<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Integrations\Stripe\Api;

[2] Fix | Delete

[3] Fix | Delete

use Exception;

[4] Fix | Delete

use WPForms\Integrations\Stripe\Api\Webhooks\Exceptions\AmountMismatchException;

[5] Fix | Delete

use WPForms\Vendor\Stripe\Webhook;

[6] Fix | Delete

use RuntimeException;

[7] Fix | Delete

use BadMethodCallException;

[8] Fix | Delete

use WPForms\Vendor\Stripe\Event as StripeEvent;

[9] Fix | Delete

use WPForms\Vendor\Stripe\Exception\SignatureVerificationException;

[10] Fix | Delete

use WPForms\Integrations\Stripe\Helpers;

[11] Fix | Delete

use WPForms\Integrations\Stripe\WebhooksHealthCheck;

[12] Fix | Delete

[13] Fix | Delete

/**

[14] Fix | Delete

* Webhooks Rest Route handler.

[15] Fix | Delete

*

[16] Fix | Delete

* @since 1.8.4

[17] Fix | Delete

*/

[18] Fix | Delete

class WebhookRoute extends Common {

[19] Fix | Delete

[20] Fix | Delete

/**

[21] Fix | Delete

* Event type.

[22] Fix | Delete

*

[23] Fix | Delete

* @since 1.8.4

[24] Fix | Delete

*

[25] Fix | Delete

* @var string

[26] Fix | Delete

*/

[27] Fix | Delete

private $event_type = 'unknown';

[28] Fix | Delete

[29] Fix | Delete

/**

[30] Fix | Delete

* Payload.

[31] Fix | Delete

*

[32] Fix | Delete

* @since 1.8.4

[33] Fix | Delete

*

[34] Fix | Delete

* @var array

[35] Fix | Delete

*/

[36] Fix | Delete

private $payload = [];

[37] Fix | Delete

[38] Fix | Delete

/**

[39] Fix | Delete

* Response.

[40] Fix | Delete

*

[41] Fix | Delete

* @since 1.8.4

[42] Fix | Delete

*

[43] Fix | Delete

* @var string

[44] Fix | Delete

*/

[45] Fix | Delete

private $response = '';

[46] Fix | Delete

[47] Fix | Delete

/**

[48] Fix | Delete

* Response code.

[49] Fix | Delete

*

[50] Fix | Delete

* @since 1.8.4

[51] Fix | Delete

*

[52] Fix | Delete

* @var int

[53] Fix | Delete

*/

[54] Fix | Delete

private $response_code = 200;

[55] Fix | Delete

[56] Fix | Delete

/**

[57] Fix | Delete

* Initialize.

[58] Fix | Delete

*

[59] Fix | Delete

* @since 1.8.4

[60] Fix | Delete

*/

[61] Fix | Delete

public function init() {

[62] Fix | Delete

[63] Fix | Delete

$this->hooks();

[64] Fix | Delete

}

[65] Fix | Delete

[66] Fix | Delete

/**

[67] Fix | Delete

* Register hooks.

[68] Fix | Delete

*

[69] Fix | Delete

* @since 1.8.4

[70] Fix | Delete

*/

[71] Fix | Delete

private function hooks() {

[72] Fix | Delete

[73] Fix | Delete

if ( $this->is_rest_verification() ) {

[74] Fix | Delete

add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );

[75] Fix | Delete

[76] Fix | Delete

return;

[77] Fix | Delete

}

[78] Fix | Delete

[79] Fix | Delete

// Do not serve regular page when it seems Stripe Webhooks are still sending requests to disabled CURL endpoint.

[80] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[81] Fix | Delete

if ( isset( $_GET[ Helpers::get_webhook_endpoint_data()['fallback'] ] )

[82] Fix | Delete

&& (

[83] Fix | Delete

! Helpers::is_webhook_enabled()

[84] Fix | Delete

|| Helpers::is_rest_api_set()

[85] Fix | Delete

) ) {

[86] Fix | Delete

add_action( 'wp', [ $this, 'dispatch_with_error_500' ] );

[87] Fix | Delete

[88] Fix | Delete

return;

[89] Fix | Delete

}

[90] Fix | Delete

[91] Fix | Delete

if ( ! Helpers::is_webhook_enabled() || ! Helpers::is_webhook_configured() ) {

[92] Fix | Delete

return;

[93] Fix | Delete

}

[94] Fix | Delete

[95] Fix | Delete

if ( Helpers::is_rest_api_set() ) {

[96] Fix | Delete

add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );

[97] Fix | Delete

} else {

[98] Fix | Delete

add_action( 'wp', [ $this, 'dispatch_with_url_param' ] );

[99] Fix | Delete

}

[100] Fix | Delete

}

[101] Fix | Delete

[102] Fix | Delete

/**

[103] Fix | Delete

* Register webhook REST route.

[104] Fix | Delete

*

[105] Fix | Delete

* @since 1.8.4

[106] Fix | Delete

*/

[107] Fix | Delete

public function register_rest_routes() {

[108] Fix | Delete

[109] Fix | Delete

$methods = [ 'POST' ];

[110] Fix | Delete

[111] Fix | Delete

if ( $this->is_rest_verification() ) {

[112] Fix | Delete

$methods[] = 'GET';

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

register_rest_route(

[116] Fix | Delete

Helpers::get_webhook_endpoint_data()['namespace'],

[117] Fix | Delete

'/' . Helpers::get_webhook_endpoint_data()['route'],

[118] Fix | Delete

[

[119] Fix | Delete

'methods' => $methods,

[120] Fix | Delete

'callback' => [ $this, 'dispatch_stripe_webhooks_payload' ],

[121] Fix | Delete

'show_in_index' => false,

[122] Fix | Delete

'permission_callback' => '__return_true',

[123] Fix | Delete

]

[124] Fix | Delete

);

[125] Fix | Delete

}

[126] Fix | Delete

[127] Fix | Delete

/**

[128] Fix | Delete

* Dispatch Stripe webhooks payload for the url param.

[129] Fix | Delete

*

[130] Fix | Delete

* @since 1.8.4

[131] Fix | Delete

*/

[132] Fix | Delete

public function dispatch_with_url_param() {

[133] Fix | Delete

[134] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[135] Fix | Delete

if ( ! isset( $_GET[ Helpers::get_webhook_endpoint_data()['fallback'] ] ) ) {

[136] Fix | Delete

return;

[137] Fix | Delete

}

[138] Fix | Delete

[139] Fix | Delete

$this->dispatch_stripe_webhooks_payload();

[140] Fix | Delete

}

[141] Fix | Delete

[142] Fix | Delete

/**

[143] Fix | Delete

* Dispatch Stripe webhooks payload for the url param with error 500.

[144] Fix | Delete

*

[145] Fix | Delete

* Runs when url param is not configured or webhooks are not enabled at all.

[146] Fix | Delete

*

[147] Fix | Delete

* @since 1.8.4

[148] Fix | Delete

*/

[149] Fix | Delete

public function dispatch_with_error_500() {

[150] Fix | Delete

[151] Fix | Delete

$this->response = esc_html__( 'It seems to be request to Stripe PHP Listener method handler but the site is not configured to use it.', 'wpforms-lite' );

[152] Fix | Delete

$this->response_code = 500;

[153] Fix | Delete

[154] Fix | Delete

$this->respond();

[155] Fix | Delete

}

[156] Fix | Delete

[157] Fix | Delete

/**

[158] Fix | Delete

* Dispatch Stripe webhooks payload.

[159] Fix | Delete

*

[160] Fix | Delete

* @since 1.8.4

[161] Fix | Delete

*/

[162] Fix | Delete

public function dispatch_stripe_webhooks_payload() {

[163] Fix | Delete

[164] Fix | Delete

if ( $this->is_rest_verification() ) {

[165] Fix | Delete

wp_send_json_success();

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

try {

[169] Fix | Delete

$this->payload = file_get_contents( 'php://input' );

[170] Fix | Delete

$event = Webhook::constructEvent(

[171] Fix | Delete

$this->payload,

[172] Fix | Delete

$this->get_webhook_signature(),

[173] Fix | Delete

$this->get_webhook_signing_secret()

[174] Fix | Delete

);

[175] Fix | Delete

[176] Fix | Delete

// Update webhooks site health status.

[177] Fix | Delete

WebhooksHealthCheck::save_status( WebhooksHealthCheck::ENDPOINT_OPTION, WebhooksHealthCheck::STATUS_OK );

[178] Fix | Delete

WebhooksHealthCheck::save_status( WebhooksHealthCheck::SIGNATURE_OPTION,WebhooksHealthCheck::STATUS_OK );

[179] Fix | Delete

[180] Fix | Delete

$this->event_type = $event->type;

[181] Fix | Delete

$this->response = 'WPForms Stripe: ' . $this->event_type . ' event received.';

[182] Fix | Delete

[183] Fix | Delete

$processed = $this->process_event( $event );

[184] Fix | Delete

[185] Fix | Delete

$this->response_code = $processed ? 200 : 202;

[186] Fix | Delete

[187] Fix | Delete

$this->respond();

[188] Fix | Delete

} catch ( AmountMismatchException $e ) {

[189] Fix | Delete

[190] Fix | Delete

$this->response_code = 202;

[191] Fix | Delete

$this->response = $e->getMessage();

[192] Fix | Delete

[193] Fix | Delete

$this->respond();

[194] Fix | Delete

} catch ( SignatureVerificationException $e ) {

[195] Fix | Delete

[196] Fix | Delete

WebhooksHealthCheck::save_status( WebhooksHealthCheck::SIGNATURE_OPTION, WebhooksHealthCheck::STATUS_ERROR );

[197] Fix | Delete

[198] Fix | Delete

$this->response_code = 500;

[199] Fix | Delete

$this->response = $e->getMessage();

[200] Fix | Delete

[201] Fix | Delete

$this->respond();

[202] Fix | Delete

} catch ( Exception $e ) {

[203] Fix | Delete

$this->handle_exception( $e );

[204] Fix | Delete

[205] Fix | Delete

$this->response = $e->getMessage();

[206] Fix | Delete

$this->response_code = $e instanceof BadMethodCallException ? 501 : 500;

[207] Fix | Delete

[208] Fix | Delete

$this->respond();

[209] Fix | Delete

}

[210] Fix | Delete

}

[211] Fix | Delete

[212] Fix | Delete

/**

[213] Fix | Delete

* Get webhook stripe signature.

[214] Fix | Delete

*

[215] Fix | Delete

* @since 1.8.4

[216] Fix | Delete

*

[217] Fix | Delete

* @throws RuntimeException When Stripe signature is not set.

[218] Fix | Delete

*

[219] Fix | Delete

* @return string

[220] Fix | Delete

*/

[221] Fix | Delete

private function get_webhook_signature() {

[222] Fix | Delete

[223] Fix | Delete

if ( ! isset( $_SERVER['HTTP_STRIPE_SIGNATURE'] ) ) {

[224] Fix | Delete

throw new RuntimeException( 'Stripe signature is not set.' );

[225] Fix | Delete

}

[226] Fix | Delete

[227] Fix | Delete

return $_SERVER['HTTP_STRIPE_SIGNATURE']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

/**

[231] Fix | Delete

* Get webhook signing secret.

[232] Fix | Delete

*

[233] Fix | Delete

* @since 1.8.4

[234] Fix | Delete

*

[235] Fix | Delete

* @throws RuntimeException When webhook signing secret is not set.

[236] Fix | Delete

*

[237] Fix | Delete

* @return string

[238] Fix | Delete

*/

[239] Fix | Delete

private function get_webhook_signing_secret() {

[240] Fix | Delete

[241] Fix | Delete

$secret = wpforms_setting( 'stripe-webhooks-secret-' . Helpers::get_stripe_mode() );

[242] Fix | Delete

[243] Fix | Delete

if ( empty( $secret ) ) {

[244] Fix | Delete

throw new RuntimeException( 'Webhook signing secret is not set.' );

[245] Fix | Delete

}

[246] Fix | Delete

[247] Fix | Delete

return $secret;

[248] Fix | Delete

}

[249] Fix | Delete

[250] Fix | Delete

/**

[251] Fix | Delete

* Process Stripe event.

[252] Fix | Delete

*

[253] Fix | Delete

* @since 1.8.4

[254] Fix | Delete

*

[255] Fix | Delete

* @param StripeEvent $event Stripe event.

[256] Fix | Delete

*

[257] Fix | Delete

* @return bool True if event has handling class, false otherwise.

[258] Fix | Delete

*/

[259] Fix | Delete

private function process_event( StripeEvent $event ) {

[260] Fix | Delete

[261] Fix | Delete

$webhooks = self::get_event_whitelist();

[262] Fix | Delete

[263] Fix | Delete

// Event can't be handled.

[264] Fix | Delete

if ( ! isset( $webhooks[ $event->type ] ) || ! class_exists( $webhooks[ $event->type ] ) ) {

[265] Fix | Delete

return false;

[266] Fix | Delete

}

[267] Fix | Delete

[268] Fix | Delete

$handler = new $webhooks[ $event->type ]();

[269] Fix | Delete

[270] Fix | Delete

$handler->setup( $event );

[271] Fix | Delete

[272] Fix | Delete

return $handler->handle();

[273] Fix | Delete

}

[274] Fix | Delete

[275] Fix | Delete

/**

[276] Fix | Delete

* Get event whitelist.

[277] Fix | Delete

*

[278] Fix | Delete

* @since 1.8.4

[279] Fix | Delete

*

[280] Fix | Delete

* @return array

[281] Fix | Delete

*/

[282] Fix | Delete

private static function get_event_whitelist() {

[283] Fix | Delete

[284] Fix | Delete

return [

[285] Fix | Delete

'charge.refunded' => Webhooks\ChargeRefunded::class,

[286] Fix | Delete

'charge.refund.updated' => Webhooks\ChargeRefundUpdated::class,

[287] Fix | Delete

'invoice.payment_succeeded' => Webhooks\InvoicePaymentSucceeded::class,

[288] Fix | Delete

'invoice.created' => Webhooks\InvoiceCreated::class,

[289] Fix | Delete

'charge.succeeded' => Webhooks\ChargeSucceeded::class,

[290] Fix | Delete

'customer.subscription.created' => Webhooks\CustomerSubscriptionCreated::class,

[291] Fix | Delete

'customer.subscription.updated' => Webhooks\CustomerSubscriptionUpdated::class,

[292] Fix | Delete

'customer.subscription.deleted' => Webhooks\CustomerSubscriptionDeleted::class,

[293] Fix | Delete

];

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

/**

[297] Fix | Delete

* Check if rest verification is requested.

[298] Fix | Delete

*

[299] Fix | Delete

* @since 1.8.4

[300] Fix | Delete

*

[301] Fix | Delete

* @return bool

[302] Fix | Delete

*/

[303] Fix | Delete

private function is_rest_verification() {

[304] Fix | Delete

[305] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Recommended

[306] Fix | Delete

return isset( $_GET['verify'] ) && $_GET['verify'] === '1';

[307] Fix | Delete

}

[308] Fix | Delete

[309] Fix | Delete

/**

[310] Fix | Delete

* Respond to the request.

[311] Fix | Delete

*

[312] Fix | Delete

* @since 1.8.4

[313] Fix | Delete

*/

[314] Fix | Delete

private function respond() {

[315] Fix | Delete

[316] Fix | Delete

$this->log_webhook();

[317] Fix | Delete

[318] Fix | Delete

wp_die( esc_html( $this->response ), '', (int) $this->response_code );

[319] Fix | Delete

}

[320] Fix | Delete

[321] Fix | Delete

/**

[322] Fix | Delete

* Log webhook request.

[323] Fix | Delete

*

[324] Fix | Delete

* @since 1.8.4

[325] Fix | Delete

*/

[326] Fix | Delete

private function log_webhook() {

[327] Fix | Delete

[328] Fix | Delete

// log only if WP_DEBUG_LOG and WPFORMS_WEBHOOKS_DEBUG are set to true.

[329] Fix | Delete

if (

[330] Fix | Delete

! defined( 'WPFORMS_WEBHOOKS_DEBUG' ) ||

[331] Fix | Delete

! WPFORMS_WEBHOOKS_DEBUG ||

[332] Fix | Delete

! defined( 'WP_DEBUG_LOG' ) ||

[333] Fix | Delete

! WP_DEBUG_LOG

[334] Fix | Delete

) {

[335] Fix | Delete

return;

[336] Fix | Delete

}

[337] Fix | Delete

[338] Fix | Delete

// If it is set to explictly display logs on output, return: this would make response to Stripe malformed.

[339] Fix | Delete

if ( defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ) {

[340] Fix | Delete

return;

[341] Fix | Delete

}

[342] Fix | Delete

[343] Fix | Delete

$webhook_log = maybe_serialize(

[344] Fix | Delete

[

[345] Fix | Delete

'event_type' => $this->event_type,

[346] Fix | Delete

'response_code' => $this->response_code,

[347] Fix | Delete

'response' => $this->response,

[348] Fix | Delete

'payload' => $this->payload,

[349] Fix | Delete

]

[350] Fix | Delete

);

[351] Fix | Delete

[352] Fix | Delete

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log

[353] Fix | Delete

error_log( $webhook_log );

[354] Fix | Delete

}

[355] Fix | Delete

[356] Fix | Delete

/**

[357] Fix | Delete

* Get webhooks events list.

[358] Fix | Delete

*

[359] Fix | Delete

* @since 1.8.4

[360] Fix | Delete

*

[361] Fix | Delete

* @return array

[362] Fix | Delete

*/

[363] Fix | Delete

public static function get_webhooks_events_list() {

[364] Fix | Delete

[365] Fix | Delete

return array_keys( self::get_event_whitelist() );

[366] Fix | Delete

}

[367] Fix | Delete

}

[368] Fix | Delete

[369] Fix | Delete