| @@ -132,11 +132,10 @@ | ||
| 132 | 132 | $amount = isset( $_POST['amount'] ) ? floatval( $_POST['amount'] ) : 0; |
| 133 | 133 | $cover_fees = isset( $_POST['cover_fees'] ) && 'true' === $_POST['cover_fees']; |
| 134 | 134 | // The anonymous flag is display-only: the donor's real name is stored as |
| 135 | 135 | // usual below and only public surfaces mask it. |
| 136 | - $donor_name = sanitize_text_field( wp_unslash( $_POST['donor_name'] ?? '' ) ); | |
| 137 | - $donor_email = sanitize_email( wp_unslash( $_POST['donor_email'] ?? '' ) ); | |
| 138 | - $donor_comment = sanitize_textarea_field( wp_unslash( $_POST['donor_comment'] ?? '' ) ); | |
| 136 | + $donor_name = sanitize_text_field( wp_unslash( $_POST['donor_name'] ?? '' ) ); | |
| 137 | + $donor_email = sanitize_email( wp_unslash( $_POST['donor_email'] ?? '' ) ); | |
| 139 | 138 | |
| 140 | 139 | // Get form_id and block_id for amount validation. |
| 141 | 140 | $form_id = isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0; |
| 142 | 141 | $is_anonymous = Payment_Helper::get_submitted_is_anonymous( $form_id ); |
| @@ -142,9 +141,13 @@ | ||
| 142 | 141 | $is_anonymous = Payment_Helper::get_submitted_is_anonymous( $form_id ); |
| 143 | 142 | // Derive the donor phone from the validated mapped field, not a separate |
| 144 | 143 | // unvalidated $_POST['donor_phone'] (see Payment_Helper::get_mapped_donor_phone). |
| 145 | 144 | $donor_phone = Payment_Helper::get_mapped_donor_phone( $form_id ); |
| 146 | - $block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : ''; | |
| 145 | + // Likewise derive the comment from the form's Donor Comment field rather | |
| 146 | + // than an unvalidated $_POST['donor_comment'] (see | |
| 147 | + // Payment_Helper::get_mapped_donor_comment). | |
| 148 | + $donor_comment = Payment_Helper::get_mapped_donor_comment( $form_id ); | |
| 149 | + $block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : ''; | |
| 147 | 150 | |
| 148 | 151 | // Validate required fields. |
| 149 | 152 | if ( $amount <= 0 ) { |
| 150 | 153 | wp_send_json_error( __( 'Invalid donation amount', 'suredonation' ) ); |
| @@ -204,26 +207,27 @@ | ||
| 204 | 207 | |
| 205 | 208 | // Create donation in database. |
| 206 | 209 | $donation_id = Donations::add( |
| 207 | 210 | [ |
| 208 | - 'campaign_id' => $campaign_id, | |
| 209 | - 'donor_id' => $donor_id ? $donor_id : 0, | |
| 210 | - 'amount' => number_format( $base_amount, 2, '.', '' ), | |
| 211 | - 'fees_covered' => number_format( $fees_covered, 2, '.', '' ), | |
| 212 | - 'currency' => Payment_Helper::get_currency(), | |
| 213 | - 'gateway' => 'manual', | |
| 214 | - 'payment_status' => 'pending', | |
| 215 | - 'payment_mode' => $payment_mode, | |
| 216 | - 'donor_name' => $donor_name, | |
| 217 | - 'donor_email' => $donor_email, | |
| 218 | - 'donor_phone' => $donor_phone, | |
| 219 | - 'is_anonymous' => $is_anonymous ? 1 : 0, | |
| 220 | - 'donation_type' => 'one-time', | |
| 221 | - 'donor_comment' => $donor_comment, | |
| 222 | - 'form_id' => $form_id, | |
| 223 | - 'ip_address' => Helper::get_client_ip(), | |
| 224 | - 'user_agent' => isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '', | |
| 225 | - 'referer_url' => isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '', | |
| 211 | + 'campaign_id' => $campaign_id, | |
| 212 | + 'donor_id' => $donor_id ? $donor_id : 0, | |
| 213 | + 'amount' => number_format( $base_amount, 2, '.', '' ), | |
| 214 | + 'fees_covered' => number_format( $fees_covered, 2, '.', '' ), | |
| 215 | + 'currency' => Payment_Helper::get_currency(), | |
| 216 | + 'gateway' => 'manual', | |
| 217 | + 'payment_status' => 'pending', | |
| 218 | + 'payment_mode' => $payment_mode, | |
| 219 | + 'donor_name' => $donor_name, | |
| 220 | + 'donor_email' => $donor_email, | |
| 221 | + 'donor_phone' => $donor_phone, | |
| 222 | + 'is_anonymous' => $is_anonymous ? 1 : 0, | |
| 223 | + 'donation_type' => 'one-time', | |
| 224 | + 'donor_comment' => $donor_comment, | |
| 225 | + 'donor_comment_status' => Donations::initial_comment_status( $donor_comment ), | |
| 226 | + 'form_id' => $form_id, | |
| 227 | + 'ip_address' => Helper::get_client_ip(), | |
| 228 | + 'user_agent' => isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '', | |
| 229 | + 'referer_url' => isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '', | |
| 226 | 230 | ] |
| 227 | 231 | ); |
| 228 | 232 | |
| 229 | 233 | if ( ! $donation_id ) { |
