819 | 1070 | |
| 820 | - return [ | |
| 1071 | + $smart_tags = [ | |
| 821 | 1072 | 'confirmation' => $confirmation_tags, |
| 822 | 1073 | 'email' => array_merge( |
| 823 | 1074 | $confirmation_tags, |
| 824 | 1075 | [ |
| @@ -834,16 +1085,8 @@ | ||
| 834 | 1085 | 'tag' => '{admin_url}', |
| 835 | 1086 | 'title' => __( 'Admin URL', 'suredonation' ), |
| 836 | 1087 | ], |
| 837 | 1088 | [ |
| 838 | - 'tag' => '{subscription_id}', | |
| 839 | - 'title' => __( 'Subscription ID', 'suredonation' ), | |
| 840 | - ], | |
| 841 | - [ | |
| 842 | - 'tag' => '{subscription_interval}', | |
| 843 | - 'title' => __( 'Subscription Interval', 'suredonation' ), | |
| 844 | - ], | |
| 845 | - [ | |
| 846 | 1089 | 'tag' => '{offline_instructions}', |
| 847 | 1090 | 'title' => __( 'Offline Instructions', 'suredonation' ), |
| 848 | 1091 | ], |
| 849 | 1092 | ] |
| @@ -880,19 +1123,21 @@ | ||
| 880 | 1123 | 'tag' => '{payment_method}', |
| 881 | 1124 | 'title' => __( 'Payment Method', 'suredonation' ), |
| 882 | 1125 | ], |
| 883 | 1126 | [ |
| 884 | - 'tag' => '{subscription_id}', | |
| 885 | - 'title' => __( 'Subscription ID', 'suredonation' ), | |
| 1127 | + 'tag' => '{refund_amount}', | |
| 1128 | + 'title' => __( 'Refund Amount', 'suredonation' ), | |
| 886 | 1129 | ], |
| 887 | 1130 | [ |
| 888 | - 'tag' => '{subscription_interval}', | |
| 889 | - 'title' => __( 'Subscription Interval', 'suredonation' ), | |
| 1131 | + 'tag' => '{form_fields}', | |
| 1132 | + 'title' => __( 'Form Fields', 'suredonation' ), | |
| 1133 | + // Resolves to a block-level receipt card. The editor | |
| 1134 | + // offers this same list for Subject, From Name and | |
| 1135 | + // Reply-To, all of which are run through | |
| 1136 | + // process_smart_tags() — inserting it there would put | |
| 1137 | + // raw markup in a mail header. Body editor only. | |
| 1138 | + 'bodyOnly' => true, | |
| 890 | 1139 | ], |
| 891 | - [ | |
| 892 | - 'tag' => '{refund_amount}', | |
| 893 | - 'title' => __( 'Refund Amount', 'suredonation' ), | |
| 894 | - ], | |
| 895 | 1140 | ], |
| 896 | 1141 | ], |
| 897 | 1142 | [ |
| 898 | 1143 | 'label' => __( 'General Tags', 'suredonation' ), |
| @@ -938,8 +1183,68 @@ | ||
| 938 | 1183 | 'title' => __( 'Admin Email', 'suredonation' ), |
| 939 | 1184 | ], |
| 940 | 1185 | ], |
| 941 | 1186 | ]; |
| 1187 | + | |
| 1188 | + // Recurring tags resolve to nothing without Pro, so a free-only site was | |
| 1189 | + // being offered two tags it could never use. They stay here rather than | |
| 1190 | + // moving into Pro so that activating Pro does not depend on shipping a | |
| 1191 | + // matching Pro release; anything Pro adds beyond these comes through the | |
| 1192 | + // filter below. | |
| 1193 | + if ( defined( 'SUREDONATION_PRO_VER' ) ) { | |
| 1194 | + $smart_tags['email_grouped'][0]['tags'][] = [ | |
| 1195 | + 'tag' => '{subscription_id}', | |
| 1196 | + 'title' => __( 'Recurring Donation ID', 'suredonation' ), | |
| 1197 | + ]; | |
| 1198 | + $smart_tags['email_grouped'][0]['tags'][] = [ | |
| 1199 | + 'tag' => '{subscription_interval}', | |
| 1200 | + 'title' => __( 'Frequency', 'suredonation' ), | |
| 1201 | + ]; | |
| 1202 | + } | |
| 1203 | + | |
| 1204 | + /** | |
| 1205 | + * Filter the grouped smart tags offered in the email notification editor. | |
| 1206 | + * | |
| 1207 | + * The list is what an admin can insert, so anything registering a tag | |
| 1208 | + * resolver via `suredonation_email_smart_tags` needs to advertise it here | |
| 1209 | + * too. Without this, Pro could resolve recurring tags but had no way to | |
| 1210 | + * surface them, and free listed subscription tags that could never | |
| 1211 | + * resolve for a free-only site. | |
| 1212 | + * | |
| 1213 | + * @param array<int, array<string, mixed>> $groups Grouped tag definitions. | |
| 1214 | + * @since 1.5.1 | |
| 1215 | + */ | |
| 1216 | + $grouped = apply_filters( 'suredonation_email_smart_tag_groups', $smart_tags['email_grouped'] ); | |
| 1217 | + | |
| 1218 | + // The filter feeds the editor's tag picker, which iterates groups and | |
| 1219 | + // their tags. A callback returning a non-array — or groups without a | |
| 1220 | + // `tags` array — would fatal there rather than in whatever added it, so | |
| 1221 | + // the shape is re-checked before it is handed on. | |
| 1222 | + if ( is_array( $grouped ) ) { | |
| 1223 | + $smart_tags['email_grouped'] = array_values( | |
| 1224 | + array_filter( | |
| 1225 | + $grouped, | |
| 1226 | + static function ( $group ) { | |
| 1227 | + return is_array( $group ) && isset( $group['tags'] ) && is_array( $group['tags'] ); | |
| 1228 | + } | |
| 1229 | + ) | |
| 1230 | + ); | |
| 1231 | + } | |
| 1232 | + | |
| 1233 | + /** | |
| 1234 | + * Filter the smart-tag catalogue grouped by context. | |
| 1235 | + * | |
| 1236 | + * Lets extensions register additional contexts (e.g. a 'pdf' group for | |
| 1237 | + * PDF receipt templates) or extend existing ones. This catalogue only | |
| 1238 | + * drives tag-picker UIs; tag resolution happens in | |
| 1239 | + * Email_Handler::process_smart_tags() and its | |
| 1240 | + * 'suredonation_email_smart_tags' filter, so new tags must be | |
| 1241 | + * registered there as well to take effect. | |
| 1242 | + * | |
| 1243 | + * @param array<string, array<int, array<string, mixed>>> $smart_tags Smart tags grouped by context. | |
| 1244 | + * @since 1.5.0 | |
| 1245 | + */ | |
| 1246 | + return apply_filters( 'suredonation_smart_tags', $smart_tags ); | |
| 942 | 1247 | } |
| 943 | 1248 | |
| 944 | 1249 | /** |
| 945 | 1250 | * Map a payment gateway slug to a human-readable label. |
| @@ -975,9 +1280,9 @@ | ||
| 975 | 1280 | /** |
| 976 | 1281 | * Render a styled payment-status badge for the donation confirmation. |
| 977 | 1282 | * |
| 978 | 1283 | * @param string $status Payment status (e.g. completed, pending, failed). |
| 979 | - * @return string Badge HTML. | |
| 1284 | + * @return array Badge HTML. | |
| 980 | 1285 | * @since 1.0.0 |
| 981 | 1286 | */ |
| 982 | 1287 | public static function get_payment_status_config( $status ) { |
| 983 | 1288 | $status = strtolower( trim( (string) $status ) ); |
| @@ -1103,8 +1408,112 @@ | ||
| 1103 | 1408 | ); |
| 1104 | 1409 | } |
| 1105 | 1410 | |
| 1106 | 1411 | /** |
| 1412 | + * Translate a stored checkbox value for display. | |
| 1413 | + * | |
| 1414 | + * Checkbox fields persist the canonical, untranslated tokens in | |
| 1415 | + * Field_Validation::CHECKBOX_VALUES so the stored column stays comparable | |
| 1416 | + * across locales and survives an export/re-import. Anything shown to a human | |
| 1417 | + * runs through here; the CSV export deliberately does not, so the exported | |
| 1418 | + * column keeps the canonical token. | |
| 1419 | + * | |
| 1420 | + * Values that are not a checkbox token are returned untouched, so this is | |
| 1421 | + * safe to apply to a mixed field set. | |
| 1422 | + * | |
| 1423 | + * @param string $value Stored field value. | |
| 1424 | + * @return string Display value. | |
| 1425 | + * @since 1.5.1 | |
| 1426 | + */ | |
| 1427 | + public static function format_checkbox_field_value( $value ) { | |
| 1428 | + $value = self::get_string_value( $value ); | |
| 1429 | + | |
| 1430 | + switch ( $value ) { | |
| 1431 | + case Field_Validation::CHECKBOX_VALUES['yes']: | |
| 1432 | + return _x( 'Yes', 'checkbox field value', 'suredonation' ); | |
| 1433 | + case Field_Validation::CHECKBOX_VALUES['no']: | |
| 1434 | + return _x( 'No', 'checkbox field value', 'suredonation' ); | |
| 1435 | + default: | |
| 1436 | + return $value; | |
| 1437 | + } | |
| 1438 | + } | |
| 1439 | + | |
| 1440 | + /** | |
| 1441 | + * Render the donation's submitted form fields as receipt rows. | |
| 1442 | + * | |
| 1443 | + * The values persisted under donation_data['fields'] (see | |
| 1444 | + * Donations::set_submitted_fields) already surface on the entry screen and | |
| 1445 | + * in exports; this renders the same set for the email templates, behind the | |
| 1446 | + * {form_fields} smart tag. Returns '' when the donation has none, so a | |
| 1447 | + * template carrying the tag is unchanged for forms with no extra fields. | |
| 1448 | + * | |
| 1449 | + * SECURITY: the return value is substituted into email HTML by the | |
| 1450 | + * {form_fields} smart tag, and that tag is exempt from the escaping pass in | |
| 1451 | + * Email_Handler::process_smart_tags() because core tags are compared by value | |
| 1452 | + * and left alone. The esc_html() calls below are therefore the only thing | |
| 1453 | + * between donor-submitted text and an admin's mailbox — both the label and | |
| 1454 | + * the value must stay escaped here. See the regression test in | |
| 1455 | + * tests/unit/inc/test-helper.php. | |
| 1456 | + * | |
| 1457 | + * @param array<mixed> $fields Stored fields as label/value/group entries. | |
| 1458 | + * @return string Rendered markup, or '' when there is nothing to show. | |
| 1459 | + * @since 1.5.1 | |
| 1460 | + */ | |
| 1461 | + public static function render_submitted_fields( $fields ) { | |
| 1462 | + if ( empty( $fields ) || ! is_array( $fields ) ) { | |
| 1463 | + return ''; | |
| 1464 | + } | |
| 1465 | + | |
| 1466 | + $rows_html = ''; | |
| 1467 | + foreach ( $fields as $field ) { | |
| 1468 | + if ( ! is_array( $field ) ) { | |
| 1469 | + continue; | |
| 1470 | + } | |
| 1471 | + | |
| 1472 | + $label = self::get_string_value( $field['label'] ?? '' ); | |
| 1473 | + $value = self::format_checkbox_field_value( $field['value'] ?? '' ); | |
| 1474 | + $group = self::get_string_value( $field['group'] ?? '' ); | |
| 1475 | + | |
| 1476 | + if ( '' === $label && '' === $value ) { | |
| 1477 | + continue; | |
| 1478 | + } | |
| 1479 | + | |
| 1480 | + // Sub-fields (e.g. the Address block's parts) are stored with their | |
| 1481 | + // parent block's label as the group; prefix it so "Street Address" | |
| 1482 | + // reads as "Address: Street Address" rather than losing its context. | |
| 1483 | + if ( '' !== $group ) { | |
| 1484 | + // str_replace (not sprintf) because the format is translator | |
| 1485 | + // editable and this runs inside the gateway webhook handlers — a | |
| 1486 | + // stray literal % would make sprintf throw a ValueError on PHP 8, | |
| 1487 | + // 500 the webhook and trigger gateway retries. Same rule as | |
| 1488 | + // Field_Validation's message formatting. | |
| 1489 | + $label = str_replace( | |
| 1490 | + [ '%1$s', '%2$s' ], | |
| 1491 | + [ $group, $label ], | |
| 1492 | + /* translators: 1: parent field label, 2: sub-field label. */ | |
| 1493 | + _x( '%1$s: %2$s', 'parent field label: sub-field label', 'suredonation' ) | |
| 1494 | + ); | |
| 1495 | + } | |
| 1496 | + | |
| 1497 | + $rows_html .= sprintf( | |
| 1498 | + '<div class="sd-receipt-row"><span class="sd-receipt-row__label">%1$s</span><span class="sd-receipt-row__value">%2$s</span></div>', | |
| 1499 | + esc_html( $label ), | |
| 1500 | + esc_html( $value ) | |
| 1501 | + ); | |
| 1502 | + } | |
| 1503 | + | |
| 1504 | + if ( '' === $rows_html ) { | |
| 1505 | + return ''; | |
| 1506 | + } | |
| 1507 | + | |
| 1508 | + return sprintf( | |
| 1509 | + '<div class="sd-receipt-card"><h3 class="sd-receipt-card__title">%1$s</h3><div class="sd-receipt-rows">%2$s</div></div>', | |
| 1510 | + esc_html__( 'Form Details', 'suredonation' ), | |
| 1511 | + $rows_html | |
| 1512 | + ); | |
| 1513 | + } | |
| 1514 | + | |
| 1515 | + /** | |
| 1107 | 1516 | * Default confirmation message template (receipt layout with smart tags). |
| 1108 | 1517 | * |
| 1109 | 1518 | * @return string Message HTML template. |
| 1110 | 1519 | * @since 1.0.0 |
| @@ -1115,9 +1524,9 @@ | ||
| 1115 | 1524 | /* translators: {donor_name} is a smart tag replaced with the donor's name. */ |
| 1116 | 1525 | . esc_html__( 'Thank you {donor_name} for your Donation', 'suredonation' ) |
| 1117 | 1526 | . '</h2>' |
| 1118 | 1527 | . '<p class="sd-receipt-subtitle" style="text-align: center;">' |
| 1119 | - . esc_html__( 'Your contribution means a lot. We have sent an email to your registered account along with a receipt for your donation.', 'suredonation' ) | |
| 1528 | + . esc_html__( 'Your contribution means a lot. We have sent a confirmation email to your registered address with the details of your donation.', 'suredonation' ) | |
| 1120 | 1529 | . '</p>{donation_receipt}'; |
| 1121 | 1530 | } |
| 1122 | 1531 | |
| 1123 | 1532 | /** |
| @@ -1123,17 +1532,28 @@ | ||
| 1123 | 1532 | /** |
| 1124 | 1533 | * Build the rendered confirmation/thank-you HTML for a donation. |
| 1125 | 1534 | * |
| 1126 | 1535 | * Resolves the form's confirmation message template against the donation's |
| 1127 | - * real data (smart tags) so the frontend can display the receipt. | |
| 1536 | + * real data (smart tags) so the frontend can display the receipt. The | |
| 1537 | + * billing interval is lifted out of the nested donation_data column, which | |
| 1538 | + * is the only field of the set that is not stored as a column of its own. | |
| 1128 | 1539 | * |
| 1129 | - * @param int $donation_id Donation ID. | |
| 1540 | + * @param int $donation_id Donation ID. | |
| 1541 | + * @param array<string, mixed>|null $donation Donation row to render from. | |
| 1542 | + * Defaults to reading it. Pass one | |
| 1543 | + * when the caller already holds the | |
| 1544 | + * row, or when the row on disk does | |
| 1545 | + * not yet reflect the state being | |
| 1546 | + * reported to the donor. | |
| 1130 | 1547 | * @return string Sanitized confirmation HTML, or '' on failure. |
| 1131 | 1548 | * @since 1.0.0 |
| 1132 | 1549 | */ |
| 1133 | - public static function render_confirmation_message( $donation_id ) { | |
| 1134 | - $donation = Donations::get( $donation_id ); | |
| 1550 | + public static function render_confirmation_message( $donation_id, $donation = null ) { | |
| 1135 | 1551 | if ( ! is_array( $donation ) ) { |
| 1552 | + $donation = Donations::get( $donation_id ); | |
| 1553 | + } | |
| 1554 | + | |
| 1555 | + if ( ! is_array( $donation ) ) { | |
| 1136 | 1556 | return ''; |
| 1137 | 1557 | } |
| 1138 | 1558 | |
| 1139 | 1559 | $form_id = isset( $donation['form_id'] ) ? absint( $donation['form_id'] ) : 0; |
| @@ -1141,19 +1561,32 @@ | ||
| 1141 | 1561 | |
| 1142 | 1562 | $settings = self::get_form_confirmation_settings( $form_id ); |
| 1143 | 1563 | $template = ! empty( $settings['message'] ) ? $settings['message'] : self::get_default_confirmation_message(); |
| 1144 | 1564 | |
| 1565 | + // The billing interval is the one field the donation row does not carry | |
| 1566 | + // as a column; it is written a level down inside donation_data, so it | |
| 1567 | + // has to be lifted out before the tag map can see it. | |
| 1568 | + $stored = $donation['donation_data'] ?? []; | |
| 1569 | + if ( is_string( $stored ) && '' !== $stored ) { | |
| 1570 | + $stored = json_decode( $stored, true ); | |
| 1571 | + } | |
| 1572 | + $stored = is_array( $stored ) ? $stored : []; | |
| 1573 | + | |
| 1145 | 1574 | $donation_data = [ |
| 1146 | - 'id' => $donation_id, | |
| 1147 | - 'donor_name' => $donation['donor_name'] ?? '', | |
| 1148 | - 'donor_email' => $donation['donor_email'] ?? '', | |
| 1149 | - 'amount' => $donation['amount'] ?? 0, | |
| 1150 | - 'fees_covered' => $donation['fees_covered'] ?? 0, | |
| 1151 | - 'currency' => $donation['currency'] ?? Payment_Helper::get_currency(), | |
| 1152 | - 'gateway' => $donation['gateway'] ?? '', | |
| 1153 | - 'payment_status' => $donation['payment_status'] ?? '', | |
| 1154 | - 'transaction_id' => $donation['transaction_id'] ?? '', | |
| 1155 | - 'donation_type' => $donation['donation_type'] ?? 'one-time', | |
| 1575 | + 'id' => $donation_id, | |
| 1576 | + 'donor_name' => $donation['donor_name'] ?? '', | |
| 1577 | + 'donor_email' => $donation['donor_email'] ?? '', | |
| 1578 | + 'amount' => $donation['amount'] ?? 0, | |
| 1579 | + 'fees_covered' => $donation['fees_covered'] ?? 0, | |
| 1580 | + 'currency' => $donation['currency'] ?? Payment_Helper::get_currency(), | |
| 1581 | + 'gateway' => $donation['gateway'] ?? '', | |
| 1582 | + 'payment_status' => $donation['payment_status'] ?? '', | |
| 1583 | + 'transaction_id' => $donation['transaction_id'] ?? '', | |
| 1584 | + 'donation_type' => $donation['donation_type'] ?? 'one-time', | |
| 1585 | + // Recurring donations resolve these two; a one-time donation has | |
| 1586 | + // neither, and the tag map already renders a missing value as empty. | |
| 1587 | + 'subscription_id' => $donation['subscription_id'] ?? '', | |
| 1588 | + 'subscription_interval' => $stored['subscription_interval'] ?? '', | |
| 1156 | 1589 | ]; |
| 1157 | 1590 | |
| 1158 | 1591 | $campaign = $campaign_id ? get_post( $campaign_id ) : null; |
| 1159 | 1592 | |
| @@ -1159,6 +1592,62 @@ | ||
| 1159 | 1592 | |
| 1160 | 1593 | $rendered = Email_Handler::process_smart_tags( $template, $donation_data, $campaign ); |
| 1161 | 1594 | |
| 1162 | 1595 | return wp_kses_post( $rendered ); |
| 1596 | + } | |
| 1597 | + | |
| 1598 | + /** | |
| 1599 | + * Check whether the OttoKit (formerly SureTriggers) plugin is active and | |
| 1600 | + * authenticated with the OttoKit SaaS. | |
| 1601 | + * | |
| 1602 | + * @return bool True when OttoKit is installed, active and connected. | |
| 1603 | + * @since 1.2.0 | |
| 1604 | + */ | |
| 1605 | + public static function is_suretriggers_ready() { | |
| 1606 | + if ( ! defined( 'SURE_TRIGGERS_FILE' ) ) { | |
| 1607 | + // Plugin is deactivated or not installed at all. | |
| 1608 | + return false; | |
| 1609 | + } | |
| 1610 | + | |
| 1611 | + $suretriggers_data = get_option( 'suretrigger_options', [] ); | |
| 1612 | + if ( ! is_array( $suretriggers_data ) || empty( $suretriggers_data['secret_key'] ) || ! is_string( $suretriggers_data['secret_key'] ) ) { | |
| 1613 | + // OttoKit is not authenticated yet. | |
| 1614 | + return false; | |
| 1615 | + } | |
| 1616 | + | |
| 1617 | + return true; | |
| 1618 | + } | |
| 1619 | + | |
| 1620 | + /** | |
| 1621 | + * Get OttoKit (formerly SureTriggers) integration metadata. | |
| 1622 | + * | |
| 1623 | + * Shared by the admin app and the donation form editor so both surface the | |
| 1624 | + * same install/activate/connect state. | |
| 1625 | + * | |
| 1626 | + * @return array<string,mixed> Integration metadata. | |
| 1627 | + * @since 1.2.0 | |
| 1628 | + */ | |
| 1629 | + public static function get_ottokit_integration() { | |
| 1630 | + $plugin_file = 'suretriggers/suretriggers.php'; | |
| 1631 | + | |
| 1632 | + if ( ! function_exists( 'is_plugin_active' ) ) { | |
| 1633 | + include_once ABSPATH . 'wp-admin/includes/plugin.php'; | |
| 1634 | + } | |
| 1635 | + | |
| 1636 | + $status = 'Install'; | |
| 1637 | + if ( is_plugin_active( $plugin_file ) ) { | |
| 1638 | + $status = 'Activated'; | |
| 1639 | + } elseif ( array_key_exists( $plugin_file, get_plugins() ) ) { | |
| 1640 | + $status = 'Installed'; | |
| 1641 | + } | |
| 1642 | + | |
| 1643 | + return [ | |
| 1644 | + 'title' => 'OttoKit', | |
| 1645 | + 'slug' => 'suretriggers', | |
| 1646 | + 'path' => $plugin_file, | |
| 1647 | + 'status' => $status, | |
| 1648 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Filter is owned by the OttoKit plugin. | |
| 1649 | + 'connected' => apply_filters( 'suretriggers_is_user_connected', '' ), | |
| 1650 | + 'connection_url' => admin_url( 'admin.php?page=suretriggers' ), | |
| 1651 | + ]; | |
| 1163 | 1652 | } |
| 1164 | 1653 | } |
