This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if ( ! defined( 'ABSPATH' ) ) { |
||
3 | exit; |
||
4 | } |
||
5 | |||
6 | /** |
||
7 | * Class that handles P24 payment method. |
||
8 | * |
||
9 | * @extends WC_Gateway_Stripe |
||
10 | * |
||
11 | * @since 4.0.0 |
||
12 | */ |
||
13 | class WC_Gateway_Stripe_P24 extends WC_Stripe_Payment_Gateway { |
||
14 | /** |
||
15 | * Notices (array) |
||
16 | * @var array |
||
17 | */ |
||
18 | public $notices = array(); |
||
19 | |||
20 | /** |
||
21 | * Is test mode active? |
||
22 | * |
||
23 | * @var bool |
||
24 | */ |
||
25 | public $testmode; |
||
26 | |||
27 | /** |
||
28 | * Alternate credit card statement name |
||
29 | * |
||
30 | * @var bool |
||
31 | */ |
||
32 | public $statement_descriptor; |
||
33 | |||
34 | /** |
||
35 | * API access secret key |
||
36 | * |
||
37 | * @var string |
||
38 | */ |
||
39 | public $secret_key; |
||
40 | |||
41 | /** |
||
42 | * Api access publishable key |
||
43 | * |
||
44 | * @var string |
||
45 | */ |
||
46 | public $publishable_key; |
||
47 | |||
48 | /** |
||
49 | * Should we store the users credit cards? |
||
50 | * |
||
51 | * @var bool |
||
52 | */ |
||
53 | public $saved_cards; |
||
54 | |||
55 | /** |
||
56 | * Constructor |
||
57 | */ |
||
58 | public function __construct() { |
||
59 | $this->id = 'stripe_p24'; |
||
60 | $this->method_title = __( 'Stripe P24', 'woocommerce-gateway-stripe' ); |
||
61 | /* translators: link */ |
||
62 | $this->method_description = sprintf( __( 'All other general Stripe settings can be adjusted <a href="%s">here</a>.', 'woocommerce-gateway-stripe' ), admin_url( 'admin.php?page=wc-settings&tab=checkout§ion=stripe' ) ); |
||
63 | $this->supports = array( |
||
64 | 'products', |
||
65 | 'refunds', |
||
66 | ); |
||
67 | |||
68 | // Load the form fields. |
||
69 | $this->init_form_fields(); |
||
70 | |||
71 | // Load the settings. |
||
72 | $this->init_settings(); |
||
73 | |||
74 | $main_settings = get_option( 'woocommerce_stripe_settings' ); |
||
75 | $this->title = $this->get_option( 'title' ); |
||
76 | $this->description = $this->get_option( 'description' ); |
||
77 | $this->enabled = $this->get_option( 'enabled' ); |
||
78 | $this->testmode = ( ! empty( $main_settings['testmode'] ) && 'yes' === $main_settings['testmode'] ) ? true : false; |
||
79 | $this->saved_cards = ( ! empty( $main_settings['saved_cards'] ) && 'yes' === $main_settings['saved_cards'] ) ? true : false; |
||
80 | $this->publishable_key = ! empty( $main_settings['publishable_key'] ) ? $main_settings['publishable_key'] : ''; |
||
81 | $this->secret_key = ! empty( $main_settings['secret_key'] ) ? $main_settings['secret_key'] : ''; |
||
82 | $this->statement_descriptor = ! empty( $main_settings['statement_descriptor'] ) ? $main_settings['statement_descriptor'] : ''; |
||
83 | |||
84 | if ( $this->testmode ) { |
||
85 | $this->publishable_key = ! empty( $main_settings['test_publishable_key'] ) ? $main_settings['test_publishable_key'] : ''; |
||
86 | $this->secret_key = ! empty( $main_settings['test_secret_key'] ) ? $main_settings['test_secret_key'] : ''; |
||
87 | } |
||
88 | |||
89 | add_action( 'woocommerce_update_options_payment_gateways_' . $this->id, array( $this, 'process_admin_options' ) ); |
||
90 | add_action( 'wp_enqueue_scripts', array( $this, 'payment_scripts' ) ); |
||
91 | } |
||
92 | |||
93 | /** |
||
94 | * Returns all supported currencies for this payment method. |
||
95 | * |
||
96 | * @since 4.0.0 |
||
97 | * @version 4.0.0 |
||
98 | * @return array |
||
99 | */ |
||
100 | public function get_supported_currency() { |
||
101 | return apply_filters( |
||
102 | 'wc_stripe_p24_supported_currencies', |
||
103 | array( |
||
104 | 'EUR', |
||
105 | 'PLN', |
||
106 | ) |
||
107 | ); |
||
108 | } |
||
109 | |||
110 | /** |
||
111 | * Checks to see if all criteria is met before showing payment method. |
||
112 | * |
||
113 | * @since 4.0.0 |
||
114 | * @version 4.0.0 |
||
115 | * @return bool |
||
116 | */ |
||
117 | public function is_available() { |
||
118 | if ( ! in_array( get_woocommerce_currency(), $this->get_supported_currency() ) ) { |
||
119 | return false; |
||
120 | } |
||
121 | |||
122 | return parent::is_available(); |
||
123 | } |
||
124 | |||
125 | /** |
||
126 | * Get_icon function. |
||
127 | * |
||
128 | * @since 1.0.0 |
||
129 | * @version 4.0.0 |
||
130 | * @return string |
||
131 | */ |
||
132 | public function get_icon() { |
||
133 | $icons = $this->payment_icons(); |
||
134 | |||
135 | $icons_str = ''; |
||
136 | |||
137 | $icons_str .= isset( $icons['p24'] ) ? $icons['p24'] : ''; |
||
138 | |||
139 | return apply_filters( 'woocommerce_gateway_icon', $icons_str, $this->id ); |
||
140 | } |
||
141 | |||
142 | /** |
||
143 | * payment_scripts function. |
||
144 | * |
||
145 | * Outputs scripts used for stripe payment |
||
146 | * |
||
147 | * @access public |
||
148 | */ |
||
149 | public function payment_scripts() { |
||
150 | if ( ! is_cart() && ! is_checkout() && ! isset( $_GET['pay_for_order'] ) && ! is_add_payment_method_page() ) { |
||
151 | return; |
||
152 | } |
||
153 | |||
154 | wp_enqueue_style( 'stripe_styles' ); |
||
155 | wp_enqueue_script( 'woocommerce_stripe' ); |
||
156 | } |
||
157 | |||
158 | /** |
||
159 | * Initialize Gateway Settings Form Fields. |
||
160 | */ |
||
161 | public function init_form_fields() { |
||
162 | $this->form_fields = require( WC_STRIPE_PLUGIN_PATH . '/includes/admin/stripe-p24-settings.php' ); |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Payment form on checkout page |
||
167 | */ |
||
168 | public function payment_fields() { |
||
169 | global $wp; |
||
170 | $user = wp_get_current_user(); |
||
0 ignored issues
–
show
|
|||
171 | $total = WC()->cart->total; |
||
172 | $description = $this->get_description(); |
||
173 | |||
174 | // If paying from order, we need to get total from order not cart. |
||
175 | if ( isset( $_GET['pay_for_order'] ) && ! empty( $_GET['key'] ) ) { |
||
176 | $order = wc_get_order( wc_clean( $wp->query_vars['order-pay'] ) ); |
||
177 | $total = $order->get_total(); |
||
178 | } |
||
179 | |||
180 | if ( is_add_payment_method_page() ) { |
||
181 | $pay_button_text = __( 'Add Payment', 'woocommerce-gateway-stripe' ); |
||
0 ignored issues
–
show
$pay_button_text is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
182 | $total = ''; |
||
183 | } else { |
||
184 | $pay_button_text = ''; |
||
0 ignored issues
–
show
$pay_button_text is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
185 | } |
||
186 | |||
187 | echo '<div |
||
188 | id="stripe-p24-payment-data" |
||
189 | data-amount="' . esc_attr( WC_Stripe_Helper::get_stripe_amount( $total ) ) . '" |
||
190 | data-currency="' . esc_attr( strtolower( get_woocommerce_currency() ) ) . '">'; |
||
191 | |||
192 | if ( $description ) { |
||
193 | echo apply_filters( 'wc_stripe_description', wpautop( wp_kses_post( $description ) ), $this->id ); |
||
194 | } |
||
195 | |||
196 | echo '</div>'; |
||
197 | } |
||
198 | |||
199 | /** |
||
200 | * Creates the source for charge. |
||
201 | * |
||
202 | * @since 4.0.0 |
||
203 | * @version 4.0.0 |
||
204 | * @param object $order |
||
205 | * @return mixed |
||
206 | */ |
||
207 | public function create_source( $order ) { |
||
208 | $currency = $order->get_currency(); |
||
209 | $return_url = $this->get_stripe_return_url( $order ); |
||
210 | $post_data = array(); |
||
211 | $post_data['amount'] = WC_Stripe_Helper::get_stripe_amount( $order->get_total(), $currency ); |
||
212 | $post_data['currency'] = strtolower( $currency ); |
||
213 | $post_data['type'] = 'p24'; |
||
214 | $post_data['owner'] = $this->get_owner_details( $order ); |
||
215 | $post_data['redirect'] = array( 'return_url' => $return_url ); |
||
216 | |||
217 | WC_Stripe_Logger::log( 'Info: Begin creating P24 source' ); |
||
218 | |||
219 | return WC_Stripe_API::request( apply_filters( 'wc_stripe_p24_source', $post_data, $order ), 'sources' ); |
||
220 | } |
||
221 | |||
222 | /** |
||
223 | * Process the payment |
||
224 | * |
||
225 | * @param int $order_id Reference. |
||
226 | * @param bool $retry Should we retry on fail. |
||
227 | * @param bool $force_save_source Force payment source to be saved. |
||
228 | * |
||
229 | * @throws Exception If payment will not be accepted. |
||
230 | * |
||
231 | * @return array|void |
||
232 | */ |
||
233 | public function process_payment( $order_id, $retry = true, $force_save_source = false ) { |
||
234 | try { |
||
235 | $order = wc_get_order( $order_id ); |
||
236 | |||
237 | // This will throw exception if not valid. |
||
238 | $this->validate_minimum_order_amount( $order ); |
||
239 | |||
240 | // This comes from the create account checkbox in the checkout page. |
||
241 | $create_account = ! empty( $_POST['createaccount'] ) ? true : false; |
||
242 | |||
243 | if ( $create_account ) { |
||
244 | $new_customer_id = $order->get_customer_id(); |
||
245 | $new_stripe_customer = new WC_Stripe_Customer( $new_customer_id ); |
||
246 | $new_stripe_customer->create_customer(); |
||
247 | } |
||
248 | |||
249 | $response = $this->create_source( $order ); |
||
250 | |||
251 | if ( ! empty( $response->error ) ) { |
||
252 | $order->add_order_note( $response->error->message ); |
||
253 | |||
254 | throw new WC_Stripe_Exception( print_r( $response, true ), $response->error->message ); |
||
255 | } |
||
256 | |||
257 | $order->update_meta_data( '_stripe_source_id', $response->id ); |
||
258 | $order->save(); |
||
259 | |||
260 | WC_Stripe_Logger::log( 'Info: Redirecting to P24...' ); |
||
261 | |||
262 | return array( |
||
263 | 'result' => 'success', |
||
264 | 'redirect' => esc_url_raw( $response->redirect->url ), |
||
265 | ); |
||
266 | } catch ( WC_Stripe_Exception $e ) { |
||
267 | wc_add_notice( $e->getLocalizedMessage(), 'error' ); |
||
268 | WC_Stripe_Logger::log( 'Error: ' . $e->getMessage() ); |
||
269 | |||
270 | do_action( 'wc_gateway_stripe_process_payment_error', $e, $order ); |
||
271 | |||
272 | if ( $order->has_status( array( 'pending', 'failed' ) ) ) { |
||
273 | $this->send_failed_order_email( $order_id ); |
||
274 | } |
||
275 | |||
276 | return array( |
||
277 | 'result' => 'fail', |
||
278 | 'redirect' => '', |
||
279 | ); |
||
280 | } |
||
281 | } |
||
282 | } |
||
283 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.