Version update

Merge pull request 'Fix Bugs C,D,E from auditing report' (#2 ) from rev0919 into main
Reviewed-on: #2
2023-10-26 15:09:50 -05:00 · 2023-10-26 18:57:48 +00:00 · 2023-09-19 16:58:49 -05:00 · 2023-07-20 13:51:57 -05:00 · 2023-07-20 13:51:12 -05:00 · 2023-06-26 10:42:37 -05:00
3 changed files with 414 additions and 253 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -3,6 +3,19 @@ All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.2] - 2023-07-20
+
+- Fixed typo in API call
+
+## [1.0.1] - 2023-06-26
+
+- Updates for production release
+
+## [1.0.0] - 2023-06-26
+
+- Security hardening changes to plugin queries.
+- Re-design of ZGo API callback to support WooCommerce 7.8.0
+
 ## [1.0.0-beta.1] - 2023-01-11

 - Adjust production server integration
--- a/assets/php/zpmt-stats-page.php
+++ b/assets/php/zpmt-stats-page.php
@ -46,11 +46,13 @@ class zpmt_stats_page {
 				$this->_npages++;
 			}

-	      	$sql = 'insert into zgo_pmtlst (pg_ix,pg_page,pg_npages,pg_offset,pg_limit) values (1,' . 
-	      	   $this->_page . ',' .
-	      	   $this->_npages . ',' .
-	      	   $this->_offset . ',' .
-	      	   $this->_limit .')';
+//			$sql = 'insert into zgo_pmtlst (pg_ix,pg_page,pg_npages,pg_offset,pg_limit) values (1,' . 
+//				$this->_page . ',' .
+//				$this->_npages . ',' .
+//				$this->_offset . ',' .
+//				$this->_limit .')';
+
+			$sql =  $wpdb->prepare('insert into zgo_pmtlst (pg_ix,pg_page,pg_npages,pg_offset,pg_limit) values (1,%d,%d,%d,%d);',$this->_page,$this->_npages,$this->_offset,$this->_limit);
 			$wpdb->query($sql);
 		} else {
 	      	// Load last state
@ -67,7 +69,10 @@ class zpmt_stats_page {
 				if ( $this->_nrows > ($this->_npages*$this->_limit) ) {
 						$this->_npages++;
 				}	
-				$sql = 'update zgo_pmtlst set pg_npages=' . $this->_npages . ' where pg_ix=1';
+
+//				$sql = 'update zgo_pmtlst set pg_npages=' . $this->_npages . ' where pg_ix=1';
+
+				$sql = $wpdb->prepare('update zgo_pmtlst set pg_npages=%d where pg_ix=1;',$this->_npages);
 				$wpdb->query($sql);
 			} 
 		}
@ -149,9 +154,13 @@ class zpmt_stats_page {
 			//
 			// Save new list state
 			//
-			$sql = 'update zgo_pmtlst set pg_page=' . $this->_page .
-			    ', pg_npages=' . $this->_npages .
-			    ', pg_offset=' . $this->_offset . ' where pg_ix=1;';		
+
+//			$sql = 'update zgo_pmtlst set pg_page=' . $this->_page .
+//			    ', pg_npages=' . $this->_npages .
+//			    ', pg_offset=' . $this->_offset . ' where pg_ix=1;';		
+			
+			$sql = $wpdb->prepare('update zgo_pmtlst set pg_page=%d, pg_npages=
+				%d, pg_offset=%d where pg_ix=1;',$this->_page,$this->_npages,$this->_offset);
 			$wpdb->query($sql);
 		}

@ -232,15 +241,15 @@ class zpmt_stats_page {
  		  	                font-weight: 600;">';
 				}
 				$line++;             
-				print '<td><a href="https://dev.zgo.cash/invoice/' . $row->pmt_orderid . '" target="_blank">' . $row->pmt_orderid . "</a></td>";
-				print "<td>" . $row->pmt_wc_order . "</td>";
-				print "<td>" . $row->pmt_wc_custname . "</td>";
-				print '<td style="text-align:center;">'. $row->pmt_accepted . "</td>";
-				print '<td style="text-align:center;">'.$row->pmt_confirmed ."</td>";
+				print '<td><a href="https://dev.zgo.cash/invoice/' . htmlentities($row->pmt_orderid, ENT_QUOTES) . '" target="_blank">' . htmlentities($row->pmt_orderid, ENT_QUOTES) . "</a></td>";
+				print "<td>" . htmlwntities($row->pmt_wc_order,ENT_QUOTES) . "</td>";
+				print "<td>" . htmlentities($row->pmt_wc_custname, ENT_QUOTES) . "</td>";
+				print '<td style="text-align:center;">'. htmlentities($row->pmt_accepted,ENT_QUOTES) . "</td>";
+				print '<td style="text-align:center;">'.htmlentities($row->pmt_confirmed,ENT_QUOTES) ."</td>";
 				print '<td style="text-align:right;">'. number_format($row->pmt_amount,2) . "</td>";
 				print '<td style="text-align:right;">'. number_format($row->pmt_rate,2) . "</td>";
 				print '<td style="text-align:right;">'. number_format($row->pmt_zec,8) . "</td>";
-				print '<td  style="text-align:center;">'.$row->pmt_wc_paid ."</td></tr>";
+				print '<td  style="text-align:center;">'. htmlentities($row->pmt_wc_paid,ENT_QUOTES) ."</td></tr>";
 			}
 		?> 
 			</table>
--- a/zgopmtgwy.php
+++ b/zgopmtgwy.php
@ -1,13 +1,13 @@
 <?php 
 /**
 * Plugin Name: ZGo Payment Gateway
-* Plugin URI: https://vergara.tech' 
+ * Plugin URI: https://zgo.cash/ 
 * Description: ZGo latest payment processing solution for Woocommerce. Accept payments using Zcash.
-* Version: 1.0.0 beta
+ * Version: 1.1.1
 * Requires at least: 5.2
 * Requires PHP:      7.2
 * Author: Vergara Tech LLC 
-* Author URI: https://vergara.tech
+ * Author URI: https://zgo.cash/
 * License:           GPL v2 or later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 **/
@ -93,10 +93,17 @@ function zgopmt_init() {

 			if ( ! $this->is_valid_for_use() ) 
 				$this->enabled = false;
+
 			/**
 			 * Add the webhook for payment confirmation from ZGo
 			 */
-			add_action( 'woocommerce_api_zpmtcallback', array($this,'zconfirm'));	
+			//add_action( 'woocommerce_api_zpmtcallback', array($this,'zconfirm'));	
+		}
+
+		public function register_routes() {
+			register_rest_route( 'wc/v3', 'zgocallback', array(
+				'methods' => 'GET',
+				'callback' => array($this,'zgoapicallback')));
 		}

 		public function init_form_fields() {
@ -174,7 +181,7 @@ function zgopmt_init() {
 			if ( isset($this->zgoownerid) && 
 				($this->zgoownerid !== '') ) {

-				$url = 'https://api.zgo.cash//auth?ownerid=' .
+				$url = 'https://api.zgo.cash/auth?ownerid=' .
 					$this->zgoownerid . '&token=' .
 					$this->zgotoken . '&siteurl=' .
 					$this->base64url_encode($this->siteURL);
@ -190,7 +197,7 @@ function zgopmt_init() {
 					$oid = json_decode($body);
 					$isvalid = $oid->{'authorized'};
 					break;
-	  			case 202:git 
+				case 202:
 					$body = wp_remote_retrieve_body($response );
 					$oid = json_decode($body);
 					break;
@ -235,34 +242,37 @@ function zgopmt_init() {
 				$body = wp_remote_retrieve_body( $response );
 				$oid = json_decode($body);
 				$zgoOrderid = $oid->{'order'};
+				$zgoOrderToken = $oid->{'token'};
 				// 
 				// Save ZGo Order ID and Cart order 
 				//
-					$sql = "replace into zgo_payments (" .
-					      "pmt_orderid," .
-					      "pmt_wc_order," .
-					      "pmt_wc_custname," .
-					      "pmt_accepted," .
-					      "pmt_confirmed," .
-					      "pmt_amount," .
-					      "pmt_rate," .
-					      "pmt_zec," .
-					      "pmt_wc_paid) values ('" .
-                    	  $zgoOrderid . "','" .
-                    	  $order_id . "','" .
-                    	  $order->get_billing_first_name() . " " . 
-                    	  $order->get_billing_last_name() . "','" .
-                       	  date('Y-m-d H:i:s') . "','',".
-                     	  $order->get_total() . 
-                     	  ",0,0,0)";
-                    $wpdb->query($sql);
+				$sql3 = $wpdb->prepare('replace into zgo_payments (pmt_orderid, pmt_wc_order, pmt_wc_custname, pmt_accepted, pmt_confirmed, pmt_amount, pmt_rate, pmt_zec, pmt_wc_paid) values (%s, %s, %s, %s, %s, %f, 0, 0, 0);',
+					$zgoOrderid, $order_id, $order->get_billing_first_name() . ' ' . $order->get_billing_last_name(), date('Y-m-d H:i:s'), '', $order->get_total());
+				//$sql = "replace into zgo_payments (" .
+				//"pmt_orderid," .
+				//"pmt_wc_order," .
+				//"pmt_wc_custname," .
+				//"pmt_accepted," .
+				//"pmt_confirmed," .
+				//"pmt_amount," .
+				//"pmt_rate," .
+				//"pmt_zec," .
+				//"pmt_wc_paid) values ('" .
+				//$zgoOrderid . "','" .
+				//$order_id . "','" .
+				//$order->get_billing_first_name() . " " . 
+				//$order->get_billing_last_name() . "','" .
+				//date('Y-m-d H:i:s') . "','',".
+				//$order->get_total() . 
+				//",0,0,0)";
+				$wpdb->query($sql3);

 				// Remove cart.
 				WC()->cart->empty_cart();

 				return array(
 					'result' => 'success',
-					    'redirect' => 'https://app.zgo.cash/invoice/' . $zgoOrderid,
+					'redirect' => 'https://app.zgo.cash/invoice/' . $zgoOrderid . '?token=' . $zgoOrderToken,
 				);
 				break;
 			case 202:
@ -279,53 +289,58 @@ function zgopmt_init() {
 		/**
 		 * Confirm payment and complete order
 		 */
-		public function zconfirm() {
+		//public function zconfirm() {

-	   		global $wpdb;
+			//global $wpdb;

-			$token = $_GET['token'];
-			$zgoOrderid =  $_GET['orderid'];
-			$orderid = $_GET['wc_orderid'];
-			$totalzec = $_GET['totalzec'];
-			$rate = $_GET['rate'];
-			$order = wc_get_order( $orderid );
+			//$token = $_GET['token'];
+			//$zgoOrderid =  $_GET['orderid'];
+			//$orderid = $_GET['wc_orderid'];
+			//$totalzec = $_GET['totalzec'];
+			//$rate = $_GET['rate'];
+			//$order = wc_get_order( $orderid );

-			$sql = "select * from zgo_payments where pmt_wc_order = '" . $orderid . "';";
-			$result = $wpdb->get_row($sql,OBJECT);
-			if ( ! is_null($result) ) {
+			//$sql = $wpdb->prepare('select * from zgo_payments where pmt_wc_order = %s ;', $orderid);
+			////$sql = "select * from zgo_payments where pmt_wc_order = '" . $orderid . "';";
+			//$result = $wpdb->get_row($sql,OBJECT);
+			//if ( ! is_null($result) ) {

-				if ( ( $token == $this->zgotoken )
-				     && ( $result->pmt_orderid == $zgoOrderid )
-				     && ( $result->pmt_wc_paid == '0' ) ) {      
-					switch ( $order->get_status() ) {
-						case 'pending':
-						case 'failed':
-							$order->payment_complete();
-							$order->reduce_order_stock();
-					      	// 
-					     	//  Mark order as completed in ZGo DB
-					      	//
-							$sql = "update zgo_payments set " .
-							   	"pmt_confirmed='" . date('Y-m-d H:i:s') . 
- 					      		"', pmt_rate=" . $rate . 
- 					      		", pmt_zec=" . $totalzec .
-							   	", pmt_wc_paid=1 " .
-							   	" where pmt_wc_order='" . $orderid . "';";
-		               		$wpdb->query($sql);	
+				//if ( ($token == $this->zgotoken )
+					//&& ( $result->pmt_orderid == $zgoOrderid )
+					//&& ( $result->pmt_wc_paid == '0' ) ) {      
+					//switch ( $order->get_status() ) {
+					//case 'pending':
+					//case 'failed':
+						//$order->payment_complete();
+						//$order->reduce_order_stock();
+						//// 
+						////  Mark order as completed in ZGo DB
+						////
+						////$sql = "update zgo_payments set " .
+						////"pmt_confirmed='" . date('Y-m-d H:i:s') . 
+						////"', pmt_rate=" . $rate . 
+						////", pmt_zec=" . $totalzec .
+						////", pmt_wc_paid=1 " .
+						////" where pmt_wc_order='" . $orderid . "';";
+						//$sql2 = $wpdb->prepare('update zgo_payments set pmt_confirmed = %s, pmt_rate = %f, pmt_zec = %f, pmt_wc_paid = 1 where pmt_wc_order = %s;', date('Y-m-d H:i:s'), $rate, $totalzec, $orderid );
+						//$wpdb->query($sql2);	

-							update_option('webhook_debug', $_GET);
-							break;
-						default:
-//						   $this->console_log('Order ' . $orderid . ' already paid or cancelled...');
-						   break;
-					} 
-				} else {
-//					$this->console_log('Invalid parameters...');
-				}
-			} else {
-//				$this->console_log('Database error...');
-			}	
-		}
+						//update_option('webhook_debug', $_GET);
+						//break;
+					//default:
+						////$this->console_log('Order ' . $orderid . ' already paid or cancelled...');
+						//return array("message" => 'Order ' . $orderid . ' already paid or cancelled...');
+						//break;
+					//} 
+				//} else {
+					////$this->console_log('Invalid parameters...');
+					//return array("message" => 'Invalid parameters...');
+				//}
+			//} else {
+				////$this->console_log('Database error...');
+				//return array("message" => 'Database error...');
+			//}	
+		//}

 		public function thankyou_page () {
 			if ( $description = $this->get_description() ) {
@ -346,6 +361,66 @@ function zgopmt_init() {
 			return $edata;
 		}

+		public function zgoapicallback($request) {
+			global $wpdb;
+
+			//$token = $_GET['token'];
+			//$zgoOrderid =  $_GET['orderid'];
+			//$orderid = $_GET['wc_orderid'];
+			//$totalzec = $_GET['totalzec'];
+			//$rate = $_GET['rate'];
+			$token = $request->get_param('token');
+			$zgoOrderid = $request->get_param('orderid');
+			$orderid = $request->get_param('wc_orderid');
+			$totalzec = $request->get_param('totalzec');
+			$rate = $request->get_param('rate');
+			$order = wc_get_order( $orderid );
+
+			$sql = $wpdb->prepare('select * from zgo_payments where pmt_wc_order = %s ;', $orderid);
+			//$sql = "select * from zgo_payments where pmt_wc_order = '" . $orderid . "';";
+			$result = $wpdb->get_row($sql,OBJECT);
+			if ( ! is_null($result) ) {
+
+				if ( (hash('sha256',$token) == hash('sha256',$this->zgotoken) )
+					&& ( $result->pmt_orderid == $zgoOrderid )
+					&& ( $result->pmt_wc_paid == '0' ) ) {      
+					switch ( $order->get_status() ) {
+					case 'pending':
+					case 'failed':
+						$order->payment_complete();
+						$order->reduce_order_stock();
+						// 
+						//  Mark order as completed in ZGo DB
+						//
+						//$sql = "update zgo_payments set " .
+						//"pmt_confirmed='" . date('Y-m-d H:i:s') . 
+						//"', pmt_rate=" . $rate . 
+						//", pmt_zec=" . $totalzec .
+						//", pmt_wc_paid=1 " .
+						//" where pmt_wc_order='" . $orderid . "';";
+						$sql2 = $wpdb->prepare('update zgo_payments set pmt_confirmed = %s, pmt_rate = %f, pmt_zec = %f, pmt_wc_paid = 1 where pmt_wc_order = %s;', date('Y-m-d H:i:s'), $rate, $totalzec, $orderid );
+						$wpdb->query($sql2);	
+
+						//update_option('webhook_debug', $_GET);
+						return array('message' => 'Order '. $orderid . ' mark as paid correctly.');
+						break;
+					default:
+						//$this->console_log('Order ' . $orderid . ' already paid or cancelled...');
+						return array("message" => 'Order ' . $orderid . ' already paid or cancelled...');
+						break;
+					} 
+				} else {
+					//$this->console_log('Invalid parameters...');
+					return array("message" => 'Invalid parameters...');
+				}
+			} else {
+				//$this->console_log('Database error...');
+				return array("message" => 'Database error...');
+			}	
+			//return array( 'custom' => 'Data', "request" => $data->get_params() );
+		}
+
+
 	}

 	add_filter( 'woocommerce_payment_gateways', 
@ -371,3 +446,67 @@ function zgopmtlist_plugin() {
 	$plugin->init();

 }
+
+function get_custom($data) {
+	global $wpdb;
+
+	//$token = $_GET['token'];
+	//$zgoOrderid =  $_GET['orderid'];
+	//$orderid = $_GET['wc_orderid'];
+	//$totalzec = $_GET['totalzec'];
+	//$rate = $_GET['rate'];
+	$token = $data->get_param('token');
+	$zgoOrderid = $data->get_param('orderid');
+	$orderid = $data->get_param('wc_orderid');
+	$totalzec = $data->get_param('totalzec');
+	$rate = $data->get_param('rate');
+	$order = wc_get_order( $orderid );
+
+	$sql = $wpdb->prepare('select * from zgo_payments where pmt_wc_order = %s ;', $orderid);
+	//$sql = "select * from zgo_payments where pmt_wc_order = '" . $orderid . "';";
+	$result = $wpdb->get_row($sql,OBJECT);
+	if ( ! is_null($result) ) {
+
+		if ( ($token == $this->zgotoken )
+			&& ( $result->pmt_orderid == $zgoOrderid )
+			&& ( $result->pmt_wc_paid == '0' ) ) {      
+			switch ( $order->get_status() ) {
+			case 'pending':
+			case 'failed':
+				$order->payment_complete();
+				$order->reduce_order_stock();
+				// 
+				//  Mark order as completed in ZGo DB
+				//
+				//$sql = "update zgo_payments set " .
+				//"pmt_confirmed='" . date('Y-m-d H:i:s') . 
+				//"', pmt_rate=" . $rate . 
+				//", pmt_zec=" . $totalzec .
+				//", pmt_wc_paid=1 " .
+				//" where pmt_wc_order='" . $orderid . "';";
+				$sql2 = $wpdb->prepare('update zgo_payments set pmt_confirmed = %s, pmt_rate = %f, pmt_zec = %f, pmt_wc_paid = 1 where pmt_wc_order = %s;', date('Y-m-d H:i:s'), $rate, $totalzec, $orderid );
+				$wpdb->query($sql2);	
+
+				//update_option('webhook_debug', $_GET);
+				break;
+			default:
+				//$this->console_log('Order ' . $orderid . ' already paid or cancelled...');
+				return array("message" => 'Order ' . $orderid . ' already paid or cancelled...');
+				break;
+			} 
+		} else {
+			//$this->console_log('Invalid parameters...');
+			return array("message" => 'Invalid parameters...');
+		}
+	} else {
+		//$this->console_log('Database error...');
+		return array("message" => 'Database error...');
+	}	
+	//return array( 'custom' => 'Data', "request" => $data->get_params() );
+}
+
+function plugin_register_rest_apis() {
+	$zgoPlugin = new WC_ZGopmt_Gateway();
+	$zgoPlugin->register_routes();
+}
+add_action( 'rest_api_init', 'plugin_register_rest_apis');
Author	SHA1	Message	Date
Rene Vergara	a82ef3c2ca	Version update	2023-10-26 15:09:50 -05:00
pitmutt	23d31d8bec	Merge pull request 'Fix Bugs C,D,E from auditing report' (#2 ) from rev0919 into main Reviewed-on: #2	2023-10-26 18:57:48 +00:00
Rene V. Vergara A.	ab08d12f2b	Fix Bugs C,D,E from auditing report	2023-09-19 16:58:49 -05:00
Rene Vergara	e7655b2af1	Merge branch 'hotfix1'	2023-07-20 13:51:57 -05:00
Rene Vergara	9d1d9cc5ae	Fix typo in API call	2023-07-20 13:51:12 -05:00
Rene Vergara	15584ca7b1	Production release	2023-06-26 10:42:37 -05:00
Rene Vergara	640911a1e2	Merge branch 'security1'	2023-06-26 10:33:45 -05:00
Rene Vergara	3dd59c757f	Implement new API callback	2023-06-26 10:09:30 -05:00
Rene Vergara	53466a6788	Debug callback	2023-06-24 20:54:34 -05:00
Rene Vergara	46fc016dc7	Format code	2023-06-23 11:49:12 -05:00
Rene Vergara	1768f700bb	Update ZGo API call to new security parameters	2023-06-23 11:08:17 -05:00
Rene Vergara	244a2cc80e	Prepare for test server	2023-06-23 10:54:52 -05:00
Rene Vergara	2e8aaa1f1a	Fix code for deployment	2023-06-23 10:23:52 -05:00
Rene Vergara	08690a29a5	Remove XSS vulnerabilities	2023-06-23 09:29:08 -05:00
Rene Vergara	0dd89a0e7f	Harden plugin against SQL injection	2023-06-23 09:09:25 -05:00