← All changes | includes/Services/Orders/OrderManager.php +16 -3 1.9.0 → 1.10.20 View file →

		@@ -156,8 +156,9 @@
156	156	'status' => 400,
157	157	];
158	158	}
159	159
	160	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom plugin table; identifier from $wpdb->prefix, not user input.
160	161	$existingOrderId = $wpdb->get_var(
161	162	$wpdb->prepare(
162	163	"SELECT order_id FROM {$table_name} WHERE invoice_id = %d LIMIT 1",
163	164	$invoice_id
		@@ -173,8 +174,9 @@
173	174	];
174	175	}
175	176
176	177	$lockName = 'sync_basalam_invoice_' . $invoice_id;
	178	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Named MySQL advisory lock; no object cache applicable.
177	179	$gotLock = $wpdb->get_var(
178	180	$wpdb->prepare("SELECT GET_LOCK(%s, 0)", $lockName)
179	181	);
180	182
		@@ -187,8 +189,9 @@
187	189	];
188	190	}
189	191
190	192	try {
	193	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom plugin table; identifier from $wpdb->prefix, not user input.
191	194	$existingOrderId = $wpdb->get_var(
192	195	$wpdb->prepare(
193	196	"SELECT order_id FROM {$table_name} WHERE invoice_id = %d LIMIT 1",
194	197	$invoice_id
		@@ -205,8 +208,9 @@
205	208	}
206	209
207	210	return self::createOrderWooLocked($params, $invoice_id, $payment_id, $user_id, $city_id, $province_id, $table_name);
208	211	} finally {
	212	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Named MySQL advisory lock; no object cache applicable.
209	213	$wpdb->query(
210	214	$wpdb->prepare("SELECT RELEASE_LOCK(%s)", $lockName)
211	215	);
212	216	}
		@@ -215,8 +219,9 @@
215	219	private static function createOrderWooLocked($params, $invoice_id, $payment_id, $user_id, $city_id, $province_id, $table_name)
216	220	{
217	221	global $wpdb;
218	222
	223	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
219	224	$wpdb->query('START TRANSACTION');
220	225	try {
221	226
222	227	$vendor_id = syncBasalamSettings()->getSettings(SettingsConfig::VENDOR_ID);
		@@ -227,8 +232,9 @@
227	232
228	233	$response = $apiServiceManager->get($api_url);
229	234
230	235	if (isset($response['success']) && !$response['success']) {
	236	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
231	237	$wpdb->query('ROLLBACK');
232	238	Logger::error("درخواست API ناموفق بود: " . ($response['error'] ?? 'خطای نامشخص'));
233	239
234	240	return [
		@@ -242,8 +248,9 @@
242	248	$api_response = $response['body'] ?? '';
243	249	$data = json_decode($api_response, true);
244	250
245	251	if (json_last_error() !== JSON_ERROR_NONE) {
	252	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
246	253	$wpdb->query('ROLLBACK');
247	254
248	255	return [
249	256	'success' => false,
		@@ -253,8 +260,9 @@
253	260	];
254	261	}
255	262
256	263	if (empty($data)) {
	264	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
257	265	$wpdb->query('ROLLBACK');
258	266	Logger::error("پاسخ خالی از API برای فاکتور دریافت شد: $invoice_id");
259	267
260	268	return [
		@@ -370,9 +378,9 @@
370	378	$order->set_shipping_country('IR');
371	379
372	380	// Set state and city with PWS compatibility
373	381	$addressData = [
374		- 'province' => $province,
	382	+ 'province' => $province,
375	383	'city' => $city,
376	384	];
377	385	GetProvincesData::setOrderAddress($order, $addressData, 'billing');
378	386	GetProvincesData::setOrderAddress($order, $addressData, 'shipping');
		@@ -379,10 +387,10 @@
379	387
380	388	// Add shipping method based on settings
381	389	$shipping_method_setting = syncBasalamSettings()->getSettings(SettingsConfig::ORDER_SHIPPING_METHOD);
382	390
383		- if (isset($data['parcel_detail']['shipping_cost'])) {
384		- $shipping_cost = $data['parcel_detail']['shipping_cost'];
	391	+ if (isset($data['financial_report']['shipping_submit']['total']['amount'])) {
	392	+ $shipping_cost = $data['financial_report']['shipping_submit']['total']['amount'];
385	393
386	394	$currency = get_woocommerce_currency();
387	395	if ($currency === 'IRT') {
388	396	$shipping_cost = $shipping_cost / 10;
		@@ -511,8 +519,9 @@
511	519
512	520	$order_id = $order->get_id();
513	521	if ($order_id) {
514	522
	523	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom plugin table; no object cache for these operational queries.
515	524	$insert_result = $wpdb->insert(
516	525	$table_name,
517	526	[
518	527	'payment_id' => $payment_id,
		@@ -530,8 +539,9 @@
530	539	}
531	540
532	541	update_post_meta($order_id, '_is_sync_basalam_order', true);
533	542
	543	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
534	544	$wpdb->query('COMMIT');
535	545
536	546	return [
537	547	'success' => true,
		@@ -542,8 +552,9 @@
542	552	} else {
543	553	throw new \Exception("خطا در ایجاد سفارش با شناسه $invoice_id ، از گزینه بررسی سفارشات استفاده نمایید.");
544	554	}
545	555	} catch (\Exception $e) {
	556	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Transaction control statement; no object cache applicable.
546	557	$wpdb->query('ROLLBACK');
547	558
548	559	Logger::error($e->getMessage());
549	560
		@@ -580,8 +591,9 @@
580	591	{
581	592	global $wpdb;
582	593	$table_name = $wpdb->prefix . 'sync_basalam_payments';
583	594
	595	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom plugin table; identifier from $wpdb->prefix, not user input.
584	596	$order_id = $wpdb->get_var(
585	597	$wpdb->prepare("SELECT order_id FROM {$table_name} WHERE invoice_id = %d", $invoice_id)
586	598	);
587	599
		@@ -676,8 +688,9 @@
676	688
677	689	public static function productExistsByTitle($title)
678	690	{
679	691	global $wpdb;
	692	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Direct lookup on core posts table; no cache key available for this title match.
680	693	$product_id = $wpdb->get_var(
681	694	$wpdb->prepare(
682	695	"SELECT ID FROM {$wpdb->posts} WHERE post_type = 'product' AND post_status != 'private' AND post_title = %s LIMIT 1",
683	696	$title