This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
0 ignored issues
–
show
|
|||
2 | /** |
||
3 | * SSI Shipping API Connector |
||
4 | * |
||
5 | * @package PrintCenter\Shipping_API |
||
6 | * @since 1.0.0 |
||
7 | */ |
||
8 | |||
9 | |||
10 | // Exit if accessed directly |
||
11 | if( ! defined( 'ABSPATH' ) ) { |
||
12 | exit; |
||
13 | } |
||
14 | |||
15 | |||
16 | /** |
||
17 | * Main Shipping_API class |
||
18 | * |
||
19 | * @since 1.0.0 |
||
20 | */ |
||
21 | class Shipping_API { |
||
22 | |||
23 | |||
24 | /** |
||
25 | * Get things started |
||
26 | * |
||
27 | * @access public |
||
28 | * @since 1.0.0 |
||
29 | * @return void |
||
30 | */ |
||
31 | public function __construct() { |
||
32 | $this->hooks(); |
||
33 | } |
||
34 | |||
35 | |||
36 | /** |
||
37 | * Run action and filter hooks |
||
38 | * |
||
39 | * @access public |
||
40 | * @since 1.0.0 |
||
41 | * @return void |
||
42 | */ |
||
43 | public function hooks() { |
||
44 | add_action( 'rest_api_init', array( $this, 'api_init' ) ); |
||
45 | add_action( 'woocommerce_admin_order_data_after_shipping_address', array( $this, 'display_order_data' ) ); |
||
46 | add_filter( 'woocommerce_email_classes', array( $this, 'add_shipped_email' ) ); |
||
47 | } |
||
48 | |||
49 | |||
50 | /** |
||
51 | * Initialize our API endpoint |
||
52 | * |
||
53 | * @access public |
||
54 | * @since 1.0.0 |
||
55 | * @return void |
||
56 | */ |
||
57 | public function api_init() { |
||
58 | register_rest_route( 'ssi-shipping/v1', '/order', array( |
||
59 | 'methods' => 'POST', |
||
60 | 'callback' => array( $this, 'process_api_request' ), |
||
61 | 'args' => array( |
||
62 | 'key' => array( |
||
63 | 'required' => true |
||
64 | ) |
||
65 | ) |
||
66 | ) ); |
||
67 | } |
||
68 | |||
69 | |||
70 | /** |
||
71 | * Process a call to the shipping API |
||
72 | * |
||
73 | * @access public |
||
74 | * @since 1.0.0 |
||
75 | * @param array $data Data passed to the API |
||
76 | * @return void |
||
77 | */ |
||
78 | public function process_api_request( $data ) { |
||
79 | $sitekey = md5( home_url() ); |
||
80 | |||
81 | if( $data['key'] == $sitekey ) { |
||
82 | $xmldata = $data->get_body(); |
||
83 | $xmldata = xmlstr_to_array( $xmldata ); |
||
84 | |||
85 | if( isset( $xmldata['@attributes']['id'] ) && isset( $xmldata['@attributes']['status'] ) ) { |
||
86 | $order_id = (int) $xmldata['@attributes']['id']; |
||
87 | |||
88 | // Bail if this isn't an order |
||
89 | if( get_post_type( $order_id ) !== 'shop_order' ) { |
||
90 | return false; |
||
91 | } |
||
92 | |||
93 | // Update shipped status |
||
94 | if( $xmldata['@attributes']['status'] == 'shipped' ) { |
||
95 | update_post_meta( $order_id, '_ssi_shipped', 'true' ); |
||
96 | update_post_meta( $order_id, '_ssi_ship_date', current_time( 'm/d/Y' ) ); |
||
97 | } else { |
||
98 | delete_post_meta( $order_id, '_ssi_shipped' ); |
||
99 | } |
||
100 | |||
101 | if( count( $xmldata['tracking'] ) > 0 ) { |
||
102 | if( count( $xmldata['tracking'] ) > 1 ) { |
||
103 | foreach( $xmldata['tracking'] as $tracking_data ) { |
||
104 | $tracking_numbers[] = $tracking_data['@attributes']['number']; |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$tracking_numbers was never initialized. Although not strictly required by PHP, it is generally a good practice to add $tracking_numbers = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
105 | } |
||
106 | } else { |
||
107 | $tracking_numbers[] = $xmldata['tracking']['@attributes']['number']; |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$tracking_numbers was never initialized. Although not strictly required by PHP, it is generally a good practice to add $tracking_numbers = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
108 | } |
||
109 | |||
110 | update_post_meta( $order_id, '_ssi_tracking_numbers', $tracking_numbers ); |
||
111 | update_post_meta( $order_id, '_ssi_shipper', $xmldata['shipment']['@attributes']['shipper'] ); |
||
112 | } |
||
113 | |||
114 | //do_action( 'printcenter_send_shipping_email', $order_id ); |
||
115 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/libraries/class-emogrifier.php'; |
||
116 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/emails/class-wc-email.php'; |
||
117 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
118 | $mail = new WC_Order_Shipped_Email(); |
||
119 | $mail->trigger( $order_id ); |
||
120 | |||
121 | return true; |
||
122 | } |
||
123 | return false; |
||
124 | } else { |
||
125 | return false; |
||
126 | } |
||
127 | } |
||
128 | |||
129 | |||
130 | /** |
||
131 | * Display order data in dashboard |
||
132 | * |
||
133 | * @access public |
||
134 | * @since 1.0.0 |
||
135 | * @param object $order The data for a given order |
||
136 | * @return void |
||
137 | */ |
||
138 | public function display_order_data( $order ) { |
||
139 | $shipping_status = get_post_meta( $order->id, '_ssi_shipped', true ); |
||
140 | $shipper = get_post_meta( $order->id, '_ssi_shipper', true ); |
||
141 | $shipping_date = get_post_meta( $order->id, '_ssi_ship_date', true ); |
||
142 | $tracking_numbers = get_post_meta( $order->id, '_ssi_tracking_numbers' ); |
||
143 | |||
144 | // Mark order as completed |
||
145 | $order->update_status('completed'); |
||
146 | |||
147 | $html = '<h4>' . __( 'Shipping Status', 'printcenter' ) . '</h4>'; |
||
148 | $html .= '<div class="shipping-status">'; |
||
149 | $html .= '<p>'; |
||
150 | $html .= '<strong>' . __( 'Shipped:', 'printcenter' ) . '</strong><br />'; |
||
151 | $html .= ( $shipping_status ? sprintf( __( 'Yes (%s)', 'printcenter' ), $shipping_date ) : __( 'No', 'printcenter' ) ); |
||
152 | $html .= '</p>'; |
||
153 | $html .= '<p>'; |
||
154 | $html .= '<strong>' . __( 'Tracking Numbers:', 'printcenter' ) . '</strong><br />'; |
||
155 | |||
156 | if( $tracking_numbers ) { |
||
157 | foreach( $tracking_numbers[0] as $tracking_number ) { |
||
158 | if( $shipper == 'USPS' ) { |
||
159 | $html .= '<a href="https://tools.usps.com/go/TrackConfirmAction?tLabels=' . $tracking_number . '" target="_blank">' . $tracking_number . '</a><br />'; |
||
160 | } else { |
||
161 | $html .= $tracking_number . '<br />'; |
||
162 | } |
||
163 | } |
||
164 | } else { |
||
165 | $html .= __( 'Unknown', 'printcenter' ); |
||
166 | } |
||
167 | |||
168 | $html .= '</p>'; |
||
169 | $html .= '</div>'; |
||
170 | |||
171 | echo $html; |
||
172 | } |
||
173 | |||
174 | |||
175 | /** |
||
176 | * Adds an email for product shipping notifications |
||
177 | * |
||
178 | * @access public |
||
179 | * @since 1.0.0 |
||
180 | * @param array $email_classes Available email classes |
||
181 | * @return array Filtered available email classes |
||
182 | */ |
||
183 | public function add_shipped_email( $email_classes ) { |
||
184 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
185 | |||
186 | $email_classes['WC_Order_Shipped_Email'] = new WC_Order_Shipped_Email(); |
||
187 | |||
188 | return $email_classes; |
||
189 | } |
||
190 | } |
||
191 |
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.