Section214 /
PrintCenter
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * SSI Shipping API Connector |
||
| 4 | * |
||
| 5 | * @package PrintCenter\Shipping_API |
||
| 6 | * @since 1.0.0 |
||
| 7 | */ |
||
| 8 | |||
| 9 | |||
| 10 | // Exit if accessed directly |
||
| 11 | if( ! defined( 'ABSPATH' ) ) { |
||
| 12 | exit; |
||
| 13 | } |
||
| 14 | |||
| 15 | |||
| 16 | /** |
||
| 17 | * Main Shipping_API class |
||
| 18 | * |
||
| 19 | * @since 1.0.0 |
||
| 20 | */ |
||
| 21 | class Shipping_API { |
||
| 22 | |||
| 23 | |||
| 24 | /** |
||
| 25 | * Get things started |
||
| 26 | * |
||
| 27 | * @access public |
||
| 28 | * @since 1.0.0 |
||
| 29 | * @return void |
||
| 30 | */ |
||
| 31 | public function __construct() { |
||
| 32 | $this->hooks(); |
||
| 33 | } |
||
| 34 | |||
| 35 | |||
| 36 | /** |
||
| 37 | * Run action and filter hooks |
||
| 38 | * |
||
| 39 | * @access public |
||
| 40 | * @since 1.0.0 |
||
| 41 | * @return void |
||
| 42 | */ |
||
| 43 | public function hooks() { |
||
| 44 | add_action( 'rest_api_init', array( $this, 'api_init' ) ); |
||
| 45 | add_action( 'woocommerce_admin_order_data_after_shipping_address', array( $this, 'display_order_data' ) ); |
||
| 46 | add_filter( 'woocommerce_email_classes', array( $this, 'add_shipped_email' ) ); |
||
| 47 | } |
||
| 48 | |||
| 49 | |||
| 50 | /** |
||
| 51 | * Initialize our API endpoint |
||
| 52 | * |
||
| 53 | * @access public |
||
| 54 | * @since 1.0.0 |
||
| 55 | * @return void |
||
| 56 | */ |
||
| 57 | public function api_init() { |
||
| 58 | register_rest_route( 'ssi-shipping/v1', '/order', array( |
||
| 59 | 'methods' => 'POST', |
||
| 60 | 'callback' => array( $this, 'process_api_request' ), |
||
| 61 | 'args' => array( |
||
| 62 | 'key' => array( |
||
| 63 | 'required' => true |
||
| 64 | ) |
||
| 65 | ) |
||
| 66 | ) ); |
||
| 67 | } |
||
| 68 | |||
| 69 | |||
| 70 | /** |
||
| 71 | * Process a call to the shipping API |
||
| 72 | * |
||
| 73 | * @access public |
||
| 74 | * @since 1.0.0 |
||
| 75 | * @param array $data Data passed to the API |
||
| 76 | * @return void |
||
| 77 | */ |
||
| 78 | public function process_api_request( $data ) { |
||
| 79 | $sitekey = md5( home_url() ); |
||
| 80 | |||
| 81 | if( $data['key'] == $sitekey ) { |
||
| 82 | $xmldata = $data->get_body(); |
||
|
0 ignored issues
–
show
|
|||
| 83 | $xmldata = xmlstr_to_array( $xmldata ); |
||
| 84 | |||
| 85 | if( isset( $xmldata['@attributes']['id'] ) && isset( $xmldata['@attributes']['status'] ) ) { |
||
| 86 | $order_id = (int) $xmldata['@attributes']['id']; |
||
| 87 | |||
| 88 | // Bail if this isn't an order |
||
| 89 | if( get_post_type( $order_id ) !== 'shop_order' ) { |
||
| 90 | return false; |
||
| 91 | } |
||
| 92 | |||
| 93 | // Update shipped status |
||
| 94 | if( $xmldata['@attributes']['status'] == 'shipped' ) { |
||
| 95 | update_post_meta( $order_id, '_ssi_shipped', 'true' ); |
||
| 96 | update_post_meta( $order_id, '_ssi_ship_date', current_time( 'm/d/Y' ) ); |
||
| 97 | } else { |
||
| 98 | delete_post_meta( $order_id, '_ssi_shipped' ); |
||
| 99 | } |
||
| 100 | |||
| 101 | if( count( $xmldata['tracking'] ) > 0 ) { |
||
| 102 | if( count( $xmldata['tracking'] ) > 1 ) { |
||
| 103 | foreach( $xmldata['tracking'] as $tracking_data ) { |
||
| 104 | $tracking_numbers[] = $tracking_data['@attributes']['number']; |
||
| 105 | } |
||
| 106 | } else { |
||
| 107 | $tracking_numbers[] = $xmldata['tracking']['@attributes']['number']; |
||
| 108 | } |
||
| 109 | |||
| 110 | update_post_meta( $order_id, '_ssi_tracking_numbers', $tracking_numbers ); |
||
|
0 ignored issues
–
show
The variable
$tracking_numbers does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
Loading history...
|
|||
| 111 | update_post_meta( $order_id, '_ssi_shipper', $xmldata['shipment']['@attributes']['shipper'] ); |
||
| 112 | } |
||
| 113 | |||
| 114 | //do_action( 'printcenter_send_shipping_email', $order_id ); |
||
| 115 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/libraries/class-emogrifier.php'; |
||
| 116 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/emails/class-wc-email.php'; |
||
| 117 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
| 118 | $mail = new WC_Order_Shipped_Email(); |
||
| 119 | $mail->trigger( $order_id ); |
||
| 120 | |||
| 121 | return true; |
||
| 122 | } |
||
| 123 | return false; |
||
| 124 | } else { |
||
| 125 | return false; |
||
| 126 | } |
||
| 127 | } |
||
| 128 | |||
| 129 | |||
| 130 | /** |
||
| 131 | * Display order data in dashboard |
||
| 132 | * |
||
| 133 | * @access public |
||
| 134 | * @since 1.0.0 |
||
| 135 | * @param object $order The data for a given order |
||
| 136 | * @return void |
||
| 137 | */ |
||
| 138 | public function display_order_data( $order ) { |
||
| 139 | $shipping_status = get_post_meta( $order->id, '_ssi_shipped', true ); |
||
| 140 | $shipper = get_post_meta( $order->id, '_ssi_shipper', true ); |
||
| 141 | $shipping_date = get_post_meta( $order->id, '_ssi_ship_date', true ); |
||
| 142 | $tracking_numbers = get_post_meta( $order->id, '_ssi_tracking_numbers' ); |
||
| 143 | |||
| 144 | // Mark order as completed |
||
| 145 | $order->update_status('completed'); |
||
| 146 | |||
| 147 | $html = '<h4>' . __( 'Shipping Status', 'printcenter' ) . '</h4>'; |
||
| 148 | $html .= '<div class="shipping-status">'; |
||
| 149 | $html .= '<p>'; |
||
| 150 | $html .= '<strong>' . __( 'Shipped:', 'printcenter' ) . '</strong><br />'; |
||
| 151 | $html .= ( $shipping_status ? sprintf( __( 'Yes (%s)', 'printcenter' ), $shipping_date ) : __( 'No', 'printcenter' ) ); |
||
| 152 | $html .= '</p>'; |
||
| 153 | $html .= '<p>'; |
||
| 154 | $html .= '<strong>' . __( 'Tracking Numbers:', 'printcenter' ) . '</strong><br />'; |
||
| 155 | |||
| 156 | if( $tracking_numbers ) { |
||
| 157 | foreach( $tracking_numbers[0] as $tracking_number ) { |
||
| 158 | if( $shipper == 'USPS' ) { |
||
| 159 | $html .= '<a href="https://tools.usps.com/go/TrackConfirmAction?tLabels=' . $tracking_number . '" target="_blank">' . $tracking_number . '</a><br />'; |
||
| 160 | } else { |
||
| 161 | $html .= $tracking_number . '<br />'; |
||
| 162 | } |
||
| 163 | } |
||
| 164 | } else { |
||
| 165 | $html .= __( 'Unknown', 'printcenter' ); |
||
| 166 | } |
||
| 167 | |||
| 168 | $html .= '</p>'; |
||
| 169 | $html .= '</div>'; |
||
| 170 | |||
| 171 | echo $html; |
||
| 172 | } |
||
| 173 | |||
| 174 | |||
| 175 | /** |
||
| 176 | * Adds an email for product shipping notifications |
||
| 177 | * |
||
| 178 | * @access public |
||
| 179 | * @since 1.0.0 |
||
| 180 | * @param array $email_classes Available email classes |
||
| 181 | * @return array Filtered available email classes |
||
| 182 | */ |
||
| 183 | public function add_shipped_email( $email_classes ) { |
||
| 184 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
| 185 | |||
| 186 | $email_classes['WC_Order_Shipped_Email'] = new WC_Order_Shipped_Email(); |
||
| 187 | |||
| 188 | return $email_classes; |
||
| 189 | } |
||
| 190 | } |
||
| 191 |
Methods can only be called on objects. This check looks for methods being called on variables that have been inferred to never be objects.