This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | if ( ! defined( 'ABSPATH' ) ) { |
||
4 | exit; |
||
5 | } |
||
6 | |||
7 | /** |
||
8 | * Handles storage and retrieval of shipping zones |
||
9 | * |
||
10 | * @class WC_Shipping_Zones |
||
11 | * @since 2.6.0 |
||
12 | * @version 2.6.0 |
||
13 | * @package WooCommerce/Classes |
||
14 | * @category Class |
||
15 | * @author WooThemes |
||
16 | */ |
||
17 | class WC_Shipping_Zones { |
||
18 | |||
19 | /** |
||
20 | * Get shipping zones from the database |
||
21 | * @since 2.6.0 |
||
22 | * @return array of arrays |
||
23 | */ |
||
24 | public static function get_zones() { |
||
25 | global $wpdb; |
||
26 | |||
27 | $raw_zones = $wpdb->get_results( "SELECT zone_id, zone_name, zone_order FROM {$wpdb->prefix}woocommerce_shipping_zones order by zone_order ASC;" ); |
||
28 | $zones = array(); |
||
29 | |||
30 | foreach ( $raw_zones as $raw_zone ) { |
||
31 | $zone = new WC_Shipping_Zone( $raw_zone ); |
||
32 | $zones[ $zone->get_zone_id() ] = $zone->get_data(); |
||
33 | $zones[ $zone->get_zone_id() ]['formatted_zone_location'] = $zone->get_formatted_location(); |
||
34 | $zones[ $zone->get_zone_id() ]['shipping_methods'] = $zone->get_shipping_methods(); |
||
35 | } |
||
36 | |||
37 | return $zones; |
||
38 | } |
||
39 | |||
40 | /** |
||
41 | * Get shipping zone using it's ID |
||
42 | * @since 2.6.0 |
||
43 | * @param int $zone_id |
||
44 | * @return WC_Shipping_Zone|bool |
||
45 | */ |
||
46 | public static function get_zone( $zone_id ) { |
||
47 | return self::get_zone_by( 'zone_id', $zone_id ); |
||
48 | } |
||
49 | |||
50 | /** |
||
51 | * Get shipping zone by an ID. |
||
52 | * @since 2.6.0 |
||
53 | * @param string $by zone_id or instance_id |
||
54 | * @param int $id |
||
55 | * @return WC_Shipping_Zone|bool |
||
56 | */ |
||
57 | public static function get_zone_by( $by = 'zone_id', $id = 0 ) { |
||
58 | global $wpdb; |
||
59 | |||
60 | $raw_zone = false; |
||
61 | |||
62 | switch ( $by ) { |
||
63 | case 'zone_id' : |
||
64 | if ( 0 === $id ) { |
||
65 | return new WC_Shipping_Zone( 0 ); |
||
66 | } else { |
||
67 | $raw_zone = $wpdb->get_row( $wpdb->prepare( "SELECT zone_id, zone_name, zone_order FROM {$wpdb->prefix}woocommerce_shipping_zones WHERE zone_id = %d LIMIT 1;", $id ) ); |
||
68 | } |
||
69 | break; |
||
70 | case 'instance_id' : |
||
71 | $zone_id = $wpdb->get_var( $wpdb->prepare( "SELECT zone_id FROM {$wpdb->prefix}woocommerce_shipping_zone_methods as methods WHERE methods.instance_id = %d LIMIT 1;", $id ) ); |
||
72 | |||
73 | if ( false !== $zone_id ) { |
||
74 | return self::get_zone_by( 'zone_id', absint( $zone_id ) ); |
||
75 | } |
||
76 | break; |
||
77 | } |
||
78 | |||
79 | return $raw_zone ? new WC_Shipping_Zone( $raw_zone ) : false; |
||
80 | } |
||
81 | |||
82 | /** |
||
83 | * Get shipping zone using it's ID |
||
84 | * @since 2.6.0 |
||
85 | * @return WC_Shipping_Meethod|bool |
||
86 | */ |
||
87 | public static function get_shipping_method( $instance_id ) { |
||
88 | global $wpdb; |
||
89 | $raw_shipping_method = $wpdb->get_row( $wpdb->prepare( "SELECT instance_id, method_id FROM {$wpdb->prefix}woocommerce_shipping_zone_methods WHERE instance_id = %d LIMIT 1;", $instance_id ) ); |
||
90 | $wc_shipping = WC_Shipping::instance(); |
||
91 | $allowed_classes = $wc_shipping->get_shipping_method_class_names(); |
||
92 | |||
93 | if ( in_array( $raw_shipping_method->method_id, array_keys( $allowed_classes ) ) ) { |
||
94 | $class_name = $allowed_classes[ $raw_shipping_method->method_id ]; |
||
95 | if ( is_object( $class_name ) ) { |
||
96 | $class_name = get_class( $class_name ); |
||
97 | } |
||
98 | return new $class_name( $raw_shipping_method->instance_id ); |
||
99 | } |
||
100 | return false; |
||
101 | } |
||
102 | |||
103 | /** |
||
104 | * Delete a zone using it's ID |
||
105 | * @param int $zone_id |
||
106 | * @since 2.6.0 |
||
107 | */ |
||
108 | public static function delete_zone( $zone_id ) { |
||
109 | $zone = new WC_Shipping_Zone( $zone_id ); |
||
110 | $zone->delete(); |
||
111 | } |
||
112 | |||
113 | /** |
||
114 | * Find a matching zone for a given package. |
||
115 | * @since 2.6.0 |
||
116 | * @uses wc_make_numeric_postcode() |
||
117 | * @param object $package |
||
118 | * @return WC_Shipping_Zone |
||
119 | */ |
||
120 | public static function get_zone_matching_package( $package ) { |
||
121 | global $wpdb; |
||
122 | |||
123 | $country = strtoupper( wc_clean( $package['destination']['country'] ) ); |
||
124 | $state = strtoupper( wc_clean( $package['destination']['state'] ) ); |
||
125 | $continent = strtoupper( wc_clean( WC()->countries->get_continent_code_for_country( $country ) ) ); |
||
126 | $postcode = wc_normalize_postcode( wc_clean( $package['destination']['postcode'] ) ); |
||
127 | $cache_key = WC_Cache_Helper::get_cache_prefix( 'shipping_zones' ) . 'wc_shipping_zone_' . md5( sprintf( '%s+%s+%s', $country, $state, $postcode ) ); |
||
128 | $matching_zone_id = wp_cache_get( $cache_key, 'shipping_zones' ); |
||
129 | |||
130 | if ( false === $matching_zone_id ) { |
||
131 | |||
132 | // Work out criteria for our zone search |
||
133 | $criteria = array(); |
||
134 | $criteria[] = $wpdb->prepare( "( ( location_type = 'country' AND location_code = %s )", $country ); |
||
135 | $criteria[] = $wpdb->prepare( "OR ( location_type = 'state' AND location_code = %s )", $country . ':' . $state ); |
||
136 | $criteria[] = $wpdb->prepare( "OR ( location_type = 'continent' AND location_code = %s ) )", $continent ); |
||
137 | |||
138 | // Postcode range and wildcard matching |
||
139 | $postcode_locations = $wpdb->get_results( "SELECT zone_id, location_code FROM {$wpdb->prefix}woocommerce_shipping_zone_locations WHERE location_type = 'postcode';" ); |
||
140 | |||
141 | if ( $postcode_locations ) { |
||
142 | $zone_ids_with_postcode_rules = array_map( 'absint', wp_list_pluck( $postcode_locations, 'zone_id' ) ); |
||
143 | $matches = wc_postcode_location_matcher( $postcode, $postcode_locations, 'zone_id', 'location_code' ); |
||
144 | $do_not_match = array_unique( array_diff( $zone_ids_with_postcode_rules, array_keys( $matches ) ) ); |
||
145 | |||
146 | if ( $do_not_match ) { |
||
0 ignored issues
–
show
|
|||
147 | $criteria[] = "AND zones.zone_id NOT IN (" . implode( ',', $do_not_match ) . ")"; |
||
148 | } |
||
149 | } |
||
150 | |||
151 | // Get matching zones |
||
152 | $matching_zone_id = $wpdb->get_var( " |
||
153 | SELECT zones.zone_id FROM {$wpdb->prefix}woocommerce_shipping_zones as zones |
||
154 | LEFT OUTER JOIN {$wpdb->prefix}woocommerce_shipping_zone_locations as locations ON zones.zone_id = locations.zone_id |
||
155 | WHERE " . implode( ' ', $criteria ) . " |
||
156 | ORDER BY zone_order ASC LIMIT 1 |
||
157 | " ); |
||
158 | |||
159 | wp_cache_set( $cache_key, $matching_zone_id, 'shipping_zones' ); |
||
160 | } |
||
161 | |||
162 | return new WC_Shipping_Zone( $matching_zone_id ? $matching_zone_id : 0 ); |
||
163 | } |
||
164 | } |
||
165 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)
or! empty(...)
instead.