Fixes raised by Review with Payment from My Account Feature

- Escaping issue raised by WP - Versioning fix raised by WP - CURL issue raised by WP, fixed using wp_remote_post - Payment from my account asked by merchants
bKash-developer · Sep 16, 2021 · 2618e2e · 2618e2e
1 parent 26cf839
commit 2618e2e
Show file tree

Hide file tree

Showing 20 changed files with 284 additions and 181 deletions.
diff --git a/assets/js/checkout.js b/assets/js/checkout.js
@@ -1,17 +1,37 @@
 (function ($) {
     $(function () {
+        let isReviewPage = false;
         var paymentObj = {paymentID: "", orderID: ""};
-        var paymentReq = {amount: '0', intent: 'sale'};
+        var paymentReq = {amount: '0', intent: 'sale', paymentURL: "", body: {}};
 
-        $(document).ready(function(){
+        $(document).ready(function () {
             InitiatebKashPayment();
         });
 
-        $('form.woocommerce-checkout').on('click', "#place_order", function (event) {
-            var payment_method = $('form.checkout').find('input[name^="payment_method"]:checked').val();
+        $('form.woocommerce-checkout, form#order_review').on('click', "#place_order", function (event) {
+            var payment_method = $('form.checkout, form#order_review').find('input[name^="payment_method"]:checked').val();
             if (payment_method === 'bkash_pgw') {
                 event.preventDefault();
 
+                // setting defaults
+                paymentReq.paymentURL = bKash_objects.submit_order;
+                paymentReq.body = $('form.checkout').serialize();
+
+                let referrer = $('form#order_review').find('input[name="_wp_http_referer"]');
+                if (referrer.length > 0) {
+                    let url = referrer.val().match(/^.*\/(\d+)\/.*$/);
+
+                    let order_review_url = url[0];
+                    let order_number = url[1];
+
+                    if (order_number !== undefined) {
+                        // Overriding if order review page
+                        isReviewPage = true;
+                        paymentReq.body = {order_id: order_number};
+                        paymentReq.paymentURL = bKash_objects.review_order_payment;
+                    }
+                }
+
                 if (bKash !== undefined) {
                     var button = document.getElementById("bKash_button");
                     bKash.reconfigure({
@@ -47,14 +67,13 @@
 
                         createRequest: function (request) {
                             blockUI();
-                            var post_data = $('form.checkout').serialize()
-                            post_data['action'] = 'ajax_order';
+                            paymentReq.body['action'] = 'ajax_order';
                             $.ajax({
                                 type: 'POST',
-                                url: bKash_objects.submit_order,
+                                url: paymentReq.paymentURL,
                                 contentType: "application/x-www-form-urlencoded; charset=UTF-8",
                                 enctype: 'multipart/form-data',
-                                data: post_data,
+                                data: paymentReq.body,
                                 success: function (result) {
                                     if (result.result && result.result === 'success') {
                                         paymentObj = result.order;
@@ -126,7 +145,7 @@
             }
             var header = "<h3 style='color: #fff;font-weight: bold;margin: 0;font-size: 20px;line-height: 14px;'>" + msg + "</h3>";
 
-            var checkout_form = $('form.checkout');
+            var checkout_form = $('form.checkout, form#order_review');
             $('.woocommerce-NoticeGroup-checkout, .woocommerce-error, .woocommerce-message').remove();
             if (error_message) {
                 checkout_form.prepend('<div class="woocommerce-' + group + ' woocommerce-NoticeGroup-checkout">' + header + error_message + '</div>'); // eslint-disable-line max-len

diff --git a/assets/js/jquery-3.3.1.min.js b/assets/js/jquery-3.3.1.min.js
diff --git a/includes/classes/Admin/AdminDashboard.php b/includes/classes/Admin/AdminDashboard.php
@@ -7,8 +7,8 @@
 use bKash\PGW\PaymentGatewaybKash;
 use bKash\PGW\TableGeneration;
 
-define( "PGW_VERSION", "1.2.0" );
-define( "TABLE_LIMIT", 10 );
+define( "BK_PGW_VERSION", "1.2.0" );
+define( "BK_TABLE_LIMIT", 10 );
 
 class AdminDashboard {
 	private static $instance;
@@ -289,7 +289,7 @@ public function loadTable( $title, $tbl_name, $columns = array() ) {
 
 		$pagenum = isset( $_GET['pagenum'] ) ? absint( $_GET['pagenum'] ) : 1;
 
-		$limit        = TABLE_LIMIT;
+		$limit        = BK_TABLE_LIMIT;
 		$offset       = ( $pagenum - 1 ) * $limit;
 		$total        = $wpdb->get_var( "select count(*) as total from $table_name" );
 		$num_of_pages = ceil( $total / $limit );
@@ -299,21 +299,21 @@ public function loadTable( $title, $tbl_name, $columns = array() ) {
 
 		?>
         <div class="wrap abs">
-            <h2><?php echo $title; ?></h2>
+            <h2><?php echo esc_html( $title ); ?></h2>
             <div class="tablenav top">
                 <div class="alignleft actions">
                 </div>
                 <br class="clear">
             </div>
 
             <table id="transaction-list-table" class='wp-list-table widefat fixed striped posts'
-                   aria-describedby="<?php echo $title; ?>">
+                   aria-describedby="<?php echo esc_attr( $title ); ?>">
                 <tr>
 					<?php
 					foreach ( array_keys( $columns ) as $table_head ) {
 						?>
                         <th class='manage-column ss-list-width' scope='col'>
-							<?php echo $table_head; ?>
+							<?php echo esc_html( $table_head ); ?>
                         </th>
 						<?php
 					}
@@ -326,7 +326,7 @@ public function loadTable( $title, $tbl_name, $columns = array() ) {
                         <tr>
 							<?php
 							foreach ( $columns as $column ) {
-								echo "<td class='manage-column ss-list-width'>" . $row->{$column} . "</td>";
+								echo "<td class='manage-column ss-list-width'>" . esc_html( $row->{$column} ) . "</td>";
 							}
 							?>
                         </tr>

diff --git a/includes/classes/Admin/pages/agreements_list.php b/includes/classes/Admin/pages/agreements_list.php
@@ -1,9 +1,9 @@
 <?php
 
-$action = $_REQUEST['action'] ?? '';
+$action = sanitize_text_field($_REQUEST['action'] ?? '');
 
 if ($action === 'cancel') {
-    $id = $_REQUEST['id'] ?? null;
+    $id = sanitize_text_field($_REQUEST['id'] ?? null);
     if ($id) {
         $agreementObj = new \bKash\PGW\Models\Agreement();
         $agreement = $agreementObj->getAgreement('','',$id);
@@ -81,13 +81,13 @@
             if ($rowcount > 0) {
                 foreach ($rows as $row) { ?>
                     <tr>
-                        <td class="manage-column ss-list-width"><?php echo $row->ID; ?></td>
-                        <td class="manage-column ss-list-width"><?php echo $row->phone; ?></td>
-                        <td class="manage-column ss-list-width"><?php echo $row->user_id; ?></td>
-                        <td class="manage-column ss-list-width"><?php echo $row->agreement_token; ?></td>
-                        <td class="manage-column ss-list-width"><?php echo $row->datetime; ?></td>
+                        <td class="manage-column ss-list-width"><?php echo esc_html($row->ID); ?></td>
+                        <td class="manage-column ss-list-width"><?php echo esc_html($row->phone); ?></td>
+                        <td class="manage-column ss-list-width"><?php echo esc_html($row->user_id); ?></td>
+                        <td class="manage-column ss-list-width"><?php echo esc_html($row->agreement_token); ?></td>
+                        <td class="manage-column ss-list-width"><?php echo esc_html($row->datetime); ?></td>
                         <td>
-                            <a onclick="return confirm('Are you sure to cancel this?');" href="<?php echo admin_url('admin.php?page=' . $this->slug . '/agreements&action=cancel&id=' . $row->ID); ?>">Cancel
+                            <a onclick="return confirm('Are you sure to cancel this?');" href="<?php echo esc_url(admin_url('admin.php?page=' . $this->slug . '/agreements&action=cancel&id=' . $row->ID)); ?>">Cancel
                                 Agreement</a></td>
 
 

diff --git a/includes/classes/Admin/pages/check_balances.php b/includes/classes/Admin/pages/check_balances.php
@@ -4,7 +4,7 @@
     // FAILED TO GET BALANCES
     ?>
     <div id="message" class="woocommerce-message bKash-hero-div bKash-error-div">
-        <p><?php echo $balances ?? '' ?></p>
+        <p><?php echo esc_html($balances) ?? '' ?></p>
     </div>
     <?php
 

diff --git a/includes/classes/Admin/pages/disburse_money.php b/includes/classes/Admin/pages/disburse_money.php
@@ -3,15 +3,11 @@
         border-left-color: #e23e3e !important;
     }
 </style>
-<h1><?php echo get_admin_page_title(); ?></h1>
+<h1><?php echo esc_html(get_admin_page_title()); ?></h1>
 <br>
 <form action="#" method="post">
 
     <table id="disburse-money-table" aria-describedby="disburse money">
-        <tr>
-            <th scope="col">Field</th>
-            <th scope="col">Value</th>
-        </tr>
         <tr>
             <td>
                 <label for="amount" class="form-label">Amount *</label>
@@ -26,7 +22,7 @@
             </td>
             <td>
                 <input name="receiver" type="tel" id="receiver" placeholder="Mobile number" class="form-text-input"
-                       value="<?php echo $receiver ?? ''; ?>" pattern="^(?:\+88|01)?\d{11}$"/>
+                       value="<?php echo esc_attr($receiver) ?? ''; ?>" pattern="^(?:\+88|01)?\d{11}$"/>
             </td>
         </tr>
         <tr>
@@ -49,7 +45,7 @@
 	// FAILED TO GET BALANCES
 	?>
     <div id="message" class="bKash-hero-div woocommerce-message bKash-error">
-        <p><?php echo $trx ?? '' ?></p>
+        <p><?php echo esc_html($trx) ?? '' ?></p>
     </div>
 	<?php
 

diff --git a/includes/classes/Admin/pages/extra_details.php b/includes/classes/Admin/pages/extra_details.php
@@ -5,21 +5,17 @@
         <p>Thank you for your payment using bKash online payment gateway. Here is your payment details</p>
 
     <table id="extra-detail-table" class="woocommerce-table order_details" aria-describedby="extra details">
-        <tr>
-            <th scope="col">Field</th>
-            <th scope="col">Value</th>
-        </tr>
         <tr>
             <td>Payment Method</td>
             <td>bKash Online payment Gateway</td>
         </tr>
         <tr>
             <td>Transaction ID</td>
-            <td><?php echo $trx->getTrxID() ?? ''; ?></td>
+            <td><?php echo esc_html($trx->getTrxID()) ?? ''; ?></td>
         </tr>
         <tr>
             <td>Payment Status</td>
-            <td><?php echo $trx->getStatus() ?? ''; ?></td>
+            <td><?php echo esc_html($trx->getStatus()) ?? ''; ?></td>
         </tr>
     </table>
 

diff --git a/includes/classes/Admin/pages/refund_transaction.php b/includes/classes/Admin/pages/refund_transaction.php
@@ -3,15 +3,11 @@
         border-left-color: #e23e3e !important;
     }
 </style>
-<h1><?php echo get_admin_page_title(); ?></h1>
+<h1><?php echo esc_html(get_admin_page_title()); ?></h1>
 <br>
 <form action="#" method="post">
 
     <table id="refund-table" aria-describedby="refund table">
-        <tr>
-            <th scope="col">Field</th>
-            <th scope="col">Value</th>
-        </tr>
         <tr>
             <td>
                 <label for="trxid" class="form-label">Transaction ID *</label>
@@ -26,7 +22,7 @@
                     }
                 ?>
                 <input name="trxid" type="text" id="trxid" placeholder="Transaction ID" class="form-text-input"
-                       value="<?php echo $current_trx_id; ?> "/>
+                       value="<?php echo esc_attr($current_trx_id); ?> "/>
             </td>
         </tr>
         <tr>
@@ -35,7 +31,7 @@
             </td>
             <td>
                 <input name="amount" type="text" id="amount" placeholder="Amount" class="form-text-input"
-                       value="<?php echo $amount ?? ''; ?>"/>
+                       value="<?php echo esc_attr($amount) ?? ''; ?>"/>
             </td>
         </tr>
         <tr>
@@ -56,17 +52,13 @@
 <form action="#" method="post">
 
     <table id="refund-status-table" aria-describedby="Refund Status Table">
-        <tr>
-            <th scope="col">Field</th>
-            <th scope="col">Value</th>
-        </tr>
         <tr>
             <td>
                 <label for="trxid" class="form-label">Transaction ID *</label>
             </td>
             <td>
                 <input name="trxid" type="text" id="trxid" placeholder="Transaction ID" class="form-text-input"
-                       value="<?php echo $current_trx_id; ?> "/>
+                       value="<?php echo esc_html($current_trx_id); ?> "/>
             </td>
         </tr>
     </table>
@@ -80,7 +72,7 @@
     // FAILED TO GET BALANCES
     ?>
     <div id="message" class="bKash-hero-div woocommerce-message bKash-error">
-        <p><?php echo $trx ?? '' ?></p>
+        <p><?php echo esc_html($trx) ?? '' ?></p>
     </div>
     <?php
 

diff --git a/includes/classes/Admin/pages/transaction_search.php b/includes/classes/Admin/pages/transaction_search.php
@@ -8,21 +8,21 @@
 <form action="#" method="post">
     <label for="trxid" class="form-label">Transaction ID</label>
     <input name="trxid" type="text" id="trxid" placeholder="Transaction ID" class="form-text-input"
-           value="<?php echo $trx_id ?? ''; ?>">
+           value="<?php echo esc_attr($trx_id) ?? ''; ?>">
 
     <button class="button button-primary" type="submit">Search</button>
 </form>
 <br>
 
 <?php
-define("STRONG_START", "<strong>");
-define("STRONG_END", "</strong>");
+define("BK_STRONG_START", " <strong>");
+define("BK_STRONG_END", "</strong> ");
 
 if (isset($trx) && is_string($trx)) {
     // FAILED TO GET BALANCES
     ?>
     <div id="message" class="bKash-hero-div woocommerce-message bKash-error">
-        <p><?php echo $trx ?? '' ?></p>
+        <p><?php echo esc_html($trx) ?? '' ?></p>
     </div>
     <?php
 
@@ -40,10 +40,10 @@
         <p><?php _e('Amount: <b>' . ($trx['amount'] ?? '') . ' ' . ($trx['currency'] ?? '') . '</b>', 'woocommerce-payment-gateway-bkash'); ?></p>
         <hr>
         <ul>
-            <li><?php echo __('Transaction Type', 'woocommerce-payment-gateway-bkash') . STRONG_START . ($trx['transactionType'] ?? '') . STRONG_END; ?></li>
-            <li><?php echo __('Merchant Account', 'woocommerce-payment-gateway-bkash') . STRONG_START . ($trx['organizationShortCode'] ?? '') . STRONG_END; ?></li>
-            <li><?php echo __('Initiated At', 'woocommerce-payment-gateway-bkash') . STRONG_START . ($trx['initiationTime'] ?? '') . STRONG_END; ?></li>
-            <li><?php echo __('Completed At', 'woocommerce-payment-gateway-bkash') . STRONG_START . ($trx['completedTime'] ?? '') . STRONG_END; ?></li>
+            <li><?php echo __('Transaction Type: ', 'woocommerce-payment-gateway-bkash') . BK_STRONG_START . ($trx['transactionType'] ?? '') . BK_STRONG_END; ?></li>
+            <li><?php echo __('Merchant Account: ', 'woocommerce-payment-gateway-bkash') . BK_STRONG_START . ($trx['organizationShortCode'] ?? '') . BK_STRONG_END; ?></li>
+            <li><?php echo __('Initiated At: ', 'woocommerce-payment-gateway-bkash') . BK_STRONG_START . ($trx['initiationTime'] ?? '') . BK_STRONG_END; ?></li>
+            <li><?php echo __('Completed At: ', 'woocommerce-payment-gateway-bkash') . BK_STRONG_START . ($trx['completedTime'] ?? '') . BK_STRONG_END; ?></li>
         </ul>
         <p>
             <button

diff --git a/includes/classes/Admin/pages/transfer_balance.php b/includes/classes/Admin/pages/transfer_balance.php
@@ -3,22 +3,18 @@
         border-left-color: #e23e3e !important;
     }
 </style>
-<h1><?php echo get_admin_page_title(); ?></h1>
+<h1><?php echo esc_html(get_admin_page_title()); ?></h1>
 <br>
 <form action="#" method="post">
 
     <table id="transfer-balance-table" aria-describedby="transfer balance">
-        <tr>
-            <th scope="col">Field</th>
-            <th scope="col">Value</th>
-        </tr>
         <tr>
             <td>
                 <label for="amount" class="form-label">Amount</label>
             </td>
             <td>
                 <input name="amount" type="text" id="amount" placeholder="Amount" class="form-text-input"
-                       value="<?php echo $amount ?? ''; ?>"/>
+                       value="<?php echo esc_html($amount) ?? ''; ?>"/>
             </td>
         </tr>
         <tr>
@@ -43,7 +39,7 @@
     // FAILED TO GET BALANCES
     ?>
     <div id="message" class="bKash-hero-div woocommerce-message bKash-error">
-        <p><?php echo $trx ?? '' ?></p>
+        <p><?php echo esc_html($trx) ?? '' ?></p>
     </div>
     <?php
 

diff --git a/includes/classes/Admin/views/admin-options.php b/includes/classes/Admin/views/admin-options.php
@@ -21,10 +21,6 @@ class="button"><?php _e('Developer page', 'woocommerce-payment-gateway-bkash');
 </div>
 
 <table class="form-table" id="admin-option-table" aria-describedby="admin option Table">
-    <tr>
-        <th scope="col">Field</th>
-        <th scope="col">Value</th>
-    </tr>
     <?php $this->generate_settings_html(); ?>
     <script type="text/javascript">
         jQuery('#woocommerce_bkash_pgw_sandbox').change(function () {