<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WPForms\Integrations\Stripe\Admin;

[2] Fix | Delete

[3] Fix | Delete

use WPForms\Integrations\Stripe\Api\DomainManager;

[4] Fix | Delete

use WPForms\Integrations\Stripe\Api\WebhooksManager;

[5] Fix | Delete

use WPForms\Integrations\Stripe\Helpers;

[6] Fix | Delete

use WPForms\Vendor\Stripe\Account;

[7] Fix | Delete

[8] Fix | Delete

/**

[9] Fix | Delete

* Stripe Connect functionality.

[10] Fix | Delete

*

[11] Fix | Delete

* @since 1.8.2

[12] Fix | Delete

*/

[13] Fix | Delete

class Connect {

[14] Fix | Delete

[15] Fix | Delete

/**

[16] Fix | Delete

* WPForms Stripe OAuth URL.

[17] Fix | Delete

*

[18] Fix | Delete

* @since 1.8.2

[19] Fix | Delete

*/

[20] Fix | Delete

const WPFORMS_URL = 'https://wpforms.com/oauth/stripe-connect';

[21] Fix | Delete

[22] Fix | Delete

/**

[23] Fix | Delete

* Stripe live/test account objects.

[24] Fix | Delete

*

[25] Fix | Delete

* @since 1.8.2

[26] Fix | Delete

*

[27] Fix | Delete

* @var array

[28] Fix | Delete

*/

[29] Fix | Delete

protected $accounts = [];

[30] Fix | Delete

[31] Fix | Delete

/**

[32] Fix | Delete

* Webhooks manager.

[33] Fix | Delete

*

[34] Fix | Delete

* @since 1.8.4

[35] Fix | Delete

*

[36] Fix | Delete

* @var WebhooksManager

[37] Fix | Delete

*/

[38] Fix | Delete

private $webhooks_manager;

[39] Fix | Delete

[40] Fix | Delete

/**

[41] Fix | Delete

* Domain manager.

[42] Fix | Delete

*

[43] Fix | Delete

* @since 1.8.6

[44] Fix | Delete

*

[45] Fix | Delete

* @var DomainManager

[46] Fix | Delete

*/

[47] Fix | Delete

private $domain_manager;

[48] Fix | Delete

[49] Fix | Delete

/**

[50] Fix | Delete

* Initialize.

[51] Fix | Delete

*

[52] Fix | Delete

* @since 1.8.2

[53] Fix | Delete

*

[54] Fix | Delete

* @return Connect

[55] Fix | Delete

*/

[56] Fix | Delete

public function init() {

[57] Fix | Delete

[58] Fix | Delete

$this->webhooks_manager = new WebhooksManager();

[59] Fix | Delete

$this->domain_manager = new DomainManager();

[60] Fix | Delete

[61] Fix | Delete

$this->hooks();

[62] Fix | Delete

[63] Fix | Delete

return $this;

[64] Fix | Delete

}

[65] Fix | Delete

[66] Fix | Delete

/**

[67] Fix | Delete

* Hooks.

[68] Fix | Delete

*

[69] Fix | Delete

* @since 1.8.2

[70] Fix | Delete

*/

[71] Fix | Delete

private function hooks() {

[72] Fix | Delete

[73] Fix | Delete

add_action( 'admin_init', [ $this, 'handle_oauth_handshake' ] );

[74] Fix | Delete

}

[75] Fix | Delete

[76] Fix | Delete

/**

[77] Fix | Delete

* Handle Stripe Connect OAuth handshake and save Stripe keys.

[78] Fix | Delete

*

[79] Fix | Delete

* @since 1.8.2

[80] Fix | Delete

*/

[81] Fix | Delete

public function handle_oauth_handshake() {

[82] Fix | Delete

[83] Fix | Delete

if ( ! wpforms_current_user_can() || ! isset( $_GET['stripe_connect'] ) || $_GET['stripe_connect'] !== 'complete' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended

[84] Fix | Delete

return;

[85] Fix | Delete

}

[86] Fix | Delete

[87] Fix | Delete

$state = isset( $_GET['state'] ) ? sanitize_text_field( wp_unslash( $_GET['state'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended

[88] Fix | Delete

[89] Fix | Delete

if ( empty( $state ) ) {

[90] Fix | Delete

return;

[91] Fix | Delete

}

[92] Fix | Delete

[93] Fix | Delete

$credentials = $this->fetch_stripe_credentials( $state );

[94] Fix | Delete

$required_keys = [ 'stripe_user_id', 'stripe_publishable_key', 'access_token', 'refresh_token', 'live_mode' ];

[95] Fix | Delete

[96] Fix | Delete

if ( 0 !== count( array_diff( $required_keys, array_keys( $credentials ) ) ) ) {

[97] Fix | Delete

return;

[98] Fix | Delete

}

[99] Fix | Delete

[100] Fix | Delete

$mode = empty( $credentials['live_mode'] ) ? 'test' : 'live';

[101] Fix | Delete

[102] Fix | Delete

$this->set_connected_user_id( $credentials['stripe_user_id'], $mode );

[103] Fix | Delete

$this->set_current_mode( $mode );

[104] Fix | Delete

[105] Fix | Delete

// In case of switching accounts existing account data needs to be cleared.

[106] Fix | Delete

unset( $this->accounts[ $mode ] );

[107] Fix | Delete

[108] Fix | Delete

Helpers::set_stripe_key( $credentials['stripe_publishable_key'], 'publishable', $mode );

[109] Fix | Delete

Helpers::set_stripe_key( $credentials['access_token'], 'secret', $mode );

[110] Fix | Delete

[111] Fix | Delete

$this->update_account_meta( $credentials['stripe_user_id'], $mode );

[112] Fix | Delete

$this->set_connected_account_country( $mode );

[113] Fix | Delete

$this->webhooks_manager->connect();

[114] Fix | Delete

$this->domain_manager->validate();

[115] Fix | Delete

[116] Fix | Delete

$settings_url = $this->get_payments_settings_url();

[117] Fix | Delete

[118] Fix | Delete

wp_safe_redirect( $settings_url );

[119] Fix | Delete

exit;

[120] Fix | Delete

}

[121] Fix | Delete

[122] Fix | Delete

/**

[123] Fix | Delete

* Fetch Stripe credentials from https://wpforms.com.

[124] Fix | Delete

*

[125] Fix | Delete

* @since 1.8.2

[126] Fix | Delete

*

[127] Fix | Delete

* @param string $state Anonymous autogenerated ID to safely fetch Stripe credentials.

[128] Fix | Delete

*

[129] Fix | Delete

* @return array

[130] Fix | Delete

*/

[131] Fix | Delete

protected function fetch_stripe_credentials( $state ) {

[132] Fix | Delete

[133] Fix | Delete

$response = wp_remote_post(

[134] Fix | Delete

self::WPFORMS_URL,

[135] Fix | Delete

[

[136] Fix | Delete

'body' => [

[137] Fix | Delete

'action' => 'credentials',

[138] Fix | Delete

'state' => $state,

[139] Fix | Delete

],

[140] Fix | Delete

]

[141] Fix | Delete

);

[142] Fix | Delete

[143] Fix | Delete

if ( is_wp_error( $response ) ) {

[144] Fix | Delete

return [];

[145] Fix | Delete

}

[146] Fix | Delete

[147] Fix | Delete

$body = wpforms_json_decode( wp_remote_retrieve_body( $response ), true );

[148] Fix | Delete

[149] Fix | Delete

return is_array( $body ) ? $body : [];

[150] Fix | Delete

}

[151] Fix | Delete

[152] Fix | Delete

/**

[153] Fix | Delete

* Fetch Stripe Account from Stripe.

[154] Fix | Delete

*

[155] Fix | Delete

* @since 1.8.2

[156] Fix | Delete

*

[157] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[158] Fix | Delete

*

[159] Fix | Delete

* @return null|Account

[160] Fix | Delete

*/

[161] Fix | Delete

protected function fetch_stripe_account( $mode = '' ) {

[162] Fix | Delete

[163] Fix | Delete

$api_key = Helpers::get_stripe_key( 'secret', $mode );

[164] Fix | Delete

[165] Fix | Delete

if ( ! $api_key ) {

[166] Fix | Delete

return null;

[167] Fix | Delete

}

[168] Fix | Delete

[169] Fix | Delete

try {

[170] Fix | Delete

$account = Account::retrieve( null, sanitize_text_field( $api_key ) );

[171] Fix | Delete

} catch ( \Exception $e ) {

[172] Fix | Delete

$account = null;

[173] Fix | Delete

}

[174] Fix | Delete

[175] Fix | Delete

return $account;

[176] Fix | Delete

}

[177] Fix | Delete

[178] Fix | Delete

/**

[179] Fix | Delete

* Update connected account meta.

[180] Fix | Delete

*

[181] Fix | Delete

* @since 1.8.2

[182] Fix | Delete

*

[183] Fix | Delete

* @param string $account_id Account ID.

[184] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[185] Fix | Delete

*/

[186] Fix | Delete

public function update_account_meta( $account_id = '', $mode = '' ) {

[187] Fix | Delete

[188] Fix | Delete

if ( ! $mode ) {

[189] Fix | Delete

$mode = Helpers::get_stripe_mode();

[190] Fix | Delete

}

[191] Fix | Delete

[192] Fix | Delete

// Stripe API has limited update method for live accounts only.

[193] Fix | Delete

if ( $mode !== 'live' ) {

[194] Fix | Delete

return;

[195] Fix | Delete

}

[196] Fix | Delete

[197] Fix | Delete

if ( ! $account_id ) {

[198] Fix | Delete

$account_id = $this->get_connected_user_id( $mode );

[199] Fix | Delete

}

[200] Fix | Delete

[201] Fix | Delete

// Return early if no connected account.

[202] Fix | Delete

if ( ! $account_id ) {

[203] Fix | Delete

return;

[204] Fix | Delete

}

[205] Fix | Delete

[206] Fix | Delete

$licence_type = wpforms_get_license_type();

[207] Fix | Delete

[208] Fix | Delete

$metadata = [

[209] Fix | Delete

'wpforms_stripe' => Helpers::is_addon_active() ? 'addon' : 'core',

[210] Fix | Delete

'wpforms_type' => wpforms()->is_pro() ? 'pro' : 'lite',

[211] Fix | Delete

'wpforms_license' => $licence_type ? $licence_type : 'lite',

[212] Fix | Delete

];

[213] Fix | Delete

[214] Fix | Delete

try {

[215] Fix | Delete

Account::update( $account_id, [ 'metadata' => $metadata ], Helpers::get_auth_opts() );

[216] Fix | Delete

} catch ( \Exception $e ) {

[217] Fix | Delete

wpforms_log(

[218] Fix | Delete

'Unable to update connected Stripe account meta.',

[219] Fix | Delete

$e->getMessage(),

[220] Fix | Delete

[

[221] Fix | Delete

'type' => [ 'payment', 'error' ],

[222] Fix | Delete

]

[223] Fix | Delete

);

[224] Fix | Delete

}

[225] Fix | Delete

}

[226] Fix | Delete

[227] Fix | Delete

/**

[228] Fix | Delete

* Generate random alphanumeric token string.

[229] Fix | Delete

* Token length is always 32 chars.

[230] Fix | Delete

*

[231] Fix | Delete

* @since 1.8.2

[232] Fix | Delete

*

[233] Fix | Delete

* @return string

[234] Fix | Delete

*/

[235] Fix | Delete

public function generate_random_token() {

[236] Fix | Delete

[237] Fix | Delete

$random = false;

[238] Fix | Delete

[239] Fix | Delete

if ( function_exists( 'openssl_random_pseudo_bytes' ) ) {

[240] Fix | Delete

$strong_result = false; // This has been added as argument #2 ($strong_result) cannot be passed by reference.

[241] Fix | Delete

$random = openssl_random_pseudo_bytes( 16, $strong_result );

[242] Fix | Delete

}

[243] Fix | Delete

[244] Fix | Delete

if ( $random === false ) {

[245] Fix | Delete

return md5( wp_rand() );

[246] Fix | Delete

}

[247] Fix | Delete

[248] Fix | Delete

return bin2hex( $random );

[249] Fix | Delete

}

[250] Fix | Delete

[251] Fix | Delete

/**

[252] Fix | Delete

* Set fetched Stripe Account for caching purposes.

[253] Fix | Delete

*

[254] Fix | Delete

* @since 1.8.2

[255] Fix | Delete

*

[256] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[257] Fix | Delete

*/

[258] Fix | Delete

protected function set_connected_account( $mode = '' ) {

[259] Fix | Delete

[260] Fix | Delete

$user_id = $this->get_connected_user_id( $mode );

[261] Fix | Delete

[262] Fix | Delete

if ( ! $user_id ) {

[263] Fix | Delete

return;

[264] Fix | Delete

}

[265] Fix | Delete

[266] Fix | Delete

$account = $this->fetch_stripe_account( $mode );

[267] Fix | Delete

$this->accounts[ $mode ] = null;

[268] Fix | Delete

[269] Fix | Delete

if ( ! isset( $account->id ) || $account->id !== $user_id ) {

[270] Fix | Delete

return;

[271] Fix | Delete

}

[272] Fix | Delete

[273] Fix | Delete

$this->accounts[ $mode ] = $account;

[274] Fix | Delete

}

[275] Fix | Delete

[276] Fix | Delete

/**

[277] Fix | Delete

* Get cached Stripe Account or fetch it from Stripe.

[278] Fix | Delete

*

[279] Fix | Delete

* @since 1.8.2

[280] Fix | Delete

*

[281] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[282] Fix | Delete

*

[283] Fix | Delete

* @return null|Account

[284] Fix | Delete

*/

[285] Fix | Delete

public function get_connected_account( $mode = '' ) {

[286] Fix | Delete

[287] Fix | Delete

$mode = Helpers::validate_stripe_mode( $mode );

[288] Fix | Delete

[289] Fix | Delete

if ( empty( $this->accounts ) || ( is_array( $this->accounts ) && ! array_key_exists( $mode, $this->accounts ) ) ) {

[290] Fix | Delete

$this->set_connected_account( $mode );

[291] Fix | Delete

}

[292] Fix | Delete

[293] Fix | Delete

if ( ! empty( $this->accounts[ $mode ] ) ) {

[294] Fix | Delete

return $this->accounts[ $mode ];

[295] Fix | Delete

}

[296] Fix | Delete

[297] Fix | Delete

return null;

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

/**

[301] Fix | Delete

* Save connected user id to an option.

[302] Fix | Delete

*

[303] Fix | Delete

* @since 1.8.2

[304] Fix | Delete

*

[305] Fix | Delete

* @param string $user_id User id to set.

[306] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[307] Fix | Delete

*

[308] Fix | Delete

* @return bool

[309] Fix | Delete

*/

[310] Fix | Delete

protected function set_connected_user_id( $user_id, $mode = '' ) {

[311] Fix | Delete

[312] Fix | Delete

$mode = Helpers::validate_stripe_mode( $mode );

[313] Fix | Delete

[314] Fix | Delete

return update_option( "wpforms_stripe_{$mode}_connect_user_id", sanitize_text_field( $user_id ) );

[315] Fix | Delete

}

[316] Fix | Delete

[317] Fix | Delete

/**

[318] Fix | Delete

* Get saved Stripe Connect user id from DB.

[319] Fix | Delete

*

[320] Fix | Delete

* @since 1.8.2

[321] Fix | Delete

*

[322] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[323] Fix | Delete

*

[324] Fix | Delete

* @return string

[325] Fix | Delete

*/

[326] Fix | Delete

public function get_connected_user_id( $mode = '' ) {

[327] Fix | Delete

[328] Fix | Delete

$mode = Helpers::validate_stripe_mode( $mode );

[329] Fix | Delete

$user_id = get_option( "wpforms_stripe_{$mode}_connect_user_id", '' );

[330] Fix | Delete

[331] Fix | Delete

/**

[332] Fix | Delete

* User ID associated with the Stripe account.

[333] Fix | Delete

*

[334] Fix | Delete

* @since 1.8.2

[335] Fix | Delete

*

[336] Fix | Delete

* @param string $user_id User ID.

[337] Fix | Delete

*/

[338] Fix | Delete

return (string) apply_filters( 'wpforms_stripe_admin_connect_get_connected_user_id', $user_id ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName

[339] Fix | Delete

}

[340] Fix | Delete

[341] Fix | Delete

/**

[342] Fix | Delete

* Get Stripe Account name.

[343] Fix | Delete

*

[344] Fix | Delete

* @since 1.8.2

[345] Fix | Delete

*

[346] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[347] Fix | Delete

*

[348] Fix | Delete

* @return string

[349] Fix | Delete

*/

[350] Fix | Delete

public function get_connected_account_name( $mode = '' ) {

[351] Fix | Delete

[352] Fix | Delete

$account = $this->get_connected_account( $mode );

[353] Fix | Delete

[354] Fix | Delete

if ( isset( $account->display_name ) ) {

[355] Fix | Delete

return $account->display_name;

[356] Fix | Delete

}

[357] Fix | Delete

[358] Fix | Delete

if ( isset( $account->settings, $account->settings->dashboard->display_name ) ) {

[359] Fix | Delete

return $account->settings->dashboard->display_name;

[360] Fix | Delete

}

[361] Fix | Delete

[362] Fix | Delete

return '';

[363] Fix | Delete

}

[364] Fix | Delete

[365] Fix | Delete

/**

[366] Fix | Delete

* Set Stripe mode.

[367] Fix | Delete

*

[368] Fix | Delete

* @since 1.8.4

[369] Fix | Delete

*

[370] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[371] Fix | Delete

*/

[372] Fix | Delete

private function set_current_mode( $mode ) {

[373] Fix | Delete

[374] Fix | Delete

$key = 'stripe-test-mode';

[375] Fix | Delete

$settings = (array) get_option( 'wpforms_settings', [] );

[376] Fix | Delete

$settings[ $key ] = $mode === 'test';

[377] Fix | Delete

[378] Fix | Delete

update_option( 'wpforms_settings', $settings );

[379] Fix | Delete

}

[380] Fix | Delete

[381] Fix | Delete

/**

[382] Fix | Delete

* Set Stripe Account country.

[383] Fix | Delete

*

[384] Fix | Delete

* @since 1.8.2

[385] Fix | Delete

*

[386] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[387] Fix | Delete

*/

[388] Fix | Delete

private function set_connected_account_country( $mode = '' ) {

[389] Fix | Delete

[390] Fix | Delete

$account = $this->get_connected_account( $mode );

[391] Fix | Delete

[392] Fix | Delete

if ( ! isset( $account->country ) ) {

[393] Fix | Delete

return;

[394] Fix | Delete

}

[395] Fix | Delete

[396] Fix | Delete

update_option( "wpforms_stripe_{$mode}_account_country", strtolower( $account->country ) );

[397] Fix | Delete

}

[398] Fix | Delete

[399] Fix | Delete

/**

[400] Fix | Delete

* Get Stripe Connect button URL.

[401] Fix | Delete

*

[402] Fix | Delete

* @since 1.8.2

[403] Fix | Delete

*

[404] Fix | Delete

* @param string $mode Stripe mode (e.g. 'live' or 'test').

[405] Fix | Delete

*

[406] Fix | Delete

* @return string

[407] Fix | Delete

*/

[408] Fix | Delete

public function get_connect_with_stripe_url( $mode = '' ) {

[409] Fix | Delete

[410] Fix | Delete

$mode = Helpers::validate_stripe_mode( $mode );

[411] Fix | Delete

$settings_url = $this->get_payments_settings_url();

[412] Fix | Delete

[413] Fix | Delete

return add_query_arg(

[414] Fix | Delete

[

[415] Fix | Delete

'action' => 'init',

[416] Fix | Delete

'live_mode' => absint( $mode === 'live' ),

[417] Fix | Delete

'state' => $this->generate_random_token(),

[418] Fix | Delete

'site_url' => rawurlencode( $settings_url ),

[419] Fix | Delete

],

[420] Fix | Delete

self::WPFORMS_URL

[421] Fix | Delete

);

[422] Fix | Delete

}

[423] Fix | Delete

[424] Fix | Delete

/**

[425] Fix | Delete

* Get "Payments" settings page URL.

[426] Fix | Delete

*

[427] Fix | Delete

* @since 1.8.2

[428] Fix | Delete

*

[429] Fix | Delete

* @return string

[430] Fix | Delete

*/

[431] Fix | Delete

private function get_payments_settings_url() {

[432] Fix | Delete

[433] Fix | Delete

return add_query_arg(

[434] Fix | Delete

[

[435] Fix | Delete

'page' => 'wpforms-settings',

[436] Fix | Delete

'view' => 'payments',

[437] Fix | Delete

],

[438] Fix | Delete

admin_url( 'admin.php' )

[439] Fix | Delete

);

[440] Fix | Delete

}

[441] Fix | Delete

}

[442] Fix | Delete

[443] Fix | Delete