Order attribution - avoid attributing AJAX-checkouts to Web Admin (#4…

…4219)

* Ensure is_admin AND ! wp_doing_ajax for setting Web admin source

* Better control to permit possible wp-admin ajax order creation

plugins/woocommerce/changelog/fix-incorrect-web-admin-order-attribution

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Fix orders being attributed to Web Admin incorrectly in certain cases.

plugins/woocommerce/src/Internal/Orders/OrderAttributionController.php

@@ -181,16 +181,28 @@ function( $order_id, $order ) {
 
 	/**
 	 * If the order is created in the admin, set the source type and origin to admin/Web admin.
+	 * Only execute this if the order is created in the admin interface (or via ajax in the admin interface).
 	 *
 	 * @param WC_Order $order The recently created order object.
 	 *
 	 * @since 8.5.0
 	 */
 	private function maybe_set_admin_source( WC_Order $order ) {
-		if ( function_exists( 'is_admin' ) && is_admin() ) {
-			$order->add_meta_data( $this->get_meta_prefixed_field_name( 'source_type' ), 'admin' );
-			$order->save();
+
+		// For ajax requests, bail if the referer is not an admin page.
+		$http_referer     = esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ?? '' ) );
+		$referer_is_admin = 0 === strpos( $http_referer, get_admin_url() );
+		if ( ! $referer_is_admin && wp_doing_ajax() ) {
+			return;
+		}
+
+		// If not admin interface page, bail.
+		if ( ! is_admin() ) {
+			return;
 		}
+
+		$order->add_meta_data( $this->get_meta_prefixed_field_name( 'source_type' ), 'admin' );
+		$order->save();
 	}
 
 	/**