Merge pull request #30 from iamsayan/develop

added v1.3.9

CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## 1.3.9
+Release Date: January 6, 2024
+
+* Added: Security check on submission.
+* Removed: Inter as default font.
+
 ## 1.3.8
 Release Date: January 5, 2024
 

includes/class-payment.php

@@ -384,7 +384,8 @@ public function init_form_fields() {
 	 */
 	public function payment_fields() {
 		global $woocommerce;
-		$order_id = $woocommerce->session->order_awaiting_payment; 
+
+		$order_id = $woocommerce->session->order_awaiting_payment ?? 0; 
 
 		if ( $order_id ) {
 			$order = wc_get_order( $order_id );
@@ -508,9 +509,8 @@ public function payment_scripts() {
 			return;
 		}
 
-		wp_register_style( 'upiwc-inter-font', 'https://fonts.googleapis.com/css?family=Inter&display=swap' );
 		wp_register_style( 'upiwc-jquery-confirm', plugins_url( 'css/jquery-confirm.min.css' , __FILE__ ), array(), '3.3.4' );
-		wp_register_style( 'upiwc-payment', plugins_url( 'css/payment.min.css' , __FILE__ ), array( 'upiwc-inter-font', 'upiwc-jquery-confirm' ), UPIWC_VERSION );
+		wp_register_style( 'upiwc-payment', plugins_url( 'css/payment.min.css' , __FILE__ ), array( 'upiwc-jquery-confirm' ), UPIWC_VERSION );
 
 		wp_register_script( 'upiwc-qr-code', plugins_url( 'js/easy.qrcode.min.js' , __FILE__ ), array( 'jquery' ), '3.8.3', true );
 		wp_register_script( 'upiwc-jquery-confirm', plugins_url( 'js/jquery-confirm.min.js' , __FILE__ ), array( 'jquery' ), '3.3.4', true );
@@ -539,6 +539,7 @@ public function payment_scripts() {
 				'payee_vpa'         => $payee_vpa,
 				'payee_name'        => preg_replace('/[^\p{L}\p{N}\s]/u', '', $this->name ),
 				'is_mobile'         => ( wp_is_mobile() ) ? 'yes' : 'no',
+				'nonce'             => wp_create_nonce( 'upiwc' ),
 				'app_version'       => UPIWC_VERSION,
 			)
 		);
@@ -759,9 +760,20 @@ public function capture_payment() {
 			return;
 		}
 
+		if ( empty( $_POST['upiwc_nonce'] ) || ! wp_verify_nonce( $_POST['upiwc_nonce'], 'upiwc' ) ) {
+			$title = __( 'Security cheeck failed!', 'upi-qr-code-payment-for-woocommerce' );
+
+			wp_die( $title, get_bloginfo( 'name' ) );
+			exit;
+		}
+
 		// generate order
-		$order_id = wc_get_order_id_by_order_key( sanitize_text_field( $_POST['upiwc_order_key'] ) );
-		$order = wc_get_order( $order_id );
+		$order = wc_get_order( absint( $_POST['upiwc_order_id'] ) );
+
+		if ( ! is_a( $order, 'WC_Order' ) ) {
+			$order_id = wc_get_order_id_by_order_key( sanitize_text_field( $_POST['upiwc_order_key'] ) );
+			$order    = wc_get_order( $order_id );
+		}
 
 		// check if it an order
 		if ( is_a( $order, 'WC_Order' ) ) {
@@ -786,7 +798,7 @@ public function capture_payment() {
 			// update post meta
 			$order->update_meta_data( '_upiwc_order_paid', 'yes' );
 
-			if ( ! empty( $_FILES['upiwc_file'] ) ) {
+			if ( ! empty( $_FILES['upiwc_file'] ) && ! empty( $_FILES['upiwc_file']['name'] ) ) {
 				$allowed_extensions = array( 'image/jpeg', 'image/png' );
 
 				if ( in_array( $_FILES['upiwc_file']['type'], $allowed_extensions ) ) {

includes/css/payment.scss

@@ -48,7 +48,7 @@
 }
 
 .jconfirm {
-    font-family: var( --upiwc-font-family, "Inter", system-ui, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif );
+    font-family: var( --upiwc-font-family, system-ui, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif );
     font-feature-settings: "liga" 0;
 
     &.jconfirm-dark {
@@ -374,6 +374,7 @@
                                         display: inline-block;
                                         min-height: 30px;
                                         font-size: 13px;
+                                        font-family: inherit;
                                         line-height: 1.8;
                                         padding: 6px 12px;
                                         vertical-align: middle;
@@ -390,6 +391,8 @@
 
                                     input[type="file"] {
                                         width: 70%;
+                                        font-size: 12px;
+                                        font-family: inherit;
                                     }
                                 }
                             }
@@ -420,7 +423,7 @@
 
             .btn {
                 position: relative;
-                font-family: var( --upiwc-font-family, "Inter", system-ui, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif );
+                font-family: var( --upiwc-font-family, system-ui, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif );
                 background-color: var( --upiwc-theme-color, #0659e3 );
                 padding: 11px 20px !important;
                 font-size: 12px;

includes/js/payment.js

@@ -221,7 +221,7 @@
                         upiForm.attr( 'method', 'POST' );
                         upiForm.attr( 'enctype', 'multipart/form-data' );
                         upiForm.attr( 'action', upiwcData.callback_url );
-                        upiForm.append( '<input type="hidden" name="upiwc_order_id" value="' + upiwcData.order_id + '"><input type="hidden" name="upiwc_order_key" value="' + upiwcData.order_key + '">' );
+                        upiForm.append( '<input type="hidden" name="upiwc_order_id" value="' + upiwcData.order_id + '"><input type="hidden" name="upiwc_order_key" value="' + upiwcData.order_key + '"><input type="hidden" name="upiwc_nonce" value="' + upiwcData.nonce + '">' );
 
                         upiForm.submit();
 

readme.txt

@@ -106,6 +106,12 @@ Post detailed information about the issue in the [support forum](https://wordpre
 
 If you like UPI QR Code Payment Gateway for WooCommerce, please take a moment to [give a 5-star rating](https://wordpress.org/support/plugin/upi-qr-code-payment-for-woocommerce/reviews/?rate=5#new-post). It helps to keep development and support going strong. Thank you!
 
+= 1.3.9 =
+Release Date: January 6, 2024
+
+* Added: Security check on submission.
+* Removed: Inter as default font.
+
 = 1.3.8 =
 Release Date: January 5, 2024