This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | if ( ! defined( 'ABSPATH' ) ) { |
||
4 | exit; // Exit if accessed directly |
||
5 | } |
||
6 | |||
7 | /** |
||
8 | * Post Data. |
||
9 | * |
||
10 | * Standardises certain post data on save. |
||
11 | * |
||
12 | * @class WC_Post_Data |
||
13 | * @version 2.2.0 |
||
14 | * @package WooCommerce/Classes/Data |
||
15 | * @category Class |
||
16 | * @author WooThemes |
||
17 | */ |
||
18 | class WC_Post_Data { |
||
19 | |||
20 | /** |
||
21 | * Editing term. |
||
22 | * |
||
23 | * @var object |
||
24 | */ |
||
25 | private static $editing_term = null; |
||
26 | |||
27 | /** |
||
28 | * Hook in methods. |
||
29 | */ |
||
30 | public static function init() { |
||
31 | add_action( 'set_object_terms', array( __CLASS__, 'set_object_terms' ), 10, 6 ); |
||
32 | |||
33 | add_action( 'transition_post_status', array( __CLASS__, 'transition_post_status' ), 10, 3 ); |
||
34 | add_action( 'woocommerce_product_set_stock_status', array( __CLASS__, 'delete_product_query_transients' ) ); |
||
35 | add_action( 'woocommerce_product_set_visibility', array( __CLASS__, 'delete_product_query_transients' ) ); |
||
36 | |||
37 | add_action( 'edit_term', array( __CLASS__, 'edit_term' ), 10, 3 ); |
||
38 | add_action( 'edited_term', array( __CLASS__, 'edited_term' ), 10, 3 ); |
||
39 | add_filter( 'update_order_item_metadata', array( __CLASS__, 'update_order_item_metadata' ), 10, 5 ); |
||
40 | add_filter( 'update_post_metadata', array( __CLASS__, 'update_post_metadata' ), 10, 5 ); |
||
41 | add_filter( 'wp_insert_post_data', array( __CLASS__, 'wp_insert_post_data' ) ); |
||
42 | add_action( 'pre_post_update', array( __CLASS__, 'pre_post_update' ) ); |
||
43 | add_action( 'update_post_meta', array( __CLASS__, 'sync_product_stock_status' ), 10, 4 ); |
||
44 | } |
||
45 | |||
46 | /** |
||
47 | * Delete transients when terms are set. |
||
48 | */ |
||
49 | public static function set_object_terms( $object_id, $terms, $tt_ids, $taxonomy, $append, $old_tt_ids ) { |
||
50 | foreach ( array_merge( $tt_ids, $old_tt_ids ) as $id ) { |
||
51 | delete_transient( 'wc_ln_count_' . md5( sanitize_key( $taxonomy ) . sanitize_key( $id ) ) ); |
||
52 | } |
||
53 | } |
||
54 | |||
55 | /** |
||
56 | * When a post status changes. |
||
57 | */ |
||
58 | public static function transition_post_status( $new_status, $old_status, $post ) { |
||
59 | if ( ( 'publish' === $new_status || 'publish' === $old_status ) && in_array( $post->post_type, array( 'product', 'product_variation' ) ) ) { |
||
60 | self::delete_product_query_transients(); |
||
61 | } |
||
62 | } |
||
63 | |||
64 | /** |
||
65 | * Delete product view transients when needed e.g. when post status changes, or visibility/stock status is modified. |
||
66 | */ |
||
67 | public static function delete_product_query_transients() { |
||
68 | // Increments the transient version to invalidate cache |
||
69 | WC_Cache_Helper::get_transient_version( 'product_query', true ); |
||
70 | |||
71 | // If not using an external caching system, we can clear the transients out manually and avoid filling our DB |
||
72 | if ( ! wp_using_ext_object_cache() ) { |
||
73 | global $wpdb; |
||
74 | |||
75 | $wpdb->query( " |
||
76 | DELETE FROM `$wpdb->options` |
||
77 | WHERE `option_name` LIKE ('\_transient\_wc\_uf\_pid\_%') |
||
78 | OR `option_name` LIKE ('\_transient\_timeout\_wc\_uf\_pid\_%') |
||
79 | OR `option_name` LIKE ('\_transient\_wc\_products\_will\_display\_%') |
||
80 | OR `option_name` LIKE ('\_transient\_timeout\_wc\_products\_will\_display\_%') |
||
81 | " ); |
||
82 | } |
||
83 | } |
||
84 | |||
85 | /** |
||
86 | * When editing a term, check for product attributes. |
||
87 | * @param id $term_id |
||
88 | * @param id $tt_id |
||
89 | * @param string $taxonomy |
||
90 | */ |
||
91 | public static function edit_term( $term_id, $tt_id, $taxonomy ) { |
||
92 | if ( strpos( $taxonomy, 'pa_' ) === 0 ) { |
||
93 | self::$editing_term = get_term_by( 'id', $term_id, $taxonomy ); |
||
94 | } else { |
||
95 | self::$editing_term = null; |
||
96 | } |
||
97 | } |
||
98 | |||
99 | /** |
||
100 | * When a term is edited, check for product attributes and update variations. |
||
101 | * @param id $term_id |
||
102 | * @param id $tt_id |
||
103 | * @param string $taxonomy |
||
104 | */ |
||
105 | public static function edited_term( $term_id, $tt_id, $taxonomy ) { |
||
106 | if ( ! is_null( self::$editing_term ) && strpos( $taxonomy, 'pa_' ) === 0 ) { |
||
107 | $edited_term = get_term_by( 'id', $term_id, $taxonomy ); |
||
108 | |||
109 | if ( $edited_term->slug !== self::$editing_term->slug ) { |
||
110 | global $wpdb; |
||
111 | |||
112 | $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->postmeta} SET meta_value = %s WHERE meta_key = %s AND meta_value = %s;", $edited_term->slug, 'attribute_' . sanitize_title( $taxonomy ), self::$editing_term->slug ) ); |
||
113 | } |
||
114 | } else { |
||
115 | self::$editing_term = null; |
||
116 | } |
||
117 | } |
||
118 | |||
119 | /** |
||
120 | * Ensure floats are correctly converted to strings based on PHP locale. |
||
121 | * |
||
122 | * @param null $check |
||
123 | * @param int $object_id |
||
124 | * @param string $meta_key |
||
125 | * @param mixed $meta_value |
||
126 | * @param mixed $prev_value |
||
127 | * @return null|bool |
||
128 | */ |
||
129 | public static function update_order_item_metadata( $check, $object_id, $meta_key, $meta_value, $prev_value ) { |
||
130 | if ( ! empty( $meta_value ) && is_float( $meta_value ) ) { |
||
131 | |||
132 | // Convert float to string |
||
133 | $meta_value = wc_float_to_string( $meta_value ); |
||
134 | |||
135 | // Update meta value with new string |
||
136 | update_metadata( 'order_item', $object_id, $meta_key, $meta_value, $prev_value ); |
||
137 | |||
138 | // Return |
||
139 | return true; |
||
140 | } |
||
141 | return $check; |
||
142 | } |
||
143 | |||
144 | /** |
||
145 | * Ensure floats are correctly converted to strings based on PHP locale. |
||
146 | * |
||
147 | * @param null $check |
||
148 | * @param int $object_id |
||
149 | * @param string $meta_key |
||
150 | * @param mixed $meta_value |
||
151 | * @param mixed $prev_value |
||
152 | * @return null|bool |
||
153 | */ |
||
154 | public static function update_post_metadata( $check, $object_id, $meta_key, $meta_value, $prev_value ) { |
||
155 | if ( ! empty( $meta_value ) && is_float( $meta_value ) && in_array( get_post_type( $object_id ), array_merge( wc_get_order_types(), array( 'shop_coupon', 'product', 'product_variation' ) ) ) ) { |
||
156 | |||
157 | // Convert float to string |
||
158 | $meta_value = wc_float_to_string( $meta_value ); |
||
159 | |||
160 | // Update meta value with new string |
||
161 | update_metadata( 'post', $object_id, $meta_key, $meta_value, $prev_value ); |
||
162 | |||
163 | // Return |
||
164 | return true; |
||
165 | } |
||
166 | return $check; |
||
167 | } |
||
168 | |||
169 | /** |
||
170 | * When setting stock level, ensure the stock status is kept in sync. |
||
171 | * @param int $meta_id |
||
172 | * @param int $object_id |
||
173 | * @param string $meta_key |
||
174 | * @param mixed $_meta_value |
||
175 | */ |
||
176 | public static function sync_product_stock_status( $meta_id, $object_id, $meta_key, $_meta_value ) { |
||
0 ignored issues
–
show
|
|||
177 | if ( '_stock' === $meta_key && 'product' !== get_post_type( $object_id ) ) { |
||
178 | $product = wc_get_product( $object_id ); |
||
179 | $product->check_stock_status(); |
||
180 | } |
||
181 | } |
||
182 | |||
183 | /** |
||
184 | * Forces the order posts to have a title in a certain format (containing the date). |
||
185 | * Forces certain product data based on the product's type, e.g. grouped products cannot have a parent. |
||
186 | * |
||
187 | * @param array $data |
||
188 | * @return array |
||
189 | */ |
||
190 | public static function wp_insert_post_data( $data ) { |
||
191 | if ( 'shop_order' === $data['post_type'] && isset( $data['post_date'] ) ) { |
||
192 | $order_title = 'Order'; |
||
193 | if ( $data['post_date'] ) { |
||
194 | $order_title.= ' – ' . date_i18n( 'F j, Y @ h:i A', strtotime( $data['post_date'] ) ); |
||
195 | } |
||
196 | $data['post_title'] = $order_title; |
||
197 | } |
||
198 | |||
199 | elseif ( 'product' === $data['post_type'] && isset( $_POST['product-type'] ) ) { |
||
200 | $product_type = stripslashes( $_POST['product-type'] ); |
||
201 | switch ( $product_type ) { |
||
202 | case 'grouped' : |
||
203 | case 'variable' : |
||
204 | $data['post_parent'] = 0; |
||
205 | break; |
||
206 | } |
||
207 | } |
||
208 | |||
209 | return $data; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * Some functions, like the term recount, require the visibility to be set prior. Lets save that here. |
||
214 | * |
||
215 | * @param int $post_id |
||
216 | */ |
||
217 | public static function pre_post_update( $post_id ) { |
||
218 | $product_type = empty( $_POST['product-type'] ) ? 'simple' : sanitize_title( stripslashes( $_POST['product-type'] ) ); |
||
219 | |||
220 | View Code Duplication | if ( isset( $_POST['_visibility'] ) ) { |
|
221 | if ( update_post_meta( $post_id, '_visibility', wc_clean( $_POST['_visibility'] ) ) ) { |
||
222 | do_action( 'woocommerce_product_set_visibility', $post_id, wc_clean( $_POST['_visibility'] ) ); |
||
223 | } |
||
224 | } |
||
225 | if ( isset( $_POST['_stock_status'] ) && 'variable' !== $product_type ) { |
||
226 | wc_update_product_stock_status( $post_id, wc_clean( $_POST['_stock_status'] ) ); |
||
227 | } |
||
228 | } |
||
229 | } |
||
230 | |||
231 | WC_Post_Data::init(); |
||
232 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.