Cherry pick 46026 into release/8.8 (#46171)

* Prevent orders being placed when no shipping options are available (#46026)

* Prevent orders being placed with invalid shipping options

* Add changelog

* Add shipping_disable_flat_rate fixture function

* Test checking out with no valid shipping methods selected

* Update tests to add a default shipping method

* Update test_checkout_invalid_shipping_method to disable method

* If shipping methods is null, return an array with an empty string inside

* Replace WC session in tests that rely on setting cookies

* Add MockSessionHandler to handle test cases using cookies

* Add docblock comment

* Expect shipping validation to fail if chosen methods are null

* Add shipping method before testing validate_selected_shipping_methods

* Update MockSessionHandler to handle caching

* Show error when test fails

* Default the chosen shipping methods to an empty array if not set

* Split checks for needs_shipping and valid shipping apart

* Remove unnecessary session set and total calculation

* Fix lint errors

* Init session in each test

* Reimplement required methods (those that are private or use cookies)

* Update phpcs ignore comment to be inline

* Prevent error when accessing unset variable in mock cache

* Fix lint error

* Prep for cherry pick 46026

---------

Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
Co-authored-by: WooCommerce Bot <no-reply@woo.com>

plugins/woocommerce/readme.txt

@@ -169,6 +169,7 @@ WooCommerce comes with some sample data you can use to see how products look; im
 
 **WooCommerce**
 
+* Fix - Fixed an issue where orders could be placed when no shipping options were available [#46026](https://github.com/woocommerce/woocommerce/pull/46026)
 * Fix - Fix a bug where saved payment methods were not rendered correctly in the heckout block [#46019](https://github.com/woocommerce/woocommerce/pull/46019)
 * Fix - Removed count from is_array check to fix Analytics comparison filter. [#45939](https://github.com/woocommerce/woocommerce/pull/45939)
 * Fix - Add a filter to adjust the 50 terms limitation in the product edit page. [#45506](https://github.com/woocommerce/woocommerce/pull/45506)

plugins/woocommerce/src/StoreApi/Utilities/OrderController.php

@@ -168,7 +168,7 @@ public function sync_customer_data_with_order( \WC_Order $order ) {
 	 */
 	public function validate_order_before_payment( \WC_Order $order ) {
 		$needs_shipping          = wc()->cart->needs_shipping();
-		$chosen_shipping_methods = wc()->session->get( 'chosen_shipping_methods' );
+		$chosen_shipping_methods = wc()->session->get( 'chosen_shipping_methods', [] );
 
 		$this->validate_coupons( $order );
 		$this->validate_email( $order );
@@ -549,18 +549,30 @@ private function get_usage_per_aliases( $coupon, $aliases ) {
 	 * @param array   $chosen_shipping_methods Array of shipping methods.
 	 */
 	public function validate_selected_shipping_methods( $needs_shipping, $chosen_shipping_methods = array() ) {
-		if ( ! $needs_shipping || ! is_array( $chosen_shipping_methods ) ) {
+		if ( ! $needs_shipping ) {
 			return;
 		}
 
+		$exception = new RouteException(
+			'woocommerce_rest_invalid_shipping_option',
+			__( 'Sorry, this order requires a shipping option.', 'woocommerce' ),
+			400,
+			array()
+		);
+
+		if ( ! is_array( $chosen_shipping_methods ) || empty( $chosen_shipping_methods ) ) {
+			throw $exception;
+		}
+
+		$valid_methods = array_keys( WC()->shipping()->get_shipping_methods() );
+
 		foreach ( $chosen_shipping_methods as $chosen_shipping_method ) {
-			if ( false === $chosen_shipping_method ) {
-				throw new RouteException(
-					'woocommerce_rest_invalid_shipping_option',
-					__( 'Sorry, this order requires a shipping option.', 'woocommerce' ),
-					400,
-					array()
-				);
+			if (
+				false === $chosen_shipping_method ||
+				! is_string( $chosen_shipping_method ) ||
+				! in_array( current( explode( ':', $chosen_shipping_method ) ), $valid_methods, true )
+			) {
+				throw $exception;
 			}
 		}
 	}

plugins/woocommerce/tests/php/src/Blocks/Helpers/FixtureData.php

@@ -321,6 +321,26 @@ public function shipping_add_flat_rate( $cost = 10 ) {
 		WC()->shipping()->load_shipping_methods();
 	}
 
+	/**
+	 * Disables the flat rate method.
+	 *
+	 * @param float $cost Optional. Cost of flat rate method.
+	 */
+	public function shipping_disable_flat_rate( $cost = 10 ) {
+		$flat_rate_settings = array(
+			'enabled'      => 'no',
+			'title'        => 'Flat rate',
+			'availability' => 'all',
+			'countries'    => '',
+			'tax_status'   => 'taxable',
+			'cost'         => $cost,
+		);
+		update_option( 'woocommerce_flat_rate_settings', $flat_rate_settings );
+		update_option( 'woocommerce_flat_rate', array() );
+		\WC_Cache_Helper::get_transient_version( 'shipping', true );
+		WC()->shipping()->load_shipping_methods();
+	}
+
 	/**
 	 * Enable bacs payment method.
 	 */