← All changes | includes/Form_Handler.php +31 -0 1.10.1 → 1.10.18 View file →

		@@ -97,9 +97,40 @@
97	97	}
98	98
99	99	// set customer.
100	100	wp_set_current_user( $order->get_customer_id() );
	101	+
	102	+ /*
	103	+ * The pay nonce was minted in Templates\Payment with the logged-out nonce
	104	+ * identity forced to 0 (its nonce_user_logged_out filter). That filter only
	105	+ * exists while the template renders — it is not registered on this POST,
	106	+ * which WooCommerce's own pay handler processes later on this same 'wp'
	107	+ * hook (priority 20). Without the mirror here, a guest-session cookie
	108	+ * (set by the pay page itself, and always replayed by the iOS/Android
	109	+ * WebViews) makes WC_Session_Handler resolve the logged-out identity to
	110	+ * its 't_…' customer id at verify time, the nonce hash no longer matches,
	111	+ * and WC_Form_Handler::pay_action() drops the payment silently.
	112	+ * Priority 20 so it wins over WC_Session_Handler's filter (priority 10).
	113	+ */
	114	+ add_filter( 'nonce_user_logged_out', array( $this, 'nonce_user_logged_out' ), 20, 2 );
101	115	}
	116	+ }
	117	+
	118	+ /**
	119	+ * Force the logged-out nonce identity to 0 for the pay nonce, matching the
	120	+ * identity Templates\Payment mints it with.
	121	+ *
	122	+ * @param int|string $uid The logged-out nonce identity.
	123	+ * @param string|int $action The nonce action.
	124	+ *
	125	+ * @return int|string
	126	+ */
	127	+ public function nonce_user_logged_out( $uid, $action ) {
	128	+ if ( 'woocommerce-pay' === $action ) {
	129	+ return 0;
	130	+ }
	131	+
	132	+ return $uid;
102	133	}
103	134
104	135	/**
105	136	* Process the coupon action.