Section214 /
PrintCenter
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * SSI API Connector |
||
| 4 | * |
||
| 5 | * @package PrintCenter\SSI_API |
||
| 6 | * @since 1.0.0 |
||
| 7 | */ |
||
| 8 | |||
| 9 | |||
| 10 | // Exit if accessed directly |
||
| 11 | if( ! defined( 'ABSPATH' ) ) { |
||
| 12 | exit; |
||
| 13 | } |
||
| 14 | |||
| 15 | |||
| 16 | /** |
||
| 17 | * Main SSI_API class |
||
| 18 | * |
||
| 19 | * @since 1.0.0 |
||
| 20 | */ |
||
| 21 | class SSI_API { |
||
| 22 | |||
| 23 | |||
| 24 | /** |
||
| 25 | * Get things started |
||
| 26 | * |
||
| 27 | * @access public |
||
| 28 | * @since 1.0.0 |
||
| 29 | * @return void |
||
| 30 | */ |
||
| 31 | public function __construct() { |
||
| 32 | $this->hooks(); |
||
| 33 | } |
||
| 34 | |||
| 35 | |||
| 36 | /** |
||
| 37 | * Run action and filter hooks |
||
| 38 | * |
||
| 39 | * @access public |
||
| 40 | * @since 1.0.0 |
||
| 41 | * @return void |
||
| 42 | */ |
||
| 43 | public function hooks() { |
||
| 44 | add_action( 'woocommerce_checkout_order_processed', array( $this, 'process_api_order' ), 10, 2 ); |
||
| 45 | add_action( 'wp_enqueue_scripts', array( $this, 'disable_woocommerce_checkout_scripts' ) ); |
||
| 46 | } |
||
| 47 | |||
| 48 | |||
| 49 | /** |
||
| 50 | * Disable WooCommerce checkout scripts if test mode is active |
||
| 51 | * |
||
| 52 | * @access public |
||
| 53 | * @since 1.0.0 |
||
| 54 | * @return void |
||
| 55 | */ |
||
| 56 | public function disable_woocommerce_checkout_scripts() { |
||
| 57 | if( printcenter()->loader->settings->get_option( 'ssi_mode', 'live' ) == 'test' ) { |
||
| 58 | wp_dequeue_script( 'wc-checkout' ); |
||
| 59 | } |
||
| 60 | } |
||
| 61 | |||
| 62 | |||
| 63 | /** |
||
| 64 | * Process new orders and send to API |
||
| 65 | * |
||
| 66 | * @access public |
||
| 67 | * @since 1.0.0 |
||
| 68 | * @param int $order_id The ID of this order |
||
| 69 | * @param array $posted The data posted for the order |
||
| 70 | * @return void |
||
| 71 | */ |
||
| 72 | public function process_api_order( $order_id = 0, $posted ) { |
||
| 73 | global $the_order; |
||
| 74 | |||
| 75 | if( empty( $the_order ) || $the_order->id != $post->ID ) { |
||
|
0 ignored issues
–
show
|
|||
| 76 | $the_order = wc_get_order( $order_id ); |
||
| 77 | } |
||
| 78 | |||
| 79 | $ship_method_data = $the_order->get_items( 'shipping' ); |
||
| 80 | $ship_method_data = reset( $ship_method_data ); |
||
| 81 | $ship_method_id = str_replace( 'WC_Weight_Based_Shipping_', '', $ship_method_data['item_meta']['method_id'][0] ); |
||
| 82 | $ship_method = new WC_Weight_Based_Shipping( $ship_method_id ); |
||
| 83 | $ship_method = $ship_method->name; |
||
| 84 | |||
| 85 | $ssi_mode = printcenter()->loader->settings->get_option( 'ssi_mode', 'live' ); |
||
| 86 | |||
| 87 | if( $ssi_mode == 'capture' ) { |
||
| 88 | $custid = printcenter()->loader->settings->get_option( 'ssi_test_custid', '1013' ); |
||
| 89 | $custzip = printcenter()->loader->settings->get_option( 'ssi_test_custzip', '99999' ); |
||
| 90 | $endpoint = 'https://orders.silkscreenink.com/capture.asp'; |
||
| 91 | } elseif( $ssi_mode == 'test' ) { |
||
| 92 | $custid = printcenter()->loader->settings->get_option( 'ssi_test_custid', '1013' ); |
||
| 93 | $custzip = printcenter()->loader->settings->get_option( 'ssi_test_custzip', '99999' ); |
||
| 94 | $endpoint = 'https://orders.silkscreenink.com/orderstest/default.asp'; |
||
| 95 | } else { |
||
| 96 | $custid = printcenter()->loader->settings->get_option( 'ssi_custid', '1024' ); |
||
| 97 | $custzip = printcenter()->loader->settings->get_option( 'ssi_custzip', '80304' ); |
||
| 98 | $endpoint = 'https://orders.silkscreenink.com/orderslive/'; |
||
| 99 | } |
||
| 100 | |||
| 101 | $ssi_order = array( |
||
| 102 | 'DocType' => 'Order', |
||
| 103 | 'GarmentsProvided' => 'No', |
||
| 104 | 'CustID' => $custid, |
||
| 105 | 'CustZip' => $custzip, |
||
| 106 | 'PO' => $order_id, |
||
| 107 | 'ShipTo' => array( |
||
| 108 | 'FirstName' => ( $posted['billing_first_name'] ? $posted['billing_first_name'] : '' ), |
||
| 109 | 'LastName' => ( $posted['billing_last_name'] ? $posted['billing_last_name'] : '' ), |
||
| 110 | 'Adrx1' => ( $posted['billing_address_1'] ? $posted['billing_address_1'] : '' ), |
||
| 111 | 'City' => ( $posted['billing_city'] ? $posted['billing_city'] : '' ), |
||
| 112 | 'State' => ( $posted['billing_state'] ? $posted['billing_state'] : '' ), |
||
| 113 | 'Zip' => ( $posted['billing_postcode'] ? $posted['billing_postcode'] : '' ), |
||
| 114 | 'Country' => ( $posted['billing_country'] ? $posted['billing_country'] : '' ), |
||
| 115 | 'Email' => ( $posted['billing_email'] ? $posted['billing_email'] : '' ), |
||
| 116 | 'Phone' => ( $posted['billing_phone'] ? $posted['billing_phone'] : '' ), |
||
| 117 | ), |
||
| 118 | 'ShipMethod' => $ship_method, |
||
| 119 | 'ShipNotifyURL' => home_url( 'wp-json/ssi-shipping/v1/order/?key=' . md5( home_url() ) ), |
||
| 120 | 'ProductionPriority' => 'Normal', |
||
| 121 | ); |
||
| 122 | |||
| 123 | $i = 0; |
||
| 124 | foreach( $the_order->get_items() as $item ) { |
||
| 125 | $product = $the_order->get_product_from_item( $item ); |
||
| 126 | $item_meta = new WC_Order_Item_Meta( $item, $product ); |
||
| 127 | $item_meta = $item_meta->get_formatted(); |
||
| 128 | |||
| 129 | $sku = get_post_meta( $item['product_id'] , '_ssi_sku', true ); |
||
| 130 | $location = get_post_meta( $item['product_id'] , '_ssi_location', true ); |
||
| 131 | $sizing = get_post_meta( $item['product_id'] , '_ssi_sizing', true ); |
||
| 132 | $art = get_post_meta( $item['product_id'] , '_ssi_art', true ); |
||
| 133 | $thumb = wp_get_attachment_image_src( get_post_thumbnail_id( $item['product_id'] ), 'full' ); |
||
| 134 | $thumb = $thumb[0]; |
||
| 135 | |||
| 136 | if( $location == 'front' ) { |
||
| 137 | $location = 'Full Front'; |
||
| 138 | } elseif( $location == 'back' ) { |
||
| 139 | $location = 'Full Back'; |
||
| 140 | } else { |
||
| 141 | $location = 'Left Chest'; |
||
| 142 | } |
||
| 143 | |||
| 144 | $product_variable = new WC_Product_Variable( $item['product_id'] ); |
||
| 145 | $variations = $product_variable->get_available_variations(); |
||
| 146 | |||
| 147 | foreach ( $variations as $variation_id => $variation ) { |
||
| 148 | if( $item['variation_id'] == $variation['id'] ) { |
||
| 149 | $thumb = $variation['image']['url']; |
||
| 150 | } |
||
| 151 | } |
||
| 152 | |||
| 153 | $ssi_order['Item'][$i] = array( |
||
| 154 | 'SKU' => $sku, |
||
| 155 | 'Color' => $item['color'], |
||
| 156 | 'Size' => $item['size'], |
||
| 157 | 'Qty' => $item['qty'], |
||
| 158 | 'DesignLocation' => $location, |
||
| 159 | 'DesignType' => 3, |
||
| 160 | 'DesignArt' => ( isset( $art ) ? $art : false ), |
||
| 161 | 'DesignThumb' => $thumb, |
||
| 162 | 'DesignCategory' => $sizing |
||
| 163 | ); |
||
| 164 | |||
| 165 | $i++; |
||
| 166 | } |
||
| 167 | |||
| 168 | $xml = Array2XML::createXML( 'Request', $ssi_order ); |
||
| 169 | $xml = $xml->saveXML(); |
||
| 170 | |||
| 171 | $content = array( |
||
| 172 | 'headers' => array( |
||
| 173 | 'content-type' => 'text/xml' |
||
| 174 | ), |
||
| 175 | 'body' => $xml |
||
| 176 | ); |
||
| 177 | |||
| 178 | $response = wp_remote_post( $endpoint, $content ); |
||
| 179 | |||
| 180 | if( $ssi_mode == 'test' ) { |
||
| 181 | $response = wp_remote_retrieve_body( $response ); |
||
| 182 | |||
| 183 | echo '<pre>' . printcenter_prettify_xml( $response, true ) . '</pre>'; |
||
| 184 | exit; |
||
|
0 ignored issues
–
show
The method
process_api_order() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an Loading history...
|
|||
| 185 | } |
||
| 186 | } |
||
| 187 | } |
||
| 188 |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.