Completed
Pull Request — master (#1478)
by
unknown
10:44
created

WC_Gateway_Stripe::settings_api_sanitized_fields()   A

Complexity

Conditions 3
Paths 3

Size

Total Lines 8

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 3
nc 3
nop 1
dl 0
loc 8
rs 10
c 0
b 0
f 0
1
<?php
2
if ( ! defined( 'ABSPATH' ) ) {
3
	exit;
4
}
5
6
/**
7
 * WC_Gateway_Stripe class.
8
 *
9
 * @extends WC_Payment_Gateway
10
 */
11
class WC_Gateway_Stripe extends WC_Stripe_Payment_Gateway {
12
	/**
13
	 * The delay between retries.
14
	 *
15
	 * @var int
16
	 */
17
	public $retry_interval;
18
19
	/**
20
	 * Should we capture Credit cards
21
	 *
22
	 * @var bool
23
	 */
24
	public $capture;
25
26
	/**
27
	 * Alternate credit card statement name
28
	 *
29
	 * @var bool
30
	 */
31
	public $statement_descriptor;
32
33
	/**
34
	 * Should we store the users credit cards?
35
	 *
36
	 * @var bool
37
	 */
38
	public $saved_cards;
39
40
	/**
41
	 * API access secret key
42
	 *
43
	 * @var string
44
	 */
45
	public $secret_key;
46
47
	/**
48
	 * Api access publishable key
49
	 *
50
	 * @var string
51
	 */
52
	public $publishable_key;
53
54
	/**
55
	 * Do we accept Payment Request?
56
	 *
57
	 * @var bool
58
	 */
59
	public $payment_request;
60
61
	/**
62
	 * Is test mode active?
63
	 *
64
	 * @var bool
65
	 */
66
	public $testmode;
67
68
	/**
69
	 * Inline CC form styling
70
	 *
71
	 * @var string
72
	 */
73
	public $inline_cc_form;
74
75
	/**
76
	 * Pre Orders Object
77
	 *
78
	 * @var object
79
	 */
80
	public $pre_orders;
81
82
	/**
83
	 * Constructor
84
	 */
85
	public function __construct() {
86
		$this->retry_interval = 1;
87
		$this->id             = 'stripe';
88
		$this->method_title   = __( 'Stripe', 'woocommerce-gateway-stripe' );
89
		/* translators: 1) link to Stripe register page 2) link to Stripe api keys page */
90
		$this->method_description = __( 'Stripe works by adding payment fields on the checkout and then sending the details to Stripe for verification.', 'woocommerce-gateway-stripe' );
91
		$this->has_fields         = true;
92
		$this->supports           = array(
93
			'products',
94
			'refunds',
95
			'tokenization',
96
			'add_payment_method',
97
			'subscriptions',
98
			'subscription_cancellation',
99
			'subscription_suspension',
100
			'subscription_reactivation',
101
			'subscription_amount_changes',
102
			'subscription_date_changes',
103
			'subscription_payment_method_change',
104
			'subscription_payment_method_change_customer',
105
			'subscription_payment_method_change_admin',
106
			'multiple_subscriptions',
107
			'pre-orders',
108
		);
109
110
		// Load the form fields.
111
		$this->init_form_fields();
112
113
		// Load the settings.
114
		$this->init_settings();
115
116
		// Get setting values.
117
		$this->title                = $this->get_option( 'title' );
118
		$this->description          = $this->get_option( 'description' );
119
		$this->enabled              = $this->get_option( 'enabled' );
120
		$this->testmode             = 'yes' === $this->get_option( 'testmode' );
121
		$this->inline_cc_form       = 'yes' === $this->get_option( 'inline_cc_form' );
0 ignored issues
show
Documentation Bug introduced by
The property $inline_cc_form was declared of type string, but 'yes' === $this->get_option('inline_cc_form') is of type boolean. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
122
		$this->capture              = 'yes' === $this->get_option( 'capture', 'yes' );
123
		$this->statement_descriptor = WC_Stripe_Helper::clean_statement_descriptor( $this->get_option( 'statement_descriptor' ) );
0 ignored issues
show
Documentation Bug introduced by
The property $statement_descriptor was declared of type boolean, but \WC_Stripe_Helper::clean...statement_descriptor')) is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
124
		$this->saved_cards          = 'yes' === $this->get_option( 'saved_cards' );
125
		$this->secret_key           = $this->testmode ? $this->get_option( 'test_secret_key' ) : $this->get_option( 'secret_key' );
126
		$this->publishable_key      = $this->testmode ? $this->get_option( 'test_publishable_key' ) : $this->get_option( 'publishable_key' );
127
		$this->payment_request      = 'yes' === $this->get_option( 'payment_request', 'yes' );
128
129
		WC_Stripe_API::set_secret_key( $this->secret_key );
130
131
		// Hooks.
132
		add_action( 'wp_enqueue_scripts', array( $this, 'payment_scripts' ) );
133
		add_action( 'admin_enqueue_scripts', array( $this, 'admin_scripts' ) );
134
		add_action( 'woocommerce_update_options_payment_gateways_' . $this->id, array( $this, 'process_admin_options' ) );
135
		add_action( 'woocommerce_admin_order_totals_after_total', array( $this, 'display_order_fee' ) );
136
		add_action( 'woocommerce_admin_order_totals_after_total', array( $this, 'display_order_payout' ), 20 );
137
		add_action( 'woocommerce_customer_save_address', array( $this, 'show_update_card_notice' ), 10, 2 );
138
		add_filter( 'woocommerce_available_payment_gateways', array( $this, 'prepare_order_pay_page' ) );
139
		add_action( 'woocommerce_account_view-order_endpoint', array( $this, 'check_intent_status_on_order_page' ), 1 );
140
		add_filter( 'woocommerce_payment_successful_result', array( $this, 'modify_successful_payment_result' ), 99999, 2 );
141
		add_action( 'set_logged_in_cookie', array( $this, 'set_cookie_on_current_request' ) );
142
		add_filter( 'woocommerce_get_checkout_payment_url', array( $this, 'get_checkout_payment_url' ), 10, 2 );
143
		add_filter( 'woocommerce_settings_api_sanitized_fields_' . $this->id, array( $this, 'settings_api_sanitized_fields' ) );
144
145
		// Note: display error is in the parent class.
146
		add_action( 'admin_notices', array( $this, 'display_errors' ), 9999 );
147
148 View Code Duplication
		if ( WC_Stripe_Helper::is_pre_orders_exists() ) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
149
			$this->pre_orders = new WC_Stripe_Pre_Orders_Compat();
150
151
			add_action( 'wc_pre_orders_process_pre_order_completion_payment_' . $this->id, array( $this->pre_orders, 'process_pre_order_release_payment' ) );
152
		}
153
	}
154
155
	/**
156
	 * Checks if gateway should be available to use.
157
	 *
158
	 * @since 4.0.2
159
	 */
160
	public function is_available() {
161
		if ( is_add_payment_method_page() && ! $this->saved_cards ) {
162
			return false;
163
		}
164
165
		return parent::is_available();
166
	}
167
168
	/**
169
	 * Adds a notice for customer when they update their billing address.
170
	 *
171
	 * @since 4.1.0
172
	 * @param int    $user_id      The ID of the current user.
173
	 * @param string $load_address The address to load.
174
	 */
175
	public function show_update_card_notice( $user_id, $load_address ) {
176
		if ( ! $this->saved_cards || ! WC_Stripe_Payment_Tokens::customer_has_saved_methods( $user_id ) || 'billing' !== $load_address ) {
177
			return;
178
		}
179
180
		/* translators: 1) Opening anchor tag 2) closing anchor tag */
181
		wc_add_notice( sprintf( __( 'If your billing address has been changed for saved payment methods, be sure to remove any %1$ssaved payment methods%2$s on file and re-add them.', 'woocommerce-gateway-stripe' ), '<a href="' . esc_url( wc_get_endpoint_url( 'payment-methods' ) ) . '" class="wc-stripe-update-card-notice" style="text-decoration:underline;">', '</a>' ), 'notice' );
182
	}
183
184
	/**
185
	 * Get_icon function.
186
	 *
187
	 * @since 1.0.0
188
	 * @version 4.0.0
189
	 * @return string
190
	 */
191
	public function get_icon() {
192
		$icons = $this->payment_icons();
193
194
		$icons_str = '';
195
196
		$icons_str .= isset( $icons['visa'] ) ? $icons['visa'] : '';
197
		$icons_str .= isset( $icons['amex'] ) ? $icons['amex'] : '';
198
		$icons_str .= isset( $icons['mastercard'] ) ? $icons['mastercard'] : '';
199
200
		if ( 'USD' === get_woocommerce_currency() ) {
201
			$icons_str .= isset( $icons['discover'] ) ? $icons['discover'] : '';
202
			$icons_str .= isset( $icons['jcb'] ) ? $icons['jcb'] : '';
203
			$icons_str .= isset( $icons['diners'] ) ? $icons['diners'] : '';
204
		}
205
206
		return apply_filters( 'woocommerce_gateway_icon', $icons_str, $this->id );
207
	}
208
209
	/**
210
	 * Initialise Gateway Settings Form Fields
211
	 */
212
	public function init_form_fields() {
213
		$this->form_fields = require( dirname( __FILE__ ) . '/admin/stripe-settings.php' );
214
	}
215
216
	/**
217
	 * Payment form on checkout page
218
	 */
219
	public function payment_fields() {
220
		global $wp;
221
		$user                 = wp_get_current_user();
222
		$display_tokenization = $this->supports( 'tokenization' ) && is_checkout() && $this->saved_cards;
223
		$total                = WC()->cart->total;
0 ignored issues
show
Unused Code introduced by
$total is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
224
		$user_email           = '';
225
		$description          = $this->get_description();
226
		$description          = ! empty( $description ) ? $description : '';
227
		$firstname            = '';
228
		$lastname             = '';
229
230
		// If paying from order, we need to get total from order not cart.
231
		if ( isset( $_GET['pay_for_order'] ) && ! empty( $_GET['key'] ) ) { // wpcs: csrf ok.
232
			$order      = wc_get_order( wc_clean( $wp->query_vars['order-pay'] ) ); // wpcs: csrf ok, sanitization ok.
233
			$total      = $order->get_total();
0 ignored issues
show
Unused Code introduced by
$total is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
234
			$user_email = $order->get_billing_email();
235
		} else {
236
			if ( $user->ID ) {
237
				$user_email = get_user_meta( $user->ID, 'billing_email', true );
238
				$user_email = $user_email ? $user_email : $user->user_email;
239
			}
240
		}
241
242
		if ( is_add_payment_method_page() ) {
243
			$firstname       = $user->user_firstname;
244
			$lastname        = $user->user_lastname;
245
		}
246
247
		ob_start();
248
249
		echo '<div
250
			id="stripe-payment-data"
251
			data-email="' . esc_attr( $user_email ) . '"
252
			data-full-name="' . esc_attr( $firstname . ' ' . $lastname ) . '"
253
			data-currency="' . esc_attr( strtolower( get_woocommerce_currency() ) ) . '"
254
		>';
255
256
		if ( $this->testmode ) {
257
			/* translators: link to Stripe testing page */
258
			$description .= ' ' . sprintf( __( 'TEST MODE ENABLED. In test mode, you can use the card number 4242424242424242 with any CVC and a valid expiration date or check the <a href="%s" target="_blank">Testing Stripe documentation</a> for more card numbers.', 'woocommerce-gateway-stripe' ), 'https://stripe.com/docs/testing' );
259
		}
260
261
		$description = trim( $description );
262
263
		echo apply_filters( 'wc_stripe_description', wpautop( wp_kses_post( $description ) ), $this->id ); // wpcs: xss ok.
264
265
		if ( $display_tokenization ) {
266
			$this->tokenization_script();
267
			$this->saved_payment_methods();
268
		}
269
270
		$this->elements_form();
271
272 View Code Duplication
		if ( apply_filters( 'wc_stripe_display_save_payment_method_checkbox', $display_tokenization ) && ! is_add_payment_method_page() && ! isset( $_GET['change_payment_method'] ) ) { // wpcs: csrf ok.
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
273
274
			$this->save_payment_method_checkbox();
275
		}
276
277
		do_action( 'wc_stripe_cards_payment_fields', $this->id );
278
279
		echo '</div>';
280
281
		ob_end_flush();
282
	}
283
284
	/**
285
	 * Renders the Stripe elements form.
286
	 *
287
	 * @since 4.0.0
288
	 * @version 4.0.0
289
	 */
290
	public function elements_form() {
291
		?>
292
		<fieldset id="wc-<?php echo esc_attr( $this->id ); ?>-cc-form" class="wc-credit-card-form wc-payment-form" style="background:transparent;">
293
			<?php do_action( 'woocommerce_credit_card_form_start', $this->id ); ?>
294
295
			<?php if ( $this->inline_cc_form ) { ?>
296
				<label for="card-element">
297
					<?php esc_html_e( 'Credit or debit card', 'woocommerce-gateway-stripe' ); ?>
298
				</label>
299
300
				<div id="stripe-card-element" class="wc-stripe-elements-field">
301
				<!-- a Stripe Element will be inserted here. -->
302
				</div>
303
			<?php } else { ?>
304
				<div class="form-row form-row-wide">
305
					<label for="stripe-card-element"><?php esc_html_e( 'Card Number', 'woocommerce-gateway-stripe' ); ?> <span class="required">*</span></label>
306
					<div class="stripe-card-group">
307
						<div id="stripe-card-element" class="wc-stripe-elements-field">
308
						<!-- a Stripe Element will be inserted here. -->
309
						</div>
310
311
						<i class="stripe-credit-card-brand stripe-card-brand" alt="Credit Card"></i>
312
					</div>
313
				</div>
314
315
				<div class="form-row form-row-first">
316
					<label for="stripe-exp-element"><?php esc_html_e( 'Expiry Date', 'woocommerce-gateway-stripe' ); ?> <span class="required">*</span></label>
317
318
					<div id="stripe-exp-element" class="wc-stripe-elements-field">
319
					<!-- a Stripe Element will be inserted here. -->
320
					</div>
321
				</div>
322
323
				<div class="form-row form-row-last">
324
					<label for="stripe-cvc-element"><?php esc_html_e( 'Card Code (CVC)', 'woocommerce-gateway-stripe' ); ?> <span class="required">*</span></label>
325
				<div id="stripe-cvc-element" class="wc-stripe-elements-field">
326
				<!-- a Stripe Element will be inserted here. -->
327
				</div>
328
				</div>
329
				<div class="clear"></div>
330
			<?php } ?>
331
332
			<!-- Used to display form errors -->
333
			<div class="stripe-source-errors" role="alert"></div>
334
			<br />
335
			<?php do_action( 'woocommerce_credit_card_form_end', $this->id ); ?>
336
			<div class="clear"></div>
337
		</fieldset>
338
		<?php
339
	}
340
341
	/**
342
	 * Load admin scripts.
343
	 *
344
	 * @since 3.1.0
345
	 * @version 3.1.0
346
	 */
347
	public function admin_scripts() {
348
		if ( 'woocommerce_page_wc-settings' !== get_current_screen()->id ) {
349
			return;
350
		}
351
352
		$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
353
354
		wp_register_script( 'woocommerce_stripe_admin', plugins_url( 'assets/js/stripe-admin' . $suffix . '.js', WC_STRIPE_MAIN_FILE ), array(), WC_STRIPE_VERSION, true );
355
356
		$params = array(
357
			'time'             => time(),
358
			'i18n_out_of_sync' => wp_kses(
359
				__( '<strong>Warning:</strong> your site\'s time does not match the time on your browser and may be incorrect. Some payment methods depend on webhook verification and verifying webhooks with a signing secret depends on your site\'s time being correct, so please check your site\'s time before setting a webhook secret. You may need to contact your site\'s hosting provider to correct the site\'s time.', 'woocommerce-gateway-stripe' ),
360
				array( 'strong' => array() )
361
			),
362
		);
363
		wp_localize_script( 'woocommerce_stripe_admin', 'wc_stripe_settings_params', $params );
364
365
		wp_enqueue_script( 'woocommerce_stripe_admin' );
366
	}
367
368
	/**
369
	 * Payment_scripts function.
370
	 *
371
	 * Outputs scripts used for stripe payment
372
	 *
373
	 * @since 3.1.0
374
	 * @version 4.0.0
375
	 */
376
	public function payment_scripts() {
377
		global $wp;
378
		if (
379
			! is_product()
380
			&& ! is_cart()
381
			&& ! is_checkout()
382
			&& ! isset( $_GET['pay_for_order'] ) // wpcs: csrf ok.
383
			&& ! is_add_payment_method_page()
384
			&& ! isset( $_GET['change_payment_method'] ) // wpcs: csrf ok.
385
			&& ! ( ! empty( get_query_var( 'view-subscription' ) ) && is_callable( 'WCS_Early_Renewal_Manager::is_early_renewal_via_modal_enabled' ) && WCS_Early_Renewal_Manager::is_early_renewal_via_modal_enabled() )
386
			|| ( is_order_received_page() )
387
		) {
388
			return;
389
		}
390
391
		// If Stripe is not enabled bail.
392
		if ( 'no' === $this->enabled ) {
393
			return;
394
		}
395
396
		// If keys are not set bail.
397
		if ( ! $this->are_keys_set() ) {
398
			WC_Stripe_Logger::log( 'Keys are not set correctly.' );
399
			return;
400
		}
401
402
		// If no SSL bail.
403
		if ( ! $this->testmode && ! is_ssl() ) {
404
			WC_Stripe_Logger::log( 'Stripe live mode requires SSL.' );
405
			return;
406
		}
407
408
		$current_theme = wp_get_theme();
0 ignored issues
show
Unused Code introduced by
$current_theme is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
409
410
		$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
411
412
		wp_register_style( 'stripe_styles', plugins_url( 'assets/css/stripe-styles.css', WC_STRIPE_MAIN_FILE ), array(), WC_STRIPE_VERSION );
413
		wp_enqueue_style( 'stripe_styles' );
414
415
		wp_register_script( 'stripe', 'https://js.stripe.com/v3/', '', '3.0', true );
416
		wp_register_script( 'woocommerce_stripe', plugins_url( 'assets/js/stripe' . $suffix . '.js', WC_STRIPE_MAIN_FILE ), array( 'jquery-payment', 'stripe' ), WC_STRIPE_VERSION, true );
417
418
		$stripe_params = array(
419
			'key'                  => $this->publishable_key,
420
			'i18n_terms'           => __( 'Please accept the terms and conditions first', 'woocommerce-gateway-stripe' ),
421
			'i18n_required_fields' => __( 'Please fill in required checkout fields first', 'woocommerce-gateway-stripe' ),
422
		);
423
424
		// If we're on the pay page we need to pass stripe.js the address of the order.
425
		if ( isset( $_GET['pay_for_order'] ) && 'true' === $_GET['pay_for_order'] ) { // wpcs: csrf ok.
426
			$order_id = wc_clean( $wp->query_vars['order-pay'] ); // wpcs: csrf ok, sanitization ok, xss ok.
427
			$order    = wc_get_order( $order_id );
428
429
			if ( is_a( $order, 'WC_Order' ) ) {
430
				$stripe_params['billing_first_name'] = $order->get_billing_first_name();
431
				$stripe_params['billing_last_name']  = $order->get_billing_last_name();
432
				$stripe_params['billing_address_1']  = $order->get_billing_address_1();
433
				$stripe_params['billing_address_2']  = $order->get_billing_address_2();
434
				$stripe_params['billing_state']      = $order->get_billing_state();
435
				$stripe_params['billing_city']       = $order->get_billing_city();
436
				$stripe_params['billing_postcode']   = $order->get_billing_postcode();
437
				$stripe_params['billing_country']    = $order->get_billing_country();
438
			}
439
		}
440
441
		$sepa_elements_options = apply_filters(
442
			'wc_stripe_sepa_elements_options',
443
			array(
444
				'supportedCountries' => array( 'SEPA' ),
445
				'placeholderCountry' => WC()->countries->get_base_country(),
446
				'style'              => array( 'base' => array( 'fontSize' => '15px' ) ),
447
			)
448
		);
449
450
		$stripe_params['no_prepaid_card_msg']       = __( 'Sorry, we\'re not accepting prepaid cards at this time. Your credit card has not been charged. Please try with alternative payment method.', 'woocommerce-gateway-stripe' );
451
		$stripe_params['no_sepa_owner_msg']         = __( 'Please enter your IBAN account name.', 'woocommerce-gateway-stripe' );
452
		$stripe_params['no_sepa_iban_msg']          = __( 'Please enter your IBAN account number.', 'woocommerce-gateway-stripe' );
453
		$stripe_params['payment_intent_error']      = __( 'We couldn\'t initiate the payment. Please try again.', 'woocommerce-gateway-stripe' );
454
		$stripe_params['sepa_mandate_notification'] = apply_filters( 'wc_stripe_sepa_mandate_notification', 'email' );
455
		$stripe_params['allow_prepaid_card']        = apply_filters( 'wc_stripe_allow_prepaid_card', true ) ? 'yes' : 'no';
456
		$stripe_params['inline_cc_form']            = $this->inline_cc_form ? 'yes' : 'no';
457
		$stripe_params['is_checkout']               = ( is_checkout() && empty( $_GET['pay_for_order'] ) ) ? 'yes' : 'no'; // wpcs: csrf ok.
458
		$stripe_params['return_url']                = $this->get_stripe_return_url();
459
		$stripe_params['ajaxurl']                   = WC_AJAX::get_endpoint( '%%endpoint%%' );
460
		$stripe_params['stripe_nonce']              = wp_create_nonce( '_wc_stripe_nonce' );
461
		$stripe_params['statement_descriptor']      = $this->statement_descriptor;
462
		$stripe_params['elements_options']          = apply_filters( 'wc_stripe_elements_options', array() );
463
		$stripe_params['sepa_elements_options']     = $sepa_elements_options;
464
		$stripe_params['invalid_owner_name']        = __( 'Billing First Name and Last Name are required.', 'woocommerce-gateway-stripe' );
465
		$stripe_params['is_change_payment_page']    = isset( $_GET['change_payment_method'] ) ? 'yes' : 'no'; // wpcs: csrf ok.
466
		$stripe_params['is_add_payment_page']       = is_wc_endpoint_url( 'add-payment-method' ) ? 'yes' : 'no';
467
		$stripe_params['is_pay_for_order_page']     = is_wc_endpoint_url( 'order-pay' ) ? 'yes' : 'no';
468
		$stripe_params['elements_styling']          = apply_filters( 'wc_stripe_elements_styling', false );
469
		$stripe_params['elements_classes']          = apply_filters( 'wc_stripe_elements_classes', false );
470
		$stripe_params['add_card_nonce']            = wp_create_nonce( 'wc_stripe_create_si' );
471
472
		// Merge localized messages to be use in JS.
473
		$stripe_params = array_merge( $stripe_params, WC_Stripe_Helper::get_localized_messages() );
474
475
		wp_localize_script( 'woocommerce_stripe', 'wc_stripe_params', apply_filters( 'wc_stripe_params', $stripe_params ) );
476
477
		$this->tokenization_script();
478
		wp_enqueue_script( 'woocommerce_stripe' );
479
	}
480
481
	/**
482
	 * Checks if a source object represents a prepaid credit card and
483
	 * throws an exception if it is one, but that is not allowed.
484
	 *
485
	 * @since 4.2.0
486
	 * @param object $prepared_source The object with source details.
487
	 * @throws WC_Stripe_Exception An exception if the card is prepaid, but prepaid cards are not allowed.
488
	 */
489
	public function maybe_disallow_prepaid_card( $prepared_source ) {
490
		// Check if we don't allow prepaid credit cards.
491
		if ( apply_filters( 'wc_stripe_allow_prepaid_card', true ) || ! $this->is_prepaid_card( $prepared_source->source_object ) ) {
492
			return;
493
		}
494
495
		$localized_message = __( 'Sorry, we\'re not accepting prepaid cards at this time. Your credit card has not been charged. Please try with alternative payment method.', 'woocommerce-gateway-stripe' );
496
		throw new WC_Stripe_Exception( print_r( $prepared_source->source_object, true ), $localized_message );
497
	}
498
499
	/**
500
	 * Checks whether a source exists.
501
	 *
502
	 * @since 4.2.0
503
	 * @param  object $prepared_source The source that should be verified.
504
	 * @throws WC_Stripe_Exception     An exception if the source ID is missing.
505
	 */
506
	public function check_source( $prepared_source ) {
507 View Code Duplication
		if ( empty( $prepared_source->source ) ) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
508
			$localized_message = __( 'Payment processing failed. Please retry.', 'woocommerce-gateway-stripe' );
509
			throw new WC_Stripe_Exception( print_r( $prepared_source, true ), $localized_message );
510
		}
511
	}
512
513
	/**
514
	 * Customer param wrong? The user may have been deleted on stripe's end. Remove customer_id. Can be retried without.
515
	 *
516
	 * @since 4.2.0
517
	 * @param object   $error The error that was returned from Stripe's API.
518
	 * @param WC_Order $order The order those payment is being processed.
519
	 * @return bool           A flag that indicates that the customer does not exist and should be removed.
520
	 */
521
	public function maybe_remove_non_existent_customer( $error, $order ) {
522
		if ( ! $this->is_no_such_customer_error( $error ) ) {
523
			return false;
524
		}
525
526
		delete_user_option( $order->get_customer_id(), '_stripe_customer_id' );
527
		$order->delete_meta_data( '_stripe_customer_id' );
528
		$order->save();
529
530
		return true;
531
	}
532
533
	/**
534
	 * Completes an order without a positive value.
535
	 *
536
	 * @since 4.2.0
537
	 * @param WC_Order $order             The order to complete.
538
	 * @param WC_Order $prepared_source   Payment source and customer data.
539
	 * @param boolean  $force_save_source Whether the payment source must be saved, like when dealing with a Subscription setup.
540
	 * @return array                      Redirection data for `process_payment`.
541
	 */
542
	public function complete_free_order( $order, $prepared_source, $force_save_source ) {
543
		if ( $force_save_source ) {
544
			$intent_secret = $this->setup_intent( $order, $prepared_source );
545
546
			if ( ! empty( $intent_secret ) ) {
547
				// `get_return_url()` must be called immediately before returning a value.
548
				return array(
549
					'result'              => 'success',
550
					'redirect'            => $this->get_return_url( $order ),
551
					'setup_intent_secret' => $intent_secret,
552
				);
553
			}
554
		}
555
556
		// Remove cart.
557
		WC()->cart->empty_cart();
558
559
		$order->payment_complete();
560
561
		// Return thank you page redirect.
562
		return array(
563
			'result'   => 'success',
564
			'redirect' => $this->get_return_url( $order ),
565
		);
566
	}
567
568
	/**
569
	 * Process the payment
570
	 *
571
	 * @since 1.0.0
572
	 * @since 4.1.0 Add 4th parameter to track previous error.
573
	 * @param int  $order_id Reference.
574
	 * @param bool $retry Should we retry on fail.
575
	 * @param bool $force_save_source Force save the payment source.
576
	 * @param mix  $previous_error Any error message from previous request.
577
	 * @param bool $use_order_source Whether to use the source, which should already be attached to the order.
578
	 *
579
	 * @throws Exception If payment will not be accepted.
580
	 * @return array|void
581
	 */
582
	public function process_payment( $order_id, $retry = true, $force_save_source = false, $previous_error = false, $use_order_source = false ) {
583
		try {
584
			$order = wc_get_order( $order_id );
585
586
			// ToDo: `process_pre_order` saves the source to the order for a later payment.
587
			// This might not work well with PaymentIntents.
588
			if ( $this->maybe_process_pre_orders( $order_id ) ) {
589
				return $this->pre_orders->process_pre_order( $order_id );
590
			}
591
592
			// Check whether there is an existing intent.
593
			$intent = $this->get_intent_from_order( $order );
594
			if ( isset( $intent->object ) && 'setup_intent' === $intent->object ) {
595
				$intent = false; // This function can only deal with *payment* intents
596
			}
597
598
			$stripe_customer_id = null;
599
			if ( $intent && ! empty( $intent->customer ) ) {
600
				$stripe_customer_id = $intent->customer;
601
			}
602
603
			// For some payments the source should already be present in the order.
604
			if ( $use_order_source ) {
605
				$prepared_source = $this->prepare_order_source( $order );
606
			} else {
607
				$prepared_source = $this->prepare_source( get_current_user_id(), $force_save_source, $stripe_customer_id );
608
			}
609
610
			$this->maybe_disallow_prepaid_card( $prepared_source );
611
			$this->check_source( $prepared_source );
612
			$this->save_source_to_order( $order, $prepared_source );
613
614
			if ( 0 >= $order->get_total() ) {
615
				return $this->complete_free_order( $order, $prepared_source, $force_save_source );
616
			}
617
618
			// This will throw exception if not valid.
619
			$this->validate_minimum_order_amount( $order );
620
621
			WC_Stripe_Logger::log( "Info: Begin processing payment for order $order_id for the amount of {$order->get_total()}" );
622
623
			if ( $intent ) {
624
				$intent = $this->update_existing_intent( $intent, $order, $prepared_source );
625
			} else {
626
				$intent = $this->create_intent( $order, $prepared_source );
627
			}
628
629
			// Confirm the intent after locking the order to make sure webhooks will not interfere.
630
			if ( empty( $intent->error ) ) {
631
				$this->lock_order_payment( $order, $intent );
632
				$intent = $this->confirm_intent( $intent, $order, $prepared_source );
633
			}
634
635
			if ( ! empty( $intent->error ) ) {
636
				$this->maybe_remove_non_existent_customer( $intent->error, $order );
637
638
				// We want to retry.
639
				if ( $this->is_retryable_error( $intent->error ) ) {
640
					return $this->retry_after_error( $intent, $order, $retry, $force_save_source, $previous_error, $use_order_source );
641
				}
642
643
				$this->unlock_order_payment( $order );
644
				$this->throw_localized_message( $intent, $order );
645
			}
646
647
			if ( ! empty( $intent ) ) {
648
				// Use the last charge within the intent to proceed.
649
				$response = end( $intent->charges->data );
650
651
				// If the intent requires a 3DS flow, redirect to it.
652
				if ( 'requires_action' === $intent->status ) {
653
					$this->unlock_order_payment( $order );
654
655
					if ( is_wc_endpoint_url( 'order-pay' ) ) {
656
						$redirect_url = add_query_arg( 'wc-stripe-confirmation', 1, $order->get_checkout_payment_url( false ) );
657
658
						return array(
659
							'result'   => 'success',
660
							'redirect' => $redirect_url,
661
						);
662
					} else {
663
						/**
664
						 * This URL contains only a hash, which will be sent to `checkout.js` where it will be set like this:
665
						 * `window.location = result.redirect`
666
						 * Once this redirect is sent to JS, the `onHashChange` function will execute `handleCardPayment`.
667
						 */
668
669
						return array(
670
							'result'                => 'success',
671
							'redirect'              => $this->get_return_url( $order ),
672
							'payment_intent_secret' => $intent->client_secret,
673
						);
674
					}
675
				}
676
			}
677
678
			// Process valid response.
679
			$this->process_response( $response, $order );
0 ignored issues
show
Bug introduced by
The variable $response does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
680
681
			// Remove cart.
682
			if ( isset( WC()->cart ) ) {
683
				WC()->cart->empty_cart();
684
			}
685
686
			// Unlock the order.
687
			$this->unlock_order_payment( $order );
688
689
			// Return thank you page redirect.
690
			return array(
691
				'result'   => 'success',
692
				'redirect' => $this->get_return_url( $order ),
693
			);
694
695
		} catch ( WC_Stripe_Exception $e ) {
696
			wc_add_notice( $e->getLocalizedMessage(), 'error' );
697
			WC_Stripe_Logger::log( 'Error: ' . $e->getMessage() );
698
699
			do_action( 'wc_gateway_stripe_process_payment_error', $e, $order );
700
701
			/* translators: error message */
702
			$order->update_status( 'failed' );
703
704
			return array(
705
				'result'   => 'fail',
706
				'redirect' => '',
707
			);
708
		}
709
	}
710
711
	/**
712
	 * Displays the Stripe fee
713
	 *
714
	 * @since 4.1.0
715
	 *
716
	 * @param int $order_id The ID of the order.
717
	 */
718 View Code Duplication
	public function display_order_fee( $order_id ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
719
		if ( apply_filters( 'wc_stripe_hide_display_order_fee', false, $order_id ) ) {
720
			return;
721
		}
722
723
		$order = wc_get_order( $order_id );
724
725
		$fee      = WC_Stripe_Helper::get_stripe_fee( $order );
726
		$currency = WC_Stripe_Helper::get_stripe_currency( $order );
727
728
		if ( ! $fee || ! $currency ) {
729
			return;
730
		}
731
732
		?>
733
734
		<tr>
735
			<td class="label stripe-fee">
736
				<?php echo wc_help_tip( __( 'This represents the fee Stripe collects for the transaction.', 'woocommerce-gateway-stripe' ) ); // wpcs: xss ok. ?>
737
				<?php esc_html_e( 'Stripe Fee:', 'woocommerce-gateway-stripe' ); ?>
738
			</td>
739
			<td width="1%"></td>
740
			<td class="total">
741
				-&nbsp;<?php echo wc_price( $fee, array( 'currency' => $currency ) ); // wpcs: xss ok. ?>
742
			</td>
743
		</tr>
744
745
		<?php
746
	}
747
748
	/**
749
	 * Displays the net total of the transaction without the charges of Stripe.
750
	 *
751
	 * @since 4.1.0
752
	 *
753
	 * @param int $order_id The ID of the order.
754
	 */
755 View Code Duplication
	public function display_order_payout( $order_id ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
756
		if ( apply_filters( 'wc_stripe_hide_display_order_payout', false, $order_id ) ) {
757
			return;
758
		}
759
760
		$order = wc_get_order( $order_id );
761
762
		$net      = WC_Stripe_Helper::get_stripe_net( $order );
763
		$currency = WC_Stripe_Helper::get_stripe_currency( $order );
764
765
		if ( ! $net || ! $currency ) {
766
			return;
767
		}
768
769
		?>
770
771
		<tr>
772
			<td class="label stripe-payout">
773
				<?php echo wc_help_tip( __( 'This represents the net total that will be credited to your Stripe bank account. This may be in the currency that is set in your Stripe account.', 'woocommerce-gateway-stripe' ) ); // wpcs: xss ok. ?>
774
				<?php esc_html_e( 'Stripe Payout:', 'woocommerce-gateway-stripe' ); ?>
775
			</td>
776
			<td width="1%"></td>
777
			<td class="total">
778
				<?php echo wc_price( $net, array( 'currency' => $currency ) ); // wpcs: xss ok. ?>
779
			</td>
780
		</tr>
781
782
		<?php
783
	}
784
785
	/**
786
	 * Generates a localized message for an error from a response.
787
	 *
788
	 * @since 4.3.2
789
	 *
790
	 * @param stdClass $response The response from the Stripe API.
791
	 *
792
	 * @return string The localized error message.
793
	 */
794
	public function get_localized_error_message_from_response( $response ) {
795
		$localized_messages = WC_Stripe_Helper::get_localized_messages();
796
797
		if ( 'card_error' === $response->error->type ) {
798
			$localized_message = isset( $localized_messages[ $response->error->code ] ) ? $localized_messages[ $response->error->code ] : $response->error->message;
799
		} else {
800
			$localized_message = isset( $localized_messages[ $response->error->type ] ) ? $localized_messages[ $response->error->type ] : $response->error->message;
801
		}
802
803
		return $localized_message;
804
	}
805
806
	/**
807
	 * Gets a localized message for an error from a response, adds it as a note to the order, and throws it.
808
	 *
809
	 * @since 4.2.0
810
	 * @param  stdClass $response  The response from the Stripe API.
811
	 * @param  WC_Order $order     The order to add a note to.
812
	 * @throws WC_Stripe_Exception An exception with the right message.
813
	 */
814
	public function throw_localized_message( $response, $order ) {
815
		$localized_message = $this->get_localized_error_message_from_response( $response );
816
817
		$order->add_order_note( $localized_message );
818
819
		throw new WC_Stripe_Exception( print_r( $response, true ), $localized_message );
820
	}
821
822
	/**
823
	 * Retries the payment process once an error occured.
824
	 *
825
	 * @since 4.2.0
826
	 * @param object   $response          The response from the Stripe API.
827
	 * @param WC_Order $order             An order that is being paid for.
828
	 * @param bool     $retry             A flag that indicates whether another retry should be attempted.
829
	 * @param bool     $force_save_source Force save the payment source.
830
	 * @param mixed    $previous_error    Any error message from previous request.
831
	 * @param bool     $use_order_source  Whether to use the source, which should already be attached to the order.
832
	 * @throws WC_Stripe_Exception        If the payment is not accepted.
833
	 * @return array|void
834
	 */
835
	public function retry_after_error( $response, $order, $retry, $force_save_source, $previous_error, $use_order_source ) {
836
		if ( ! $retry ) {
837
			$localized_message = __( 'Sorry, we are unable to process your payment at this time. Please retry later.', 'woocommerce-gateway-stripe' );
838
			$order->add_order_note( $localized_message );
839
			throw new WC_Stripe_Exception( print_r( $response, true ), $localized_message ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.
840
		}
841
842
		// Don't do anymore retries after this.
843
		if ( 5 <= $this->retry_interval ) {
844
			return $this->process_payment( $order->get_id(), false, $force_save_source, $response->error, $previous_error );
845
		}
846
847
		sleep( $this->retry_interval );
848
		$this->retry_interval++;
849
850
		return $this->process_payment( $order->get_id(), true, $force_save_source, $response->error, $previous_error, $use_order_source );
851
	}
852
853
	/**
854
	 * Adds the necessary hooks to modify the "Pay for order" page in order to clean
855
	 * it up and prepare it for the Stripe PaymentIntents modal to confirm a payment.
856
	 *
857
	 * @since 4.2
858
	 * @param WC_Payment_Gateway[] $gateways A list of all available gateways.
859
	 * @return WC_Payment_Gateway[]          Either the same list or an empty one in the right conditions.
860
	 */
861
	public function prepare_order_pay_page( $gateways ) {
862
		if ( ! is_wc_endpoint_url( 'order-pay' ) || ! isset( $_GET['wc-stripe-confirmation'] ) ) { // wpcs: csrf ok.
863
			return $gateways;
864
		}
865
866
		try {
867
			$this->prepare_intent_for_order_pay_page();
868
		} catch ( WC_Stripe_Exception $e ) {
869
			// Just show the full order pay page if there was a problem preparing the Payment Intent
870
			return $gateways;
871
		}
872
873
		add_filter( 'woocommerce_checkout_show_terms', '__return_false' );
874
		add_filter( 'woocommerce_pay_order_button_html', '__return_false' );
875
		add_filter( 'woocommerce_available_payment_gateways', '__return_empty_array' );
876
		add_filter( 'woocommerce_no_available_payment_methods_message', array( $this, 'change_no_available_methods_message' ) );
877
		add_action( 'woocommerce_pay_order_after_submit', array( $this, 'render_payment_intent_inputs' ) );
878
879
		return array();
880
	}
881
882
	/**
883
	 * Changes the text of the "No available methods" message to one that indicates
884
	 * the need for a PaymentIntent to be confirmed.
885
	 *
886
	 * @since 4.2
887
	 * @return string the new message.
888
	 */
889
	public function change_no_available_methods_message() {
890
		return wpautop( __( "Almost there!\n\nYour order has already been created, the only thing that still needs to be done is for you to authorize the payment with your bank.", 'woocommerce-gateway-stripe' ) );
891
	}
892
893
	/**
894
	 * Prepares the Payment Intent for it to be completed in the "Pay for Order" page.
895
	 *
896
	 * @param WC_Order|null $order Order object, or null to get the order from the "order-pay" URL parameter
897
	 *
898
	 * @throws WC_Stripe_Exception
899
	 * @since 4.3
900
	 */
901
	public function prepare_intent_for_order_pay_page( $order = null ) {
902 View Code Duplication
		if ( ! isset( $order ) || empty( $order ) ) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
903
			$order = wc_get_order( absint( get_query_var( 'order-pay' ) ) );
904
		}
905
		$intent = $this->get_intent_from_order( $order );
906
907
		if ( ! $intent ) {
908
			throw new WC_Stripe_Exception( 'Payment Intent not found', __( 'Payment Intent not found for order #' . $order->get_id(), 'woocommerce-gateway-stripe' ) );
909
		}
910
911
		if ( 'requires_payment_method' === $intent->status && isset( $intent->last_payment_error )
912
		     && 'authentication_required' === $intent->last_payment_error->code ) {
913
			$level3_data = $this->get_level3_data_from_order( $order );
914
			$intent      = WC_Stripe_API::request_with_level3_data(
915
				array(
916
					'payment_method' => $intent->last_payment_error->source->id,
917
				),
918
				'payment_intents/' . $intent->id . '/confirm',
919
				$level3_data,
920
				$order
921
			);
922
923
			if ( isset( $intent->error ) ) {
924
				throw new WC_Stripe_Exception( print_r( $intent, true ), $intent->error->message );
925
			}
926
		}
927
928
		$this->order_pay_intent = $intent;
929
	}
930
931
	/**
932
	 * Renders hidden inputs on the "Pay for Order" page in order to let Stripe handle PaymentIntents.
933
	 *
934
	 * @param WC_Order|null $order Order object, or null to get the order from the "order-pay" URL parameter
935
	 *
936
	 * @throws WC_Stripe_Exception
937
	 * @since 4.2
938
	 */
939
	public function render_payment_intent_inputs( $order = null ) {
940 View Code Duplication
		if ( ! isset( $order ) || empty( $order ) ) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
941
			$order = wc_get_order( absint( get_query_var( 'order-pay' ) ) );
942
		}
943
		if ( ! isset( $this->order_pay_intent ) ) {
944
			$this->prepare_intent_for_order_pay_page( $order );
945
		}
946
947
		$verification_url = add_query_arg(
948
			array(
949
				'order'            => $order->get_id(),
950
				'nonce'            => wp_create_nonce( 'wc_stripe_confirm_pi' ),
951
				'redirect_to'      => rawurlencode( $this->get_return_url( $order ) ),
952
				'is_pay_for_order' => true,
953
			),
954
			WC_AJAX::get_endpoint( 'wc_stripe_verify_intent' )
955
		);
956
957
		echo '<input type="hidden" id="stripe-intent-id" value="' . esc_attr( $this->order_pay_intent->client_secret ) . '" />';
958
		echo '<input type="hidden" id="stripe-intent-return" value="' . esc_attr( $verification_url ) . '" />';
959
	}
960
961
	/**
962
	 * Adds an error message wrapper to each saved method.
963
	 *
964
	 * @since 4.2.0
965
	 * @param WC_Payment_Token $token Payment Token.
966
	 * @return string                 Generated payment method HTML
967
	 */
968
	public function get_saved_payment_method_option_html( $token ) {
969
		$html          = parent::get_saved_payment_method_option_html( $token );
970
		$error_wrapper = '<div class="stripe-source-errors" role="alert"></div>';
971
972
		return preg_replace( '~</(\w+)>\s*$~', "$error_wrapper</$1>", $html );
973
	}
974
975
	/**
976
	 * Attempt to manually complete the payment process for orders, which are still pending
977
	 * before displaying the View Order page. This is useful in case webhooks have not been set up.
978
	 *
979
	 * @since 4.2.0
980
	 * @param int $order_id The ID that will be used for the thank you page.
981
	 */
982
	public function check_intent_status_on_order_page( $order_id ) {
983
		if ( empty( $order_id ) || absint( $order_id ) <= 0 ) {
984
			return;
985
		}
986
987
		$order = wc_get_order( absint( $order_id ) );
988
989
		if ( ! $order ) {
990
			return;
991
		}
992
993
		$this->verify_intent_after_checkout( $order );
994
	}
995
996
	/**
997
	 * Attached to `woocommerce_payment_successful_result` with a late priority,
998
	 * this method will combine the "naturally" generated redirect URL from
999
	 * WooCommerce and a payment/setup intent secret into a hash, which contains both
1000
	 * the secret, and a proper URL, which will confirm whether the intent succeeded.
1001
	 *
1002
	 * @since 4.2.0
1003
	 * @param array $result   The result from `process_payment`.
1004
	 * @param int   $order_id The ID of the order which is being paid for.
1005
	 * @return array
1006
	 */
1007
	public function modify_successful_payment_result( $result, $order_id ) {
1008
		if ( ! isset( $result['payment_intent_secret'] ) && ! isset( $result['setup_intent_secret'] ) ) {
1009
			// Only redirects with intents need to be modified.
1010
			return $result;
1011
		}
1012
1013
		// Put the final thank you page redirect into the verification URL.
1014
		$verification_url = add_query_arg(
1015
			array(
1016
				'order'       => $order_id,
1017
				'nonce'       => wp_create_nonce( 'wc_stripe_confirm_pi' ),
1018
				'redirect_to' => rawurlencode( $result['redirect'] ),
1019
			),
1020
			WC_AJAX::get_endpoint( 'wc_stripe_verify_intent' )
1021
		);
1022
1023
		if ( isset( $result['payment_intent_secret'] ) ) {
1024
			$redirect = sprintf( '#confirm-pi-%s:%s', $result['payment_intent_secret'], rawurlencode( $verification_url ) );
1025
		} else if ( isset( $result['setup_intent_secret'] ) ) {
1026
			$redirect = sprintf( '#confirm-si-%s:%s', $result['setup_intent_secret'], rawurlencode( $verification_url ) );
1027
		}
1028
1029
		return array(
1030
			'result'   => 'success',
1031
			'redirect' => $redirect,
0 ignored issues
show
Bug introduced by
The variable $redirect does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
1032
		);
1033
	}
1034
1035
	/**
1036
	 * Proceed with current request using new login session (to ensure consistent nonce).
1037
	 */
1038
	public function set_cookie_on_current_request( $cookie ) {
1039
		$_COOKIE[ LOGGED_IN_COOKIE ] = $cookie;
1040
	}
1041
1042
	/**
1043
	 * Executed between the "Checkout" and "Thank you" pages, this
1044
	 * method updates orders based on the status of associated PaymentIntents.
1045
	 *
1046
	 * @since 4.2.0
1047
	 * @param WC_Order $order The order which is in a transitional state.
1048
	 */
1049
	public function verify_intent_after_checkout( $order ) {
1050
		$payment_method = $order->get_payment_method();
1051
		if ( $payment_method !== $this->id ) {
1052
			// If this is not the payment method, an intent would not be available.
1053
			return;
1054
		}
1055
1056
		$intent = $this->get_intent_from_order( $order );
1057
		if ( ! $intent ) {
1058
			// No intent, redirect to the order received page for further actions.
1059
			return;
1060
		}
1061
1062
		// A webhook might have modified or locked the order while the intent was retreived. This ensures we are reading the right status.
1063
		clean_post_cache( $order->get_id() );
1064
		$order = wc_get_order( $order->get_id() );
1065
1066
		if ( ! $order->has_status( array( 'pending', 'failed' ) ) ) {
1067
			// If payment has already been completed, this function is redundant.
1068
			return;
1069
		}
1070
1071
		if ( $this->lock_order_payment( $order, $intent ) ) {
1072
			return;
1073
		}
1074
1075
		if ( 'setup_intent' === $intent->object && 'succeeded' === $intent->status ) {
1076
			WC()->cart->empty_cart();
1077
			if ( WC_Stripe_Helper::is_pre_orders_exists() && WC_Pre_Orders_Order::order_contains_pre_order( $order ) ) {
1078
				WC_Pre_Orders_Order::mark_order_as_pre_ordered( $order );
1079
			} else {
1080
				$order->payment_complete();
1081
			}
1082
		} else if ( 'succeeded' === $intent->status || 'requires_capture' === $intent->status ) {
1083
			// Proceed with the payment completion.
1084
			$this->handle_intent_verification_success( $order, $intent );
1085
		} else if ( 'requires_payment_method' === $intent->status ) {
1086
			// `requires_payment_method` means that SCA got denied for the current payment method.
1087
			$this->handle_intent_verification_failure( $order, $intent );
1088
		}
1089
1090
		$this->unlock_order_payment( $order );
1091
	}
1092
1093
	/**
1094
	 * Called after an intent verification succeeds, this allows
1095
	 * specific APNs or children of this class to modify its behavior.
1096
	 *
1097
	 * @param WC_Order $order The order whose verification succeeded.
1098
	 * @param stdClass $intent The Payment Intent object.
1099
	 */
1100
	protected function handle_intent_verification_success( $order, $intent ) {
1101
		$this->process_response( end( $intent->charges->data ), $order );
1102
	}
1103
1104
	/**
1105
	 * Called after an intent verification fails, this allows
1106
	 * specific APNs or children of this class to modify its behavior.
1107
	 *
1108
	 * @param WC_Order $order The order whose verification failed.
1109
	 * @param stdClass $intent The Payment Intent object.
1110
	 */
1111
	protected function handle_intent_verification_failure( $order, $intent ) {
1112
		$this->failed_sca_auth( $order, $intent );
1113
	}
1114
1115
	/**
1116
	 * Checks if the payment intent associated with an order failed and records the event.
1117
	 *
1118
	 * @since 4.2.0
1119
	 * @param WC_Order $order  The order which should be checked.
1120
	 * @param object   $intent The intent, associated with the order.
1121
	 */
1122
	public function failed_sca_auth( $order, $intent ) {
1123
		// If the order has already failed, do not repeat the same message.
1124
		if ( $order->has_status( 'failed' ) ) {
1125
			return;
1126
		}
1127
1128
		// Load the right message and update the status.
1129
		$status_message = isset( $intent->last_payment_error )
1130
			/* translators: 1) The error message that was received from Stripe. */
1131
			? sprintf( __( 'Stripe SCA authentication failed. Reason: %s', 'woocommerce-gateway-stripe' ), $intent->last_payment_error->message )
1132
			: __( 'Stripe SCA authentication failed.', 'woocommerce-gateway-stripe' );
1133
		$order->update_status( 'failed', $status_message );
1134
	}
1135
1136
	/**
1137
	 * Preserves the "wc-stripe-confirmation" URL parameter so the user can complete the SCA authentication after logging in.
1138
	 *
1139
	 * @param string $pay_url Current computed checkout URL for the given order.
1140
	 * @param WC_Order $order Order object.
1141
	 *
1142
	 * @return string Checkout URL for the given order.
1143
	 */
1144
	public function get_checkout_payment_url( $pay_url, $order ) {
1145
		global $wp;
1146
		if ( isset( $_GET['wc-stripe-confirmation'] ) && isset( $wp->query_vars['order-pay'] ) && $wp->query_vars['order-pay'] == $order->get_id() ) {
1147
			$pay_url = add_query_arg( 'wc-stripe-confirmation', 1, $pay_url );
1148
		}
1149
		return $pay_url;
1150
	}
1151
1152
	/**
1153
	 * Checks whether new keys are being entered when saving options.
1154
	 */
1155
	public function process_admin_options() {
1156
		// Load all old values before the new settings get saved.
1157
		$old_publishable_key      = $this->get_option( 'publishable_key' );
1158
		$old_secret_key           = $this->get_option( 'secret_key' );
1159
		$old_test_publishable_key = $this->get_option( 'test_publishable_key' );
1160
		$old_test_secret_key      = $this->get_option( 'test_secret_key' );
1161
1162
		parent::process_admin_options();
1163
1164
		// Load all old values after the new settings have been saved.
1165
		$new_publishable_key      = $this->get_option( 'publishable_key' );
1166
		$new_secret_key           = $this->get_option( 'secret_key' );
1167
		$new_test_publishable_key = $this->get_option( 'test_publishable_key' );
1168
		$new_test_secret_key      = $this->get_option( 'test_secret_key' );
1169
1170
		// Checks whether a value has transitioned from a non-empty value to a new one.
1171
		$has_changed = function( $old_value, $new_value ) {
1172
			return ! empty( $old_value ) && ( $old_value !== $new_value );
1173
		};
1174
1175
		// Look for updates.
1176
		if (
1177
			$has_changed( $old_publishable_key, $new_publishable_key )
1178
			|| $has_changed( $old_secret_key, $new_secret_key )
1179
			|| $has_changed( $old_test_publishable_key, $new_test_publishable_key )
1180
			|| $has_changed( $old_test_secret_key, $new_test_secret_key )
1181
		) {
1182
			update_option( 'wc_stripe_show_changed_keys_notice', 'yes' );
1183
		}
1184
	}
1185
1186 View Code Duplication
	public function validate_publishable_key_field( $key, $value ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
1187
		$value = $this->validate_text_field( $key, $value );
1188
		if ( ! empty( $value ) && ! preg_match( '/^pk_live_/', $value ) ) {
1189
			throw new Exception( __( 'The "Live Publishable Key" should start with "pk_live", enter the correct key.', 'woocommerce-gateway-stripe' ) );
1190
		}
1191
		return $value;
1192
	}
1193
1194 View Code Duplication
	public function validate_secret_key_field( $key, $value ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
1195
		$value = $this->validate_text_field( $key, $value );
1196
		if ( ! empty( $value ) && ! preg_match( '/^[rs]k_live_/', $value ) ) {
1197
			throw new Exception( __( 'The "Live Secret Key" should start with "sk_live" or "rk_live", enter the correct key.', 'woocommerce-gateway-stripe' ) );
1198
		}
1199
		return $value;
1200
	}
1201
1202 View Code Duplication
	public function validate_test_publishable_key_field( $key, $value ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
1203
		$value = $this->validate_text_field( $key, $value );
1204
		if ( ! empty( $value ) && ! preg_match( '/^pk_test_/', $value ) ) {
1205
			throw new Exception( __( 'The "Test Publishable Key" should start with "pk_test", enter the correct key.', 'woocommerce-gateway-stripe' ) );
1206
		}
1207
		return $value;
1208
	}
1209
1210 View Code Duplication
	public function validate_test_secret_key_field( $key, $value ) {
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
1211
		$value = $this->validate_text_field( $key, $value );
1212
		if ( ! empty( $value ) && ! preg_match( '/^[rs]k_test_/', $value ) ) {
1213
			throw new Exception( __( 'The "Test Secret Key" should start with "sk_test" or "rk_test", enter the correct key.', 'woocommerce-gateway-stripe' ) );
1214
		}
1215
		return $value;
1216
	}
1217
1218
	/**
1219
	 * Ensures the statement descriptor about to be saved to options does not contain any invalid characters.
1220
	 *
1221
	 * @since 4.8.0
1222
	 * @param $settings WC_Settings_API settings to be filtered
1223
	 * @return Filtered settings
1224
	 */
1225
	public function settings_api_sanitized_fields( $settings ) {
1226
		if ( is_array( $settings ) ) {
1227
			if ( array_key_exists( 'statement_descriptor', $settings ) ) {
1228
				$settings['statement_descriptor'] = WC_Stripe_Helper::clean_statement_descriptor( $settings['statement_descriptor']);
1229
			}
1230
		}
1231
		return $settings;
1232
	}
1233
}
1234