This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /** |
||
3 | * Notes class. |
||
4 | * |
||
5 | */ |
||
6 | |||
7 | defined( 'ABSPATH' ) || exit; |
||
8 | |||
9 | /** |
||
10 | * Handles invoice notes. |
||
11 | * |
||
12 | */ |
||
13 | class WPInv_Notes { |
||
14 | |||
15 | /** |
||
16 | * Class constructor. |
||
17 | */ |
||
18 | public function __construct() { |
||
19 | |||
20 | // Filter inovice notes. |
||
21 | add_action( 'pre_get_comments', array( $this, 'set_invoice_note_type' ), 11, 1 ); |
||
22 | add_action( 'comment_feed_where', array( $this, 'wpinv_comment_feed_where' ), 10, 1 ); |
||
23 | |||
24 | // Delete comments count cache whenever there is a new comment or a comment status changes. |
||
25 | add_action( 'wp_insert_comment', array( $this, 'delete_comments_count_cache' ) ); |
||
26 | add_action( 'wp_set_comment_status', array( $this, 'delete_comments_count_cache' ) ); |
||
27 | |||
28 | // Count comments. |
||
29 | add_filter( 'wp_count_comments', array( $this, 'wp_count_comments' ), 100, 2 ); |
||
30 | |||
31 | // Fires after notes are loaded. |
||
32 | do_action( 'wpinv_notes_init', $this ); |
||
33 | } |
||
34 | |||
35 | /** |
||
36 | * Filters invoice notes query to only include our notes. |
||
37 | * |
||
38 | * @param WP_Comment_Query $query |
||
39 | */ |
||
40 | public function set_invoice_note_type( $query ) { |
||
41 | $post_id = ! empty( $query->query_vars['post_ID'] ) ? $query->query_vars['post_ID'] : $query->query_vars['post_id']; |
||
42 | |||
43 | if ( $post_id && getpaid_is_invoice_post_type( get_post_type( $post_id ) ) ) { |
||
44 | $query->query_vars['type'] = 'wpinv_note'; |
||
45 | } else { |
||
46 | |||
47 | if ( empty( $query->query_vars['type__not_in'] ) ) { |
||
48 | $query->query_vars['type__not_in'] = array(); |
||
49 | } |
||
50 | |||
51 | $query->query_vars['type__not_in'] = wpinv_parse_list( $query->query_vars['type__not_in'] ); |
||
52 | $query->query_vars['type__not_in'] = array_merge( array( 'wpinv_note' ), $query->query_vars['type__not_in'] ); |
||
53 | } |
||
54 | |||
55 | return $query; |
||
56 | } |
||
57 | |||
58 | /** |
||
59 | * Exclude notes from the comments feed. |
||
60 | */ |
||
61 | function wpinv_comment_feed_where( $where ) { |
||
0 ignored issues
–
show
|
|||
62 | return $where . ( $where ? ' AND ' : '' ) . " comment_type != 'wpinv_note' "; |
||
63 | } |
||
64 | |||
65 | /** |
||
66 | * Delete comments count cache whenever there is |
||
67 | * new comment or the status of a comment changes. Cache |
||
68 | * will be regenerated next time WPInv_Notes::wp_count_comments() |
||
69 | * is called. |
||
70 | */ |
||
71 | public function delete_comments_count_cache() { |
||
72 | delete_transient( 'getpaid_count_comments' ); |
||
73 | } |
||
74 | |||
75 | /** |
||
76 | * Remove invoice notes from wp_count_comments(). |
||
77 | * |
||
78 | * @since 2.2 |
||
79 | * @param object $stats Comment stats. |
||
80 | * @param int $post_id Post ID. |
||
81 | * @return object |
||
82 | */ |
||
83 | public function wp_count_comments( $stats, $post_id ) { |
||
84 | global $wpdb; |
||
85 | |||
86 | if ( empty( $post_id ) ) { |
||
87 | $stats = get_transient( 'getpaid_count_comments' ); |
||
88 | |||
89 | if ( ! $stats ) { |
||
90 | $stats = array( |
||
91 | 'total_comments' => 0, |
||
92 | 'all' => 0, |
||
93 | ); |
||
94 | |||
95 | $count = $wpdb->get_results( |
||
96 | " |
||
97 | SELECT comment_approved, COUNT(*) AS num_comments |
||
98 | FROM {$wpdb->comments} |
||
99 | WHERE comment_type NOT IN ('action_log', 'order_note', 'webhook_delivery', 'wpinv_note') |
||
100 | GROUP BY comment_approved |
||
101 | ", |
||
102 | ARRAY_A |
||
103 | ); |
||
104 | |||
105 | $approved = array( |
||
106 | '0' => 'moderated', |
||
107 | '1' => 'approved', |
||
108 | 'spam' => 'spam', |
||
109 | 'trash' => 'trash', |
||
110 | 'post-trashed' => 'post-trashed', |
||
111 | ); |
||
112 | |||
113 | foreach ( (array) $count as $row ) { |
||
114 | // Don't count post-trashed toward totals. |
||
115 | if ( ! in_array( $row['comment_approved'], array( 'post-trashed', 'trash', 'spam' ), true ) ) { |
||
116 | $stats['all'] += $row['num_comments']; |
||
117 | $stats['total_comments'] += $row['num_comments']; |
||
118 | } elseif ( ! in_array( $row['comment_approved'], array( 'post-trashed', 'trash' ), true ) ) { |
||
119 | $stats['total_comments'] += $row['num_comments']; |
||
120 | } |
||
121 | if ( isset( $approved[ $row['comment_approved'] ] ) ) { |
||
122 | $stats[ $approved[ $row['comment_approved'] ] ] = $row['num_comments']; |
||
123 | } |
||
124 | } |
||
125 | |||
126 | foreach ( $approved as $key ) { |
||
127 | if ( empty( $stats[ $key ] ) ) { |
||
128 | $stats[ $key ] = 0; |
||
129 | } |
||
130 | } |
||
131 | |||
132 | $stats = (object) $stats; |
||
133 | set_transient( 'getpaid_count_comments', $stats ); |
||
134 | } |
||
135 | } |
||
136 | |||
137 | return $stats; |
||
138 | } |
||
139 | |||
140 | /** |
||
141 | * Returns an array of invoice notes. |
||
142 | * |
||
143 | * @param int $invoice_id The invoice ID whose notes to retrieve. |
||
144 | * @param string $type Optional. Pass in customer to only return customer notes. |
||
145 | * @return WP_Comment[] |
||
146 | */ |
||
147 | public function get_invoice_notes( $invoice_id = 0, $type = 'all' ) { |
||
148 | |||
149 | // Default comment args. |
||
150 | $args = array( |
||
151 | 'post_id' => $invoice_id, |
||
152 | 'orderby' => 'comment_ID', |
||
153 | 'order' => 'ASC', |
||
154 | ); |
||
155 | |||
156 | // Maybe only show customer comments. |
||
157 | if ( $type == 'customer' ) { |
||
158 | $args['meta_key'] = '_wpi_customer_note'; |
||
159 | $args['meta_value'] = 1; |
||
160 | } |
||
161 | |||
162 | $args = apply_filters( 'wpinv_invoice_notes_args', $args, $this, $invoice_id, $type ); |
||
163 | |||
164 | return get_comments( $args ); |
||
165 | } |
||
166 | |||
167 | /** |
||
168 | * Saves an invoice comment. |
||
169 | * |
||
170 | * @param WPInv_Invoice $invoice The invoice to add the comment to. |
||
171 | * @param string $note The note content. |
||
172 | * @param string $note_author The name of the author of the note. |
||
173 | * @param bool $for_customer Whether or not this comment is meant to be sent to the customer. |
||
174 | * @return int|false The new note's ID on success, false on failure. |
||
175 | */ |
||
176 | function add_invoice_note( $invoice, $note, $note_author, $author_email, $for_customer = false ) { |
||
177 | |||
178 | do_action( 'wpinv_pre_insert_invoice_note', $invoice->get_id(), $note, $for_customer ); |
||
179 | |||
180 | /** |
||
181 | * Insert the comment. |
||
182 | */ |
||
183 | $note_id = wp_insert_comment( |
||
184 | wp_filter_comment( |
||
185 | array( |
||
186 | 'comment_post_ID' => $invoice->get_id(), |
||
187 | 'comment_content' => $note, |
||
188 | 'comment_agent' => 'Invoicing', |
||
189 | 'user_id' => get_current_user_id(), |
||
190 | 'comment_author' => $note_author, |
||
191 | 'comment_author_IP' => wpinv_get_ip(), |
||
192 | 'comment_author_email' => $author_email, |
||
193 | 'comment_author_url' => $invoice->get_view_url(), |
||
194 | 'comment_type' => 'wpinv_note', |
||
195 | ) |
||
196 | ) |
||
197 | ); |
||
198 | |||
199 | do_action( 'wpinv_insert_payment_note', $note_id, $invoice->get_id(), $note, $for_customer ); |
||
200 | |||
201 | // Are we notifying the customer? |
||
202 | if ( empty( $note_id ) || empty( $for_customer ) ) { |
||
203 | return $note_id; |
||
204 | } |
||
205 | |||
206 | add_comment_meta( $note_id, '_wpi_customer_note', 1 ); |
||
207 | do_action( |
||
208 | 'wpinv_new_customer_note', |
||
209 | array( |
||
210 | 'invoice_id' => $invoice->get_id(), |
||
211 | 'user_note' => $note, |
||
212 | ) |
||
213 | ); |
||
214 | do_action( 'getpaid_new_customer_note', $invoice, $note ); |
||
215 | return $note_id; |
||
216 | } |
||
217 | |||
218 | } |
||
219 |
Adding explicit visibility (
private
,protected
, orpublic
) is generally recommend to communicate to other developers how, and from where this method is intended to be used.