← All changes | includes/Gateway.php +15 -45 4.3.2 → 4.4.0 View file →

		@@ -70,9 +70,9 @@
70	70	private $payment_form = null;
71	71
72	72	/**
73	73	* Holds the instance of the Digital_Wallet class.
74		- * @since x.x.x
	74	+ * @since 4.2.0
75	75	*
76	76	* @var null|Digital_Wallet
77	77	*/
78	78	private $digital_wallet = null;
		@@ -78,9 +78,9 @@
78	78	private $digital_wallet = null;
79	79
80	80	/**
81	81	* Holds the instance of the Gift_Card class.
82		- * @since x.x.x
	82	+ * @since 4.2.0
83	83	*
84	84	* @var null|Gift_Card
85	85	*/
86	86	private $gift_card = null;
		@@ -124,8 +124,9 @@
124	124	add_action( 'wp_ajax_wc_' . $this->get_id() . '_log_js_data', array( $this, 'log_js_data' ) );
125	125	add_action( 'wp_ajax_nopriv_wc_' . $this->get_id() . '_log_js_data', array( $this, 'log_js_data' ) );
126	126
127	127	add_action( 'wp_ajax_wc_' . $this->get_id() . '_get_token_by_id', array( $this, 'get_token_by_id' ) );
	128	+ add_action( 'wp_ajax_nopriv_wc_' . $this->get_id() . '_get_token_by_id', array( $this, 'get_token_by_id' ) );
128	129
129	130	// store the Square item variation ID to order items
130	131	add_action( 'woocommerce_new_order_item', array( $this, 'store_new_order_item_square_meta' ), 10, 3 );
131	132
		@@ -154,59 +155,27 @@
154	155
155	156	/**
156	157	* Ajax callback to return payment token by token ID.
157	158	*
158		- * @since x.x.x
	159	+ * @since 4.2.0
159	160	*/
160	161	public function get_token_by_id() {
161	162	$nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : false;
162	163
163		- if ( ! wp_verify_nonce( $nonce, 'payment_token_nonce' ) || ! is_user_logged_in() ) {
164		- wp_send_json_error( esc_html__( 'Verification failed.', 'woocommerce-square' ), \WP_Http::UNAUTHORIZED );
	164	+ if ( ! wp_verify_nonce( $nonce, 'payment_token_nonce' ) ) {
	165	+ wp_send_json_error( esc_html__( 'Nonce verification failed.', 'woocommerce-square' ) );
165	166	}
166	167
167	168	$token_id = isset( $_GET['token_id'] ) ? absint( wp_unslash( $_GET['token_id'] ) ) : false;
168	169
169	170	if ( ! $token_id ) {
170		- wp_send_json_error( esc_html__( 'Token ID missing.', 'woocommerce-square' ), \WP_Http::BAD_REQUEST );
	171	+ wp_send_json_error( esc_html__( 'Token ID missing.', 'woocommerce-square' ) );
171	172	}
172	173
173	174	$token_obj = \WC_Payment_Tokens::get( $token_id );
174	175
175		- /*
176		- * Verify token belongs to this gateway.
177		- *
178		- * This ajax endpoint is for retrieving Square payment tokens only.
179		- */
180		- if ( is_object( $token_obj ) && $this->get_id() !== $token_obj->get_gateway_id() ) {
181		- wp_send_json_error( esc_html__( 'Verification failed.', 'woocommerce-square' ), \WP_Http::FORBIDDEN );
182		- }
183		-
184		- /*
185		- * Ensure user has permission to access token.
186		- *
187		- * Store administrators can request any token but other users can only
188		- * access tokens belonging to their own account.
189		- */
190		- if (
191		- ! current_user_can( 'manage_woocommerce' )
192		- && (
193		- is_null( $token_obj )
194		- || get_current_user_id() !== $token_obj->get_user_id()
195		- )
196		- ) {
197		- wp_send_json_error( esc_html__( 'Verification failed.', 'woocommerce-square' ), \WP_Http::FORBIDDEN );
198		- }
199		-
200		- /*
201		- * Show invalid Token ID to store admins only.
202		- *
203		- * The condition above will present a generic "validation failed" message to other
204		- * users, this will only provide the details of why validation failed to store
205		- * admins to avoid information disclosure.
206		- */
207	176	if ( is_null( $token_obj ) ) {
208		- wp_send_json_error( esc_html__( 'No payment token exists for this ID.', 'woocommerce-square' ), \WP_Http::NOT_FOUND );
	177	+ wp_send_json_error( esc_html__( 'No payment token exists for this ID.', 'woocommerce-square' ) );
209	178	}
210	179
211	180	wp_send_json_success( $token_obj->get_token() );
212	181	}
		@@ -482,9 +451,9 @@
482	451
483	452	/**
484	453	* Stores gift card details as order meta.
485	454	*
486		- * @since x.x.x
	455	+ * @since 4.2.0
487	456	*
488	457	* @param \Square\Models\Order $square_order
489	458	* @param \WC_Order $order
490	459	*/
		@@ -710,9 +679,9 @@
710	679
711	680	/**
712	681	* Returns the gift card object.
713	682	*
714		- * @since x.x.x
	683	+ * @since 4.2.0
715	684	*
716	685	* @return Gift_Card;
717	686	*/
718	687	public function get_gift_card_handler() {
		@@ -721,9 +690,9 @@
721	690
722	691	/**
723	692	* Returns the gift card object.
724	693	*
725		- * @since x.x.x
	694	+ * @since 4.2.0
726	695	*
727	696	* @return Digital_Wallet;
728	697	*/
729	698	public function get_digital_wallet_handler() {
		@@ -807,8 +776,9 @@
807	776	// debug mode
808	777	$this->form_fields['debug_mode'] = array(
809	778	'title' => esc_html__( 'Debug Mode', 'woocommerce-square' ),
810	779	'type' => 'select',
	780	+ 'class' => 'wc-enhanced-select',
811	781	/* translators: Placeholders: %1$s - <a> tag, %2$s - </a> tag */
812	782	'desc' => sprintf( esc_html__( 'Show Detailed Error Messages and API requests/responses on the checkout page and/or save them to the %1$sdebug log%2$s', 'woocommerce-square' ), '<a href="' . Square_Helper::get_wc_log_file_url( $this->get_id() ) . '">', '</a>' ),
813	783	'default' => self::DEBUG_MODE_OFF,
814	784	'options' => array(
		@@ -1292,9 +1262,9 @@
1292	1262
1293	1263	/**
1294	1264	* Filters to show only the Square gateway when cart contains a Gift card product.
1295	1265	*
1296		- * @since x.x.x
	1266	+ * @since 4.2.0
1297	1267	*
1298	1268	* @param array $gateways Array of payment gateways.
1299	1269	* @return array
1300	1270	*/
		@@ -1314,9 +1284,9 @@
1314	1284
1315	1285	/**
1316	1286	* If no payment gateways are available and cart contains gift card, then show error message.
1317	1287	*
1318		- * @since x.x.x
	1288	+ * @since 4.2.0
1319	1289	*
1320	1290	* @param string $text Error message.
1321	1291	* @return string
1322	1292	*/
		@@ -1436,9 +1406,9 @@
1436	1406
1437	1407	/**
1438	1408	* Get order amount via AJAX.
1439	1409	*
1440		- * @since x.x.x
	1410	+ * @since 4.1.0
1441	1411	*/
1442	1412	public function get_order_amount() {
1443	1413	check_ajax_referer( 'wc_' . $this->get_id() . '_get_order_amount', 'security' );
1444	1414	$total_amount = '';