PluginProbe
Pay with Vipps and MobilePay for WooCommerce / 6.2.5
Pay with Vipps and MobilePay for WooCommerce v6.2.5
6.2.5 6.2.4 6.2.3 6.2.2 6.2.1 6.2.0 6.1.10 6.1.9 6.1.8 6.1.7 6.1.6 6.1.5 6.1.4 6.1.3 6.1.2 6.1.1 6.1.0 6.0.5 6.0.4 6.0.3 6.0.2 6.0.1 6.0.0 5.4.3 5.4.2 All 187 releases
← All changes | payment/WC_Gateway_Vipps.class.php +67 -58 6.1.7 → 6.2.5 View file →
@@ -215,8 +215,26 @@
215 215 add_action('woocommerce_order_status_refunded', array($this, 'maybe_refund_order'), 9, 1);
216 216
217 217 // Possibly delete orders that never went anywhere
218 218 add_action('woocommerce_order_status_pending_to_cancelled', array($this, 'maybe_delete_order'), 99999, 1);
219 +
220 + // Disable emails for cancelled express orders that never went anywhere IOK 2026-09-09
221 + add_filter('woocommerce_email_enabled_cancelled_order', function ( $enabled, $order, $email ) {
222 + if ( ! $order instanceof WC_Order ) {
223 + return $enabled;
224 + }
225 + $pm = $order->get_payment_method();
226 + if (! Vipps::is_vipps_order($pm)){
227 + return $enabled;
228 + }
229 + $is_vipps_express = (bool) $order->get_meta( '_vipps_express_checkout' );
230 + $has_billing_email = (bool) $order->get_billing_email();
231 + if ( $is_vipps_express && ! $has_billing_email ) {
232 + return false;
233 + }
234 + return $enabled;
235 + }, 10, 3);
236 +
219 237 // Handle orders when authorized
220 238 add_action('woocommerce_payment_complete', array($this, 'order_payment_complete'), 10, 1);
221 239
222 240 // when an order is complete, we need to check if there is reserved amount that is not captured
@@ -603,22 +621,8 @@
603 621 }
604 622 public function shipping_details_callback_url($token='',$reference=0) {
605 623 return $this->make_callback_urls('vipps_shipping_details',$token,$reference);
606 624 }
607 - // Callback for the consetn removal callback. Must use template redirect directly, because wc-api doesn't handle DELETE.
608 - // IOK 2018-05-18
609 - public function consent_removal_callback_url () {
610 - $queryargs = [];
611 - $url = home_url("/", 'https');
612 - if ( !get_option('permalink_structure')) {
613 - $queryargs['vipps-consent-removal']=1;
614 - } else {
615 - $url = trailingslashit(home_url('vipps-consent-removal', 'https'));
616 - }
617 - // And we need to add an empty "callback" query arg as the very last arg to receive the actual callback.
618 - // We can't use add_query_arg for that, as an empty argument will remove the equals-sign.
619 - return add_query_arg($queryargs, $url) . "&callback=";
620 - }
621 625
622 626 // Allow user to select the template to be used for the special Vipps MobilePay pages. IOK 2020-02-17
623 627 public function get_theme_page_templates() {
624 628 if (!$this->page_templates) {
@@ -630,22 +634,8 @@
630 634 }
631 635 return $this->page_templates;
632 636 }
633 637
634 - // We can't use get_pages to get a default list of pages for our settings, because it triggers
635 - // actions that can be used by other plugins. Therefore we must use the database directly and cache the results. IOK 2023-08-22
636 - public function get_pagelist () {
637 - if (!$this->page_list) {
638 - global $wpdb;
639 - $page_list = array(''=>__('Use a simulated page (default)', 'woo-vipps'));
640 - foreach($wpdb->get_results("SELECT ID,post_title FROM {$wpdb->prefix}posts WHERE post_type='page' and post_status='publish'") as $page) {
641 - $page_list[$page->ID] = $page->post_title;
642 - }
643 - $this->page_list = $page_list;
644 - }
645 - return $this->page_list;
646 - }
647 -
648 638 // Check to see if the product in question can be bought with express checkout IOK 2018-12-04
649 639 public function product_supports_express_checkout($product) {
650 640 // IOK 2023-12-12 Can only support express checkout for Vipps - not MobilePay (yet!)
651 641 // IOK 2025-09-01 Now supports mobilepay
@@ -797,9 +787,9 @@
797 787 $order->save();
798 788 }
799 789
800 790 // IOK 2024-09-01 In general, we can refund most Vipps Mobilepay orders through the api,
801 - // however, this is not the case for the Bank Transfer method available through Vipps Checkout.
791 + // however, this is not the case for the Bank Transfer method available through Checkout.
802 792 public function can_refund_order( $order ) {
803 793 $method = $order->get_meta('_vipps_api');
804 794 switch ($method) {
805 795 case 'banktransfer':
@@ -1055,9 +1045,8 @@
1055 1045 global $Vipps;
1056 1046
1057 1047 // Used for defaults in the admin interface; however this functions is called a loot more often than that.
1058 1048 $page_templates = $this->get_theme_page_templates();
1059 - $page_list = $this->get_pagelist();
1060 1049
1061 1050 $orderprefix = $Vipps->generate_order_prefix();
1062 1051
1063 1052 // Default handling based on other parameters and earlier values.
@@ -1068,16 +1057,15 @@
1068 1057 if (class_exists('VippsWooLogin')) {
1069 1058 $woodefault = 'yes' === get_option('woocommerce_enable_signup_and_login_from_checkout');
1070 1059 if ($woodefault) {
1071 1060 $expresscreateuserdefault = "yes";
1072 - // $vippscreateuserdefault = "yes"; // However, for Vipps Checkout the email address is freetext so we'll treat the default a bit different.
1061 + // $vippscreateuserdefault = "yes"; // However, for Checkout the email address is freetext so we'll treat the default a bit different.
1073 1062 }
1074 1063 }
1075 1064
1076 - // We will only show the Vipps Checkout options if the user has activated the feature (thus creating the pages involved etc). IOK 2021-10-01
1065 + // We will only show the Checkout options if the user has activated the feature (thus creating the pages involved etc). IOK 2021-10-01
1077 1066 $vipps_checkout_activated = get_option('woo_vipps_checkout_activated', false);
1078 1067
1079 -
1080 1068 // This is used for new options,to set reasonable defaults based on older settings. We can't use WC_Settings->get_option for this unfortunately.
1081 1069 $current = get_option('woocommerce_vipps_settings');
1082 1070 // New defaults based on old defaults
1083 1071 $default_static_shipping_for_checkout = 'no';
@@ -1240,9 +1228,9 @@
1240 1228 'description' => __('Your phone number where Porterbuddy may send you important messages. Format must be MSISDN (including country code). Example: "4791234567"','woo-vipps'),
1241 1229 'default' => '',
1242 1230 ),
1243 1231
1244 - // Vipps checkout *shipping options* - extra shipping options that only work with Vipps Checkout
1232 + // Vipps checkout *shipping options* - extra shipping options that only work with Checkout
1245 1233 'vcs_helthjem' => array(
1246 1234 'title' => __('Helthjem', 'woo-vipps'),
1247 1235 'label' => sprintf(__('Support Helthjem as a shipping method in %1$s', 'woo-vipps'), Vipps::CheckoutName()),
1248 1236 'type' => 'checkbox',
@@ -1277,9 +1265,9 @@
1277 1265 ),
1278 1266
1279 1267 );
1280 1268
1281 - /* Support for *certain* external payment methods in Vipps Checkout. IOK 2024-05-27 */
1269 + /* Support for *certain* external payment methods in Checkout. IOK 2024-05-27 */
1282 1270 $externals = [];
1283 1271 $external_payment_fields = [];
1284 1272 $allow_external_payments = $this->allow_external_payments_in_checkout();
1285 1273 if ($allow_external_payments) {
@@ -1602,22 +1590,24 @@
1602 1590 'description' => __('Turn this on to add support for Woos Order Attribution API for Checkout and Express Checkout. Some stores have reported problems when using this API together with Vipps, so be sure to test this if you turn it on.', 'woo-vipps'),
1603 1591 ),
1604 1592
1605 1593 'vippsspecialpagetemplate' => array(
1606 - 'title' => sprintf(__('Override page template used for the special %1$s pages', 'woo-vipps'), Vipps::CompanyName()),
1594 + 'title' => sprintf(__('Legacy: Override page template used for the special %1$s page', 'woo-vipps'), Vipps::CompanyName()),
1607 1595 'label' => sprintf(__('Use specific template for %1$s', 'woo-vipps'), Vipps::CompanyName()),
1608 1596 'type' => 'select',
1609 1597 'options' => $page_templates,
1610 - 'description' => sprintf(__('Use this template from your theme or child-theme to display all the special %1$s pages. You will probably want a full-width template and it should call \'the_content()\' normally.', 'woo-vipps'), Vipps::CompanyName()),
1598 + 'description' => sprintf(__('Use this template from your theme or child-theme for the special %1$s page.<br>Legacy: This is not necessary anymore - you should instead choose a template by editing the page like any other page.','woo-vipps'), Vipps::CompanyName()),
1611 1599 'default' => ''),
1612 1600
1601 + // Deprecated, not shown anymore: TODO: remove this option in future. LP 2026-09-01
1613 1602 'vippsspecialpageid' => array(
1614 1603 'title' => sprintf(__('Use a real page ID for the special %1$s pages - neccessary for some themes', 'woo-vipps'), Vipps::CompanyName()),
1615 1604 'label' => __('Use a real page ID', 'woo-vipps'),
1616 1605 'type' => 'select',
1617 - 'options' => $page_list,
1606 + 'options' => [],
1618 1607 'description' => sprintf(__('Some very few themes do not work with the simulated pages used by this plugin, and needs a real page ID for this. Choose a blank page for this; the content will be replaced, but the template and other metadata will be present. You only need to use this if the plugin seems to break on the special %1$s pages.', 'woo-vipps'), Vipps::CompanyName()),
1619 - 'default'=>''),
1608 + 'default' => ''
1609 + ),
1620 1610
1621 1611 'sendreceipts' => array(
1622 1612 'title' => __("Send receipts and order confirmation info to the customers' app on completed purchases.", 'woo-vipps'),
1623 1613 'label' => sprintf(__("Send receipts to the customers %1\$s app", 'woo-vipps'), Vipps::CompanyName()),
@@ -1781,9 +1771,9 @@
1781 1771 $ok = apply_filters('woo_vipps_is_available', $ok, $this);
1782 1772 return $ok;
1783 1773 }
1784 1774
1785 - // True if the alternative Vipps Checkout screen is both available and activated. Returns the page id of the checkout
1775 + // True if the alternative Checkout screen is both available and activated. Returns the page id of the checkout
1786 1776 // page for convenience. IOK 2021-10-01
1787 1777 public function vipps_checkout_available () {
1788 1778
1789 1779 if ($this->get_option('vipps_checkout_enabled') != 'yes') return false;
@@ -1854,9 +1844,8 @@
1854 1844 wc_add_notice(sprintf(__('Unfortunately, the %1$s payment method is currently unavailable. Please choose another method.','woo-vipps'), $this->get_payment_method_name()),'error');
1855 1845 return [];
1856 1846 }
1857 1847
1858 -
1859 1848 // From the request, get either [billing_phone] => or [vipps phone]
1860 1849 $phone = '';
1861 1850 if (isset($_POST['vippsphone'])) {
1862 1851 $phone = trim(sanitize_text_field($_POST['vippsphone']));
@@ -1949,9 +1938,8 @@
1949 1938 $limited_session = $this->generate_authtoken();
1950 1939 $returnurl = add_query_arg('ls',$limited_session,$returnurl);
1951 1940 $returnurl = add_query_arg('id', $order_id, $returnurl);
1952 1941
1953 -
1954 1942 try {
1955 1943 // If the order was 'failed', it isnt any more! yet!
1956 1944 if ($order->get_status() == 'failed') {
1957 1945 $order->set_status('pending', __('Setting order status to pending to start payment', 'woo-vipps'));
@@ -1999,12 +1987,14 @@
1999 1987 $order->update_meta_data('_vipps_init_timestamp',$vippstamp);
2000 1988 $order->update_meta_data('_vipps_orderurl', $url);
2001 1989
2002 1990 $order->update_meta_data('_vipps_status','INITIATE'); // INITIATE right now
2003 - $order->add_order_note(sprintf(__('%1$s payment initiated','woo-vipps'), $this->get_payment_method_name()));
2004 - $order->add_order_note(sprintf(__('Awaiting %1$s payment confirmation','woo-vipps'), $this->get_payment_method_name()));
1991 +
1992 + $name = $this->get_payment_method_name();
1993 + $order->add_order_note(sprintf(__('%1$s payment initiated','woo-vipps'), $name));
1994 + $order->add_order_note(sprintf(__('Awaiting %1$s payment confirmation','woo-vipps'),$name));
1995 +
2005 1996 $order->save();
2006 -
2007 1997 // Create a signal file that we can check without calling wordpress to see if our result is in IOK 2018-05-04
2008 1998 try {
2009 1999 $Vipps->createCallbackSignal($order);
2010 2000 } catch (Exception $e) {
@@ -2009,9 +1999,8 @@
2009 1999 $Vipps->createCallbackSignal($order);
2010 2000 } catch (Exception $e) {
2011 2001 // Could not create a signal file, but that's ok.
2012 2002 }
2013 -
2014 2003 do_action('woo_vipps_before_redirect_to_vipps',$order_id);
2015 2004
2016 2005 // This will send us to a receipt page where we will do the actual work. IOK 2018-04-20
2017 2006 return array('result'=>'success','redirect'=>$url);
@@ -2676,9 +2665,9 @@
2676 2665 $ready = true;
2677 2666 }
2678 2667
2679 2668 if ($ready && ($express || $checkout_session)) {
2680 - // For Vipps Checkout version 3 there are no more userDetails, so we will add it, including defaults for anonymous purchases IOK 2023-01-10
2669 + // For Checkout version 3 there are no more userDetails, so we will add it, including defaults for anonymous purchases IOK 2023-01-10
2681 2670 // This will also normalize userDetails, adding 'sub' where possible and fields for backwards compatibility. 2025-08-12
2682 2671 $result = $this->ensure_userDetails($result, $order);
2683 2672
2684 2673 // After, we need to normalize shipping details or even add them if e.g. using Checkout without address or contact info IOK 2025-08-13
@@ -2751,9 +2740,9 @@
2751 2740 return $result;
2752 2741 }
2753 2742
2754 2743
2755 - // IOK 2024-01-09 If using Vipps Checkout with the BankTransfer method, which is eg. used in Finland,
2744 + // IOK 2024-01-09 If using Checkout with the BankTransfer method, which is eg. used in Finland,
2756 2745 // we are (currently) not receiving any 'state' or 'aggregate', so add this iff the payment is successful.
2757 2746 // The reason for this is that this payment type does not actually use the epayment API at all (!)
2758 2747 // Also moved some other compatibility code here -
2759 2748 // --- reference used to be orderId
@@ -2822,9 +2811,9 @@
2822 2811
2823 2812 return $result;
2824 2813 }
2825 2814
2826 - // Vipps Checkout v3 does *not* provide userDetails. Vipps Checkout v2 and epayment *does*. But Checkout additionally allows
2815 + // Checkout v3 does *not* provide userDetails. Checkout v2 and epayment *does*. But Checkout additionally allows
2827 2816 // for anonymous purchases, in which case there is *no* user details. In this case we provide an anonymous user so we can actually create an order.
2828 2817 // To handle this, we provide this utility that ensures we have userDetails no matter the input. For this we use the anonymous filters and "billingDetails" if present
2829 2818 // if not, we use shippingDetails. IOK 2023-01-10
2830 2819 // Also, epayment uses mobileNumber and checkout uses phoneNumber, so normalize.
@@ -3201,9 +3190,13 @@
3201 3190 $is_base64 = $shipping_table ? ( $shipping_table['_is_base64'] ?? false) : false;
3202 3191
3203 3192 if (is_array($shipping_table) && isset($shipping_table[$key])) {
3204 3193 $decoded = $is_base64 ? @base64_decode($shipping_table[$key]) : $shipping_table[$key];
3205 - $shipping_rate = $decoded ? @unserialize($decoded) : null;
3194 +
3195 + // Ensure no shop manager has injected an evil object (that they would have had to add as a plugin) here. IOK 2026-09-18
3196 + $shipping_rate = $decoded ? @unserialize($decoded, ['allowed_classes' => [WC_Shipping_Rate::class]]) : null;
3197 + $shipping_rate = is_a($shipping_rate,'WC_Shipping_Rate') ? $shipping_rate : null;
3198 +
3206 3199 if (!$shipping_rate) {
3207 3200 $this->log(sprintf(__("%1\$s: Could not deserialize the chosen shipping method %2\$s for order %3\$d", 'woo-vipps'), Vipps::ExpressCheckoutName(), $method, $order->get_id()), 'error');
3208 3201 $this->log(sprintf(__("Serialized data was %1\$s", 'woo-vipps'), $decoded), 'error');
3209 3202 } else {
@@ -3223,9 +3216,9 @@
3223 3216 }
3224 3217 }
3225 3218 }
3226 3219
3227 - // Possible extra metadata from Vipps Checkout IOK 2023-01-17
3220 + // Possible extra metadata from Checkout IOK 2023-01-17
3228 3221 // Store in the order, but also in the shipping rate so it will be visible in the order screen
3229 3222 // along with the shipping ragte
3230 3223 if (isset($shipping['pickupPoint'])) {
3231 3224 $order->update_meta_data('vipps_checkout_pickupPoint', $shipping['pickupPoint']);
@@ -3285,9 +3278,9 @@
3285 3278 $methodclass = $methods_classes[$shipping_rate->get_method_id()] ?? null;
3286 3279 $shipping_method = $methodclass ? new $methodclass($shipping_rate->get_instance_id()) : null;
3287 3280 $is_vipps_checkout_shipping = $shipping_method && is_a($shipping_method, 'VippsCheckout_Shipping_Method');
3288 3281
3289 - // Some Vipps Checkout-specific shipping methods calculate the cost in the Vipps window.
3282 + // Some Checkout-specific shipping methods calculate the cost in the Vipps window.
3290 3283 if ($is_vipps_checkout_shipping && $shipping_method->dynamic_cost) {
3291 3284 $vippsamount = intval($order->get_meta('_vipps_amount'));
3292 3285 $shipping_tax_rate = floatval($order->get_meta('_vipps_shipping_tax_rates'));
3293 3286 $compareamount = $ordertotal * 100;
@@ -3323,9 +3316,9 @@
3323 3316
3324 3317 $order->set_total($ordertotal + $total_shipping + $total_shipping_tax);
3325 3318 $order->update_taxes(); // Necessary for the admin view only; does not recalculate order.
3326 3319
3327 - // Add an early hook for Vipps Checkout orders with special shipping methods
3320 + // Add an early hook for Checkout orders with special shipping methods
3328 3321 $metadata = $shipping_rate->get_meta_data();
3329 3322 if (isset($metadata['type'])) {
3330 3323 do_action('woo_vipps_checkout_special_shipping_method', $order, $shipping_rate, $metadata['type']);
3331 3324 }
@@ -3341,9 +3334,9 @@
3341 3334
3342 3335
3343 3336 // If we have the 'expresscreateuser' thing set to true, we will create or assign the order here, as it is the first-ish place where we can.
3344 3337 // If possible and safe, user will be logged in before being sent to the thankyou screen. IOK 2020-10-09
3345 - // Same thing for Vipps Checkout, mutatis mutandis. The function below returns false if no customer exists or gets created.
3338 + // Same thing for Checkout, mutatis mutandis. The function below returns false if no customer exists or gets created.
3346 3339 $customer = false;
3347 3340 if ($assigncustomer) {
3348 3341 $customer = Vipps::instance()->express_checkout_get_vipps_customer($order);
3349 3342 }
@@ -3676,9 +3669,9 @@
3676 3669 // made to the session here will be saved. Sorry.
3677 3670 // UPDATE: Should be no more race condition since we moved callback into the action scheduler, and this shipping finalization into this rest endpoint. LP 2026-03-30
3678 3671 Vipps::instance()->callback_restore_session($order_id);
3679 3672
3680 - // For Vipps Checkout version 3 there are no more userDetails, so we will add it, including defaults for anonymous purchases IOK 2023-01-10
3673 + // For Checkout version 3 there are no more userDetails, so we will add it, including defaults for anonymous purchases IOK 2023-01-10
3681 3674 // This will also normalize userDetails, adding 'sub' where possible and fields for backwards compatibility. 2025-08-12
3682 3675 $data = $this->ensure_userDetails($data, $order);
3683 3676
3684 3677 // Some Express Checkout orders aren't really express checkout orders, but normal orders to which we have
@@ -3769,9 +3762,9 @@
3769 3762 }
3770 3763 do_action('woo_vipps_payment_complete_at_shutdown', $order, $this);
3771 3764 } catch (Exception $e) {
3772 3765 // This is/should be non-critical so just log it.
3773 - $this->log(sprintf(__("Could not do all payment-complete actions on %1\$s order %2\$d: %3\$s ", 'woo-vipps'), Vipps::CompanyName(), $orderid, $e->etMessage()), "error");
3766 + $this->log(sprintf(__("Could not do all payment-complete actions on %1\$s order %2\$d: %3\$s ", 'woo-vipps'), Vipps::CompanyName(), $orderid, $e->getMessage()), "error");
3774 3767 }
3775 3768 }
3776 3769
3777 3770 // This is run on payment complete. Per default will it only add a link to the order confirmation page, but
@@ -3878,9 +3871,9 @@
3878 3871
3879 3872 $contents = WC()->cart->get_cart_contents();
3880 3873 $contents = apply_filters('woo_vipps_create_express_checkout_cart_contents',$contents);
3881 3874 try {
3882 - $cart_hash = md5(json_encode(wc_clean($contents)) . WC()->cart->total);
3875 + $cart_hash = WC()->cart->get_cart_hash();
3883 3876 $order = new WC_Order();
3884 3877 $order->set_status('pending');
3885 3878 $order->set_payment_method($this);
3886 3879 if ($ischeckout) {
@@ -3891,8 +3884,9 @@
3891 3884 }
3892 3885 // We use 'checkout' as the created_via key as per requests, but allow merchants to use their own. IOK 2022-09-15
3893 3886 $created_via = apply_filters('woo_vipps_express_checkout_created_via', 'checkout', $order, $ischeckout);
3894 3887 $order->set_created_via($created_via);
3888 + $order->set_cart_hash($cart_hash);
3895 3889
3896 3890 $dummy = sprintf(__('Vipps Express Checkout', 'woo-vipps')); // this is so gettext will find this string.
3897 3891 $dummy = sprintf(__('Vipps Checkout', 'woo-vipps')); // this is so gettext will find this string.
3898 3892
@@ -4054,9 +4048,9 @@
4054 4048 </p>
4055 4049 </div>
4056 4050 <?php endif; ?>
4057 4051
4058 - <?php // We will only show the Vipps Checkout options if the user has activated the feature (thus creating the pages involved etc). IOK 2021-10-01
4052 + <?php // We will only show the Checkout options if the user has activated the feature (thus creating the pages involved etc). IOK 2021-10-01
4059 4053 $vipps_checkout_activated = get_option('woo_vipps_checkout_activated', false);
4060 4054 ?>
4061 4055
4062 4056 <?php /* We will *not* allow vipps checkout to be activated at this point, since the product is no longer sold. IOK 2026-04-30 */ ?>
@@ -4117,8 +4111,23 @@
4117 4111 // If enabling this, ensure the page in question exists
4118 4112 if ($this->get_option('vipps_checkout_enabled') == 'yes') {
4119 4113 update_option('woo_vipps_checkout_activated', true, true); // This must be true here, but still, make sure
4120 4114 Vipps::instance()->maybe_create_vipps_pages();
4115 + }
4116 +
4117 + // Ensure special page has the necessary shortcode. LP 2026-09-01
4118 + $special_page = get_post(Vipps::get_special_page_id());
4119 + if ($special_page && !has_shortcode($special_page->post_content, 'vipps_special_page')) {
4120 + $new_content = $special_page->post_content . "\n\n<!-- wp:shortcode -->[vipps_special_page]<!-- /wp:shortcode -->";
4121 + wp_update_post([
4122 + 'ID' => Vipps::get_special_page_id(),
4123 + 'post_content' => $new_content,
4124 + ]);
4125 + } else if (!Vipps::get_special_page_id()) {
4126 + // We shouldn't really get here, the page should be ensured to exist in init. LP 2026-09-03
4127 + /* translators: %s is current method name */
4128 + $this->log(sprintf(__('Missing special page in %s, attempting to fix', 'woo-vipps'), 'process_admin_options'), 'warning');
4129 + Vipps::instance()->ensure_special_page_exists();
4121 4130 }
4122 4131
4123 4132 return $saved;
4124 4133 }