Skip to content

Commit a0ae44e

Browse files
krugazulkrugazul
committed
Adding int he WPCS fixes
1 parent 6c87fd6 commit a0ae44e

File tree

6 files changed

+32
-24
lines changed

6 files changed

+32
-24
lines changed

‎includes/classes/class-confirm-payment.php‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ protected function setup_data( $payment ) {
102102
* Confirm Payment Functionality.
103103
*/
104104
public function confirm_payment() {
105-
if ( trim( $_POST['code'] ) === '' ) {
105+
if ( ! isset( $_POST['code'] ) || '' === trim( wp_unslash( $_POST['code'] ) ) ) {
106106
$response = array(
107107
'error' => true,
108108
'error_message' => __( 'Did you make a payment?', 'pff-paystack' ),
@@ -117,7 +117,7 @@ public function confirm_payment() {
117117
}
118118

119119
$this->helpers = new Helpers();
120-
$code = sanitize_text_field( $_POST['code'] );
120+
$code = sanitize_text_field( wp_unslash( $_POST['code'] ) );
121121
$record = $this->helpers->get_db_record( $code, $this->txn_column );
122122

123123
if ( false !== $record ) {
@@ -198,10 +198,13 @@ public function confirm_payment() {
198198
*/
199199
protected function update_sold_inventory() {
200200
$usequantity = $this->meta['usequantity'];
201-
$sold = $this->meta['sold'];
201+
$sold = (int) $this->meta['sold'];
202202

203203
if ( 'yes' === $usequantity ) {
204-
$quantity = $_POST['quantity'];
204+
$quantity = 1;
205+
if ( isset( $_POST['quantity'] ) ) {
206+
$quantity = (int) sanitize_text_field( wp_unslash( $_POST['quantity'] ) );
207+
}
205208
$sold = $this->meta['sold'];
206209

207210
if ( '' === $sold ) {
@@ -298,7 +301,7 @@ protected function update_payment_dates( $data ) {
298301
protected function maybe_create_subscription() {
299302
// Create a "subscription" and attach it to the current plan code.
300303
if ( 1 == $this->meta['startdate_enabled'] && ! empty( $this->meta['startdate_days'] ) && ! empty( $this->meta['startdate_plan_code'] ) ) {
301-
$start_date = date( 'c', strtotime( '+' . $this->meta['startdate_days'] . ' days' ) );
304+
$start_date = gmdate( 'c', strtotime( '+' . $this->meta['startdate_days'] . ' days' ) );
302305
$body = array(
303306
'start_date' => $start_date,
304307
'plan' => $this->meta['startdate_plan_code'],

‎includes/classes/class-email-receipt-owner.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ public function get_html_body() {
164164
<tr>
165165
<td class="column_cell font_default" align="center" valign="top" style="padding:16px 16px 0;font-family:Helvetica,Arial,sans-serif;font-size:15px;text-align:center;vertical-align:top;color:#888">
166166
<small style="font-size:86%;font-weight:normal"><strong><?php echo esc_html__( 'Notice', 'pff-paystack' ); ?></strong><br>
167-
<?php echo esc_html__( 'You\'re getting this email because someone made a payment of', 'pff-paystack' ); ?> <?php $this->currency . ' ' . number_format($this->amount); ?> <?php echo esc_html__( 'to', 'pff-paystack' ); ?> <a href="<?php echo get_bloginfo( 'url' ) ?>" style="display:inline-block;text-decoration:none;font-family:Helvetica,Arial,sans-serif;color:#2f68b4"><?php echo esc_html( get_option( 'blogname' ) ); ?></a>.</small>
167+
<?php echo esc_html__( 'You\'re getting this email because someone made a payment of', 'pff-paystack' ); ?> <?php echo esc_html( $this->currency . ' ' . number_format( $this->amount ) ); ?> <?php echo esc_html__( 'to', 'pff-paystack' ); ?> <a href="<?php echo esc_html( get_bloginfo( 'url' ) ); ?>" style="display:inline-block;text-decoration:none;font-family:Helvetica,Arial,sans-serif;color:#2f68b4"><?php echo esc_html( get_option( 'blogname' ) ); ?></a>.</small>
168168
</td>
169169
</tr>
170170
</tbody>

‎includes/classes/class-form-shortcode.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,8 @@ public function form_shortcode( $atts ) {
188188
* @return void
189189
*/
190190
public function get_code() {
191+
// We ignore this as we are not performing any update action with the data
192+
// phpcs:ignore WordPress.Security.NonceVerification
191193
$code = isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : '';
192194
return $code;
193195
}
@@ -268,7 +270,9 @@ public function get_hidden_fields() {
268270
<input type="hidden" name="pf-id" value="' . esc_attr( $this->form->ID ) . '" />
269271
<input type="hidden" name="pf-user_id" value="' . esc_attr( $this->user['id'] ) . '" />
270272
<input type="hidden" name="pf-recur" value="' . esc_attr( $this->meta['recur'] ) . '" />
271-
<input type="hidden" name="pf-currency" id="pf-currency" value="' . $this->meta['currency'] . '" />';
273+
<input type="hidden" name="pf-currency" id="pf-currency" value="' . $this->meta['currency'] . '" />' .
274+
wp_nonce_field( 'pff-paystack-invoice', 'pf-nonce', true, false );
275+
;
272276
return $html;
273277
}
274278

‎includes/classes/class-form-submit.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -98,15 +98,15 @@ protected function valid_submission() {
9898
/**
9999
* TODO - Needs better security checks - NONCE
100100
*/
101-
if ( ! isset( $_POST['pf-id'] ) || '' == trim( sanitize_text_field( $_POST['pf-id'] ) ) ) {
101+
if ( ! isset( $_POST['pf-id'] ) || '' == trim( sanitize_text_field( wp_unslash( $_POST['pf-id'] ) ) ) ) {
102102
$this->response['result'] = 'failed';
103103
$this->response['message'] = 'A form ID is required';
104104
return false;
105105
} else {
106-
$this->form_id = sanitize_text_field( $_POST['pf-id'] );
106+
$this->form_id = sanitize_text_field( wp_unslash( $_POST['pf-id'] ) );
107107
}
108108

109-
if ( '' == trim( sanitize_text_field( $_POST['pf-pemail'] ) ) ) {
109+
if ( ! isset( $_POST['pf-pemail'] ) || '' == trim( sanitize_text_field( wp_unslash( $_POST['pf-pemail'] ) ) ) ) {
110110
$this->response['result'] = 'failed';
111111
$this->response['message'] = 'Email is required';
112112
return false;
@@ -143,7 +143,7 @@ protected function setup_data() {
143143

144144
if ( isset( $_SERVER['HTTP_REFERER'] ) ) {
145145
// Get the referer URL
146-
$this->referer_url = sanitize_url( $_SERVER['HTTP_REFERER'] );
146+
$this->referer_url = sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) );
147147
}
148148
}
149149

@@ -314,7 +314,7 @@ public function submit_action() {
314314
$exist = $wpdb->get_results(
315315
$wpdb->prepare(
316316
"SELECT *
317-
FROM {$table}
317+
FROM %i
318318
WHERE post_id = %s
319319
AND email = %s
320320
AND user_id = %s
@@ -323,6 +323,7 @@ public function submit_action() {
323323
AND ip = %s
324324
AND paid = '0'
325325
AND metadata = %s",
326+
$table,
326327
$insert['post_id'],
327328
$insert['email'],
328329
$insert['user_id'],

‎includes/classes/class-retry-submit.php‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,7 @@ public function __construct() {
7373
*/
7474
protected function setup_data() {
7575
$this->helpers = new Helpers();
76-
$this->code = sanitize_text_field( $_POST['code'] );
7776
$this->new_code = $this->generate_code() . '_2';
78-
7977
$retry_record = $this->helpers->get_db_record( $this->code );
8078
if ( false !== $retry_record ) {
8179
$this->retry_meta = $retry_record;
@@ -90,12 +88,13 @@ protected function setup_data() {
9088
* @return void
9189
*/
9290
public function retry_action() {
93-
if ( '' === trim( $_POST['code'] ) ) {
91+
if ( isset( $_POST['code'] ) && '' !== trim( wp_unslash( $_POST['code'] ) ) ) {
92+
$this->code = sanitize_text_field( wp_unslash( $_POST['code'] ) );
93+
} else {
9494
$response = array(
9595
'result' => 'failed',
9696
'message' => __( 'Code is required', 'pff-paystack' ),
9797
);
98-
9998
// Exit here, for not processing further because of the error.
10099
exit( wp_json_encode( $response ) );
101100
}
@@ -178,14 +177,15 @@ protected function update_retry_code() {
178177
global $wpdb;
179178
$return = false;
180179
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
181-
$sql = $wpdb->prepare(
182-
"UPDATE %i SET txn_code_2 = %s WHERE txn_code = %s",
183-
$table,
184-
$this->new_code,
185-
$this->code
186-
);
187180
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
188-
$return = $wpdb->query( $sql );
181+
$return = $wpdb->query(
182+
$wpdb->prepare(
183+
"UPDATE %i SET txn_code_2 = %s WHERE txn_code = %s",
184+
$table,
185+
$this->new_code,
186+
$this->code
187+
)
188+
);
189189
return $return;
190190
}
191191
}

‎includes/classes/class-setup.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ public function enqueue_scripts() {
137137

138138
wp_enqueue_script( 'blockUI', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/jquery.blockUI.min.js', array( 'jquery', 'jquery-ui-core' ), PFF_PAYSTACK_VERSION, true, true );
139139

140-
wp_register_script( 'Paystack', 'https://js.paystack.co/v1/inline.js', false, '1' );
140+
wp_register_script( 'Paystack', 'https://js.paystack.co/v1/inline.js', false, true );
141141
wp_enqueue_script( 'Paystack' );
142142

143143
wp_enqueue_script( PFF_PLUGIN_NAME . '-public', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/paystack-public.js', array( 'jquery' ), PFF_PAYSTACK_VERSION, true, true);

0 commit comments

Comments
 (0)