woocommerce-pos / includes / Templates / Received.php

Received.php in WCPOS – Point of Sale (POS) plugin for WooCommerce 1.10.16, at includes/Templates/Received.php

113 lines 3.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Received order template.
4	*
5	* @author Paul Kilmurray <paul@kilbot.com>
6	*
7	* @see http://wcpos.com
8	* @package WooCommercePOS\Templates
9	*/
10
11	namespace WCPOS\WooCommercePOS\Templates;
12
13	use Exception;
14	use WCPOS\WooCommercePOS\Logger;
15	use WP_REST_Request;
16
17	/**
18	* Received class.
19	*/
20	class Received {
21	/**
22	* Order ID.
23	*
24	* @var int
25	*/
26	private $order_id;
27
28	/**
29	* Constructor.
30	*
31	* @param int $order_id The order ID.
32	*/
33	public function __construct( int $order_id ) {
34	$this->order_id = $order_id;
35
36	add_filter( 'show_admin_bar', '__return_false' );
37	}
38
39	/**
40	* Fetch the order JSON via an internal REST request to the WCPOS endpoint.
41	*
42	* @param int $order_id The order ID.
43	*
44	* @return string\|false JSON string or false on failure.
45	*/
46	public function get_order_json( int $order_id ) {
47	// Grant POS access for this internal request so it passes both the
48	// WC REST permission check and the POS access_woocommerce_pos gate.
49	$grant_caps = function ( $allcaps ) {
50	$allcaps['access_woocommerce_pos'] = true;
51	return $allcaps;
52	};
53	add_filter( 'user_has_cap', $grant_caps );
54	add_filter( 'woocommerce_rest_check_permissions', '__return_true' );
55
56	try {
57	$request = new WP_REST_Request( 'GET', '/wcpos/v1/orders/' . $order_id );
58	$server = rest_get_server();
59	$response = $server->dispatch( $request );
60	if ( $response->is_error() \|\| $response->get_status() >= 400 ) {
61	Logger::log( sprintf( 'Received order %d REST dispatch failed with status %d.', $order_id, $response->get_status() ) );
62	return false;
63	}
64	$data = $server->response_to_data( $response, true );
65	} finally {
66	remove_filter( 'user_has_cap', $grant_caps );
67	remove_filter( 'woocommerce_rest_check_permissions', '__return_true' );
68	}
69
70	return wp_json_encode( $data );
71	}
72
73	/**
74	* Get and display the received template.
75	*/
76	public function get_template(): void {
77	try {
78	$order = \wc_get_order( $this->order_id );
79
80	if ( ! $order ) {
81	wp_die( esc_html__( 'Sorry, this order is invalid.', 'woocommerce-pos' ) );
82	}
83
84	// Verify order key to prevent unauthenticated access.
85	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Order key is the auth mechanism here, matching WooCommerce core behavior.
86	$provided_key = isset( $_GET['key'] ) ? sanitize_text_field( wp_unslash( $_GET['key'] ) ) : '';
87	if ( ! $provided_key \|\| $provided_key !== $order->get_order_key() ) {
88	wp_die(
89	esc_html__( 'Sorry, this order cannot be viewed. The order key is missing or invalid.', 'woocommerce-pos' ),
90	/* translators: Short WCPOS UI label; keep concise. */
91	esc_html__( 'Error', 'woocommerce-pos' ),
92	array( 'response' => 403 )
93	);
94	}
95
96	$order_json = $this->get_order_json( $order->get_id() );
97	// Emit only after WooCommerce recognizes the order as paid. A negative
98	// needs_payment() check is insufficient because zero-total failed orders do not
99	// need payment. Keep the POS exclusions so parked carts never report success.
100	$order_complete = $order->is_paid() && ! \in_array( $order->get_status(), array( 'pos-open', 'pos-partial' ), true );
101
102	if ( false === $order_json ) {
103	$order_complete = false;
104	}
105
106	include woocommerce_pos_locate_template( 'received.php' );
107	exit;
108	} catch ( Exception $e ) {
109	\wc_print_notice( $e->getMessage(), 'error' );
110	}
111	}
112	}
113