diff --git a/includes/class-wc-checkout.php b/includes/class-wc-checkout.php index b0ba00e2fe4..e5c8a0e9b69 100644 --- a/includes/class-wc-checkout.php +++ b/includes/class-wc-checkout.php @@ -688,23 +688,25 @@ class WC_Checkout { foreach ( $fieldset as $key => $field ) { $type = sanitize_title( isset( $field['type'] ) ? $field['type'] : 'text' ); + // phpcs:disable WordPress.Security.NonceVerification.Missing switch ( $type ) { case 'checkbox': - $value = isset( $_POST[ $key ] ) ? 1 : ''; // WPCS: input var ok, CSRF ok. + $value = isset( $_POST[ $key ] ) ? 1 : ''; break; case 'multiselect': - $value = isset( $_POST[ $key ] ) ? implode( ', ', wc_clean( wp_unslash( $_POST[ $key ] ) ) ) : ''; // WPCS: input var ok, CSRF ok. + $value = isset( $_POST[ $key ] ) ? implode( ', ', wc_clean( wp_unslash( $_POST[ $key ] ) ) ) : ''; break; case 'textarea': - $value = isset( $_POST[ $key ] ) ? wc_sanitize_textarea( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. + $value = isset( $_POST[ $key ] ) ? wc_sanitize_textarea( wp_unslash( $_POST[ $key ] ) ) : ''; break; case 'password': - $value = isset( $_POST[ $key ] ) ? wp_unslash( $_POST[ $key ] ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok. + $value = isset( $_POST[ $key ] ) ? wp_unslash( $_POST[ $key ] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized break; default: - $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. + $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : ''; break; } + // phpcs:enable WordPress.Security.NonceVerification.Missing $data[ $key ] = apply_filters( 'woocommerce_process_checkout_' . $type . '_field', apply_filters( 'woocommerce_process_checkout_field_' . $key, $value ) ); } @@ -835,7 +837,8 @@ class WC_Checkout { WC()->countries->country_exists( $billing_country, true ); } - if ( empty( $data['woocommerce_checkout_update_totals'] ) && empty( $data['terms'] ) && ! empty( $_POST['terms-field'] ) ) { // WPCS: input var ok, CSRF ok. + // phpcs:ignore WordPress.Security.NonceVerification.Missing + if ( empty( $data['woocommerce_checkout_update_totals'] ) && empty( $data['terms'] ) && ! empty( $_POST['terms-field'] ) ) { $errors->add( 'terms', __( 'Please read and accept the terms and conditions to proceed with your order.', 'woocommerce' ) ); } @@ -1211,8 +1214,8 @@ class WC_Checkout { */ public function get_value( $input ) { // If the form was posted, get the posted value. This will only tend to happen when JavaScript is disabled client side. - if ( ! empty( $_POST[ $input ] ) ) { // WPCS: input var ok, CSRF OK. - return wc_clean( wp_unslash( $_POST[ $input ] ) ); // WPCS: input var ok, CSRF OK. + if ( ! empty( $_POST[ $input ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing + return wc_clean( wp_unslash( $_POST[ $input ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing } // Allow 3rd parties to short circuit the logic and return their own default value.