Steve-Dee-Designs
/
woocommerce
mirror of https://github.com/woocommerce/woocommerce.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #24919 from TimBHowe/fix/20921 

Fix/20921 - Throw error for invalid character in flat rate cost.
This commit is contained in:
Christopher Allford 2020-01-29 13:32:49 -08:00 committed by GitHub
parent 641a4c1890 f488f46b37
commit ceeba16014
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
includes/admin/class-wc-admin-setup-wizard.php
View File

@ -1279,13 +1279,19 @@ class WC_Admin_Setup_Wizard {
// Save chosen shipping method settings (using REST controller for convenience).
if ( ! empty( $_POST['shipping_zones']['domestic'][ $domestic_method ] ) ) { // WPCS: input var ok.
// Sanitize the cost field.
$domestic_cost = wc_clean( wp_unslash( $_POST['shipping_zones']['domestic'][ $domestic_method ] ) );
$domestic_cost = str_replace( array( get_woocommerce_currency_symbol(), html_entity_decode( get_woocommerce_currency_symbol() ) ), '', $domestic_cost );
// Build and make a REST request to save the shipping zone and method set.
$request = new WP_REST_Request( 'POST', "/wc/v3/shipping/zones/{$zone_id}/methods" );
$request->add_header( 'Content-Type', 'application/json' );
$request->set_body(
wp_json_encode(
array(
'method_id' => $domestic_method,
'settings' => wc_clean( wp_unslash( $_POST['shipping_zones']['domestic'][ $domestic_method ] ) ),
'settings' => $domestic_cost,
)
)
);
@ -1297,13 +1303,19 @@ class WC_Admin_Setup_Wizard {
if ( $setup_intl ) {
// Save chosen shipping method settings (using REST controller for convenience).
if ( ! empty( $_POST['shipping_zones']['intl'][ $intl_method ] ) ) { // WPCS: input var ok.
// Sanitize the cost field.
$intl_cost = wc_clean( wp_unslash( $_POST['shipping_zones']['intl'][ $intl_method ] ) );
$intl_cost = str_replace( array( get_woocommerce_currency_symbol(), html_entity_decode( get_woocommerce_currency_symbol() ) ), '', $intl_cost );
// Build and make a REST request to save the shipping zone and method set.
$request = new WP_REST_Request( 'POST', '/wc/v3/shipping/zones/0/methods' );
$request->add_header( 'Content-Type', 'application/json' );
$request->set_body(
wp_json_encode(
array(
'method_id' => $intl_method,
'settings' => wc_clean( wp_unslash( $_POST['shipping_zones']['intl'][ $intl_method ] ) ),
'settings' => $intl_cost,
)
)
);

5
includes/shipping/flat-rate/class-wc-shipping-flat-rate.php
View File

@ -256,12 +256,17 @@ class WC_Shipping_Flat_Rate extends WC_Shipping_Method {
*
* @since 3.4.0
* @param string $value Unsanitized value.
* @throws Exception Last error triggered.
* @return string
*/
public function sanitize_cost( $value ) {
$value = is_null( $value ) ? '' : $value;
$value = wp_kses_post( trim( wp_unslash( $value ) ) );
$value = str_replace( array( get_woocommerce_currency_symbol(), html_entity_decode( get_woocommerce_currency_symbol() ) ), '', $value );
// Thrown an error on the front end if the evaluate_cost will fail.
if ( false === $this->evaluate_cost( $value ) ) {
throw new Exception( WC_Eval_Math::$last_error );
}
return $value;
}
}