WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo - Version 4.5.1

Version Description

  • 2022-08-08 =
  • Security update.
Download this release

Release Info

Developer automattic
Plugin Icon 128x128 WooCommerce Payments – Fully Integrated Solution Built and Supported by Woo
Version 4.5.1
Comparing to
See all releases

Code changes from version 4.5.0 to 4.5.1

Files changed (4) hide show
  1. changelog.txt +4 -1
  2. includes/class-wc-payment-gateway-wcpay.php +20 -5
  3. readme.txt +5 -2
  4. woocommerce-payments.php +1 -1
changelog.txt CHANGED
@@ -1,4 +1,7 @@
1
- *** WooCommerce Payments Changelog ***
 
 
 
2
 
3
  = 4.5.0 - 2022-07-27 =
4
  * Add - Add "Things to do" task list to the Payments Overview screen
1
+ *** WooCommerce Payments Changelog ***
2
+
3
+ = 4.5.1 - 2022-08-08 =
4
+ * Security update.
5
 
6
  = 4.5.0 - 2022-07-27 =
7
  * Add - Add "Things to do" task list to the Payments Overview screen
includes/class-wc-payment-gateway-wcpay.php CHANGED
@@ -1088,9 +1088,10 @@ class WC_Payment_Gateway_WCPay extends WC_Payment_Gateway_CC {
1088
  * @param WCPay\Payment_Information $payment_information Payment info.
1089
  * @param array $additional_api_parameters Any additional fields required for payment method to pass to API.
1090
  *
1091
- * @return array|null An array with result of payment and redirect URL, or nothing.
1092
- * @throws API_Exception Error processing the payment.
1093
- * @throws Add_Payment_Method_Exception When $0 order processing failed.
 
1094
  */
1095
  public function process_payment_for_order( $cart, $payment_information, $additional_api_parameters = [] ) {
1096
  $order = $payment_information->get_order();
@@ -1190,10 +1191,24 @@ class WC_Payment_Gateway_WCPay extends WC_Payment_Gateway_CC {
1190
  // phpcs:ignore WordPress.Security.NonceVerification.Missing
1191
  $platform_checkout_intent_id = sanitize_user( wp_unslash( $_POST['platform-checkout-intent'] ?? '' ), true );
1192
 
 
 
 
1193
  if ( ! empty( $platform_checkout_intent_id ) ) {
1194
  // If the intent is included in the request use that intent.
1195
- $intent = $this->payments_api_client->get_intent( $platform_checkout_intent_id );
1196
- } else {
 
 
 
 
 
 
 
 
 
 
 
1197
  // Create intention, try to confirm it & capture the charge (if 3DS is not required).
1198
  $intent = $this->payments_api_client->create_and_confirm_intention(
1199
  $converted_amount,
1088
  * @param WCPay\Payment_Information $payment_information Payment info.
1089
  * @param array $additional_api_parameters Any additional fields required for payment method to pass to API.
1090
  *
1091
+ * @return array|null An array with result of payment and redirect URL, or nothing.
1092
+ * @throws API_Exception Error processing the payment.
1093
+ * @throws Add_Payment_Method_Exception When $0 order processing failed.
1094
+ * @throws Intent_Authentication_Exception When the payment intent could not be authenticated.
1095
  */
1096
  public function process_payment_for_order( $cart, $payment_information, $additional_api_parameters = [] ) {
1097
  $order = $payment_information->get_order();
1191
  // phpcs:ignore WordPress.Security.NonceVerification.Missing
1192
  $platform_checkout_intent_id = sanitize_user( wp_unslash( $_POST['platform-checkout-intent'] ?? '' ), true );
1193
 
1194
+ // Initializing the intent variable here to ensure we don't try to use an undeclared
1195
+ // variable later.
1196
+ $intent = null;
1197
  if ( ! empty( $platform_checkout_intent_id ) ) {
1198
  // If the intent is included in the request use that intent.
1199
+ $intent = $this->payments_api_client->get_intent( $platform_checkout_intent_id );
1200
+ $intent_meta_order_id_raw = $intent->get_metadata()['order_id'] ?? '';
1201
+ $intent_meta_order_id = is_numeric( $intent_meta_order_id_raw ) ? intval( $intent_meta_order_id_raw ) : 0;
1202
+
1203
+ if ( $intent_meta_order_id !== $order_id ) {
1204
+ throw new Intent_Authentication_Exception(
1205
+ __( "We're not able to process this payment. Please try again later.", 'woocommerce-payments' ),
1206
+ 'order_id_mismatch'
1207
+ );
1208
+ }
1209
+ }
1210
+
1211
+ if ( empty( $intent ) ) {
1212
  // Create intention, try to confirm it & capture the charge (if 3DS is not required).
1213
  $intent = $this->payments_api_client->create_and_confirm_intention(
1214
  $converted_amount,
readme.txt CHANGED
@@ -4,7 +4,7 @@ Tags: woocommerce, payment, payment request, credit card, automattic
4
  Requires at least: 5.8
5
  Tested up to: 6.0
6
  Requires PHP: 7.0
7
- Stable tag: 4.5.0
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -96,7 +96,10 @@ Please note that our support for the checkout block is still experimental and th
96
  3. Track Deposits
97
  4. Manage Disputes
98
 
99
- == Changelog ==
 
 
 
100
 
101
  = 4.5.0 - 2022-07-27 =
102
  * Add - Add "Things to do" task list to the Payments Overview screen
4
  Requires at least: 5.8
5
  Tested up to: 6.0
6
  Requires PHP: 7.0
7
+ Stable tag: 4.5.1
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
96
  3. Track Deposits
97
  4. Manage Disputes
98
 
99
+ == Changelog ==
100
+
101
+ = 4.5.1 - 2022-08-08 =
102
+ * Security update.
103
 
104
  = 4.5.0 - 2022-07-27 =
105
  * Add - Add "Things to do" task list to the Payments Overview screen
woocommerce-payments.php CHANGED
@@ -12,7 +12,7 @@
12
  * WC tested up to: 6.7.0
13
  * Requires at least: 5.8
14
  * Requires PHP: 7.0
15
- * Version: 4.5.0
16
  *
17
  * @package WooCommerce\Payments
18
  */
12
  * WC tested up to: 6.7.0
13
  * Requires at least: 5.8
14
  * Requires PHP: 7.0
15
+ * Version: 4.5.1
16
  *
17
  * @package WooCommerce\Payments
18
  */