This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * SSI Shipping API Connector |
||
4 | * |
||
5 | * @package PrintCenter\Shipping_API |
||
6 | * @since 1.0.0 |
||
7 | */ |
||
8 | |||
9 | |||
10 | // Exit if accessed directly |
||
11 | if( ! defined( 'ABSPATH' ) ) { |
||
12 | exit; |
||
13 | } |
||
14 | |||
15 | |||
16 | /** |
||
17 | * Main Shipping_API class |
||
18 | * |
||
19 | * @since 1.0.0 |
||
20 | */ |
||
21 | class Shipping_API { |
||
22 | |||
23 | |||
24 | /** |
||
25 | * Get things started |
||
26 | * |
||
27 | * @access public |
||
28 | * @since 1.0.0 |
||
29 | * @return void |
||
30 | */ |
||
31 | public function __construct() { |
||
32 | $this->hooks(); |
||
33 | } |
||
34 | |||
35 | |||
36 | /** |
||
37 | * Run action and filter hooks |
||
38 | * |
||
39 | * @access public |
||
40 | * @since 1.0.0 |
||
41 | * @return void |
||
42 | */ |
||
43 | public function hooks() { |
||
44 | add_action( 'rest_api_init', array( $this, 'api_init' ) ); |
||
45 | add_action( 'woocommerce_admin_order_data_after_shipping_address', array( $this, 'display_order_data' ) ); |
||
46 | add_filter( 'woocommerce_email_classes', array( $this, 'add_shipped_email' ) ); |
||
47 | } |
||
48 | |||
49 | |||
50 | /** |
||
51 | * Initialize our API endpoint |
||
52 | * |
||
53 | * @access public |
||
54 | * @since 1.0.0 |
||
55 | * @return void |
||
56 | */ |
||
57 | public function api_init() { |
||
58 | register_rest_route( 'ssi-shipping/v1', '/order', array( |
||
59 | 'methods' => 'POST', |
||
60 | 'callback' => array( $this, 'process_api_request' ), |
||
61 | 'args' => array( |
||
62 | 'key' => array( |
||
63 | 'required' => true |
||
64 | ) |
||
65 | ) |
||
66 | ) ); |
||
67 | } |
||
68 | |||
69 | |||
70 | /** |
||
71 | * Process a call to the shipping API |
||
72 | * |
||
73 | * @access public |
||
74 | * @since 1.0.0 |
||
75 | * @param array $data Data passed to the API |
||
76 | * @return void |
||
77 | */ |
||
78 | public function process_api_request( $data ) { |
||
79 | $sitekey = md5( home_url() ); |
||
80 | |||
81 | if( $data['key'] == $sitekey ) { |
||
82 | $xmldata = $data->get_body(); |
||
83 | $xmldata = xmlstr_to_array( $xmldata ); |
||
84 | |||
85 | if( isset( $xmldata['@attributes']['id'] ) && isset( $xmldata['@attributes']['status'] ) ) { |
||
86 | $order_id = (int) $xmldata['@attributes']['id']; |
||
87 | |||
88 | // Bail if this isn't an order |
||
89 | if( get_post_type( $order_id ) !== 'shop_order' ) { |
||
90 | return false; |
||
91 | } |
||
92 | |||
93 | // Update shipped status |
||
94 | if( $xmldata['@attributes']['status'] == 'shipped' ) { |
||
95 | update_post_meta( $order_id, '_ssi_shipped', 'true' ); |
||
96 | update_post_meta( $order_id, '_ssi_ship_date', current_time( 'm/d/Y' ) ); |
||
97 | } else { |
||
98 | delete_post_meta( $order_id, '_ssi_shipped' ); |
||
99 | } |
||
100 | |||
101 | if( count( $xmldata['tracking'] ) > 0 ) { |
||
102 | if( count( $xmldata['tracking'] ) > 1 ) { |
||
103 | foreach( $xmldata['tracking'] as $tracking_data ) { |
||
104 | $tracking_numbers[] = $tracking_data['@attributes']['number']; |
||
105 | } |
||
106 | } else { |
||
107 | $tracking_numbers[] = $xmldata['tracking']['@attributes']['number']; |
||
108 | } |
||
109 | |||
110 | update_post_meta( $order_id, '_ssi_tracking_numbers', $tracking_numbers ); |
||
111 | update_post_meta( $order_id, '_ssi_shipper', $xmldata['shipment']['@attributes']['shipper'] ); |
||
112 | } |
||
113 | |||
114 | //do_action( 'printcenter_send_shipping_email', $order_id ); |
||
0 ignored issues
–
show
|
|||
115 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/libraries/class-emogrifier.php'; |
||
116 | require_once WP_PLUGIN_DIR . '/woocommerce/includes/emails/class-wc-email.php'; |
||
117 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
118 | $mail = new WC_Order_Shipped_Email(); |
||
119 | $mail->trigger( $order_id ); |
||
120 | |||
121 | return true; |
||
122 | } |
||
123 | return false; |
||
124 | } else { |
||
125 | return false; |
||
126 | } |
||
127 | } |
||
128 | |||
129 | |||
130 | /** |
||
131 | * Display order data in dashboard |
||
132 | * |
||
133 | * @access public |
||
134 | * @since 1.0.0 |
||
135 | * @param object $order The data for a given order |
||
136 | * @return void |
||
137 | */ |
||
138 | public function display_order_data( $order ) { |
||
139 | $shipping_status = get_post_meta( $order->id, '_ssi_shipped', true ); |
||
140 | $shipper = get_post_meta( $order->id, '_ssi_shipper', true ); |
||
141 | $shipping_date = get_post_meta( $order->id, '_ssi_ship_date', true ); |
||
142 | $tracking_numbers = get_post_meta( $order->id, '_ssi_tracking_numbers' ); |
||
143 | |||
144 | // Mark order as completed |
||
145 | $order->update_status('completed'); |
||
146 | |||
147 | $html = '<h4>' . __( 'Shipping Status', 'printcenter' ) . '</h4>'; |
||
148 | $html .= '<div class="shipping-status">'; |
||
149 | $html .= '<p>'; |
||
150 | $html .= '<strong>' . __( 'Shipped:', 'printcenter' ) . '</strong><br />'; |
||
151 | $html .= ( $shipping_status ? sprintf( __( 'Yes (%s)', 'printcenter' ), $shipping_date ) : __( 'No', 'printcenter' ) ); |
||
152 | $html .= '</p>'; |
||
153 | $html .= '<p>'; |
||
154 | $html .= '<strong>' . __( 'Tracking Numbers:', 'printcenter' ) . '</strong><br />'; |
||
155 | |||
156 | if( $tracking_numbers ) { |
||
157 | foreach( $tracking_numbers[0] as $tracking_number ) { |
||
158 | if( $shipper == 'USPS' ) { |
||
159 | $html .= '<a href="https://tools.usps.com/go/TrackConfirmAction?tLabels=' . $tracking_number . '" target="_blank">' . $tracking_number . '</a><br />'; |
||
160 | } else { |
||
161 | $html .= $tracking_number . '<br />'; |
||
162 | } |
||
163 | } |
||
164 | } else { |
||
165 | $html .= __( 'Unknown', 'printcenter' ); |
||
166 | } |
||
167 | |||
168 | $html .= '</p>'; |
||
169 | $html .= '</div>'; |
||
170 | |||
171 | echo $html; |
||
172 | } |
||
173 | |||
174 | |||
175 | /** |
||
176 | * Adds an email for product shipping notifications |
||
177 | * |
||
178 | * @access public |
||
179 | * @since 1.0.0 |
||
180 | * @param array $email_classes Available email classes |
||
181 | * @return array Filtered available email classes |
||
182 | */ |
||
183 | public function add_shipped_email( $email_classes ) { |
||
184 | require_once PRINTCENTER_DIR . 'includes/class.wc-order-shipped-email.php'; |
||
185 | |||
186 | $email_classes['WC_Order_Shipped_Email'] = new WC_Order_Shipped_Email(); |
||
187 | |||
188 | return $email_classes; |
||
189 | } |
||
190 | } |
||
191 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.