← All changes | payment/Vipps.class.php +502 -576 6.2.6 → 6.3.1 View file →

		@@ -54,11 +54,8 @@
54	54
55	55	// True if HPOS is being used
56	56	public $HPOSActive = null;
57	57
58		- // used in the fake locking mechanism using transients
59		- private $lockKey = null;
60		-
61	58	public $vippsJSConfig = array();
62	59
63	60	public $button_options_version = '2.0';
64	61	public $button_options_express_version = '2.0';
		@@ -117,9 +114,10 @@
117	114	add_action('wp_footer', array($Vipps,'footer'));
118	115	}
119	116	add_action( 'plugins_loaded', array($Vipps,'plugins_loaded'));
120	117	add_action( 'after_setup_theme', array($Vipps,'after_setup_theme'));
121		- add_action('init',array($Vipps,'init'));
	118	+ add_action( 'init',array($Vipps,'init'));
	119	+ add_action( 'rest_api_init', array($Vipps, 'rest_api_init'));
122	120	add_action( 'woocommerce_loaded', array($Vipps,'woocommerce_loaded'));
123	121	add_filter( 'woocommerce_available_payment_gateways', array($Vipps, 'payment_gateway_filter'));
124	122	add_action( 'woocommerce_blocks_loaded', [$Vipps, 'woocommerce_blocks_loaded']);
125	123	// Express Checkout and Checkout supports the new pickup_location shipping method, but the admin interface for this may
		@@ -227,8 +225,9 @@
227	225	// Register certain scripts in wp_loaded because they will be added to the backend as well - the gutenberg checkout block
228	226	// needs these to be defined in the backend. IOK 2024-04-16
229	227	add_action('wp_loaded', array($this, 'wp_register_scripts'));
230	228	add_action('wp_enqueue_scripts', array($this, 'wp_enqueue_scripts'));
	229	+ add_action('wp_enqueue_scripts', array($this, 'enqueue_classic_checkout_scripts'), 20);
231	230
232	231	// Remove the possibility of restarting failed orders etc. This will be fixed in the future. IOK 2023-05-26
233	232	add_filter('woocommerce_my_account_my_orders_actions', array($this,'woocommerce_my_account_my_orders_actions'), 10, 2);
234	233
		@@ -244,16 +243,8 @@
244	243
245	244	// Extra order actions on the order screen, now using ajax to be compatible with HPOS. IOK 2022-12-02
246	245	add_action('wp_ajax_woo_vipps_order_action', array($this, 'order_handle_vipps_action'));
247	246
248		- // Fetch wc products, but filter those only purchasable by VMP express checkout. LP 2026-01-22
249		- add_action('rest_api_init', function() {
250		- register_rest_route(self::get_rest_namespace('v1'), '/express-products', [
251		- 'methods' => 'GET',
252		- 'callback' => [$this, 'rest_express_checkout_products'],
253		- 'permission_callback' => '__return_true',
254		- ]);
255		- });
256	247
257	248	// We need a 5-minute scheduled event for the handler for missed callbacks. Using the
258	249	// action scheduler would be better, but we can't do that just yet because of backwards
259	250	// compatibility. At some point, support for older woo-versions should be dropped; then this
		@@ -276,15 +267,8 @@
276	267	// because it is self-updating or because it has been deactivated just now or something, we won't have access to it.
277	268	// Therefore test it first. IOK 2022-12-08
278	269	$gw = $this->gateway();
279	270
280		- // This is a developer-mode level feature because flock() is not portable. This ensures callbacks and shopreturns do not
281		- // simultaneously update the orders, in particular not the express checkout order lines wrt shipping. IOK 2020-05-19
282		- if ($gw && $gw->get_option('use_flock') == 'yes') {
283		- add_filter('woo_vipps_lock_order', array($this,'flock_lock_order'));
284		- add_action('woo_vipps_unlock_order', array($this, 'flock_unlock_order'));
285		- }
286		-
287	271	// Set default button options, migrating any older setup IOK 2026-07-15
288	272	$this->init_button_options();
289	273
290	274	/*
		@@ -314,9 +298,32 @@
314	298	add_action('woo_vipps_before_handling_special_page', array($this, 'pre_special_page_actions'));
315	299
316	300	// Add an admin interface for this page as well IOK 2026-09-11
317	301	add_action('woocommerce_settings_pages', array($this, 'woocommerce_settings_pages'));
	302	+ }
318	303
	304	+
	305	+ public function rest_api_init () {
	306	+
	307	+ // Fetch wc products, but filter those only purchasable by VMP express checkout. LP 2026-01-22
	308	+ register_rest_route(self::get_rest_namespace('v1'), '/express-products', [
	309	+ 'methods' => 'GET',
	310	+ 'callback' => [$this, 'rest_express_checkout_products'],
	311	+ 'permission_callback' => '__return_true',
	312	+ ]);
	313	+
	314	+ // Start a single product express checkout process. IOK 2026-08-25
	315	+ register_rest_route(self::get_rest_namespace('v1'), '/express_checkout_single', [
	316	+ 'methods' => 'POST',
	317	+ 'callback' => [$this, 'rest_do_single_product_express_checkout'],
	318	+ 'permission_callback' => '__return_true',
	319	+ ]);
	320	+ // And one for the cart. IOK 2026-09-04
	321	+ register_rest_route(self::get_rest_namespace('v1'), '/express_checkout', [
	322	+ 'methods' => 'POST',
	323	+ 'callback' => [$this, 'rest_do_express_checkout'],
	324	+ 'permission_callback' => '__return_true',
	325	+ ]);
319	326	}
320	327
321	328	public function admin_init () {
322	329	$gw = $this->gateway();
		@@ -345,10 +352,8 @@
345	352	// Styling etc
346	353	add_action('admin_head', array($this, 'admin_head'));
347	354
348	355	// Scripts
349		- $this->vippsJSConfig['vippssecnonce'] = wp_create_nonce('vippssecnonce');
350		- wp_localize_script('vipps-gw', 'VippsConfig', $this->vippsJSConfig);
351	356	add_action('admin_enqueue_scripts', array($this,'admin_enqueue_scripts'));
352	357
353	358	// IOK 2026-05-26 redirect the old Woo-generated settings-screen to our own settings page.
354	359	add_action('current_screen', function ($screen) {
		@@ -1086,8 +1091,10 @@
1086	1091	// Don't support these login verbs. LP 2026-06-04
1087	1092	if (in_array($attrs['verb'], ['login', 'register'])) $attrs['verb'] = 'buy';
1088	1093	// Looks like button and badge web components now use 'da' instead of 'dk' for danish. LP 2026-08-11
1089	1094	if ('dk' === $attrs['language']) $attrs['language'] = 'da';
	1095	+ // Fix swedish too. LP 2026-10-06
	1096	+ if ('se' === $attrs['language']) $attrs['language'] = 'sv';
1090	1097
1091	1098	$escaped_attrs = [];
1092	1099	foreach($attrs as $k => $v) {
1093	1100	$escaped_attrs[$k] = esc_attr($v);
		@@ -1694,12 +1701,14 @@
1694	1701	<?php
1695	1702	}
1696	1703	// Scripts used in the backend
1697	1704	public function admin_enqueue_scripts($hook) {
	1705	+
	1706	+ wp_register_script('vipps-admin',plugins_url('js/admin.js',__FILE__),array('jquery'),filemtime(dirname(__FILE__) . "/js/admin.js"), 'all');
	1707	+ $this->vippsJSConfig['vippssecnonce'] = wp_create_nonce('vippssecnonce');
	1708	+ wp_localize_script('vipps-admin', 'VippsConfig', $this->vippsJSConfig);
1698	1709	// Add certain translations very late so translation plugins get a chance to work. IOK 2026-02-02
1699		- $this->script_add_vippslocale();
1700		-
1701		- wp_register_script('vipps-admin',plugins_url('js/admin.js',__FILE__),array('jquery','vipps-gw'),filemtime(dirname(__FILE__) . "/js/admin.js"), 'all');
	1710	+ $this->script_add_vippslocale('vipps-admin');
1702	1711	wp_enqueue_script('vipps-admin');
1703	1712
1704	1713	wp_enqueue_style('vipps-admin-style',plugins_url('css/admin.css',__FILE__),array(),filemtime(dirname(__FILE__) . "/css/admin.css"), 'all');
1705	1714	wp_enqueue_style('vipps-fonts');
		@@ -1769,12 +1778,9 @@
1769	1778
1770	1779	public function wp_register_scripts () {
1771	1780	// We are going to use the 'hooks' library introduced by WP 5.1, but we still support WP 4.7. So if this isn't enqueues
1772	1781	// (which it only is if Gutenberg is active) or not provided at all, add it now.
1773		- if (!wp_script_is( 'wp-hooks', 'registered')) {
1774		- wp_register_script('wp-hooks', plugins_url('/compat/hooks.min.js', __FILE__));
1775		- }
1776		- wp_register_script('vipps-gw',plugins_url('js/vipps.js',__FILE__),array('jquery','wp-hooks'),filemtime(dirname(__FILE__) . "/js/vipps.js"), 'true');
	1782	+ wp_register_script('vipps-gw',plugins_url('js/vipps.js',__FILE__),array('jquery','wp-hooks', 'wp-api-fetch','vipps-widget-sdk'),filemtime(dirname(__FILE__) . "/js/vipps.js"), true);
1777	1783
1778	1784	// Badges - web components provided by Vipps MobilePay to display payment options in-store.
1779	1785	wp_register_script('vipps-onsite-messageing',
1780	1786	plugins_url('js/vipps-on-site-messaging.js', WC_VIPPS_PAYMENT_MAIN_FILE),
		@@ -1780,13 +1786,27 @@
1780	1786	plugins_url('js/vipps-on-site-messaging.js', WC_VIPPS_PAYMENT_MAIN_FILE),
1781	1787	array(),
1782	1788	filemtime(dirname(WC_VIPPS_PAYMENT_MAIN_FILE) . '/js/vipps-on-site-messaging.js'),
1783	1789	[
1784		- 'in_footer' => true,
1785		- 'strategy' => 'async',
	1790	+ 'in_footer' => true,
	1791	+ 'strategy' => 'async',
1786	1792	],
1787	1793	);
1788	1794
	1795	+ add_filter( 'script_loader_tag', function($tag, $handle,$src) {
	1796	+ if ($handle == 'vipps-widget-sdk') {
	1797	+ $tag = preg_replace("!^<script!", "<script data-vipps-widget-sdk ", $tag);
	1798	+ return $tag;
	1799	+ }
	1800	+ return $tag;
	1801	+ },10,3);
	1802	+
	1803	+ wp_register_script('vipps-widget-sdk', "https://cdn.vippsmobilepay.com/js/widget-sdk/vipps-widget.js",
	1804	+ array('vipps-button-webcomponent'),
	1805	+ filemtime(dirname(WC_VIPPS_PAYMENT_MAIN_FILE) . '/js/vipps.js'),
	1806	+ ['in_footer' => true]
	1807	+ );
	1808	+
1789	1809	// Button web component downloaded from https://cdn.vippsmobilepay.com/js/button/button.js. LP 2026-06-24
1790	1810	wp_register_script('vipps-button-webcomponent',
1791	1811	plugins_url('js/vipps-button.js', WC_VIPPS_PAYMENT_MAIN_FILE),
1792	1812	array(),
		@@ -1792,27 +1812,45 @@
1792	1812	array(),
1793	1813	filemtime(dirname(WC_VIPPS_PAYMENT_MAIN_FILE) . '/js/vipps-button.js'),
1794	1814	[
1795	1815	'in_footer' => false
1796		- ],
	1816	+ ]
1797	1817	);
1798	1818	}
1799	1819
1800	1820	// Runs late in both wp_enqueue_scripts and admin_enqueue_scripts to make it more compatible with translation plugins IOK 2026-02-02
1801		- public function script_add_vippslocale () {
	1821	+ public function script_add_vippslocale ($handle) {
1802	1822	// This is actually for the payment block, where localize script has started to not-work in certain contexts. IOK 2022-12-13
	1823	+ $name = $this->get_payment_method_name();
1803	1824	$strings = array(
1804		- 'Continue with Vipps'=>sprintf(__('Continue with %1$s', 'woo-vipps'), $this->get_payment_method_name()),
1805		- 'Vipps'=> sprintf(__('%1$s', 'woo-vipps'), $this->get_payment_method_name()),
1806		- 'pay_with_card' => sprintf(__('Pay with card through %1$s', 'woo-vipps'), $this->get_payment_method_name()),
	1825	+ 'Continue with Vipps'=>sprintf(__('Continue with %1$s', 'woo-vipps'), $name),
	1826	+ 'Vipps'=> sprintf(__('%1$s', 'woo-vipps'), $name),
	1827	+ 'pay_with_card' => sprintf(__('Pay with card through %1$s', 'woo-vipps'), $name),
	1828	+ 'termsAndConditionsError' => __( 'Please read and accept the terms and conditions to proceed with your order.', 'woocommerce' ),
	1829	+ 'temporaryError' => sprintf(__('%1$s is temporarily unavailable.','woo-vipps'),$name),
	1830	+ 'successMessage' => sprintf(__('To the %1$s app!','woo-vipps'), $name),
	1831	+ 'cancel'=> __("Cancel", 'woo-vipps'),
	1832	+ 'close'=> __("Close", 'woo-vipps'),
	1833	+ 'missingPaymentUrl'=> __("Successful checkout response has no payment URL", 'woo-vipps'),
	1834	+ 'expressCheckoutFailed'=> __("Express checkout failed", 'woo-vipps'),
	1835	+ 'unexpectedCheckoutResponse'=> __("Unexpected express checkout response", 'woo-vipps'),
	1836	+ 'vippsCheckoutFailed'=> __("Vipps Mobilepay checkout failed", 'woo-vipps'),
	1837	+ 'correctHighlightedFields'=> __("Please correct the highlighted fields.", 'woo-vipps'),
	1838	+ 'checkFormBeforeContinuing'=> __("Please check the form before continuing.", 'woo-vipps'),
	1839	+ 'cartCheckoutUnavailable'=> __("Cannot start express checkout: cart checkout is unavailable", 'woo-vipps'),
	1840	+ 'productIdentifiersMissing'=> __("Cannot buy product: product id, variation id and sku are missing", 'woo-vipps'),
	1841	+ 'productFormNotFound'=> __("Cannot buy product: product form not found", 'woo-vipps'),
	1842	+ 'paymentSuccessfulRedirecting' => __("Payment successful. Redirecting…", 'woo-vipps'),
1807	1843	);
1808		- wp_localize_script('vipps-gw', 'VippsLocale', $strings);
	1844	+ wp_localize_script($handle, 'VippsLocale', $strings);
1809	1845	}
1810	1846
1811	1847	public function wp_enqueue_scripts() {
	1848	+ // Add late: if this value isn't 'yes' we wil not add order attribution to express orders. IOK 2026-09-10
	1849	+ $this->vippsJSConfig['expressOrderAttribution'] = $this->gateway()->get_option('vippsorderattribution');
1812	1850	wp_localize_script('vipps-gw', 'VippsConfig', $this->vippsJSConfig);
1813	1851	// Add certain translations very late so translation plugins get a chance to work. IOK 2026-02-02
1814		- $this->script_add_vippslocale();
	1852	+ $this->script_add_vippslocale('vipps-gw');
1815	1853
1816	1854	wp_enqueue_script('vipps-gw');
1817	1855	wp_enqueue_style('vipps-gw',plugins_url('css/vipps.css',__FILE__),array(),filemtime(dirname(__FILE__) . "/css/vipps.css"));
1818	1856	wp_enqueue_script('vipps-button-webcomponent');
		@@ -1817,13 +1855,55 @@
1817	1855	wp_enqueue_style('vipps-gw',plugins_url('css/vipps.css',__FILE__),array(),filemtime(dirname(__FILE__) . "/css/vipps.css"));
1818	1856	wp_enqueue_script('vipps-button-webcomponent');
1819	1857	}
1820	1858
	1859	+ // These scripts should be loaded only on the checkout screen and is used only for the classic shortcode checkout and
	1860	+ // the pay-for-order screen. IOK 2026-09-15
	1861	+ public function enqueue_classic_checkout_scripts () {
	1862	+ if ( ! function_exists( 'is_checkout' ) || ! is_checkout() || is_order_received_page() ) {
	1863	+ return;
	1864	+ }
	1865	+ // Order-pay is rendered by the classic form even with a Blocks checkout page.
	1866	+ // It must bypass the check for the parent checkout page's block content.
	1867	+ if ( ! is_checkout_pay_page() ) {
	1868	+ $utils = '\\Automattic\\WooCommerce\\Blocks\\Utils\\CartCheckoutUtils';
	1869	+ $uses_checkout_block = is_callable( array( $utils, 'is_checkout_block_default' ) )
	1870	+ ? $utils::is_checkout_block_default()
	1871	+ : has_block( 'woocommerce/checkout', wc_get_page_id( 'checkout' ) );
1821	1872
	1873	+ if ( $uses_checkout_block ) {
	1874	+ return;
	1875	+ }
	1876	+ }
	1877	+
	1878	+ // This script uses jQuery because the classic checkout screen does too. IOK 2026-09-15
	1879	+ $relative_path = 'js/vipps-classic-checkout.js';
	1880	+ wp_enqueue_script(
	1881	+ 'vipps-classic-checkout',
	1882	+ plugins_url( $relative_path, __FILE__ ),
	1883	+ array( 'jquery', 'wc-checkout', 'vipps-gw' ),
	1884	+ filemtime( plugin_dir_path( __FILE__ ) . $relative_path ),
	1885	+ true
	1886	+ );
	1887	+
	1888	+ if ( is_checkout_pay_page() ) {
	1889	+ $order = wc_get_order( absint( get_query_var( 'order-pay' ) ) );
	1890	+ wp_add_inline_script( 'vipps-classic-checkout', 'window.VippsOrderPayConfig = ' . wp_json_encode( array(
	1891	+ 'orderId' => $order ? $order->get_id() : 0,
	1892	+ 'orderKey' => $order ? $order->get_order_key() : '',
	1893	+ 'billingEmail' => $order ? $order->get_billing_email() : '',
	1894	+ 'endpoint' => $order ? rest_url( 'wc/store/v1/checkout/' . $order->get_id() ) : '',
	1895	+ 'nonce' => wp_create_nonce( 'wc_store_api' ),
	1896	+ 'billingAddress' => $order ? $order->get_address( 'billing' ) : array(),
	1897	+ 'shippingAddress' => $order ? $order->get_address( 'shipping' ) : array(),
	1898	+ ) ) . ';', 'before' );
	1899	+ }
	1900	+ }
	1901	+
	1902	+
1822	1903	public function add_shortcodes() {
1823	1904	add_shortcode('woo_vipps_buy_now', array($this, 'buy_now_button_shortcode'));
1824	1905	add_shortcode('woo_vipps_express_checkout_button', array($this, 'express_checkout_button_shortcode'));
1825		- add_shortcode('woo_vipps_express_checkout_banner', array($this, 'express_checkout_banner_shortcode'));
1826	1906
1827	1907	// Badges, if using shortcodes
1828	1908	// New vipps-mobilepay-badge shortcode. LP 19.11.2024
1829	1909	add_shortcode('vipps-mobilepay-badge', array($this, 'vipps_mobilepay_badge_shortcode'));
		@@ -1869,58 +1949,14 @@
1869	1949	public function express_checkout_section_html() {
1870	1950	$payment_method = $this->get_payment_method_name();
1871	1951	$header_text = __('Express Checkout', 'woo-vipps');
1872	1952	$header = "<legend class='express-header'>$header_text</legend>";
1873		- $div_classes = "legacy-checkout vipps-express-checkout $payment_method";
	1953	+ $div_classes = "legacy-checkout express $payment_method";
1874	1954	echo "<fieldset class='$div_classes'>$header";
1875	1955	$this->checkout_express_checkout_button_html();
1876	1956	echo '</fieldset>';
1877	1957	}
1878	1958
1879		- public function express_checkout_banner() {
1880		- $gw = $this->gateway();
1881		- if (!$gw->show_express_checkout()) return;
1882		- return $this->express_checkout_banner_html();
1883		- }
1884		-
1885		- public function express_checkout_banner_html() {
1886		- $url = $this->express_checkout_url();
1887		- $url = wp_nonce_url($url,'express','sec');
1888		- $text = __('Skip entering your address and just checkout using', 'woo-vipps');
1889		- $linktext = 'Express'; // dont translate. LP 2025-09-03
1890		- $logo = $this->get_express_banner_logo();
1891		- $payment_method = $this->get_payment_method_name();
1892		-
1893		- $img_classes = 'express-banner-logo inline negative ' . strtolower($payment_method) . '-logo';
1894		- $div_classes = 'woocommerce-info ' . strtolower($payment_method) . '-info';
1895		- $a_classes = 'express-banner-link ' . strtolower($payment_method) . '-link';
1896		-
1897		- $message = $text . "<a href='$url' class='$a_classes'><img class='$img_classes' border=0 src='$logo' alt='$payment_method'/>$linktext!</a>";
1898		- $message = apply_filters('woo_vipps_express_checkout_banner', $message, $url, $payment_method);
1899		- ?>
1900		- <div class="<?php echo $div_classes;?>"><?php echo $message;?></div>
1901		- <?php
1902		- }
1903		-
1904		- public function checkout_express_checkout_button() {
1905		- $gw = $this->gateway();
1906		-
1907		- if ($gw->show_express_checkout()){
1908		- return $this->checkout_express_checkout_button_html();
1909		- }
1910		- }
1911		-
1912		- public function checkout_express_checkout_button_html() {
1913		- $url = $this->express_checkout_url();
1914		- $url = wp_nonce_url($url,'express','sec');
1915		- $button= apply_filters('woo_vipps_express_checkout_button', $this->get_html_button_for_context('checkout'));
1916		- $method = $this->get_payment_method_name();
1917		- $title = sprintf(__('Buy now with %1$s!', 'woo-vipps'), $method);
1918		- $html = "<a href='$url' class='vipps-express-checkout short $method' title='$title'>$button</a>";
1919		- $html = apply_filters('woo_vipps_cart_express_checkout_button', $html, $url);
1920		- echo $html;
1921		- }
1922		-
1923	1959	// Show the express button if reasonable to do so
1924	1960	public function cart_express_checkout_button() {
1925	1961	$gw = $this->gateway();
1926	1962
		@@ -1936,19 +1972,38 @@
1936	1972	return $this->cart_express_checkout_button_html('minicart');
1937	1973	}
1938	1974	}
1939	1975
	1976	+ // This is for the Vipps SDK button used instead of the normal "pay for order" and "confirm order" buttons
	1977	+ // on the classic checkout and pay-for-order pages. It gets swapped in when the user selects vipps, and swapped out otherwise.
	1978	+ public function add_checkout_button_for_classic () {
	1979	+ $button = $this->get_html_button_for_context('checkout');
	1980	+ $submit = "<div class='vipps-classic-checkout-container'><button id='vipps-classic-checkout-submit' class='hidden vipps-submit-wrapper' type='submit'>$button</button></div>";
	1981	+ echo $submit;
	1982	+ }
	1983	+
1940	1984	public function cart_express_checkout_button_html($context= 'cart') {
1941		- $url = $this->express_checkout_url();
1942		- $url = wp_nonce_url($url,'express','sec');
1943		- $button= apply_filters('woo_vipps_express_checkout_button', $this->get_html_button_for_context($context));
	1985	+ $button = apply_filters('woo_vipps_express_checkout_button', $this->get_html_button_for_context($context));
1944	1986	$method = $this->get_payment_method_name();
1945	1987	$title = sprintf(__('Buy now with %1$s!', 'woo-vipps'), $method);
1946		- $html = "<a href='$url' class='vipps-express-checkout short $method' title='$title'>$button</a>";
	1988	+ $url = "#";
	1989	+ $sec = wp_create_nonce('express');
	1990	+ $html = "<a href='#' class='vipps-express-checkout short " . esc_attr($method) . "' title='" . esc_attr($title) . "' data-sec='" . esc_attr($sec) . "'>$button</a>";
1947	1991	$html = apply_filters('woo_vipps_cart_express_checkout_button', $html, $url);
1948	1992	echo $html;
1949	1993	}
1950	1994
	1995	+ public function checkout_express_checkout_button_html() {
	1996	+ $button = apply_filters('woo_vipps_express_checkout_button', $this->get_html_button_for_context('checkout'));
	1997	+ $method = $this->get_payment_method_name();
	1998	+ $title = sprintf(__('Buy now with %1$s!', 'woo-vipps'), $method);
	1999	+ $url = "#";
	2000	+ $sec = wp_create_nonce('express');
	2001	+ $html = "<a href='#' class='vipps-express-checkout short " . esc_attr($method) . "' title='" . esc_attr($title) . "' data-sec='" . esc_attr($sec) . "'>$button</a>";
	2002	+ $html = apply_filters('woo_vipps_cart_express_checkout_button', $html, $url);
	2003	+ echo $html;
	2004	+ }
	2005	+
1951	2006	// A shortcode for a single buy now button. Express checkout must be active; but I don't check for this here, as this button may be
1952	2007	// cached. Therefore stock, purchasability etc will be done later. IOK 2018-10-02
1953	2008	public function buy_now_button_shortcode ($atts) {
1954	2009	// The new web component button args. LP 2026-07-02
		@@ -1986,16 +2041,8 @@
1986	2041	ob_start();
1987	2042	$this->cart_express_checkout_button_html('cart');
1988	2043	return ob_get_clean();
1989	2044	}
1990		- // Show a banner normally shown for non-logged-in-users at the checkout page. It does not need to check if we are to show the button, obviously, but needs to see if the cart works
1991		- public function express_checkout_banner_shortcode() {
1992		- $gw = $this->gateway();
1993		- if (!$gw->cart_supports_express_checkout()) return;
1994		- ob_start();
1995		- $this->express_checkout_banner_html();
1996		- return ob_get_clean();
1997		- }
1998	2045
1999	2046	// Manage the various product meta fields
2000	2047	public function process_product_meta ($id, $post) {
2001	2048	// This is for the 'buy now' button
		@@ -2521,82 +2568,9 @@
2521	2568	if ($ok) return $callbackdir;
2522	2569	return null;
2523	2570	}
2524	2571
2525		- // Unfortunately, we cannot do any form of portable locking, and we may get callbacks from Vipps arriving at the same moment as we check the status at Vipps,
2526		- // which in the very worst case, for Express Checkout orders, may lead to a double shipping line. Changing this to a queue system is non-trivial, because some of
2527		- // the operations done when modifying the order actually requires the customers session to be active. This operation will make conflicts a litte less probable
2528		- // by implementing something that isn't quite a lock, and the filter may be used to implement proper locking, using e.g. flock, where this can be used
2529		- // (non-distributed environments using unix on standard filesystems. IOK 2020-05-15
2530		- // Returns true if lock succeeds, or false.
2531		- public function lockOrder($order) {
2532		- $orderid = $order->get_id();
2533		- if (has_filter('woo_vipps_lock_order')) {
2534		- $ok = apply_filters('woo_vipps_lock_order', $order);
2535		- if (!$ok) return false;
2536		- } else {
2537		- if(get_transient('order_lock_'.$orderid)) return false;
2538		- $this->lockKey = uniqid();
2539		- set_transient('order_lock_' . $orderid, $this->lockKey, 30);
2540		- }
2541		- add_action('shutdown', function () use ($order) { global $Vipps; $Vipps->unlockOrder($order); });
2542		- return true;
2543		- }
2544		- // If the order is locked, it means it is in the process of being finalized, so for instance, we do *not* want to abandon it
2545		- // in checkout.
2546		- public function isLocked ($order) {
2547		- $orderid = $order->get_id();
2548		- $locked = get_transient('order_lock_'.$orderid);
2549		- return apply_filters('woo_vipps_order_locked', $locked, $order);
2550		- }
2551		- public function unlockOrder($order) {
2552		- $orderid = $order->get_id();
2553		- if (has_action('woo_vipps_unlock_order')) {
2554		- do_action('woo_vipps_unlock_order', $order);
2555		- } else {
2556		- if(get_transient('order_lock_'.$orderid) == $this->lockKey) {
2557		- delete_transient('order_lock_'.$orderid);
2558		- }
2559		- }
2560		- }
2561	2572
2562		- // Functions using flock() and files to lock orders. This is only guaranteed to work on certain setups, ie, non-distributed setups
2563		- // using Unix with normal filesystems (not NFS).
2564		- public function flock_lock_order($order) {
2565		- global $_orderlocks;
2566		- if (!$_orderlocks) $_orderlocks = array();
2567		- $dir = $this->callbackDir();
2568		- if (!$dir) {
2569		- $this->log(__("Cannot use flock() to lock orders: cannot create or write to directory", "woo-vipps"), 'error');
2570		- return true;
2571		- }
2572		- $fname = '.ht-vipps-lock-'.md5($order->get_order_key() . $order->get_meta('_vipps_transaction'));
2573		- $path = $dir . DIRECTORY_SEPARATOR . $fname;
2574		- touch($path);
2575		- if (!is_writable($path)) {
2576		- $this->log(__("Cannot use flock() to lock orders: cannot create lockfiles ", "woo-vipps"), 'error');
2577		- return true;
2578		- }
2579		- $handle = fopen($path, 'w+');
2580		- if (flock($handle, LOCK_EX | LOCK_NB)) {
2581		- $_orderlocks[$order->get_id()] = array($handle,$path);
2582		- return true;
2583		- }
2584		- return false;
2585		- }
2586		- public function flock_unlock_order($order) {
2587		- $orderid=$order->get_id();
2588		- global $_orderlocks;
2589		- if (!$_orderlocks) return;
2590		- if (!isset($_orderlocks[$orderid])) return;
2591		- list($handle, $path) = $_orderlocks[$orderid];
2592		- unset($_orderlocks[$orderid]);
2593		- flock($handle, LOCK_UN);
2594		- fclose($handle);
2595		- @unlink($path);
2596		- }
2597		-
2598		-
2599	2573	// Because the prefix used to create the Vipps order id is editable
2600	2574	// by the user, we will store that as a meta and use this for callbacks etc.
2601	2575	// IOK 2023-01-23 this function is no longer used, and kept only for backwards compatibility with
2602	2576	// debug filters and similar.
		@@ -2685,11 +2659,17 @@
2685	2659	// Some validation is required for this action
2686	2660	if ($action == 'do_express_checkout') {
2687	2661	$this->vipps_express_checkout_consistency_check();
2688	2662	}
	2663	+ // These two actions require an extra script
	2664	+ if (in_array($action, ['buy_product','do_express_checkout'])) {
	2665	+ wp_enqueue_script('vipps-purchase', plugins_url('js/vipps-purchase.js',__FILE__), ['vipps-gw'],
	2666	+ filemtime(dirname(__FILE__) . "/js/vipps-purchase.js"),
	2667	+ ['in_footer'=>true]
	2668	+ );
	2669	+ }
2689	2670	}
2690	2671
2691		-
2692	2672	// Dynamic special page title depending on endpoint/action, only frontend. LP 2026-09-02
2693	2673	public function vipps_special_page_endpoint_title($title, $postid = 0) {
2694	2674	global $wp_query;
2695	2675	// Comment from woocommerce's wc_page_endpoint_title where this logic is from: LP 2026-09-02
		@@ -2838,8 +2818,12 @@
2838	2818
2839	2819	add_action('woocommerce_after_add_to_cart_button', array($this, 'single_product_buy_now_button'));
2840	2820	add_action('woocommerce_after_shop_loop_item', array($this, 'loop_single_product_buy_now_button'), 20);
2841	2821
	2822	+ // For the classic checkout page and pay-for-order page, use a custom submit button when payment method
	2823	+ // is Vipps
	2824	+ add_action('woocommerce_review_order_after_submit', array($this, 'add_checkout_button_for_classic'));
	2825	+ add_action('woocommerce_pay_order_after_submit', array($this, 'add_checkout_button_for_classic'));
2842	2826
2843	2827	// Special pages and callbacks handled by template_redirect. IOK 2023-02-22
2844	2828	add_action('template_redirect', array($this,'template_redirect'),1);
2845	2829
		@@ -2849,21 +2833,8 @@
2849	2833	// Ajax endpoints for checking the order status while waiting for confirmation
2850	2834	add_action('wp_ajax_nopriv_check_order_status', array($this, 'ajax_check_order_status'));
2851	2835	add_action('wp_ajax_check_order_status', array($this, 'ajax_check_order_status'));
2852	2836
2853		-
2854		- // Buying a single product directly using express checkout IOK 2018-09-28
2855		- add_action('wp_ajax_nopriv_vipps_buy_single_product', array($this, 'ajax_vipps_buy_single_product'));
2856		- add_action('wp_ajax_vipps_buy_single_product', array($this, 'ajax_vipps_buy_single_product'));
2857		-
2858		- // This is for express checkout which we will also do asynchronously IOK 2018-05-28
2859		- add_action('wp_ajax_nopriv_do_express_checkout', array($this, 'ajax_do_express_checkout'));
2860		- add_action('wp_ajax_do_express_checkout', array($this, 'ajax_do_express_checkout'));
2861		-
2862		- // Same thing, but for single products IOK 2018-05-28
2863		- add_action('wp_ajax_nopriv_do_single_product_express_checkout', array($this, 'ajax_do_single_product_express_checkout'));
2864		- add_action('wp_ajax_do_single_product_express_checkout', array($this, 'ajax_do_single_product_express_checkout'));
2865		-
2866	2837	// Handle the cancel unpaid order action when the "hold stock" times out.
2867	2838	// For *normal* vipps orders, we run another cronjob every 5. minute which checks order status,
2868	2839	// therefore here it suffices to check if the order is 'cancelled' at Vipps, and if so we return.
2869	2840	// For Checkout the rules are different though.
		@@ -2942,9 +2913,8 @@
2942	2913	$this->vippsJSConfig = array();
2943	2914	$this->vippsJSConfig['vippsajaxurl'] = admin_url('admin-ajax.php');
2944	2915	$this->vippsJSConfig['BuyNowWith'] = __('Buy now with', 'woo-vipps');
2945	2916	$this->vippsJSConfig['BuyNowWithVipps'] = sprintf(__('Buy now with %1$s', 'woo-vipps'), $this->get_payment_method_name());
2946		- $this->vippsJSConfig['vippslogourl'] = plugins_url('img/vipps_logo_negativ_rgb_transparent.png',__FILE__);
2947	2917	$this->vippsJSConfig['vippssmileurl'] = plugins_url('img/vmp-logo.png',__FILE__);
2948	2918	$this->vippsJSConfig['vippsbuynowbutton'] = sprintf(__( '%1$s Buy Now button', 'woo-vipps' ), $this->get_payment_method_name());
2949	2919	$this->vippsJSConfig['vippsbuynowdescription'] = sprintf(__( 'Add a %1$s Buy Now-button to the product block or choose a product manually', 'woo-vipps'), $this->get_payment_method_name());
2950	2920	$this->vippsJSConfig['vippslanguage'] = $this->get_customer_language();
		@@ -2949,10 +2919,17 @@
2949	2919	$this->vippsJSConfig['vippsbuynowdescription'] = sprintf(__( 'Add a %1$s Buy Now-button to the product block or choose a product manually', 'woo-vipps'), $this->get_payment_method_name());
2950	2920	$this->vippsJSConfig['vippslanguage'] = $this->get_customer_language();
2951	2921	$this->vippsJSConfig['vippslocale'] = get_locale();
2952	2922	$this->vippsJSConfig['vippsexpressbuttonurl'] = $this->get_payment_method_name();
2953		-
	2923	+ $this->vippsJSConfig['paymentMethodSlug'] = sanitize_title($this->get_payment_method_name());
	2924	+ $this->vippsJSConfig['paymentMethodName'] = $this->get_payment_method_name();
	2925	+ $wc_lang = $this->get_html_button_attrs_for_context()['language'];
	2926	+ if ('store' === $wc_lang) $wc_lang = $this->get_customer_language();
	2927	+ // Looks like button and badge web components now use 'da' instead of 'dk' for danish. LP 2026-08-11
	2928	+ if ('dk' === $wc_lang) $wc_lang = 'da';
	2929	+ $this->vippsJSConfig['webcomponentLanguage'] = $wc_lang;
2954	2930
	2931	+
2955	2932	// If the site supports Gutenberg Blocks, support the Checkout block IOK 2020-08-10
2956	2933	if (class_exists('Automattic\WooCommerce\Blocks\Payments\Integrations\AbstractPaymentMethodType')) {
2957	2934	// Ensure gateways are loaded at this point IOK 2026-05-27
2958	2935	require_once(dirname(__FILE__) . '/WC_Gateway_VippsCard.class.php');
		@@ -3824,9 +3801,9 @@
3824	3801	$shipping_method = $methodclass ? new $methodclass($rate->get_instance_id()) : null;
3825	3802
3826	3803	$tax = $rate->get_shipping_tax() ?: 0;
3827	3804	$cost = $rate->get_cost() ?: 0;
3828		- $label = $rate->get_label();
	3805	+ $label = html_entity_decode($rate->get_label());
3829	3806
3830	3807	if ($cost == 0 && ($methodid != 'local_pickup' && $methodid != 'pickup_location')) {
3831	3808	$has_free_shipping = true;
3832	3809	}
		@@ -3852,9 +3829,9 @@
3852	3829	$shippingcostB = sprintf("%.2F",wc_format_decimal($cost, '') + wc_format_decimal($tax,''));
3853	3830	$shippingcost = max($shippingcostA, $shippingcostB);
3854	3831
3855	3832	$vippsmethod['shippingCost'] = $shippingcost;
3856		- $vippsmethod['shippingMethod'] = $rate->get_label();
	3833	+ $vippsmethod['shippingMethod'] = html_entity_decode($rate->get_label());
3857	3834	$vippsmethod['shippingMethodId'] = $key;
3858	3835	$vippsmethods[]=$vippsmethod;
3859	3836
3860	3837	// Metadata and settings stored for later use for Checkout
		@@ -4199,9 +4176,9 @@
4199	4176	$tax = $rate->get_shipping_tax() ?: 0;
4200	4177	$cost = $rate->get_cost() ?: 0;
4201	4178
4202	4179	$method['shippingCost'] = sprintf("%.2F",wc_format_decimal($cost+$tax,''));
4203		- $method['shippingMethod'] = $rate->get_label();
	4180	+ $method['shippingMethod'] = html_entity_decode($rate->get_label());
4204	4181	// We may not really need the tax stashed here, but just to be sure.
4205	4182	$method['shippingMethodId'] = $rate->get_id() . ";" . $tax;
4206	4183	$methods[]= $method;
4207	4184
		@@ -4481,28 +4458,12 @@
4481	4458	$order = wc_get_order($order->get_id());
4482	4459	$order_status = $order->get_status();
4483	4460
4484	4461	if ($order_status != 'pending') return $order_status;
4485		- // No callback has occured yet. If this has been going on for a while, check directly with Vipps
4486		- // We can't use the vipps init timestamp here, because that may be in the past for Checkout at least. IOK 2025-08-13
4487		- if ($order_status == 'pending') {
4488		- if (WC()->session) {
4489		- $now = time();
4490		- $then = WC()->session->get('_vipps_check_' . $order->get_id());
4491		- if (!$then) {
4492		- $then = $now;
4493		- WC()->session->set('_vipps_check_' . $order->get_id(), $then);
4494		- }
4495		- if (($then + (1 * 30)) > $now) { // more than half a minute? Start checking at Vipps
4496		- return $order_status;
4497		- }
4498		- } else {
4499		- // No session shouldn't be possible, but if it is..
4500		- return $order_status;
4501		- }
4502		- }
	4462	+
	4463	+ $gw = $this->gateway();
4503	4464	$this->log("Checking order status on Vipps for order id: " . $order->get_id(), 'info');
4504		- return $this->check_status_of_pending_order($order);
	4465	+ $newstatus = $gw->poll_and_check_order_status($order);
4505	4466	}
4506	4467
4507	4468	// In some situations we have to empty the cart when the user goes to Vipps, so
4508	4469	// we store it in the session and restore it if the users cancels. IOK 2018-05-07
		@@ -4570,8 +4531,9 @@
4570	4531
4571	4532	// Maybe log in user
4572	4533	// It is done on the thank-you page of the order, and only for express checkout.
4573	4534	function maybe_log_in_user ($order) {
	4535	+
4574	4536	if (is_user_logged_in()) return;
4575	4537	if (!$order || ! self::is_vipps_order($order)) return;
4576	4538
4577	4539	// We *do* want to log in express checkout customers, but not those that
		@@ -4723,124 +4685,227 @@
4723	4685	$this->restore_cart($o);
4724	4686	}
4725	4687
4726	4688
4727		- public function ajax_vipps_buy_single_product () {
4728		- Vipps::nocache();
4729		- static::set_locale_if_in_header();
4730		- // We're not checking ajax referer here, because what we do is creating a session and redirecting to the
4731		- // 'create order' page wherein we'll do the actual work. IOK 2018-09-28
4732		- $session = WC()->session;
4733		- if (!$session->has_session()) {
4734		- $session->set_customer_session_cookie(true);
	4689	+ // Actually create a express checkout order object, with no shipping or personal information, returning information about
	4690	+ // the result. The order should at this point be in a/the cart. For single product purchases, this is a different cart than
	4691	+ // the main one; for cart purchases, it's just the WC()->cart object. IOK 2026-08-25
	4692	+ private function create_and_process_express_order() {
	4693	+ $result = null;
	4694	+ $gw = $this->gateway();
	4695	+ try {
	4696	+ $orderid = $gw->create_partial_order();
	4697	+ do_action('woo_vipps_ajax_do_express_checkout', $orderid);
	4698	+ } catch (Exception $e) {
	4699	+ $result = array('ok'=>0, 'orderid'=>0, 'msg'=>__('Could not create order','woo-vipps') . ': ' . $e->getMessage(), 'url'=>false);
	4700	+ return $result;
	4701	+ }
	4702	+ if (!$orderid) {
	4703	+ $result = array('ok'=>0, 'orderid'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
	4704	+ return $result;
4735	4705	}
4736		- $session->set('__vipps_buy_product', json_encode($_REQUEST));
4737	4706
4738		- // Incredibly, some caches will cache this page even with cookies set and no-cache headers set. So we try to
4739		- // add yet another way to inform caches that this is, in fact, not cacheable. IOK 2023-06-12
4740		- $url = add_query_arg('nc', sha1(uniqid(WC()->session->get_customer_id(),true)), $this->buy_product_url());
	4707	+ try {
	4708	+ $this->maybe_add_static_shipping($gw,$orderid);
	4709	+ } catch (Exception $e) {
	4710	+ $this->log(__("Error calculating static shipping", 'woo-vipps'), 'error');
	4711	+ $this->log($e->getMessage(),'error');
	4712	+ $result = array('ok'=>0, 'orderid'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
	4713	+ return $result;
	4714	+ }
4741	4715
4742		- $result = array('ok'=>1, 'msg'=>__('Processing order... ','woo-vipps'), 'url'=> $url);
4743		- wp_send_json($result);
4744		- exit();
	4716	+ // Now pass this to the Woo gateway and get a redirect URL back IOK 2026-08-25
	4717	+ $ok = $gw->process_payment($orderid);
	4718	+ if ($ok && $ok['result'] == 'success') {
	4719	+ $result = array('ok'=>1, 'orderid'=>$orderid, 'msg'=>'', 'url'=>$ok['redirect']);
	4720	+ return $result;
	4721	+ }
	4722	+ $result = array('ok'=>0, 'orderid'=>$orderid, 'msg'=> sprintf(__('%1$s is temporarily unavailable.','woo-vipps'), $this->get_payment_method_name()), 'url'=>'');
	4723	+ return $result;
4745	4724	}
4746	4725
4747		- public function ajax_do_express_checkout () {
4748		- check_ajax_referer('do_express','sec');
4749		- Vipps::nocache();
4750		- static::set_locale_if_in_header();
	4726	+ // This creates a simple hash for the 'current order' which we will store in the session if we proceed to checkout. We use this to
	4727	+ // avoid/warn the user of duplicate purchases. IOK 2026-09-09
	4728	+ public function create_order_hash($args=null) {
	4729	+ // If we have no arguments, we'll hash the cart.
	4730	+ if (empty($args)) {
	4731	+ $cartitems = WC()->cart->get_cart();
	4732	+ $orderspec = array();
	4733	+ foreach($cartitems as $item => $values) {
	4734	+ $orderspec[] = array('sku'=> ($values['sku'] ?? ""), 'product_id'=>($values['product_id'] ?? 0), 'variation_id'=>($values['variation_id'] ?? 0), 'quantity'=>($values['quantity'] ?? 1));
	4735	+ }
	4736	+ $args = $orderspec;
	4737	+ }
	4738	+ return md5(serialize($args));
	4739	+ }
	4740	+
	4741	+
	4742	+ // This method may provide HTML form elements to ask a user questions after starting
	4743	+ // express checkout. It is used to detect duplicate orders, possibly for terms and conditions, and user-definiable customizations. IOK 2026-09-09
	4744	+ // NULL productinfo means use the cart; the "current hash" is used to detect duplicates, and is calculated by the caller.
	4745	+ public function express_order_needs_confirmation($args, $productinfo, $current_hash) {
	4746	+ $elements = [];
	4747	+ $html = "";
	4748	+
	4749	+ // First, let's check if we need to confirm the purchase.
	4750	+ $last_express_purchase_hash = WC()->session->get('woo_vipps_last_express');
	4751	+ if ($last_express_purchase_hash) {
	4752	+ list($hash, $orderid, $stamp) = explode(":", $last_express_purchase_hash);
	4753	+ $cutoff = $stamp + apply_filters('woo_vipps_recent_order_cutoff', (3*60));
	4754	+ if ($hash == $current_hash && (time() <= $cutoff )) {
	4755	+ $order = wc_get_order($orderid);
	4756	+ $status = $order ? $order->get_status() : false;
	4757	+ // IOK TODO/FIXME actually, if the order is pending/failed/cancelled and *identical* to our current productinfo, we could plausibly do a restart here. Would probably require careful checking though, and
	4758	+ // a different flow. IOK 2026-09-17
	4759	+ if (in_array($status, ['on-hold', 'processing', 'completed'])) {
	4760	+ $header = __("Are you sure?",'woo-vipps');
	4761	+ $body = __("You recently completed an order with exactly the same products as you are buying now. There should be an email in your inbox from the previous purchase. Are you sure you want to order again?",'woo-vipps');
	4762	+ $elements['possible_duplicate'] = "<h1>$header</h1><p>$body</p>";
	4763	+ $this->log(__("It seems a customer is trying to re-order product(s) recently bought in the same session, asking user for confirmation", 'woo-vipps'), 'info');
	4764	+ }
	4765	+ }
	4766	+ }
	4767	+
4751	4768	$gw = $this->gateway();
	4769	+ $askForTerms = function_exists('wc_terms_and_conditions_checkbox_enabled') ? wc_terms_and_conditions_checkbox_enabled() : true;
	4770	+ $askForTerms = $askForTerms && ($gw->get_option('expresscheckout_termscheckbox') == 'yes');
	4771	+ $askForTerms = apply_filters('woo_vipps_express_checkout_terms_and_conditions_checkbox_enabled', $askForTerms);
4752	4772
4753		- if (!$gw->express_checkout_available() || !$gw->cart_supports_express_checkout()) {
4754		- $result = array('ok'=>0, 'msg'=>sprintf(__('%1$s is not available for this order','woo-vipps'), Vipps::ExpressCheckoutName()), 'url'=>false);
4755		- wp_send_json($result);
4756		- exit();
	4773	+ if ($askForTerms) {
	4774	+ $termsHTML = '';
	4775	+ // Include shop terms
	4776	+ ob_start();
	4777	+ wc_get_template('checkout/terms.php');
	4778	+ $termsHTML = ob_get_clean();
	4779	+ $termsHTML = apply_filters('woo_vipps_express_checkout_terms_and_conditions_html',$termsHTML);
	4780	+ $elements['terms'] = $termsHTML;
4757	4781	}
4758	4782
	4783	+ // Custom fields
	4784	+ ob_start();
	4785	+ do_action('woo_vipps_express_checkout_orderspec_form', $productinfo, $args);
	4786	+ $extra_fields = ob_get_clean();
	4787	+ if (!empty($extra_fields)) {
	4788	+ $elements['extra'] = $extra_fields;
	4789	+ }
4759	4790
4760		-
	4791	+ if (!empty($elements)) {
	4792	+ $html = join("\n", array_values($elements));
	4793	+ $msg = join(",", array_keys($elements));
	4794	+ return ['ok'=>2, 'msg'=>$msg, 'html'=>$html, 'url'=>''];
	4795	+ }
4761	4796
	4797	+ return false;
	4798	+
	4799	+ }
	4800	+
	4801	+ public function rest_do_express_checkout ($request) {
	4802	+ Vipps::nocache();
	4803	+ check_ajax_referer('express', 'sec');
	4804	+ static::set_locale_if_in_header();
	4805	+ $args = $request->get_json_params();
	4806	+ if (!$args) {
	4807	+ return new WP_Error('no_data', __('No data passed to express checkout', 'woo-vipps'), ['status' => 400]);
	4808	+ }
	4809	+
	4810	+ // Since this is the REST api, we need to load the cart manually here. IOK 2026-08-27
	4811	+ if ( is_null( WC()->cart ) ) {
	4812	+ WC()->frontend_includes();
	4813	+ if ( ! WC()->session instanceof WC_Session ) {
	4814	+ WC()->session = new WC_Session_Handler();
	4815	+ WC()->session->init();
	4816	+ }
	4817	+ if (is_null( WC()->customer)) {
	4818	+ WC()->customer = new WC_Customer( get_current_user_id(), true );
	4819	+ }
	4820	+ WC()->cart = new WC_Cart();
	4821	+ WC()->cart->get_cart_from_session();
	4822	+ }
	4823	+
	4824	+
	4825	+ $gw = $this->gateway();
	4826	+ if (!$gw->express_checkout_available() || !$gw->cart_supports_express_checkout()) {
	4827	+ $result = array('ok'=>0, 'msg'=>sprintf(__('%1$s is not available for this order','woo-vipps'), Vipps::ExpressCheckoutName()), 'url'=>false);
	4828	+ return $result;
	4829	+ }
4762	4830	// Validate cart going forward using same logic as WC_Cart->check_cart() but not adding notices.
4763	4831	$toolate = false;
4764	4832	$msg = "";
4765	4833	$valid = WC()->cart->check_cart_item_validity();
4766	4834	if ( is_wp_error( $valid) ) {
4767		- $toolate = true;
4768		- $msg = "<br>" . $valid->get_error_message();
	4835	+ $toolate = true;
	4836	+ $msg = "<br>" . $valid->get_error_message();
4769	4837	}
4770	4838	$stock = WC()->cart->check_cart_item_stock();
4771		- if ( is_wp_error( $stock) ) {
4772		- $toolate = true;
4773		- $msg = "<br>" . $stock->get_error_message();
4774		- }
	4839	+ if ( is_wp_error( $stock) ) {
	4840	+ $toolate = true;
	4841	+ $msg = "<br>" . $stock->get_error_message();
	4842	+ }
4775	4843
4776	4844	if ($toolate) {
4777	4845	$result = array('ok'=>0, 'msg'=>sprintf(__('Some of the products in your cart are no longer available in the quantities you have ordered. Please <a href="%1$s">edit your order</a> before continuing the checkout','woo-vipps'), wc_get_cart_url()) . $msg, 'url'=>false);
4778		- wp_send_json($result);
4779		- exit();
	4846	+ return $result;
4780	4847	}
4781	4848
4782		- try {
4783		- $orderid = $gw->create_partial_order();
4784		- do_action('woo_vipps_ajax_do_express_checkout', $orderid);
4785		- } catch (Exception $e) {
4786		- $this->log($e->getMessage(),'error');
4787		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps') . ': ' . $e->getMessage(), 'url'=>false);
4788		- wp_send_json($result);
4789		- exit();
4790		- }
4791		- if (!$orderid) {
4792		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
4793		- wp_send_json($result);
4794		- exit();
	4849	+ // Then the cookies. These would be the _ga and sbjs_ cookies typically, but we'll let users handle these themselves.
	4850	+ // These are passed as arguments from the javascript, since proxies are likely to strip them. This should allow
	4851	+ // systems like MonsterInsights that look for the _GA cookie to succeed. IOK 2026-08-30
	4852	+ $cookies = $args['cookies'] ?? [];
	4853	+ foreach($cookies as $key => $value) {
	4854	+ if (!isset($_COOKIE[$key])) {
	4855	+ $_COOKIE[$key] = $value;
	4856	+ }
4795	4857	}
	4858	+ // There might be extra values here now, which would typically have been posted as POST arguments, in a form.
	4859	+ // User-defined stuff and so on. We'll initiate the POST value with these to simulate this for backwards compatibility.
	4860	+ $others =$args['post'] ?? [];
	4861	+ foreach($args['post'] as $key=>$value) {
	4862	+ $_POST[$key] = $value;
	4863	+ }
4796	4864
4797		- try {
4798		- $this->maybe_add_static_shipping($gw,$orderid);
4799		- } catch (Exception $e) {
4800		- $this->log(__("Error calculating static shipping", 'woo-vipps'), 'error');
4801		- $this->log($e->getMessage(),'error');
4802		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
4803		- wp_send_json($result);
4804		- exit();
	4865	+ // Try to avoid re-purchasing the same order repeatedly. IOK 2026-09-02
	4866	+ $current_hash = $this->create_order_hash();
	4867	+ $confirmation = (bool) intval(($others['confirmed'] ?? 0));
	4868	+ if (!$confirmation) {
	4869	+ $result = $this->express_order_needs_confirmation($args, null, $current_hash);
	4870	+ if (!empty($result)) {
	4871	+ return $result;
	4872	+ }
4805	4873	}
4806		-
4807		- $ok = $gw->process_payment($orderid);
4808		- if ($ok && $ok['result'] == 'success') {
4809		- $result = array('ok'=>1, 'msg'=>'', 'url'=>$ok['redirect']);
4810		- wp_send_json($result);
4811		- exit();
	4874	+
	4875	+ $result = $this->create_and_process_express_order();
	4876	+ if ($result['ok'] == 1) {
	4877	+ $orderid = $result['orderid'];
	4878	+ WC()->session->set('woo_vipps_last_express', "$current_hash:$orderid:" . time());
	4879	+ WC()->session->save_data();
4812	4880	}
4813		- $result = array('ok'=>0, 'msg'=> sprintf(__('%1$s is temporarily unavailable.','woo-vipps'), $this->get_payment_method_name()), 'url'=>'');
4814		- wp_send_json($result);
4815		- exit();
	4881	+ return $result;
	4882	+
4816	4883	}
4817	4884
4818		- // Same as ajax_do_express_checkout, but for a single product/variation. Duplicate code because we want to manipulate the cart differently here. IOK 2018-09-25
4819		- public function ajax_do_single_product_express_checkout() {
4820		- check_ajax_referer('do_express','sec');
4821		- Vipps::nocache();
	4885	+
	4886	+ // Rest handler for single product express checkout. Expects arguments as JSON. IOK 2026-08-25
	4887	+ public function rest_do_single_product_express_checkout ($request) {
	4888	+ Vipps::nocache();
4822	4889	static::set_locale_if_in_header();
4823		- require_once(dirname(__FILE__) . "/WC_Gateway_Vipps.class.php");
4824		- $gw = $this->gateway();
4825		-
4826		- if (!$gw->express_checkout_available()) {
4827		- $result = array('ok'=>0, 'msg'=>sprintf(__('%1$s is not available for this order','woo-vipps'), Vipps::ExpressCheckoutName()), 'url'=>false);
4828		- wp_send_json($result);
4829		- exit();
	4890	+ $args = $request->get_json_params();
	4891	+ if (!$args) {
	4892	+ return new WP_Error('no_data', __('No data passed to express checkout', 'woo-vipps'), ['status' => 400]);
4830	4893	}
	4894	+ $result = ['ok' => 0, 'msg'=>'', 'orderid'=>0, 'url'=>''];
4831	4895
	4896	+ // We receive the varid, prodid, sku and quantity directly. One of these. The sku is the dominant one. IOK 2026-08-27
	4897	+ $varid = intval($args['variation_id'] ?? 0);
	4898	+ $prodid = intval($args['product_id'] ?? 0);
	4899	+ $sku = sanitize_text_field($args['sku'] ?? "");
	4900	+ $quantity = max(1, intval($args['quantity'] ?? 0));
4832	4901
4833		- // Here we will either have a product-id, a variant-id and a product-id, or just a SKU. The product-id will not be a variant - but
4834		- // we'll double-check just in case. Also if we somehow *just* get a variant-id we should fix that too. But a SKU trumps all. IOK 2018-10-02
4835		- $varid = intval(@$_POST['variation_id']);
4836		- $prodid = intval(@$_POST['product_id']);
4837		- $sku = sanitize_text_field(@$_POST['sku']);
4838		- $quant = intval(@$_POST['quantity']);
4839	4902
4840		- // Get any attributes posted for variable products (where one of the dimensions is "any" for instance)
4841		- $variations = array();
4842		- foreach ($_POST as $key => $value ) {
	4903	+ // We expect the variations - that is, the fields named "attribute_..." to be sent as post fields.
	4904	+ // We just need to sanitize them.
	4905	+ $variations = [];
	4906	+ $invars = $args['post'] ?? [];
	4907	+ foreach ($invars as $key => $value) {
4843	4908	if ( 'attribute_' !== substr( $key, 0, 10 ) ) {
4844	4909	continue;
4845	4910	}
4846	4911	$variations[ sanitize_title( wp_unslash( $key ) ) ] = wp_unslash( $value );
		@@ -4845,15 +4910,94 @@
4845	4910	}
4846	4911	$variations[ sanitize_title( wp_unslash( $key ) ) ] = wp_unslash( $value );
4847	4912	}
4848	4913
4849		- $product = null;
4850		- $variant = null;
4851		- $parent = null;
4852		- $parentid = null;
4853		- $quantity = 1;
4854		- if ($quant && $quant>1) $quantity=$quant;
	4914	+ // Then the cookies. These would be the _ga and sbjs_ cookies typically, but we'll let users handle these themselves.
	4915	+ // These are passed as arguments from the javascript, since proxies are likely to strip them. This should allow
	4916	+ // systems like MonsterInsights that look for the _GA cookie to succeed. IOK 2026-08-30
	4917	+ $cookies = $args['cookies'] ?? [];
	4918	+ foreach($cookies as $key => $value) {
	4919	+ if (!isset($_COOKIE[$key])) {
	4920	+ $_COOKIE[$key] = $value;
	4921	+ }
	4922	+ }
4855	4923
	4924	+ // There might be extra values here now, which would typically have been posted as POST arguments, in a form.
	4925	+ // User-defined stuff and so on. We'll initiate the POST value with these to simulate this for backwards compatibility.
	4926	+ $others =$args['post'] ?? [];
	4927	+ foreach($args['post'] as $key=>$value) {
	4928	+ $_POST[$key] = $value;
	4929	+ }
	4930	+
	4931	+ // Since this is the REST api, we need to load the cart manually here. *Not* loading the cart could be an option but unpredictable. IOK 2026-08-27
	4932	+ if ( is_null( WC()->cart ) ) {
	4933	+ WC()->frontend_includes();
	4934	+ if ( ! WC()->session instanceof WC_Session ) {
	4935	+ WC()->session = new WC_Session_Handler();
	4936	+ WC()->session->init();
	4937	+
	4938	+ // If we don't have a session cookie, we need to set it, and also initialize the $_COOKIE value. IOK 2026-09-29
	4939	+ if (! WC()->session->get_session_cookie()) {
	4940	+ $store_session_cookie = function ( $options, $name, $value ) { $_COOKIE[$name] = $value; return $options;};
	4941	+ add_filter('woocommerce_set_cookie_options', $store_session_cookie, 10, 3);
	4942	+ try {
	4943	+ WC()->session->set_customer_session_cookie( true ); // We have to explicitly set the cookie if this session is fresh. IOK 2026-09-29
	4944	+ } finally {
	4945	+ remove_filter('woocommerce_set_cookie_options', $store_session_cookie, 10);
	4946	+ }
	4947	+ }
	4948	+ }
	4949	+ if (is_null( WC()->customer)) {
	4950	+ WC()->customer = new WC_Customer( get_current_user_id(), true );
	4951	+ }
	4952	+ WC()->cart = new WC_Cart();
	4953	+ WC()->cart->get_cart_from_session();
	4954	+ }
	4955	+
	4956	+ // Try to avoid re-purchasing the same order repeatedly. IOK 2026-09-02
	4957	+ // We calculate this here so we can add it to the session later. IOK 2026-09-09
	4958	+ $orderspec = array('sku'=> $sku, 'product_id'=>$prodid, 'variation_id'=>$varid, 'quantity'=>$quantity);
	4959	+ $current_hash = $this->create_order_hash($orderspec);
	4960	+
	4961	+ // Now to handle "extra questions" for an order, including terms + conditions and "possible duplicate order" IOK 2026-09-09
	4962	+ $confirmation = (bool) intval(($others['confirmed'] ?? 0));
	4963	+ if (!$confirmation) {
	4964	+ $result = $this->express_order_needs_confirmation($args, $orderspec, $current_hash);
	4965	+ if (!empty($result)) {
	4966	+ $response = new WP_REST_Response($result);
	4967	+ $response->set_status(200);
	4968	+ return $response;
	4969	+ }
	4970	+ }
	4971	+
	4972	+ // Basically always return 200 after this, and always return an object with an 'ok' and a 'msg' value, possibly 'orderid' and 'url'.
	4973	+ $result = $this->really_do_single_product_express_checkout($prodid, $varid, $sku, $quantity, $variations);
	4974	+ // And if we're going to express now so let's note the order. IOK 2026-08-27. Now this assumes success, but *basically* I think this is ok.
	4975	+ // We'll reset it on order failure I think. IOK 2026-08-20 FIXME
	4976	+ if ($result['ok'] == 1) {
	4977	+ $orderid = $result['orderid'];
	4978	+ WC()->session->set('woo_vipps_last_express', "$current_hash:$orderid:" . time());
	4979	+ WC()->session->save_data();
	4980	+ }
	4981	+
	4982	+ $response = new WP_REST_Response($result);
	4983	+ $response->set_status(200);
	4984	+
	4985	+ return $response;
	4986	+ }
	4987	+
	4988	+ // Common private method to do single product express checkout, used by the new REST express. IOK 2026-08-25
	4989	+ private function really_do_single_product_express_checkout($prodid, $varid, $sku, $quantity=1, $variations=[]) {
	4990	+ require_once(dirname(__FILE__) . "/WC_Gateway_Vipps.class.php");
	4991	+ $gw = $this->gateway();
	4992	+
	4993	+ if (!$gw->express_checkout_available()) {
	4994	+ $result = array('ok'=>0, 'msg'=>sprintf(__('%1$s is not available for this order','woo-vipps'), Vipps::ExpressCheckoutName()), 'url'=>false);
	4995	+ return $result;
	4996	+ }
	4997	+ // Here we will either have a product-id, a variant-id and a product-id, or just a SKU. The product-id will not be a variant - but
	4998	+ // we'll double-check just in case. Also if we somehow *just* get a variant-id we should fix that too. But a SKU trumps all. IOK 2018-10-02
	4999	+
4856	5000	// Find the product, or variation, and get everything in order so we can check existence, availability etc. IOK 2018-10-02
4857	5001	// Moved rules around as the _sku variant broke in 3.6.1 for stores that didn't bother to update the database IOK 2019-04-24
4858	5002	// This broke single-product purchases for variable products; fixed IOK 2019-05-21 thanks to Gaute Terland Nilsen @ Easyweb for the report
4859	5003	try {
		@@ -4866,17 +5010,14 @@
4866	5010	$product = wc_get_product($skuid);
4867	5011	}
4868	5012	} catch (Exception $e) {
4869	5013	$result = array('ok'=>0, 'msg'=>__('Error finding product - cannot create order','woo-vipps'), 'url'=>false);
4870		- wp_send_json($result);
4871		- exit();
	5014	+ return $result;
4872	5015	}
4873	5016
4874		-
4875	5017	if (!$product) {
4876	5018	$result = array('ok'=>0, 'msg'=>__('Unknown product, cannot create order','woo-vipps'), 'url'=>false);
4877		- wp_send_json($result);
4878		- exit();
	5019	+ return $result;
4879	5020	}
4880	5021
4881	5022	$parentid = $product ? $product->get_parent_id() : null; // If the product is a variation, then the parent product is the parentid.
4882	5023	$parent = $parentid ? wc_get_product($parentid) : null;
		@@ -4883,34 +5024,30 @@
4883	5024
4884	5025	// This can't really happen, but if it did..
4885	5026	if ($prodid && $parentid && ($prodid != $parentid)) {
4886	5027	$result = array('ok'=>0, 'msg'=>__('Selected product variant is not available','woo-vipps'), 'url'=>false);
4887		- wp_send_json($result);
4888		- exit();
	5028	+ return $result;
4889	5029	}
4890	5030	if (!$gw->product_supports_express_checkout($product)) {
4891	5031	$result = array('ok'=>0, 'msg'=>sprintf(__('%1$s is not available for this order','woo-vipps'), Vipps::ExpressCheckoutName()), 'url'=>false);
4892		- wp_send_json($result);
4893		- exit();
	5032	+ return $result;
4894	5033	}
4895	5034
4896	5035	// Somebody addded the wrong SKU
4897	5036	if ($product->get_type() == 'variable'){
4898	5037	$result = array('ok'=>0, 'msg'=>__('Selected product variant is not available for purchase','woo-vipps'), 'url'=>false);
4899		- wp_send_json($result);
4900		- exit();
	5038	+ return $result;
4901	5039	}
4902	5040	// Final check of availability
4903	5041	if (!$product->is_purchasable() || !$product->is_in_stock()) {
4904	5042	$result = array('ok'=>0, 'msg'=>__('Your product is temporarily no longer available for purchase','woo-vipps'), 'url'=>false);
4905		- wp_send_json($result);
4906		- exit();
	5043	+ return $result;
4907	5044	}
4908	5045
4909	5046	// Now it should be safe to continue to the checkout process. IOK 2018-10-02
4910		-
4911	5047	// Create a new temporary cart for this order. We need to get (and save) the real session cart,
4912	5048	// because some plugins actually override this.
	5049	+ // NB: Please note the cart must have been loaded here, be aware when doing REST. IOK 2026-08-27
4913	5050	$current_cart = clone WC()->cart;
4914	5051	WC()->cart->empty_cart();
4915	5052
4916	5053	if ($parent && $parent->get_type() == 'variable') {
		@@ -4917,50 +5054,22 @@
4917	5054	WC()->cart->add_to_cart($parent->get_id(),$quantity,$product->get_id(), $variations);
4918	5055	} else {
4919	5056	WC()->cart->add_to_cart($product->get_id(),$quantity);
4920	5057	}
	5058	+ WC()->session->save_data();
4921	5059
4922		- try {
4923		- $orderid = $gw->create_partial_order();
4924		- do_action('woo_vipps_ajax_do_express_checkout', $orderid);
4925		- } catch (Exception $e) {
4926		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps') . ': ' . $e->getMessage(), 'url'=>false);
4927		- wp_send_json($result);
4928		- exit();
4929		- }
	5060	+ $result = $this->create_and_process_express_order();
4930	5061
4931		- if (!$orderid) {
4932		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
4933		- wp_send_json($result);
4934		- exit();
	5062	+ if ($result['ok'] ?? false) {
	5063	+ // Single product purchase, so save any contents of the real cart
	5064	+ $orderid = $result['orderid'];
	5065	+ $order = wc_get_order($orderid);
	5066	+ $order->update_meta_data('_vipps_single_product_express',true);
	5067	+ $order->save();
	5068	+ $this->save_cart($order,$current_cart);
4935	5069	}
4936	5070
4937		- try {
4938		- $this->maybe_add_static_shipping($gw,$orderid);
4939		- } catch (Exception $e) {
4940		- $this->log(__("Error calculating static shipping", 'woo-vipps'), 'error');
4941		- $this->log($e->getMessage(),'error');
4942		- $result = array('ok'=>0, 'msg'=>__('Could not create order','woo-vipps'), 'url'=>false);
4943		- wp_send_json($result);
4944		- exit();
4945		- }
4946		-
4947		-
4948		- // Single product purchase, so save any contents of the real cart
4949		- $order = wc_get_order($orderid);
4950		- $order->update_meta_data('_vipps_single_product_express',true);
4951		- $order->save();
4952		- $this->save_cart($order,$current_cart);
4953		-
4954		- $ok = $gw->process_payment($orderid);
4955		- if ($ok && $ok['result'] == 'success') {
4956		- $result = array('ok'=>1, 'msg'=>'', 'url'=>$ok['redirect']);
4957		- wp_send_json($result);
4958		- exit();
4959		- }
4960		- $result = array('ok'=>0, 'msg'=> sprintf(__('%1$s is temporarily unavailable.','woo-vipps'), $this->get_payment_method_name()), 'url'=>'');
4961		- wp_send_json($result);
4962		- exit();
	5071	+ return $result;
4963	5072	}
4964	5073
4965	5074	// This calculates and adds static shipping info to a partial order for express checkout if merchant has enabled this. IOK 2020-03-19
4966	5075	// Made visible for consistency with add_static_shipping. IOK 2021-10-22
		@@ -5026,9 +5135,9 @@
5026	5135	$transaction = sanitize_text_field(@$_POST['transaction']);
5027	5136
5028	5137	$sessionorders= WC()->session->get('_vipps_session_orders');
5029	5138	if (!isset($sessionorders[$orderid])) {
5030		- wp_send_json(array('status'=>'error', 'msg'=>__('Not an order','woo-vipps')));
	5139	+ wp_send_json(array('status'=>'error', 'msg'=>__('Not a session order','woo-vipps')));
5031	5140	}
5032	5141
5033	5142	$order = wc_get_order($orderid);
5034	5143	if (!$order) {
		@@ -5285,9 +5394,8 @@
5285	5394	echo "<div class='vipps_buy_now_wrapper loop'>$button</div>";
5286	5395	}
5287	5396
5288	5397
5289		-
5290	5398	// Checkout replaces the default checkout page, and currently uses its own page for this which needs to exist
5291	5399	// IOK 2026-04-30 remove this when checkout is end-of-life'd
5292	5400	// We now also use this for the vipps special page, previously a fakepage. LP 2026-08-18
5293	5401	public function woocommerce_create_pages ($data) {
		@@ -5368,15 +5476,8 @@
5368	5476	// This URL will when accessed add a product to the cart and go directly to the express checkout page.
5369	5477	// The argument passed must be a shareable link created for a given product - so this in effect acts as a landing page for
5370	5478	// the buying thru Vipps Express Checkout of a single product linked to in for instance banners. IOK 2018-09-24
5371	5479	public function vipps_buy_product() {
5372		-
5373		- add_filter('body_class', function ($classes) {
5374		- $classes[] = 'vipps-express-checkout';
5375		- $classes[] = 'woocommerce-checkout'; // Required by Pixel Your Site IOK 2022-11-24
5376		- return apply_filters('woo_vipps_express_checkout_body_class', $classes);
5377		- });
5378		-
5379	5480	do_action('woo_vipps_express_checkout_page');
5380	5481
5381	5482	$session = WC()->session;
5382	5483	$posted = $session->get('__vipps_buy_product');
		@@ -5410,23 +5511,26 @@
5410	5511	}
5411	5512
5412	5513	// Pass the productinfo to the express checkout form
5413	5514	$args = array();
5414		- $args['quantity'] = 1;
5415		- if (array_key_exists('product_id',$productinfo)) $args['product_id'] = intval($productinfo['product_id']);
5416		- if (array_key_exists('variation_id',$productinfo)) $args['variation_id'] = intval($productinfo['variation_id']);
5417		- if (array_key_exists('product_sku',$productinfo)) $args['sku'] = sanitize_text_field($productinfo['product_sku']);
5418		- if (array_key_exists('quantity',$productinfo)) $args['quantity'] = intval($productinfo['quantity']);
	5515	+ $args['product_id'] = esc_attr(intval($productinfo['product_id'] ?? 0));
	5516	+ $args['variation_id'] = esc_attr(intval($productinfo['variation_id'] ?? 0));
	5517	+ $args['sku'] = esc_attr(sanitize_text_field($productinfo['product_sku'] ?? ""));
	5518	+ $args['quantity'] = esc_attr(max(1, intval($productinfo['quantity'] ?? 0)));
5419	5519
5420		- // For variable products where some of the attributes are "any", we need to add these as well. This is from woos form-handler for these.
5421		- foreach ($productinfo as $key => $value) {
5422		- if ( 'attribute_' !== substr( $key, 0, 10 ) ) {
5423		- continue;
5424		- }
5425		- $args[sanitize_title(wp_unslash($key))] = sanitize_text_field(wp_unslash($value));
5426		- }
	5520	+ $payment_method = $this->get_payment_method_name();
	5521	+ $btitle = esc_attr(sprintf(__('Buy now with %1$s', 'woo-vipps'), $payment_method));
	5522	+ $bclass = esc_attr($payment_method);
5427	5523
5428		- return $this->express_checkout_page_html(true,'do_single_product_express_checkout',$args);
	5524	+ $content = "<p id=waiting>" . __("Please wait while we are preparing your order", 'woo-vipps') . "...</p>";
	5525	+ $content .= "<div class='vipps-qr-purchase' style='visibility:hidden'>";
	5526	+ $content .= "<a href='javascript:void(0)' class='single-product button vipps-buy-now $bclass' data-vipps-autostart='true' data-vipps-purchase='single' data-product_id='{$args['product_id']}' data-variation_id='{$args['variation_id']}' data-product_sku='{$args['sku']}' data-quantity='{$args['quantity']}' title='{$btitle}';
	5527	+ >";
	5528	+ $content .= $this->get_html_button_for_context('global');
	5529	+ $content .= "</a>";
	5530	+ $content .= "</div>";
	5531	+
	5532	+ return $content;
5429	5533	}
5430	5534
5431	5535	public function vipps_express_checkout_consistency_check() {
5432	5536	// We need a nonce to get here, but we should only get here when we have a cart, so this will not be cached.
		@@ -5450,9 +5554,10 @@
5450	5554
5451	5555	add_filter('woo_vipps_express_checkout_consistent', '__return_true');
5452	5556	}
5453	5557
5454		- // This is a landing page for the express checkout of then normal cart - it is done like this because this could take time on slower hosts.
	5558	+ // This is a landing page for the express checkout of the normal cart - it is done like this because this could take time on slower hosts.
	5559	+ // IOK 2026-09-09 - nowadays this is only used for compatibility mode. It will automatically start express checkout of the current cart when reached.
5455	5560	public function vipps_express_checkout() {
5456	5561	// Some checks are made in template_redirect, we check here if they are ok IOK 2026-09-21
5457	5562	if (!apply_filters('woo_vipps_express_checkout_consistent', false)) {
5458	5563	$content = __('Link expired, please try again', 'woo-vipps');
		@@ -5457,217 +5562,30 @@
5457	5562	if (!apply_filters('woo_vipps_express_checkout_consistent', false)) {
5458	5563	$content = __('Link expired, please try again', 'woo-vipps');
5459	5564	return $content;
5460	5565	}
5461		-
5462		- add_filter('body_class', function ($classes) {
5463		- $classes[] = 'vipps-express-checkout';
5464		- $classes[] = 'woocommerce-checkout'; // Required by Pixel Your Site IOK 2022-11-24
5465		- return apply_filters('woo_vipps_express_checkout_body_class', $classes);
5466		- });
5467		-
	5566	+
5468	5567	do_action('woo_vipps_express_checkout_page');
5469	5568
5470		- return $this->express_checkout_page_html(true, 'do_express_checkout');
5471		- }
	5569	+ $payment_method = $this->get_payment_method_name();
	5570	+ $btitle = esc_attr(sprintf(__('Buy now with %1$s', 'woo-vipps'), $payment_method));
	5571	+ $bclass = esc_attr($payment_method);
	5572	+ $sec = esc_attr($_REQUEST['sec']);
	5573	+ $content = "";
	5574	+ $content .= "<p id=waiting>" . __("Please wait while we are preparing your order", 'woo-vipps') . "...</p>";
	5575	+ $content .= '<div class="vipps-cart-purchase" style="visibility:hidden">"';
	5576	+ $content .= "<a href='javascript:void(0)' class='vipps-express-checkout short $bclass' data-vipps-autostart='true' data-sec='$sec' title='$btitle'>";
	5577	+ $content .= $this->get_html_button_for_context('global');
	5578	+ $content .="</a>";
	5579	+ $content .="</div>";
5472	5580
5473		- // This method tries to ensure that a customer does not 'lose' the return page and
5474		- // starts ordering the same products twice. IOK 2020-01-22
5475		- protected function validate_express_checkout_orderspec ($orderspec) {
5476		- if (empty($orderspec)) return true; // It's not a duplicate, it's nothing.
5477		-
5478		- // First build for the current order an array of hash-tables keyed by prodid, varid and quantity.
5479		- $orderset = array();
5480		- foreach($orderspec as $entry) $orderset[] = join(':', $entry);
5481		-
5482		- // Then get open orders
5483		- $sessionorders = array();
5484		- $sessionorderdata = WC()->session->get('_vipps_session_orders');
5485		- if ($sessionorderdata) {
5486		- foreach(array_keys($sessionorderdata) as $oid) {
5487		- $orderobject = wc_get_order($oid);
5488		- // Check to see that this hasn't been deleted yet IOK 2020-01-07
5489		- if ($orderobject instanceof WC_Order) {
5490		- $sessionorders[] = $orderobject;
5491		- }
5492		- }
5493		- }
5494		- // Nothing more to do here
5495		- if (empty($sessionorders)) return true;
5496		-
5497		- // And create a similar hash table for each of the open orders
5498		- $openorderdata = array();
5499		- foreach ($sessionorders as $open_order) {
5500		- $status = $open_order->get_status();
5501		- if ($status == 'cancelled' || $status == 'pending') continue;
5502		- $when = strtotime($open_order->get_date_modified());
5503		- $cutoff = $when + apply_filters('woo_vipps_recent_order_cutoff', (5*60));
5504		- if (time() > $cutoff) {
5505		- continue;
5506		- }
5507		- $orderdata = array();
5508		- foreach($open_order->get_items() as $item) {
5509		- $productspec = $item->get_product_id() . ':' . $item->get_variation_id() . ':' . $item->get_quantity();
5510		- $orderdata[] = $productspec;
5511		- }
5512		- $openorderdata[]=$orderdata;
5513		- }
5514		-
5515		- // Now: For each entry in the orderhash, check if there is an order that has a) all of them and b) not any more of them.
5516		- foreach($openorderdata as $prevorder) {
5517		- $a = array_diff($prevorder, $orderset);
5518		- $b = array_diff($orderset, $prevorder);
5519		- if (empty($a) && empty($b)) {
5520		- $this->log(__("It seems a customer is trying to re-order product(s) recently bought in the same session, asking user for confirmation", 'woo-vipps'), 'info');
5521		- return false;
5522		- }
5523		- }
5524		- // Else, order is good.
5525		- return true;
	5581	+ return $content;
5526	5582	}
5527	5583
5528		- // Returns a triple of productid, variantid and quantity from an array of arguments which can pass either these or a SKU value.
5529		- // Return value is like in a cart.
5530		- // Used to create an order in express checkout, and to see that this order isn't a repeat. IOK 2020-01-22
5531		- protected function get_orderspec_from_arguments ($productinfo) {
5532		- if (!$productinfo) return array();
5533		- $variantid = 0;
5534		- $productid = 0;
5535		- $quantity = intval(@$productinfo['quantity']);
5536		- if (!$quantity) $quantity = 1;
5537		- if (isset($productinfo['sku']) && $productinfo['sku']) {
5538		- $sku = $productinfo['sku'];
5539		- $skuid = wc_get_product_id_by_sku($sku);
5540		- $product = wc_get_product($skuid);
5541		- $parentid = $product ? $product->get_parent_id() : null;
5542		- if ($product) {
5543		- if ($parentid) {
5544		- $variantid = $skuid; $productid = $parentid;
5545		- } else {
5546		- $productid = $skuid;
5547		- }
5548		- }
5549		- } else if (isset($productinfo['product_id']) && $productinfo['product_id']) {
5550		- $productid = intval($productinfo['product_id']);
5551		- $variantid = intval(@$productinfo['variation_id']);
5552		- }
5553		- if ($productid) return array(array('product_id'=>$productid, 'variation_id'=>$variantid, 'quantity'=>$quantity));
5554		- return array();
5555		- }
5556		- // If no productinfo, this will produce an orderspec from the current cart IOK 2020-01-24
5557		- protected function get_orderspec_from_cart () {
5558		- $cartitems = WC()->cart->get_cart();
5559		- $orderspec = array();
5560		- foreach($cartitems as $item => $values) {
5561		- $orderspec[] = array('product_id'=>$values['product_id'], 'variation_id'=>$values['variation_id'], 'quantity'=>$values['quantity']);
5562		- }
5563		- return $orderspec;
5564		- }
5565		-
5566		- // Used as a landing page for launching express checkout - borh for the cart and for single products. IOK 2018-09-28
5567		- // Returns the html. LP 2026-08-27
5568		- protected function express_checkout_page_html($execute,$action,$productinfo=null) {
5569		- $gw = $this->gateway();
5570		-
5571		- $expressCheckoutMessages = array();
5572		- $expressCheckoutMessages['termsAndConditionsError'] = __( 'Please read and accept the terms and conditions to proceed with your order.', 'woocommerce' );
5573		- $expressCheckoutMessages['temporaryError'] = sprintf(__('%1$s is temporarily unavailable.','woo-vipps'), $this->get_payment_method_name());
5574		- $expressCheckoutMessages['successMessage'] = sprintf(__('To the %1$s app!','woo-vipps'), $this->get_payment_method_name());
5575		-
5576		- wp_register_script('vipps-express-checkout',plugins_url('js/express-checkout.js',__FILE__),array('jquery','wp-hooks'),filemtime(dirname(__FILE__) . "/js/express-checkout.js"), 'true');
5577		- wp_localize_script('vipps-express-checkout', 'VippsCheckoutMessages', $expressCheckoutMessages);
5578		- wp_enqueue_script('vipps-express-checkout');
5579		- // If we have a valid nonce when we get here, just call the 'create order' bit at once. Otherwise, make a button
5580		- // to actually perform the express checkout.
5581		- $buttonhtml = apply_filters('woo_vipps_express_checkout_button', $this->get_html_button());
5582		-
5583		-
5584		-
5585		- $orderspec = $this->get_orderspec_from_arguments($productinfo);
5586		- if (empty($orderspec)) {
5587		- $orderspec = $this->get_orderspec_from_cart();
5588		- }
5589		- $orderisOK = $this->validate_express_checkout_orderspec($orderspec);
5590		- $orderisOK = apply_filters('woo_vipps_validate_express_checkout_orderspec', $orderisOK, $orderspec);
5591		-
5592		- $askForTerms = function_exists('wc_terms_and_conditions_checkbox_enabled') ? wc_terms_and_conditions_checkbox_enabled() : true;
5593		- $askForTerms = $askForTerms && ($gw->get_option('expresscheckout_termscheckbox') == 'yes');
5594		- $askForTerms = apply_filters('woo_vipps_express_checkout_terms_and_conditions_checkbox_enabled', $askForTerms);
5595		-
5596		- $askForConfirmationHTML = '';
5597		- if (!$orderisOK) {
5598		- $header = __("Are you sure?",'woo-vipps');
5599		- $body = __("You recently completed an order with exactly the same products as you are buying now. There should be an email in your inbox from the previous purchase. Are you sure you want to order again?",'woo-vipps');
5600		- $askForConfirmationHTML = apply_filters('woo_vipps_ask_user_to_confirm_repurchase', "<h2 class='confirmVippsExpressCheckoutHeader'>$header</h2><p>$body</p>");
5601		- }
5602		- // Should we go directly to checkout, or do we need to stop and ask the user something (for instance?) IOK 2010-01-20
5603		- $execute = $execute && $orderisOK && !$askForTerms;
5604		- $execute = apply_filters('woo_vipps_checkout_directly_to_vipps', $execute, $productinfo);
5605		-
5606		- $content = $this->spinner();
5607		-
5608		- // We impersonate the woocommerce-checkout form here mainly to work with the Pixel Your Site plugin IOK 2022-11-24
5609		- // The form data below is sent on order creation; the sec is also used to poll session status
5610		- $classlist = apply_filters("woo_vipps_express_checkout_form_classes", "woocommerce-checkout");
5611		- $content .= "<form id='vippsdata' class='" . esc_attr($classlist) . "'>";
5612		- $content .= "<input type='hidden' name='action' value='" . esc_attr($action) ."'>";
5613		- if ($this->gateway()->get_option('vippsorderattribution') == 'yes') {
5614		- // This is for the new order attribution feature of woo. IOK 2024-01-09
5615		- $content .= '<input type="hidden" id="vippsorderattribution" value="1" />';
5616		- ob_start();
5617		- do_action( 'woocommerce_after_order_notes');
5618		- $content .= ob_get_clean();
5619		- }
5620		- $content .= wp_nonce_field('do_express','sec',1,false);
5621		-
5622		- $termsHTML = '';
5623		- if ($askForTerms) {
5624		- // Include shop terms
5625		- ob_start();
5626		- wc_get_template('checkout/terms.php');
5627		- $termsHTML = ob_get_clean();
5628		- $termsHTML = apply_filters('woo_vipps_express_checkout_terms_and_conditions_html',$termsHTML);
5629		- }
5630		- $termsHTML = apply_filters('woo_vipps_express_checkout_terms_and_conditions_html',$termsHTML);
5631		-
5632		- if ($productinfo) {
5633		- foreach($productinfo as $key=>$value) {
5634		- $k = esc_attr($key);
5635		- $v = esc_attr($value);
5636		- $content .= "<input type='hidden' name='$k' value='$v' />";
5637		- }
5638		- }
5639		- ob_start();
5640		- $content .= do_action('woo_vipps_express_checkout_orderspec_form', $productinfo);
5641		- $content .= ob_get_clean();
5642		- $content .= "</form>";
5643		-
5644		- $extraHTML = apply_filters('woo_vipps_express_checkout_final_html', '', $termsHTML,$askForConfirmationHTML);
5645		- $pressTheButtonHTML = "";
5646		- if (empty($termsHTML) && empty($askForConfirmationHTML) && empty($extraHTML)) {
5647		- $pressTheButtonHTML = "<p id=waiting>" . sprintf(__('Ready for %1$s - press the button', 'woo-vipps'), Vipps::ExpressCheckoutName()) . "</p>";
5648		- }
5649		-
5650		- if ($execute) {
5651		- $content .= "<p id=waiting>" . __("Please wait while we are preparing your order", 'woo-vipps') . "</p>";
5652		- $content .= "<div id='vipps-status-message'></div>";
5653		- return $this->special_page_html('', $content);
5654		- } else {
5655		- $content .= $askForConfirmationHTML;
5656		- $content .= $extraHTML;
5657		- $content .= $termsHTML;
5658		- $content .= apply_filters('woo_vipps_express_checkout_validation_elements', '');
5659		- $title = sprintf(__('Buy now with %1$s!', 'woo-vipps'), $this->get_payment_method_name());
5660		- $content .= "<div class='vipps_buy_now_wrapper noloop'><a href='#' id='do-express-checkout' class='vipps-express-checkout' title='$title'>$buttonhtml</a></div>";
5661		- $content .= "<div id='vipps-status-message'></div>";
5662		- return $this->special_page_html('', $content);
5663		- }
5664		- }
5665		-
5666		-
5667	5584	// Called in template_redirect before we get to the wait-for-payment page IOK 2026-09-21
5668	5585	private function handle_payment_poll_and_redirect () {
5669	5586	$orderid = WC()->session->get('_vipps_pending_order');
	5587	+
5670	5588	$order = null;
5671	5589	$gw = $this->gateway();
5672	5590
5673	5591	// Failsafe for when the session disappears IOK 2018-11-19
		@@ -5696,9 +5614,14 @@
5696	5614	$session = WC()->session;
5697	5615	if (!$session->has_session()) {
5698	5616	$session->set_customer_session_cookie(true);
5699	5617	}
	5618	+
	5619	+ $sessionorders= WC()->session->get('_vipps_session_orders');
	5620	+ $sessionorders[$orderid] = 1;
	5621	+ WC()->session->set('_vipps_session_orders',$sessionorders);
5700	5622	$session->set('_vipps_pending_order', $orderid);
	5623	+ WC()->session->save_data();
5701	5624	}
5702	5625	}
5703	5626
5704	5627	$deleted_order=0;
		@@ -5704,9 +5627,9 @@
5704	5627	$deleted_order=0;
5705	5628	if ($orderid && !$order) {
5706	5629	// If this happens, we actually did have an order, but it has been deleted, which must mean that it was cancelled.
5707	5630	// Concievably a hook on the 'cancel'-transition or in the callback handlers could clean that up before we get here. IOK 2019-09-26
5708		- $this->log(__("In order return: The order %1\$d seems to be deleted", 'woo-vipps'), 'debug');
	5631	+ $this->log(sprintf(__("In order return: The order %1\$d seems to be deleted", 'woo-vipps'), $orderid), 'debug');
5709	5632	$deleted_order=1;
5710	5633	}
5711	5634
5712	5635	if (!$order && !$deleted_order) wp_die(__('Unknown order', 'woo-vipps'));
		@@ -5716,12 +5639,13 @@
5716	5639
5717	5640	// This is for debugging only - set to false to ensure we wait for the callback. IOK 2023-08-04
5718	5641	$do_poll = true;
5719	5642
5720		- // Still pending, no callback. Make a call to the server as the order might not have been created. IOK 2018-05-16
	5643	+ // Do a single poll here to check and set the order status at Woo using the order status at Vipps IOK 2026-09-29
5721	5644	if ($do_poll && $status == 'pending') {
5722		- // Just in case the callback hasn't come yet, do a quick check of the order status at Vipps.
5723		- $newstatus = $gw->callback_check_order_status($order);
	5645	+ // We will do *one* poll before waiting for the callback (for a while, at least.) IOK 2026-09-29
	5646	+ $newstatus = $gw->poll_and_check_order_status($order);
	5647	+ $this->log(sprintf(__("In order return: Order status of %1\$d is %2\$s", 'woo-vipps'), $orderid, $newstatus), 'info');
5724	5648	if ($status != $newstatus) {
5725	5649	$status = $newstatus;
5726	5650	clean_post_cache($orderid);
5727	5651	$order = wc_get_order($orderid); // Reload order object
		@@ -5729,8 +5653,10 @@
5729	5653	} else {
5730	5654	// No need to do anyting here. IOK 2020-01-26
5731	5655	}
5732	5656
	5657	+ // Actually, this may cause a second poll if the first left us pending. Should be rewritten - but *mostly* it will just check
	5658	+ // the payment status at Vipps without polls, which will tell us if the payment succeeded in case people use custom order statuses and so on. IOK 2026-09-29
5733	5659	$payment = 'notchecked';
5734	5660	if ($do_poll) {
5735	5661	$payment = $deleted_order ? 'cancelled' : $gw->check_payment_status($order);
5736	5662	}
		@@ -5765,8 +5691,10 @@
5765	5691	// If not, enqueue the status checker IOK 2026-09-21
5766	5692	wp_enqueue_script('check-vipps',plugins_url('js/check-order-status.js',__FILE__),array('jquery','vipps-gw'),filemtime(dirname(__FILE__) . "/js/check-order-status.js"), 'true');
5767	5693	}
5768	5694
	5695	+ $this->log(sprintf(__("Order status of %1\$d not ready in order return: payment status %2\$s", 'woo-vipps'), $orderid, $payment), 'info');
	5696	+
5769	5697	// Communicate this to the shortcode IOK 2026-09-21
5770	5698	add_filter('woo_vipps_wait_for_payment_status', function () use($orderid, $status, $payment) {
5771	5699	return ['orderid'=>$orderid, 'status'=>$status, 'payment'=>$payment];
5772	5700	});
		@@ -5773,9 +5701,8 @@
5773	5701
5774	5702	}
5775	5703
5776	5704	public function vipps_wait_for_payment() {
5777		-
5778	5705	// This will have been computed in template_redirect, but the status will be either still pending or failed. IOK 2026-09-21
5779	5706	$data = apply_filters('woo_vipps_wait_for_payment_status', []);
5780	5707
5781	5708	$orderid = $data['orderid'] ?? 0;
		@@ -5815,9 +5742,8 @@
5815	5742	$content .= "<input type='hidden' name='key' value='".htmlspecialchars($order->get_order_key())."'>";
5816	5743	$content .= "<input type='hidden' name='action' value='check_order_status'>";
5817	5744	$content .= wp_nonce_field('vippsstatus','sec',1,false);
5818	5745	$content .= "</form>";
5819		-
5820	5746
5821	5747	$content .= "<div id='error' style='display:none'><p>".__('Error during order confirmation','woo-vipps'). '</p>';
5822	5748	$content .= "<p>" . __('An error occured during order confirmation. The error has been logged. Please contact us to determine the status of your order', 'woo-vipps') . "</p>";
5823	5749	$content .= "<p><a href='" . home_url() . "' class='btn button'>" . __('Continue shopping','woo-vipps') . '</a></p>';