From e9d02699c4dfcbee4eef1348c2de585f769a61e5 Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:05:59 +1300 Subject: [PATCH 1/8] phpcs --- .../admin/class-wc-admin-setup-wizard.php | 58 ++++++++++--------- includes/admin/class-wc-admin.php | 52 +++++++++-------- 2 files changed, 59 insertions(+), 51 deletions(-) diff --git a/includes/admin/class-wc-admin-setup-wizard.php b/includes/admin/class-wc-admin-setup-wizard.php index 18912286352..0308240902c 100644 --- a/includes/admin/class-wc-admin-setup-wizard.php +++ b/includes/admin/class-wc-admin-setup-wizard.php @@ -190,8 +190,8 @@ class WC_Admin_Setup_Wizard { 'i18n' => array( 'extra_plugins' => array( 'payment' => array( - 'stripe_create_account' => __( 'Stripe setup is powered by Jetpack and WooCommerce Services.', 'woocommerce' ), - 'ppec_paypal_reroute_requests' => __( 'PayPal setup is powered by Jetpack and WooCommerce Services.', 'woocommerce' ), + 'stripe_create_account' => __( 'Stripe setup is powered by Jetpack and WooCommerce Services.', 'woocommerce' ), + 'ppec_paypal_reroute_requests' => __( 'PayPal setup is powered by Jetpack and WooCommerce Services.', 'woocommerce' ), 'stripe_create_account,ppec_paypal_reroute_requests' => __( 'Stripe and PayPal setup are powered by Jetpack and WooCommerce Services.', 'woocommerce' ), ), ), @@ -790,8 +790,8 @@ class WC_Admin_Setup_Wizard { * @param string $input_prefix Input prefix. */ protected function shipping_method_selection_form( $country_code, $currency_code, $input_prefix ) { - $selected = 'flat_rate'; - $shipping_methods = $this->get_wizard_shipping_methods( $country_code, $currency_code ); + $selected = 'flat_rate'; + $shipping_methods = $this->get_wizard_shipping_methods( $country_code, $currency_code ); ?>
@@ -966,7 +966,7 @@ class WC_Admin_Setup_Wizard { 'class' => array(), 'data-tip' => array(), ), - 'a' => array( + 'a' => array( 'href' => array(), 'target' => array(), ), @@ -985,28 +985,32 @@ class WC_Admin_Setup_Wizard {
    display_recommended_item( array( - 'type' => 'woocommerce_services', - 'title' => __( 'Print shipping labels at home', 'woocommerce' ), - 'description' => __( 'We recommend WooCommerce Services & Jetpack. These plugins will save you time at the Post Office by enabling you to print your shipping labels at home.', 'woocommerce' ), - 'img_url' => WC()->plugin_url() . '/assets/images/obw-woocommerce-services-icon.png', - 'img_alt' => __( 'WooCommerce Services icon', 'woocommerce' ), - 'plugins' => $this->get_wcs_requisite_plugins(), - ) ); + $this->display_recommended_item( + array( + 'type' => 'woocommerce_services', + 'title' => __( 'Print shipping labels at home', 'woocommerce' ), + 'description' => __( 'We recommend WooCommerce Services & Jetpack. These plugins will save you time at the Post Office by enabling you to print your shipping labels at home.', 'woocommerce' ), + 'img_url' => WC()->plugin_url() . '/assets/images/obw-woocommerce-services-icon.png', + 'img_alt' => __( 'WooCommerce Services icon', 'woocommerce' ), + 'plugins' => $this->get_wcs_requisite_plugins(), + ) + ); elseif ( $is_shipstation_supported ) : - $this->display_recommended_item( array( - 'type' => 'shipstation', - 'title' => __( 'Print shipping labels at home', 'woocommerce' ), - 'description' => __( 'We recommend using ShipStation to save time at the Post Office by printing your shipping labels at home. Try ShipStation free for 30 days.', 'woocommerce' ), - 'img_url' => WC()->plugin_url() . '/assets/images/obw-shipstation-icon.png', - 'img_alt' => __( 'ShipStation icon', 'woocommerce' ), - 'plugins' => array( - array( - 'name' => __( 'ShipStation', 'woocommerce' ), - 'slug' => 'woocommerce-shipstation-integration', + $this->display_recommended_item( + array( + 'type' => 'shipstation', + 'title' => __( 'Print shipping labels at home', 'woocommerce' ), + 'description' => __( 'We recommend using ShipStation to save time at the Post Office by printing your shipping labels at home. Try ShipStation free for 30 days.', 'woocommerce' ), + 'img_url' => WC()->plugin_url() . '/assets/images/obw-shipstation-icon.png', + 'img_alt' => __( 'ShipStation icon', 'woocommerce' ), + 'plugins' => array( + array( + 'name' => __( 'ShipStation', 'woocommerce' ), + 'slug' => 'woocommerce-shipstation-integration', + ), ), - ), - ) ); + ) + ); endif; endif; ?> @@ -1023,7 +1027,7 @@ class WC_Admin_Setup_Wizard { $this->get_product_dimension_selection() ), array( - 'span' => array( + 'span' => array( 'class' => array(), ), 'select' => array( @@ -1873,7 +1877,7 @@ class WC_Admin_Setup_Wizard { && $this->should_show_automated_tax() && $this->should_show_mailchimp() ) : - esc_html_e( 'Select from the list below to enable automated taxes and MailChimp’s best-in-class email services — and design your store with our official, free WooCommerce theme.', 'woocommerce' ); + esc_html_e( 'Select from the list below to enable automated taxes and MailChimp’s best-in-class email services — and design your store with our official, free WooCommerce theme.', 'woocommerce' ); else : esc_html_e( 'Enhance your store with these recommended features.', 'woocommerce' ); endif; diff --git a/includes/admin/class-wc-admin.php b/includes/admin/class-wc-admin.php index c7e902a0b51..426712b770b 100644 --- a/includes/admin/class-wc-admin.php +++ b/includes/admin/class-wc-admin.php @@ -3,14 +3,12 @@ * WooCommerce Admin * * @class WC_Admin - * @author WooThemes - * @category Admin * @package WooCommerce/Admin * @version 2.6.0 */ if ( ! defined( 'ABSPATH' ) ) { - exit; // Exit if accessed directly + exit; // Exit if accessed directly. } /** @@ -66,12 +64,12 @@ class WC_Admin { include_once WC_ABSPATH . 'includes/tracks/class-wc-tracks-footer-pixel.php'; include_once WC_ABSPATH . 'includes/tracks/class-wc-site-tracking.php'; - // Help Tabs + // Help Tabs. if ( apply_filters( 'woocommerce_enable_admin_help_tab', true ) ) { include_once dirname( __FILE__ ) . '/class-wc-admin-help.php'; } - // Setup/welcome + // Setup/welcome. if ( ! empty( $_GET['page'] ) ) { switch ( $_GET['page'] ) { case 'wc-setup': @@ -80,12 +78,12 @@ class WC_Admin { } } - // Importers + // Importers. if ( defined( 'WP_LOAD_IMPORTERS' ) ) { include_once dirname( __FILE__ ) . '/class-wc-admin-importers.php'; } - // Helper + // Helper. include_once dirname( __FILE__ ) . '/helper/class-wc-helper-options.php'; include_once dirname( __FILE__ ) . '/helper/class-wc-helper-api.php'; include_once dirname( __FILE__ ) . '/helper/class-wc-helper-updater.php'; @@ -95,7 +93,7 @@ class WC_Admin { } /** - * Preloads some functionality of the Helper to be loaded on the `plugins_loaded` hook + * Preloads some functionality of the Helper to be loaded on the `plugins_loaded` hook. */ public function preload_helper() { include_once dirname( __FILE__ ) . '/helper/class-wc-helper-file-headers.php'; @@ -105,7 +103,9 @@ class WC_Admin { * Include admin files conditionally. */ public function conditional_includes() { - if ( ! $screen = get_current_screen() ) { + $screen = get_current_screen(); + + if ( ! $screen ) { return; } @@ -138,9 +138,9 @@ class WC_Admin { * For setup wizard, transient must be present, the user must have access rights, and we must ignore the network/bulk plugin updaters. */ public function admin_redirects() { - // Nonced plugin install redirects (whitelisted) + // Nonced plugin install redirects (whitelisted). if ( ! empty( $_GET['wc-install-plugin-redirect'] ) ) { - $plugin_slug = wc_clean( $_GET['wc-install-plugin-redirect'] ); + $plugin_slug = wc_clean( wp_unslash( $_GET['wc-install-plugin-redirect'] ) ); if ( current_user_can( 'install_plugins' ) && in_array( $plugin_slug, array( 'woocommerce-gateway-stripe' ) ) ) { $nonce = wp_create_nonce( 'install-plugin_' . $plugin_slug ); @@ -153,15 +153,19 @@ class WC_Admin { exit; } - // Setup wizard redirect + // Setup wizard redirect. if ( get_transient( '_wc_activation_redirect' ) ) { delete_transient( '_wc_activation_redirect' ); - if ( ( ! empty( $_GET['page'] ) && in_array( $_GET['page'], array( 'wc-setup' ) ) ) || is_network_admin() || isset( $_GET['activate-multi'] ) || ! current_user_can( 'manage_woocommerce' ) || apply_filters( 'woocommerce_prevent_automatic_wizard_redirect', false ) ) { + if ( ( ! empty( $_GET['page'] ) && + in_array( wp_unslash( $_GET['page'] ), array( 'wc-setup' ) ) ) || + is_network_admin() || isset( $_GET['activate-multi'] ) || + ! current_user_can( 'manage_woocommerce' ) || + apply_filters( 'woocommerce_prevent_automatic_wizard_redirect', false ) ) { return; } - // If the user needs to install, send them to the setup wizard + // If the user needs to install, send them to the setup wizard. if ( WC_Admin_Notices::has_notice( 'install' ) ) { wp_safe_redirect( admin_url( 'index.php?page=wc-setup' ) ); exit; @@ -175,7 +179,7 @@ class WC_Admin { public function prevent_admin_access() { $prevent_access = false; - if ( apply_filters( 'woocommerce_disable_admin_bar', true ) && ! is_ajax() && basename( $_SERVER["SCRIPT_FILENAME"] ) !== 'admin-post.php' ) { + if ( apply_filters( 'woocommerce_disable_admin_bar', true ) && ! is_ajax() && basename( wp_unslash( $_SERVER['SCRIPT_FILENAME'] ) ) !== 'admin-post.php' ) { $has_cap = false; $access_caps = array( 'edit_posts', 'manage_woocommerce', 'view_admin_dashboard' ); @@ -203,28 +207,28 @@ class WC_Admin { public function preview_emails() { if ( isset( $_GET['preview_woocommerce_mail'] ) ) { - if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'preview-mail' ) ) { + if ( ! wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'], 'preview-mail' ) ) ) { die( 'Security check' ); } - // load the mailer class + // load the mailer class. $mailer = WC()->mailer(); - // get the preview email subject + // get the preview email subject. $email_heading = __( 'HTML email template', 'woocommerce' ); - // get the preview email content + // get the preview email content. ob_start(); include 'views/html-email-template-preview.php'; $message = ob_get_clean(); - // create a new email + // create a new email. $email = new WC_Email(); - // wrap the content with the email template and then add styles + // wrap the content with the email template and then add styles. $message = apply_filters( 'woocommerce_mail_content', $email->style_inline( $mailer->wrap_message( $email_heading, $message ) ) ); - // print the preview email + // print the preview email. echo $message; exit; } @@ -234,7 +238,7 @@ class WC_Admin { * Change the admin footer text on WooCommerce admin pages. * * @since 2.3 - * @param string $footer_text + * @param string $footer_text text to be rendered in the footer. * @return string */ public function admin_footer_text( $footer_text ) { @@ -249,7 +253,7 @@ class WC_Admin { // Check to make sure we're on a WooCommerce admin page. if ( isset( $current_screen->id ) && apply_filters( 'woocommerce_display_admin_footer_text', in_array( $current_screen->id, $wc_pages ) ) ) { - // Change the footer text + // Change the footer text. if ( ! get_option( 'woocommerce_admin_footer_text_rated' ) ) { $footer_text = sprintf( /* translators: 1: WooCommerce 2:: five stars */ From 712f06014d8c90836d87034d61404779009b4ba0 Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:08:34 +1300 Subject: [PATCH 2/8] moar --- includes/admin/helper/class-wc-helper.php | 90 ++++++++++++++------- includes/class-wc-tracker.php | 97 +++++++++++++---------- 2 files changed, 114 insertions(+), 73 deletions(-) diff --git a/includes/admin/helper/class-wc-helper.php b/includes/admin/helper/class-wc-helper.php index 147ef000b99..0c1895b061b 100644 --- a/includes/admin/helper/class-wc-helper.php +++ b/includes/admin/helper/class-wc-helper.php @@ -61,7 +61,8 @@ class WC_Helper { 'section' => 'helper', 'wc-helper-connect' => 1, 'wc-helper-nonce' => wp_create_nonce( 'connect' ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); include self::get_view_filename( 'html-oauth-start.php' ); @@ -73,7 +74,8 @@ class WC_Helper { 'section' => 'helper', 'wc-helper-disconnect' => 1, 'wc-helper-nonce' => wp_create_nonce( 'disconnect' ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); $current_filter = self::get_current_filter(); @@ -84,7 +86,8 @@ class WC_Helper { 'filter' => $current_filter, 'wc-helper-refresh' => 1, 'wc-helper-nonce' => wp_create_nonce( 'refresh' ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); // Installed plugins and themes, with or without an active subscription. @@ -108,7 +111,8 @@ class WC_Helper { 'wc-helper-product-key' => $subscription['product_key'], 'wc-helper-product-id' => $subscription['product_id'], 'wc-helper-nonce' => wp_create_nonce( 'activate:' . $subscription['product_key'] ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); $subscription['deactivate_url'] = add_query_arg( @@ -120,7 +124,8 @@ class WC_Helper { 'wc-helper-product-key' => $subscription['product_key'], 'wc-helper-product-id' => $subscription['product_id'], 'wc-helper-nonce' => wp_create_nonce( 'deactivate:' . $subscription['product_key'] ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); $subscription['local'] = array( @@ -505,13 +510,15 @@ class WC_Helper { 'wc-helper-deactivate-plugin' => 1, 'wc-helper-product-id' => $subscription['product_id'], 'wc-helper-nonce' => wp_create_nonce( 'deactivate-plugin:' . $subscription['product_id'] ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); /* translators: %1$s: product name, %2$s: deactivate url */ $message = sprintf( __( 'Subscription for %1$s deactivated successfully. You will no longer receive updates for this product. Click here if you wish to deactivate the plugin as well.', 'woocommerce' ), - '' . esc_html( $subscription['product_name'] ) . '', esc_url( $deactivate_plugin_url ) + '' . esc_html( $subscription['product_name'] ) . '', + esc_url( $deactivate_plugin_url ) ); } @@ -552,7 +559,8 @@ class WC_Helper { /* translators: %1$s: product name, %2$s: plugins screen url */ 'message' => sprintf( __( 'An error has occurred when deactivating the extension %1$s. Please proceed to the Plugins screen to deactivate it manually.', 'woocommerce' ), - '' . esc_html( $subscription['product_name'] ) . '', admin_url( 'plugins.php' ) + '' . esc_html( $subscription['product_name'] ) . '', + admin_url( 'plugins.php' ) ), ); break; @@ -640,11 +648,13 @@ class WC_Helper { 'section' => 'helper', 'wc-helper-return' => 1, 'wc-helper-nonce' => wp_create_nonce( 'connect' ), - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); $request = WC_Helper_API::post( - 'oauth/request_token', array( + 'oauth/request_token', + array( 'body' => array( 'home_url' => home_url(), 'redirect_uri' => $redirect_uri, @@ -675,7 +685,8 @@ class WC_Helper { 'home_url' => rawurlencode( home_url() ), 'redirect_uri' => rawurlencode( $redirect_uri ), 'secret' => rawurlencode( $secret ), - ), WC_Helper_API::url( 'oauth/authorize' ) + ), + WC_Helper_API::url( 'oauth/authorize' ) ); wp_redirect( esc_url_raw( $connect_url ) ); @@ -709,7 +720,8 @@ class WC_Helper { // Obtain an access token. $request = WC_Helper_API::post( - 'oauth/access_token', array( + 'oauth/access_token', + array( 'body' => array( 'request_token' => $_GET['request_token'], 'home_url' => home_url(), @@ -731,7 +743,8 @@ class WC_Helper { } WC_Helper_Options::update( - 'auth', array( + 'auth', + array( 'access_token' => $access_token['access_token'], 'access_token_secret' => $access_token['access_token_secret'], 'site_id' => $access_token['site_id'], @@ -767,7 +780,8 @@ class WC_Helper { 'page' => 'wc-addons', 'section' => 'helper', 'wc-helper-status' => 'helper-connected', - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ) ); die(); @@ -792,11 +806,13 @@ class WC_Helper { 'page' => 'wc-addons', 'section' => 'helper', 'wc-helper-status' => 'helper-disconnected', - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); WC_Helper_API::post( - 'oauth/invalidate_token', array( + 'oauth/invalidate_token', + array( 'authenticated' => true, ) ); @@ -834,7 +850,8 @@ class WC_Helper { 'section' => 'helper', 'filter' => self::get_current_filter(), 'wc-helper-status' => 'helper-refreshed', - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); self::_flush_authentication_cache(); @@ -858,7 +875,8 @@ class WC_Helper { } $request = WC_Helper_API::post( - 'activate', array( + 'activate', + array( 'authenticated' => true, 'body' => json_encode( array( @@ -890,7 +908,8 @@ class WC_Helper { 'filter' => self::get_current_filter(), 'wc-helper-status' => $activated ? 'activate-success' : 'activate-error', 'wc-helper-product-id' => $product_id, - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); wp_safe_redirect( $redirect_uri ); @@ -910,7 +929,8 @@ class WC_Helper { } $request = WC_Helper_API::post( - 'deactivate', array( + 'deactivate', + array( 'authenticated' => true, 'body' => json_encode( array( @@ -934,7 +954,8 @@ class WC_Helper { 'filter' => self::get_current_filter(), 'wc-helper-status' => $deactivated ? 'deactivate-success' : 'deactivate-error', 'wc-helper-product-id' => $product_id, - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); wp_safe_redirect( $redirect_uri ); @@ -961,7 +982,8 @@ class WC_Helper { array_merge( self::get_local_woo_plugins(), self::get_local_woo_themes() - ), array( '_product_id' => $product_id ) + ), + array( '_product_id' => $product_id ) ); // Attempt to deactivate this plugin or theme. @@ -981,7 +1003,8 @@ class WC_Helper { 'filter' => self::get_current_filter(), 'wc-helper-status' => $deactivated ? 'deactivate-plugin-success' : 'deactivate-plugin-error', 'wc-helper-product-id' => $product_id, - ), admin_url( 'admin.php' ) + ), + admin_url( 'admin.php' ) ); wp_safe_redirect( $redirect_uri ); @@ -1000,7 +1023,8 @@ class WC_Helper { array_merge( self::get_local_woo_plugins(), self::get_local_woo_themes() - ), array( '_product_id' => $product_id ) + ), + array( '_product_id' => $product_id ) ); if ( ! empty( $local ) ) { @@ -1138,7 +1162,8 @@ class WC_Helper { // Obtain the connected user info. $request = WC_Helper_API::get( - 'subscriptions', array( + 'subscriptions', + array( 'authenticated' => true, ) ); @@ -1212,7 +1237,8 @@ class WC_Helper { } $request = WC_Helper_API::post( - 'activate', array( + 'activate', + array( 'authenticated' => true, 'body' => json_encode( array( @@ -1278,7 +1304,8 @@ class WC_Helper { } $request = WC_Helper_API::post( - 'deactivate', array( + 'deactivate', + array( 'authenticated' => true, 'body' => json_encode( array( @@ -1407,7 +1434,8 @@ class WC_Helper { /* translators: %1$s: helper url, %2$d: number of extensions */ return sprintf( _n( 'Note: You currently have %2$d paid extension which should be updated first before updating WooCommerce.', 'Note: You currently have %2$d paid extensions which should be updated first before updating WooCommerce.', $available, 'woocommerce' ), - admin_url( 'admin.php?page=wc-addons§ion=helper' ), $available + admin_url( 'admin.php?page=wc-addons§ion=helper' ), + $available ); } @@ -1448,7 +1476,8 @@ class WC_Helper { */ public static function _flush_authentication_cache() { $request = WC_Helper_API::get( - 'oauth/me', array( + 'oauth/me', + array( 'authenticated' => true, ) ); @@ -1463,7 +1492,8 @@ class WC_Helper { } WC_Helper_Options::update( - 'auth_user_data', array( + 'auth_user_data', + array( 'name' => $user_data['name'], 'email' => $user_data['email'], ) diff --git a/includes/class-wc-tracker.php b/includes/class-wc-tracker.php index 1994cb50837..ab99163bd29 100644 --- a/includes/class-wc-tracker.php +++ b/includes/class-wc-tracker.php @@ -60,16 +60,19 @@ class WC_Tracker { update_option( 'woocommerce_tracker_last_send', time() ); $params = self::get_tracking_data(); - wp_safe_remote_post( self::$api_url, array( - 'method' => 'POST', - 'timeout' => 45, - 'redirection' => 5, - 'httpversion' => '1.0', - 'blocking' => false, - 'headers' => array( 'user-agent' => 'WooCommerceTracker/' . md5( esc_url_raw( home_url( '/' ) ) ) . ';' ), - 'body' => wp_json_encode( $params ), - 'cookies' => array(), - ) ); + wp_safe_remote_post( + self::$api_url, + array( + 'method' => 'POST', + 'timeout' => 45, + 'redirection' => 5, + 'httpversion' => '1.0', + 'blocking' => false, + 'headers' => array( 'user-agent' => 'WooCommerceTracker/' . md5( esc_url_raw( home_url( '/' ) ) ) . ';' ), + 'body' => wp_json_encode( $params ), + 'cookies' => array(), + ) + ); } /** @@ -87,23 +90,23 @@ class WC_Tracker { * @return array */ private static function get_tracking_data() { - $data = array(); + $data = array(); // General site info. - $data['url'] = home_url(); - $data['email'] = apply_filters( 'woocommerce_tracker_admin_email', get_option( 'admin_email' ) ); - $data['theme'] = self::get_theme_info(); + $data['url'] = home_url(); + $data['email'] = apply_filters( 'woocommerce_tracker_admin_email', get_option( 'admin_email' ) ); + $data['theme'] = self::get_theme_info(); // WordPress Info. - $data['wp'] = self::get_wordpress_info(); + $data['wp'] = self::get_wordpress_info(); // Server Info. - $data['server'] = self::get_server_info(); + $data['server'] = self::get_server_info(); // Plugin info. - $all_plugins = self::get_all_plugins(); - $data['active_plugins'] = $all_plugins['active_plugins']; - $data['inactive_plugins'] = $all_plugins['inactive_plugins']; + $all_plugins = self::get_all_plugins(); + $data['active_plugins'] = $all_plugins['active_plugins']; + $data['inactive_plugins'] = $all_plugins['inactive_plugins']; // Jetpack & WooCommerce Connect. $data['jetpack_version'] = defined( 'JETPACK__VERSION' ) ? JETPACK__VERSION : 'none'; @@ -114,26 +117,26 @@ class WC_Tracker { $data['helper_connected'] = self::get_helper_connected(); // Store count info. - $data['users'] = self::get_user_counts(); - $data['products'] = self::get_product_counts(); - $data['orders'] = self::get_orders(); - $data['reviews'] = self::get_review_counts(); - $data['categories'] = self::get_category_counts(); + $data['users'] = self::get_user_counts(); + $data['products'] = self::get_product_counts(); + $data['orders'] = self::get_orders(); + $data['reviews'] = self::get_review_counts(); + $data['categories'] = self::get_category_counts(); // Payment gateway info. - $data['gateways'] = self::get_active_payment_gateways(); + $data['gateways'] = self::get_active_payment_gateways(); // Shipping method info. - $data['shipping_methods'] = self::get_active_shipping_methods(); + $data['shipping_methods'] = self::get_active_shipping_methods(); // Get all WooCommerce options info. - $data['settings'] = self::get_all_woocommerce_options_values(); + $data['settings'] = self::get_all_woocommerce_options_values(); // Template overrides. $data['template_overrides'] = self::get_all_template_overrides(); // Template overrides. - $data['admin_user_agents'] = self::get_admin_user_agents(); + $data['admin_user_agents'] = self::get_admin_user_agents(); return apply_filters( 'woocommerce_tracker_data', $data ); } @@ -197,20 +200,20 @@ class WC_Tracker { } if ( function_exists( 'ini_get' ) ) { - $server_data['php_post_max_size'] = size_format( wc_let_to_num( ini_get( 'post_max_size' ) ) ); - $server_data['php_time_limt'] = ini_get( 'max_execution_time' ); + $server_data['php_post_max_size'] = size_format( wc_let_to_num( ini_get( 'post_max_size' ) ) ); + $server_data['php_time_limt'] = ini_get( 'max_execution_time' ); $server_data['php_max_input_vars'] = ini_get( 'max_input_vars' ); - $server_data['php_suhosin'] = extension_loaded( 'suhosin' ) ? 'Yes' : 'No'; + $server_data['php_suhosin'] = extension_loaded( 'suhosin' ) ? 'Yes' : 'No'; } $database_version = wc_get_server_database_version(); $server_data['mysql_version'] = $database_version['number']; - $server_data['php_max_upload_size'] = size_format( wp_max_upload_size() ); + $server_data['php_max_upload_size'] = size_format( wp_max_upload_size() ); $server_data['php_default_timezone'] = date_default_timezone_get(); - $server_data['php_soap'] = class_exists( 'SoapClient' ) ? 'Yes' : 'No'; - $server_data['php_fsockopen'] = function_exists( 'fsockopen' ) ? 'Yes' : 'No'; - $server_data['php_curl'] = function_exists( 'curl_init' ) ? 'Yes' : 'No'; + $server_data['php_soap'] = class_exists( 'SoapClient' ) ? 'Yes' : 'No'; + $server_data['php_fsockopen'] = function_exists( 'fsockopen' ) ? 'Yes' : 'No'; + $server_data['php_curl'] = function_exists( 'curl_init' ) ? 'Yes' : 'No'; return $server_data; } @@ -232,7 +235,7 @@ class WC_Tracker { foreach ( $plugins as $k => $v ) { // Take care of formatting the data how we want it. - $formatted = array(); + $formatted = array(); $formatted['name'] = strip_tags( $v['Name'] ); if ( isset( $v['Version'] ) ) { $formatted['version'] = strip_tags( $v['Version'] ); @@ -347,12 +350,15 @@ class WC_Tracker { private static function get_review_counts() { global $wpdb; $review_count = array(); - $counts = $wpdb->get_results( " + $counts = $wpdb->get_results( + " SELECT comment_approved, COUNT(*) AS num_reviews FROM {$wpdb->comments} WHERE comment_type = 'review' GROUP BY comment_approved - ", ARRAY_A ); + ", + ARRAY_A + ); if ( $counts ) { foreach ( $counts as $count ) { if ( 1 === $count['comment_approved'] ) { @@ -451,7 +457,7 @@ class WC_Tracker { $template_paths = apply_filters( 'woocommerce_template_overrides_scan_paths', array( 'WooCommerce' => WC()->plugin_path() . '/templates/' ) ); $scanned_files = array(); - require_once( WC()->plugin_path() . '/includes/admin/class-wc-admin-status.php' ); + require_once WC()->plugin_path() . '/includes/admin/class-wc-admin-status.php'; foreach ( $template_paths as $plugin_name => $template_path ) { $scanned_files[ $plugin_name ] = WC_Admin_Status::scan_template_files( $template_path ); @@ -496,7 +502,8 @@ class WC_Tracker { public static function get_order_totals() { global $wpdb; - $gross_total = $wpdb->get_var( " + $gross_total = $wpdb->get_var( + " SELECT SUM( order_meta.meta_value ) AS 'gross_total' FROM {$wpdb->prefix}posts AS orders @@ -504,7 +511,8 @@ class WC_Tracker { WHERE order_meta.meta_key = '_order_total' AND orders.post_status = 'wc-completed' GROUP BY order_meta.meta_key - " ); + " + ); if ( is_null( $gross_total ) ) { $gross_total = 0; @@ -523,13 +531,16 @@ class WC_Tracker { private static function get_order_dates() { global $wpdb; - $min_max = $wpdb->get_row( " + $min_max = $wpdb->get_row( + " SELECT MIN( post_date_gmt ) as 'first', MAX( post_date_gmt ) as 'last' FROM {$wpdb->prefix}posts WHERE post_type = 'shop_order' AND post_status = 'wc-completed' - ", ARRAY_A ); + ", + ARRAY_A + ); if ( is_null( $min_max ) ) { $min_max = array( From 9ee091210458de7e13b16a67a9869045b7ad52f9 Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:11:43 +1300 Subject: [PATCH 3/8] even more --- includes/admin/settings/class-wc-settings-accounts.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/includes/admin/settings/class-wc-settings-accounts.php b/includes/admin/settings/class-wc-settings-accounts.php index 3c35b68ae98..86f3225470d 100644 --- a/includes/admin/settings/class-wc-settings-accounts.php +++ b/includes/admin/settings/class-wc-settings-accounts.php @@ -36,7 +36,7 @@ class WC_Settings_Accounts extends WC_Settings_Page { $erasure_text = sprintf( '%s', esc_url( admin_url( 'tools.php?page=remove_personal_data' ) ), $erasure_text ); } - $tracking_info_text = sprintf( '%s','https://woocommerce.com/usage-tracking', esc_html__( 'Read more about what we collect', 'woocommerce' ) ); + $tracking_info_text = sprintf( '%s', 'https://woocommerce.com/usage-tracking', esc_html__( 'Read more about what we collect', 'woocommerce' ) ); $settings = apply_filters( 'woocommerce_' . $this->id . '_settings', @@ -243,6 +243,7 @@ class WC_Settings_Accounts extends WC_Settings_Page { array( 'title' => __( 'Enable tracking', 'woocommerce' ), 'desc' => __( 'Allow usage of WooCommerce to be tracked', 'woocommerce' ), + /* Translators: %s URL to tracking info screen. */ 'desc_tip' => sprintf( esc_html__( 'If you would rather opt-out, and do not check this box, we will not know this store exists and we will not collect any usage data. %s.', 'woocommerce' ), $tracking_info_text ), 'id' => 'woocommerce_allow_tracking', 'type' => 'checkbox', From 09dec9083144996598d7c352cc758f758d61d08c Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:20:50 +1300 Subject: [PATCH 4/8] getting there --- includes/admin/helper/class-wc-helper.php | 26 ++++++++++++++++------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/includes/admin/helper/class-wc-helper.php b/includes/admin/helper/class-wc-helper.php index 0c1895b061b..8fd040e4f32 100644 --- a/includes/admin/helper/class-wc-helper.php +++ b/includes/admin/helper/class-wc-helper.php @@ -1,4 +1,11 @@ sprintf( __( 'Version %s is available. To enable this update you need to purchase a new subscription.', 'woocommerce' ), esc_html( $updates[ $data['_product_id'] ]['version'] ) ), 'button_label' => __( 'Purchase', 'woocommerce' ), 'button_url' => $data['_product_url'], @@ -319,11 +329,11 @@ class WC_Helper { WC_Helper_Options::update( 'auth', $auth ); } - // Sort alphabetically + // Sort alphabetically. uasort( $subscriptions, array( __CLASS__, '_sort_by_product_name' ) ); uasort( $no_subscriptions, array( __CLASS__, '_sort_by_name' ) ); - // Filters + // Filters. self::get_filters_counts( $subscriptions ); // Warm it up. self::_filter( $subscriptions, self::get_current_filter() ); @@ -357,7 +367,7 @@ class WC_Helper { * * @param array $subscriptions The array of all available subscriptions. * - * @return array Filter counts (filter => count) + * @return array Filter counts (filter => count). */ public static function get_filters_counts( $subscriptions = null ) { static $filters; @@ -389,8 +399,8 @@ class WC_Helper { $current_filter = 'all'; $valid_filters = array_keys( self::get_filters() ); - if ( ! empty( $_GET['filter'] ) && in_array( $_GET['filter'], $valid_filters ) ) { - $current_filter = $_GET['filter']; + if ( ! empty( $_GET['filter'] ) && in_array( wp_unslash( $_GET['filter'] ), $valid_filters ) ) { + $current_filter = wp_unslash( $_GET['filter'] ); } return $current_filter; @@ -463,7 +473,7 @@ class WC_Helper { * @return array Array pairs of message/type strings with notices. */ private static function _get_return_notices() { - $return_status = isset( $_GET['wc-helper-status'] ) ? $_GET['wc-helper-status'] : null; + $return_status = isset( $_GET['wc-helper-status'] ) ? wp_unslash( $_GET['wc-helper-status'] ) : null; $notices = array(); switch ( $return_status ) { From ea4407de99dca5e210eae0e1a285d173fd9b0ef7 Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:42:23 +1300 Subject: [PATCH 5/8] dione --- includes/admin/class-wc-admin-setup-wizard.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/admin/class-wc-admin-setup-wizard.php b/includes/admin/class-wc-admin-setup-wizard.php index 0308240902c..d94d28de0cc 100644 --- a/includes/admin/class-wc-admin-setup-wizard.php +++ b/includes/admin/class-wc-admin-setup-wizard.php @@ -536,7 +536,7 @@ class WC_Admin_Setup_Wizard { public function wc_setup_store_setup_save() { check_admin_referer( 'wc-setup' ); - // phpcs:disable WordPress.VIP.SuperGlobalInputUsage.AccessDetected, WordPress.VIP.ValidatedSanitizedInput.InputNotValidated, WordPress.VIP.ValidatedSanitizedInput.MissingUnslash + // phpcs:disable WordPress.VIP.SuperGlobalInputUsage.AccessDetected, WordPress.VIP.ValidatedSanitizedInput.InputNotValidated, WordPress.VIP.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput $address = sanitize_text_field( $_POST['store_address'] ); $address_2 = sanitize_text_field( $_POST['store_address_2'] ); $city = sanitize_text_field( $_POST['store_city'] ); From 14d9678513befa7ff2b2939172e975c5a8e1221f Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Fri, 8 Mar 2019 10:48:26 +1300 Subject: [PATCH 6/8] admin --- includes/admin/class-wc-admin.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/includes/admin/class-wc-admin.php b/includes/admin/class-wc-admin.php index 426712b770b..1b42022231f 100644 --- a/includes/admin/class-wc-admin.php +++ b/includes/admin/class-wc-admin.php @@ -179,7 +179,7 @@ class WC_Admin { public function prevent_admin_access() { $prevent_access = false; - if ( apply_filters( 'woocommerce_disable_admin_bar', true ) && ! is_ajax() && basename( wp_unslash( $_SERVER['SCRIPT_FILENAME'] ) ) !== 'admin-post.php' ) { + if ( apply_filters( 'woocommerce_disable_admin_bar', true ) && ! is_ajax() && isset( $_SERVER['SCRIPT_FILENAME'] ) && basename( sanitize_text_field( wp_unslash( $_SERVER['SCRIPT_FILENAME'] ) ) ) !== 'admin-post.php' ) { $has_cap = false; $access_caps = array( 'edit_posts', 'manage_woocommerce', 'view_admin_dashboard' ); @@ -207,7 +207,7 @@ class WC_Admin { public function preview_emails() { if ( isset( $_GET['preview_woocommerce_mail'] ) ) { - if ( ! wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'], 'preview-mail' ) ) ) { + if ( ! ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'], 'preview-mail' ) ) ) ) ) { die( 'Security check' ); } @@ -229,7 +229,7 @@ class WC_Admin { $message = apply_filters( 'woocommerce_mail_content', $email->style_inline( $mailer->wrap_message( $email_heading, $message ) ) ); // print the preview email. - echo $message; + echo esc_html( $message ); exit; } } From 60d478b6423b29902cbae221318e3fd55b7a80ee Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Mon, 11 Mar 2019 11:49:56 +1300 Subject: [PATCH 7/8] wc_clean --- .../admin/class-wc-admin-setup-wizard.php | 26 +++++++------------ 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/includes/admin/class-wc-admin-setup-wizard.php b/includes/admin/class-wc-admin-setup-wizard.php index d94d28de0cc..4b1a2798049 100644 --- a/includes/admin/class-wc-admin-setup-wizard.php +++ b/includes/admin/class-wc-admin-setup-wizard.php @@ -536,22 +536,16 @@ class WC_Admin_Setup_Wizard { public function wc_setup_store_setup_save() { check_admin_referer( 'wc-setup' ); - // phpcs:disable WordPress.VIP.SuperGlobalInputUsage.AccessDetected, WordPress.VIP.ValidatedSanitizedInput.InputNotValidated, WordPress.VIP.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput - $address = sanitize_text_field( $_POST['store_address'] ); - $address_2 = sanitize_text_field( $_POST['store_address_2'] ); - $city = sanitize_text_field( $_POST['store_city'] ); - $country = sanitize_text_field( $_POST['store_country'] ); - $state = isset( $_POST['store_state'] ) ? sanitize_text_field( $_POST['store_state'] ) : false; - $postcode = sanitize_text_field( $_POST['store_postcode'] ); - $currency_code = sanitize_text_field( $_POST['currency_code'] ); - $product_type = sanitize_text_field( $_POST['product_type'] ); - $sell_in_person = isset( $_POST['sell_in_person'] ) && ( 'yes' === sanitize_text_field( $_POST['sell_in_person'] ) ); - $tracking = isset( $_POST['wc_tracker_checkbox'] ) && ( 'yes' === sanitize_text_field( $_POST['wc_tracker_checkbox'] ) ); - // phpcs:enable - - if ( ! $state ) { - $state = '*'; - } + $address = isset( $_POST['store_address'] ) ? wc_clean( wp_unslash( $_POST['store_address'] ) ) : ''; + $address_2 = isset( $_POST['store_address_2'] ) ? wc_clean( wp_unslash( $_POST['store_address_2'] ) ) : ''; + $city = isset( $_POST['store_city'] ) ? wc_clean( wp_unslash( $_POST['store_city'] ) ) : ''; + $country = isset( $_POST['store_country'] ) ? wc_clean( wp_unslash( $_POST['store_country'] ) ) : ''; + $state = isset( $_POST['store_state'] ) ? wc_clean( wp_unslash( $_POST['store_state'] ) ) : '*'; + $postcode = isset( $_POST['store_postcode'] ) ? wc_clean( wp_unslash( $_POST['store_postcode'] ) ) : ''; + $currency_code = isset( $_POST['currency_code'] ) ? wc_clean( wp_unslash( $_POST['currency_code'] ) ) : ''; + $product_type = isset( $_POST['product_type'] ) ? wc_clean( wp_unslash( $_POST['product_type'] ) ) : ''; + $sell_in_person = isset( $_POST['sell_in_person'] ) && ( 'yes' === wc_clean( wp_unslash( $_POST['sell_in_person'] ) ) ); + $tracking = isset( $_POST['wc_tracker_checkbox'] ) && ( 'yes' === wc_clean( wp_unslash( $_POST['wc_tracker_checkbox'] ) ) ); update_option( 'woocommerce_store_address', $address ); update_option( 'woocommerce_store_address_2', $address_2 ); From 6e2c67aef6730b3e172c1c6a166ce172777d54d4 Mon Sep 17 00:00:00 2001 From: Paul Sealock Date: Mon, 11 Mar 2019 11:59:05 +1300 Subject: [PATCH 8/8] dont escape --- includes/admin/class-wc-admin.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/includes/admin/class-wc-admin.php b/includes/admin/class-wc-admin.php index 1b42022231f..77c5d420753 100644 --- a/includes/admin/class-wc-admin.php +++ b/includes/admin/class-wc-admin.php @@ -229,7 +229,9 @@ class WC_Admin { $message = apply_filters( 'woocommerce_mail_content', $email->style_inline( $mailer->wrap_message( $email_heading, $message ) ) ); // print the preview email. - echo esc_html( $message ); + // phpcs:ignore WordPress.Security.EscapeOutput + echo $message; + // phpcs:enable exit; } }