Apply latest fixes for 4.1.0 release

Author: Dinamiko

modules/ppcp-api-client/src/Authentication/PayPalBearer.php

@@ -189,11 +189,17 @@ private function newBearer(): Token {
 			$status_code = is_wp_error( $response ) ? 0 : (int) wp_remote_retrieve_response_code( $response );
 			$this->rate_limiter->register_failure( self::RATE_LIMIT_SCOPE, $status_code, $response );
 
-			$error = new RuntimeException( 'Could not create token.' );
+			$error    = new RuntimeException( 'Could not create token.' );
+			$log_args = $args;
+			foreach ( array_keys( $log_args['headers'] ) as $header_name ) {
+				if ( preg_match( '/authorization|signature/i', $header_name ) ) {
+					$log_args['headers'][ $header_name ] = '[REDACTED]';
+				}
+			}
 			$this->logger->warning(
 				$error->getMessage(),
 				array(
-					'args'     => $args,
+					'args'     => $log_args,
 					'response' => $response,
 				)
 			);

modules/ppcp-api-client/src/Endpoint/LoginSeller.php

@@ -141,8 +141,8 @@ private function generate_token_for(
 		string $seller_nonce
 	): string {
 
-		$url      = trailingslashit( $this->host ) . 'v1/oauth2/token/';
-		$args     = array(
+		$url  = trailingslashit( $this->host ) . 'v1/oauth2/token/';
+		$args = array(
 			'method'  => 'POST',
 			'headers' => array(
 				// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode

modules/ppcp-api-client/src/Repository/PartnerReferralsData.php

@@ -30,15 +30,6 @@ public function __construct( DccApplies $dcc_applies, FeaturesDefinition $featur
 		$this->features_definition = $features_definition;
 	}
 
-	/**
-	 * Returns a nonce.
-	 *
-	 * @return string
-	 */
-	public function nonce(): string {
-		return 'a1233wtergfsdt4365tzrshgfbaewa36AGa1233wtergfsdt4365tzrshgfbaewa36AG';
-	}
-
 	/**
 	 * Returns the data.
 	 *
@@ -47,13 +38,15 @@ public function nonce(): string {
 	 * @param string   $onboarding_token  A security token to finalize the onboarding process.
 	 * @param bool     $use_subscriptions If the merchant requires subscription features.
 	 * @param bool     $use_card_payments If the merchant wants to process credit card payments.
+	 * @param string   $seller_nonce      The PKCE code_verifier for the OAuth flow.
 	 * @return array
 	 */
 	public function data(
 		array $products = array(),
 		string $onboarding_token = '',
 		?bool $use_subscriptions = null,
-		bool $use_card_payments = true
+		bool $use_card_payments = true,
+		string $seller_nonce = ''
 	): array {
 		$in_acdc_country = $this->dcc_applies->for_country_currency(); // @phpstan-ignore property.deprecated
 
@@ -129,7 +122,7 @@ public function data(
 							'integration_type'    => 'FIRST_PARTY',
 							'first_party_details' => array(
 								'features'     => $first_party_features,
-								'seller_nonce' => $this->nonce(),
+								'seller_nonce' => $seller_nonce,
 							),
 						),
 					),

modules/ppcp-axo/src/Gateway/AxoGateway.php

@@ -296,6 +296,7 @@ public function process_payment( $order_id ) {
 			}
 		} catch ( Exception $exception ) {
 			$this->logger->error( '[AXO] Payment processing failed: ' . $exception->getMessage() );
+
 			return array(
 				'result'  => 'failure',
 				'message' => $this->get_user_friendly_error_message( $exception ),
@@ -330,6 +331,47 @@ protected function process_3ds_return( WC_Order $wc_order, string $token ): arra
 				);
 			}
 
+			$purchase_units = $paypal_order->purchase_units();
+			$purchase_unit  = $purchase_units[0] ?? null;
+
+			if ( null === $purchase_unit ) {
+				$this->logger->error(
+					sprintf(
+						'[AXO] 3DS return validation failed: PayPal order has no purchase units. WC order ID: %s',
+						$wc_order->get_id(),
+					)
+				);
+
+				return array(
+					'result'  => 'failure',
+					'message' => __( 'Payment validation failed. Please try again.', 'woocommerce-paypal-payments' ),
+				);
+			}
+
+			/*
+			 * If the custom_id === order_id condition is true, we know that the PayPal order
+			 * and our WC order match, and there's no need for other checks.
+			 *
+			 * Specifically, we do not compare the WC_Order total amount against the
+			 * purchase unit's value, as the PU value can deviate from the WC order total, which
+			 * might reject legitimate payments.
+			 */
+			if ( $purchase_unit->custom_id() !== (string) $wc_order->get_id() ) {
+				$this->logger->error(
+					sprintf(
+						'[AXO] 3DS return validation failed: custom_id mismatch. Token: %s, WC order ID: %s, PayPal custom_id: %s',
+						$token,
+						$wc_order->get_id(),
+						$purchase_unit->custom_id()
+					)
+				);
+
+				return array(
+					'result'  => 'failure',
+					'message' => __( 'Payment validation failed. Please try again.', 'woocommerce-paypal-payments' ),
+				);
+			}
+
 			/**
 			 * This filter controls if the method 'process()' from OrderProcessor will be called.
 			 * So you can implement your own for example on subscriptions
@@ -344,6 +386,7 @@ protected function process_3ds_return( WC_Order $wc_order, string $token ): arra
 			}
 		} catch ( Exception $exception ) {
 			$this->logger->error( '[AXO] 3DS return processing failed: ' . $exception->getMessage() );
+
 			return array(
 				'result'  => 'failure',
 				'message' => $this->get_user_friendly_error_message( $exception ),
@@ -453,7 +496,7 @@ protected function build_payment_source_properties( string $payment_token ): obj
 			'single_use_token' => $payment_token,
 		);
 
-			$three_d_secure = $this->settings_model->get_three_d_secure_enum();
+		$three_d_secure = $this->settings_model->get_three_d_secure_enum();
 
 		if ( 'SCA_ALWAYS' === $three_d_secure || 'SCA_WHEN_REQUIRED' === $three_d_secure ) {
 			$properties['attributes'] = array(
@@ -482,7 +525,7 @@ protected function build_order_data(): array {
 
 		$data['experience_context'] = $experience_context->to_array();
 
-			$three_d_secure = $this->settings_model->get_three_d_secure_enum();
+		$three_d_secure = $this->settings_model->get_three_d_secure_enum();
 
 		if ( $three_d_secure === 'SCA_ALWAYS' || $three_d_secure === 'SCA_WHEN_REQUIRED' ) {
 			$data['transaction_context'] = array(

modules/ppcp-blocks/resources/js/paypal-config.js

@@ -193,6 +193,7 @@ export const createSubscription = async ( data, actions, config ) => {
 
 	return actions.subscription.create( {
 		plan_id: planId,
+		custom_id: config.scriptData.subscription_custom_id,
 	} );
 };
 

modules/ppcp-button/resources/js/modules/ActionHandler/CartActionHandler.js

@@ -14,6 +14,7 @@ class CartActionHandler {
 			createSubscription: ( data, actions ) => {
 				return actions.subscription.create( {
 					plan_id: subscriptionPlanId,
+					custom_id: this.config.subscription_custom_id,
 				} );
 			},
 			onApprove: ( data ) => {

modules/ppcp-button/resources/js/modules/ActionHandler/CheckoutActionHandler.js

@@ -23,6 +23,7 @@ class CheckoutActionHandler {
 
 				return actions.subscription.create( {
 					plan_id: subscription_plan_id,
+					custom_id: this.config.subscription_custom_id,
 				} );
 			},
 			onApprove: ( data, actions ) => {

modules/ppcp-button/resources/js/modules/ActionHandler/SingleProductActionHandler.js

@@ -21,6 +21,7 @@ class SingleProductActionHandler {
 			createSubscription: ( data, actions ) => {
 				return actions.subscription.create( {
 					plan_id: subscription_plan,
+					custom_id: this.config.subscription_custom_id,
 				} );
 			},
 			onApprove: ( data, actions ) => {

modules/ppcp-button/src/Assets/SmartButton.php

@@ -16,6 +16,7 @@
 use WC_Product;
 use WC_Product_Variable;
 use WC_Product_Variation;
+use WC_Session_Handler;
 use WooCommerce\PayPalCommerce\ApiClient\Entity\Money;
 use WooCommerce\PayPalCommerce\ApiClient\Factory\PayerFactory;
 use WooCommerce\PayPalCommerce\ApiClient\Helper\CurrencyGetter;
@@ -53,6 +54,7 @@
 use WooCommerce\PayPalCommerce\Settings\Data\SettingsProvider;
 use WooCommerce\PayPalCommerce\WcSubscriptions\FreeTrialHandlerTrait;
 use WooCommerce\PayPalCommerce\WcSubscriptions\Helper\SubscriptionHelper;
+use WooCommerce\PayPalCommerce\Webhooks\CustomIds;
 
 /**
  * Class SmartButton
@@ -995,6 +997,26 @@ private function need_shipping(): bool {
 	 *
 	 * @return array
 	 */
+	/**
+	 * The session-bound custom_id used to tie a PayPal subscription/order to the
+	 * current shopper. Mirrors the value stamped on cart orders by
+	 * PurchaseUnitFactory::from_wc_cart(); both must stay in sync so that
+	 * ApproveSubscriptionEndpoint can validate ownership on approval.
+	 *
+	 * @return string
+	 */
+	private function subscription_custom_id(): string {
+		$session = WC()->session;
+		if ( $session instanceof WC_Session_Handler ) {
+			$session_id = $session->get_customer_unique_id();
+			if ( $session_id ) {
+				return CustomIds::CUSTOMER_ID_PREFIX . $session_id;
+			}
+		}
+
+		return '';
+	}
+
 	public function script_data(): array {
 		$is_free_trial_cart = $this->is_free_trial_cart();
 		$is_acdc_enabled    = $this->dcc_configuration->is_acdc_enabled();
@@ -1085,6 +1107,7 @@ public function script_data(): array {
 			),
 			'cart_contains_subscription'              => $this->subscription_helper->cart_contains_subscription(),
 			'subscription_plan_id'                    => $this->subscription_helper->paypal_subscription_id(),
+			'subscription_custom_id'                  => $this->subscription_custom_id(),
 			'variable_paypal_subscription_variations' => $this->subscription_helper->variable_paypal_subscription_variations(),
 			'variable_paypal_subscription_variation_from_cart' => $this->subscription_helper->paypal_subscription_variation_from_cart(),
 			'subscription_product_allowed'            => $this->subscription_helper->checkout_subscription_product_allowed(),

modules/ppcp-button/src/Endpoint/ApproveOrderEndpoint.php

@@ -27,6 +27,7 @@
 use WooCommerce\PayPalCommerce\WcGateway\Gateway\PayPalGateway;
 use WooCommerce\PayPalCommerce\Settings\Data\SettingsProvider;
 use WooCommerce\PayPalCommerce\Settings\Data\SettingsModel;
+use WooCommerce\PayPalCommerce\Webhooks\CustomIds;
 
 /**
  * Class ApproveOrderEndpoint
@@ -188,6 +189,24 @@ public function handle_request(): void {
 
 			$order = $this->api_endpoint->order( $data['order_id'] );
 
+			$purchase_units = $order->purchase_units();
+			if ( ! empty( $purchase_units ) ) {
+				$custom_id  = $purchase_units[0]->custom_id();
+				$prefix_len = strlen( CustomIds::CUSTOMER_ID_PREFIX );
+				if ( strpos( $custom_id, CustomIds::CUSTOMER_ID_PREFIX ) === 0 ) {
+					$order_session_id = substr( $custom_id, $prefix_len );
+					$wc_session       = WC()->session;
+					if ( $wc_session instanceof \WC_Session_Handler ) {
+						$current_session_id = (string) $wc_session->get_customer_unique_id();
+						if ( $order_session_id !== $current_session_id ) {
+							throw new RuntimeException(
+								__( 'Order validation failed.', 'woocommerce-paypal-payments' )
+							);
+						}
+					}
+				}
+			}
+
 			$payment_source = $order->payment_source();
 
 			if ( $payment_source && $payment_source->name() === 'card' ) {