WordPress.org
Get WordPress

Plugin Directory

Changeset 3283287


Ignore:
Timestamp:
04/28/2025 10:02:51 AM (11 months ago)
Author:
seuroficial
Message:

v2.2.24

Location:
seur/trunk
Files:
29 edited

Legend:

Unmodified
Added
Removed

  • seur/trunk/classes/class-seur-collections.php

    r3191344 r3283287  
    1414
    1515    private string $seur_adr;
    16     /**
    17      * @var false|mixed
    18      */
    19     private mixed $client_secret;
    20     /**
    21      * @var false|mixed
    22      */
    23     private mixed $accountnumber;
    24     /**
    25      * @var false|mixed
    26      */
    27     private mixed $nif;
    28     /**
    29      * @var false|mixed
    30      */
    31     private mixed $phone;
     16    private $client_secret;
     17    private $accountnumber;
     18    private $nif;
     19    private $phone;
    3220    private string $name;
    33     /**
    34      * @var false|mixed
    35      */
    36     private mixed $email;
     21    private $email;
    3722    private string $streetname;
    38     /**
    39      * @var false|mixed
    40      */
    41     private mixed $cityname;
    42     /**
    43      * @var false|mixed
    44      */
    45     private mixed $postalcode;
    46     /**
    47      * @var false|mixed
    48      */
    49     private mixed $country;
     23    private $cityname;
     24    private $postalcode;
     25    private $country;
    5026    private string $token;
    5127
    … …  
    211187        }
    212188        if ( seur()->log_is_acive() ) {
    213             seur()->slog( '$response_body: ' . print_r( $result, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
     189            seur()->slog( '$response_body: ' . print_r( $result, true) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
    214190        }
    215191        return json_decode( $result, true );
    … …  
    238214        if ( seur()->log_is_acive() ) {
    239215            seur()->slog( 'Cancelando recogida con referencia: ' . $reference );
    240             seur()->slog( 'Data enviada: ' . print_r( $data, true ) );
     216            seur()->slog( 'Data enviada: ' .  $data);
    241217        }
    242218

  • seur/trunk/classes/class-seur-global.php

    r3261412 r3283287  
    10711071    public function is_seur_order($order_id) {
    10721072        global $wpdb;
    1073         global $post;
    1074         $sql = $wpdb->prepare(
    1075             "SELECT distinct o.order_id
    1076             FROM {$wpdb->prefix}woocommerce_order_items o
    1077             inner join {$wpdb->prefix}woocommerce_order_itemmeta om on om.order_item_id = o.order_item_id
    1078             where om.meta_key = %s and (om.meta_value like %s)
    1079             AND o.order_id = %d
    1080             UNION
    1081             SELECT distinct p.ID
    1082             FROM {$wpdb->prefix}posts p
    1083             inner join {$wpdb->prefix}postmeta m on m.post_id = p.ID
    1084             where post_type = %s
    1085             and meta_key like %s
    1086             and ID = %d",
    1087             ['method_id', 'seur', $order_id, 'shop_order', 'shipping', $post->ID]
    1088         );
    1089         $sql = str_replace('seur', '%seur%', $sql);
    1090         $sql = str_replace('shipping', '_seur_shipping%', $sql);
    1091 
    1092         $result = $wpdb->get_results($sql);
     1073        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom query required, no core function available
     1074        $result = $wpdb->get_results(
     1075            $wpdb->prepare(
     1076            "SELECT DISTINCT o.order_id
     1077        FROM {$wpdb->prefix}woocommerce_order_items o
     1078        INNER JOIN {$wpdb->prefix}woocommerce_order_itemmeta om ON om.order_item_id = o.order_item_id
     1079        WHERE om.meta_key = %s AND om.meta_value LIKE %s
     1080        AND o.order_id = %d
     1081        UNION
     1082        SELECT DISTINCT p.ID
     1083        FROM {$wpdb->prefix}posts p
     1084        INNER JOIN {$wpdb->prefix}postmeta m ON m.post_id = p.ID
     1085        WHERE post_type = %s
     1086        AND meta_key LIKE %s
     1087        AND ID = %d",
     1088            [
     1089                'method_id',
     1090                '%seur%',
     1091                $order_id,
     1092                'shop_order',
     1093                '_seur_shipping%',
     1094                $order_id
     1095            ]
     1096        ));
     1097        //var_dump($wpdb->last_query); die;
    10931098        return !empty($result);
    10941099    }
    … …  
    10961101    public function is_seur_local_method($custom_rate_id) {
    10971102        global $wpdb;
     1103        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom query required, no core function available
    10981104        return $wpdb->get_results($wpdb->prepare(
    10991105            "SELECT ID
    … …  
    11511157        return (!empty($label_ids));
    11521158    }
     1159
     1160    public function seur_download_rates_csv() {
     1161        global $wpdb;
     1162        $table_name = $wpdb->prefix . 'seur_custom_rates';
     1163        // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery -- Table name is hardcoded and safe
     1164        $rates = $wpdb->get_results( "SELECT * FROM {$table_name}", ARRAY_A );
     1165
     1166        if ( empty( $rates ) ) {
     1167            wp_die( 'No hay tarifas para exportar.' );
     1168        }
     1169
     1170        // Limpiar el buffer de salida para evitar HTML no deseado
     1171        ob_clean();
     1172        header( 'Content-Type: text/csv; charset=utf-8' );
     1173        header( 'Content-Disposition: attachment; filename=seur_tarifas_actuales.csv' );
     1174        header( 'Pragma: no-cache' );
     1175        header( 'Expires: 0' );
     1176
     1177        // Abrir salida para CSV
     1178        $output = fopen( 'php://output', 'w' );
     1179
     1180        // Reemplazar los saltos de línea en los códigos postales para exportar
     1181        // Eliminar las columnas "created_at" y "updated_at"
     1182        foreach ( $rates as &$row ) {
     1183            $row['postcode'] = str_replace("\r\n", "|", $row['postcode']);
     1184            unset( $row['created_at'], $row['updated_at'] );
     1185        }
     1186        unset($row); // Para evitar referencias inesperadas
     1187
     1188        // Escribir encabezados sin las columnas eliminadas
     1189        fputcsv( $output, array_keys( $rates[0] ) );
     1190
     1191        // Escribir filas sin las columnas eliminadas
     1192        foreach ( $rates as $row ) {
     1193            fputcsv( $output, $row );
     1194        }
     1195
     1196        // Cerrar salida
     1197        fclose( $output ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- php://output is not a real file and WP_Filesystem is not applicable
     1198
     1199        // Detener la ejecución de WordPress
     1200        exit;
     1201    }
    11531202}
    11541203

  • seur/trunk/classes/class-seur-seguimiento.php

    r3234068 r3283287  
    9393        $ref = get_post_meta( $label_id, '_seur_shipping_id_number', true);
    9494
    95         $url_call      = $this->seur_adr . '?ref=' . $ref . '&refType=REFERENCE&idNumber=' . $this->id_number .
     95        $url_call      = $this->seur_adr . '?ref=' . $ref . '&refType=REFERENCE' .
    9696            '&accountNumber=' . $this->accoun_number . '&businessUnit=' . $this->business_unit;
    9797
    … …  
    146146function getStatusExpedition($eventCode) {
    147147    global $wpdb;
     148    // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Table name is hardcoded and safe, no caching applicable
    148149    $result = $wpdb->get_results($wpdb->prepare(
    149150        "SELECT * FROM {$wpdb->prefix}seur_status WHERE cod_situ = %s",
    … …  
    167168    $order_id = get_post_meta( $label_id, '_seur_shipping_order_id', true);
    168169    if ($expeditionStatusKey = getExpeditionStatusKey($expeditionStatus)) {
     170        // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Table name is hardcoded and safe, no caching applicable
    169171        $wpdb->query($wpdb->prepare(
    170172            "UPDATE {$wpdb->prefix}wc_order_stats SET status=%s WHERE order_id = %d",

  • seur/trunk/classes/tcpdf/include/tcpdf_static.php

    r3176965 r3283287  
    348348            header('Content-Length: '.$length);
    349349        }
     350        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pdf data, escaping not appropriate.
    350351        echo $data;
    351352    }

  • seur/trunk/classes/tcpdf/tcpdf.php

    r3176965 r3283287  
    76527652                    TCPDF_STATIC::sendOutputData($this->getBuffer(), $this->bufferlen);
    76537653                } else {
     7654                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is pdf data, escaping not appropriate.
    76547655                    echo $this->getBuffer();
    76557656                }

  • seur/trunk/core/functions/functions.php

    r3264469 r3283287  
    125125function seur_custom_rates_load_js() {
    126126
    127     wp_enqueue_script( 'custom-rates-seur', SEUR_PLUGIN_URL . 'assets/js/custom-rates.js', array(), SEUR_OFFICIAL_VERSION );
    128     wp_enqueue_script( 'jquery-datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/jquery.dataTables.min.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION );
    129     wp_enqueue_script( 'jqueryui-datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/dataTables.jqueryui.min.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION );
    130     wp_enqueue_script( 'datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/datatables.min.js', array( 'jquery-datattables-seur-rates' ), SEUR_OFFICIAL_VERSION );
    131     wp_enqueue_script( 'custom-table-seur-rates', SEUR_PLUGIN_URL . 'assets/js/seur-custom-rates.js', array( 'datattables-seur-rates', 'jquery-ui-autocomplete' ), SEUR_OFFICIAL_VERSION );
     127    wp_enqueue_script( 'custom-rates-seur', SEUR_PLUGIN_URL . 'assets/js/custom-rates.js', array(), SEUR_OFFICIAL_VERSION, true);
     128    wp_enqueue_script( 'jquery-datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/jquery.dataTables.min.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION, true );
     129    wp_enqueue_script( 'jqueryui-datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/dataTables.jqueryui.min.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION, true );
     130    wp_enqueue_script( 'datattables-seur-rates', SEUR_PLUGIN_URL . 'assets/js/datatables.min.js', array( 'jquery-datattables-seur-rates' ), SEUR_OFFICIAL_VERSION, true );
     131    wp_enqueue_script( 'custom-table-seur-rates', SEUR_PLUGIN_URL . 'assets/js/seur-custom-rates.js', array( 'datattables-seur-rates', 'jquery-ui-autocomplete' ), SEUR_OFFICIAL_VERSION, true );
    132132    $seurratesphpfiles = array(
    133133        'pathtorates' => SEUR_PLUGIN_URL . 'core/pages/rates/',
    … …  
    140140 */
    141141function seur_select2_load_js() {
    142     wp_enqueue_script( 'seur-select2', SEUR_PLUGIN_URL . 'assets/js/select2.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION );
     142    wp_enqueue_script( 'seur-select2', SEUR_PLUGIN_URL . 'assets/js/select2.js', array( 'jquery', 'jquery-ui-core' ), SEUR_OFFICIAL_VERSION, true );
    143143}
    144144
    … …  
    147147 */
    148148function seur_settings_load_js() {
    149     wp_enqueue_script( 'seur-tooltip', SEUR_PLUGIN_URL . 'assets/js/tooltip.js', array( 'jquery-ui-tooltip' ), SEUR_OFFICIAL_VERSION );
    150     wp_enqueue_script( 'seur-switchery', SEUR_PLUGIN_URL . 'assets/js/switchery.min.js', array(), SEUR_OFFICIAL_VERSION );
    151     wp_enqueue_script( 'seur-admin', SEUR_PLUGIN_URL . 'assets/js/seur-advanced-settings.js', array(), SEUR_OFFICIAL_VERSION );
     149    wp_enqueue_script( 'seur-tooltip', SEUR_PLUGIN_URL . 'assets/js/tooltip.js', array( 'jquery-ui-tooltip' ), SEUR_OFFICIAL_VERSION, true );
     150    wp_enqueue_script( 'seur-switchery', SEUR_PLUGIN_URL . 'assets/js/switchery.min.js', array(), SEUR_OFFICIAL_VERSION, false );
     151    wp_enqueue_script( 'seur-admin', SEUR_PLUGIN_URL . 'assets/js/seur-advanced-settings.js', array(), SEUR_OFFICIAL_VERSION, true );
    152152}
    153153
    … …  
    156156 */
    157157function seur_select2_custom_load_js() {
    158     wp_enqueue_script( 'seur-select2custom', SEUR_PLUGIN_URL . 'assets/js/select2custom.js', array( 'seur-select2' ), SEUR_OFFICIAL_VERSION );
     158    wp_enqueue_script( 'seur-select2custom', SEUR_PLUGIN_URL . 'assets/js/select2custom.js', array( 'seur-select2' ), SEUR_OFFICIAL_VERSION, true );
    159159}
    160160
    … …  
    163163 */
    164164function seur_auto_country_state_js() {
    165     wp_enqueue_script( 'seur-country-state', SEUR_PLUGIN_URL . 'assets/js/seur-country-state.js', array( 'jquery' ), SEUR_OFFICIAL_VERSION );
     165    wp_enqueue_script( 'seur-country-state', SEUR_PLUGIN_URL . 'assets/js/seur-country-state.js', array( 'jquery' ), SEUR_OFFICIAL_VERSION, true );
    166166}
    167167
    … …  
    170170 */
    171171function seur_datepicker_js() {
    172     wp_enqueue_script( 'seur-datepicker', SEUR_PLUGIN_URL . 'assets/js/seur-datepicker.js', array( 'jquery', 'jquery-ui-datepicker' ), SEUR_OFFICIAL_VERSION );
     172    wp_enqueue_script( 'seur-datepicker', SEUR_PLUGIN_URL . 'assets/js/seur-datepicker.js', array( 'jquery', 'jquery-ui-datepicker' ), SEUR_OFFICIAL_VERSION, true );
    173173}
    174174
    … …  
    177177 */
    178178function seur_status_js() {
    179     wp_enqueue_script( 'seur-status', SEUR_PLUGIN_URL . 'assets/js/seur-report.js', array( 'jquery' ), SEUR_OFFICIAL_VERSION );
     179    wp_enqueue_script( 'seur-status', SEUR_PLUGIN_URL . 'assets/js/seur-report.js', array( 'jquery' ), SEUR_OFFICIAL_VERSION, true );
    180180}
    181181
    … …  
    187187
    188188    if ( 'seur' == $post_type ) {
    189         wp_enqueue_script( 'seur-lavels-script_compatibility', SEUR_PLUGIN_URL . 'assets/js/pdf/compatibility.js', array(), SEUR_OFFICIAL_VERSION );
    190         wp_enqueue_script( 'seur-lavels-script_l10n', SEUR_PLUGIN_URL . 'assets/js/pdf/l10n.js', array(), SEUR_OFFICIAL_VERSION );
    191         wp_enqueue_script( 'seur-lavels-script_pdf', SEUR_PLUGIN_URL . 'assets/js/pdf/pdf.js', array(), SEUR_OFFICIAL_VERSION );
    192         wp_enqueue_script( 'seur-lavels-script_viewer', SEUR_PLUGIN_URL . 'assets/js/pdf/viewer.js', array(), SEUR_OFFICIAL_VERSION );
     189        wp_enqueue_script( 'seur-lavels-script_compatibility', SEUR_PLUGIN_URL . 'assets/js/pdf/compatibility.js', array(), SEUR_OFFICIAL_VERSION, true);
     190        wp_enqueue_script( 'seur-lavels-script_l10n', SEUR_PLUGIN_URL . 'assets/js/pdf/l10n.js', array(), SEUR_OFFICIAL_VERSION, true );
     191        wp_enqueue_script( 'seur-lavels-script_pdf', SEUR_PLUGIN_URL . 'assets/js/pdf/pdf.js', array(), SEUR_OFFICIAL_VERSION, true );
     192        wp_enqueue_script( 'seur-lavels-script_viewer', SEUR_PLUGIN_URL . 'assets/js/pdf/viewer.js', array(), SEUR_OFFICIAL_VERSION , true);
    193193        $translation_array = array(
    194194            'path_js_pdf' => SEUR_PLUGIN_URL . 'assets/js/pdf',
    … …  
    538538function seur_get_countries_states( $country ) {
    539539
     540    if (!preg_match('/^[A-Z]{2}$/', $country)) {
     541        return false;
     542    }
     543
    540544    $states      = array();
    541545    $states_file = SEUR_PLUGIN_PATH . 'core/places/states/' . $country . '.php';
    … …  
    559563    global $wpdb;
    560564    $table = $wpdb->prefix . SEUR_TBL_SCR;
    561     $query = $wpdb->prepare( "SELECT * FROM $table WHERE type = %s ORDER BY ID ASC", $type );
    562     return $wpdb->get_results( $query, $output_type );
     565
     566    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table lookup, no caching applicable
     567    return $wpdb->get_results(
     568        $wpdb->prepare("SELECT * FROM $table WHERE type = %s ORDER BY ID ASC", $type) // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe and hardcoded
     569        , $output_type
     570    );
    563571}
    564572
    … …  
    593601function seur_search_availables_rates( $country = '*', $state = '*', $postcode = '*', $price_weight = 0 ) {
    594602    global $wpdb;
     603
    595604    $type = get_option( 'seur_rates_type_field' ); // 'price' o 'weight', definido en la configuración de SEUR
    596605    $table = $wpdb->prefix . SEUR_TBL_SCR;
    597606
    598     $query = "
    599     SELECT *
    600     FROM $table
    601     WHERE type = %s
    602       AND country = COALESCE(
    603           (SELECT %s
    604            FROM $table
    605            WHERE type = %s
    606              AND country = %s
    607              AND (state = %s OR state = '*')
    608              AND (min".$type." <= %f AND max".$type." > %f)
    609            LIMIT 1),
    610           '*'
    611       )
    612       AND state = COALESCE(
    613           (SELECT %s
    614            FROM $table
    615            WHERE type = %s
    616              AND (country = %s OR country = '*')
    617              AND state = %s
    618              AND (min".$type." <= %f AND max".$type." > %f)
    619            LIMIT 1),
    620           '*'
    621       )
    622       AND min".$type." <= %f
    623       AND max".$type." > %f
    624     ORDER BY ID ASC;";
    625 
    626     $query = $wpdb->prepare(
    627         $query,
    628         $type,
    629         $country,  $type, $country, $state, $price_weight, $price_weight,
    630         $state,    $type, $country, $state, $price_weight, $price_weight,
    631         $price_weight, $price_weight
    632     );
    633 
    634     $results = $wpdb->get_results($query, 'ARRAY_A');
    635 
    636     // Filtrar resultados
    637     $filteredResults = array_filter($results, function ($row) use ($postcode) {
    638         return matchPostcode($postcode, $row['postcode']);
     607    $valid_types = [ 'price', 'weight' ];
     608    if ( ! in_array( $type, $valid_types, true ) ) {
     609        return []; // Tipo no válido
     610    }
     611
     612    $min_col = 'min' . $type;
     613    $max_col = 'max' . $type;
     614
     615    $sql = "SELECT *
     616            FROM $table
     617            WHERE type = %s
     618              AND country = COALESCE(
     619                  (SELECT country
     620                   FROM $table
     621                   WHERE type = %s
     622                     AND country = %s
     623                     AND (state = %s OR state = '*')
     624                     AND ($min_col <= %f AND $max_col > %f)
     625                   LIMIT 1),
     626                  '*'
     627              )
     628              AND state = COALESCE(
     629                  (SELECT state
     630                   FROM $table
     631                   WHERE type = %s
     632                     AND (country = %s OR country = '*')
     633                     AND state = %s
     634                     AND ($min_col <= %f AND $max_col > %f)
     635                   LIMIT 1),
     636                  '*'
     637              )
     638              AND $min_col <= %f
     639              AND $max_col > %f
     640            ORDER BY ID ASC;";
     641    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQL.NotPrepared -- Custom table lookup, no caching applicable, Table name safe and hardcoded and Query prepared in the line above
     642    $results = $wpdb->get_results(
     643
     644        $wpdb->prepare(
     645            $sql // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query prepared in the line above
     646            ,$type,
     647            $type, $country, $state, $price_weight, $price_weight,
     648            $type, $country, $state, $price_weight, $price_weight,
     649            $price_weight, $price_weight
     650        ), ARRAY_A );
     651
     652    // Filtrar por código postal
     653    $filteredResults = array_filter( $results, function ( $row ) use ( $postcode ) {
     654        return matchPostcode( $postcode, $row['postcode'] );
    639655    });
    640656
     657    // Registrar en el log si está activado
    641658    if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
    642659        $log = new WC_Logger();
    643         $log->add( 'seur', 'Tarifas disponibles encontradas: ' . print_r( $filteredResults, true ) );
    644     }
     660        $log->add( 'seur', 'Tarifas disponibles encontradas: ' . print_r( $filteredResults, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
     661    }
     662
    645663    return $filteredResults;
    646664}
    … …  
    17101728
    17111729    // Obtener los nuevos valores de los campos desde $_POST
    1712     $new_shipping_address = [
    1713         'first_name' => isset($_POST['_shipping_first_name']) ? sanitize_text_field($_POST['_shipping_first_name']) : '',
    1714         'last_name'  => isset($_POST['_shipping_last_name']) ? sanitize_text_field($_POST['_shipping_last_name']) : '',
    1715         'company'    => isset($_POST['_shipping_company']) ? sanitize_text_field($_POST['_shipping_company']) : '',
    1716         'address_1'  => isset($_POST['_shipping_address_1']) ? sanitize_text_field($_POST['_shipping_address_1']) : '',
    1717         'address_2'  => isset($_POST['_shipping_address_2']) ? sanitize_text_field($_POST['_shipping_address_2']) : '',
    1718         'city'       => isset($_POST['_shipping_city']) ? sanitize_text_field($_POST['_shipping_city']) : '',
    1719         'state'      => isset($_POST['_shipping_state']) ? sanitize_text_field($_POST['_shipping_state']) : '',
    1720         'postcode'   => isset($_POST['_shipping_postcode']) ? sanitize_text_field($_POST['_shipping_postcode']) : '',
    1721         'country'    => isset($_POST['_shipping_country']) ? sanitize_text_field($_POST['_shipping_country']) : '',
    1722         'phone'      => isset($_POST['_shipping_phone']) ? sanitize_text_field($_POST['_shipping_phone']) : '',
    1723         'customer_note' => isset($_POST['_customer_note']) ? sanitize_text_field($_POST['_customer_note']) : '',
    1724     ];
     1730    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1731    $new_shipping_address['first_name'] = isset($_POST['_shipping_first_name']) ? sanitize_text_field(wp_unslash($_POST['_shipping_first_name'])) : '';
     1732    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1733    $new_shipping_address['last_name']  = isset($_POST['_shipping_last_name']) ? sanitize_text_field(wp_unslash($_POST['_shipping_last_name'])) : '';
     1734    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1735    $new_shipping_address['company']    = isset($_POST['_shipping_company']) ? sanitize_text_field(wp_unslash($_POST['_shipping_company'])) : '';
     1736    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1737    $new_shipping_address['address_1']  = isset($_POST['_shipping_address_1']) ? sanitize_text_field(wp_unslash($_POST['_shipping_address_1'])) : '';
     1738    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1739    $new_shipping_address['address_2']  = isset($_POST['_shipping_address_2']) ? sanitize_text_field(wp_unslash($_POST['_shipping_address_2'])) : '';
     1740    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1741    $new_shipping_address['city']       = isset($_POST['_shipping_city']) ? sanitize_text_field(wp_unslash($_POST['_shipping_city'])) : '';
     1742    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1743    $new_shipping_address['state']      = isset($_POST['_shipping_state']) ? sanitize_text_field(wp_unslash($_POST['_shipping_state'])) : '';
     1744    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1745    $new_shipping_address['postcode']   = isset($_POST['_shipping_postcode']) ? sanitize_text_field(wp_unslash($_POST['_shipping_postcode'])) : '';
     1746    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1747    $new_shipping_address['country']    = isset($_POST['_shipping_country']) ? sanitize_text_field(wp_unslash($_POST['_shipping_country'])) : '';
     1748    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1749    $new_shipping_address['phone']      = isset($_POST['_shipping_phone']) ? sanitize_text_field(wp_unslash($_POST['_shipping_phone'])) : '';
     1750    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
     1751    $new_shipping_address['customer_note'] = isset($_POST['_customer_note']) ? sanitize_text_field(wp_unslash($_POST['_customer_note'])) : '';
    17251752
    17261753    // Validaciones
    … …  
    18031830        ob_start();
    18041831        include $file_path;
    1805         $output = ob_get_clean();
    1806         echo $output;
     1832        $data = include $file_path;
     1833        echo esc_html($data);
    18071834    } else {
    18081835        echo "Error: No se encontró el archivo de procesamiento.";

  • seur/trunk/core/installer.php

    r3261412 r3283287  
    1414function deleteTableSeurSpvr() {
    1515    global $wpdb;
     16    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange -- Custom table drop, no caching applicable
    1617    $wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}seur_svpr" );
    1718}
    … …  
    2223    if ( $seur_table_version_saved !== '1.0.5' && SEUR_TABLE_VERSION === '1.0.5' ) {
    2324        global $wpdb;
     25        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table deletion, no caching applicable
    2426        $wpdb->query( "DELETE FROM {$wpdb->prefix}actionscheduler_actions WHERE hook='seur_get_token_hook'" );
    2527        update_option( 'seur_table_version', SEUR_TABLE_VERSION );
    … …  
    7274    include_once plugin_dir_path( __FILE__ ).'../data/seur-products.php';
    7375    $products = get_seur_product();
    74 
     76    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table lookup, no caching applicable
    7577    $ratesCustomNames = $wpdb->get_results($wpdb->prepare("
    7678        SELECT option_name, option_value as custom_name
    … …  
    8890        }
    8991    }
    90 
     92   // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table lookup, no caching applicable
    9193    $ordersShippingMethods = $wpdb->get_results($wpdb->prepare("
    9294        select order_id, order_item_name
    … …  
    545547    global $wpdb;
    546548    $table_name = $wpdb->prefix . 'seur_custom_rates';
    547 
     549    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    548550    $wpdb->insert(
    549551        $table_name,
    … …  
    561563        )
    562564    );
     565    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    563566    $wpdb->insert(
    564567        $table_name,
    … …  
    576579        )
    577580    );
     581    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    578582    $wpdb->insert(
    579583        $table_name,
    … …  
    591595        )
    592596    );
     597    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    593598    $wpdb->insert(
    594599        $table_name,
    … …  
    606611        )
    607612    );
     613    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    608614    $wpdb->insert(
    609615        $table_name,
    … …  
    621627        )
    622628    );
     629    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    623630    $wpdb->insert(
    624631        $table_name,
    … …  
    636643        )
    637644    );
     645    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    638646    $wpdb->insert(
    639647        $table_name,
    … …  
    651659        )
    652660    );
     661    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    653662    $wpdb->insert(
    654663        $table_name,
    … …  
    666675        )
    667676    );
     677    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    668678    $wpdb->insert(
    669679        $table_name,
    … …  
    681691        )
    682692    );
     693    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    683694    $wpdb->insert(
    684695        $table_name,
    … …  
    696707        )
    697708    );
     709    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    698710    $wpdb->insert(
    699711        $table_name,
    … …  
    711723        )
    712724    );
     725    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    713726    $wpdb->insert(
    714727        $table_name,
    … …  
    726739        )
    727740    );
     741    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    728742    $wpdb->insert(
    729743        $table_name,
    … …  
    741755        )
    742756    );
     757    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    743758    $wpdb->insert(
    744759        $table_name,
    … …  
    756771        )
    757772    );
     773    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    758774    $wpdb->insert(
    759775        $table_name,
    … …  
    884900
    885901    // Verificar si la columna 'postcode' existe antes de modificarla
     902    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared   -- Custom table alter, no caching applicable
    886903    $column_exists = $wpdb->get_results("SHOW COLUMNS FROM `$table_name` LIKE '$column_name'");
    887904    if (!empty($column_exists)) {
    888905        // Modificar la columna 'postcode' a VARCHAR(200) con valor por defecto '*'
     906        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.PreparedSQL.InterpolatedNotPrepared    -- Custom table alter, no caching applicable
    889907        $wpdb->query("ALTER TABLE `$table_name` MODIFY `$column_name` VARCHAR(200) NOT NULL DEFAULT '*'");
    890908        update_option('seur_db_version', SEUR_DB_VERSION);

  • seur/trunk/core/labels-cpt/labels-cpt.php

    r3261412 r3283287  
    451451        }
    452452
     453        $current_order_id = 0;
    453454        foreach($id_orders as $label_id => $id_order)
    454455        {
     456            if ($current_order_id == $id_order) {
     457                continue;
     458            }
    455459            $order = wc_get_order( $id_order );
    456460
    … …  
    469473
    470474            $ecbs = $order->get_meta('_seur_label_ecbs', true);
     475            if (is_serialized($ecbs)) {
     476                $ecbs = unserialize($ecbs);
     477            }
    471478            $order_manifest['ecbs'] = $ecbs;
    472479            $order_manifest['producto'] =  get_post_meta( $label_id, '_seur_shipping_product', true );
    473480            $order_manifest['servicio'] =  get_post_meta( $label_id, '_seur_shipping_service', true );
    474             $order_manifest['bultos'] =  get_post_meta( $label_id, '_seur_shipping_packages', true );
    475             $order_manifest['peso'] =  get_post_meta( $label_id, '_seur_shipping_weight', true );
     481            $order_manifest['bultos'] =  $order->get_meta('_seur_shipping_packages', true);
     482            $order_manifest['peso'] =  $order->get_meta('_seur_shipping_weight', true);
    476483            $order_manifest['otros'] = get_post_meta( $label_id, '_seur_shipping_order_customer_comments', true );
    477484            $order_manifest['cashondelivery'] =  0;
    … …  
    481488
    482489            update_post_meta( $label_id, '_seur_shipping_manifested', 1 );
     490
     491            if ($current_order_id !== $id_order) {
     492                $current_order_id = $id_order;
     493            }
    483494        }
    484495
    … …  
    661672                    <td colspan="2">'.$order['otros'].'</td>
    662673                    <td>0.0</td>
    663                     <td>'.$order['peso'].'</td>
     674                    <td>'. round($order['peso']/$order['bultos'], 2).'</td>
    664675                    <td>0</td>
    665676                    <td>0</td>

  • seur/trunk/core/pages/rates/custom-name-rates.php

    r3179024 r3283287  
    2222        foreach ($products as $custom_name => $product) {
    2323            $rate_name_value = '';
    24             if (isset($_POST[$product['field'].'_custom_name_field'])) {
    25                 $rate_name_value = sanitize_text_field(wp_unslash($_POST[$product['field'] . '_custom_name_field']));
     24
     25            $field_key = $product['field'] . '_custom_name_field';
     26            if ( isset( $_POST[ $field_key ] ) ) {
     27                $rate_name_value = sanitize_text_field( wp_unslash( $_POST[ $field_key ] ) );
    2628            }
    2729            update_option($product['field'] . '_custom_name_field', $rate_name_value);

  • seur/trunk/core/pages/rates/seur-add-form.php

    r3261412 r3283287  
    4444    <form method='post' id='emp-SaveForm' action="#">
    4545        <?php esc_html_e( 'Include the rates of the transport options that your customers can choose', 'seur' ); ?>
     46        <input type='hidden' name='new_seur_rate_nonce_field' value='<?php echo esc_attr( wp_create_nonce( 'new_seur_rate_nonce_field' ) ); ?>' />
    4647        <table class='table table-bordered'>
    4748            <tr>
    … …  
    7879                <td><?php esc_html_e( 'Postcode', 'seur' ); ?></td>
    7980                <td><textarea title="<?php esc_html_e( 'Type a Postcode', 'seur' ); ?>" name="postcode" id="postcode" placeholder="<?php echo esc_html("List 1 postcode per line");?>" class="form-control" cols="29" rows="5" required=""></textarea>
    80                     <br><span class="description"><?php echo SEUR_RATES_POSTALCODE_DESCRIPTION . esc_html__('Add 1 per line'); ?></span>
     81                    <br><span class="description"><?php echo esc_html(SEUR_RATES_POSTALCODE_DESCRIPTION) . esc_html__('Add 1 per line', 'seur'); ?></span>
    8182                </td>
    8283            </tr>

  • seur/trunk/core/pages/rates/seur-create-rate.php

    r3261412 r3283287  
    6868                $seur_maxweight = '9999999';
    6969            }
     70            // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Safe custom table insertion not caching applicable
    7071            $wpdb->insert(
    7172                $table,

  • seur/trunk/core/pages/rates/seur-custom-rates.php

    r3254005 r3283287  
    1010}
    1111$rates_type = get_option( 'seur_rates_type_field' );
    12 
     12// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- It's a link, no form to verify
    1313if ( isset( $_GET['action'] ) && $_GET['action'] === 'download_seur_rates_csv' ) {
    14     global $wpdb;
    15     $table_name = $wpdb->prefix . 'seur_custom_rates';
    16 
    17     $rates = $wpdb->get_results( "SELECT * FROM {$table_name}", ARRAY_A );
    18 
    19     if ( empty( $rates ) ) {
    20         wp_die( 'No hay tarifas para exportar.' );
    21     }
    22 
    23     // Limpiar el buffer de salida para evitar HTML no deseado
    24     ob_clean();
    25     header( 'Content-Type: text/csv; charset=utf-8' );
    26     header( 'Content-Disposition: attachment; filename=seur_tarifas_actuales.csv' );
    27     header( 'Pragma: no-cache' );
    28     header( 'Expires: 0' );
    29 
    30     // Abrir salida para CSV
    31     $output = fopen( 'php://output', 'w' );
    32 
    33     // Eliminar las columnas "created_at" y "updated_at"
    34     foreach ( $rates as &$row ) {
    35         unset( $row['created_at'], $row['updated_at'] );
    36     }
    37     unset($row); // Para evitar referencias inesperadas
    38 
    39     // Escribir encabezados sin las columnas eliminadas
    40     fputcsv( $output, array_keys( $rates[0] ) );
    41 
    42     // Escribir filas sin las columnas eliminadas
    43     foreach ( $rates as $row ) {
    44         fputcsv( $output, $row );
    45     }
    46 
    47     // Cerrar salida
    48     fclose( $output );
    49 
    50     // Detener la ejecución de WordPress
    51     exit;
     14    seur()->seur_download_rates_csv();
    5215}
    5316?>

  • seur/trunk/core/pages/rates/seur-delete.php

    r2643080 r3283287  
    1414 */
    1515function seur_delete_rate() {
    16     if ( sanitize_text_field( wp_unslash( $_POST['del_id'] ) ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated,WordPress.Security.NonceVerification.Missing
    17 
    18         global $wpdb;
    19 
    20         $id       = sanitize_text_field( wp_unslash( $_POST['del_id'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated,WordPress.Security.NonceVerification.Missing
    21         $table    = $wpdb->prefix . 'seur_custom_rates';
    22         $getrates = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}seur_custom_rates ORDER BY ID ASC" );
    23         $wpdb->delete( $table, array( 'ID' => $id ), array( '%d' ) );
    24     }
     16    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is not applicable here, ajax request
     17    if ( isset( $_POST['del_id'] ) ) { // Validación básica
     18        global $wpdb;
     19        // phpcs:ignore WordPress.Security.NonceVerification.Missing
     20        $id    = absint( wp_unslash( $_POST['del_id'] ) );
     21        $table = $wpdb->prefix . 'seur_custom_rates';
     22        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Safe custom table deletion no caching applicable
     23        $wpdb->delete( $table, array( 'ID' => $id ), array( '%d' ) );
     24    }
    2525}

  • seur/trunk/core/pages/rates/seur-edit-form.php

    r3261412 r3283287  
    1515function seur_edit_rate() {
    1616
    17     if ( isset( $_GET['edit_id'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     17   if ( isset( $_GET['edit_id'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    1818        global $wpdb;
    1919
    20         $id        = sanitize_text_field( wp_unslash( $_GET['edit_id'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     20       // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- Nonce verification is not applicable here
     21        $id = absint( wp_unslash( $_GET['edit_id'] ) );
     22        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table lookup by ID
    2123        $getrate   = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}seur_custom_rates WHERE ID = %d", $id ) );
    2224        $min_value = ($getrate->type=='price'? $getrate->minprice: $getrate->minweight);
    … …  
    4648        <table class='table table-bordered'>
    4749            <input type='hidden' name='id' value='<?php echo esc_html( $getrate->ID ); ?>' />
     50            <input type='hidden' name='edit_rate_nonce_field' value='<?php echo esc_attr( wp_create_nonce( 'edit_rate_nonce_field' ) ); ?>' />
     51
    4852            <tr>
    4953                <td><?php esc_html_e( 'Rate', 'seur' ); ?></td>
    … …  
    137141                <td><?php esc_html_e( 'Postcode', 'seur' ); ?></td>
    138142                <td><textarea title="<?php esc_html_e( 'Type a Postcode', 'seur' ); ?>" name="postcode" id="postcode" class="form-control" cols="29" rows="5" required=""><?php echo esc_html( $getrate->postcode ); ?></textarea>
    139                     <br><span class="description"><?php echo SEUR_RATES_POSTALCODE_DESCRIPTION . esc_html__('Add 1 per line'); ?></span>
     143                    <br><span class="description"><?php echo esc_html(SEUR_RATES_POSTALCODE_DESCRIPTION) . esc_html__('Add 1 per line', 'seur'); ?></span>
    140144                </td>
    141145            </tr>

  • seur/trunk/core/pages/rates/seur-import-custom-rates.php

    r3261412 r3283287  
    1515if ( isset( $_POST['import_custom_rates'] ) && check_admin_referer( 'seur_import_custom_rates_nonce', 'seur_import_custom_rates_nonce_field' ) ) {
    1616    try {
    17         // Validar que el archivo fue subido sin errores
    18         if ( isset( $_FILES['csv_file'] ) && isset( $_FILES['csv_file']['error'] ) && $_FILES['csv_file']['error'] === UPLOAD_ERR_OK ) {
    19             $file = $_FILES['csv_file'];
    20 
    21             // Validar que el archivo es un CSV
    22             $file_type = wp_check_filetype( $file['name'] );
    23             if ( $file_type['ext'] !== 'csv' ) {
     17
     18        if (
     19            isset( $_FILES['csv_file'] ) &&
     20            isset( $_FILES['csv_file']['error'] ) &&
     21            $_FILES['csv_file']['error'] === UPLOAD_ERR_OK
     22        ) {
     23            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- the input is validated in previous lines
     24            $original_name = sanitize_file_name( $_FILES['csv_file']['name'] );
     25            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- the input is validated in previous lines
     26            $tmp_name      = sanitize_text_field( $_FILES['csv_file']['tmp_name'] );
     27
     28            $file_type = wp_check_filetype( $original_name );
     29            if ( $file_type['ext'] !== 'csv' ) {
    2430                echo '<div class="notice notice-error"><p>El archivo subido no es un CSV.</p></div>';
    2531            } else {
    … …  
    4450                }
    4551
    46                 $uploaded_file = $upload_path . sanitize_file_name( $file['name'] );
    47 
    48                 if ( $wp_filesystem->put_contents( $uploaded_file, $wp_filesystem->get_contents( $file['tmp_name'] ), FS_CHMOD_FILE ) ) {
    49                     // Procesar el archivo CSV
     52                $uploaded_file = trailingslashit( $upload_path ) . $original_name;
     53                if ( $wp_filesystem->put_contents( $uploaded_file, $wp_filesystem->get_contents( $tmp_name ), FS_CHMOD_FILE ) ) {
     54
     55                    // Procesar el archivo CSV
    5056                    $result = seur_process_csv( $uploaded_file );
    5157
    … …  
    7682    }
    7783} else {
    78     echo '<div class="notice notice-error"><p>Error de seguridad. Por favor, recargue la página e inténtelo de nuevo.</p></div>';
     84    //verificar si se ha hecho submit
     85    if ( isset( $_POST['import_custom_rates'] ) ) {
     86        echo '<div class="notice notice-error"><p>Error de seguridad. Por favor, recargue la página e inténtelo de nuevo.</p></div>';
     87    }
    7988}
    8089
    8190if ( isset( $_GET['action'] ) && $_GET['action'] === 'download_seur_rates_csv' ) {
    82     global $wpdb;
    83     $table_name = $wpdb->prefix . 'seur_custom_rates';
    84 
    85     $rates = $wpdb->get_results( "SELECT * FROM {$table_name}", ARRAY_A );
    86 
    87     if ( empty( $rates ) ) {
    88         wp_die( 'No hay tarifas para exportar.' );
    89     }
    90 
    91     // Limpiar el buffer de salida para evitar HTML no deseado
    92     ob_clean();
    93     header( 'Content-Type: text/csv; charset=utf-8' );
    94     header( 'Content-Disposition: attachment; filename=seur_tarifas_actuales.csv' );
    95     header( 'Pragma: no-cache' );
    96     header( 'Expires: 0' );
    97 
    98     // Abrir salida para CSV
    99     $output = fopen( 'php://output', 'w' );
    100 
    101     // Reemplazar los saltos de línea en los códigos postales para exportar
    102     // Eliminar las columnas "created_at" y "updated_at"
    103     foreach ( $rates as &$row ) {
    104         $row['postcode'] = str_replace("\r\n", "|", $row['postcode']);
    105         unset( $row['created_at'], $row['updated_at'] );
    106     }
    107     unset($row); // Para evitar referencias inesperadas
    108 
    109     // Escribir encabezados sin las columnas eliminadas
    110     fputcsv( $output, array_keys( $rates[0] ) );
    111 
    112     // Escribir filas sin las columnas eliminadas
    113     foreach ( $rates as $row ) {
    114         fputcsv( $output, $row );
    115     }
    116 
    117     // Cerrar salida
    118     fclose( $output );
    119 
    120     // Detener la ejecución de WordPress
    121     exit;
     91    seur()->seur_download_rates_csv();
    12292}
    12393
    … …  
    132102
    133103        // Iniciar una transacción
     104        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching  -- Using SQL transactions intentionally
    134105        $wpdb->query( 'START TRANSACTION' );
    135106
    … …  
    209180                // Verificar si el ID existe
    210181                if ( !empty( $record['ID'] ) ) {
     182                    // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery -- Table name is hardcoded and safe
    211183                    $existing_record = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}seur_custom_rates WHERE ID = %d", $record['ID'] ) );
    212184
    … …  
    220192                        }
    221193                        if ( !empty( $update_data ) ) {
     194                            // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery -- Table name is hardcoded and safe
    222195                            $wpdb->update(
    223196                                "{$wpdb->prefix}seur_custom_rates",
    … …  
    238211
    239212                    // Insertar un nuevo registro
     213                    // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery -- Table name is hardcoded and safe
    240214                    $wpdb->insert( "{$wpdb->prefix}seur_custom_rates", array_filter( $record ) );
    241215                }
    … …  
    244218            // Comprobar si hay errores antes de confirmar o revertir la transacción
    245219            if ( !empty($error_messages) ) {
     220                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Using SQL transactions intentionally
    246221                $wpdb->query('ROLLBACK'); // Revertir la transacción
    247222                return [
    … …  
    252227
    253228            // Confirmar la transacción si no hay errores
     229            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Using SQL transactions intentionally
    254230            $wpdb->query('COMMIT');
    255231            return [
    … …  
    258234            ];
    259235        } else {
     236            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Using SQL transactions intentionally
    260237            $wpdb->query('ROLLBACK'); // Revertir la transacción
    261238            return [
    … …  
    265242        }
    266243    } catch ( Exception $e ) {
     244        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Using SQL transactions intentionally
    267245        $wpdb->query('ROLLBACK'); // Revertir la transacción en caso de excepción
    268246        return [
    … …  
    283261            Los ejemplos deben ser eliminados antes de la importación final.
    284262            <br>
    285             O bien descargue las tarifas actuales aquíí
     263            O bien descargue las tarifas actuales aquí
    286264            <a href="<?php echo esc_url( admin_url( 'admin.php?page=seur_rates_prices&tab=import_custom_rates&action=download_seur_rates_csv' ) ); ?>">
    287265                Descargar Tarifas Actuales en CSV
    … …  
    300278        <li><strong>country</strong>: País al que se aplica la tarifa. Use "*" para aplicar a todos los países.</li>
    301279        <li><strong>state</strong>: Estado o provincia al que se aplica la tarifa. Use "*" para aplicar a todos los estados.</li>
    302         <li><strong>postcode</strong>: Código postal al que se aplica la tarifa. <?php echo SEUR_RATES_POSTALCODE_DESCRIPTION .' Separar los valores con "|", por ejemplo: 01*|02*|03001..03010'; ?></li>
     280        <li><strong>postcode</strong>: Código postal al que se aplica la tarifa. <?php echo esc_html(SEUR_RATES_POSTALCODE_DESCRIPTION) . esc_html(' Separar los valores con "|", por ejemplo: 01*|02*|03001..03010'); ?></li>
    303281        <li><strong>minprice</strong>: Precio mínimo para aplicar la tarifa.</li>
    304282        <li><strong>maxprice</strong>: Precio máximo para aplicar la tarifa.</li>

  • seur/trunk/core/pages/rates/seur-update.php

    r3261412 r3283287  
    6464            }
    6565
    66             $wpdb->update(
     66            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table update, no caching applicable
     67            $result = $wpdb->update(
    6768                $table,
    6869                array(
    … …  
    9394                array( '%d' )
    9495            );
    95             if ( ! $wpdb->insert_id ) {
     96            if ( $result ) {
    9697                echo '<div class="notice notice-success">' . esc_html__( 'Rate successfully updated', 'seur' ) . '</div>';
    9798            } else {

  • seur/trunk/core/pages/setting-options/advanced-settings.php

    r3261412 r3283287  
    207207}
    208208
    209 
    210209function seur_uploads_dir_field() {
    211210    $uploads_dir = seur()->get_option('seur_uploads_dir');
    212     if (!file_exists($uploads_dir)) {
    213         echo '<div id="seur_uploads_dir">'.esc_html('Directory not found').'&nbsp;
    214                 <button type="button" class="button" onclick="seur_create_upload_folder_ajax()">'.esc_html('Regenerate folder').'</button>
     211    if ( ! file_exists( $uploads_dir ) ) {
     212        echo '<div id="seur_uploads_dir">' . esc_html( 'Directory not found' ) . '&nbsp;
     213                <button type="button" class="button" onclick="seur_create_upload_folder_ajax()">' . esc_html( 'Regenerate folder' ) . '</button>
    215214              </div>';
    216215    } else {
    217         echo '<div id="seur_uploads_dir">'.esc_html($uploads_dir).'</div>';
    218         if (!is_writable($uploads_dir)) {
    219             echo '<br><strong>'.esc_html('Directory is not writable').'!!!</strong>';
     216        echo '<div id="seur_uploads_dir">' . esc_html( $uploads_dir ) . '</div>';
     217
     218        // Inicializar WP_Filesystem si no está listo
     219        if ( ! function_exists( 'request_filesystem_credentials' ) ) {
     220            require_once ABSPATH . 'wp-admin/includes/file.php';
     221        }
     222        global $wp_filesystem;
     223        if ( WP_Filesystem( request_filesystem_credentials( '', '', false, false, null ) ) ) {
     224            if ( ! $wp_filesystem->is_writable( $uploads_dir ) ) {
     225                echo '<br><strong>' . esc_html( 'Directory is not writable' ) . '!!!</strong>';
     226            }
     227        } else {
     228            echo '<br><strong>' . esc_html( 'Could not initialize WP_Filesystem' ) . '</strong>';
    220229        }
    221230    }
    … …  
    245254
    246255    // register all setings.
    247     register_setting( 'seur-advanced-settings-section', 'seur_activate_geolabel_field' );
    248     register_setting( 'seur-advanced-settings-section', 'seur_activate_free_shipping_field' );
    249     register_setting( 'seur-advanced-settings-section', 'seur_preaviso_notificar_field' );
    250     register_setting( 'seur-advanced-settings-section', 'seur_activate_local_pickup_field' );
    251     register_setting( 'seur-advanced-settings-section', 'seur_google_maps_api_field' );
    252     register_setting( 'seur-advanced-settings-section', 'seur_after_get_label_field' );
    253     register_setting( 'seur-advanced-settings-section', 'seur_preaviso_notificar_field' );
    254     register_setting( 'seur-advanced-settings-section', 'seur_reparto_notificar_field' );
    255     register_setting( 'seur-advanced-settings-section', 'seur_tipo_notificacion_field' );
    256     register_setting( 'seur-advanced-settings-section', 'seur_tipo_etiqueta_field' );
    257     register_setting( 'seur-advanced-settings-section', 'seur_aduana_origen_field' );
    258     register_setting( 'seur-advanced-settings-section', 'seur_aduana_destino_field' );
    259     register_setting( 'seur-advanced-settings-section', 'seur_tipo_mercancia_field' );
    260     register_setting( 'seur-advanced-settings-section', 'seur_id_mercancia_field' );
    261     register_setting( 'seur-advanced-settings-section', 'seur_descripcion_field' );
    262     register_setting( 'seur-advanced-settings-section', 'seur_uploads_dir' );
    263 
     256    register_setting( 'seur-advanced-settings-section', 'seur_activate_geolabel_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] );  // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     257    register_setting( 'seur-advanced-settings-section', 'seur_activate_free_shipping_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     258    register_setting( 'seur-advanced-settings-section', 'seur_preaviso_notificar_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     259    register_setting( 'seur-advanced-settings-section', 'seur_activate_local_pickup_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     260    register_setting( 'seur-advanced-settings-section', 'seur_after_get_label_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     261    register_setting( 'seur-advanced-settings-section', 'seur_reparto_notificar_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     262
     263    register_setting( 'seur-advanced-settings-section', 'seur_google_maps_api_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     264    register_setting( 'seur-advanced-settings-section', 'seur_tipo_notificacion_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     265    register_setting( 'seur-advanced-settings-section', 'seur_tipo_etiqueta_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     266    register_setting( 'seur-advanced-settings-section', 'seur_tipo_mercancia_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     267    register_setting( 'seur-advanced-settings-section', 'seur_id_mercancia_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     268    register_setting( 'seur-advanced-settings-section', 'seur_aduana_origen_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     269    register_setting( 'seur-advanced-settings-section', 'seur_aduana_destino_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     270    register_setting( 'seur-advanced-settings-section', 'seur_descripcion_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     271    //'seur_uploads_dir' already registered
    264272}
    265273add_action( 'admin_init', 'display_seur_advanced_settings_panel_fields' );

  • seur/trunk/core/pages/setting-options/user-settings.php

    r3176965 r3283287  
    347347
    348348    // register all setings.
    349     register_setting( 'seur-user-settings-section', 'seur_test_field' );
    350     register_setting( 'seur-user-settings-section', 'seur_log_field' );
    351     register_setting( 'seur-user-settings-section', 'seur_nif_field' );
    352     register_setting( 'seur-user-settings-section', 'seur_rates_tax_field' );
    353     register_setting( 'seur-user-settings-section', 'seur_rates_type_field' );
    354     register_setting( 'seur-user-settings-section', 'seur_empresa_field' );
    355     register_setting( 'seur-user-settings-section', 'seur_viatipo_field' );
    356     register_setting( 'seur-user-settings-section', 'seur_vianombre_field' );
    357     register_setting( 'seur-user-settings-section', 'seur_vianumero_field' );
    358     register_setting( 'seur-user-settings-section', 'seur_escalera_field' );
    359     register_setting( 'seur-user-settings-section', 'seur_piso_field' );
    360     register_setting( 'seur-user-settings-section', 'seur_puerta_field' );
    361     register_setting( 'seur-user-settings-section', 'seur_postal_field' );
    362     register_setting( 'seur-user-settings-section', 'seur_poblacion_field' );
    363     register_setting( 'seur-user-settings-section', 'seur_provincia_field' );
    364     register_setting( 'seur-user-settings-section', 'seur_pais_field' );
    365     register_setting( 'seur-user-settings-section', 'seur_telefono_field' );
    366     register_setting( 'seur-user-settings-section', 'seur_email_field' );
    367     register_setting( 'seur-user-settings-section', 'seur_contacto_nombre_field' );
    368     register_setting( 'seur-user-settings-section', 'seur_contacto_apellidos_field' );
    369     register_setting( 'seur-user-settings-section', 'seur_client_secret_field' );
    370     register_setting( 'seur-user-settings-section', 'seur_user_field' );
    371     register_setting( 'seur-user-settings-section', 'seur_password_field' );
    372     register_setting( 'seur-user-settings-section', 'seur_client_id_field' );
    373     register_setting( 'seur-user-settings-section', 'seur_accountnumber_field' );
    374     register_setting( 'seur-user-settings-section', 'seur_ccc_field' );
    375     register_setting( 'seur-user-settings-section', 'seur_int_ccc_field' );
    376     register_setting( 'seur-user-settings-section', 'seur_franquicia_field' );
     349    register_setting( 'seur-user-settings-section', 'seur_test_field', [ 'sanitize_callback' => 'rest_sanitize_boolean' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     350    register_setting( 'seur-user-settings-section', 'seur_log_field' , [ 'sanitize_callback' => 'rest_sanitize_boolean' ]); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     351
     352    register_setting( 'seur-user-settings-section', 'seur_nif_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     353    register_setting( 'seur-user-settings-section', 'seur_rates_tax_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     354    register_setting( 'seur-user-settings-section', 'seur_rates_type_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     355    register_setting( 'seur-user-settings-section', 'seur_empresa_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     356    register_setting( 'seur-user-settings-section', 'seur_viatipo_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     357    register_setting( 'seur-user-settings-section', 'seur_vianombre_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     358    register_setting( 'seur-user-settings-section', 'seur_vianumero_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     359    register_setting( 'seur-user-settings-section', 'seur_escalera_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     360    register_setting( 'seur-user-settings-section', 'seur_piso_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     361    register_setting( 'seur-user-settings-section', 'seur_puerta_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     362    register_setting( 'seur-user-settings-section', 'seur_postal_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     363    register_setting( 'seur-user-settings-section', 'seur_poblacion_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     364    register_setting( 'seur-user-settings-section', 'seur_provincia_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     365    register_setting( 'seur-user-settings-section', 'seur_pais_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     366    register_setting( 'seur-user-settings-section', 'seur_telefono_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     367    register_setting( 'seur-user-settings-section', 'seur_email_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     368    register_setting( 'seur-user-settings-section', 'seur_contacto_nombre_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     369    register_setting( 'seur-user-settings-section', 'seur_contacto_apellidos_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     370    register_setting( 'seur-user-settings-section', 'seur_client_secret_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     371    register_setting( 'seur-user-settings-section', 'seur_user_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     372    register_setting( 'seur-user-settings-section', 'seur_password_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     373    register_setting( 'seur-user-settings-section', 'seur_client_id_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     374    register_setting( 'seur-user-settings-section', 'seur_accountnumber_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     375    register_setting( 'seur-user-settings-section', 'seur_ccc_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     376    register_setting( 'seur-user-settings-section', 'seur_int_ccc_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
     377    register_setting( 'seur-user-settings-section', 'seur_franquicia_field', [ 'sanitize_callback' => 'sanitize_text_field' ] ); // phpcs:ignore PluginCheck.CodeAnalysis.SettingSanitization.register_settingDynamic -- Sanitization callback is safe and known
    377378}
    378379add_action( 'admin_init', 'display_seur_user_sittings_panel_fields' );

  • seur/trunk/core/pages/seur-get-labels.php

    r3254005 r3283287  
    171171    }
    172172
    173     if ( $_SERVER['REQUEST_METHOD'] != 'POST') { ?>
     173    if (isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] != 'POST') { ?>
    174174    <div class="wrap">
    175175        <h1 class="wp-heading-inline"><?php esc_html_e( 'Modify Packages', 'seur' ); ?></h1>
    … …  
    212212    }
    213213
    214     if ( $_SERVER['REQUEST_METHOD'] === 'POST' && isset( $_POST['seur-number-packages'] ) && isset( $_POST['seur-shipping-weight'] ) ) {
     214    if (isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] === 'POST' && isset( $_POST['seur-number-packages'] ) && isset( $_POST['seur-shipping-weight'] ) ) {
    215215        if ( ! isset( $_POST['seur_modify_packages_nonce_field'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['seur_modify_packages_nonce_field'] ) ), 'seur_modify_packages_action' ) ) {
    216216            exit;
    … …  
    249249                <?php
    250250            } else {
    251                 echo '<p>' . esc_html__( 'Error updating packages: ' . $response['errors'][0]['detail'], 'seur' ) . '</p>';
     251                echo '<p>' . esc_html__( 'Error updating packages: ', 'seur'). esc_html($response['errors'][0]['detail']) . '</p>';
    252252            }
    253253        } else {

  • seur/trunk/core/pages/status/status-check.php

    r3176965 r3283287  
    354354                    <td data-export-label="Check for <?php echo esc_html( $table_name ); ?>"><?php echo esc_html__( 'Check for', 'seur' ) . ' ' . esc_html( $table_name ); ?></td>
    355355                    <?php
    356                     if ( $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %d', $table_name ) ) === $table_name ) {
     356                    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Table existence check is required
     357                    if ( $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %s', $table_name ) ) === $table_name ) {
    357358                        echo '<td><span class="yes">&#10004;</span></td>';
    358359                    } else {

  • seur/trunk/core/tracking/back/tracking-back.php

    r3254005 r3283287  
    1515function seur_register_meta_boxes_tracking() {
    1616    $screen = seur_get_order_screen();
    17     $order_id = isset($_GET['id']) ? $_GET['id'] : '';
     17    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- Nonce verification is not applicable here
     18    $order_id = isset( $_GET['id'] ) ? absint( wp_unslash( $_GET['id'] ) ) : 0;
    1819    if (seur()->is_seur_order($order_id)) {
    1920        add_meta_box('seurmetaboxtracking', __('SEUR Tracking', 'seur'), 'seur_metabox_tracking_callback', $screen, 'side', 'low');

  • seur/trunk/core/woocommerce/includes/class-seur_local_shipping_method.php

    r3234068 r3283287  
    241241            $i++;
    242242        }
    243         seur()->slog('$centro: ' . print_r($centro, true));
     243        seur()->slog('$centro: ' . print_r($centro, true)); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
    244244        return $centro;
    245245    //}
    … …  
    436436 */
    437437function seur_validation_2shop_fields() {
    438 
     438    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- not needed
    439439    $seur_cutom_rate_ID = sanitize_text_field( wp_unslash($_POST['shipping_method'][0]??''));
    440440    if (seur()->is_seur_local_method($seur_cutom_rate_ID)) {

  • seur/trunk/core/woocommerce/includes/class-wc-shipping-seur.php

    r3209024 r3283287  
    365365    public function clear_transients() {
    366366        global $wpdb;
    367 
     367        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table deletion not caching applicable
    368368        $wpdb->query( "DELETE FROM `$wpdb->options` WHERE `option_name` LIKE ('_transient_seur_quote_%') OR `option_name` LIKE ('_transient_timeout_seur_quote_%')" );
    369369    }

  • seur/trunk/core/woocommerce/includes/metabox/seur-metabox.php

    r3254005 r3283287  
    1515function seur_register_meta_boxes() {
    1616    $screen = seur_get_order_screen();
    17     $order_id = isset($_GET['id']) ? $_GET['id'] : '';
     17    // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- Nonce verification is not applicable here
     18    $order_id = isset( $_GET['id'] ) ? absint( wp_unslash( $_GET['id'] ) ) : 0;
    1819    if (seur()->is_seur_order($order_id)) {
    1920        add_meta_box('seurmetabox', __('SEUR Labels', 'seur'), 'seur_metabox_callback', $screen, 'side', 'low');
    … …  
    4243        );
    4344        add_thickbox();
     45        // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage -- Image is static and not stored in the media library
    4446        echo '<img src="'. esc_url( SEUR_PLUGIN_URL ) .'assets/img/icon-96x37.png" alt="SEUR Image" width="96" height="37" />';
    4547        for ($k=0;$k<=1;$k++) {
    … …  
    5961            <?php
    6062        }
    61     } else { ?>
    62         <img src="<?php echo esc_url( SEUR_PLUGIN_URL ); ?>assets/img/icon-96x37.png" alt="SEUR Image" width="96" height="37" />
    63         <?php
     63    } else {
     64        // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage -- Image is static and not stored in the media library
     65        echo '<img src="'. esc_url( SEUR_PLUGIN_URL ) .'assets/img/icon-96x37.png" alt="SEUR Image" width="96" height="37" />';
    6466        $url_upload_dir = get_site_option( 'seur_uploads_url_labels' );
    6567        $label_ids = seur_get_labels_ids($order->get_id());

  • seur/trunk/core/woocommerce/includes/seur-woo-functions.php

    r3261412 r3283287  
    2626function seur_add_cart_weight_hpos( $order_id )
    2727{
    28     if (WC()->cart) {
     28    if (WC()->cart && WC()->cart->cart_contents_count > 0) {
    2929        $order = new WC_Order($order_id);
    3030
     31        $product_name = '';
    3132        $ship_methods = maybe_unserialize($order->get_shipping_methods());
    3233        foreach ($ship_methods as $ship_method) {
    … …  
    5354function seur_add_cart_weight( $order_id ) {
    5455    global $woocommerce;
    55 
    56     $weight = $woocommerce->cart->cart_contents_weight;
    57     update_post_meta( $order_id, '_seur_cart_weight', $weight );
     56    if ( $woocommerce->cart->cart_contents_count > 0 ) {
     57        $weight = $woocommerce->cart->cart_contents_weight;
     58        update_post_meta($order_id, '_seur_cart_weight', $weight);
     59    }
    5860}
    5961
    … …  
    264266    $action        = $wp_list_table->current_action();
    265267
     268    // 2. check the ID
     269    // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    266270    if (isset($_REQUEST['id'])) {
     271        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    267272        $post_ids      = array_map( 'absint', (array) $_REQUEST['id'] );
    268273    }
     274    // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    269275    if (isset($_REQUEST['post'])) {
     276        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    270277        $post_ids      = array_map( 'absint', (array) $_REQUEST['post'] );
    271278    }
    … …  
    328335    }
    329336
     337    // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    330338    if ( isset( $_GET['post_status'] ) ) {
    331             $sendback = add_query_arg( 'post_status', sanitize_text_field(wp_unslash($_GET['post_status'])), $sendback );
     339        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     340        $sendback = add_query_arg( 'post_status', sanitize_text_field(wp_unslash($_GET['post_status'])), $sendback );
    332341    }
    333342
    … …  
    502511            <option value="seur"
    503512            <?php
     513            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    504514            $_shop_order_seur_shipping_method = isset( $_GET['_shop_order_seur_shipping_method'] ) ? esc_attr( sanitize_text_field(wp_unslash($_GET['_shop_order_seur_shipping_method']))) : '';
    505515            if ($_shop_order_seur_shipping_method == 'seur') {
    … …  
    529539
    530540function seur_filter_orders_by_shipping_method_query( $vars ) {
    531     global $typenow;
    532 
    533     if ( seur_is_order_page($typenow) &&
    534          isset( $_GET['_shop_order_seur_shipping_method'] ) &&
    535          !empty($_GET['_shop_order_seur_shipping_method']) ) {
     541    global $typenow;
     542
     543    // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     544    if (seur_is_order_page( $typenow ) && isset( $_GET['_shop_order_seur_shipping_method'] ) && ! empty( $_GET['_shop_order_seur_shipping_method'] )
     545    ) {
    536546        $products = seur()->get_products();
    537         $vars['meta_key']   = '_seur_shipping';
    538         $vars['meta_value'] = 'seur';
     547        // Filtro por defecto
     548        $meta_query = [
     549            [
     550                'key'   => '_seur_shipping',
     551                'value' => 'seur',
     552            ]
     553        ];
     554        $user_input = sanitize_text_field( wp_unslash( $_GET['_shop_order_seur_shipping_method'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    539555        foreach ( $products as $code => $product ) {
    540             $custom_name = get_option($product['field'].'_custom_name_field')?get_option($product['field'].'_custom_name_field'):$code;
     556            $custom_name = get_option( $product['field'] . '_custom_name_field' ) ?: $code;
    541557            $shippment_sani = sanitize_title( $custom_name );
    542             if ( $shippment_sani == sanitize_text_field( wp_unslash( $_GET['_shop_order_seur_shipping_method']))) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    543                 $vars['meta_key'] = '_seur_shipping_method_service_real_name';
    544                 $vars['meta_value'] = $code;
     558
     559            if ( $shippment_sani === $user_input ) {
     560                $meta_query = [
     561                    [
     562                        'key'   => '_seur_shipping_method_service_real_name',
     563                        'value' => $code,
     564                    ]
     565                ];
    545566                break;
    546567            }
    547568        }
    548     }
    549     return $vars;
     569        $vars['meta_query'] = $meta_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
     570    }
     571    return $vars;
    550572}
    551573if (seur_is_wc_order_hpos_enabled()) {

  • seur/trunk/core/woocommerce/seur-woocommerce.php

    r3176965 r3283287  
    168168            // instance.
    169169            if ( ! $this->is_zone_has_seur( 0 ) ) {
     170                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table insert, no caching applicable
    170171                $wpdb->query( $wpdb->prepare( "INSERT INTO {$wpdb->prefix}woocommerce_shipping_zone_methods ( zone_id, method_id, method_order, is_enabled ) VALUES ( %d, %s, %d, %d )", 0, 'seur', 1, 1 ) );
    171172                // add settings to the newly created instance to options table.
    … …  
    232233    public function is_zone_has_seur( $zone_id ) {
    233234        global $wpdb;
    234 
     235        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table lookup, no caching applicable
    235236        return (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(instance_id) FROM {$wpdb->prefix}woocommerce_shipping_zone_methods WHERE method_id = 'seur' AND zone_id = %d", $zone_id ) ) > 0;
    236237    }

  • seur/trunk/loader.php

    r3264469 r3283287  
    44 * Plugin URI: http://www.seur.com/
    55 * Description: Add SEUR shipping method to WooCommerce. The SEUR plugin for WooCommerce allows you to manage your order dispatches in a fast and easy way
    6  * Version: 2.2.23
     6 * Version: 2.2.24
    77 * Author: SEUR Oficial
    88 * Author URI: http://www.seur.com/
    9  * Tested up to: 6.7.2
     9 * Tested up to: 6.8
    1010 * WC requires at least: 3.0
    1111 * WC tested up to: 9.1.4
    … …  
    2020use Automattic\WooCommerce\Utilities\FeaturesUtil;
    2121
    22 define( 'SEUR_OFFICIAL_VERSION', '2.2.23' );
     22define( 'SEUR_OFFICIAL_VERSION', '2.2.24' );
    2323define( 'SEUR_DB_VERSION', '1.0.5' );
    2424define( 'SEUR_TABLE_VERSION', '1.0.5' );

  • seur/trunk/readme.txt

    r3264469 r3283287  
    33Tags: woocommerce, shipping, seur, logistica, enviar paquete
    44Requires at least: 4.0
    5 Tested up to: 6.7.2
    6 Stable tag: 2.2.23
     5Tested up to: 6.8
     6Stable tag: 2.2.24
    77WC requires at least: 3.0
    88WC tested up to: 9.1.4
    … …  
    9393
    9494== Changelog ==
     95
     96== 2.2.24 ==
     97* ADDED: WordPress 6.8 compatibility
     98* ADDED: Check cart before save weight
     99* FIXED: Vulnerability SET-467
    95100
    96101== 2.2.23 ==

  • seur/trunk/uninstall.php

    r3159775 r3283287  
    109109
    110110// Drop tables.
     111// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.DirectDatabaseQuery.NoCaching -- Required for uninstall cleanup no caching applicable
    111112$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}seur_reco" );
     113// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.DirectDatabaseQuery.NoCaching -- Required for uninstall cleanup no caching applicable
    112114$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}seur_ecb" );
     115// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.DirectDatabaseQuery.NoCaching -- Required for uninstall cleanup no caching applicable
    113116$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}seur_svpr" );
     117// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.DirectDatabaseQuery.NoCaching -- Required for uninstall cleanup no caching applicable
    114118$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}seur_custom_rates" );
    115119
    116120// remove seur_labels post type.
     121// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    117122$wpdb->query( "DELETE FROM {$wpdb->posts} WHERE post_type IN ('seur_labels');" );
     123// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    118124$wpdb->query( "DELETE meta FROM {$wpdb->postmeta} meta LEFT JOIN {$wpdb->posts} posts ON posts.ID = meta.post_id WHERE posts.ID IS NULL;" );
     125// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    119126$wpdb->delete( $wpdb->term_taxonomy, array( 'taxonomy' => 'labels-product' ) );
     127
    120128// Delete orphan relationships.
     129// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    121130$wpdb->query( "DELETE tr FROM {$wpdb->term_relationships} tr LEFT JOIN {$wpdb->posts} posts ON posts.ID = tr.object_id WHERE posts.ID IS NULL;" );
    122131
    123132// Delete orphan terms.
     133// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    124134$wpdb->query( "DELETE t FROM {$wpdb->terms} t LEFT JOIN {$wpdb->term_taxonomy} tt ON t.term_id = tt.term_id WHERE tt.term_id IS NULL;" );
    125135
    126136// Delete orphan term meta.
    127137if ( ! empty( $wpdb->termmeta ) ) {
     138    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Removing custom post type and related data
    128139    $wpdb->query( "DELETE tm FROM {$wpdb->termmeta} tm LEFT JOIN {$wpdb->term_taxonomy} tt ON tm.term_id = tt.term_id WHERE tt.term_id IS NULL;" );
    129140}
Note: See TracChangeset for help on using the changeset viewer.