woothemes /
woocommerce
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | if ( ! defined( 'ABSPATH' ) ) { |
||
| 3 | exit; |
||
| 4 | } |
||
| 5 | |||
| 6 | /** |
||
| 7 | * WooCommerce Payment Tokens. |
||
| 8 | * |
||
| 9 | * An API for storing and managing tokens for gateways and customers. |
||
| 10 | * |
||
| 11 | * @class WC_Payment_Tokens |
||
| 12 | * @since 2.6.0 |
||
| 13 | * @package WooCommerce/Classes |
||
| 14 | * @category Class |
||
| 15 | * @author WooThemes |
||
| 16 | */ |
||
| 17 | class WC_Payment_Tokens { |
||
| 18 | |||
| 19 | /** |
||
| 20 | * Gets valid tokens from the database based on user defined criteria. |
||
| 21 | * @param array $args |
||
| 22 | * @return array |
||
| 23 | */ |
||
| 24 | public static function get_tokens( $args ) { |
||
| 25 | global $wpdb; |
||
| 26 | |||
| 27 | $args = wp_parse_args( $args, array( |
||
| 28 | 'token_id' => '', |
||
| 29 | 'user_id' => '', |
||
| 30 | 'gateway_id' => '', |
||
| 31 | 'type' => '', |
||
| 32 | ) ); |
||
| 33 | |||
| 34 | $sql = "SELECT * FROM {$wpdb->prefix}woocommerce_payment_tokens"; |
||
| 35 | $where = array( '1=1' ); |
||
| 36 | |||
| 37 | if ( $args['token_id'] ) { |
||
| 38 | $token_ids = array_map( 'absint', is_array( $args['token_id'] ) ? $args['token_id'] : array( $args['token_id'] ) ); |
||
| 39 | $where[] = "token_id IN ('" . implode( "','", array_map( 'esc_sql', $token_ids ) ) . "')"; |
||
| 40 | } |
||
| 41 | |||
| 42 | if ( $args['user_id'] ) { |
||
| 43 | $where[] = 'user_id = ' . absint( $args['user_id'] ); |
||
| 44 | } |
||
| 45 | |||
| 46 | if ( $args['gateway_id'] ) { |
||
| 47 | $gateway_ids = array( $args['gateway_id'] ); |
||
| 48 | } else { |
||
| 49 | $gateways = WC_Payment_Gateways::instance(); |
||
| 50 | $gateway_ids = $gateways->get_payment_gateway_ids(); |
||
| 51 | } |
||
| 52 | |||
| 53 | $gateway_ids[] = ''; |
||
| 54 | $where[] = "gateway_id IN ('" . implode( "','", array_map( 'esc_sql', $gateway_ids ) ) . "')"; |
||
| 55 | |||
| 56 | if ( $args['type'] ) { |
||
| 57 | $where[] = 'type = ' . esc_sql( $args['type'] ); |
||
| 58 | } |
||
| 59 | |||
| 60 | $token_results = $wpdb->get_results( $sql . ' WHERE ' . implode( ' AND ', $where ) ); |
||
| 61 | $tokens = array(); |
||
| 62 | |||
| 63 | if ( ! empty( $token_results ) ) { |
||
| 64 | foreach ( $token_results as $token_result ) { |
||
| 65 | $_token = self::get( $token_result->token_id, $token_result ); |
||
| 66 | if ( ! empty( $_token ) ) { |
||
| 67 | $tokens[ $token_result->token_id ] = $_token; |
||
| 68 | } |
||
| 69 | } |
||
| 70 | } |
||
| 71 | |||
| 72 | return $tokens; |
||
| 73 | } |
||
| 74 | |||
| 75 | /** |
||
| 76 | * Returns an array of payment token objects associated with the passed customer ID. |
||
| 77 | * @since 2.6.0 |
||
| 78 | * @param int $customer_id Customer ID |
||
| 79 | * @param string $gateway_id Optional Gateway ID for getting tokens for a specific gateway |
||
| 80 | * @return array Array of token objects |
||
| 81 | */ |
||
| 82 | public static function get_customer_tokens( $customer_id, $gateway_id = '' ) { |
||
| 83 | if ( $customer_id < 1 ) { |
||
| 84 | return array(); |
||
| 85 | } |
||
| 86 | |||
| 87 | $tokens = self::get_tokens( array( |
||
| 88 | 'user_id' => $customer_id, |
||
| 89 | 'gateway_id' => $gateway_id |
||
| 90 | ) ); |
||
| 91 | |||
| 92 | return apply_filters( 'woocommerce_get_customer_payment_tokens', $tokens, $customer_id, $gateway_id ); |
||
| 93 | } |
||
| 94 | |||
| 95 | /** |
||
| 96 | * Returns a customers default token or NULL if there is no default token. |
||
| 97 | * @since 2.6.0 |
||
| 98 | * @param int $customer_id |
||
| 99 | * @return WC_Payment_Token|null |
||
| 100 | */ |
||
| 101 | public static function get_customer_default_token( $customer_id ) { |
||
| 102 | if ( $customer_id < 1 ) { |
||
| 103 | return null; |
||
| 104 | } |
||
| 105 | |||
| 106 | global $wpdb; |
||
| 107 | |||
| 108 | $token = $wpdb->get_row( $wpdb->prepare( |
||
| 109 | "SELECT * FROM {$wpdb->prefix}woocommerce_payment_tokens WHERE user_id = %d AND is_default = 1", |
||
| 110 | $customer_id |
||
| 111 | ) ); |
||
| 112 | |||
| 113 | if ( $token ) { |
||
| 114 | return self::get( $token->token_id, $token ); |
||
| 115 | } else { |
||
| 116 | return null; |
||
| 117 | } |
||
| 118 | } |
||
| 119 | |||
| 120 | /** |
||
| 121 | * Returns an array of payment token objects associated with the passed order ID. |
||
| 122 | * @since 2.6.0 |
||
| 123 | * @param int $order_id Order ID |
||
| 124 | * @return array Array of token objects |
||
| 125 | */ |
||
| 126 | public static function get_order_tokens( $order_id ) { |
||
| 127 | $order = wc_get_order( $order_id ); |
||
| 128 | |||
| 129 | if ( ! $order ) { |
||
| 130 | return array(); |
||
| 131 | } |
||
| 132 | |||
| 133 | $token_ids = get_post_meta( $order_id, '_payment_tokens', true ); |
||
| 134 | if ( empty( $token_ids ) ) { |
||
| 135 | return array(); |
||
| 136 | } |
||
| 137 | |||
| 138 | $tokens = self::get_tokens( array( |
||
| 139 | 'token_id' => $token_ids |
||
| 140 | ) ); |
||
| 141 | |||
| 142 | return apply_filters( 'woocommerce_get_order_payment_tokens', $tokens, $order_id ); |
||
| 143 | } |
||
| 144 | |||
| 145 | /** |
||
| 146 | * Get a token object by ID. |
||
| 147 | * @since 2.6.0 |
||
| 148 | * @param int $token_id Token ID |
||
| 149 | * @return WC_Payment_Token|null Returns a valid payment token or null if no token can be found |
||
| 150 | */ |
||
| 151 | public static function get( $token_id, $token_result = null ) { |
||
| 152 | global $wpdb; |
||
| 153 | |||
| 154 | if ( is_null( $token_result ) ) { |
||
| 155 | $token_result = $wpdb->get_row( $wpdb->prepare( |
||
| 156 | "SELECT * FROM {$wpdb->prefix}woocommerce_payment_tokens WHERE token_id = %d", |
||
| 157 | $token_id |
||
| 158 | ) ); |
||
| 159 | |||
| 160 | // Still empty? Token doesn't exist? Don't continue |
||
| 161 | if ( empty( $token_result ) ) { |
||
| 162 | return null; |
||
| 163 | } |
||
| 164 | } |
||
| 165 | |||
| 166 | $token_class = 'WC_Payment_Token_' . $token_result->type; |
||
| 167 | |||
| 168 | if ( class_exists( $token_class ) ) { |
||
| 169 | $meta = get_metadata( 'payment_token', $token_id ); |
||
| 170 | $passed_meta = array(); |
||
| 171 | if ( ! empty( $meta ) ) { |
||
| 172 | foreach( $meta as $meta_key => $meta_value ) { |
||
| 173 | $passed_meta[ $meta_key ] = $meta_value[0]; |
||
| 174 | } |
||
| 175 | } |
||
| 176 | return new $token_class( $token_id, (array) $token_result, $passed_meta ); |
||
| 177 | } |
||
| 178 | |||
| 179 | return null; |
||
| 180 | } |
||
| 181 | |||
| 182 | /** |
||
| 183 | * Remove a payment token from the database by ID. |
||
| 184 | * @since 2.6.0 |
||
| 185 | * @param WC_Payment_Token $token_id Token ID |
||
| 186 | */ |
||
| 187 | public static function delete( $token_id ) { |
||
| 188 | $type = self::get_token_type_by_id( $token_id ); |
||
|
0 ignored issues
–
show
|
|||
| 189 | if ( ! empty ( $type ) ) { |
||
| 190 | $class = 'WC_Payment_Token_' . $type; |
||
| 191 | $token = new $class( $token_id ); |
||
| 192 | $token->delete(); |
||
| 193 | } |
||
| 194 | } |
||
| 195 | |||
| 196 | /** |
||
| 197 | * Loops through all of a users payment tokens and sets is_default to false for all but a specific token. |
||
| 198 | * @since 2.6.0 |
||
| 199 | * @param int $user_id User to set a default for |
||
| 200 | * @param int $token_id The ID of the token that should be default |
||
| 201 | */ |
||
| 202 | public static function set_users_default( $user_id, $token_id ) { |
||
| 203 | global $wpdb; // DB queries so we avoid an infinite loop (update & create use this function) |
||
| 204 | $users_tokens = self::get_customer_tokens( $user_id ); |
||
| 205 | foreach ( $users_tokens as $token ) { |
||
| 206 | if ( $token_id === $token->get_id() ) { |
||
| 207 | $token->set_default( true ); |
||
| 208 | $wpdb->update( |
||
| 209 | $wpdb->prefix . 'woocommerce_payment_tokens', |
||
| 210 | array( 'is_default' => 1 ), |
||
| 211 | array( 'token_id' => $token->get_id(), |
||
| 212 | ) ); |
||
| 213 | |||
| 214 | do_action( 'woocommerce_payment_token_set_default', $token_id, $token ); |
||
| 215 | } else { |
||
| 216 | $token->set_default( false ); |
||
| 217 | $wpdb->update( |
||
| 218 | $wpdb->prefix . 'woocommerce_payment_tokens', |
||
| 219 | array( 'is_default' => 0 ), |
||
| 220 | array( 'token_id' => $token->get_id(), |
||
| 221 | ) ); |
||
| 222 | } |
||
| 223 | } |
||
| 224 | } |
||
| 225 | |||
| 226 | /** |
||
| 227 | * Returns what type (credit card, echeck, etc) of token a token is by ID. |
||
| 228 | * @since 2.6.0 |
||
| 229 | * @param int $token_id Token ID |
||
| 230 | * @return string Type |
||
| 231 | */ |
||
| 232 | public static function get_token_type_by_id( $token_id ) { |
||
| 233 | global $wpdb; |
||
| 234 | $type = $wpdb->get_var( $wpdb->prepare( |
||
| 235 | "SELECT type FROM {$wpdb->prefix}woocommerce_payment_tokens WHERE token_id = %d", |
||
| 236 | $token_id |
||
| 237 | ) ); |
||
| 238 | return $type; |
||
| 239 | } |
||
| 240 | |||
| 241 | } |
||
| 242 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: