From e6de32eeb3dfefed034d59e1087e02fa4e5b0948 Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Tue, 25 Sep 2018 16:04:09 -0300
Subject: [PATCH 01/54] consistently escape gateway ID in payment method
 template

---
 templates/checkout/payment-method.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index dead8df7953..5f07bdafa32 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -20,14 +20,14 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 ?>
-<li class="wc_payment_method payment_method_<?php echo $gateway->id; ?>">
-	<input id="payment_method_<?php echo $gateway->id; ?>" type="radio" class="input-radio" name="payment_method" value="<?php echo esc_attr( $gateway->id ); ?>" <?php checked( $gateway->chosen, true ); ?> data-order_button_text="<?php echo esc_attr( $gateway->order_button_text ); ?>" />
+<li class="wc_payment_method payment_method_<?php echo esc_attr( $gateway->id ); ?>">
+	<input id="payment_method_<?php echo esc_attr( $gateway->id ); ?>" type="radio" class="input-radio" name="payment_method" value="<?php echo esc_attr( $gateway->id ); ?>" <?php checked( $gateway->chosen, true ); ?> data-order_button_text="<?php echo esc_attr( $gateway->order_button_text ); ?>" />
 
-	<label for="payment_method_<?php echo $gateway->id; ?>">
+	<label for="payment_method_<?php echo esc_attr( $gateway->id ); ?>">
 		<?php echo $gateway->get_title(); ?> <?php echo $gateway->get_icon(); ?>
 	</label>
 	<?php if ( $gateway->has_fields() || $gateway->get_description() ) : ?>
-		<div class="payment_box payment_method_<?php echo $gateway->id; ?>" <?php if ( ! $gateway->chosen ) : ?>style="display:none;"<?php endif; ?>>
+		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : ?>style="display:none;"<?php endif; ?>>
 			<?php $gateway->payment_fields(); ?>
 		</div>
 	<?php endif; ?>

From 7f5122d50239c50242f2881f6e9d991f9a282c93 Mon Sep 17 00:00:00 2001
From: dyszczo <krzysiek@inspirelabs.pl>
Date: Wed, 26 Sep 2018 12:41:28 +0200
Subject: [PATCH 02/54] Fix for warning in wc_get_logger when
 woocommerce_logging_class returns valid logger instance

---
 includes/wc-core-functions.php                |   2 +-
 .../util/class-wc-tests-core-functions.php    | 104 +++++++++++-------
 tests/unit-tests/util/dummy-wc-logger.php     | 103 +++++++++++++++++
 3 files changed, 171 insertions(+), 38 deletions(-)
 create mode 100644 tests/unit-tests/util/dummy-wc-logger.php

diff --git a/includes/wc-core-functions.php b/includes/wc-core-functions.php
index 6631d4339c4..f9ab2265457 100644
--- a/includes/wc-core-functions.php
+++ b/includes/wc-core-functions.php
@@ -1633,7 +1633,7 @@ function wc_get_logger() {
 
 	$class = apply_filters( 'woocommerce_logging_class', 'WC_Logger' );
 
-	if ( null !== $logger && is_a( $logger, $class ) ) {
+	if ( null !== $logger && is_string( $class ) && is_a( $logger, $class ) ) {
 		return $logger;
 	}
 
diff --git a/tests/unit-tests/util/class-wc-tests-core-functions.php b/tests/unit-tests/util/class-wc-tests-core-functions.php
index f8dcc0f6a51..21fef046a8e 100644
--- a/tests/unit-tests/util/class-wc-tests-core-functions.php
+++ b/tests/unit-tests/util/class-wc-tests-core-functions.php
@@ -268,8 +268,8 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 	 * @since 2.4
 	 */
 	public function test_wc_get_log_file_path() {
-		$log_dir   = trailingslashit( WC_LOG_DIR );
-		$hash_name = sanitize_file_name( wp_hash( 'unit-tests' ) );
+		$log_dir     = trailingslashit( WC_LOG_DIR );
+		$hash_name   = sanitize_file_name( wp_hash( 'unit-tests' ) );
 		$date_suffix = date( 'Y-m-d', current_time( 'timestamp', true ) );
 
 		$this->assertEquals( $log_dir . 'unit-tests-' . $date_suffix . '-' . $hash_name . '.log', wc_get_log_file_path( 'unit-tests' ) );
@@ -293,6 +293,26 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 		$this->assertSame( $log_a, $log_b, '`wc_get_logger()` should return the same instance' );
 	}
 
+	/**
+	 * Test wc_get_logger() to check if can return instance when given in filter.
+	 */
+	public function test_wc_get_logger_for_instance() {
+		add_filter( 'woocommerce_logging_class', array( $this, 'return_valid_logger_instance' ) );
+
+		$logger = wc_get_logger();
+
+		$this->assertInstanceOf( 'WC_Logger_Instance', $logger, '`wc_get_logger()` should return valid Dummy_WC_Logger instance' );
+	}
+
+	/**
+	 * Return valid logger instance that implements WC_Logger_Interface.
+	 *
+	 * @return WC_Logger_Interface
+	 */
+	public function return_valid_logger_instance() {
+		return new Dummy_WC_Logger();
+	}
+
 	/**
 	 * Return class which does not implement WC_Logger_Interface
 	 *
@@ -326,7 +346,7 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 		$this->assertEquals(
 			array(
 				'country' => 'US',
-				'state' => 'CA',
+				'state'   => 'CA',
 			),
 			wc_format_country_state_string( 'US:CA' )
 		);
@@ -335,7 +355,7 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 		$this->assertEquals(
 			array(
 				'country' => 'US-CA',
-				'state' => '',
+				'state'   => '',
 			),
 			wc_format_country_state_string( 'US-CA' )
 		);
@@ -483,26 +503,32 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 		update_option( 'woocommerce_currency', $new_currency );
 
 		// New order should be created using shop currency.
-		$order = wc_create_order( array(
-			'status'      => 'pending',
-			'customer_id' => 1,
-			'created_via' => 'unit tests',
-			'cart_hash'   => '',
-		) );
+		$order = wc_create_order(
+			array(
+				'status'      => 'pending',
+				'customer_id' => 1,
+				'created_via' => 'unit tests',
+				'cart_hash'   => '',
+			)
+		);
 		$this->assertEquals( $new_currency, $order->get_currency() );
 
 		update_option( 'woocommerce_currency', $old_currency );
 
 		// Currency should not change when order is updated.
-		$order = wc_update_order( array(
-			'customer_id' => 2,
-			'order_id'    => $order->get_id(),
-		) );
+		$order = wc_update_order(
+			array(
+				'customer_id' => 2,
+				'order_id'    => $order->get_id(),
+			)
+		);
 		$this->assertEquals( $new_currency, $order->get_currency() );
 
-		$order = wc_update_order( array(
-			'customer_id' => 2,
-		) );
+		$order = wc_update_order(
+			array(
+				'customer_id' => 2,
+			)
+		);
 		$this->assertInstanceOf( 'WP_Error', $order );
 	}
 
@@ -577,25 +603,29 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 	 * @return void
 	 */
 	public function test_wc_get_page_children() {
-		$page_id = wp_insert_post( array(
-			'post_title'  => 'Parent Page',
-			'post_type'   => 'page',
-			'post_name'   => 'parent-page',
-			'post_status' => 'publish',
-			'post_author' => 1,
-			'menu_order'  => 0,
-		) );
+		$page_id = wp_insert_post(
+			array(
+				'post_title'  => 'Parent Page',
+				'post_type'   => 'page',
+				'post_name'   => 'parent-page',
+				'post_status' => 'publish',
+				'post_author' => 1,
+				'menu_order'  => 0,
+			)
+		);
 
-		$child_page_id = wp_insert_post( array(
-			'post_parent' => $page_id,
-			'post_title'  => 'Parent Page',
-			'post_type'   => 'page',
-			'post_name'   => 'parent-page',
-			'post_status' => 'publish',
-			'post_author' => 1,
-			'menu_order'  => 0,
-		) );
-		$children = wc_get_page_children( $page_id );
+		$child_page_id = wp_insert_post(
+			array(
+				'post_parent' => $page_id,
+				'post_title'  => 'Parent Page',
+				'post_type'   => 'page',
+				'post_name'   => 'parent-page',
+				'post_status' => 'publish',
+				'post_author' => 1,
+				'menu_order'  => 0,
+			)
+		);
+		$children      = wc_get_page_children( $page_id );
 		$this->assertEquals( $child_page_id, $children[0] );
 
 		wp_delete_post( $page_id, true );
@@ -721,7 +751,7 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 
 		foreach ( $test_cases as $test_case ) {
 			list( $value, $options, $result ) = $test_case;
-			$actual_result = $result ? " selected='selected'" : '';
+			$actual_result                    = $result ? " selected='selected'" : '';
 			$this->assertEquals( wc_selected( $value, $options ), $actual_result );
 		}
 	}
@@ -815,7 +845,7 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 	 * @return void
 	 */
 	public function test_wc_get_user_agent() {
-		$example_user_agent = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36';
+		$example_user_agent         = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36';
 		$_SERVER['HTTP_USER_AGENT'] = $example_user_agent;
 		$this->assertEquals( $example_user_agent, wc_get_user_agent() );
 	}
diff --git a/tests/unit-tests/util/dummy-wc-logger.php b/tests/unit-tests/util/dummy-wc-logger.php
new file mode 100644
index 00000000000..9896fcfbe5a
--- /dev/null
+++ b/tests/unit-tests/util/dummy-wc-logger.php
@@ -0,0 +1,103 @@
+<?php
+
+/**
+ * Dummy Logger implements WC_Logger_Interface.
+ */
+class Dummy_WC_Logger implements WC_Logger_Interface {
+
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $handle
+	 * @param string $message
+	 * @param string $level
+	 *
+	 * @return bool|void
+	 */
+	public function add( $handle, $message, $level = WC_Log_Levels::NOTICE ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $level
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function log( $level, $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function emergency( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function alert( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function critical( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function error( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function warning( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function notice( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function info( $message, $context = [] ) {
+	}
+
+	/**
+	 * Do nothing.
+	 *
+	 * @param string $message
+	 * @param array $context
+	 */
+	public function debug( $message, $context = [] ) {
+	}
+
+}

From 94ed5a2460fa524d5fe5d75629acfcbe3586fc51 Mon Sep 17 00:00:00 2001
From: dyszczo <krzysiek@inspirelabs.pl>
Date: Wed, 26 Sep 2018 15:37:08 +0200
Subject: [PATCH 03/54] fix for wc_logger test

---
 tests/unit-tests/util/class-wc-tests-core-functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/unit-tests/util/class-wc-tests-core-functions.php b/tests/unit-tests/util/class-wc-tests-core-functions.php
index 21fef046a8e..2b4bf34fc0a 100644
--- a/tests/unit-tests/util/class-wc-tests-core-functions.php
+++ b/tests/unit-tests/util/class-wc-tests-core-functions.php
@@ -301,7 +301,7 @@ class WC_Tests_Core_Functions extends WC_Unit_Test_Case {
 
 		$logger = wc_get_logger();
 
-		$this->assertInstanceOf( 'WC_Logger_Instance', $logger, '`wc_get_logger()` should return valid Dummy_WC_Logger instance' );
+		$this->assertInstanceOf( 'WC_Logger_Interface', $logger, '`wc_get_logger()` should return valid Dummy_WC_Logger instance' );
 	}
 
 	/**

From 6019e91e5e5bb9c3d743b69eea4cf527f7d511e5 Mon Sep 17 00:00:00 2001
From: dyszczo <krzysiek@inspirelabs.pl>
Date: Wed, 26 Sep 2018 15:53:52 +0200
Subject: [PATCH 04/54] php 5.3 compatibility

---
 tests/unit-tests/util/dummy-wc-logger.php | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tests/unit-tests/util/dummy-wc-logger.php b/tests/unit-tests/util/dummy-wc-logger.php
index 9896fcfbe5a..b91f35a7caa 100644
--- a/tests/unit-tests/util/dummy-wc-logger.php
+++ b/tests/unit-tests/util/dummy-wc-logger.php
@@ -25,7 +25,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function log( $level, $message, $context = [] ) {
+	public function log( $level, $message, $context = array() ) {
 	}
 
 	/**
@@ -34,7 +34,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function emergency( $message, $context = [] ) {
+	public function emergency( $message, $context = array() ) {
 	}
 
 	/**
@@ -43,7 +43,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function alert( $message, $context = [] ) {
+	public function alert( $message, $context = array() ) {
 	}
 
 	/**
@@ -52,7 +52,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function critical( $message, $context = [] ) {
+	public function critical( $message, $context = array() ) {
 	}
 
 	/**
@@ -61,7 +61,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function error( $message, $context = [] ) {
+	public function error( $message, $context = array() ) {
 	}
 
 	/**
@@ -70,7 +70,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function warning( $message, $context = [] ) {
+	public function warning( $message, $context = array() ) {
 	}
 
 	/**
@@ -79,7 +79,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function notice( $message, $context = [] ) {
+	public function notice( $message, $context = array() ) {
 	}
 
 	/**
@@ -88,7 +88,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function info( $message, $context = [] ) {
+	public function info( $message, $context = array() ) {
 	}
 
 	/**
@@ -97,7 +97,7 @@ class Dummy_WC_Logger implements WC_Logger_Interface {
 	 * @param string $message
 	 * @param array $context
 	 */
-	public function debug( $message, $context = [] ) {
+	public function debug( $message, $context = array() ) {
 	}
 
 }

From 526e3826e84aaada4d191ebf297ee188369f850d Mon Sep 17 00:00:00 2001
From: andgrankin <andgrankin@gmail.com>
Date: Wed, 26 Sep 2018 22:43:17 +0700
Subject: [PATCH 05/54] Update documentation

Update documentation for methods set_coupon_discount_totals and set_coupon_discount_tax_totals
---
 includes/class-wc-cart.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/class-wc-cart.php b/includes/class-wc-cart.php
index 037a3817b21..6d26c0d6d52 100644
--- a/includes/class-wc-cart.php
+++ b/includes/class-wc-cart.php
@@ -401,7 +401,7 @@ class WC_Cart extends WC_Legacy_Cart {
 	}
 
 	/**
-	 * Return all calculated coupon totals.
+	 * Sets the array of calculated coupon totals.
 	 *
 	 * @since 3.2.0
 	 * @param array $value Value to set.
@@ -410,7 +410,7 @@ class WC_Cart extends WC_Legacy_Cart {
 		$this->coupon_discount_totals = (array) $value;
 	}
 	/**
-	 * Return all calculated coupon tax totals.
+	 * Sets the array of calculated coupon tax totals.
 	 *
 	 * @since 3.2.0
 	 * @param array $value Value to set.

From d4484f3a4bcbe797f39b5e6a3ea87dc8f01d5612 Mon Sep 17 00:00:00 2001
From: David Garcia Watkins <david.g@onthegosystems.com>
Date: Thu, 27 Sep 2018 19:51:10 +0200
Subject: [PATCH 06/54] The orderby=ID argument needs to be uppercase.

---
 includes/class-wc-query.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/includes/class-wc-query.php b/includes/class-wc-query.php
index 5084ee96795..0eeacb4b6c0 100644
--- a/includes/class-wc-query.php
+++ b/includes/class-wc-query.php
@@ -459,6 +459,9 @@ class WC_Query {
 		);
 
 		switch ( $orderby ) {
+			case 'id':
+				$args['orderby'] = 'ID';
+				break;
 			case 'menu_order':
 				$args['orderby'] = 'menu_order title';
 				break;

From 819d03fe3f77cffb64664636b40e64ef747a0d57 Mon Sep 17 00:00:00 2001
From: Claudio Sanches <contato@claudiosanches.com>
Date: Fri, 28 Sep 2018 12:52:21 -0300
Subject: [PATCH 07/54] Updated "--" to "&mdash;"

Closes #21460
---
 readme.txt                                           | 10 +++++-----
 templates/emails/admin-cancelled-order.php           |  2 +-
 templates/emails/customer-processing-order.php       |  2 +-
 templates/emails/plain/admin-cancelled-order.php     |  2 +-
 templates/emails/plain/customer-processing-order.php |  2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/readme.txt b/readme.txt
index a47b9feaa36..ccaf54692fe 100644
--- a/readme.txt
+++ b/readme.txt
@@ -13,7 +13,7 @@ WooCommerce is a powerful, extendable eCommerce plugin that helps you sell anyth
 
 WooCommerce is a free eCommerce plugin that allows you to sell anything, beautifully. Built to integrate seamlessly with WordPress, WooCommerce is the world’s favorite eCommerce solution that gives both store owners and developers complete control.
 
-With endless flexibility and access to hundreds of free and premium WordPress extensions, WooCommerce now powers 30% of all online stores -- more than any other platform.
+With endless flexibility and access to hundreds of free and premium WordPress extensions, WooCommerce now powers 30% of all online stores &mdash; more than any other platform.
 
 [youtube https://www.youtube.com/watch?v=1KahlicghaE]
 
@@ -28,10 +28,10 @@ Offer free shipping, flat rate shipping, or make real-time calculations. Limit y
 = Extensive payment options =
 WooCommerce comes bundled with the ability to accept major credit cards, PayPal, BACS (bank transfers), and cash on delivery. Need additional options? More than 140 region-specific gateways integrate with WooCommerce, including popular choices like Stripe, Authorize.Net, and Amazon Payments.
 
-= You control it all -- forever =
+= You control it all &mdash; forever =
 WooCommerce gives you complete control of your store, from taxes to stock levels to customer accounts. Add and remove extensions, change your design, and switch settings as you please. It’s all under your control.
 
-One of the biggest risks of using a hosted eCommerce platform is what happens to your store if the provider closes up shop. With WooCommerce, you have complete control, so there’s never any reason to worry. Your data belongs to you -- and it’s kept secure, thanks to regular audits by industry leaders.
+One of the biggest risks of using a hosted eCommerce platform is what happens to your store if the provider closes up shop. With WooCommerce, you have complete control, so there’s never any reason to worry. Your data belongs to you &mdash; and it’s kept secure, thanks to regular audits by industry leaders.
 
 = Define your style with Storefront =
 
@@ -41,11 +41,11 @@ Define your style even further by customizing Storefront to your liking or choos
 
 = Built with developers in mind =
 
-Extendable, adaptable, and open source -- WooCommerce was created with developers in mind. With its strong, robust framework, you can scale your client’s store all the way from basic to high-end (infinity and beyond).
+Extendable, adaptable, and open source &mdash; WooCommerce was created with developers in mind. With its strong, robust framework, you can scale your client’s store all the way from basic to high-end (infinity and beyond).
 
 Built with a REST API, WooCommerce can integrate with virtually any service. Your store’s data can be accessed anywhere, anytime, 100% securely. WooCommerce allows developers to easily create, modify, and grow a store that meets their specifications.
 
-No matter the size of the store you want to build, WooCommerce will scale to meet your requirements. With a growing collection of more than 300 extensions, you can enhance each store’s features to meet your client’s unique needs -- or even create your own solution.
+No matter the size of the store you want to build, WooCommerce will scale to meet your requirements. With a growing collection of more than 300 extensions, you can enhance each store’s features to meet your client’s unique needs &mdash; or even create your own solution.
 
 If security is a concern, rest easy. WooCommerce is audited by a dedicated team of developers working around the clock to identify and patch any and all discovered bugs.
 
diff --git a/templates/emails/admin-cancelled-order.php b/templates/emails/admin-cancelled-order.php
index a447dc9ec05..7073349157b 100644
--- a/templates/emails/admin-cancelled-order.php
+++ b/templates/emails/admin-cancelled-order.php
@@ -25,7 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 do_action( 'woocommerce_email_header', $email_heading, $email ); ?>
 
 <?php /* translators: %1$s: Customer full name. %2$s: Order numer */ ?>
-<p><?php printf( esc_html__( 'Alas. Just to let you know -- %1$s has cancelled order #%2$s:', 'woocommerce' ), esc_html( $order->get_formatted_billing_full_name() ), esc_html( $order->get_order_number() ) ); ?></p>
+<p><?php printf( esc_html__( 'Alas. Just to let you know &mdash; %1$s has cancelled order #%2$s:', 'woocommerce' ), esc_html( $order->get_formatted_billing_full_name() ), esc_html( $order->get_order_number() ) ); ?></p>
 
 <?php
 
diff --git a/templates/emails/customer-processing-order.php b/templates/emails/customer-processing-order.php
index 648e1e1c3ea..49383803bce 100644
--- a/templates/emails/customer-processing-order.php
+++ b/templates/emails/customer-processing-order.php
@@ -27,7 +27,7 @@ do_action( 'woocommerce_email_header', $email_heading, $email ); ?>
 <?php /* translators: %s: Customer first name */ ?>
 <p><?php printf( esc_html__( 'Hi %s,', 'woocommerce' ), esc_html( $order->get_billing_first_name() ) ); ?></p>
 <?php /* translators: %s: Order number */ ?>
-<p><?php printf( esc_html__( 'Just to let you know -- your payment has been confirmed, and order #%s is now being processed:', 'woocommerce' ), esc_html( $order->get_order_number() ) ); ?></p>
+<p><?php printf( esc_html__( 'Just to let you know &mdash; your payment has been confirmed, and order #%s is now being processed:', 'woocommerce' ), esc_html( $order->get_order_number() ) ); ?></p>
 
 <?php
 
diff --git a/templates/emails/plain/admin-cancelled-order.php b/templates/emails/plain/admin-cancelled-order.php
index a4c5c022d4c..acbf1c9d160 100644
--- a/templates/emails/plain/admin-cancelled-order.php
+++ b/templates/emails/plain/admin-cancelled-order.php
@@ -22,7 +22,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 echo '= ' . esc_html( $email_heading ) . " =\n\n";
 
 /* translators: %1$s: Customer full name. %2$s: Order numer */
-echo sprintf( esc_html__( 'Alas. Just to let you know -- %1$s has cancelled order #%2$s:', 'woocommerce' ), esc_html( $order->get_formatted_billing_full_name() ), esc_html( $order->get_order_number() ) ) . "\n\n";
+echo sprintf( esc_html__( 'Alas. Just to let you know &mdash; %1$s has cancelled order #%2$s:', 'woocommerce' ), esc_html( $order->get_formatted_billing_full_name() ), esc_html( $order->get_order_number() ) ) . "\n\n";
 
 echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n";
 
diff --git a/templates/emails/plain/customer-processing-order.php b/templates/emails/plain/customer-processing-order.php
index d32d663ee3f..4ea616b1e19 100644
--- a/templates/emails/plain/customer-processing-order.php
+++ b/templates/emails/plain/customer-processing-order.php
@@ -24,7 +24,7 @@ echo '= ' . esc_html( $email_heading ) . " =\n\n";
 /* translators: %s: Customer first name */
 echo sprintf( esc_html__( 'Hi %s,', 'woocommerce' ), esc_html( $order->get_billing_first_name() ) ) . "\n\n";
 /* translators: %s: Order number */
-echo sprintf( esc_html__( 'Just to let you know -- your payment has been confirmed, and order #%s is now being processed:', 'woocommerce' ), esc_html( $order->get_order_number() ) ) . "\n\n";
+echo sprintf( esc_html__( 'Just to let you know &mdash; your payment has been confirmed, and order #%s is now being processed:', 'woocommerce' ), esc_html( $order->get_order_number() ) ) . "\n\n";
 
 echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n";
 

From 7a55f67f47f27aff848fa5cfcc51792e1e4e6861 Mon Sep 17 00:00:00 2001
From: David Garcia Watkins <david.g@onthegosystems.com>
Date: Fri, 28 Sep 2018 18:46:05 +0200
Subject: [PATCH 08/54] Fix test

---
 tests/unit-tests/shortcodes/products.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/unit-tests/shortcodes/products.php b/tests/unit-tests/shortcodes/products.php
index 214f87469c4..f72453a2889 100644
--- a/tests/unit-tests/shortcodes/products.php
+++ b/tests/unit-tests/shortcodes/products.php
@@ -86,7 +86,7 @@ class WC_Test_Shortcode_Products extends WC_Unit_Test_Case {
 
 		// products shortcode with attributes.
 		$shortcode2 = new WC_Shortcode_Products( array(
-			'orderby' => 'id',
+			'orderby' => 'ID',
 			'order'   => 'DESC',
 		) );
 		$expected2  = array(
@@ -94,7 +94,7 @@ class WC_Test_Shortcode_Products extends WC_Unit_Test_Case {
 			'post_status'         => 'publish',
 			'ignore_sticky_posts' => true,
 			'no_found_rows'       => true,
-			'orderby'             => 'id',
+			'orderby'             => 'ID',
 			'order'               => 'DESC',
 			'posts_per_page'      => '-1',
 			'meta_query'          => $meta_query,

From 7aa730dfac957c55fa1afb62ed51c31d79c9fbeb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=B9=D1=80=D0=B0=D1=82=20=D0=A5=D0=B0=D0=BB=D0=B8?=
 =?UTF-8?q?=D1=82=D0=BE=D0=B2?= <airat.halitov@gmail.com>
Date: Sat, 29 Sep 2018 03:54:27 +0500
Subject: [PATCH 09/54] Delete ISSUE_TEMPLATE.md

---
 .github/ISSUE_TEMPLATE.md | 48 ---------------------------------------
 1 file changed, 48 deletions(-)
 delete mode 100644 .github/ISSUE_TEMPLATE.md

diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
deleted file mode 100644
index 3019353697d..00000000000
--- a/.github/ISSUE_TEMPLATE.md
+++ /dev/null
@@ -1,48 +0,0 @@
-<!-- This form is for reporting bugs and issues specific to the WooCommerce plugin. This is not a support portal. If you need technical support from a human being, please submit a ticket via the helpdesk instead: https://woocommerce.com/contact-us/ -->
-
-<!-- Usage questions can also be directed to the public support forum here: https://wordpress.org/support/plugin/woocommerce, unless this is a question about a premium extension in which case you should use the helpdesk. -->
-
-<!-- If you have a feature request, submit it to: http://ideas.woocommerce.com/forums/133476-woocommerce -->
-
-<!-- If you are a developer who needs a new filter/hook raise a PR instead :) -->
-
-<!-- Please be as descriptive as possible; issues lacking the below details, or for any other reason than to report a bug, may be closed without action. -->
-
-## Prerequisites
-
-<!-- MARK COMPLETED ITEMS WITH AN [x] -->
-
-- [ ] I have searched for similar issues in both open and closed tickets and cannot find a duplicate
-- [ ] The issue still exists against the latest `master` branch of WooCommerce on Github (this is **not** the same version as on WordPress.org!)
-- [ ] I have attempted to find the simplest possible steps to reproduce the issue
-- [ ] I have included a failing test as a pull request (Optional)
-
-## Steps to reproduce the issue
-
-<!-- We need to be able to reproduce the bug in order to fix it so please be descriptive! -->
-
-1.
-2.
-3.
-
-## Expected/actual behavior
-
-When I follow those steps, I see...
-
-I was expecting to see...
-
-## Isolating the problem
-
-<!-- MARK COMPLETED ITEMS WITH AN [x] -->
-
-- [ ] This bug happens with only WooCommerce plugin active
-- [ ] This bug happens with a default WordPress theme active, or [Storefront](https://woocommerce.com/storefront/)
-- [ ] I can reproduce this bug consistently using the steps above
-
-## WordPress Environment
-
-<details>
-```
-Copy and paste the system status report from **WooCommerce > System Status** in WordPress admin here.
-```
-</details>

From f3909c00e8b5e168377f2785c2ca7408b99798c1 Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Mon, 1 Oct 2018 09:08:18 -0300
Subject: [PATCH 10/54] fix/add exceptions for existing coding standard
 violations

---
 templates/checkout/payment-method.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index 5f07bdafa32..67822e470fe 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -10,9 +10,9 @@
  * happen. When this occurs the version of the template file will be bumped and
  * the readme will list any important changes.
  *
- * @see 	    https://docs.woocommerce.com/document/template-structure/
- * @author 		WooThemes
- * @package 	WooCommerce/Templates
+ * @see         https://docs.woocommerce.com/document/template-structure/
+ * @author      WooThemes
+ * @package     WooCommerce/Templates
  * @version     2.3.0
  */
 
@@ -24,10 +24,10 @@ if ( ! defined( 'ABSPATH' ) ) {
 	<input id="payment_method_<?php echo esc_attr( $gateway->id ); ?>" type="radio" class="input-radio" name="payment_method" value="<?php echo esc_attr( $gateway->id ); ?>" <?php checked( $gateway->chosen, true ); ?> data-order_button_text="<?php echo esc_attr( $gateway->order_button_text ); ?>" />
 
 	<label for="payment_method_<?php echo esc_attr( $gateway->id ); ?>">
-		<?php echo $gateway->get_title(); ?> <?php echo $gateway->get_icon(); ?>
+		<?php echo $gateway->get_title(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */?> <?php echo $gateway->get_icon(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */?>
 	</label>
 	<?php if ( $gateway->has_fields() || $gateway->get_description() ) : ?>
-		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : ?>style="display:none;"<?php endif; ?>>
+		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore WordPress.WhiteSpace.ControlStructureSpacing */?>style="display:none;"<?php endif; ?>>
 			<?php $gateway->payment_fields(); ?>
 		</div>
 	<?php endif; ?>

From cdf036454fc8b87b102bf0d2ea0fbcabcd8e3bbd Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Mon, 1 Oct 2018 22:02:06 -0300
Subject: [PATCH 11/54] add spaces, remove @author, change control structure

---
 templates/checkout/payment-method.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index 67822e470fe..f3d44296e7f 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -11,7 +11,6 @@
  * the readme will list any important changes.
  *
  * @see         https://docs.woocommerce.com/document/template-structure/
- * @author      WooThemes
  * @package     WooCommerce/Templates
  * @version     2.3.0
  */
@@ -24,10 +23,10 @@ if ( ! defined( 'ABSPATH' ) ) {
 	<input id="payment_method_<?php echo esc_attr( $gateway->id ); ?>" type="radio" class="input-radio" name="payment_method" value="<?php echo esc_attr( $gateway->id ); ?>" <?php checked( $gateway->chosen, true ); ?> data-order_button_text="<?php echo esc_attr( $gateway->order_button_text ); ?>" />
 
 	<label for="payment_method_<?php echo esc_attr( $gateway->id ); ?>">
-		<?php echo $gateway->get_title(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */?> <?php echo $gateway->get_icon(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */?>
+		<?php echo $gateway->get_title(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?> <?php echo $gateway->get_icon(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?>
 	</label>
 	<?php if ( $gateway->has_fields() || $gateway->get_description() ) : ?>
-		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore WordPress.WhiteSpace.ControlStructureSpacing */?>style="display:none;"<?php endif; ?>>
+		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>style="display:none;"<?php endif; ?>>
 			<?php $gateway->payment_fields(); ?>
 		</div>
 	<?php endif; ?>

From e4c3966852206fe9523f3e18b33bd1df803bbb36 Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Tue, 2 Oct 2018 08:46:16 -0300
Subject: [PATCH 12/54] add second phpcs: ignore

---
 templates/checkout/payment-method.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index f3d44296e7f..c4b2558c7ed 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 		<?php echo $gateway->get_title(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?> <?php echo $gateway->get_icon(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?>
 	</label>
 	<?php if ( $gateway->has_fields() || $gateway->get_description() ) : ?>
-		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>style="display:none;"<?php endif; ?>>
+		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>style="display:none;"<?php endif; /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>>
 			<?php $gateway->payment_fields(); ?>
 		</div>
 	<?php endif; ?>

From 8c893b21126fa6c1e8fd489619af4460f5011c60 Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Tue, 2 Oct 2018 14:38:12 -0300
Subject: [PATCH 13/54] use correct rule name in ignore

---
 templates/checkout/payment-method.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index c4b2558c7ed..94cbfe7ed4b 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 		<?php echo $gateway->get_title(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?> <?php echo $gateway->get_icon(); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?>
 	</label>
 	<?php if ( $gateway->has_fields() || $gateway->get_description() ) : ?>
-		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>style="display:none;"<?php endif; /* phpcs:ignore ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>>
+		<div class="payment_box payment_method_<?php echo esc_attr( $gateway->id ); ?>" <?php if ( ! $gateway->chosen ) : /* phpcs:ignore Squiz.ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>style="display:none;"<?php endif; /* phpcs:ignore Squiz.ControlStructures.ControlSignature.NewlineAfterOpenBrace */ ?>>
 			<?php $gateway->payment_fields(); ?>
 		</div>
 	<?php endif; ?>

From 357d47a28c3652c91ad45e52d4a45c7371822bee Mon Sep 17 00:00:00 2001
From: Ron Rennick <ron@ronandandrea.com>
Date: Wed, 3 Oct 2018 12:05:12 -0300
Subject: [PATCH 14/54] update template version

---
 templates/checkout/payment-method.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/checkout/payment-method.php b/templates/checkout/payment-method.php
index 94cbfe7ed4b..0e8a654508a 100644
--- a/templates/checkout/payment-method.php
+++ b/templates/checkout/payment-method.php
@@ -12,7 +12,7 @@
  *
  * @see         https://docs.woocommerce.com/document/template-structure/
  * @package     WooCommerce/Templates
- * @version     2.3.0
+ * @version     3.5.0
  */
 
 if ( ! defined( 'ABSPATH' ) ) {

From b0b2b34884462a336f85f42f3668093493d26aea Mon Sep 17 00:00:00 2001
From: JD <thiscouldbejd@users.noreply.github.com>
Date: Wed, 3 Oct 2018 16:40:49 +0100
Subject: [PATCH 15/54] Avoid treating HTTP 301 and 302 Codes as Failures

As per:

https://github.com/woocommerce/woocommerce/issues/21490

Change the definition of a Webhook Delivery Failure to exclude HTTP/301 and HTTP/302 responses. This allows webhook handlers (such as Google Apps Script) to avoid breaching failure limits and disabling webhooks.
---
 includes/class-wc-webhook.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/includes/class-wc-webhook.php b/includes/class-wc-webhook.php
index bf4cf9dc1c8..1bd278ff010 100644
--- a/includes/class-wc-webhook.php
+++ b/includes/class-wc-webhook.php
@@ -442,7 +442,8 @@ class WC_Webhook extends WC_Legacy_Webhook {
 		);
 
 		// Track failures.
-		if ( intval( $response_code ) >= 200 && intval( $response_code ) < 300 ) {
+		// Check for a success, which is a 2xx, 301 or 302 Response Code
+		if ( intval( $response_code ) >= 200 && intval( $response_code ) < 303 ) {
 			$this->set_failure_count( 0 );
 			$this->save();
 		} else {

From 84e5de5eef8e0ce6a5c567e9be7bac41ea16f12d Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Wed, 3 Oct 2018 14:31:35 -0400
Subject: [PATCH 16/54] Add address_1 to shipping packages info

---
 includes/class-wc-cart.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/includes/class-wc-cart.php b/includes/class-wc-cart.php
index 6d26c0d6d52..1b3c3fda2be 100644
--- a/includes/class-wc-cart.php
+++ b/includes/class-wc-cart.php
@@ -1317,6 +1317,7 @@ class WC_Cart extends WC_Legacy_Cart {
 						'postcode'  => $this->get_customer()->get_shipping_postcode(),
 						'city'      => $this->get_customer()->get_shipping_city(),
 						'address'   => $this->get_customer()->get_shipping_address(),
+						'address_1' => $this->get_customer()->get_shipping_address(), // Provide both address and address_1 for backwards compatibility.
 						'address_2' => $this->get_customer()->get_shipping_address_2(),
 					),
 					'cart_subtotal'   => $this->get_displayed_subtotal(),

From 1716538617dfbaa37f121f4ff02c455a1d4028de Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Wed, 3 Oct 2018 15:43:11 -0400
Subject: [PATCH 17/54] Prevent duplicate actions from firing in shipping
 settings

---
 includes/admin/settings/class-wc-settings-shipping.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/includes/admin/settings/class-wc-settings-shipping.php b/includes/admin/settings/class-wc-settings-shipping.php
index efc2d90c9a0..797551b0925 100644
--- a/includes/admin/settings/class-wc-settings-shipping.php
+++ b/includes/admin/settings/class-wc-settings-shipping.php
@@ -174,8 +174,11 @@ class WC_Settings_Shipping extends WC_Settings_Page {
 		switch ( $current_section ) {
 			case 'options':
 				WC_Admin_Settings::save_fields( $this->get_settings() );
+				do_action( 'woocommerce_update_options_' . $this->id . '_options' );
 				break;
 			case 'classes':
+				do_action( 'woocommerce_update_options_' . $this->id . '_classes' );
+				break;
 			case '':
 				break;
 			default:
@@ -189,10 +192,6 @@ class WC_Settings_Shipping extends WC_Settings_Page {
 				break;
 		}
 
-		if ( $current_section ) {
-			do_action( 'woocommerce_update_options_' . $this->id . '_' . $current_section );
-		}
-
 		// Increments the transient version to invalidate cache.
 		WC_Cache_Helper::get_transient_version( 'shipping', true );
 	}

From 0871ad86272bdaaa533edde8e35d45479a72d9b4 Mon Sep 17 00:00:00 2001
From: JD <thiscouldbejd@users.noreply.github.com>
Date: Wed, 3 Oct 2018 21:38:53 +0100
Subject: [PATCH 18/54] Update class-wc-webhook.php

---
 includes/class-wc-webhook.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/class-wc-webhook.php b/includes/class-wc-webhook.php
index 1bd278ff010..5306f6e1b7e 100644
--- a/includes/class-wc-webhook.php
+++ b/includes/class-wc-webhook.php
@@ -442,7 +442,7 @@ class WC_Webhook extends WC_Legacy_Webhook {
 		);
 
 		// Track failures.
-		// Check for a success, which is a 2xx, 301 or 302 Response Code
+		// Check for a success, which is a 2xx, 301 or 302 Response Code.
 		if ( intval( $response_code ) >= 200 && intval( $response_code ) < 303 ) {
 			$this->set_failure_count( 0 );
 			$this->save();

From 4e636b4b31ba9b3046e668729a3bc38d43fab0a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Demarle?= <frederic.demarle@yahoo.fr>
Date: Thu, 4 Oct 2018 21:00:52 +0200
Subject: [PATCH 19/54] Fix payment url in plain customer invoice email

---
 templates/emails/plain/customer-invoice.php | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/templates/emails/plain/customer-invoice.php b/templates/emails/plain/customer-invoice.php
index 890f364d2fb..24c6376e257 100644
--- a/templates/emails/plain/customer-invoice.php
+++ b/templates/emails/plain/customer-invoice.php
@@ -26,17 +26,10 @@ echo sprintf( esc_html__( 'Hi %s,', 'woocommerce' ), esc_html( $order->get_billi
 
 if ( $order->has_status( 'pending' ) ) {
 	echo sprintf(
-		wp_kses(
-			/* translators: %1$s Site title, %2$s Order pay link */
-			__( 'An order has been created for you on %1$s. Your invoice is below, with a link to make payment when you’re ready: %1$s', 'woocommerce' ),
-			array(
-				'a' => array(
-					'href' => array(),
-				),
-			)
-		),
+		/* translators: %1$s Site title, %2$s Order pay link */
+		__( 'An order has been created for you on %1$s. Your invoice is below, with a link to make payment when you’re ready: %2$s', 'woocommerce' ),
 		esc_html( get_bloginfo( 'name', 'display' ) ),
-		'<a href="' . esc_url( $order->get_checkout_payment_url() ) . '">' . esc_html__( 'Pay for this order', 'woocommerce' ) . '</a>'
+		esc_url( $order->get_checkout_payment_url() )
 	) . "\n\n";
 
 } else {

From c3b76a38f71e2d551ecde657d1e89932238154a5 Mon Sep 17 00:00:00 2001
From: Steve Grunwell <steve@stevegrunwell.com>
Date: Sat, 6 Oct 2018 18:05:34 +0000
Subject: [PATCH 20/54] Add a test for handling errors during order status
 transitions

---
 .../order/class-wc-tests-crud-orders.php      | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/unit-tests/order/class-wc-tests-crud-orders.php b/tests/unit-tests/order/class-wc-tests-crud-orders.php
index 3a309b269c3..dc7da4ea03e 100644
--- a/tests/unit-tests/order/class-wc-tests-crud-orders.php
+++ b/tests/unit-tests/order/class-wc-tests-crud-orders.php
@@ -944,6 +944,28 @@ class WC_Tests_CRUD_Orders extends WC_Unit_Test_Case {
 		remove_filter( 'woocommerce_payment_complete_order_status', array( $this, 'throwAnException' ) );
 	}
 
+	/**
+	 * Test: status_transition
+	 */
+	public function test_status_transition_handles_transition_errors() {
+		$object = new WC_Order();
+		$object->save();
+
+		add_filter( 'woocommerce_order_status_on-hold', array( $this, 'throwAnException' ) );
+		$object->update_status( 'on-hold' );
+		remove_filter( 'woocommerce_order_status_on-hold', array( $this, 'throwAnException' ) );
+
+		$note = current(
+			wc_get_order_notes(
+				array(
+					'order_id' => $object->get_id(),
+				)
+			)
+		);
+
+		$this->assertContains( __( 'Error during status transition.', 'woocommerce' ), $note->content );
+	}
+
 	/**
 	 * Test: get_billing_first_name
 	 */

From bdf406eb1e6829b396e969dcdf3efb131c226a76 Mon Sep 17 00:00:00 2001
From: Scott C Wilson <scottcwilson@gmail.com>
Date: Tue, 9 Oct 2018 07:34:54 -0400
Subject: [PATCH 21/54] Fixes #21363 Recommends using assertSame rather than
 assertEquals

---
 tests/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/README.md b/tests/README.md
index e77403038e8..feddd0d7560 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -44,7 +44,7 @@ A text code coverage summary can be displayed using the `--coverage-text` option
 * Use the test coverage HTML report (under `tmp/coverage/index.html`) to examine which lines your tests are covering and aim for 100% coverage
 * For code that cannot be tested (e.g. they require a certain PHP version), you can exclude them from coverage using a comment: `// @codeCoverageIgnoreStart` and `// @codeCoverageIgnoreEnd`. For example, see [`wc_round_tax_total()`](https://github.com/woocommerce/woocommerce/blob/35f83867736713955fa2c4f463a024578bb88795/includes/wc-formatting-functions.php#L208-L219)
 * In addition to covering each line of a method/function, make sure to test common input and edge cases.
-* Prefer `assertsEquals()` where possible as it tests both type & equality
+* Prefer `assertSame()` where possible as it tests both type & equality
 * Remember that only methods prefixed with `test` will be run so use helper methods liberally to keep test methods small and reduce code duplication. If there is a common helper method used in multiple test files, consider adding it to the `WC_Unit_Test_Case` class so it can be shared by all test cases
 * Filters persist between test cases so be sure to remove them in your test method or in the `tearDown()` method.
 * Use data providers where possible. Be sure that their name is like `data_provider_function_to_test` (i.e. the data provider for `test_is_postcode` would be `data_provider_test_is_postcode`). Read more about data providers [here](https://phpunit.de/manual/current/en/writing-tests-for-phpunit.html#writing-tests-for-phpunit.data-providers).

From 9d327ac52e9d3a6fa6bf6c095de6218d3e1e319f Mon Sep 17 00:00:00 2001
From: AmanS <aman@tact9.in>
Date: Wed, 10 Oct 2018 00:28:15 +0530
Subject: [PATCH 22/54] WC Refund class older name 'WC_Refund' somehow left
 over in the function docblock. Corrected to WC_Order_Refund.

---
 includes/wc-order-functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/wc-order-functions.php b/includes/wc-order-functions.php
index ee68ae42d6b..75ae8c08d3a 100644
--- a/includes/wc-order-functions.php
+++ b/includes/wc-order-functions.php
@@ -73,7 +73,7 @@ function wc_get_orders( $args ) {
  *
  * @param  mixed $the_order Post object or post ID of the order.
  *
- * @return bool|WC_Order|WC_Refund
+ * @return bool|WC_Order|WC_Order_Refund
  */
 function wc_get_order( $the_order = false ) {
 	if ( ! did_action( 'woocommerce_after_register_post_type' ) ) {

From 7e17be74d91b536500641eea28824dd191461a0d Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Wed, 10 Oct 2018 12:14:25 -0700
Subject: [PATCH 23/54] Fix db log handler cleanup

---
 includes/log-handlers/class-wc-log-handler-db.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/log-handlers/class-wc-log-handler-db.php b/includes/log-handlers/class-wc-log-handler-db.php
index e654eb92b80..d47d850cc1b 100644
--- a/includes/log-handlers/class-wc-log-handler-db.php
+++ b/includes/log-handlers/class-wc-log-handler-db.php
@@ -146,8 +146,8 @@ class WC_Log_Handler_DB extends WC_Log_Handler {
 
 		$wpdb->query(
 			$wpdb->prepare(
-				"DELETE FROM {$wpdb->prefix}woocommerce_log WHERE timestamp < %d",
-				$timestamp
+				"DELETE FROM {$wpdb->prefix}woocommerce_log WHERE timestamp < %s",
+				date( 'Y-m-d H:i:s', $timestamp )
 			)
 		);
 	}

From 12279989bd40bde18c99bf187b2d8f760039c45e Mon Sep 17 00:00:00 2001
From: unknown <way.h3ming@gmail.com>
Date: Thu, 11 Oct 2018 15:47:35 +0300
Subject: [PATCH 24/54] Fix cart notice position

---
 includes/wc-template-hooks.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/wc-template-hooks.php b/includes/wc-template-hooks.php
index b37c7803563..a606bce240c 100644
--- a/includes/wc-template-hooks.php
+++ b/includes/wc-template-hooks.php
@@ -292,7 +292,7 @@ add_action( 'woocommerce_register_form', 'wc_registration_privacy_policy_text',
 /**
  * Notices.
  */
-add_action( 'woocommerce_cart_is_empty', 'woocommerce_output_all_notices', 10 );
+add_action( 'woocommerce_cart_is_empty', 'woocommerce_output_all_notices', 5 );
 add_action( 'woocommerce_shortcode_before_product_cat_loop', 'woocommerce_output_all_notices', 10 );
 add_action( 'woocommerce_before_shop_loop', 'woocommerce_output_all_notices', 10 );
 add_action( 'woocommerce_before_single_product', 'woocommerce_output_all_notices', 10 );

From af32bfe3291eaa717af5ac6191831a5a5788d948 Mon Sep 17 00:00:00 2001
From: Rodrigo Primo <rodrigosprimo@gmail.com>
Date: Thu, 11 Oct 2018 15:10:46 -0300
Subject: [PATCH 25/54] Fix phpcs violations automatically using phpcbf

---
 tests/unit-tests/log/log-handler-db.php | 86 +++++++++++++------------
 1 file changed, 46 insertions(+), 40 deletions(-)

diff --git a/tests/unit-tests/log/log-handler-db.php b/tests/unit-tests/log/log-handler-db.php
index 939d323dff8..1c2041b3ca4 100644
--- a/tests/unit-tests/log/log-handler-db.php
+++ b/tests/unit-tests/log/log-handler-db.php
@@ -25,8 +25,14 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 		global $wpdb;
 
 		$handler = new WC_Log_Handler_DB( array( 'threshold' => 'debug' ) );
-		$time = time();
-		$context = array( 1, 2, 'a', 'b', 'key' => 'value' );
+		$time    = time();
+		$context = array(
+			1,
+			2,
+			'a',
+			'b',
+			'key' => 'value',
+		);
 
 		$handler->handle( $time, 'debug', 'msg_debug', array( 'source' => 'source_debug' ) );
 		$handler->handle( $time, 'info', 'msg_info', array( 'source' => 'source_info' ) );
@@ -42,69 +48,69 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 		$log_entries = $wpdb->get_results( "SELECT timestamp, level, message, source, context FROM {$wpdb->prefix}woocommerce_log", ARRAY_A );
 
 		$expected_ts = date( 'Y-m-d H:i:s', $time );
-		$expected = array(
+		$expected    = array(
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'debug' ),
-				'message' => 'msg_debug',
-				'source' => 'source_debug',
-				'context' => serialize( array( 'source' => 'source_debug' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'debug' ),
+				'message'   => 'msg_debug',
+				'source'    => 'source_debug',
+				'context'   => serialize( array( 'source' => 'source_debug' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'info' ),
-				'message' => 'msg_info',
-				'source' => 'source_info',
-				'context' => serialize( array( 'source' => 'source_info' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'info' ),
+				'message'   => 'msg_info',
+				'source'    => 'source_info',
+				'context'   => serialize( array( 'source' => 'source_info' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'notice' ),
-				'message' => 'msg_notice',
-				'source' => 'source_notice',
-				'context' => serialize( array( 'source' => 'source_notice' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'notice' ),
+				'message'   => 'msg_notice',
+				'source'    => 'source_notice',
+				'context'   => serialize( array( 'source' => 'source_notice' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'warning' ),
-				'message' => 'msg_warning',
-				'source' => 'source_warning',
-				'context' => serialize( array( 'source' => 'source_warning' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'warning' ),
+				'message'   => 'msg_warning',
+				'source'    => 'source_warning',
+				'context'   => serialize( array( 'source' => 'source_warning' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'error' ),
-				'message' => 'msg_error',
-				'source' => 'source_error',
-				'context' => serialize( array( 'source' => 'source_error' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'error' ),
+				'message'   => 'msg_error',
+				'source'    => 'source_error',
+				'context'   => serialize( array( 'source' => 'source_error' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'critical' ),
-				'message' => 'msg_critical',
-				'source' => 'source_critical',
-				'context' => serialize( array( 'source' => 'source_critical' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'critical' ),
+				'message'   => 'msg_critical',
+				'source'    => 'source_critical',
+				'context'   => serialize( array( 'source' => 'source_critical' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'alert' ),
-				'message' => 'msg_alert',
-				'source' => 'source_alert',
-				'context' => serialize( array( 'source' => 'source_alert' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'alert' ),
+				'message'   => 'msg_alert',
+				'source'    => 'source_alert',
+				'context'   => serialize( array( 'source' => 'source_alert' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'emergency' ),
-				'message' => 'msg_emergency',
-				'source' => 'source_emergency',
-				'context' => serialize( array( 'source' => 'source_emergency' ) ),
+				'level'     => WC_Log_Levels::get_level_severity( 'emergency' ),
+				'message'   => 'msg_emergency',
+				'source'    => 'source_emergency',
+				'context'   => serialize( array( 'source' => 'source_emergency' ) ),
 			),
 			array(
 				'timestamp' => $expected_ts,
-				'level' => WC_Log_Levels::get_level_severity( 'debug' ),
-				'message' => 'context_test',
-				'source' => pathinfo( __FILE__, PATHINFO_FILENAME ),
-				'context' => serialize( $context ),
+				'level'     => WC_Log_Levels::get_level_severity( 'debug' ),
+				'message'   => 'context_test',
+				'source'    => pathinfo( __FILE__, PATHINFO_FILENAME ),
+				'context'   => serialize( $context ),
 			),
 		);
 
@@ -121,7 +127,7 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 		global $wpdb;
 
 		$handler = new WC_Log_Handler_DB( array( 'threshold' => 'debug' ) );
-		$time = time();
+		$time    = time();
 
 		$handler->handle( $time, 'debug', '', array() );
 

From 402144893b829ef68e4236a93a277e138480ba12 Mon Sep 17 00:00:00 2001
From: Rodrigo Primo <rodrigosprimo@gmail.com>
Date: Thu, 11 Oct 2018 15:11:28 -0300
Subject: [PATCH 26/54] Remove unnecessary code to cleanup tests

WP test case cleans the database automatically after each test so there is no need to do it automatically.
---
 tests/unit-tests/log/log-handler-db.php | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/tests/unit-tests/log/log-handler-db.php b/tests/unit-tests/log/log-handler-db.php
index 1c2041b3ca4..70aec995680 100644
--- a/tests/unit-tests/log/log-handler-db.php
+++ b/tests/unit-tests/log/log-handler-db.php
@@ -6,16 +6,6 @@
  * @since 3.0.0
  */
 class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
-	public function setUp() {
-		parent::setUp();
-		WC_Log_Handler_DB::flush();
-	}
-
-	public function tearDown() {
-		WC_Log_Handler_DB::flush();
-		parent::tearDown();
-	}
-
 	/**
 	 * Test handle writes to database correctly.
 	 *

From 2a08fa3a7b6f83ec7a685b91b3786db2571292d5 Mon Sep 17 00:00:00 2001
From: Rodrigo Primo <rodrigosprimo@gmail.com>
Date: Thu, 11 Oct 2018 15:25:12 -0300
Subject: [PATCH 27/54] Add test to check
 WC_Log_Handler_DB::delete_logs_before_timestamp() basic functionality

---
 tests/unit-tests/log/log-handler-db.php | 43 +++++++++++++++++--------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/tests/unit-tests/log/log-handler-db.php b/tests/unit-tests/log/log-handler-db.php
index 70aec995680..ad776f778bf 100644
--- a/tests/unit-tests/log/log-handler-db.php
+++ b/tests/unit-tests/log/log-handler-db.php
@@ -6,6 +6,12 @@
  * @since 3.0.0
  */
 class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
+	public function setUp() {
+		parent::setUp();
+
+		$this->handler = new WC_Log_Handler_DB( array( 'threshold' => 'debug' ) );
+	}
+
 	/**
 	 * Test handle writes to database correctly.
 	 *
@@ -14,7 +20,6 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 	public function test_handle() {
 		global $wpdb;
 
-		$handler = new WC_Log_Handler_DB( array( 'threshold' => 'debug' ) );
 		$time    = time();
 		$context = array(
 			1,
@@ -24,16 +29,16 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 			'key' => 'value',
 		);
 
-		$handler->handle( $time, 'debug', 'msg_debug', array( 'source' => 'source_debug' ) );
-		$handler->handle( $time, 'info', 'msg_info', array( 'source' => 'source_info' ) );
-		$handler->handle( $time, 'notice', 'msg_notice', array( 'source' => 'source_notice' ) );
-		$handler->handle( $time, 'warning', 'msg_warning', array( 'source' => 'source_warning' ) );
-		$handler->handle( $time, 'error', 'msg_error', array( 'source' => 'source_error' ) );
-		$handler->handle( $time, 'critical', 'msg_critical', array( 'source' => 'source_critical' ) );
-		$handler->handle( $time, 'alert', 'msg_alert', array( 'source' => 'source_alert' ) );
-		$handler->handle( $time, 'emergency', 'msg_emergency', array( 'source' => 'source_emergency' ) );
+		$this->handler->handle( $time, 'debug', 'msg_debug', array( 'source' => 'source_debug' ) );
+		$this->handler->handle( $time, 'info', 'msg_info', array( 'source' => 'source_info' ) );
+		$this->handler->handle( $time, 'notice', 'msg_notice', array( 'source' => 'source_notice' ) );
+		$this->handler->handle( $time, 'warning', 'msg_warning', array( 'source' => 'source_warning' ) );
+		$this->handler->handle( $time, 'error', 'msg_error', array( 'source' => 'source_error' ) );
+		$this->handler->handle( $time, 'critical', 'msg_critical', array( 'source' => 'source_critical' ) );
+		$this->handler->handle( $time, 'alert', 'msg_alert', array( 'source' => 'source_alert' ) );
+		$this->handler->handle( $time, 'emergency', 'msg_emergency', array( 'source' => 'source_emergency' ) );
 
-		$handler->handle( $time, 'debug', 'context_test', $context );
+		$this->handler->handle( $time, 'debug', 'context_test', $context );
 
 		$log_entries = $wpdb->get_results( "SELECT timestamp, level, message, source, context FROM {$wpdb->prefix}woocommerce_log", ARRAY_A );
 
@@ -116,10 +121,9 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 	public function test_flush() {
 		global $wpdb;
 
-		$handler = new WC_Log_Handler_DB( array( 'threshold' => 'debug' ) );
-		$time    = time();
+		$time = time();
 
-		$handler->handle( $time, 'debug', '', array() );
+		$this->handler->handle( $time, 'debug', '', array() );
 
 		$log_entries = $wpdb->get_results( "SELECT timestamp, level, message, source FROM {$wpdb->prefix}woocommerce_log" );
 		$this->assertCount( 1, $log_entries );
@@ -130,4 +134,17 @@ class WC_Tests_Log_Handler_DB extends WC_Unit_Test_Case {
 		$this->assertCount( 0, $log_entries );
 	}
 
+	public function test_delete_logs_before_timestamp() {
+		global $wpdb;
+
+		$time = time();
+		$this->handler->handle( $time, 'debug', '', array() );
+		$this->handler->handle( $time - 10, 'debug', '', array() );
+
+		$this->handler->delete_logs_before_timestamp( $time );
+
+		$log_count = $wpdb->get_var( "SELECT count(*) FROM {$wpdb->prefix}woocommerce_log" );
+		$this->assertEquals( 1, $log_count );
+	}
+
 }

From 88d506bac01be521e5b107bb0c1c854259e35c88 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 31 Aug 2018 12:24:55 -0700
Subject: [PATCH 28/54] Dont do abspath file_exists check on urls that start
 with // since those are remote urls and not local urls

---
 includes/class-wc-download-handler.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/class-wc-download-handler.php b/includes/class-wc-download-handler.php
index 8b1af51fe81..e39a466bc70 100644
--- a/includes/class-wc-download-handler.php
+++ b/includes/class-wc-download-handler.php
@@ -244,7 +244,7 @@ class WC_Download_Handler {
 		$remote_file      = true;
 
 		// See if path needs an abspath prepended to work.
-		if ( file_exists( ABSPATH . $file_path ) ) {
+		if ( '//' !== substr( $file_path, 0, 2 ) && file_exists( ABSPATH . $file_path ) ) {
 			$remote_file = false;
 			$file_path   = ABSPATH . $file_path;
 

From 989230f2b93659aa974c0042720462b5c4517d7c Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 31 Aug 2018 13:26:15 -0700
Subject: [PATCH 29/54] Refactor for increased safety

---
 includes/class-wc-download-handler.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/includes/class-wc-download-handler.php b/includes/class-wc-download-handler.php
index e39a466bc70..f16c23d8aed 100644
--- a/includes/class-wc-download-handler.php
+++ b/includes/class-wc-download-handler.php
@@ -243,8 +243,16 @@ class WC_Download_Handler {
 		$parsed_file_path = wp_parse_url( $file_path );
 		$remote_file      = true;
 
+		// Paths that begin with '//' are always remote URLs.
+		if ( '//' === substr( $file_path, 0, 2 ) ) {
+			return array(
+				'remote_file' => true,
+				'file_path'   => $file_path,
+			);
+		}
+
 		// See if path needs an abspath prepended to work.
-		if ( '//' !== substr( $file_path, 0, 2 ) && file_exists( ABSPATH . $file_path ) ) {
+		if ( file_exists( ABSPATH . $file_path ) ) {
 			$remote_file = false;
 			$file_path   = ABSPATH . $file_path;
 

From 441fe32f0be6197b7c6c3a794fa7da9595e6247a Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Tue, 18 Sep 2018 12:28:46 -0700
Subject: [PATCH 30/54] Add filetype checking for all files located on the
 server

---
 includes/class-wc-product-download.php        |  14 +-
 .../class-wc-tests-product-download.php       | 142 ++++++++++++++++++
 2 files changed, 155 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit-tests/product/class-wc-tests-product-download.php

diff --git a/includes/class-wc-product-download.php b/includes/class-wc-product-download.php
index 423197dc8ce..a4b9c7a74cc 100644
--- a/includes/class-wc-product-download.php
+++ b/includes/class-wc-product-download.php
@@ -87,7 +87,19 @@ class WC_Product_Download implements ArrayAccess {
 	 * @return boolean
 	 */
 	public function is_allowed_filetype() {
-		if ( 'relative' !== $this->get_type_of_file_path() ) {
+		$file_url = $this->get_file();
+
+		// File types for URL-based files located on the server should get validated.
+		$is_file_on_server = false;
+		if ( false !== stripos( $file_url, network_site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_url, network_site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_url, site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_url, site_url( '/', 'http' ) )
+		) {
+			$is_file_on_server = true;
+		}
+
+		if ( ! $is_file_on_server && 'relative' !== $this->get_type_of_file_path() ) {
 			return true;
 		}
 		return ! $this->get_file_extension() || in_array( $this->get_file_type(), $this->get_allowed_mime_types(), true );
diff --git a/tests/unit-tests/product/class-wc-tests-product-download.php b/tests/unit-tests/product/class-wc-tests-product-download.php
new file mode 100644
index 00000000000..a5e183a305b
--- /dev/null
+++ b/tests/unit-tests/product/class-wc-tests-product-download.php
@@ -0,0 +1,142 @@
+<?php
+/**
+ * Unit tests for the product download class.
+ *
+ * @package WooCommerce\Tests\Product
+ */
+
+/**
+ * WC_Product_Download tests.
+ *
+ * @package WooCommerce\Tests\Product
+ * @since 3.4.6
+ */
+class WC_Tests_Product_Download extends WC_Unit_Test_Case {
+
+	/**
+	 * Test the setters and getters.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_setters_getters() {
+		$download = new WC_Product_Download();
+		$download->set_id( 'testid' );
+		$download->set_name( 'Test Name' );
+		$download->set_file( 'http://example.com/file.jpg' );
+
+		$this->assertEquals( 'testid', $download->get_id() );
+		$this->assertEquals( 'Test Name', $download->get_name() );
+		$this->assertEquals( 'http://example.com/file.jpg', $download->get_file() );
+	}
+
+	/**
+	 * Test the get_allowed_mime_types method.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_get_allowed_mime_types() {
+		$download = new WC_Product_Download();
+		$this->assertEquals( get_allowed_mime_types(), $download->get_allowed_mime_types() );
+	}
+
+	/**
+	 * Test the get_type_of_file_path method.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_get_type_of_file_path() {
+		$download = new WC_Product_Download();
+
+		$this->assertEquals( 'absolute', $download->get_type_of_file_path( 'http://example.com/file.jpg' ) );
+		$this->assertEquals( 'absolute', $download->get_type_of_file_path( site_url( '/wp-content/uploads/test.jpg' ) ) );
+		$this->assertEquals( 'relative', $download->get_type_of_file_path( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/assets/images/help.png' ) );
+		$this->assertEquals( 'shortcode', $download->get_type_of_file_path( '[s3 bucket ="" file=""]' ) );
+	}
+
+	/**
+	 * Test the get_file_type method.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_get_file_type() {
+		$download = new WC_Product_Download();
+
+		$download->set_file( 'http://example.com/file.jpg' );
+		$this->assertEquals( 'image/jpeg', $download->get_file_type() );
+
+		$download->set_file( 'http://example.com/file.php' );
+		$this->assertEquals( '', $download->get_file_type() );
+
+		$download->set_file( 'http://example.com/file.php?ext=jpg' );
+		$this->assertEquals( '', $download->get_file_type() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/assets/images/help.png' ) );
+		$this->assertEquals( 'image/png', $download->get_file_type() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/woocommerce.php' ) );
+		$this->assertEquals( '', $download->get_file_type() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/assets/images/help.png' );
+		$this->assertEquals( 'image/png', $download->get_file_type() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/woocommerce.php' );
+		$this->assertEquals( false, $download->get_file_type() );
+	}
+
+	/**
+	 * Test the get_file_extension method.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_get_file_extension() {
+		$download = new WC_Product_Download();
+
+		$download->set_file( 'http://example.com/file.jpg' );
+		$this->assertEquals( 'jpg', $download->get_file_extension() );
+
+		$download->set_file( 'http://example.com/file.php' );
+		$this->assertEquals( 'php', $download->get_file_extension() );
+
+		$download->set_file( 'http://example.com/file.php?ext=jpg' );
+		$this->assertEquals( 'php', $download->get_file_extension() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/assets/images/help.png' ) );
+		$this->assertEquals( 'png', $download->get_file_extension() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/woocommerce.php' ) );
+		$this->assertEquals( 'php', $download->get_file_extension() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/assets/images/help.png' );
+		$this->assertEquals( 'png', $download->get_file_extension() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/woocommerce.php' );
+		$this->assertEquals( 'php', $download->get_file_extension() );
+	}
+
+	/**
+	 * Test the is_allowed_filetype method.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_is_allowed_filetype() {
+		$download = new WC_Product_Download();
+
+		$download->set_file( 'http://example.com/file.jpg' );
+		$this->assertEquals( true, $download->is_allowed_filetype() );
+
+		$download->set_file( 'http://example.com/file.php' );
+		$this->assertEquals( true, $download->is_allowed_filetype() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/assets/images/help.png' ) );
+		$this->assertEquals( true, $download->is_allowed_filetype() );
+
+		$download->set_file( site_url( '/wp-content/plugins/woocommerce/woocommerce.php' ) );
+		$this->assertEquals( false, $download->is_allowed_filetype() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/assets/images/help.png' );
+		$this->assertEquals( true, $download->is_allowed_filetype() );
+
+		$download->set_file( trailingslashit( WP_PLUGIN_DIR ) . 'woocommerce/woocommerce.php' );
+		$this->assertEquals( false, $download->is_allowed_filetype() );
+	}
+}

From e53e21d65fca1cc8b6b3d344ea542538f209aa88 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Tue, 18 Sep 2018 13:09:16 -0700
Subject: [PATCH 31/54] Better variable name

---
 includes/class-wc-product-download.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/includes/class-wc-product-download.php b/includes/class-wc-product-download.php
index a4b9c7a74cc..92099b69b78 100644
--- a/includes/class-wc-product-download.php
+++ b/includes/class-wc-product-download.php
@@ -87,14 +87,14 @@ class WC_Product_Download implements ArrayAccess {
 	 * @return boolean
 	 */
 	public function is_allowed_filetype() {
-		$file_url = $this->get_file();
+		$file_path = $this->get_file();
 
 		// File types for URL-based files located on the server should get validated.
 		$is_file_on_server = false;
-		if ( false !== stripos( $file_url, network_site_url( '/', 'https' ) ) ||
-			false !== stripos( $file_url, network_site_url( '/', 'https' ) ) ||
-			false !== stripos( $file_url, site_url( '/', 'https' ) ) ||
-			false !== stripos( $file_url, site_url( '/', 'http' ) )
+		if ( false !== stripos( $file_path, network_site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_path, network_site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_path, site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_path, site_url( '/', 'http' ) )
 		) {
 			$is_file_on_server = true;
 		}

From afd24dea4b5d69b541ca08e4f89f212382f0ee9d Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 27 Sep 2018 12:27:15 -0700
Subject: [PATCH 32/54] Add http(s) to // download urls

---
 includes/class-wc-download-handler.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/class-wc-download-handler.php b/includes/class-wc-download-handler.php
index f16c23d8aed..4bcabb74645 100644
--- a/includes/class-wc-download-handler.php
+++ b/includes/class-wc-download-handler.php
@@ -247,7 +247,7 @@ class WC_Download_Handler {
 		if ( '//' === substr( $file_path, 0, 2 ) ) {
 			return array(
 				'remote_file' => true,
-				'file_path'   => $file_path,
+				'file_path'   => is_ssl() ? 'https:' . $file_path : 'http:' . $file_path,
 			);
 		}
 

From b6f22d9950b44f0b086ccf19890b1976cbabe40b Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 27 Sep 2018 12:34:58 -0700
Subject: [PATCH 33/54] Fix typo

---
 includes/class-wc-product-download.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/class-wc-product-download.php b/includes/class-wc-product-download.php
index 92099b69b78..2bb73c4e5b1 100644
--- a/includes/class-wc-product-download.php
+++ b/includes/class-wc-product-download.php
@@ -92,7 +92,7 @@ class WC_Product_Download implements ArrayAccess {
 		// File types for URL-based files located on the server should get validated.
 		$is_file_on_server = false;
 		if ( false !== stripos( $file_path, network_site_url( '/', 'https' ) ) ||
-			false !== stripos( $file_path, network_site_url( '/', 'https' ) ) ||
+			false !== stripos( $file_path, network_site_url( '/', 'http' ) ) ||
 			false !== stripos( $file_path, site_url( '/', 'https' ) ) ||
 			false !== stripos( $file_path, site_url( '/', 'http' ) )
 		) {

From 7b19673dead1a92924948d3cd5604469eaf34a98 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Tue, 18 Sep 2018 11:06:34 -0700
Subject: [PATCH 34/54] Extra file type checking

---
 ...ass-wc-product-csv-importer-controller.php | 39 ++++++++++++++-----
 .../import/class-wc-product-csv-importer.php  |  4 ++
 2 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/includes/admin/importers/class-wc-product-csv-importer-controller.php b/includes/admin/importers/class-wc-product-csv-importer-controller.php
index 4711b5bb29e..da1ead43534 100644
--- a/includes/admin/importers/class-wc-product-csv-importer-controller.php
+++ b/includes/admin/importers/class-wc-product-csv-importer-controller.php
@@ -83,6 +83,28 @@ class WC_Product_CSV_Importer_Controller {
 		return new $importer_class( $file, $args );
 	}
 
+	/**
+	 * Check whether a file is a valid CSV file.
+	 *
+	 * @param string $file File path.
+	 * @return bool
+	 */
+	public static function is_file_valid_csv( $file ) {
+		$valid_filetypes = apply_filters(
+			'woocommerce_csv_product_import_valid_filetypes', array(
+				'csv' => 'text/csv',
+				'txt' => 'text/plain',
+			)
+		);
+
+		$filetype = wp_check_filetype( $file, $valid_filetypes );
+		if ( in_array( $filetype['type'], $valid_filetypes, true ) ) {
+			return true;
+		}
+
+		return false;
+	}
+
 	/**
 	 * Constructor.
 	 */
@@ -271,13 +293,6 @@ class WC_Product_CSV_Importer_Controller {
 	 * @return string|WP_Error
 	 */
 	public function handle_upload() {
-		$valid_filetypes = apply_filters(
-			'woocommerce_csv_product_import_valid_filetypes', array(
-				'csv' => 'text/csv',
-				'txt' => 'text/plain',
-			)
-		);
-
 		// phpcs:disable WordPress.CSRF.NonceVerification.NoNonceVerification -- Nonce already verified in WC_Product_CSV_Importer_Controller::upload_form_handler()
 		$file_url = isset( $_POST['file_url'] ) ? wc_clean( wp_unslash( $_POST['file_url'] ) ) : '';
 
@@ -286,8 +301,7 @@ class WC_Product_CSV_Importer_Controller {
 				return new WP_Error( 'woocommerce_product_csv_importer_upload_file_empty', __( 'File is empty. Please upload something more substantial. This error could also be caused by uploads being disabled in your php.ini or by post_max_size being defined as smaller than upload_max_filesize in php.ini.', 'woocommerce' ) );
 			}
 
-			$filetype = wp_check_filetype( wc_clean( wp_unslash( $_FILES['import']['name'] ) ), $valid_filetypes );
-			if ( ! in_array( $filetype['type'], $valid_filetypes, true ) ) {
+			if ( ! self::is_file_valid_csv( wc_clean( wp_unslash( $_FILES['import']['name'] ) ) ) ) {
 				return new WP_Error( 'woocommerce_product_csv_importer_upload_file_invalid', __( 'Invalid file type. The importer supports CSV and TXT file formats.', 'woocommerce' ) );
 			}
 
@@ -372,8 +386,15 @@ class WC_Product_CSV_Importer_Controller {
 	 * Import the file if it exists and is valid.
 	 */
 	public function import() {
+		if ( ! self::is_file_valid_csv( $this->file ) ) {
+			$this->add_error( __( 'Invalid file type. The importer supports CSV and TXT file formats.', 'woocommerce' ) );
+			$this->output_errors();
+			return;
+		}
+
 		if ( ! is_file( $this->file ) ) {
 			$this->add_error( __( 'The file does not exist, please try again.', 'woocommerce' ) );
+			$this->output_errors();
 			return;
 		}
 
diff --git a/includes/import/class-wc-product-csv-importer.php b/includes/import/class-wc-product-csv-importer.php
index 7ac517e5aeb..e7ff49a7645 100644
--- a/includes/import/class-wc-product-csv-importer.php
+++ b/includes/import/class-wc-product-csv-importer.php
@@ -63,6 +63,10 @@ class WC_Product_CSV_Importer extends WC_Product_Importer {
 	 * Read file.
 	 */
 	protected function read_file() {
+		if ( ! WC_Product_CSV_Importer_Controller::is_file_valid_csv( $this->file ) ) {
+			wp_die( __( 'Invalid file type. The importer supports CSV and TXT file formats.', 'woocommerce' ) );
+		}
+
 		$handle = fopen( $this->file, 'r' ); // @codingStandardsIgnoreLine.
 
 		if ( false !== $handle ) {

From acf8757636635214a8690badaf9df7073c71e39f Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 21 Sep 2018 10:16:59 -0700
Subject: [PATCH 35/54] Add path checking and fix bug

---
 ...ass-wc-product-csv-importer-controller.php | 34 +++++++++++++------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/includes/admin/importers/class-wc-product-csv-importer-controller.php b/includes/admin/importers/class-wc-product-csv-importer-controller.php
index da1ead43534..ddafdaec055 100644
--- a/includes/admin/importers/class-wc-product-csv-importer-controller.php
+++ b/includes/admin/importers/class-wc-product-csv-importer-controller.php
@@ -87,16 +87,15 @@ class WC_Product_CSV_Importer_Controller {
 	 * Check whether a file is a valid CSV file.
 	 *
 	 * @param string $file File path.
+	 * @param bool   $check_path Whether to also check the file is located in a valid location (Default: true).
 	 * @return bool
 	 */
-	public static function is_file_valid_csv( $file ) {
-		$valid_filetypes = apply_filters(
-			'woocommerce_csv_product_import_valid_filetypes', array(
-				'csv' => 'text/csv',
-				'txt' => 'text/plain',
-			)
-		);
+	public static function is_file_valid_csv( $file, $check_path = true ) {
+		if ( $check_path && 0 !== stripos( $file, ABSPATH ) ) {
+			return false;
+		}
 
+		$valid_filetypes = self::get_valid_csv_filetypes();
 		$filetype = wp_check_filetype( $file, $valid_filetypes );
 		if ( in_array( $filetype['type'], $valid_filetypes, true ) ) {
 			return true;
@@ -105,6 +104,20 @@ class WC_Product_CSV_Importer_Controller {
 		return false;
 	}
 
+	/**
+	 * Get all the valid filetypes for a CSV file.
+	 *
+	 * @return array
+	 */
+	protected static function get_valid_csv_filetypes() {
+		return apply_filters(
+			'woocommerce_csv_product_import_valid_filetypes', array(
+				'csv' => 'text/csv',
+				'txt' => 'text/plain',
+			)
+		);
+	}
+
 	/**
 	 * Constructor.
 	 */
@@ -301,13 +314,13 @@ class WC_Product_CSV_Importer_Controller {
 				return new WP_Error( 'woocommerce_product_csv_importer_upload_file_empty', __( 'File is empty. Please upload something more substantial. This error could also be caused by uploads being disabled in your php.ini or by post_max_size being defined as smaller than upload_max_filesize in php.ini.', 'woocommerce' ) );
 			}
 
-			if ( ! self::is_file_valid_csv( wc_clean( wp_unslash( $_FILES['import']['name'] ) ) ) ) {
+			if ( ! self::is_file_valid_csv( wc_clean( wp_unslash( $_FILES['import']['name'] ) ), false ) ) {
 				return new WP_Error( 'woocommerce_product_csv_importer_upload_file_invalid', __( 'Invalid file type. The importer supports CSV and TXT file formats.', 'woocommerce' ) );
 			}
 
 			$overrides = array(
 				'test_form' => false,
-				'mimes'     => $valid_filetypes,
+				'mimes'     => self::get_valid_csv_filetypes(),
 			);
 			$import    = $_FILES['import']; // WPCS: sanitization ok, input var ok.
 			$upload    = wp_handle_upload( $import, $overrides );
@@ -337,8 +350,7 @@ class WC_Product_CSV_Importer_Controller {
 
 			return $upload['file'];
 		} elseif ( file_exists( ABSPATH . $file_url ) ) {
-			$filetype = wp_check_filetype( ABSPATH . $file_url, $valid_filetypes );
-			if ( ! in_array( $filetype['type'], $valid_filetypes, true ) ) {
+			if ( ! self::is_file_valid_csv( ABSPATH . $file_url ) ) {
 				return new WP_Error( 'woocommerce_product_csv_importer_upload_file_invalid', __( 'Invalid file type. The importer supports CSV and TXT file formats.', 'woocommerce' ) );
 			}
 

From 26b188569bd761726c23e2199d07c2eeeb5f7eff Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 11 Oct 2018 10:18:21 -0700
Subject: [PATCH 36/54] Add filter for disabling file path check

---
 .../importers/class-wc-product-csv-importer-controller.php      | 2 +-
 tests/unit-tests/importer/product.php                           | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/includes/admin/importers/class-wc-product-csv-importer-controller.php b/includes/admin/importers/class-wc-product-csv-importer-controller.php
index ddafdaec055..affa25fcaa0 100644
--- a/includes/admin/importers/class-wc-product-csv-importer-controller.php
+++ b/includes/admin/importers/class-wc-product-csv-importer-controller.php
@@ -91,7 +91,7 @@ class WC_Product_CSV_Importer_Controller {
 	 * @return bool
 	 */
 	public static function is_file_valid_csv( $file, $check_path = true ) {
-		if ( $check_path && 0 !== stripos( $file, ABSPATH ) ) {
+		if ( $check_path && apply_filters( 'woocommerce_product_csv_importer_check_import_file_path', true ) && 0 !== stripos( $file, ABSPATH ) ) {
 			return false;
 		}
 
diff --git a/tests/unit-tests/importer/product.php b/tests/unit-tests/importer/product.php
index 42984e1086e..468e82941c4 100644
--- a/tests/unit-tests/importer/product.php
+++ b/tests/unit-tests/importer/product.php
@@ -27,6 +27,8 @@ class WC_Tests_Product_CSV_Importer extends WC_Unit_Test_Case {
 		$bootstrap = WC_Unit_Tests_Bootstrap::instance();
 		require_once $bootstrap->plugin_dir . '/includes/import/class-wc-product-csv-importer.php';
 		require_once $bootstrap->plugin_dir . '/includes/admin/importers/class-wc-product-csv-importer-controller.php';
+
+		add_filter( 'woocommerce_product_csv_importer_check_import_file_path', '__return_false' );
 	}
 
 	/**

From f2422a284ad9b8ffe3f2b8a4ba37451ebed278b7 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 11 Oct 2018 10:27:58 -0700
Subject: [PATCH 37/54] Remove filter after running tests

---
 tests/unit-tests/importer/product.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/unit-tests/importer/product.php b/tests/unit-tests/importer/product.php
index 468e82941c4..042b7152286 100644
--- a/tests/unit-tests/importer/product.php
+++ b/tests/unit-tests/importer/product.php
@@ -31,6 +31,13 @@ class WC_Tests_Product_CSV_Importer extends WC_Unit_Test_Case {
 		add_filter( 'woocommerce_product_csv_importer_check_import_file_path', '__return_false' );
 	}
 
+	/**
+	 * Remove filters.
+	 */
+	public function tearDown() {
+		remove_filter( 'woocommerce_product_csv_importer_check_import_file_path', '__return_false' );
+	}
+
 	/**
 	 * Get CSV mapped items.
 	 *

From b9c364a47552225ec52fd512bbf0eead20202478 Mon Sep 17 00:00:00 2001
From: Rodrigo Primo <rodrigosprimo@gmail.com>
Date: Thu, 11 Oct 2018 14:31:46 -0300
Subject: [PATCH 38/54] Add call to parent::tearDown()

It is usually necessary to call parent::tearDown(); when extending tearDown() to make sure WordPress cleanup routines are executed after each test.
---
 tests/unit-tests/importer/product.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/unit-tests/importer/product.php b/tests/unit-tests/importer/product.php
index 042b7152286..f039988646a 100644
--- a/tests/unit-tests/importer/product.php
+++ b/tests/unit-tests/importer/product.php
@@ -35,6 +35,7 @@ class WC_Tests_Product_CSV_Importer extends WC_Unit_Test_Case {
 	 * Remove filters.
 	 */
 	public function tearDown() {
+		parent::tearDown();
 		remove_filter( 'woocommerce_product_csv_importer_check_import_file_path', '__return_false' );
 	}
 

From d6144a769e903185165b660797dbbdc6ca13eb18 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 14 Sep 2018 12:08:36 -0700
Subject: [PATCH 39/54] Restrict shop managers to editing customers

---
 includes/wc-user-functions.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/includes/wc-user-functions.php b/includes/wc-user-functions.php
index 90dae915926..25b85868609 100644
--- a/includes/wc-user-functions.php
+++ b/includes/wc-user-functions.php
@@ -379,6 +379,11 @@ function wc_modify_map_meta_cap( $caps, $cap, $user_id, $args ) {
 				if ( user_can( $args[0], 'administrator' ) && ! current_user_can( 'administrator' ) ) {
 					$caps[] = 'do_not_allow';
 				}
+
+				// Shop managers can only edit customer info.
+				if ( current_user_can( 'shop_manager' ) && ! user_can( $args[0], 'customer' ) ) {
+					$caps[] = 'do_not_allow';
+				}
 			}
 			break;
 	}

From 7ea4e7b1b505b8bbbdfbb741252143653397122b Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 14 Sep 2018 12:31:43 -0700
Subject: [PATCH 40/54] Prevent role changing

---
 includes/wc-user-functions.php | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/includes/wc-user-functions.php b/includes/wc-user-functions.php
index 25b85868609..000c675f992 100644
--- a/includes/wc-user-functions.php
+++ b/includes/wc-user-functions.php
@@ -352,6 +352,12 @@ function wc_modify_editable_roles( $roles ) {
 	if ( ! current_user_can( 'administrator' ) ) {
 		unset( $roles['administrator'] );
 	}
+
+	if ( current_user_can( 'shop_manager' ) && isset( $roles['customer'] ) ) {
+		return array(
+			'customer' => $roles['customer'],
+		);
+	}
 	return $roles;
 }
 add_filter( 'editable_roles', 'wc_modify_editable_roles' );
@@ -381,8 +387,11 @@ function wc_modify_map_meta_cap( $caps, $cap, $user_id, $args ) {
 				}
 
 				// Shop managers can only edit customer info.
-				if ( current_user_can( 'shop_manager' ) && ! user_can( $args[0], 'customer' ) ) {
-					$caps[] = 'do_not_allow';
+				if ( current_user_can( 'shop_manager' ) ) {
+					$userdata = get_userdata( $args[0] );
+					if ( property_exists( $userdata, 'roles' ) && ! empty( $userdata->roles ) && ! in_array( 'customer', $userdata->roles ) ) {
+						$caps[] = 'do_not_allow';
+					}
 				}
 			}
 			break;

From 75bfc8e4bbda903ebca097842904a16272010b95 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 21 Sep 2018 11:41:22 -0700
Subject: [PATCH 41/54] Add unit tests

---
 .../util/class-wc-tests-user-functions.php    | 124 ++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 tests/unit-tests/util/class-wc-tests-user-functions.php

diff --git a/tests/unit-tests/util/class-wc-tests-user-functions.php b/tests/unit-tests/util/class-wc-tests-user-functions.php
new file mode 100644
index 00000000000..2f8975bb16a
--- /dev/null
+++ b/tests/unit-tests/util/class-wc-tests-user-functions.php
@@ -0,0 +1,124 @@
+<?php
+/**
+ * Unit tests for the user functions.
+ *
+ * @package WooCommerce\Tests\Util
+ * @since 3.4.6
+ */
+
+/**
+ * Core function unit tests.
+ */
+class WC_Tests_User_Functions extends WC_Unit_Test_Case {
+
+	/**
+	 * Test the logic of wc_modify_editable_roles.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_wc_modify_editable_roles() {
+		$password = wp_generate_password();
+
+		$admin_id = wp_insert_user( array(
+			'user_login' => 'test_admin',
+			'user_pass'  => $password,
+			'user_email' => 'admin@example.com',
+			'role'       => 'administrator',
+		) );
+
+		$editor_id = wp_insert_user( array(
+			'user_login' => 'test_editor',
+			'user_pass'  => $password,
+			'user_email' => 'editor@example.com',
+			'role'       => 'editor',
+		) );
+
+		$manager_id = wp_insert_user( array(
+			'user_login' => 'test_manager',
+			'user_pass'  => $password,
+			'user_email' => 'manager@example.com',
+			'role'       => 'shop_manager',
+		) );
+
+		// Admins should be able to edit anyone.
+		wp_set_current_user( $admin_id );
+		$admin_editable_roles = array_keys( get_editable_roles() );
+		$this->assertContains( 'administrator', $admin_editable_roles );
+		$this->assertContains( 'editor', $admin_editable_roles );
+		$this->assertContains( 'shop_manager', $admin_editable_roles );
+		$this->assertContains( 'customer', $admin_editable_roles );
+
+		// Editors should be able to edit non-admins.
+		wp_set_current_user( $editor_id );
+		$editor_editable_roles = array_keys( get_editable_roles() );
+		$this->assertNotContains( 'administrator', $editor_editable_roles );
+		$this->assertContains( 'editor', $editor_editable_roles );
+		$this->assertContains( 'shop_manager', $editor_editable_roles );
+		$this->assertContains( 'customer', $editor_editable_roles );
+
+		// Shop manager should only be able to edit customers.
+		wp_set_current_user( $manager_id );
+		$manager_editable_roles = array_keys( get_editable_roles() );
+		$this->assertEquals( array( 'customer' ), $manager_editable_roles );
+	}
+
+	/**
+	 * Test the logic of wc_modify_map_meta_cap.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_wc_modify_map_meta_cap() {
+		$password = wp_generate_password();
+
+		$admin_id = wp_insert_user( array(
+			'user_login' => 'test_admin',
+			'user_pass'  => $password,
+			'user_email' => 'admin@example.com',
+			'role'       => 'administrator',
+		) );
+
+		$editor_id = wp_insert_user( array(
+			'user_login' => 'test_editor',
+			'user_pass'  => $password,
+			'user_email' => 'editor@example.com',
+			'role'       => 'editor',
+		) );
+
+		$manager_id = wp_insert_user( array(
+			'user_login' => 'test_manager',
+			'user_pass'  => $password,
+			'user_email' => 'manager@example.com',
+			'role'       => 'shop_manager',
+		) );
+
+		$customer_id = wp_insert_user( array(
+			'user_login' => 'test_customer',
+			'user_pass'  => $password,
+			'user_email' => 'customer@example.com',
+			'role'       => 'customer',
+		) );
+
+		// Admins should be able to edit or promote anyone.
+		wp_set_current_user( $admin_id );
+		$caps = map_meta_cap( 'edit_user', $admin_id, $editor_id );
+		$this->assertEquals( array( 'edit_users' ), $caps );
+		$caps = map_meta_cap( 'promote_user', $admin_id, $manager_id );
+		$this->assertEquals( array( 'promote_users' ), $caps );
+
+		// Shop managers should only be able to edit themselves or customers.
+		wp_set_current_user( $manager_id );
+		$caps = map_meta_cap( 'edit_user', $manager_id, $admin_id );
+		$this->assertContains( 'do_not_allow', $caps );
+		$caps = map_meta_cap( 'edit_user', $manager_id, $editor_id );
+		$this->assertContains( 'do_not_allow', $caps );
+		$caps = map_meta_cap( 'edit_user', $manager_id, $customer_id );
+		$this->assertEquals( array( 'edit_users' ), $caps );
+
+		// Customers should not be able to edit or promote anyone.
+		wp_set_current_user( $customer_id );
+		$caps = map_meta_cap( 'edit_user', $customer_id, $admin_id );
+		$this->assertContains( 'do_not_allow', $caps );
+		$caps = map_meta_cap( 'edit_user', $customer_id, $editor_id );
+		$this->assertContains( 'do_not_allow', $caps );
+	}
+}

From 5f2b915f18c36965c637536eb2c4b1e172b347d7 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Wed, 10 Oct 2018 09:56:37 -0700
Subject: [PATCH 42/54] Add filter for ease of extensions

---
 includes/wc-user-functions.php                        | 11 ++++++-----
 .../unit-tests/util/class-wc-tests-user-functions.php |  7 -------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/includes/wc-user-functions.php b/includes/wc-user-functions.php
index 000c675f992..b7b7a59926d 100644
--- a/includes/wc-user-functions.php
+++ b/includes/wc-user-functions.php
@@ -353,11 +353,11 @@ function wc_modify_editable_roles( $roles ) {
 		unset( $roles['administrator'] );
 	}
 
-	if ( current_user_can( 'shop_manager' ) && isset( $roles['customer'] ) ) {
-		return array(
-			'customer' => $roles['customer'],
-		);
+	if ( current_user_can( 'shop_manager' ) ) {
+		$shop_manager_editable_roles = apply_filters( 'woocommerce_shop_manager_editable_roles', array( 'customer' ) );
+		return array_intersect_key( $roles, array_flip( $shop_manager_editable_roles ) );
 	}
+
 	return $roles;
 }
 add_filter( 'editable_roles', 'wc_modify_editable_roles' );
@@ -389,7 +389,8 @@ function wc_modify_map_meta_cap( $caps, $cap, $user_id, $args ) {
 				// Shop managers can only edit customer info.
 				if ( current_user_can( 'shop_manager' ) ) {
 					$userdata = get_userdata( $args[0] );
-					if ( property_exists( $userdata, 'roles' ) && ! empty( $userdata->roles ) && ! in_array( 'customer', $userdata->roles ) ) {
+					$shop_manager_editable_roles = apply_filters( 'woocommerce_shop_manager_editable_roles', array( 'customer' ) );
+					if ( property_exists( $userdata, 'roles' ) && ! empty( $userdata->roles ) && ! array_intersect( $userdata->roles, $shop_manager_editable_roles ) ) {
 						$caps[] = 'do_not_allow';
 					}
 				}
diff --git a/tests/unit-tests/util/class-wc-tests-user-functions.php b/tests/unit-tests/util/class-wc-tests-user-functions.php
index 2f8975bb16a..f4668146886 100644
--- a/tests/unit-tests/util/class-wc-tests-user-functions.php
+++ b/tests/unit-tests/util/class-wc-tests-user-functions.php
@@ -113,12 +113,5 @@ class WC_Tests_User_Functions extends WC_Unit_Test_Case {
 		$this->assertContains( 'do_not_allow', $caps );
 		$caps = map_meta_cap( 'edit_user', $manager_id, $customer_id );
 		$this->assertEquals( array( 'edit_users' ), $caps );
-
-		// Customers should not be able to edit or promote anyone.
-		wp_set_current_user( $customer_id );
-		$caps = map_meta_cap( 'edit_user', $customer_id, $admin_id );
-		$this->assertContains( 'do_not_allow', $caps );
-		$caps = map_meta_cap( 'edit_user', $customer_id, $editor_id );
-		$this->assertContains( 'do_not_allow', $caps );
 	}
 }

From 3bbf05d025d0bce82951d412185d06ffc67fc498 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 14 Sep 2018 09:26:58 -0700
Subject: [PATCH 43/54] Prevent deleting things outside the log dir

---
 includes/log-handlers/class-wc-log-handler-file.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/includes/log-handlers/class-wc-log-handler-file.php b/includes/log-handlers/class-wc-log-handler-file.php
index 0b233ef4a92..0bbe4a2dd43 100644
--- a/includes/log-handlers/class-wc-log-handler-file.php
+++ b/includes/log-handlers/class-wc-log-handler-file.php
@@ -249,7 +249,8 @@ class WC_Log_Handler_File extends WC_Log_Handler {
 	public function remove( $handle ) {
 		$removed = false;
 		$file = trailingslashit( WC_LOG_DIR ) . $handle;
-		if ( $file ) {
+
+		if ( 0 === stripos( realpath( $file ), WC_LOG_DIR ) ) {
 			if ( is_file( $file ) && is_writable( $file ) ) { // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_is_writable
 				$this->close( $file ); // Close first to be certain no processes keep it alive after it is unlinked.
 				$removed = unlink( $file ); // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_unlink

From 87b81c94aeaca0a7a84a20dc8438a54b33185664 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 14 Sep 2018 09:45:53 -0700
Subject: [PATCH 44/54] Better way of doing it

---
 includes/admin/views/html-admin-page-status-logs.php | 2 +-
 includes/log-handlers/class-wc-log-handler-file.php  | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/includes/admin/views/html-admin-page-status-logs.php b/includes/admin/views/html-admin-page-status-logs.php
index 6f501191c00..0f5810e79b4 100644
--- a/includes/admin/views/html-admin-page-status-logs.php
+++ b/includes/admin/views/html-admin-page-status-logs.php
@@ -16,7 +16,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 			<h2>
 				<?php echo esc_html( $viewed_log ); ?>
 				<?php if ( ! empty( $viewed_log ) ) : ?>
-					<a class="page-title-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'handle' => $viewed_log ), admin_url( 'admin.php?page=wc-status&tab=logs' ) ), 'remove_log' ) ); ?>" class="button"><?php esc_html_e( 'Delete log', 'woocommerce' ); ?></a>
+					<a class="page-title-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'handle' => sanitize_title( $viewed_log ) ), admin_url( 'admin.php?page=wc-status&tab=logs' ) ), 'remove_log' ) ); ?>" class="button"><?php esc_html_e( 'Delete log', 'woocommerce' ); ?></a>
 				<?php endif; ?>
 			</h2>
 		</div>
diff --git a/includes/log-handlers/class-wc-log-handler-file.php b/includes/log-handlers/class-wc-log-handler-file.php
index 0bbe4a2dd43..a8f2dd111ee 100644
--- a/includes/log-handlers/class-wc-log-handler-file.php
+++ b/includes/log-handlers/class-wc-log-handler-file.php
@@ -248,9 +248,10 @@ class WC_Log_Handler_File extends WC_Log_Handler {
 	 */
 	public function remove( $handle ) {
 		$removed = false;
-		$file = trailingslashit( WC_LOG_DIR ) . $handle;
+		$logs = $this->get_log_files();
 
-		if ( 0 === stripos( realpath( $file ), WC_LOG_DIR ) ) {
+		if ( isset( $logs[ $handle ] ) && $logs[ $handle ] ) {
+			$file = trailingslashit( WC_LOG_DIR ) . $logs[ $handle ];
 			if ( is_file( $file ) && is_writable( $file ) ) { // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_is_writable
 				$this->close( $file ); // Close first to be certain no processes keep it alive after it is unlinked.
 				$removed = unlink( $file ); // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_unlink

From bd7d73a7882decf514288eb92f375b36f575034f Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 21 Sep 2018 12:13:42 -0700
Subject: [PATCH 45/54] Extra checking to make sure log file is in log file
 directory

---
 includes/log-handlers/class-wc-log-handler-file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/log-handlers/class-wc-log-handler-file.php b/includes/log-handlers/class-wc-log-handler-file.php
index a8f2dd111ee..124f9125fe0 100644
--- a/includes/log-handlers/class-wc-log-handler-file.php
+++ b/includes/log-handlers/class-wc-log-handler-file.php
@@ -251,8 +251,8 @@ class WC_Log_Handler_File extends WC_Log_Handler {
 		$logs = $this->get_log_files();
 
 		if ( isset( $logs[ $handle ] ) && $logs[ $handle ] ) {
-			$file = trailingslashit( WC_LOG_DIR ) . $logs[ $handle ];
-			if ( is_file( $file ) && is_writable( $file ) ) { // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_is_writable
+			$file = realpath( trailingslashit( WC_LOG_DIR ) . $logs[ $handle ] );
+			if ( 0 === stripos( $file, trailingslashit( WC_LOG_DIR ) ) && is_file( $file ) && is_writable( $file ) ) { // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_is_writable
 				$this->close( $file ); // Close first to be certain no processes keep it alive after it is unlinked.
 				$removed = unlink( $file ); // phpcs:ignore WordPress.VIP.FileSystemWritesDisallow.file_ops_unlink
 			}

From 09ed5fd152f39a32ec86b357ac762fe0e22e7f7e Mon Sep 17 00:00:00 2001
From: Claudio Sanches <contato@claudiosanches.com>
Date: Fri, 5 Oct 2018 17:46:41 -0300
Subject: [PATCH 46/54] Fixed coding standards

---
 includes/log-handlers/class-wc-log-handler-file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/log-handlers/class-wc-log-handler-file.php b/includes/log-handlers/class-wc-log-handler-file.php
index 124f9125fe0..f44675cab26 100644
--- a/includes/log-handlers/class-wc-log-handler-file.php
+++ b/includes/log-handlers/class-wc-log-handler-file.php
@@ -248,7 +248,7 @@ class WC_Log_Handler_File extends WC_Log_Handler {
 	 */
 	public function remove( $handle ) {
 		$removed = false;
-		$logs = $this->get_log_files();
+		$logs    = $this->get_log_files();
 
 		if ( isset( $logs[ $handle ] ) && $logs[ $handle ] ) {
 			$file = realpath( trailingslashit( WC_LOG_DIR ) . $logs[ $handle ] );

From d5ac2e4dee9d85166a552fb59fe6a909216f0e36 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 11 Oct 2018 09:43:36 -0700
Subject: [PATCH 47/54] Backwards compatibility handling

---
 includes/log-handlers/class-wc-log-handler-file.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/includes/log-handlers/class-wc-log-handler-file.php b/includes/log-handlers/class-wc-log-handler-file.php
index f44675cab26..85514dbbfd9 100644
--- a/includes/log-handlers/class-wc-log-handler-file.php
+++ b/includes/log-handlers/class-wc-log-handler-file.php
@@ -249,6 +249,7 @@ class WC_Log_Handler_File extends WC_Log_Handler {
 	public function remove( $handle ) {
 		$removed = false;
 		$logs    = $this->get_log_files();
+		$handle  = sanitize_title( $handle );
 
 		if ( isset( $logs[ $handle ] ) && $logs[ $handle ] ) {
 			$file = realpath( trailingslashit( WC_LOG_DIR ) . $logs[ $handle ] );

From cf96455559695625ce3bde7ba9afd0d5776a4fe2 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 13 Sep 2018 10:48:05 -0700
Subject: [PATCH 48/54] Add test to verify issue

---
 tests/unit-tests/attributes/functions.php | 56 +++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/tests/unit-tests/attributes/functions.php b/tests/unit-tests/attributes/functions.php
index 698f6603cc0..44040833168 100644
--- a/tests/unit-tests/attributes/functions.php
+++ b/tests/unit-tests/attributes/functions.php
@@ -65,6 +65,62 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 		wc_delete_attribute( $id );
 	}
 
+	/**
+	 * Test that updating a global attribute will not modify local attribute data.
+	 *
+	 * @since 3.4.6
+	 */
+	public function test_wc_create_attribute_serialized_data() {
+		global $wpdb;
+
+		$global_attribute_data = WC_Helper_Product::create_attribute( 'test', array( 'Chicken', 'Nuggets' ) );
+
+		$local_attribute = new WC_Product_Attribute();
+		$local_attribute->set_id( 0 );
+		$local_attribute->set_name( 'Test Local Attribute' );
+		$local_attribute->set_options( array( 'Fish', 'Fingers', 's:7:"pa_test' ) );
+		$local_attribute->set_position( 0 );
+		$local_attribute->set_visible( true );
+		$local_attribute->set_variation( false );
+
+		$global_attribute = new WC_Product_Attribute();
+		$global_attribute->set_id( $global_attribute_data['attribute_id'] );
+		$global_attribute->set_name( $global_attribute_data['attribute_taxonomy'] );
+		$global_attribute->set_options( $global_attribute_data['term_ids'] );
+		$global_attribute->set_position( 1 );
+		$global_attribute->set_visible( true );
+		$global_attribute->set_variation( false );
+
+		$product = new WC_Product_Simple();
+		$product->set_attributes( array(
+			'test-local' => $local_attribute,
+			'test-global' => $global_attribute,
+		) );
+		$product->save();
+
+		$meta_before_update = $wpdb->get_results( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = " . $product->get_id(), ARRAY_A );
+		$product_meta_before_update = @unserialize( $meta_before_update[0]['meta_value'] );
+		$this->assertNotFalse( $product_meta_before_update, 'Meta should be an unserializable string' );
+
+		// Update the global attribute.
+		$updated_global_attribute_id = wc_create_attribute(
+			array(
+				'id' => $global_attribute_data['attribute_id'],
+				'name' => 'Test Update',
+				'old_slug' => 'test',
+				'slug' => 'testupdate',
+			)
+		);
+		$this->assertEquals( $updated_global_attribute_id, $global_attribute_data['attribute_id'] );
+
+		// Changes to the global attribute should update in the product without causing side-effects.
+		$meta_after_update = $wpdb->get_results( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = " . $product->get_id(), ARRAY_A );
+		$product_meta_after_update = @unserialize( $meta_after_update[0]['meta_value'] );
+		$this->assertNotFalse( $product_meta_after_update, 'Meta should be an unserializable string' );
+
+		// @todo check individual attribute values are good once meta after update is unserializable.
+	}
+
 	/**
 	 * Tests wc_update_attribute().
 	 *

From c9c12c2518262c53fb0d898a8bb35c0d51cf385c Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 13 Sep 2018 12:14:09 -0700
Subject: [PATCH 49/54] Initial implementation

---
 includes/wc-attribute-functions.php       | 28 +++++++++++++-------
 tests/unit-tests/attributes/functions.php | 32 ++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 10 deletions(-)

diff --git a/includes/wc-attribute-functions.php b/includes/wc-attribute-functions.php
index 12339c6bdbd..d5cf141e64d 100644
--- a/includes/wc-attribute-functions.php
+++ b/includes/wc-attribute-functions.php
@@ -536,16 +536,26 @@ function wc_create_attribute( $args ) {
 			);
 
 			// Update product attributes which use this taxonomy.
-			$old_attribute_name_length = strlen( $old_slug ) + 3;
-			$attribute_name_length     = strlen( $data['attribute_name'] ) + 3;
-
-			$wpdb->query(
+			$old_taxonomy_name = 'pa_' . $old_slug;
+			$new_taxonomy_name = 'pa_' . $data['attribute_name'];
+			$metadatas = $wpdb->get_results(
 				$wpdb->prepare(
-					"UPDATE {$wpdb->postmeta} SET meta_value = REPLACE( meta_value, %s, %s ) WHERE meta_key = '_product_attributes'",
-					's:' . $old_attribute_name_length . ':"pa_' . $old_slug . '"',
-					's:' . $attribute_name_length . ':"pa_' . $data['attribute_name'] . '"'
-				)
-			);
+					"SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND meta_value LIKE %s",
+					'%' . $old_taxonomy_name . '%'
+				),
+			ARRAY_A );
+			foreach ( $metadatas as $metadata ) {
+				$product_id = $metadata['post_id'];
+				$unserialized_data = @unserialize( $metadata['meta_value'] );
+				if ( ! $unserialized_data || ! isset( $unserialized_data[ $old_taxonomy_name ] ) ) {
+					continue;
+				}
+
+				$unserialized_data[ $new_taxonomy_name ] = $unserialized_data[ $old_taxonomy_name ];
+				unset( $unserialized_data[ $old_taxonomy_name ] );
+				$unserialized_data[ $new_taxonomy_name ]['name'] = $new_taxonomy_name;
+				update_post_meta( $product_id, '_product_attributes', $unserialized_data );
+			}
 
 			// Update variations which use this taxonomy.
 			$wpdb->update(
diff --git a/tests/unit-tests/attributes/functions.php b/tests/unit-tests/attributes/functions.php
index 44040833168..0b54a7dd6b7 100644
--- a/tests/unit-tests/attributes/functions.php
+++ b/tests/unit-tests/attributes/functions.php
@@ -98,10 +98,30 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 		) );
 		$product->save();
 
+		// Check everything looks good before updating the attribute.
 		$meta_before_update = $wpdb->get_results( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = " . $product->get_id(), ARRAY_A );
 		$product_meta_before_update = @unserialize( $meta_before_update[0]['meta_value'] );
 		$this->assertNotFalse( $product_meta_before_update, 'Meta should be an unserializable string' );
 
+		$expected_local_attribute_data = array(
+			'name' => 'Test Local Attribute',
+			'value' => 'Fish | Fingers | s:7:"pa_test',
+			'position' => 0,
+			'is_visible' => 1,
+			'is_variation' => 0,
+			'is_taxonomy' => 0,
+		);
+		$expected_global_attribute_data = array(
+			'name' => 'pa_test',
+			'value' => '',
+			'position' => 1,
+			'is_visible' => 1,
+			'is_variation' => 0,
+			'is_taxonomy' => 1,
+		);
+		$this->assertEquals( $expected_local_attribute_data, $product_meta_before_update['Test Local Attribute'] );
+		$this->assertEquals( $expected_global_attribute_data, $product_meta_before_update['pa_test'] );
+
 		// Update the global attribute.
 		$updated_global_attribute_id = wc_create_attribute(
 			array(
@@ -118,7 +138,17 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 		$product_meta_after_update = @unserialize( $meta_after_update[0]['meta_value'] );
 		$this->assertNotFalse( $product_meta_after_update, 'Meta should be an unserializable string' );
 
-		// @todo check individual attribute values are good once meta after update is unserializable.
+		$expected_global_attribute_data = array(
+			'name' => 'pa_testupdate',
+			'value' => '',
+			'position' => 1,
+			'is_visible' => 1,
+			'is_variation' => 0,
+			'is_taxonomy' => 1,
+		);
+		$this->assertEquals( $product_meta_before_update['Test Local Attribute'], $product_meta_after_update['Test Local Attribute'] );
+		$this->assertEquals( $expected_global_attribute_data, $product_meta_after_update['pa_testupdate'] );
+		$this->assertArrayNotHasKey( 'pa_test', $product_meta_after_update );
 	}
 
 	/**

From d1e9e85cbb2c457ed1f19feefc2932c9e7a7c1e6 Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Fri, 21 Sep 2018 12:24:13 -0700
Subject: [PATCH 50/54] Extra safety

---
 includes/wc-attribute-functions.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/wc-attribute-functions.php b/includes/wc-attribute-functions.php
index d5cf141e64d..32e24b87f4c 100644
--- a/includes/wc-attribute-functions.php
+++ b/includes/wc-attribute-functions.php
@@ -541,13 +541,13 @@ function wc_create_attribute( $args ) {
 			$metadatas = $wpdb->get_results(
 				$wpdb->prepare(
 					"SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND meta_value LIKE %s",
-					'%' . $old_taxonomy_name . '%'
+					'%' . $wpdb->esc_like( $old_taxonomy_name ) . '%'
 				),
 			ARRAY_A );
 			foreach ( $metadatas as $metadata ) {
 				$product_id = $metadata['post_id'];
-				$unserialized_data = @unserialize( $metadata['meta_value'] );
-				if ( ! $unserialized_data || ! isset( $unserialized_data[ $old_taxonomy_name ] ) ) {
+				$unserialized_data = maybe_unserialize( $metadata['meta_value'] );
+				if ( ! $unserialized_data || ! is_array( $unserialized_data ) || ! isset( $unserialized_data[ $old_taxonomy_name ] ) ) {
 					continue;
 				}
 

From 2f7f514f1496c2b7c03cd72277ca18e6044d5948 Mon Sep 17 00:00:00 2001
From: Claudio Sanches <contato@claudiosanches.com>
Date: Fri, 5 Oct 2018 17:06:16 -0300
Subject: [PATCH 51/54] Fixed coding standards

---
 includes/wc-attribute-functions.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/wc-attribute-functions.php b/includes/wc-attribute-functions.php
index 32e24b87f4c..b4a3616f0c2 100644
--- a/includes/wc-attribute-functions.php
+++ b/includes/wc-attribute-functions.php
@@ -538,14 +538,14 @@ function wc_create_attribute( $args ) {
 			// Update product attributes which use this taxonomy.
 			$old_taxonomy_name = 'pa_' . $old_slug;
 			$new_taxonomy_name = 'pa_' . $data['attribute_name'];
-			$metadatas = $wpdb->get_results(
+			$metadatas         = $wpdb->get_results(
 				$wpdb->prepare(
 					"SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND meta_value LIKE %s",
 					'%' . $wpdb->esc_like( $old_taxonomy_name ) . '%'
 				),
 			ARRAY_A );
 			foreach ( $metadatas as $metadata ) {
-				$product_id = $metadata['post_id'];
+				$product_id        = $metadata['post_id'];
 				$unserialized_data = maybe_unserialize( $metadata['meta_value'] );
 				if ( ! $unserialized_data || ! is_array( $unserialized_data ) || ! isset( $unserialized_data[ $old_taxonomy_name ] ) ) {
 					continue;

From 06e5fe1fd825965ce0a49de4f671a51e5538350a Mon Sep 17 00:00:00 2001
From: Claudio Sanches <contato@claudiosanches.com>
Date: Fri, 5 Oct 2018 17:13:32 -0300
Subject: [PATCH 52/54] Fixed coding standards in unit tests

---
 tests/unit-tests/attributes/functions.php | 56 ++++++++++++-----------
 1 file changed, 29 insertions(+), 27 deletions(-)

diff --git a/tests/unit-tests/attributes/functions.php b/tests/unit-tests/attributes/functions.php
index 0b54a7dd6b7..c4b83ac0966 100644
--- a/tests/unit-tests/attributes/functions.php
+++ b/tests/unit-tests/attributes/functions.php
@@ -92,32 +92,34 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 		$global_attribute->set_variation( false );
 
 		$product = new WC_Product_Simple();
-		$product->set_attributes( array(
-			'test-local' => $local_attribute,
-			'test-global' => $global_attribute,
-		) );
+		$product->set_attributes(
+			array(
+				'test-local'  => $local_attribute,
+				'test-global' => $global_attribute,
+			)
+		);
 		$product->save();
 
 		// Check everything looks good before updating the attribute.
-		$meta_before_update = $wpdb->get_results( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = " . $product->get_id(), ARRAY_A );
-		$product_meta_before_update = @unserialize( $meta_before_update[0]['meta_value'] );
+		$meta_before_update         = $wpdb->get_results( $wpdb->prepare( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = %d", $product->get_id() ), ARRAY_A );
+		$product_meta_before_update = @unserialize( $meta_before_update[0]['meta_value'] ); // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged, WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize
 		$this->assertNotFalse( $product_meta_before_update, 'Meta should be an unserializable string' );
 
-		$expected_local_attribute_data = array(
-			'name' => 'Test Local Attribute',
-			'value' => 'Fish | Fingers | s:7:"pa_test',
-			'position' => 0,
-			'is_visible' => 1,
+		$expected_local_attribute_data  = array(
+			'name'         => 'Test Local Attribute',
+			'value'        => 'Fish | Fingers | s:7:"pa_test',
+			'position'     => 0,
+			'is_visible'   => 1,
 			'is_variation' => 0,
-			'is_taxonomy' => 0,
+			'is_taxonomy'  => 0,
 		);
 		$expected_global_attribute_data = array(
-			'name' => 'pa_test',
-			'value' => '',
-			'position' => 1,
-			'is_visible' => 1,
+			'name'         => 'pa_test',
+			'value'        => '',
+			'position'     => 1,
+			'is_visible'   => 1,
 			'is_variation' => 0,
-			'is_taxonomy' => 1,
+			'is_taxonomy'  => 1,
 		);
 		$this->assertEquals( $expected_local_attribute_data, $product_meta_before_update['Test Local Attribute'] );
 		$this->assertEquals( $expected_global_attribute_data, $product_meta_before_update['pa_test'] );
@@ -125,26 +127,26 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 		// Update the global attribute.
 		$updated_global_attribute_id = wc_create_attribute(
 			array(
-				'id' => $global_attribute_data['attribute_id'],
-				'name' => 'Test Update',
+				'id'       => $global_attribute_data['attribute_id'],
+				'name'     => 'Test Update',
 				'old_slug' => 'test',
-				'slug' => 'testupdate',
+				'slug'     => 'testupdate',
 			)
 		);
 		$this->assertEquals( $updated_global_attribute_id, $global_attribute_data['attribute_id'] );
 
 		// Changes to the global attribute should update in the product without causing side-effects.
-		$meta_after_update = $wpdb->get_results( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = " . $product->get_id(), ARRAY_A );
-		$product_meta_after_update = @unserialize( $meta_after_update[0]['meta_value'] );
+		$meta_after_update         = $wpdb->get_results( $wpdb->prepare( "SELECT meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_product_attributes' AND post_id = %d", $product->get_id() ), ARRAY_A );
+		$product_meta_after_update = @unserialize( $meta_after_update[0]['meta_value'] ); // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged, WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize
 		$this->assertNotFalse( $product_meta_after_update, 'Meta should be an unserializable string' );
 
 		$expected_global_attribute_data = array(
-			'name' => 'pa_testupdate',
-			'value' => '',
-			'position' => 1,
-			'is_visible' => 1,
+			'name'         => 'pa_testupdate',
+			'value'        => '',
+			'position'     => 1,
+			'is_visible'   => 1,
 			'is_variation' => 0,
-			'is_taxonomy' => 1,
+			'is_taxonomy'  => 1,
 		);
 		$this->assertEquals( $product_meta_before_update['Test Local Attribute'], $product_meta_after_update['Test Local Attribute'] );
 		$this->assertEquals( $expected_global_attribute_data, $product_meta_after_update['pa_testupdate'] );

From 4be0018c092e617c5d2b8c46b800eb71ece9ddef Mon Sep 17 00:00:00 2001
From: claudiulodro <claudiulodro@gmail.com>
Date: Thu, 11 Oct 2018 10:01:17 -0700
Subject: [PATCH 53/54] Backwards compatibility in unit test

---
 tests/unit-tests/attributes/functions.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/unit-tests/attributes/functions.php b/tests/unit-tests/attributes/functions.php
index c4b83ac0966..577ece7229a 100644
--- a/tests/unit-tests/attributes/functions.php
+++ b/tests/unit-tests/attributes/functions.php
@@ -121,7 +121,8 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 			'is_variation' => 0,
 			'is_taxonomy'  => 1,
 		);
-		$this->assertEquals( $expected_local_attribute_data, $product_meta_before_update['Test Local Attribute'] );
+		$local_before = isset( $product_meta_before_update['Test Local Attribute'] ) ? $product_meta_before_update['Test Local Attribute'] : $product_meta_before_update['test-local-attribute'];
+		$this->assertEquals( $expected_local_attribute_data, $local_before );
 		$this->assertEquals( $expected_global_attribute_data, $product_meta_before_update['pa_test'] );
 
 		// Update the global attribute.
@@ -148,7 +149,7 @@ class WC_Tests_Attributes_Functions extends WC_Unit_Test_Case {
 			'is_variation' => 0,
 			'is_taxonomy'  => 1,
 		);
-		$this->assertEquals( $product_meta_before_update['Test Local Attribute'], $product_meta_after_update['Test Local Attribute'] );
+		$this->assertEquals( $local_before, isset( $product_meta_after_update['Test Local Attribute'] ) ? $product_meta_after_update['Test Local Attribute'] : $product_meta_after_update['test-local-attribute'] );
 		$this->assertEquals( $expected_global_attribute_data, $product_meta_after_update['pa_testupdate'] );
 		$this->assertArrayNotHasKey( 'pa_test', $product_meta_after_update );
 	}

From 212975c9419bfeb7626bca6b5caf72fd29c0981f Mon Sep 17 00:00:00 2001
From: Rodrigo Primo <rodrigosprimo@gmail.com>
Date: Mon, 15 Oct 2018 09:41:54 -0300
Subject: [PATCH 54/54] 3.4.6 changelog

---
 CHANGELOG.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index b319f72b4d7..888f3534859 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,5 +1,10 @@
 == Changelog ==
 
+= 3.4.6 - 2018-10-11 =
+* Fix - Security issues
+* Fix - Allow percent coupons with sale restrictions to apply to carts with sale items in them. #21241
+* Fix - Prevent multiple slashing of variation's SKU. #21019
+
 = 3.4.5 - 2018-08-29 =
 * Fix - Tweak sanitization when resetting password cookie. #20901
 * Fix - Use `+` instead of `array_merge` when appending parent to tax class to fix issues with numeric tax class names. #20916