Нет описания

class-wc-form-handler.php 44KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129
  1. <?php
  2. /**
  3. * Handle frontend forms.
  4. *
  5. * @package WooCommerce\Classes\
  6. */
  7. defined( 'ABSPATH' ) || exit;
  8. /**
  9. * WC_Form_Handler class.
  10. */
  11. class WC_Form_Handler {
  12. /**
  13. * Hook in methods.
  14. */
  15. public static function init() {
  16. add_action( 'template_redirect', array( __CLASS__, 'redirect_reset_password_link' ) );
  17. add_action( 'template_redirect', array( __CLASS__, 'save_address' ) );
  18. add_action( 'template_redirect', array( __CLASS__, 'save_account_details' ) );
  19. add_action( 'wp_loaded', array( __CLASS__, 'checkout_action' ), 20 );
  20. add_action( 'wp_loaded', array( __CLASS__, 'process_login' ), 20 );
  21. add_action( 'wp_loaded', array( __CLASS__, 'process_registration' ), 20 );
  22. add_action( 'wp_loaded', array( __CLASS__, 'process_lost_password' ), 20 );
  23. add_action( 'wp_loaded', array( __CLASS__, 'process_reset_password' ), 20 );
  24. add_action( 'wp_loaded', array( __CLASS__, 'cancel_order' ), 20 );
  25. add_action( 'wp_loaded', array( __CLASS__, 'update_cart_action' ), 20 );
  26. add_action( 'wp_loaded', array( __CLASS__, 'add_to_cart_action' ), 20 );
  27. // May need $wp global to access query vars.
  28. add_action( 'wp', array( __CLASS__, 'pay_action' ), 20 );
  29. add_action( 'wp', array( __CLASS__, 'add_payment_method_action' ), 20 );
  30. add_action( 'wp', array( __CLASS__, 'delete_payment_method_action' ), 20 );
  31. add_action( 'wp', array( __CLASS__, 'set_default_payment_method_action' ), 20 );
  32. }
  33. /**
  34. * Remove key and user ID (or user login, as a fallback) from query string, set cookie, and redirect to account page to show the form.
  35. */
  36. public static function redirect_reset_password_link() {
  37. if ( is_account_page() && isset( $_GET['key'] ) && ( isset( $_GET['id'] ) || isset( $_GET['login'] ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  38. // If available, get $user_id from query string parameter for fallback purposes.
  39. if ( isset( $_GET['login'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  40. $user = get_user_by( 'login', sanitize_user( wp_unslash( $_GET['login'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  41. $user_id = $user ? $user->ID : 0;
  42. } else {
  43. $user_id = absint( $_GET['id'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  44. }
  45. // If the reset token is not for the current user, ignore the reset request (don't redirect).
  46. $logged_in_user_id = get_current_user_id();
  47. if ( $logged_in_user_id && $logged_in_user_id !== $user_id ) {
  48. wc_add_notice( __( 'This password reset key is for a different user account. Please log out and try again.', 'woocommerce' ), 'error' );
  49. return;
  50. }
  51. $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
  52. $value = sprintf( '%d:%s', $user_id, wp_unslash( $_GET['key'] ) ); // phpcs:ignore
  53. WC_Shortcode_My_Account::set_reset_password_cookie( $value );
  54. wp_safe_redirect(
  55. add_query_arg(
  56. array(
  57. 'show-reset-form' => 'true',
  58. 'action' => $action,
  59. ),
  60. wc_lostpassword_url()
  61. )
  62. );
  63. exit;
  64. }
  65. }
  66. /**
  67. * Save and and update a billing or shipping address if the
  68. * form was submitted through the user account page.
  69. */
  70. public static function save_address() {
  71. global $wp;
  72. $nonce_value = wc_get_var( $_REQUEST['woocommerce-edit-address-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  73. if ( ! wp_verify_nonce( $nonce_value, 'woocommerce-edit_address' ) ) {
  74. return;
  75. }
  76. if ( empty( $_POST['action'] ) || 'edit_address' !== $_POST['action'] ) {
  77. return;
  78. }
  79. wc_nocache_headers();
  80. $user_id = get_current_user_id();
  81. if ( $user_id <= 0 ) {
  82. return;
  83. }
  84. $customer = new WC_Customer( $user_id );
  85. if ( ! $customer ) {
  86. return;
  87. }
  88. $load_address = isset( $wp->query_vars['edit-address'] ) ? wc_edit_address_i18n( sanitize_title( $wp->query_vars['edit-address'] ), true ) : 'billing';
  89. if ( ! isset( $_POST[ $load_address . '_country' ] ) ) {
  90. return;
  91. }
  92. $address = WC()->countries->get_address_fields( wc_clean( wp_unslash( $_POST[ $load_address . '_country' ] ) ), $load_address . '_' );
  93. foreach ( $address as $key => $field ) {
  94. if ( ! isset( $field['type'] ) ) {
  95. $field['type'] = 'text';
  96. }
  97. // Get Value.
  98. if ( 'checkbox' === $field['type'] ) {
  99. $value = (int) isset( $_POST[ $key ] );
  100. } else {
  101. $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : '';
  102. }
  103. // Hook to allow modification of value.
  104. $value = apply_filters( 'woocommerce_process_myaccount_field_' . $key, $value );
  105. // Validation: Required fields.
  106. if ( ! empty( $field['required'] ) && empty( $value ) ) {
  107. /* translators: %s: Field name. */
  108. wc_add_notice( sprintf( __( '%s is a required field.', 'woocommerce' ), $field['label'] ), 'error', array( 'id' => $key ) );
  109. }
  110. if ( ! empty( $value ) ) {
  111. // Validation and formatting rules.
  112. if ( ! empty( $field['validate'] ) && is_array( $field['validate'] ) ) {
  113. foreach ( $field['validate'] as $rule ) {
  114. switch ( $rule ) {
  115. case 'postcode':
  116. $country = wc_clean( wp_unslash( $_POST[ $load_address . '_country' ] ) );
  117. $value = wc_format_postcode( $value, $country );
  118. if ( '' !== $value && ! WC_Validation::is_postcode( $value, $country ) ) {
  119. switch ( $country ) {
  120. case 'IE':
  121. $postcode_validation_notice = __( 'Please enter a valid Eircode.', 'woocommerce' );
  122. break;
  123. default:
  124. $postcode_validation_notice = __( 'Please enter a valid postcode / ZIP.', 'woocommerce' );
  125. }
  126. wc_add_notice( $postcode_validation_notice, 'error' );
  127. }
  128. break;
  129. case 'phone':
  130. if ( '' !== $value && ! WC_Validation::is_phone( $value ) ) {
  131. /* translators: %s: Phone number. */
  132. wc_add_notice( sprintf( __( '%s is not a valid phone number.', 'woocommerce' ), '<strong>' . $field['label'] . '</strong>' ), 'error' );
  133. }
  134. break;
  135. case 'email':
  136. $value = strtolower( $value );
  137. if ( ! is_email( $value ) ) {
  138. /* translators: %s: Email address. */
  139. wc_add_notice( sprintf( __( '%s is not a valid email address.', 'woocommerce' ), '<strong>' . $field['label'] . '</strong>' ), 'error' );
  140. }
  141. break;
  142. }
  143. }
  144. }
  145. }
  146. try {
  147. // Set prop in customer object.
  148. if ( is_callable( array( $customer, "set_$key" ) ) ) {
  149. $customer->{"set_$key"}( $value );
  150. } else {
  151. $customer->update_meta_data( $key, $value );
  152. }
  153. } catch ( WC_Data_Exception $e ) {
  154. // Set notices. Ignore invalid billing email, since is already validated.
  155. if ( 'customer_invalid_billing_email' !== $e->getErrorCode() ) {
  156. wc_add_notice( $e->getMessage(), 'error' );
  157. }
  158. }
  159. }
  160. /**
  161. * Hook: woocommerce_after_save_address_validation.
  162. *
  163. * Allow developers to add custom validation logic and throw an error to prevent save.
  164. *
  165. * @param int $user_id User ID being saved.
  166. * @param string $load_address Type of address e.g. billing or shipping.
  167. * @param array $address The address fields.
  168. * @param WC_Customer $customer The customer object being saved. @since 3.6.0
  169. */
  170. do_action( 'woocommerce_after_save_address_validation', $user_id, $load_address, $address, $customer );
  171. if ( 0 < wc_notice_count( 'error' ) ) {
  172. return;
  173. }
  174. $customer->save();
  175. wc_add_notice( __( 'Address changed successfully.', 'woocommerce' ) );
  176. do_action( 'woocommerce_customer_save_address', $user_id, $load_address );
  177. wp_safe_redirect( wc_get_endpoint_url( 'edit-address', '', wc_get_page_permalink( 'myaccount' ) ) );
  178. exit;
  179. }
  180. /**
  181. * Save the password/account details and redirect back to the my account page.
  182. */
  183. public static function save_account_details() {
  184. $nonce_value = wc_get_var( $_REQUEST['save-account-details-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  185. if ( ! wp_verify_nonce( $nonce_value, 'save_account_details' ) ) {
  186. return;
  187. }
  188. if ( empty( $_POST['action'] ) || 'save_account_details' !== $_POST['action'] ) {
  189. return;
  190. }
  191. wc_nocache_headers();
  192. $user_id = get_current_user_id();
  193. if ( $user_id <= 0 ) {
  194. return;
  195. }
  196. $account_first_name = ! empty( $_POST['account_first_name'] ) ? wc_clean( wp_unslash( $_POST['account_first_name'] ) ) : '';
  197. $account_last_name = ! empty( $_POST['account_last_name'] ) ? wc_clean( wp_unslash( $_POST['account_last_name'] ) ) : '';
  198. $account_display_name = ! empty( $_POST['account_display_name'] ) ? wc_clean( wp_unslash( $_POST['account_display_name'] ) ) : '';
  199. $account_email = ! empty( $_POST['account_email'] ) ? wc_clean( wp_unslash( $_POST['account_email'] ) ) : '';
  200. $pass_cur = ! empty( $_POST['password_current'] ) ? $_POST['password_current'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  201. $pass1 = ! empty( $_POST['password_1'] ) ? $_POST['password_1'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  202. $pass2 = ! empty( $_POST['password_2'] ) ? $_POST['password_2'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  203. $save_pass = true;
  204. // Current user data.
  205. $current_user = get_user_by( 'id', $user_id );
  206. $current_first_name = $current_user->first_name;
  207. $current_last_name = $current_user->last_name;
  208. $current_email = $current_user->user_email;
  209. // New user data.
  210. $user = new stdClass();
  211. $user->ID = $user_id;
  212. $user->first_name = $account_first_name;
  213. $user->last_name = $account_last_name;
  214. $user->display_name = $account_display_name;
  215. // Prevent display name to be changed to email.
  216. if ( is_email( $account_display_name ) ) {
  217. wc_add_notice( __( 'Display name cannot be changed to email address due to privacy concern.', 'woocommerce' ), 'error' );
  218. }
  219. // Handle required fields.
  220. $required_fields = apply_filters(
  221. 'woocommerce_save_account_details_required_fields',
  222. array(
  223. 'account_first_name' => __( 'First name', 'woocommerce' ),
  224. 'account_last_name' => __( 'Last name', 'woocommerce' ),
  225. 'account_display_name' => __( 'Display name', 'woocommerce' ),
  226. 'account_email' => __( 'Email address', 'woocommerce' ),
  227. )
  228. );
  229. foreach ( $required_fields as $field_key => $field_name ) {
  230. if ( empty( $_POST[ $field_key ] ) ) {
  231. /* translators: %s: Field name. */
  232. wc_add_notice( sprintf( __( '%s is a required field.', 'woocommerce' ), '<strong>' . esc_html( $field_name ) . '</strong>' ), 'error', array( 'id' => $field_key ) );
  233. }
  234. }
  235. if ( $account_email ) {
  236. $account_email = sanitize_email( $account_email );
  237. if ( ! is_email( $account_email ) ) {
  238. wc_add_notice( __( 'Please provide a valid email address.', 'woocommerce' ), 'error' );
  239. } elseif ( email_exists( $account_email ) && $account_email !== $current_user->user_email ) {
  240. wc_add_notice( __( 'This email address is already registered.', 'woocommerce' ), 'error' );
  241. }
  242. $user->user_email = $account_email;
  243. }
  244. if ( ! empty( $pass_cur ) && empty( $pass1 ) && empty( $pass2 ) ) {
  245. wc_add_notice( __( 'Please fill out all password fields.', 'woocommerce' ), 'error' );
  246. $save_pass = false;
  247. } elseif ( ! empty( $pass1 ) && empty( $pass_cur ) ) {
  248. wc_add_notice( __( 'Please enter your current password.', 'woocommerce' ), 'error' );
  249. $save_pass = false;
  250. } elseif ( ! empty( $pass1 ) && empty( $pass2 ) ) {
  251. wc_add_notice( __( 'Please re-enter your password.', 'woocommerce' ), 'error' );
  252. $save_pass = false;
  253. } elseif ( ( ! empty( $pass1 ) || ! empty( $pass2 ) ) && $pass1 !== $pass2 ) {
  254. wc_add_notice( __( 'New passwords do not match.', 'woocommerce' ), 'error' );
  255. $save_pass = false;
  256. } elseif ( ! empty( $pass1 ) && ! wp_check_password( $pass_cur, $current_user->user_pass, $current_user->ID ) ) {
  257. wc_add_notice( __( 'Your current password is incorrect.', 'woocommerce' ), 'error' );
  258. $save_pass = false;
  259. }
  260. if ( $pass1 && $save_pass ) {
  261. $user->user_pass = $pass1;
  262. }
  263. // Allow plugins to return their own errors.
  264. $errors = new WP_Error();
  265. do_action_ref_array( 'woocommerce_save_account_details_errors', array( &$errors, &$user ) );
  266. if ( $errors->get_error_messages() ) {
  267. foreach ( $errors->get_error_messages() as $error ) {
  268. wc_add_notice( $error, 'error' );
  269. }
  270. }
  271. if ( wc_notice_count( 'error' ) === 0 ) {
  272. wp_update_user( $user );
  273. // Update customer object to keep data in sync.
  274. $customer = new WC_Customer( $user->ID );
  275. if ( $customer ) {
  276. // Keep billing data in sync if data changed.
  277. if ( is_email( $user->user_email ) && $current_email !== $user->user_email ) {
  278. $customer->set_billing_email( $user->user_email );
  279. }
  280. if ( $current_first_name !== $user->first_name ) {
  281. $customer->set_billing_first_name( $user->first_name );
  282. }
  283. if ( $current_last_name !== $user->last_name ) {
  284. $customer->set_billing_last_name( $user->last_name );
  285. }
  286. $customer->save();
  287. }
  288. wc_add_notice( __( 'Account details changed successfully.', 'woocommerce' ) );
  289. do_action( 'woocommerce_save_account_details', $user->ID );
  290. wp_safe_redirect( wc_get_page_permalink( 'myaccount' ) );
  291. exit;
  292. }
  293. }
  294. /**
  295. * Process the checkout form.
  296. */
  297. public static function checkout_action() {
  298. if ( isset( $_POST['woocommerce_checkout_place_order'] ) || isset( $_POST['woocommerce_checkout_update_totals'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
  299. wc_nocache_headers();
  300. if ( WC()->cart->is_empty() ) {
  301. wp_safe_redirect( wc_get_cart_url() );
  302. exit;
  303. }
  304. wc_maybe_define_constant( 'WOOCOMMERCE_CHECKOUT', true );
  305. WC()->checkout()->process_checkout();
  306. }
  307. }
  308. /**
  309. * Process the pay form.
  310. *
  311. * @throws Exception On payment error.
  312. */
  313. public static function pay_action() {
  314. global $wp;
  315. if ( isset( $_POST['woocommerce_pay'], $_GET['key'] ) ) {
  316. wc_nocache_headers();
  317. $nonce_value = wc_get_var( $_REQUEST['woocommerce-pay-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  318. if ( ! wp_verify_nonce( $nonce_value, 'woocommerce-pay' ) ) {
  319. return;
  320. }
  321. ob_start();
  322. // Pay for existing order.
  323. $order_key = wp_unslash( $_GET['key'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  324. $order_id = absint( $wp->query_vars['order-pay'] );
  325. $order = wc_get_order( $order_id );
  326. if ( $order_id === $order->get_id() && hash_equals( $order->get_order_key(), $order_key ) && $order->needs_payment() ) {
  327. do_action( 'woocommerce_before_pay_action', $order );
  328. WC()->customer->set_props(
  329. array(
  330. 'billing_country' => $order->get_billing_country() ? $order->get_billing_country() : null,
  331. 'billing_state' => $order->get_billing_state() ? $order->get_billing_state() : null,
  332. 'billing_postcode' => $order->get_billing_postcode() ? $order->get_billing_postcode() : null,
  333. 'billing_city' => $order->get_billing_city() ? $order->get_billing_city() : null,
  334. )
  335. );
  336. WC()->customer->save();
  337. if ( ! empty( $_POST['terms-field'] ) && empty( $_POST['terms'] ) ) {
  338. wc_add_notice( __( 'Please read and accept the terms and conditions to proceed with your order.', 'woocommerce' ), 'error' );
  339. return;
  340. }
  341. // Update payment method.
  342. if ( $order->needs_payment() ) {
  343. try {
  344. $payment_method_id = isset( $_POST['payment_method'] ) ? wc_clean( wp_unslash( $_POST['payment_method'] ) ) : false;
  345. if ( ! $payment_method_id ) {
  346. throw new Exception( __( 'Invalid payment method.', 'woocommerce' ) );
  347. }
  348. $available_gateways = WC()->payment_gateways->get_available_payment_gateways();
  349. $payment_method = isset( $available_gateways[ $payment_method_id ] ) ? $available_gateways[ $payment_method_id ] : false;
  350. if ( ! $payment_method ) {
  351. throw new Exception( __( 'Invalid payment method.', 'woocommerce' ) );
  352. }
  353. $order->set_payment_method( $payment_method );
  354. $order->save();
  355. $payment_method->validate_fields();
  356. if ( 0 === wc_notice_count( 'error' ) ) {
  357. $result = $payment_method->process_payment( $order_id );
  358. // Redirect to success/confirmation/payment page.
  359. if ( isset( $result['result'] ) && 'success' === $result['result'] ) {
  360. $result['order_id'] = $order_id;
  361. $result = apply_filters( 'woocommerce_payment_successful_result', $result, $order_id );
  362. wp_redirect( $result['redirect'] ); //phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
  363. exit;
  364. }
  365. }
  366. } catch ( Exception $e ) {
  367. wc_add_notice( $e->getMessage(), 'error' );
  368. }
  369. } else {
  370. // No payment was required for order.
  371. $order->payment_complete();
  372. wp_safe_redirect( $order->get_checkout_order_received_url() );
  373. exit;
  374. }
  375. do_action( 'woocommerce_after_pay_action', $order );
  376. }
  377. }
  378. }
  379. /**
  380. * Process the add payment method form.
  381. */
  382. public static function add_payment_method_action() {
  383. if ( isset( $_POST['woocommerce_add_payment_method'], $_POST['payment_method'] ) ) {
  384. wc_nocache_headers();
  385. $nonce_value = wc_get_var( $_REQUEST['woocommerce-add-payment-method-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  386. if ( ! wp_verify_nonce( $nonce_value, 'woocommerce-add-payment-method' ) ) {
  387. return;
  388. }
  389. if ( ! apply_filters( 'woocommerce_add_payment_method_form_is_valid', true ) ) {
  390. return;
  391. }
  392. // Test rate limit.
  393. $current_user_id = get_current_user_id();
  394. $rate_limit_id = 'add_payment_method_' . $current_user_id;
  395. $delay = (int) apply_filters( 'woocommerce_payment_gateway_add_payment_method_delay', 20 );
  396. if ( WC_Rate_Limiter::retried_too_soon( $rate_limit_id ) ) {
  397. wc_add_notice(
  398. sprintf(
  399. /* translators: %d number of seconds */
  400. _n(
  401. 'You cannot add a new payment method so soon after the previous one. Please wait for %d second.',
  402. 'You cannot add a new payment method so soon after the previous one. Please wait for %d seconds.',
  403. $delay,
  404. 'woocommerce'
  405. ),
  406. $delay
  407. ),
  408. 'error'
  409. );
  410. return;
  411. }
  412. WC_Rate_Limiter::set_rate_limit( $rate_limit_id, $delay );
  413. ob_start();
  414. $payment_method_id = wc_clean( wp_unslash( $_POST['payment_method'] ) );
  415. $available_gateways = WC()->payment_gateways->get_available_payment_gateways();
  416. if ( isset( $available_gateways[ $payment_method_id ] ) ) {
  417. $gateway = $available_gateways[ $payment_method_id ];
  418. if ( ! $gateway->supports( 'add_payment_method' ) && ! $gateway->supports( 'tokenization' ) ) {
  419. wc_add_notice( __( 'Invalid payment gateway.', 'woocommerce' ), 'error' );
  420. return;
  421. }
  422. $gateway->validate_fields();
  423. if ( wc_notice_count( 'error' ) > 0 ) {
  424. return;
  425. }
  426. $result = $gateway->add_payment_method();
  427. if ( 'success' === $result['result'] ) {
  428. wc_add_notice( __( 'Payment method successfully added.', 'woocommerce' ) );
  429. }
  430. if ( 'failure' === $result['result'] ) {
  431. wc_add_notice( __( 'Unable to add payment method to your account.', 'woocommerce' ), 'error' );
  432. }
  433. if ( ! empty( $result['redirect'] ) ) {
  434. wp_redirect( $result['redirect'] ); //phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
  435. exit();
  436. }
  437. }
  438. }
  439. }
  440. /**
  441. * Process the delete payment method form.
  442. */
  443. public static function delete_payment_method_action() {
  444. global $wp;
  445. if ( isset( $wp->query_vars['delete-payment-method'] ) ) {
  446. wc_nocache_headers();
  447. $token_id = absint( $wp->query_vars['delete-payment-method'] );
  448. $token = WC_Payment_Tokens::get( $token_id );
  449. if ( is_null( $token ) || get_current_user_id() !== $token->get_user_id() || ! isset( $_REQUEST['_wpnonce'] ) || false === wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'delete-payment-method-' . $token_id ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  450. wc_add_notice( __( 'Invalid payment method.', 'woocommerce' ), 'error' );
  451. } else {
  452. WC_Payment_Tokens::delete( $token_id );
  453. wc_add_notice( __( 'Payment method deleted.', 'woocommerce' ) );
  454. }
  455. wp_safe_redirect( wc_get_account_endpoint_url( 'payment-methods' ) );
  456. exit();
  457. }
  458. }
  459. /**
  460. * Process the delete payment method form.
  461. */
  462. public static function set_default_payment_method_action() {
  463. global $wp;
  464. if ( isset( $wp->query_vars['set-default-payment-method'] ) ) {
  465. wc_nocache_headers();
  466. $token_id = absint( $wp->query_vars['set-default-payment-method'] );
  467. $token = WC_Payment_Tokens::get( $token_id );
  468. if ( is_null( $token ) || get_current_user_id() !== $token->get_user_id() || ! isset( $_REQUEST['_wpnonce'] ) || false === wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'set-default-payment-method-' . $token_id ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  469. wc_add_notice( __( 'Invalid payment method.', 'woocommerce' ), 'error' );
  470. } else {
  471. WC_Payment_Tokens::set_users_default( $token->get_user_id(), intval( $token_id ) );
  472. wc_add_notice( __( 'This payment method was successfully set as your default.', 'woocommerce' ) );
  473. }
  474. wp_safe_redirect( wc_get_account_endpoint_url( 'payment-methods' ) );
  475. exit();
  476. }
  477. }
  478. /**
  479. * Remove from cart/update.
  480. */
  481. public static function update_cart_action() {
  482. if ( ! ( isset( $_REQUEST['apply_coupon'] ) || isset( $_REQUEST['remove_coupon'] ) || isset( $_REQUEST['remove_item'] ) || isset( $_REQUEST['undo_item'] ) || isset( $_REQUEST['update_cart'] ) || isset( $_REQUEST['proceed'] ) ) ) {
  483. return;
  484. }
  485. wc_nocache_headers();
  486. $nonce_value = wc_get_var( $_REQUEST['woocommerce-cart-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  487. if ( ! empty( $_POST['apply_coupon'] ) && ! empty( $_POST['coupon_code'] ) ) {
  488. WC()->cart->add_discount( wc_format_coupon_code( wp_unslash( $_POST['coupon_code'] ) ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  489. } elseif ( isset( $_GET['remove_coupon'] ) ) {
  490. WC()->cart->remove_coupon( wc_format_coupon_code( urldecode( wp_unslash( $_GET['remove_coupon'] ) ) ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  491. } elseif ( ! empty( $_GET['remove_item'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-cart' ) ) {
  492. $cart_item_key = sanitize_text_field( wp_unslash( $_GET['remove_item'] ) );
  493. $cart_item = WC()->cart->get_cart_item( $cart_item_key );
  494. if ( $cart_item ) {
  495. WC()->cart->remove_cart_item( $cart_item_key );
  496. $product = wc_get_product( $cart_item['product_id'] );
  497. /* translators: %s: Item name. */
  498. $item_removed_title = apply_filters( 'woocommerce_cart_item_removed_title', $product ? sprintf( _x( '&ldquo;%s&rdquo;', 'Item name in quotes', 'woocommerce' ), $product->get_name() ) : __( 'Item', 'woocommerce' ), $cart_item );
  499. // Don't show undo link if removed item is out of stock.
  500. if ( $product && $product->is_in_stock() && $product->has_enough_stock( $cart_item['quantity'] ) ) {
  501. /* Translators: %s Product title. */
  502. $removed_notice = sprintf( __( '%s removed.', 'woocommerce' ), $item_removed_title );
  503. $removed_notice .= ' <a href="' . esc_url( wc_get_cart_undo_url( $cart_item_key ) ) . '" class="restore-item">' . __( 'Undo?', 'woocommerce' ) . '</a>';
  504. } else {
  505. /* Translators: %s Product title. */
  506. $removed_notice = sprintf( __( '%s removed.', 'woocommerce' ), $item_removed_title );
  507. }
  508. wc_add_notice( $removed_notice, apply_filters( 'woocommerce_cart_item_removed_notice_type', 'success' ) );
  509. }
  510. $referer = wp_get_referer() ? remove_query_arg( array( 'remove_item', 'add-to-cart', 'added-to-cart', 'order_again', '_wpnonce' ), add_query_arg( 'removed_item', '1', wp_get_referer() ) ) : wc_get_cart_url();
  511. wp_safe_redirect( $referer );
  512. exit;
  513. } elseif ( ! empty( $_GET['undo_item'] ) && isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-cart' ) ) {
  514. // Undo Cart Item.
  515. $cart_item_key = sanitize_text_field( wp_unslash( $_GET['undo_item'] ) );
  516. WC()->cart->restore_cart_item( $cart_item_key );
  517. $referer = wp_get_referer() ? remove_query_arg( array( 'undo_item', '_wpnonce' ), wp_get_referer() ) : wc_get_cart_url();
  518. wp_safe_redirect( $referer );
  519. exit;
  520. }
  521. // Update Cart - checks apply_coupon too because they are in the same form.
  522. if ( ( ! empty( $_POST['apply_coupon'] ) || ! empty( $_POST['update_cart'] ) || ! empty( $_POST['proceed'] ) ) && wp_verify_nonce( $nonce_value, 'woocommerce-cart' ) ) {
  523. $cart_updated = false;
  524. $cart_totals = isset( $_POST['cart'] ) ? wp_unslash( $_POST['cart'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  525. if ( ! WC()->cart->is_empty() && is_array( $cart_totals ) ) {
  526. foreach ( WC()->cart->get_cart() as $cart_item_key => $values ) {
  527. $_product = $values['data'];
  528. // Skip product if no updated quantity was posted.
  529. if ( ! isset( $cart_totals[ $cart_item_key ] ) || ! isset( $cart_totals[ $cart_item_key ]['qty'] ) ) {
  530. continue;
  531. }
  532. // Sanitize.
  533. $quantity = apply_filters( 'woocommerce_stock_amount_cart_item', wc_stock_amount( preg_replace( '/[^0-9\.]/', '', $cart_totals[ $cart_item_key ]['qty'] ) ), $cart_item_key );
  534. if ( '' === $quantity || $quantity === $values['quantity'] ) {
  535. continue;
  536. }
  537. // Update cart validation.
  538. $passed_validation = apply_filters( 'woocommerce_update_cart_validation', true, $cart_item_key, $values, $quantity );
  539. // is_sold_individually.
  540. if ( $_product->is_sold_individually() && $quantity > 1 ) {
  541. /* Translators: %s Product title. */
  542. wc_add_notice( sprintf( __( 'You can only have 1 %s in your cart.', 'woocommerce' ), $_product->get_name() ), 'error' );
  543. $passed_validation = false;
  544. }
  545. if ( $passed_validation ) {
  546. WC()->cart->set_quantity( $cart_item_key, $quantity, false );
  547. $cart_updated = true;
  548. }
  549. }
  550. }
  551. // Trigger action - let 3rd parties update the cart if they need to and update the $cart_updated variable.
  552. $cart_updated = apply_filters( 'woocommerce_update_cart_action_cart_updated', $cart_updated );
  553. if ( $cart_updated ) {
  554. WC()->cart->calculate_totals();
  555. }
  556. if ( ! empty( $_POST['proceed'] ) ) {
  557. wp_safe_redirect( wc_get_checkout_url() );
  558. exit;
  559. } elseif ( $cart_updated ) {
  560. wc_add_notice( __( 'Cart updated.', 'woocommerce' ), apply_filters( 'woocommerce_cart_updated_notice_type', 'success' ) );
  561. $referer = remove_query_arg( array( 'remove_coupon', 'add-to-cart' ), ( wp_get_referer() ? wp_get_referer() : wc_get_cart_url() ) );
  562. wp_safe_redirect( $referer );
  563. exit;
  564. }
  565. }
  566. }
  567. /**
  568. * Place a previous order again.
  569. *
  570. * @deprecated 3.5.0 Logic moved to cart session handling.
  571. */
  572. public static function order_again() {
  573. wc_deprecated_function( 'WC_Form_Handler::order_again', '3.5', 'This method should not be called manually.' );
  574. }
  575. /**
  576. * Cancel a pending order.
  577. */
  578. public static function cancel_order() {
  579. if (
  580. isset( $_GET['cancel_order'] ) &&
  581. isset( $_GET['order'] ) &&
  582. isset( $_GET['order_id'] ) &&
  583. ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), 'woocommerce-cancel_order' ) ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  584. ) {
  585. wc_nocache_headers();
  586. $order_key = wp_unslash( $_GET['order'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  587. $order_id = absint( $_GET['order_id'] );
  588. $order = wc_get_order( $order_id );
  589. $user_can_cancel = current_user_can( 'cancel_order', $order_id );
  590. $order_can_cancel = $order->has_status( apply_filters( 'woocommerce_valid_order_statuses_for_cancel', array( 'pending', 'failed' ), $order ) );
  591. $redirect = isset( $_GET['redirect'] ) ? wp_unslash( $_GET['redirect'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  592. if ( $user_can_cancel && $order_can_cancel && $order->get_id() === $order_id && hash_equals( $order->get_order_key(), $order_key ) ) {
  593. // Cancel the order + restore stock.
  594. WC()->session->set( 'order_awaiting_payment', false );
  595. $order->update_status( 'cancelled', __( 'Order cancelled by customer.', 'woocommerce' ) );
  596. wc_add_notice( apply_filters( 'woocommerce_order_cancelled_notice', __( 'Your order was cancelled.', 'woocommerce' ) ), apply_filters( 'woocommerce_order_cancelled_notice_type', 'notice' ) );
  597. do_action( 'woocommerce_cancelled_order', $order->get_id() );
  598. } elseif ( $user_can_cancel && ! $order_can_cancel ) {
  599. wc_add_notice( __( 'Your order can no longer be cancelled. Please contact us if you need assistance.', 'woocommerce' ), 'error' );
  600. } else {
  601. wc_add_notice( __( 'Invalid order.', 'woocommerce' ), 'error' );
  602. }
  603. if ( $redirect ) {
  604. wp_safe_redirect( $redirect );
  605. exit;
  606. }
  607. }
  608. }
  609. /**
  610. * Add to cart action.
  611. *
  612. * Checks for a valid request, does validation (via hooks) and then redirects if valid.
  613. *
  614. * @param bool $url (default: false) URL to redirect to.
  615. */
  616. public static function add_to_cart_action( $url = false ) {
  617. if ( ! isset( $_REQUEST['add-to-cart'] ) || ! is_numeric( wp_unslash( $_REQUEST['add-to-cart'] ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  618. return;
  619. }
  620. wc_nocache_headers();
  621. $product_id = apply_filters( 'woocommerce_add_to_cart_product_id', absint( wp_unslash( $_REQUEST['add-to-cart'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  622. $was_added_to_cart = false;
  623. $adding_to_cart = wc_get_product( $product_id );
  624. if ( ! $adding_to_cart ) {
  625. return;
  626. }
  627. $add_to_cart_handler = apply_filters( 'woocommerce_add_to_cart_handler', $adding_to_cart->get_type(), $adding_to_cart );
  628. if ( 'variable' === $add_to_cart_handler || 'variation' === $add_to_cart_handler ) {
  629. $was_added_to_cart = self::add_to_cart_handler_variable( $product_id );
  630. } elseif ( 'grouped' === $add_to_cart_handler ) {
  631. $was_added_to_cart = self::add_to_cart_handler_grouped( $product_id );
  632. } elseif ( has_action( 'woocommerce_add_to_cart_handler_' . $add_to_cart_handler ) ) {
  633. do_action( 'woocommerce_add_to_cart_handler_' . $add_to_cart_handler, $url ); // Custom handler.
  634. } else {
  635. $was_added_to_cart = self::add_to_cart_handler_simple( $product_id );
  636. }
  637. // If we added the product to the cart we can now optionally do a redirect.
  638. if ( $was_added_to_cart && 0 === wc_notice_count( 'error' ) ) {
  639. $url = apply_filters( 'woocommerce_add_to_cart_redirect', $url, $adding_to_cart );
  640. if ( $url ) {
  641. wp_safe_redirect( $url );
  642. exit;
  643. } elseif ( 'yes' === get_option( 'woocommerce_cart_redirect_after_add' ) ) {
  644. wp_safe_redirect( wc_get_cart_url() );
  645. exit;
  646. }
  647. }
  648. }
  649. /**
  650. * Handle adding simple products to the cart.
  651. *
  652. * @since 2.4.6 Split from add_to_cart_action.
  653. * @param int $product_id Product ID to add to the cart.
  654. * @return bool success or not
  655. */
  656. private static function add_to_cart_handler_simple( $product_id ) {
  657. $quantity = empty( $_REQUEST['quantity'] ) ? 1 : wc_stock_amount( wp_unslash( $_REQUEST['quantity'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  658. $passed_validation = apply_filters( 'woocommerce_add_to_cart_validation', true, $product_id, $quantity );
  659. if ( $passed_validation && false !== WC()->cart->add_to_cart( $product_id, $quantity ) ) {
  660. wc_add_to_cart_message( array( $product_id => $quantity ), true );
  661. return true;
  662. }
  663. return false;
  664. }
  665. /**
  666. * Handle adding grouped products to the cart.
  667. *
  668. * @since 2.4.6 Split from add_to_cart_action.
  669. * @param int $product_id Product ID to add to the cart.
  670. * @return bool success or not
  671. */
  672. private static function add_to_cart_handler_grouped( $product_id ) {
  673. $was_added_to_cart = false;
  674. $added_to_cart = array();
  675. $items = isset( $_REQUEST['quantity'] ) && is_array( $_REQUEST['quantity'] ) ? wp_unslash( $_REQUEST['quantity'] ) : array(); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  676. if ( ! empty( $items ) ) {
  677. $quantity_set = false;
  678. foreach ( $items as $item => $quantity ) {
  679. $quantity = wc_stock_amount( $quantity );
  680. if ( $quantity <= 0 ) {
  681. continue;
  682. }
  683. $quantity_set = true;
  684. // Add to cart validation.
  685. $passed_validation = apply_filters( 'woocommerce_add_to_cart_validation', true, $item, $quantity );
  686. // Suppress total recalculation until finished.
  687. remove_action( 'woocommerce_add_to_cart', array( WC()->cart, 'calculate_totals' ), 20, 0 );
  688. if ( $passed_validation && false !== WC()->cart->add_to_cart( $item, $quantity ) ) {
  689. $was_added_to_cart = true;
  690. $added_to_cart[ $item ] = $quantity;
  691. }
  692. add_action( 'woocommerce_add_to_cart', array( WC()->cart, 'calculate_totals' ), 20, 0 );
  693. }
  694. if ( ! $was_added_to_cart && ! $quantity_set ) {
  695. wc_add_notice( __( 'Please choose the quantity of items you wish to add to your cart&hellip;', 'woocommerce' ), 'error' );
  696. } elseif ( $was_added_to_cart ) {
  697. wc_add_to_cart_message( $added_to_cart );
  698. WC()->cart->calculate_totals();
  699. return true;
  700. }
  701. } elseif ( $product_id ) {
  702. /* Link on product archives */
  703. wc_add_notice( __( 'Please choose a product to add to your cart&hellip;', 'woocommerce' ), 'error' );
  704. }
  705. return false;
  706. }
  707. /**
  708. * Handle adding variable products to the cart.
  709. *
  710. * @since 2.4.6 Split from add_to_cart_action.
  711. * @throws Exception If add to cart fails.
  712. * @param int $product_id Product ID to add to the cart.
  713. * @return bool success or not
  714. */
  715. private static function add_to_cart_handler_variable( $product_id ) {
  716. $variation_id = empty( $_REQUEST['variation_id'] ) ? '' : absint( wp_unslash( $_REQUEST['variation_id'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  717. $quantity = empty( $_REQUEST['quantity'] ) ? 1 : wc_stock_amount( wp_unslash( $_REQUEST['quantity'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  718. $variations = array();
  719. $product = wc_get_product( $product_id );
  720. foreach ( $_REQUEST as $key => $value ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
  721. if ( 'attribute_' !== substr( $key, 0, 10 ) ) {
  722. continue;
  723. }
  724. $variations[ sanitize_title( wp_unslash( $key ) ) ] = wp_unslash( $value );
  725. }
  726. $passed_validation = apply_filters( 'woocommerce_add_to_cart_validation', true, $product_id, $quantity, $variation_id, $variations );
  727. if ( ! $passed_validation ) {
  728. return false;
  729. }
  730. // Prevent parent variable product from being added to cart.
  731. if ( empty( $variation_id ) && $product && $product->is_type( 'variable' ) ) {
  732. /* translators: 1: product link, 2: product name */
  733. wc_add_notice( sprintf( __( 'Please choose product options by visiting <a href="%1$s" title="%2$s">%2$s</a>.', 'woocommerce' ), esc_url( get_permalink( $product_id ) ), esc_html( $product->get_name() ) ), 'error' );
  734. return false;
  735. }
  736. if ( false !== WC()->cart->add_to_cart( $product_id, $quantity, $variation_id, $variations ) ) {
  737. wc_add_to_cart_message( array( $product_id => $quantity ), true );
  738. return true;
  739. }
  740. return false;
  741. }
  742. /**
  743. * Process the login form.
  744. *
  745. * @throws Exception On login error.
  746. */
  747. public static function process_login() {
  748. // The global form-login.php template used `_wpnonce` in template versions < 3.3.0.
  749. $nonce_value = wc_get_var( $_REQUEST['woocommerce-login-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  750. if ( isset( $_POST['login'], $_POST['username'], $_POST['password'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-login' ) ) {
  751. try {
  752. $creds = array(
  753. 'user_login' => trim( wp_unslash( $_POST['username'] ) ), // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  754. 'user_password' => $_POST['password'], // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  755. 'remember' => isset( $_POST['rememberme'] ), // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  756. );
  757. $validation_error = new WP_Error();
  758. $validation_error = apply_filters( 'woocommerce_process_login_errors', $validation_error, $creds['user_login'], $creds['user_password'] );
  759. if ( $validation_error->get_error_code() ) {
  760. throw new Exception( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . $validation_error->get_error_message() );
  761. }
  762. if ( empty( $creds['user_login'] ) ) {
  763. throw new Exception( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . __( 'Username is required.', 'woocommerce' ) );
  764. }
  765. // On multisite, ensure user exists on current site, if not add them before allowing login.
  766. if ( is_multisite() ) {
  767. $user_data = get_user_by( is_email( $creds['user_login'] ) ? 'email' : 'login', $creds['user_login'] );
  768. if ( $user_data && ! is_user_member_of_blog( $user_data->ID, get_current_blog_id() ) ) {
  769. add_user_to_blog( get_current_blog_id(), $user_data->ID, 'customer' );
  770. }
  771. }
  772. // Perform the login.
  773. $user = wp_signon( apply_filters( 'woocommerce_login_credentials', $creds ), is_ssl() );
  774. if ( is_wp_error( $user ) ) {
  775. throw new Exception( $user->get_error_message() );
  776. } else {
  777. if ( ! empty( $_POST['redirect'] ) ) {
  778. $redirect = wp_unslash( $_POST['redirect'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  779. } elseif ( wc_get_raw_referer() ) {
  780. $redirect = wc_get_raw_referer();
  781. } else {
  782. $redirect = wc_get_page_permalink( 'myaccount' );
  783. }
  784. wp_redirect( wp_validate_redirect( apply_filters( 'woocommerce_login_redirect', remove_query_arg( 'wc_error', $redirect ), $user ), wc_get_page_permalink( 'myaccount' ) ) ); // phpcs:ignore
  785. exit;
  786. }
  787. } catch ( Exception $e ) {
  788. wc_add_notice( apply_filters( 'login_errors', $e->getMessage() ), 'error' );
  789. do_action( 'woocommerce_login_failed' );
  790. }
  791. }
  792. }
  793. /**
  794. * Handle lost password form.
  795. */
  796. public static function process_lost_password() {
  797. if ( isset( $_POST['wc_reset_password'], $_POST['user_login'] ) ) {
  798. $nonce_value = wc_get_var( $_REQUEST['woocommerce-lost-password-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  799. if ( ! wp_verify_nonce( $nonce_value, 'lost_password' ) ) {
  800. return;
  801. }
  802. $success = WC_Shortcode_My_Account::retrieve_password();
  803. // If successful, redirect to my account with query arg set.
  804. if ( $success ) {
  805. wp_safe_redirect( add_query_arg( 'reset-link-sent', 'true', wc_get_account_endpoint_url( 'lost-password' ) ) );
  806. exit;
  807. }
  808. }
  809. }
  810. /**
  811. * Handle reset password form.
  812. */
  813. public static function process_reset_password() {
  814. $nonce_value = wc_get_var( $_REQUEST['woocommerce-reset-password-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
  815. if ( ! wp_verify_nonce( $nonce_value, 'reset_password' ) ) {
  816. return;
  817. }
  818. $posted_fields = array( 'wc_reset_password', 'password_1', 'password_2', 'reset_key', 'reset_login' );
  819. foreach ( $posted_fields as $field ) {
  820. if ( ! isset( $_POST[ $field ] ) ) {
  821. return;
  822. }
  823. if ( in_array( $field, array( 'password_1', 'password_2' ), true ) ) {
  824. // Don't unslash password fields
  825. // @see https://github.com/woocommerce/woocommerce/issues/23922.
  826. $posted_fields[ $field ] = $_POST[ $field ]; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  827. } else {
  828. $posted_fields[ $field ] = wp_unslash( $_POST[ $field ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  829. }
  830. }
  831. $user = WC_Shortcode_My_Account::check_password_reset_key( $posted_fields['reset_key'], $posted_fields['reset_login'] );
  832. if ( $user instanceof WP_User ) {
  833. if ( empty( $posted_fields['password_1'] ) ) {
  834. wc_add_notice( __( 'Please enter your password.', 'woocommerce' ), 'error' );
  835. }
  836. if ( $posted_fields['password_1'] !== $posted_fields['password_2'] ) {
  837. wc_add_notice( __( 'Passwords do not match.', 'woocommerce' ), 'error' );
  838. }
  839. $errors = new WP_Error();
  840. do_action( 'validate_password_reset', $errors, $user );
  841. wc_add_wp_error_notices( $errors );
  842. if ( 0 === wc_notice_count( 'error' ) ) {
  843. WC_Shortcode_My_Account::reset_password( $user, $posted_fields['password_1'] );
  844. do_action( 'woocommerce_customer_reset_password', $user );
  845. wp_safe_redirect( add_query_arg( 'password-reset', 'true', wc_get_page_permalink( 'myaccount' ) ) );
  846. exit;
  847. }
  848. }
  849. }
  850. /**
  851. * Process the registration form.
  852. *
  853. * @throws Exception On registration error.
  854. */
  855. public static function process_registration() {
  856. $nonce_value = isset( $_POST['_wpnonce'] ) ? wp_unslash( $_POST['_wpnonce'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  857. $nonce_value = isset( $_POST['woocommerce-register-nonce'] ) ? wp_unslash( $_POST['woocommerce-register-nonce'] ) : $nonce_value; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  858. if ( isset( $_POST['register'], $_POST['email'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-register' ) ) {
  859. $username = 'no' === get_option( 'woocommerce_registration_generate_username' ) && isset( $_POST['username'] ) ? wp_unslash( $_POST['username'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  860. $password = 'no' === get_option( 'woocommerce_registration_generate_password' ) && isset( $_POST['password'] ) ? $_POST['password'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
  861. $email = wp_unslash( $_POST['email'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  862. try {
  863. $validation_error = new WP_Error();
  864. $validation_error = apply_filters( 'woocommerce_process_registration_errors', $validation_error, $username, $password, $email );
  865. $validation_errors = $validation_error->get_error_messages();
  866. if ( 1 === count( $validation_errors ) ) {
  867. throw new Exception( $validation_error->get_error_message() );
  868. } elseif ( $validation_errors ) {
  869. foreach ( $validation_errors as $message ) {
  870. wc_add_notice( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . $message, 'error' );
  871. }
  872. throw new Exception();
  873. }
  874. $new_customer = wc_create_new_customer( sanitize_email( $email ), wc_clean( $username ), $password );
  875. if ( is_wp_error( $new_customer ) ) {
  876. throw new Exception( $new_customer->get_error_message() );
  877. }
  878. if ( 'yes' === get_option( 'woocommerce_registration_generate_password' ) ) {
  879. wc_add_notice( __( 'Your account was created successfully and a password has been sent to your email address.', 'woocommerce' ) );
  880. } else {
  881. wc_add_notice( __( 'Your account was created successfully. Your login details have been sent to your email address.', 'woocommerce' ) );
  882. }
  883. // Only redirect after a forced login - otherwise output a success notice.
  884. if ( apply_filters( 'woocommerce_registration_auth_new_customer', true, $new_customer ) ) {
  885. wc_set_customer_auth_cookie( $new_customer );
  886. if ( ! empty( $_POST['redirect'] ) ) {
  887. $redirect = wp_sanitize_redirect( wp_unslash( $_POST['redirect'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
  888. } elseif ( wc_get_raw_referer() ) {
  889. $redirect = wc_get_raw_referer();
  890. } else {
  891. $redirect = wc_get_page_permalink( 'myaccount' );
  892. }
  893. wp_redirect( wp_validate_redirect( apply_filters( 'woocommerce_registration_redirect', $redirect ), wc_get_page_permalink( 'myaccount' ) ) ); //phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
  894. exit;
  895. }
  896. } catch ( Exception $e ) {
  897. if ( $e->getMessage() ) {
  898. wc_add_notice( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . $e->getMessage(), 'error' );
  899. }
  900. }
  901. }
  902. }
  903. }
  904. WC_Form_Handler::init();