Do not send user meta data back in woocommerce_get_customer_details

[jonathansadowski]

Submission Review Guidelines:

• I have followed the WooCommerce Contributing Guidelines and the WordPress Coding Standards.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have reviewed my code for security best practices.
• Following the above guidelines will result in quick merges and clear and detailed feedback when appropriate.

Changes proposed in this Pull Request:

The ajax handler for woocommerce_get_customer_details is primarily used (within WC core) for grabbing a customer's stored addresses. However, up until now, the response has also included all of the user's meta data, which we identified as being unnecessary and risky.

Closes # .

How to test the changes in this Pull Request:

Using the WooCommerce Testing Instructions Guide, include your detailed testing instructions:

1. Create an order or edit an existing order.
2. Select a new customer. You can pick any user you like, it can be an admin user instead of a customer.
3. Then, edit the billing address and click Load Billing Address.
4. Via your browser console or similar, inspect the ajax response: with this change in place it should not include an array of user meta data.

Changelog entry

• Automatically create a changelog entry from the details below.

Significance

• Patch
• Minor
• Major

Type

• Fix - Fixes an existing bug
• Add - Adds functionality
• Update - Update existing functionality
• Dev - Development related task
• Tweak - A minor adjustment to the codebase
• Performance - Address performance issues
• Enhancement - Improvement to existing functionality

Message

Do not send user meta data back in woocommerce_get_customer_details.

Comment

[github-actions]

Hi @barryhughes,

Apart from reviewing the code changes, please make sure to review the testing instructions as well.

You can follow this guide to find out what good testing instructions should look like:
https://github.com/woocommerce/woocommerce/wiki/Writing-high-quality-testing-instructions

[barryhughes]

A1 👍🏼

Left a suggestion re changelog; pre-emptively approving.

[github-actions]

Test Results Summary

Commit SHA: 7d079ff

Test 🧪	Passed ✅	Failed 🚨	Broken 🚧	Skipped ⏭️	Unknown ❔	Total 📊	Duration ⏱️
API Tests	259	0	0	2	0	261	0m 54s
E2E Tests	197	0	0	15	0	212	17m 32s

---

To view the full API test report, click here.
To view the full E2E test report, click here.
To view all test reports, visit the WooCommerce Test Reports Dashboard.

[jonathansadowski]

Currently fighting our changelog automation 😄, will fix then merge once tests pass.

[tsc1390]

hello, i believe this has caused an error within a mobile application, I'm getting meta data error in console , can't parse meta_data , in the mobile app, it use json response to get the latest order data , parse it then display it within custom app with sound notification, with this latest modification "Do not send user meta data back in woocommerce_get_customer_details", it destroyed everything, how can i fix this issue? @jonathansadowski

[tsc1390]

I'm new here, not sure if this is ok or not but this is the script , - `using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using TMPro;
using UnityEngine;
using UnityEngine.Networking;
//using UnityEngine.Audio;
public class LogicManager : MonoBehaviour
{
[Header("WooCommerce API Settings")]
[SerializeField] private string WooCommerceBaseUrl = "website_json_endpoint";
[SerializeField] private string ConsumerKey = "ck";
[SerializeField] private string ConsumerSecret = "cs";

private int latestOrderId = 0;
private bool shouldPlayAlertSound = true;

public AudioSource alertSoundSource;
public TMP_Text orderIdText;
public TMP_Text customerNameText;
public TMP_Text dateCreatedText;
public TMP_Text statusText;
public TMP_Text totalAmountText;
public TMP_Text shippingAddressText;
public TMP_Text shippingOptionsText;
public TMP_Text lineItemsText;
public TMP_Text phoneText;
public TMP_Text emailText;
public TMP_Text paymentMethodText;
public TMP_Text subtotalText; // TMP Text component for displaying the subtotal
public TMP_Text DiscountsText; // TMP Text component for displaying any additional fees
public TMP_Text tipsText; // TMP Text component for displaying tips
public TMP_Text taxText; // TMP Text component for displaying tax amount
public TMP_Text textToIncrease;
public GameObject buttonIconTransform;

private const float targetRotation = 0f;
private const float targetRotationRange = 30f;
private const float targetRotationRangeDelay = 0.1f;
private const float targetRotationRangeDelayEase = 0.5f;

private const float orderCheckDelay = 2.0f;

private OrderData data;
private string Jre;

private void Start()
{
    StartCoroutine(OrderCheckingCoroutine());
}

private IEnumerator OrderCheckingCoroutine()
{
    while (true)
    {

        yield return StartCoroutine(GetNewOrderData());
        yield return new WaitForSeconds(orderCheckDelay);
    }
}

private IEnumerator GetNewOrderData()
{
    string requestUrl = $"{WooCommerceBaseUrl}/orders?consumer_key={ConsumerKey}&consumer_secret={ConsumerSecret}";
    UnityWebRequest request = UnityWebRequest.Get(requestUrl);
    yield return request.SendWebRequest();

    if (request.result == UnityWebRequest.Result.ConnectionError || request.result == UnityWebRequest.Result.ProtocolError)
    {
         Debug.LogError("Error retrieving order data: " + request.error);
        yield break;
    }

    string jsonResponse = request.downloadHandler.text; // Get the JSON response as a string
    Debug.Log("JSON Response: " + jsonResponse); // Log the JSON response


    List<OrderData> orderDataList = JsonConvert.DeserializeObject<List<OrderData>>(request.downloadHandler.text);

    foreach (var orderData in orderDataList)
    {
        int orderId = orderData.id;
        if (orderId > latestOrderId)
        {
            DisplayAlertNormWithSound(orderData, jsonResponse);
            latestOrderId = orderId;
            data = orderData;
            Jre = jsonResponse;
        }
    }
}

private decimal CalculateOverallSubtotal(OrderData order)
{
    decimal overallSubtotal = 0;

    foreach (var item in order.line_items)
    {
        overallSubtotal += item.subtotal;
    }

    return overallSubtotal;
}
// use this to find tip amount
public string FindTipAmount(string jsonResponse, int orderId)
{
    try
    {
        // Parse the JSON response into a List of OrderData objects
        List<OrderData> orderDataList = JsonConvert.DeserializeObject<List<OrderData>>(jsonResponse);

        // Find the order with the given orderId in the orderDataList
        OrderData orderData = orderDataList.FirstOrDefault(order => order.id == orderId);

        if (orderData == null)
        {
            //Debug.LogError($"Order with ID {orderId} not found in the JSON response.");
            return "N/A";
        }

        // Check if the current order contains the "fee_lines" list
        if (orderData.fee_lines != null && orderData.fee_lines.Any())
        {
            // Find the fee line with the tip amount, if available
            var tipFee = orderData.fee_lines.FirstOrDefault(fee => decimal.TryParse(fee.total, out _));
            if (tipFee != null && decimal.TryParse(tipFee.total, out decimal tipAmount))
            {
                return tipAmount.ToString("F2");
            }
        }

        return "N/A"; // Return "N/A" if the tip amount is not found
    }
    catch (JsonReaderException ex)
    {
        Debug.LogError($"Error parsing JSON for finding tip amount: {ex.Message}");
    }

    return "N/A"; // Return "N/A" if an error occurs during parsing
}

// use this to get line item data
public Dictionary<int, string> FindJsonValuesByKeym(string jsonResponse, string targetKey)
{
    Dictionary<int, string> values = new Dictionary<int, string>();

    try
    {
        // Parse the JSON response into a JArray
        JArray jArray = JArray.Parse(jsonResponse);

        // Loop through each item in the JArray and find the value for the target key
        foreach (JObject jObject in jArray)
        {
            // Check if the current item contains the "line_items" array
            if (jObject.TryGetValue("line_items", out JToken lineItemsToken) && lineItemsToken is JArray lineItemsArray)
            {
                // Loop through each item in the "line_items" array
                foreach (JObject lineItem in lineItemsArray)
                {
                    // Get the line item ID
                    int lineItemID = lineItem.Value<int>("id");

                    // Check if the current line item contains the "meta_data" array
                    if (lineItem.TryGetValue("meta_data", out JToken metaDataToken) && metaDataToken is JArray metaDataArray)
                    {
                        // Loop through each item in the "meta_data" array
                        foreach (JObject metaData in metaDataArray)
                        {
                            // Check if the current metadata item contains the target key "order_notes"
                            if (metaData.TryGetValue("key", out JToken keyToken) && keyToken.ToString() == targetKey)
                            {
                                // Get the value associated with the "order_notes" key
                                if (metaData.TryGetValue("value", out JToken valueToken))
                                {
                                    // Convert the value to a string and add it to the dictionary with the line item ID as the key
                                    values.Add(lineItemID, valueToken.ToString());
                                }
                            }
                        }
                    }
                }
            }
        }
    }
    catch (JsonReaderException ex)
    {
        Debug.LogError($"Error parsing JSON for logging: {ex.Message}");
    }

    return values;
}

// use this to get discount
public string FindJsonValueByKey(string jsonResponse, string targetKey)
{
    try
    {
        // Deserialize the JSON response into a list of dictionaries (List<Dictionary<string, object>>)
        List<Dictionary<string, object>> dataList = JsonConvert.DeserializeObject<List<Dictionary<string, object>>>(jsonResponse);

        // Loop through each item in the list and find the value for the target key
        foreach (var data in dataList)
        {
            foreach (var keyValuePair in data)
            {
                string key = keyValuePair.Key;
                object value = keyValuePair.Value;

                // Check if the current key matches the target key
                if (key == targetKey)
                {
                    // Return the value as a string when the target key is found
                    return value.ToString();
                }
            }
        }
    }
    catch (JsonSerializationException ex)
    {
        Debug.LogError($"Error deserializing JSON for logging: {ex.Message}");
    }

    // Return an empty string if the target key is not found in the JSON response
    return string.Empty;
}

public Dictionary<string, string> FindVariationValues(string jsonResponse, string[] targetKeys)
{
    Dictionary<string, string> values = new Dictionary<string, string>();
    HashSet<string> processedItems = new HashSet<string>();

    try
    {
        // Parse the JSON response into a JArray
        JArray jArray = JArray.Parse(jsonResponse);

        // Loop through each item in the JArray and find the values for the target keys
        foreach (JObject jObject in jArray)
        {
            // Check if the current item contains the "line_items" array
            if (jObject.TryGetValue("line_items", out JToken lineItemsToken) && lineItemsToken is JArray lineItemsArray)
            {
                // Loop through each item in the "line_items" array
                foreach (JObject lineItem in lineItemsArray)
                {
                    // Get the line item name
                    string itemName = lineItem.Value<string>("name");

                    // Check if the item has already been processed, if so, skip it
                    if (processedItems.Contains(itemName))
                    {
                        continue;
                    }

                    // Check if the current line item contains the "meta_data" array
                    if (lineItem.TryGetValue("meta_data", out JToken metaDataToken) && metaDataToken is JArray metaDataArray)
                    {
                        // Loop through each item in the "meta_data" array
                        foreach (JObject metaData in metaDataArray)
                        {
                            // Check if the current metadata item contains any of the target keys
                            if (metaData.TryGetValue("key", out JToken keyToken) && targetKeys.Contains(keyToken.ToString()))
                            {
                                // Get the value associated with the target key
                                if (metaData.TryGetValue("value", out JToken valueToken))
                                {
                                    // Add the variation value to the dictionary with the item name as the key
                                    string variationValue = valueToken.ToString();
                                    if (values.ContainsKey(itemName))
                                    {
                                        values[itemName] += $", {variationValue}";
                                    }
                                    else
                                    {
                                        values[itemName] = variationValue;
                                    }
                                }
                            }
                        }
                    }

                    // Add the processed item to the HashSet
                    processedItems.Add(itemName);
                }
            }
        }
    }
    catch (JsonReaderException ex)
    {
        Debug.LogError($"Error parsing JSON for finding variation values: {ex.Message}");
    }

    return values;
}

public void IncreaseTextValue()
{
    if (textToIncrease != null)
    {
        // Parse the current text value as an integer
        if (int.TryParse(textToIncrease.text, out int currentValue))
        {
            // Increase the value by 1
            int newValue = currentValue + 1;

            // Update the TMPro text with the new value
            textToIncrease.text = newValue.ToString();
        }
    }
}
private void ClearOrderDetails()
{
    orderIdText.text = "";
    customerNameText.text = "";
    phoneText.text = "";
    emailText.text = "";
    dateCreatedText.text = "";
    statusText.text = "";
    totalAmountText.text = "";
    shippingAddressText.text = "";
    shippingOptionsText.text = "";
    lineItemsText.text = "";
    paymentMethodText.text = "";
    subtotalText.text = ""; // Clear the subtotal TMP Text component
    DiscountsText.text = ""; // Clear the subtotal TMP Text component
    taxText.text = ""; // Clear the tax TMP Text component
    tipsText.text = "";
}

public void DisplayAlertNorm(OrderData order, string response) 
{
    ClearOrderDetails();
    // Extract order notes for each line item
    string jsonResponse = response; // Replace with your actual JSON response
    int orderId = order.id;
    string customerName = order.billing.first_name + " " + order.billing.last_name;
    string phoneNumber = FormatPhoneNumber(order.billing.phone);
    string customerEmail = order.billing.email;
    string paymentMethod = order.payment_method;
    string customerNote = order.customer_note;
    DateTime dateCreated = DateTime.Parse(order.date_created);
    string tips = FindTipAmount(jsonResponse, orderId);
    decimal totalAmount = decimal.Parse(order.total);
    string lineItemsInfo = "Items:\n";
    decimal tax = decimal.Parse(order.total_tax); // Extract total tax amount
    decimal overallSubtotal = CalculateOverallSubtotal(order);
    string targetKey = "Order Notes";
    string shippingOptionsTextgo = string.Empty;
    Dictionary<int, string> orderNotesDict = FindJsonValuesByKeym(jsonResponse, targetKey);

    // Find the ShippingData object with key "options_" and display its value

    foreach (var shippingData in order.meta_data)
    {
        if (shippingData.key == "options_")
        {
            shippingOptionsTextgo = shippingData.value;
            break;
        }
    }

    // Prepare the line items info with variation details
    foreach (var item in order.line_items)
    {
        string formattedPrice = item.price.ToString("F2");
        string formattedTax = item.total_tax.ToString("F2");
        string orderNoteTextgo = string.Empty;
        string allvari = string.Empty;

        // Define the target keys for the variations
        string[] targetKeys = { "pa_regular", "Served With Soup Or Salad", "Sides", "type", "Size", "Add", "choice-of-desert", "Drink", "Deluxe", "deluxe", "DELUXE", "SIDES", "SERVED WITH SOUP OR SALAD", "DRINK", "Choice Of Veggies", "Choice Of Cheese", "Choice Of Rice", "Choice Of Suace", "choice-of-veggies", "size", "sides", "drink", "flavors", "Protein", "protein" };

        // Find the variation values and update the relevant text components
        Dictionary<string, string> variationValues = FindVariationValues(jsonResponse, targetKeys);

        // Use the extracted order notes for each line item, if available
        if (orderNotesDict.TryGetValue(item.id, out string orderNoteForLineItem))
        {
            orderNoteTextgo = orderNoteForLineItem;
        }

        // Add the variation information for the line item, if available
        if (variationValues.TryGetValue(item.name, out string variationValue))
        {
            string[] variations = variationValue.Split(',');
            string allVariations = string.Join(", ", variations);
            allvari = allVariations;
        }

        lineItemsInfo += $"{item.name} - {allvari} \n Qty: {item.quantity}, Price:${formattedPrice}, Tax:${formattedTax} \n{orderNoteTextgo}\n\n";

    }
    subtotalText.text = $"Subtotal:\n${overallSubtotal:F2}";
    DiscountsText.text = ("Discount:\n$" + FindJsonValueByKey(jsonResponse, "discount_total"));
    orderIdText.text = $"Order Number: {orderId}";
    phoneText.text = $"{phoneNumber}";
    customerNameText.text = $" {customerName}";
    emailText.text = $"{customerEmail}";
    paymentMethodText.text = $"Payment: {paymentMethod}";
    tipsText.text = $"Tip:\n ${tips}";
    dateCreatedText.text = $"{dateCreated:MM dd yyyy hh:mm tt}";
    statusText.text = $" {order.status}";
    shippingOptionsText.text = shippingOptionsTextgo;
    taxText.text = $"Tax:\n ${tax:F2}"; // Update the tax TMP Text component
    totalAmountText.text = $"Total:\n ${totalAmount:F2}";
    shippingAddressText.text = $"{order.billing.address_1}, {order.billing.city}, {order.billing.state}, {order.billing.country}";
    lineItemsText.text = $"{lineItemsInfo}Customer Note:\n{customerNote}";
    SnapScrollViewToBeginning();
}
public void DisplayAlertNormWithSound(OrderData order, string response) 
{
    shouldPlayAlertSound = true;
    if (shouldPlayAlertSound)
    {
        PlayAlertSound();
        DisplayAlertNorm(order, response);
    }
}

public void DisplayAlertNormWithoutSound(OrderData order, string response) 
{
    DisplayAlertNorm(order, response);
}

public void ViewLastOrder()
{
    DisplayAlertNormWithoutSound(data, Jre);
}

private void SnapScrollViewToBeginning()
{
    // Find the ScrollViewBoundsController component and call the SnapToBeginning method
    ScrollViewBoundsController boundsController = GetComponent<ScrollViewBoundsController>();
    if (boundsController != null)
    {
        boundsController.SnapToBeginning();
    }
}
private void PlayAlertSound()
{
    StartCoroutine(RotateButtonIcon());
    PlaySound();
}

private IEnumerator RotateButtonIcon()
{
    while (shouldPlayAlertSound)
    {
        float targetRotationSide1 = targetRotation + targetRotationRange;
        iTween.RotateTo(buttonIconTransform, iTween.Hash("z", targetRotationSide1, "time", targetRotationRangeDelayEase, "easetype", "linear"));
        yield return new WaitForSeconds(targetRotationRangeDelay);

        iTween.RotateTo(buttonIconTransform, iTween.Hash("z", targetRotation, "time", targetRotationRangeDelayEase, "easetype", "linear"));
        yield return new WaitForSeconds(targetRotationRangeDelay);

        float targetRotationSide2 = targetRotation - targetRotationRange;
        iTween.RotateTo(buttonIconTransform, iTween.Hash("z", targetRotationSide2, "time", targetRotationRangeDelayEase, "easetype", "linear"));
        yield return new WaitForSeconds(targetRotationRangeDelay);

        iTween.RotateTo(buttonIconTransform, iTween.Hash("z", targetRotation, "time", targetRotationRangeDelayEase, "easetype", "linear"));
        yield return new WaitForSeconds(targetRotationRangeDelay);
    }

    iTween.RotateTo(buttonIconTransform, iTween.Hash("z", targetRotation, "time", targetRotationRangeDelayEase, "easetype", "linear"));
}

private void StopRotationAnimation()
{
    iTween.Stop(buttonIconTransform);
    IncreaseTextValue();
}


private void PlaySound()
{
    // Load the sound from the Resources folder
    AudioClip soundClip = Resources.Load<AudioClip>("order-music");

    if (soundClip != null)
    {
        alertSoundSource.clip = soundClip;
        alertSoundSource.Play();
    }
    else
    {
        Debug.LogError("Alert sound not found in Resources folder.");
    }
}



public void StopAlertSound()
{
    shouldPlayAlertSound = false;
    if (alertSoundSource.isPlaying)
    {
        alertSoundSource.Stop();
    }
    StopRotationAnimation();
    ClearOrderDetails();
}


private string FormatPhoneNumber(string phoneNumber)
{
    string digitsOnly = new string(Array.FindAll(phoneNumber.ToCharArray(), char.IsDigit));
    if (digitsOnly.Length >= 10)
    {
        string areaCode = digitsOnly.Substring(digitsOnly.Length - 10, 3);
        string firstThreeDigits = digitsOnly.Substring(digitsOnly.Length - 7, 3);
        string lastFourDigits = digitsOnly.Substring(digitsOnly.Length - 4, 4);
        return $"({areaCode}) {firstThreeDigits}-{lastFourDigits}";
    }
    else
    {
        return phoneNumber;
    }
}

}

[System.Serializable]
public class OrderData
{
// Existing properties...
public int id;
public BillingData billing;
public List line_items;
public string date_created;
public string status;
public string total;
public string total_tax;
public string discount_total;
public string customerEmail;
public string payment_method;
public string customer_note;
public string subtotal;
public string fees;
public string tips;
public List meta_data;
public List fee_lines; // Add this property to hold fee lines

}

[System.Serializable]
public class BillingData
{
public string first_name;
public string last_name;
public string address_1;
public string city;
public string state;
public string country;
public string phone;
public string email; // Additional property for email
}

[System.Serializable]
public class OrderItem
{
public string name;
public int quantity;
public decimal price;
public decimal subtotal;
public decimal total_tax;
public int id;
public string key;
public string value;

}

[System.Serializable]
public class ShippingData
{
public string address_1;
public string city;
public string state;
public string country;
public int id;
public string key;
public string value;
public List meta_data; // New property to store metadata
}
[System.Serializable]
public class MetaData
{
public int id;
public string key;
public string value;
}

[System.Serializable]
public class FeeLine
{
public string name;
public string total;
// Additional properties if any...
}`

[barryhughes]

Hi @tsc1390,

We're sorry for any disruption this might have caused. However:

• We will not be reverting this change, which was introduced for security reasons. If it has caused a problem, you will need to update your application code accordingly.
• It's also not clear to me that your code is actually impacted by this change (but, you've shared a pretty large chunk of code in a language we don't normally work with). Method GetNewOrderData seems to be interacting with the REST API, and specifically with the orders endpoint, rather than with the ajax endpoint relevant to this change.

If you still think there is a bug within WooCommerce, please do raise a new bug report and we will be happy to look into it. If you could distill it down to a set of easily reproducible steps, that would be ideal.

Thanks!