<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Integrations\Square\Api;

[2] Fix | Delete

[3] Fix | Delete

use Exception;

[4] Fix | Delete

use RuntimeException;

[5] Fix | Delete

use BadMethodCallException;

[6] Fix | Delete

use WPForms\Integrations\Square\Helpers;

[7] Fix | Delete

use WPForms\Integrations\Square\WebhooksHealthCheck;

[8] Fix | Delete

[9] Fix | Delete

/**

[10] Fix | Delete

* Webhooks Rest Route handler.

[11] Fix | Delete

*

[12] Fix | Delete

* @since 1.9.5

[13] Fix | Delete

*/

[14] Fix | Delete

class WebhookRoute {

[15] Fix | Delete

[16] Fix | Delete

/**

[17] Fix | Delete

* Event type.

[18] Fix | Delete

*

[19] Fix | Delete

* @since 1.9.5

[20] Fix | Delete

*

[21] Fix | Delete

* @var string

[22] Fix | Delete

*/

[23] Fix | Delete

private $event_type = 'unknown';

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Payload.

[27] Fix | Delete

*

[28] Fix | Delete

* @since 1.9.5

[29] Fix | Delete

*

[30] Fix | Delete

* @var array

[31] Fix | Delete

*/

[32] Fix | Delete

private $payload = [];

[33] Fix | Delete

[34] Fix | Delete

/**

[35] Fix | Delete

* Response.

[36] Fix | Delete

*

[37] Fix | Delete

* @since 1.9.5

[38] Fix | Delete

*

[39] Fix | Delete

* @var string

[40] Fix | Delete

*/

[41] Fix | Delete

private $response = '';

[42] Fix | Delete

[43] Fix | Delete

/**

[44] Fix | Delete

* Response code.

[45] Fix | Delete

*

[46] Fix | Delete

* @since 1.9.5

[47] Fix | Delete

*

[48] Fix | Delete

* @var int

[49] Fix | Delete

*/

[50] Fix | Delete

private $response_code = 200;

[51] Fix | Delete

[52] Fix | Delete

/**

[53] Fix | Delete

* Initialize.

[54] Fix | Delete

*

[55] Fix | Delete

* @since 1.9.5

[56] Fix | Delete

*/

[57] Fix | Delete

public function init() {

[58] Fix | Delete

[59] Fix | Delete

$this->hooks();

[60] Fix | Delete

}

[61] Fix | Delete

[62] Fix | Delete

/**

[63] Fix | Delete

* Register hooks.

[64] Fix | Delete

*

[65] Fix | Delete

* @since 1.9.5

[66] Fix | Delete

*/

[67] Fix | Delete

private function hooks() {

[68] Fix | Delete

[69] Fix | Delete

if ( $this->is_rest_verification() ) {

[70] Fix | Delete

add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );

[71] Fix | Delete

[72] Fix | Delete

return;

[73] Fix | Delete

}

[74] Fix | Delete

[75] Fix | Delete

// Do not serve regular page when it seems Square Webhooks are still sending requests to disabled CURL endpoint.

[76] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Recommended

[77] Fix | Delete

if (

[78] Fix | Delete

isset( $_GET[ Helpers::get_webhook_endpoint_data()['fallback'] ] ) &&

[79] Fix | Delete

( ! Helpers::is_webhook_enabled() || Helpers::is_rest_api_set() )

[80] Fix | Delete

) {

[81] Fix | Delete

add_action( 'wp', [ $this, 'dispatch_with_error_500' ] );

[82] Fix | Delete

[83] Fix | Delete

return;

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

// Check if Square is configured.

[87] Fix | Delete

if ( ! Helpers::is_square_configured() ) {

[88] Fix | Delete

return;

[89] Fix | Delete

}

[90] Fix | Delete

[91] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Recommended

[92] Fix | Delete

if ( ! Helpers::is_webhook_enabled() || ! Helpers::is_webhook_configured() ) {

[93] Fix | Delete

return;

[94] Fix | Delete

}

[95] Fix | Delete

[96] Fix | Delete

if ( Helpers::is_rest_api_set() ) {

[97] Fix | Delete

add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );

[98] Fix | Delete

[99] Fix | Delete

return;

[100] Fix | Delete

}

[101] Fix | Delete

[102] Fix | Delete

add_action( 'wp', [ $this, 'dispatch_with_url_param' ] );

[103] Fix | Delete

}

[104] Fix | Delete

[105] Fix | Delete

/**

[106] Fix | Delete

* Register webhook REST route.

[107] Fix | Delete

*

[108] Fix | Delete

* @since 1.9.5

[109] Fix | Delete

*/

[110] Fix | Delete

public function register_rest_routes() {

[111] Fix | Delete

[112] Fix | Delete

$methods = [ 'POST' ];

[113] Fix | Delete

[114] Fix | Delete

if ( $this->is_rest_verification() ) {

[115] Fix | Delete

$methods[] = 'GET';

[116] Fix | Delete

}

[117] Fix | Delete

[118] Fix | Delete

register_rest_route(

[119] Fix | Delete

Helpers::get_webhook_endpoint_data()['namespace'],

[120] Fix | Delete

'/' . Helpers::get_webhook_endpoint_data()['route'],

[121] Fix | Delete

[

[122] Fix | Delete

'methods' => $methods,

[123] Fix | Delete

'callback' => [ $this, 'dispatch_square_webhooks_payload' ],

[124] Fix | Delete

'show_in_index' => false,

[125] Fix | Delete

'permission_callback' => '__return_true',

[126] Fix | Delete

]

[127] Fix | Delete

);

[128] Fix | Delete

}

[129] Fix | Delete

[130] Fix | Delete

/**

[131] Fix | Delete

* Dispatch Square webhooks payload for the url param.

[132] Fix | Delete

*

[133] Fix | Delete

* @since 1.9.5

[134] Fix | Delete

*/

[135] Fix | Delete

public function dispatch_with_url_param() {

[136] Fix | Delete

[137] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[138] Fix | Delete

if ( ! isset( $_GET[ Helpers::get_webhook_endpoint_data()['fallback'] ] ) ) {

[139] Fix | Delete

return;

[140] Fix | Delete

}

[141] Fix | Delete

[142] Fix | Delete

$this->dispatch_square_webhooks_payload();

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

/**

[146] Fix | Delete

* Dispatch Square webhooks payload for the url param with error 500.

[147] Fix | Delete

*

[148] Fix | Delete

* Runs when url param is not configured or webhooks are not enabled at all.

[149] Fix | Delete

*

[150] Fix | Delete

* @since 1.9.5

[151] Fix | Delete

*/

[152] Fix | Delete

public function dispatch_with_error_500() {

[153] Fix | Delete

[154] Fix | Delete

$this->response = esc_html__( 'It seems to be request to Square PHP Listener method handler but the site is not configured to use it.', 'wpforms-lite' );

[155] Fix | Delete

$this->response_code = 500;

[156] Fix | Delete

[157] Fix | Delete

$this->respond();

[158] Fix | Delete

}

[159] Fix | Delete

[160] Fix | Delete

/**

[161] Fix | Delete

* Dispatch Square webhooks' payload.

[162] Fix | Delete

*

[163] Fix | Delete

* @since 1.9.5

[164] Fix | Delete

*

[165] Fix | Delete

* @throws RuntimeException When Square signature is not set.

[166] Fix | Delete

*/

[167] Fix | Delete

public function dispatch_square_webhooks_payload() {

[168] Fix | Delete

[169] Fix | Delete

if ( $this->is_rest_verification() ) {

[170] Fix | Delete

wp_send_json_success();

[171] Fix | Delete

}

[172] Fix | Delete

[173] Fix | Delete

try {

[174] Fix | Delete

// Get raw payload and signature.

[175] Fix | Delete

$this->payload = file_get_contents( 'php://input' );

[176] Fix | Delete

[177] Fix | Delete

// Construct event.

[178] Fix | Delete

$event = WebhookEvent::construct_event(

[179] Fix | Delete

$this->payload,

[180] Fix | Delete

$this->get_webhook_signature(),

[181] Fix | Delete

$this->get_webhook_signing_secret()

[182] Fix | Delete

);

[183] Fix | Delete

[184] Fix | Delete

$event_whitelist = self::get_webhooks_events_list();

[185] Fix | Delete

[186] Fix | Delete

if ( ! in_array( $event->type, $event_whitelist, true ) ) {

[187] Fix | Delete

throw new RuntimeException( 'Square event type is not whitelisted.' );

[188] Fix | Delete

}

[189] Fix | Delete

[190] Fix | Delete

// Update webhook site health status.

[191] Fix | Delete

WebhooksHealthCheck::save_status( WebhooksHealthCheck::ENDPOINT_OPTION, WebhooksHealthCheck::STATUS_OK );

[192] Fix | Delete

[193] Fix | Delete

$this->event_type = $event->type;

[194] Fix | Delete

$this->response = 'WPForms Square: ' . $this->event_type . ' event received.';

[195] Fix | Delete

[196] Fix | Delete

$processed = $this->process_event( $event );

[197] Fix | Delete

[198] Fix | Delete

$this->response_code = $processed ? 200 : 202;

[199] Fix | Delete

[200] Fix | Delete

$this->respond();

[201] Fix | Delete

} catch ( Exception $e ) {

[202] Fix | Delete

[203] Fix | Delete

$this->response = $e->getMessage();

[204] Fix | Delete

$this->response_code = $e instanceof BadMethodCallException ? 501 : 500;

[205] Fix | Delete

[206] Fix | Delete

$this->respond();

[207] Fix | Delete

}

[208] Fix | Delete

}

[209] Fix | Delete

[210] Fix | Delete

/**

[211] Fix | Delete

* Get webhook signature.

[212] Fix | Delete

*

[213] Fix | Delete

* @since 1.9.5

[214] Fix | Delete

*

[215] Fix | Delete

* @throws RuntimeException When Square signature is not set.

[216] Fix | Delete

*

[217] Fix | Delete

* @return string

[218] Fix | Delete

*/

[219] Fix | Delete

private function get_webhook_signature(): string {

[220] Fix | Delete

[221] Fix | Delete

if ( ! isset( $_SERVER['HTTP_X_SQUARE_HMACSHA256_SIGNATURE'] ) ) {

[222] Fix | Delete

throw new RuntimeException( 'Square signature is not set.' );

[223] Fix | Delete

}

[224] Fix | Delete

[225] Fix | Delete

return sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_SQUARE_HMACSHA256_SIGNATURE'] ) );

[226] Fix | Delete

}

[227] Fix | Delete

[228] Fix | Delete

/**

[229] Fix | Delete

* Get webhook signing secret.

[230] Fix | Delete

*

[231] Fix | Delete

* @since 1.9.5

[232] Fix | Delete

*

[233] Fix | Delete

* @throws RuntimeException When webhook signing secret is not set.

[234] Fix | Delete

*

[235] Fix | Delete

* @return string

[236] Fix | Delete

*/

[237] Fix | Delete

private function get_webhook_signing_secret(): string {

[238] Fix | Delete

[239] Fix | Delete

$secret = wpforms_setting( 'square-webhooks-secret-' . Helpers::get_mode() );

[240] Fix | Delete

[241] Fix | Delete

if ( empty( $secret ) ) {

[242] Fix | Delete

throw new RuntimeException( 'Webhook signing secret is not set.' );

[243] Fix | Delete

}

[244] Fix | Delete

[245] Fix | Delete

return $secret;

[246] Fix | Delete

}

[247] Fix | Delete

[248] Fix | Delete

/**

[249] Fix | Delete

* Process Square event.

[250] Fix | Delete

*

[251] Fix | Delete

* @since 1.9.5

[252] Fix | Delete

*

[253] Fix | Delete

* @param object $event Square event.

[254] Fix | Delete

*

[255] Fix | Delete

* @return bool True if event has handling class, false otherwise.

[256] Fix | Delete

*/

[257] Fix | Delete

private function process_event( $event ): bool {

[258] Fix | Delete

[259] Fix | Delete

$webhooks = self::get_event_whitelist();

[260] Fix | Delete

[261] Fix | Delete

// Event can't be handled.

[262] Fix | Delete

if ( ! isset( $webhooks[ $event->type ] ) || ! class_exists( $webhooks[ $event->type ] ) ) {

[263] Fix | Delete

return false;

[264] Fix | Delete

}

[265] Fix | Delete

[266] Fix | Delete

$handler = new $webhooks[ $event->type ]();

[267] Fix | Delete

[268] Fix | Delete

$handler->setup( $event );

[269] Fix | Delete

[270] Fix | Delete

return $handler->handle();

[271] Fix | Delete

}

[272] Fix | Delete

[273] Fix | Delete

/**

[274] Fix | Delete

* Get event allowlist.

[275] Fix | Delete

*

[276] Fix | Delete

* @since 1.9.5

[277] Fix | Delete

*

[278] Fix | Delete

* @return array

[279] Fix | Delete

*/

[280] Fix | Delete

private static function get_event_whitelist(): array {

[281] Fix | Delete

[282] Fix | Delete

return [

[283] Fix | Delete

'refund.updated' => Webhooks\RefundUpdated::class,

[284] Fix | Delete

'payment.updated' => Webhooks\PaymentUpdated::class,

[285] Fix | Delete

'payment.created' => Webhooks\PaymentCreated::class,

[286] Fix | Delete

'subscription.created' => Webhooks\SubscriptionCreated::class,

[287] Fix | Delete

'subscription.updated' => Webhooks\SubscriptionUpdated::class,

[288] Fix | Delete

];

[289] Fix | Delete

}

[290] Fix | Delete

[291] Fix | Delete

/**

[292] Fix | Delete

* Check if rest verification is requested.

[293] Fix | Delete

*

[294] Fix | Delete

* @since 1.9.5

[295] Fix | Delete

*

[296] Fix | Delete

* @return bool

[297] Fix | Delete

*/

[298] Fix | Delete

private function is_rest_verification(): bool {

[299] Fix | Delete

[300] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[301] Fix | Delete

return isset( $_GET['verify'] ) && $_GET['verify'] === '1';

[302] Fix | Delete

}

[303] Fix | Delete

[304] Fix | Delete

/**

[305] Fix | Delete

* Respond to the request.

[306] Fix | Delete

*

[307] Fix | Delete

* @since 1.9.5

[308] Fix | Delete

*/

[309] Fix | Delete

private function respond() {

[310] Fix | Delete

[311] Fix | Delete

$this->log_webhook();

[312] Fix | Delete

[313] Fix | Delete

wp_die( esc_html( $this->response ), '', (int) $this->response_code );

[314] Fix | Delete

}

[315] Fix | Delete

[316] Fix | Delete

/**

[317] Fix | Delete

* Log webhook request.

[318] Fix | Delete

*

[319] Fix | Delete

* @since 1.9.5

[320] Fix | Delete

*/

[321] Fix | Delete

private function log_webhook() {

[322] Fix | Delete

[323] Fix | Delete

// log only if WP_DEBUG_LOG and WPFORMS_WEBHOOKS_DEBUG are set to true.

[324] Fix | Delete

if (

[325] Fix | Delete

! defined( 'WPFORMS_WEBHOOKS_DEBUG' ) ||

[326] Fix | Delete

! WPFORMS_WEBHOOKS_DEBUG ||

[327] Fix | Delete

! defined( 'WP_DEBUG_LOG' ) ||

[328] Fix | Delete

! WP_DEBUG_LOG

[329] Fix | Delete

) {

[330] Fix | Delete

return;

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

// If it is set to explicitly display logs on output, return: this would make response to Square malformed.

[334] Fix | Delete

if ( defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ) {

[335] Fix | Delete

return;

[336] Fix | Delete

}

[337] Fix | Delete

[338] Fix | Delete

$webhook_log = maybe_serialize(

[339] Fix | Delete

[

[340] Fix | Delete

'event_type' => $this->event_type,

[341] Fix | Delete

'response_code' => $this->response_code,

[342] Fix | Delete

'response' => $this->response,

[343] Fix | Delete

'payload' => $this->payload,

[344] Fix | Delete

]

[345] Fix | Delete

);

[346] Fix | Delete

[347] Fix | Delete

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log

[348] Fix | Delete

error_log( $webhook_log );

[349] Fix | Delete

}

[350] Fix | Delete

[351] Fix | Delete

/**

[352] Fix | Delete

* Get a webhook events list.

[353] Fix | Delete

*

[354] Fix | Delete

* @since 1.9.5

[355] Fix | Delete

*

[356] Fix | Delete

* @return array

[357] Fix | Delete

*/

[358] Fix | Delete

public static function get_webhooks_events_list(): array {

[359] Fix | Delete

[360] Fix | Delete

return array_keys( self::get_event_whitelist() );

[361] Fix | Delete

}

[362] Fix | Delete

}

[363] Fix | Delete

[364] Fix | Delete