diff --git a/includes/gateways/bacs/class-wc-gateway-bacs.php b/includes/gateways/bacs/class-wc-gateway-bacs.php index 1e155df98f2..dabc097e469 100644 --- a/includes/gateways/bacs/class-wc-gateway-bacs.php +++ b/includes/gateways/bacs/class-wc-gateway-bacs.php @@ -1,7 +1,12 @@ init_form_fields(); $this->init_settings(); - // Define user set variables + // Define user set variables. $this->title = $this->get_option( 'title' ); $this->description = $this->get_option( 'description' ); $this->instructions = $this->get_option( 'instructions' ); - // BACS account fields shown on the thanks page and in emails - $this->account_details = get_option( 'woocommerce_bacs_accounts', + // BACS account fields shown on the thanks page and in emails. + $this->account_details = get_option( + 'woocommerce_bacs_accounts', array( array( 'account_name' => $this->get_option( 'account_name' ), @@ -54,12 +63,12 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { ) ); - // Actions + // Actions. add_action( 'woocommerce_update_options_payment_gateways_' . $this->id, array( $this, 'process_admin_options' ) ); add_action( 'woocommerce_update_options_payment_gateways_' . $this->id, array( $this, 'save_account_details' ) ); add_action( 'woocommerce_thankyou_bacs', array( $this, 'thankyou_page' ) ); - // Customer Emails + // Customer Emails. add_action( 'woocommerce_email_before_order_table', array( $this, 'email_instructions' ), 10, 3 ); } @@ -69,27 +78,27 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { public function init_form_fields() { $this->form_fields = array( - 'enabled' => array( + 'enabled' => array( 'title' => __( 'Enable/Disable', 'woocommerce' ), 'type' => 'checkbox', 'label' => __( 'Enable bank transfer', 'woocommerce' ), 'default' => 'no', ), - 'title' => array( + 'title' => array( 'title' => __( 'Title', 'woocommerce' ), 'type' => 'text', 'description' => __( 'This controls the title which the user sees during checkout.', 'woocommerce' ), 'default' => __( 'Direct bank transfer', 'woocommerce' ), 'desc_tip' => true, ), - 'description' => array( + 'description' => array( 'title' => __( 'Description', 'woocommerce' ), 'type' => 'textarea', 'description' => __( 'Payment method description that the customer will see on your checkout.', 'woocommerce' ), 'default' => __( 'Make your payment directly into our bank account. Please use your Order ID as the payment reference. Your order will not be shipped until the funds have cleared in our account.', 'woocommerce' ), 'desc_tip' => true, ), - 'instructions' => array( + 'instructions' => array( 'title' => __( 'Instructions', 'woocommerce' ), 'type' => 'textarea', 'description' => __( 'Instructions that will be added to the thank you page and emails.', 'woocommerce' ), @@ -97,7 +106,7 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { 'desc_tip' => true, ), 'account_details' => array( - 'type' => 'account_details', + 'type' => 'account_details', ), ); @@ -112,27 +121,27 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { ob_start(); - $country = WC()->countries->get_base_country(); - $locale = $this->get_country_locale(); + $country = WC()->countries->get_base_country(); + $locale = $this->get_country_locale(); - // Get sortcode label in the $locale array and use appropriate one + // Get sortcode label in the $locale array and use appropriate one. $sortcode = isset( $locale[ $country ]['sortcode']['label'] ) ? $locale[ $country ]['sortcode']['label'] : __( 'Sort code', 'woocommerce' ); ?> - : +
- - - - - - + + + + + + @@ -144,12 +153,12 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { echo ' - - - - - - + + + + + + '; } } @@ -157,7 +166,7 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { - +
 
@@ -196,14 +205,16 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { $accounts = array(); - if ( isset( $_POST['bacs_account_name'] ) ) { + // phpcs:disable WordPress.CSRF.NonceVerification.NoNonceVerification -- Nonce verification already handled in WC_Admin_Settings::save() + if ( isset( $_POST['bacs_account_name'] ) && isset( $_POST['bacs_account_number'] ) && isset( $_POST['bacs_bank_name'] ) + && isset( $_POST['bacs_sort_code'] ) && isset( $_POST['bacs_iban'] ) && isset( $_POST['bacs_bic'] ) ) { - $account_names = array_map( 'wc_clean', $_POST['bacs_account_name'] ); - $account_numbers = array_map( 'wc_clean', $_POST['bacs_account_number'] ); - $bank_names = array_map( 'wc_clean', $_POST['bacs_bank_name'] ); - $sort_codes = array_map( 'wc_clean', $_POST['bacs_sort_code'] ); - $ibans = array_map( 'wc_clean', $_POST['bacs_iban'] ); - $bics = array_map( 'wc_clean', $_POST['bacs_bic'] ); + $account_names = wc_clean( wp_unslash( $_POST['bacs_account_name'] ) ); + $account_numbers = wc_clean( wp_unslash( $_POST['bacs_account_number'] ) ); + $bank_names = wc_clean( wp_unslash( $_POST['bacs_bank_name'] ) ); + $sort_codes = wc_clean( wp_unslash( $_POST['bacs_sort_code'] ) ); + $ibans = wc_clean( wp_unslash( $_POST['bacs_iban'] ) ); + $bics = wc_clean( wp_unslash( $_POST['bacs_bic'] ) ); foreach ( $account_names as $i => $name ) { if ( ! isset( $account_names[ $i ] ) ) { @@ -220,20 +231,20 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { ); } } + // phpcs:enable update_option( 'woocommerce_bacs_accounts', $accounts ); - } /** * Output for the order received page. * - * @param int $order_id + * @param int $order_id Order ID. */ public function thankyou_page( $order_id ) { if ( $this->instructions ) { - echo wpautop( wptexturize( wp_kses_post( $this->instructions ) ) ); + echo wp_kses_post( wpautop( wptexturize( wp_kses_post( $this->instructions ) ) ) ); } $this->bank_details( $order_id ); @@ -242,15 +253,15 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { /** * Add content to the WC emails. * - * @param WC_Order $order - * @param bool $sent_to_admin - * @param bool $plain_text + * @param WC_Order $order Order object. + * @param bool $sent_to_admin Sent to admin. + * @param bool $plain_text Email format: plain text or HTML. */ public function email_instructions( $order, $sent_to_admin, $plain_text = false ) { if ( ! $sent_to_admin && 'bacs' === $order->get_payment_method() && $order->has_status( 'on-hold' ) ) { if ( $this->instructions ) { - echo wpautop( wptexturize( $this->instructions ) ) . PHP_EOL; + echo wp_kses_post( wpautop( wptexturize( $this->instructions ) ) . PHP_EOL ); } $this->bank_details( $order->get_id() ); } @@ -260,7 +271,7 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { /** * Get bank details and place into a list format. * - * @param int $order_id + * @param int $order_id Order ID. */ private function bank_details( $order_id = '' ) { @@ -268,14 +279,14 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { return; } - // Get order and store in $order - $order = wc_get_order( $order_id ); + // Get order and store in $order. + $order = wc_get_order( $order_id ); - // Get the order country and country $locale - $country = $order->get_billing_country(); - $locale = $this->get_country_locale(); + // Get the order country and country $locale. + $country = $order->get_billing_country(); + $locale = $this->get_country_locale(); - // Get sortcode label in the $locale array and use appropriate one + // Get sortcode label in the $locale array and use appropriate one. $sortcode = isset( $locale[ $country ]['sortcode']['label'] ) ? $locale[ $country ]['sortcode']['label'] : __( 'Sort code', 'woocommerce' ); $bacs_accounts = apply_filters( 'woocommerce_bacs_accounts', $this->account_details ); @@ -293,29 +304,31 @@ class WC_Gateway_BACS extends WC_Payment_Gateway { $account_html .= '