• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

wp-graphql / wp-graphql-woocommerce / 7304543431

22 Dec 2023 11:06PM UTC coverage: 84.742% (+0.01%) from 84.731%
7304543431

push

github

web-flow
fix: Bug fixed in Product_Connection_Resolver::add_tax_query (#820)

* fix: Bug fixed in Product_Connection_Resolver::add_tax_query

* fix: some product connection resolver hooks restored

14 of 14 new or added lines in 1 file covered. (100.0%)

71 existing lines in 4 files now uncovered.

11047 of 13036 relevant lines covered (84.74%)

58.86 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

39.17
/includes/utils/class-protected-router.php
1
<?php
2
/**
3
 * Sets up the auth endpoint
4
 *
5
 * @package WPGraphQL\WooCommerce\Utils
6
 * @since   0.12.5
7
 */
8

9
namespace WPGraphQL\WooCommerce\Utils;
10

11
use WPGraphQL\WooCommerce\WooCommerce_Filters;
12

13
/**
14
 * Class Protected_Router
15
 */
16
class Protected_Router {
17
        /**
18
         * Stores the instance of the Protected_Router class
19
         *
20
         * @var null|\WPGraphQL\WooCommerce\Utils\Protected_Router
21
         */
22
        private static $instance = null;
23

24
        /**
25
         * The default route
26
         *
27
         * @var string
28
         */
29
        public static $default_route = 'transfer-session';
30

31
        /**
32
         * Sets the route to use as the endpoint
33
         *
34
         * @var string
35
         */
36
        public static $route = null;
37

38
        /**
39
         * Set the default status code to 200.
40
         *
41
         * @var int
42
         */
43
        public static $http_status_code = 200;
44

45
        /**
46
         * Protected_Router constructor
47
         */
48
        private function __construct() {
49
                self::$route = woographql_setting( 'authorizing_url_endpoint', apply_filters( 'woographql_authorizing_url_endpoint', self::$default_route ) );
×
50
                /**
51
                 * Create the rewrite rule for the route
52
                 */
53
                add_action( 'init', [ $this, 'add_rewrite_rule' ], 10 );
×
54

55
                /**
56
                 * Add the query var for the route
57
                 */
58
                add_filter( 'query_vars', [ $this, 'add_query_var' ], 1, 1 );
×
59

60
                /**
61
                 * Redirects the route to the graphql processor
62
                 */
63
                add_action( 'pre_get_posts', [ $this, 'resolve_request' ], 1 );
×
64
        }
65

66
        /**
67
         * Returns the Protected_Router singleton instance.
68
         *
69
         * @return \WPGraphQL\WooCommerce\Utils\Protected_Router
70
         */
71
        public static function instance() {
72
                if ( is_null( self::$instance ) ) {
4✔
73
                        self::$instance = new self();
×
74
                }
75

76
                // Return the Protected_Router Instance.
77
                return self::$instance;
4✔
78
        }
79

80
        /**
81
         * Initializes the Protected_Router singleton.
82
         *
83
         * @return void
84
         */
85
        public static function initialize() {
86
                self::instance();
×
87
        }
88

89
        /**
90
         * Throw error on object clone.
91
         * The whole idea of the singleton design pattern is that there is a single object
92
         * therefore, we don't want the object to be cloned.
93
         *
94
         * @return void
95
         */
96
        public function __clone() {
97
                // Cloning instances of the class is forbidden.
98
                _doing_it_wrong( __FUNCTION__, esc_html__( 'Protected_Router class should not be cloned.', 'wp-graphql-woocommerce' ), esc_html( WPGRAPHQL_WOOCOMMERCE_VERSION ) );
×
99
        }
100

101
        /**
102
         * Disable unserializing of the class.
103
         *
104
         * @return void
105
         */
106
        public function __wakeup() {
107
                // De-serializing instances of the class is forbidden.
108
                _doing_it_wrong( __FUNCTION__, esc_html__( 'De-serializing instances of the Protected_Router class is not allowed', 'wp-graphql-woocommerce' ), esc_html( WPGRAPHQL_WOOCOMMERCE_VERSION ) );
×
109
        }
110

111
        /**
112
         * Adds rewrite rule for the route endpoint
113
         *
114
         * @return void
115
         */
116
        public function add_rewrite_rule() {
117
                add_rewrite_rule(
×
118
                        self::$route . '/?$',
×
119
                        'index.php?' . self::$route . '=true',
×
120
                        'top'
×
121
                );
×
122
        }
123

124
        /**
125
         * Adds the query_var for the route
126
         *
127
         * @param array $query_vars The array of whitelisted query variables.
128
         *
129
         * @return array
130
         */
131
        public function add_query_var( $query_vars ) {
132
                $query_vars[] = self::$route;
1✔
133

134
                return $query_vars;
1✔
135
        }
136

137
        /**
138
         * Returns true when the current request is a request to download the plugin.
139
         *
140
         * @return boolean
141
         */
142
        public static function is_auth_request() {
143
                $is_auth_request = false;
113✔
144
                if ( isset( $_GET[ self::$route ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
113✔
145
                        $is_auth_request = true;
×
146
                } elseif ( isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_URI'] ) ) {
113✔
147
                        // Check the server to determine if the auth endpoint is being requested.
148
                        $host = wp_unslash( $_SERVER['HTTP_HOST'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102✔
149
                        $uri  = wp_unslash( $_SERVER['REQUEST_URI'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102✔
150

151
                        if ( ! is_string( $host ) ) {
102✔
UNCOV
152
                                return false;
×
153
                        }
154

155
                        if ( ! is_string( $uri ) ) {
102✔
UNCOV
156
                                return false;
×
157
                        }
158

159
                        $parsed_site_url    = wp_parse_url( site_url( self::$route ), PHP_URL_PATH );
102✔
160
                        $auth_url           = ! empty( $parsed_site_url ) ? wp_unslash( $parsed_site_url ) : self::$route;
102✔
161
                        $parsed_request_url = wp_parse_url( $uri, PHP_URL_PATH );
102✔
162
                        $request_url        = ! empty( $parsed_request_url ) ? wp_unslash( $parsed_request_url ) : '';
102✔
163

164
                        // Determine if the route is indeed a download request.
165
                        $is_auth_request = false !== strpos( $request_url, $auth_url );
102✔
166
                }//end if
167

168
                /**
169
                 * Filter whether the request is a download request. Default is false.
170
                 *
171
                 * @param boolean $is_download_request Whether the request is a request to download the plugin. Default false.
172
                 */
173
                return apply_filters( 'woographql_is_auth_request', $is_auth_request );
113✔
174
        }
175

176
        /**
177
         * This resolves the http request and ensures that WordPress can respond with the appropriate
178
         * response instead of responding with a template from the standard WordPress Template
179
         * Loading process
180
         *
181
         * @return void
182
         */
183
        public function resolve_request() {
184

185
                /**
186
                 * Access the $wp_query object
187
                 */
188
                global $wp_query;
103✔
189

190
                /**
191
                 * Ensure we're on the registered route for graphql route
192
                 */
193
                if ( ! $this->is_auth_request() ) {
103✔
194
                        return;
103✔
195
                }
196

197
                /**
198
                 * Set is_home to false
199
                 */
UNCOV
200
                $wp_query->is_home = false;
×
201

202
                /**
203
                 * Process the GraphQL query Request
204
                 */
UNCOV
205
                $this->process_auth_request();
×
206
        }
207

208
        /**
209
         * Returns the name of all the valid nonce names.
210
         *
211
         * @return array
212
         */
213
        public static function get_nonce_names() {
214
                $enabled_authorizing_url_fields = WooCommerce_Filters::enabled_authorizing_url_fields();
4✔
215
                if ( empty( $enabled_authorizing_url_fields ) ) {
4✔
UNCOV
216
                        return [];
×
217
                }
218
                $nonce_names = [];
4✔
219
                foreach ( array_keys( $enabled_authorizing_url_fields ) as $field ) {
4✔
220
                        $nonce_names[ $field ] = WooCommerce_Filters::get_authorizing_url_nonce_param_name( $field );
4✔
221
                }
222

223
                return array_filter( $nonce_names );
4✔
224
        }
225

226
        /**
227
         * Returns the nonce action prefix for the provided field.
228
         *
229
         * @param string $field  Field.
230
         * @return string|null
231
         */
232
        public function get_nonce_prefix( $field ) {
233
                switch ( $field ) {
234
                        case 'cart_url':
2✔
235
                                return 'load-cart_';
1✔
236
                        case 'checkout_url':
2✔
237
                                return 'load-checkout_';
1✔
238
                        case 'account_url':
2✔
239
                                return 'load-account_';
1✔
240
                        case 'add_payment_method_url':
2✔
241
                                return 'add-payment-method_';
1✔
242
                        default:
243
                                return apply_filters( 'woographql_auth_nonce_prefix', null, $field, $this );
2✔
244
                }
245
        }
246

247
        /**
248
         * Returns the target endpoint url for the provided field.
249
         *
250
         * @todo Add error logging here when WC Page needs to be created.
251
         *
252
         * @param string $field  Field.
253
         * @return string|null
254
         */
255
        public function get_target_endpoint( $field ) {
256
                switch ( $field ) {
257
                        case 'cart_url':
1✔
258
                                $cart_page_id  = wc_get_page_id( 'cart' );
1✔
259
                                $cart_page_url = get_permalink( $cart_page_id );
1✔
260
                                return $cart_page_url ? $cart_page_url : null;
1✔
261
                        case 'checkout_url':
1✔
262
                                return wc_get_endpoint_url( 'checkout' );
1✔
263
                        case 'account_url':
1✔
264
                                $account_page_id  = get_option( 'woocommerce_myaccount_page_id' );
1✔
265
                                $account_page_url = get_permalink( $account_page_id );
1✔
266
                                return $account_page_url ? $account_page_url : null;
1✔
267
                        case 'add_payment_method_url':
1✔
268
                                return wc_get_account_endpoint_url( 'add-payment-method' );
1✔
269
                        default:
UNCOV
270
                                return apply_filters( 'woographql_auth_target_endpoint', null, $field, $this );
×
271
                }
272
        }
273

274
        /**
275
         * Redirects to homepage.
276
         *
277
         * @return void
278
         */
279
        private function redirect_to_home() {
UNCOV
280
                status_header( 404 );
×
UNCOV
281
                wp_safe_redirect( home_url() );
×
282
                exit;
×
283
        }
284

285
        /**
286
         * Send stable version of plugin to download.
287
         *
288
         * @throws \Exception Session not found.
289
         *
290
         * @return void
291
         */
292
        private function process_auth_request() {
293
                // Bail early if session ID or nonce not found.
UNCOV
294
                $nonce_names = $this->get_nonce_names();
×
UNCOV
295
                if ( empty( $nonce_names ) ) {
×
296
                        $this->redirect_to_home();
×
297
                        return;
×
298
                }
299

300
                /**
301
                 * Nonce prefix
302
                 *
303
                 * @var string $nonce_prefix
304
                 */
UNCOV
305
                $nonce_prefix = null;
×
306

307
                /**
308
                 * Session ID
309
                 *
310
                 * @var string $session_id
311
                 */
UNCOV
312
                $session_id = null;
×
313

314
                /**
315
                 * Nonce
316
                 *
317
                 * @var string $nonce
318
                 */
UNCOV
319
                $nonce = null;
×
320

321
                /**
322
                 * Field
323
                 *
324
                 * @var string $field
325
                 */
UNCOV
326
                $field = null;
×
UNCOV
327
                foreach ( $nonce_names as $possible_field => $nonce_param ) {
×
328
                        if ( in_array( $nonce_param, array_keys( $_REQUEST ), true ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
329
                                $field        = $possible_field;
×
330
                                $nonce_prefix = $this->get_nonce_prefix( $field );
×
331
                                $session_id   = isset( $_REQUEST['session_id'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['session_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
332
                                $nonce        = isset( $_REQUEST[ $nonce_param ] ) ? sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_param ] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
333
                                break;
×
334
                        }
335
                }
336

UNCOV
337
                if ( empty( $field ) || empty( $nonce_prefix ) || empty( $session_id ) || empty( $nonce ) ) {
×
UNCOV
338
                        $this->redirect_to_home();
×
339
                        return;
×
340
                }
341

342
                // Bail early if session user already authenticated.
UNCOV
343
                if ( 0 !== get_current_user_id() && get_current_user_id() === absint( $session_id ) ) {
×
UNCOV
344
                        $redirect_url = $this->get_target_endpoint( (string) $field );
×
345
                        if ( empty( $redirect_url ) ) {
×
346
                                $this->redirect_to_home();
×
347
                                return;
×
348
                        }
349
                        wp_safe_redirect( $redirect_url );
×
UNCOV
350
                        exit;
×
351
                }
352

353
                // Unauthenticate if current user not session user.
UNCOV
354
                if ( 0 !== get_current_user_id() ) {
×
UNCOV
355
                        wp_clear_auth_cookie();
×
356
                        wp_set_current_user( 0 );
×
357
                }
358

359
                // Verify nonce.
UNCOV
360
                if ( null !== $nonce && ! woographql_verify_nonce( $nonce, $nonce_prefix . $session_id ) ) {
×
UNCOV
361
                        $this->redirect_to_home();
×
362
                }
363

UNCOV
364
                do_action( 'woographql_process_auth_request_nonce_verified' );
×
365

366
                // If Session ID is a user ID authenticate as session user.
UNCOV
367
                if ( 0 !== absint( $session_id ) ) {
×
UNCOV
368
                        $user_id = absint( $session_id );
×
369
                        wp_clear_auth_cookie();
×
370
                        wp_set_current_user( $user_id );
×
371
                        wp_set_auth_cookie( $user_id );
×
372
                }
373

374
                /**
375
                 * Session object
376
                 *
377
                 * @var \WPGraphQL\WooCommerce\Utils\Transfer_Session_Handler $session
378
                 */
UNCOV
379
                $session = \WC()->session;
×
380

381
                // Read session data connected to session ID.
UNCOV
382
                $session_data = $session->get_session( $session_id );
×
383

384
                // We were passed a session ID, yet no session was found. Let's log this and bail.
UNCOV
385
                if ( ! is_array( $session_data ) || empty( $session_data ) ) {
×
386
                        // TODO: Switch to WC Notices.
387
                        throw new \Exception( 'Could not locate WooCommerce session on checkout' );
×
388
                }
389

390
                // Reinitialize session and save session cookie before redirect.
UNCOV
391
                $session->init_session_cookie();
×
392

393
                // Set the session variable.
UNCOV
394
                foreach ( $session_data as $key => $value ) {
×
UNCOV
395
                        $session->set( $key, maybe_unserialize( $value ) );
×
396
                }
397
                $session->set_customer_session_cookie( true );
×
398

399
                // After session has been restored on redirect to destination.
UNCOV
400
                $redirect_url = $this->get_target_endpoint( (string) $field );
×
UNCOV
401
                if ( empty( $redirect_url ) ) {
×
402
                        $this->redirect_to_home();
×
403
                        return;
×
404
                }
405
                wp_safe_redirect( $redirect_url );
×
UNCOV
406
                exit;
×
407
        }
408
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc