This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
0 ignored issues
–
show
|
|||
2 | /** |
||
3 | * SSI Shipping API Connector |
||
4 | * |
||
5 | * @package PrintCenter\Shipping_API |
||
6 | * @since 1.0.0 |
||
7 | */ |
||
8 | |||
9 | |||
10 | // Exit if accessed directly |
||
11 | if( ! defined( 'ABSPATH' ) ) { |
||
12 | exit; |
||
13 | } |
||
14 | |||
15 | |||
16 | /** |
||
17 | * Main Shipping_API class |
||
18 | * |
||
19 | * @since 1.0.0 |
||
20 | */ |
||
21 | class Shipping_API { |
||
22 | |||
23 | |||
24 | /** |
||
25 | * Get things started |
||
26 | * |
||
27 | * @access public |
||
28 | * @since 1.0.0 |
||
29 | * @return void |
||
30 | */ |
||
31 | public function __construct() { |
||
32 | $this->hooks(); |
||
33 | } |
||
34 | |||
35 | |||
36 | /** |
||
37 | * Run action and filter hooks |
||
38 | * |
||
39 | * @access public |
||
40 | * @since 1.0.0 |
||
41 | * @return void |
||
42 | */ |
||
43 | public function hooks() { |
||
44 | add_action( 'rest_api_init', array( $this, 'api_init' ) ); |
||
45 | add_action( 'woocommerce_admin_order_data_after_shipping_address', array( $this, 'display_order_data' ) ); |
||
46 | add_filter( 'woocommerce_email_classes', array( $this, 'add_shipped_email' ) ); |
||
47 | } |
||
48 | |||
49 | |||
50 | /** |
||
51 | * Initialize our API endpoint |
||
52 | * |
||
53 | * @access public |
||
54 | * @since 1.0.0 |
||
55 | * @return void |
||
56 | */ |
||
57 | public function api_init() { |
||
58 | register_rest_route( 'ssi-shipping/v1', '/order', array( |
||
59 | 'methods' => 'POST', |
||
60 | 'callback' => array( $this, 'process_api_request' ), |
||
61 | 'args' => array( |
||
62 | 'key' => array( |
||
63 | 'required' => true |
||
64 | ) |
||
65 | ) |
||
66 | ) ); |
||
67 | } |
||
68 | |||
69 | |||
70 | /** |
||
71 | * Process a call to the shipping API |
||
72 | * |
||
73 | * @access public |
||
74 | * @since 1.0.0 |
||
75 | * @param array $data Data passed to the API |
||
76 | * @return void |
||
77 | */ |
||
78 | public function process_api_request( $data ) { |
||
79 | $sitekey = md5( home_url() ); |
||
80 | |||
81 | if( $data['key'] == $sitekey ) { |
||
82 | $xmldata = $data->get_body(); |
||
83 | $xmldata = xmlstr_to_array( $xmldata ); |
||
84 | |||
85 | if( isset( $xmldata['@attributes']['id'] ) && isset( $xmldata['@attributes']['status'] ) ) { |
||
86 | $order_id = (int) $xmldata['@attributes']['id']; |
||
87 | |||
88 | // Bail if this isn't an order |
||
89 | if( get_post_type( $order_id ) !== 'shop_order' ) { |
||
90 | return false; |
||
91 | } |
||
92 | |||
93 | // Update shipped status |
||
94 | if( $xmldata['@attributes']['status'] == 'shipped' ) { |
||
95 | update_post_meta( $order_id, '_ssi_shipped', 'true' ); |
||
96 | update_post_meta( $order_id, '_ssi_ship_date', current_time( 'm/d/Y' ) ); |
||
97 | } else { |
||
98 | delete_post_meta( $order_id, '_ssi_shipped' ); |
||
99 | } |
||
100 | |||
101 | if( count( $xmldata['tracking'] ) > 0 ) { |
||
102 | if( count( $xmldata['tracking'] ) > 1 ) { |
||
103 | foreach( $xmldata['tracking'] as $tracking_data ) { |
||
104 | $tracking_numbers[] = $tracking_data['@attributes']['number']; |
||
105 | } |
||
106 | } else { |
||
107 | $tracking_numbers[] = $xmldata['tracking']['@attributes']['number']; |
||
108 | } |
||
109 | |||
110 | update_post_meta( $order_id, '_ssi_tracking_numbers', $tracking_numbers ); |
||
111 | update_post_meta( $order_id, '_ssi_shipper', $xmldata['shipment']['@attributes']['shipper'] ); |
||
112 | } |
||
113 | |||
114 | //do_action( 'printcenter_send_shipping_email', $order_id ); |
||
115 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/libraries/class-emogrifier.php'; |
||
116 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/emails/class-wc-email.php'; |
||
117 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
118 | $mail = new WC_Order_Shipped_Email(); |
||
119 | $mail->trigger( $order_id ); |
||
120 | |||
121 | return true; |
||
122 | } |
||
123 | return false; |
||
124 | } else { |
||
125 | return false; |
||
126 | } |
||
127 | } |
||
128 | |||
129 | |||
130 | /** |
||
131 | * Display order data in dashboard |
||
132 | * |
||
133 | * @access public |
||
134 | * @since 1.0.0 |
||
135 | * @param object $order The data for a given order |
||
136 | * @return void |
||
137 | */ |
||
138 | public function display_order_data( $order ) { |
||
139 | $shipping_status = get_post_meta( $order->id, '_ssi_shipped', true ); |
||
140 | $shipper = get_post_meta( $order->id, '_ssi_shipper', true ); |
||
141 | $shipping_date = get_post_meta( $order->id, '_ssi_ship_date', true ); |
||
142 | $tracking_numbers = get_post_meta( $order->id, '_ssi_tracking_numbers' ); |
||
143 | |||
144 | // Mark order as completed |
||
145 | $order->update_status('completed'); |
||
146 | |||
147 | $html = '<h4>' . __( 'Shipping Status', 'printcenter' ) . '</h4>'; |
||
148 | $html .= '<div class="shipping-status">'; |
||
149 | $html .= '<p>'; |
||
150 | $html .= '<strong>' . __( 'Shipped:', 'printcenter' ) . '</strong><br />'; |
||
151 | $html .= ( $shipping_status ? sprintf( __( 'Yes (%s)', 'printcenter' ), $shipping_date ) : __( 'No', 'printcenter' ) ); |
||
152 | $html .= '</p>'; |
||
153 | $html .= '<p>'; |
||
154 | $html .= '<strong>' . __( 'Tracking Numbers:', 'printcenter' ) . '</strong><br />'; |
||
155 | |||
156 | if( $tracking_numbers ) { |
||
157 | foreach( $tracking_numbers[0] as $tracking_number ) { |
||
158 | if( $shipper == 'USPS' ) { |
||
159 | $html .= '<a href="https://tools.usps.com/go/TrackConfirmAction?tLabels=' . $tracking_number . '" target="_blank">' . $tracking_number . '</a><br />'; |
||
160 | } else { |
||
161 | $html .= $tracking_number . '<br />'; |
||
162 | } |
||
163 | } |
||
164 | } else { |
||
165 | $html .= __( 'Unknown', 'printcenter' ); |
||
166 | } |
||
167 | |||
168 | $html .= '</p>'; |
||
169 | $html .= '</div>'; |
||
170 | |||
171 | echo $html; |
||
172 | } |
||
173 | |||
174 | |||
175 | /** |
||
176 | * Adds an email for product shipping notifications |
||
177 | * |
||
178 | * @access public |
||
179 | * @since 1.0.0 |
||
180 | * @param array $email_classes Available email classes |
||
181 | * @return array Filtered available email classes |
||
182 | */ |
||
183 | public function add_shipped_email( $email_classes ) { |
||
184 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
185 | |||
186 | $email_classes['WC_Order_Shipped_Email'] = new WC_Order_Shipped_Email(); |
||
187 | |||
188 | return $email_classes; |
||
189 | } |
||
190 | } |
||
191 |
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.