Changeset 3649832

Timestamp:

08/16/2026 02:37:02 PM (2 months ago)

Author:

theritesites

Message:

1.5.5 - trademark-compliant display name, i18n fix, PHP 8.1 deprecation fix, security hardening (defense in depth, no vulnerability found)

Location:

woo-cost-of-shipping/trunk

Files:

• README.txt (modified) (3 diffs)
• assets/README.md (deleted)
• assets/js/woocommerce-cost-of-shipping.js (modified) (1 diff)
• assets/repo (deleted)
• includes/README.md (deleted)
• includes/admin/class-wc-cos-admin-orders.php (modified) (29 diffs)
• includes/admin/class-wc-cos-safe-domdocument.php (modified) (3 diffs)
• languages/woo-cost-of-shipping.pot (added)
• languages/woocommerce-cost-of-shipping.pot (deleted)
• woo-includes/class-wc-cos-dependencies.php (modified) (1 diff)
• woo-includes/woo-functions.php (modified) (1 diff)
• woocommerce-cost-of-shipping.php (modified) (6 diffs)

woo-cost-of-shipping/trunk/README.txt

@@ -1 @@
-=== WooCommerce Cost of Shipping ===
+=== Cost of Shipping for WooCommerce ===
 Contributors:      TheRiteSites   
-Donate link:       https://www.theritesites.com/plugins/woocommerce-cost-of-shipping  
+Donate link:       https://www.theritesites.com/plugins/woo-cost-of-shipping  
 Tags:              cost of shipping, shipping cost, WooCommerce, net profit, shipstation
 Requires at least: 5.2
-Tested up to:      6.5
+Tested up to:      7.0
 Requires PHP:      7.0
 Stable tag:        trunk
@@ -38 +38 @@
 
 1. Upload the entire `/woo-cost-of-shipping` directory to the `/wp-content/plugins/` directory.
-2. Activate WooCommerce Cost of Shipping through the 'Plugins' menu in WordPress.
+2. Activate Cost of Shipping for WooCommerce through the 'Plugins' menu in WordPress.
 3. Enjoy the easy editting of the cost of shipping in the edit order screen, below the order total.
 
@@ -59 +59 @@
 
 == Changelog ==
+
+= 1.5.5 =
+- Changed: display name to "Cost of Shipping for WooCommerce" (was "WooCommerce Cost of Shipping"). Slug and installed directory are unchanged; this is a display-name-only change.
+- Changed: Plugin URI and Donate link now point at the plugin's real slug instead of the old trademarked path.
+- Fixed: text domain now matches the plugin slug.
+- Fixed: PHP 8.1+ deprecation notice on the safe XML parser's method return types.
+- Fixed: escaped order-ID attribute output and sanitized page-parameter reads flagged by wordpress.org's Plugin Check.
+- Security: hardened the admin AJAX handlers, the ShipStation import and the XML parser. No vulnerability was found; this is defense in depth. Updating is recommended.
+- Fixed: the cost of shipping method and change history were not being saved on orders. Existing order data is left as-is; new saves are correct.
+- Fixed: a possible fatal error when importing WooCommerce Services labels on some stores.
+- Fixed: a WooCommerce Services import that resolved to exactly 0.00 was reported as a failure.
+- Fixed: the order screen could show a cost of shipping as saved when the save had not succeeded.
+- Changed: order-screen strings are now translatable.
 
 = 1.5.4 =

woo-cost-of-shipping/trunk/assets/js/woocommerce-cost-of-shipping.js

@@ -1 @@
-window.WCCOS=window.WCCOS||{},function(i,o,t,c){var e={};c.init=function(){c.cache(),c.bindEvents()},c.cache=function(){e.window=t(i),e.body=t(o.body)},c.bindEvents=function(){},t(c.init)}(window,document,jQuery,window.WCCOS),jQuery(document).ready((function(i){"use strict";i("#edit-shipping-cost").on("click",(function(o){o.preventDefault(),i(".edit-shipping-tooltip").toggle(),i("#shipping-cost-input").focus()})),i("#edit-shipping-cancel").on("click",(function(o){o.preventDefault(),i(".edit-shipping-tooltip").toggle()})),i("#edit-shipping-save").on("click",(function(o){o.preventDefault(),i("#edit-shipping-save").attr("disabled",!0),i("#edit-shipping-cancel").attr("disabled",!0);var t={action:"set_shipping_cost",security:WCCOSApi.nonce,post_id:i("#edit-shipping-cost").data("orderid"),shipping_cost:i("#shipping-cost-input").val()};i.post(ajaxurl,t,(function(i){WCCOSApi.debug&&console.log("Shipping cost sent!")})).done((function(){i("#edit-shipping-save").attr("disabled",!1),i("#edit-shipping-cancel").attr("disabled",!1),i(".edit-shipping-tooltip").toggle()})).fail((function(){console.log("Failed to save the shipping cost from manual input.")})).success((function(){WCCOSApi.debug&&console.log("success");var o=parseFloat(i("#shipping-cost-input").val()).toFixed(2);i("#shipping-cost .amount").html('<span class="woocommerce-Price-currencySymbol">'+WCCOSApi.currency+"</span>"+o)})).always((function(){}))})),i(".wc-cos-wcs-import").on("click",(function(o){o.preventDefault(),console.log();var t={action:"set_label_cost_wcs",security:WCCOSApi.nonce,post_id:i(this).data("orderid")};i(".wc-cos-wcs-import").prop("disabled",!0),i(this).html("Loading..."),i.post(ajaxurl,t,(function(i){WCCOSApi.debug&&console.log("Shipping cost being imported!")})).done((function(){i("#wc-cos-protip").remove(),i(".wc-cos-wcs-import").attr("disabled",!1),i(".wc-cos-wcs-import").after('<div id="wc-cos-protip"><p><b>Pro tip:</b> If you purchase your label(s) and then set the order status to complete, the cost of shipping will automatically be imported!</p></div>')})).fail((function(){console.log("failed to import shipping cost from WooCommerce services created label."),i(".wc-cos-wcs-import").html("Retry import")})).success((function(o){WCCOSApi.debug&&console.log("Success"),i(".wc-cos-wcs-import").html("Re-import"),i(".shipping-total .woocommerce-Price-amount").html('<span class="woocommerce-Price-currencySymbol">'+o.data.currency+"</span>"+parseFloat(o.data.cost).toFixed(2))}))}))}));
+/**
+ * WooCommerce Cost of Shipping
+ * https://www.theritesites.com/plugins/woocomerce-cost-of-shipping
+ *
+ * This plugin can be expanded into net profit reporting by getting the WooCommerce Net Profit plugin
+ * developed by TheRiteSites and found at https://www.theritesites.com/plugins/woocommerce-net-profit
+ *
+ * Licensed under the GPLv2+ license.
+ */
+
+window.WCCOS = window.WCCOS || {};
+
+( function( window, document, $, plugin ) {
+        var $c = {};
+
+        plugin.init = function() {
+                plugin.cache();
+                plugin.bindEvents();
+        };
+
+        plugin.cache = function() {
+                $c.window = $( window );
+                $c.body = $( document.body );
+        };
+
+        plugin.bindEvents = function() {
+        };
+
+        $( plugin.init );
+
+
+}( window, document, jQuery, window.WCCOS ) );
+
+jQuery(document).ready(function( $ ) {
+    'use strict';
+
+        var i18n = ( window.WCCOSApi && WCCOSApi.i18n ) || {};
+
+        /**
+         * Build the price markup the same way wc_price() does, but from DOM nodes
+         * so neither the currency symbol nor the amount is ever parsed as HTML.
+         */
+        function renderPrice( $target, currency, amount ) {
+                var value = parseFloat( amount );
+                if ( isNaN( value ) ) {
+                        return;
+                }
+                $target.empty().append(
+                        $( '<span/>' ).addClass( 'woocommerce-Price-currencySymbol' ).text( currency ),
+                        document.createTextNode( value.toFixed( 2 ) )
+                );
+        }
+
+        function debugLog( message ) {
+                if ( window.WCCOSApi && WCCOSApi.debug && window.console ) {
+                        console.log( message );
+                }
+        }
+
+    $('#edit-shipping-cost').on('click', function(e) {
+                e.preventDefault();
+        $('.edit-shipping-tooltip').toggle();
+        $('#shipping-cost-input').focus();
+    });
+
+    $('#edit-shipping-cancel').on('click', function(e) {
+                e.preventDefault();
+        $('.edit-shipping-tooltip').toggle();
+    });
+
+        $('#edit-shipping-save').on('click', function(e) {
+                e.preventDefault();
+
+                $('#edit-shipping-save').prop( 'disabled', true );
+                $('#edit-shipping-cancel').prop( 'disabled', true );
+
+                var data = {
+                        action: 'set_shipping_cost',
+                        security: WCCOSApi.nonce,
+                        post_id: $('#edit-shipping-cost').data('orderid'),
+                        shipping_cost: $('#shipping-cost-input').val()
+                };
+
+                $.post( ajaxurl, data )
+                .done(function( response ) {
+                        // admin-ajax answers 200 for wp_send_json_error() unless a status is
+                        // passed, so a resolved request is not yet a saved value.
+                        if ( ! response || ! response.success ) {
+                                var message = ( response && response.data && response.data.message ) || i18n.save_failed || 'The cost of shipping could not be saved.';
+                                window.alert( message );
+                                return;
+                        }
+                        debugLog( 'Shipping cost saved.' );
+                        renderPrice( $('#shipping-cost .amount'), WCCOSApi.currency, $('#shipping-cost-input').val() );
+                        $('.edit-shipping-tooltip').toggle();
+                })
+                .fail(function( jqXHR ) {
+                        var message = ( jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message ) || i18n.save_failed || 'The cost of shipping could not be saved.';
+                        debugLog( 'Failed to save the shipping cost from manual input.' );
+                        window.alert( message );
+                })
+                .always(function() {
+                        $('#edit-shipping-save').prop( 'disabled', false );
+                        $('#edit-shipping-cancel').prop( 'disabled', false );
+                });
+        });
+
+        $('.wc-cos-wcs-import').on('click', function(e){
+                e.preventDefault();
+                var $button = $(this);
+                var data = {
+                        action: 'set_label_cost_wcs',
+                        security: WCCOSApi.nonce,
+                        post_id: $button.data('orderid'),
+                };
+
+                $('.wc-cos-wcs-import').prop('disabled', true);
+                $button.text( i18n.loading || 'Loading...' );
+
+                $.post( ajaxurl, data )
+                .done(function( response ) {
+                        if ( ! response || ! response.success ) {
+                                $button.text( i18n.retry || 'Retry import' );
+                                return;
+                        }
+                        $button.text( i18n.reimport || 'Re-import' );
+                        $('#wc-cos-protip').remove();
+                        $button.after(
+                                $( '<div id="wc-cos-protip"/>' ).append(
+                                        $( '<p/>' ).append(
+                                                $( '<b/>' ).text( 'Pro tip: ' ),
+                                                document.createTextNode( i18n.protip || 'If you purchase your label(s) and then set the order status to complete, the cost of shipping will automatically be imported!' )
+                                        )
+                                )
+                        );
+                        if ( response.data && typeof response.data.cost !== 'undefined' ) {
+                                debugLog( 'Shipping cost imported.' );
+                                renderPrice( $('.shipping-total .woocommerce-Price-amount'), response.data.currency, response.data.cost );
+                        }
+                })
+                .fail(function() {
+                        debugLog( 'Failed to import shipping cost from WooCommerce Services created label.' );
+                        $button.text( i18n.retry || 'Retry import' );
+                })
+                .always(function() {
+                        $('.wc-cos-wcs-import').prop('disabled', false);
+                });
+        });
+
+});

woo-cost-of-shipping/trunk/includes/admin/class-wc-cos-admin-orders.php

@@ -1 +1 @@
 <?php
 /**
- * WooCommerce Cost of Shipping Admin Orders
+ * Cost of Shipping for WooCommerce Admin Orders
  * 
  * This file adds the cost of shipping functionality to the Admin Orders page.
@@ -27 +27 @@
  * 
  */
-use Automattic\WooCommerce\Internal\DataStores\Orders\CustomOrdersTableController;
 
 if ( ! defined( 'ABSPATH' ) ) {
@@ -71 +70 @@
 
                 // Adds style sheets for the order edit page
-                add_action( 'admin_print_styles', array( $this, 'enqueue_styles' ) );
+                add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_styles' ) );
 
                 // Adds javascript files for the order edit page
@@ -99 +98 @@
 
         /**
+         * Nonce action shared by this plugin's AJAX handlers.
+         *
+         * Deliberately not 'wp_rest': that nonce is minted for every REST call and
+         * is present on any page that enqueues wp-api, so a purpose-built action
+         * keeps the surface that can drive these handlers as small as possible.
+         *
+         * @since 1.5.5
+         */
+        const AJAX_NONCE_ACTION = 'wc-cos-ajax';
+
+        /**
+         * Whether the current admin screen is the single-order edit screen.
+         *
+         * Uses the screen id WooCommerce reports for the current storage mode, so it
+         * is correct for both the shop_order post type and HPOS (wc-orders) without
+         * reading $pagenow or $_GET.
+         *
+         * @since 1.5.5
+         *
+         * @return bool
+         */
+        protected function is_order_edit_screen() {
+                if ( ! function_exists( 'get_current_screen' ) ) {
+                        return false;
+                }
+                $screen = get_current_screen();
+                if ( ! $screen ) {
+                        return false;
+                }
+                return function_exists( 'wc_get_page_screen_id' )
+                        ? wc_get_page_screen_id( 'shop-order' ) === $screen->id
+                        : 'shop_order' === $screen->id;
+        }
+
+        /**
          * Function to register and enqueue javascript files for the order admin page
-         * 
+         *
          * @since 1.1.0
          */
         public function enqueue_scripts() {
-                global $pagenow;
-                global $post_type;
-                $admin_page = isset( $_GET['page'] ) ? $_GET['page'] : '';
-
-                if ( ( $pagenow == 'post.php' && $post_type == 'shop_order' ) || ( $admin_page == 'wc-orders' && $pagenow == 'admin.php' ) ) {
-
-                        $js_file = '';
-                        $path = realpath( dirname(__FILE__) . '/../' );
-
-                        if ( file_exists( $path .  '/assets/js/woo-cost-of-shipping.min.js' ) && ! ( $this->plugin->__get( 'debug' ) || WP_DEBUG ) ) {
-                                $js_file = plugins_url( '/assets/js/woo-cost-of-shipping.min.js', plugin_dir_path(__DIR__) );
-                        }
-                        else
-                                $js_file = plugins_url( '/assets/js/woocommerce-cost-of-shipping.js', plugin_dir_path(__DIR__) );
-
-                        if ( ! empty( $js_file ) ) {
-                                wp_register_script( $this->plugin->basename , $js_file, array( 'jquery' ), $this->plugin->version, false );
-
-                                wp_localize_script( $this->plugin->basename, 'WCCOSApi', array(
-                                        'nonce' => wp_create_nonce('wp_rest'),
-                                        'currency' => get_woocommerce_currency_symbol(),
-                                        'debug' => $this->plugin->__get( 'debug' )
-                                ));
-                                wp_enqueue_script( $this->plugin->basename );
-                        }
+                if ( ! $this->is_order_edit_screen() ) {
+                        return;
+                }
+
+                $js_file = '';
+                $path = realpath( dirname(__FILE__) . '/../' );
+
+                if ( file_exists( $path .  '/assets/js/woo-cost-of-shipping.min.js' ) && ! ( $this->plugin->__get( 'debug' ) || WP_DEBUG ) ) {
+                        $js_file = plugins_url( '/assets/js/woo-cost-of-shipping.min.js', plugin_dir_path(__DIR__) );
+                }
+                else
+                        $js_file = plugins_url( '/assets/js/woocommerce-cost-of-shipping.js', plugin_dir_path(__DIR__) );
+
+                if ( ! empty( $js_file ) ) {
+                        wp_register_script( $this->plugin->basename , $js_file, array( 'jquery' ), $this->plugin->version, false );
+
+                        wp_localize_script( $this->plugin->basename, 'WCCOSApi', array(
+                                'nonce'    => wp_create_nonce( self::AJAX_NONCE_ACTION ),
+                                'currency' => get_woocommerce_currency_symbol(),
+                                'debug'    => $this->plugin->__get( 'debug' ),
+                                'i18n'     => array(
+                                        'reimport'    => __( 'Re-Import', 'woo-cost-of-shipping' ),
+                                        'retry'       => __( 'Retry import', 'woo-cost-of-shipping' ),
+                                        'loading'     => __( 'Loading...', 'woo-cost-of-shipping' ),
+                                        'save_failed' => __( 'The cost of shipping could not be saved.', 'woo-cost-of-shipping' ),
+                                        'protip'      => __( 'If you purchase your label(s) and then set the order status to complete, the cost of shipping will automatically be imported!', 'woo-cost-of-shipping' ),
+                                ),
+                        ));
+                        wp_enqueue_script( $this->plugin->basename );
                 }
         }
@@ -134 +172 @@
         /**
          * Function to register and enqueue CSS files for the order admin page
-         * 
+         *
          * @since 1.0.0
          */
         public function enqueue_styles() {
-                global $pagenow;
-                global $post_type;
-                $admin_page = isset( $_GET['page'] ) ? $_GET['page'] : '';
-
-                if ( ( $pagenow == 'post.php' && $post_type == 'shop_order' ) || ( $pagenow == 'admin.php' && $admin_page == 'wc-orders' ) ) {
-
-                        $cs_file = '';
-                        $path = realpath(dirname(__FILE__) . '/../');
-                        
-                        if ( file_exists( $path . '/assets/css/woocommerce-cost-of-shipping.min.css' ) && !( $this->plugin->__get( 'debug' ) || WP_DEBUG ) ) {
-                                $cs_file = plugins_url( '/assets/css/woocommerce-cost-of-shipping.min.css', plugin_dir_path(__DIR__) );
-                        }
-                        else
-                                $cs_file = plugins_url( '/assets/css/woocommerce-cost-of-shipping.css', plugin_dir_path(__DIR__) );
-                        wp_enqueue_style( $this->plugin->basename, $cs_file, array(), $this->plugin->version );
-                }
+                if ( ! $this->is_order_edit_screen() ) {
+                        return;
+                }
+
+                $cs_file = '';
+                $path = realpath(dirname(__FILE__) . '/../');
+
+                if ( file_exists( $path . '/assets/css/woocommerce-cost-of-shipping.min.css' ) && !( $this->plugin->__get( 'debug' ) || WP_DEBUG ) ) {
+                        $cs_file = plugins_url( '/assets/css/woocommerce-cost-of-shipping.min.css', plugin_dir_path(__DIR__) );
+                }
+                else
+                        $cs_file = plugins_url( '/assets/css/woocommerce-cost-of-shipping.css', plugin_dir_path(__DIR__) );
+                wp_enqueue_style( $this->plugin->basename, $cs_file, array(), $this->plugin->version );
+        }
+
+        /**
+         * Shared guard for the AJAX handlers: nonce, login, capability, and a
+         * real shop_order behind the submitted id. On any failure it sends the
+         * JSON error itself, with a non-200 status so the front end's fail handler
+         * runs, and exits; otherwise it returns the order.
+         *
+         * @since 1.5.5
+         *
+         * @return WC_Order
+         */
+        protected function ajax_guard() {
+                if ( ! check_ajax_referer( self::AJAX_NONCE_ACTION, 'security', false ) || ! is_user_logged_in() || ! current_user_can( 'manage_woocommerce' ) ) {
+                        wp_send_json_error( array( 'message' => __( 'You are not allowed to do that.', 'woo-cost-of-shipping' ) ), 403 );
+                }
+
+                $order_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : 0;
+                $order    = $order_id ? wc_get_order( $order_id ) : false;
+
+                // wc_get_order() also returns refunds; only a real order carries a cost of shipping.
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        wp_send_json_error( array( 'message' => __( 'Order not found.', 'woo-cost-of-shipping' ) ), 400 );
+                }
+
+                return $order;
         }
 
@@ -167 +228 @@
         public function add_order_shipping_cost_to_order_note( $order_id, $cos, $method ) {
                 $order = wc_get_order( $order_id );
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        return;
+                }
 
                 $fcos = wc_price( $cos );
-                $by = $method == 'manual' ? __('manually', 'woocommerce-cost-of-shipping') : sprintf(__('automatically by %s', 'woocommerce-cost-of-shipping'), $method);
+                // $method has been through a public filter, so escape it before it lands in a note.
+                $by = $method == 'manual' ? __('manually', 'woo-cost-of-shipping') : sprintf(__('automatically by %s', 'woo-cost-of-shipping'), esc_html( $method ));
                 // If automatically changed by an integration component, there is a change in verbage.
                 // Careful on translation here!
-                $note = sprintf( __('Cost of Shipping was changed to %s %s', 'woocommerce-cost-of-shipping'), $fcos, $by );
+                $note = sprintf( __('Cost of Shipping was changed to %s %s', 'woo-cost-of-shipping'), $fcos, $by );
 
                 $order->add_order_note( $note );
@@ -187 +252 @@
          */
         function set_shipping_cost_callback() {
-                        
-                if ( ! check_ajax_referer( 'wp_rest', 'security' ) || ! is_user_logged_in() || ! current_user_can('manage_woocommerce') ) {
-                        wp_send_json_error();
-                        wp_die();
-                }
-
-                $post_id = intval( sanitize_text_field( $_POST['post_id'] ) );
-                $cos     = floatval( sanitize_text_field( $_POST['shipping_cost'] ) );
+
+                $order   = $this->ajax_guard();
+                $post_id = $order->get_id();
+
+                $raw = isset( $_POST['shipping_cost'] ) ? sanitize_text_field( wp_unslash( $_POST['shipping_cost'] ) ) : '';
+                if ( '' === $raw || ! is_numeric( $raw ) ) {
+                        wp_send_json_error( array( 'message' => __( 'Cost of shipping must be a number.', 'woo-cost-of-shipping' ) ), 400 );
+                }
+                $cos = floatval( $raw );
+                // The input's min="0" is client-side only; enforce it here too.
+                if ( ! is_finite( $cos ) || $cos < 0 ) {
+                        wp_send_json_error( array( 'message' => __( 'Cost of shipping must be zero or more.', 'woo-cost-of-shipping' ) ), 400 );
+                }
 
                 do_action( 'wc_cos_before_ajax_set_shipping_cost', $post_id, $cos, 'manual' );
-                
+
                 // Returns true on success, false on anything else
                 if ( $this->store_cost_of_shipping( $post_id, $cos, 'manual' ) ){
-                        
+
                         do_action( 'wc_cos_after_ajax_set_shipping_cost', $post_id, $cos, 'manual' );
                         wp_send_json_success();
-                        wp_die();
-                }
-                wp_send_json_error();
-                wp_die();
-                
+                }
+                // Not an error the user can act on: the value already matched what was stored.
+                wp_send_json_success( array( 'unchanged' => true ) );
+
         }
 
@@ -229 +298 @@
                 }
                 if ( true === $this->plugin->__get( 'debug' ) ) {
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'Function: store_cost_of_shipping', 'woocommerce-cost-of-shipping' ) );
-                        $this->log->add( 'the-rite-sites-profit-plugins', sprintf( __( '   Order cost of shipping being stored to order id %d', 'woocommerce-cost-of-shipping' ), $order_id ) );
-                        $this->log->add( 'the-rite-sites-profit-plugins', sprintf( __( '       Cost of shipping: %.2f via method: %s', 'woocommerce-cost-of-shipping' ), $cos, $method ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'Function: store_cost_of_shipping', 'woo-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', sprintf( __( '   Order cost of shipping being stored to order id %d', 'woo-cost-of-shipping' ), $order_id ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', sprintf( __( '       Cost of shipping: %.2f via method: %s', 'woo-cost-of-shipping' ), $cos, $method ) );
                 }
                 $cos = apply_filters( 'wc_cos_store_cost_of_shipping', $cos, $order_id );
@@ -240 +309 @@
                 // Query wc_order
                 $order = wc_get_order( $order_id );
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        if ( true === $this->plugin->__get( 'debug' ) ) {
+                                $this->log->add( 'the-rite-sites-profit-plugins', sprintf( __( '       No order found for id %d, nothing stored.', 'woo-cost-of-shipping' ), $order_id ) );
+                        }
+                        return false;
+                }
 
                 // Store for possible history update before the new store overwrites.
@@ -256 +331 @@
                 if ( ( float ) $old_cos == ( float ) $cos ) {
                         if ( true === $this->plugin->__get( 'debug' ) ) {
-                                $this->log->add( 'the-rite-sites-profit-plugins', __( '       No need to update Cost of Shipping, values are equivalent.', 'woocommerce-cost-of-shipping' ) );
+                                $this->log->add( 'the-rite-sites-profit-plugins', __( '       No need to update Cost of Shipping, values are equivalent.', 'woo-cost-of-shipping' ) );
                         }
                         return false;
@@ -262 +337 @@
                 $order->update_meta_data( '_wc_cost_of_shipping', ( float ) $cos );
 
-                $order->update_meta_data( $order_id, '_wc_cos_method', $method );
+                // 1.5.0 - 1.5.4 passed ( $order_id, '_wc_cos_method', $method ) here, a leftover
+                // from the update_post_meta() signature, so the method was never stored and a
+                // stray meta row keyed by the order id was written instead. Fixed in 1.5.5.
+                $order->update_meta_data( '_wc_cos_method', $method );
 
                 if ( true === $this->plugin->__get( 'debug' ) ) {
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( '     Cost of shipping value and method updated.', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( '     Cost of shipping value and method updated.', 'woo-cost-of-shipping' ) );
                 }
 
@@ -279 +357 @@
 
                         if ( true === $this->plugin->__get( 'debug' ) ) {
-                                $this->log->add( 'the-rite-sites-profit-plugins', __( '     Cost of shipping history updated with value and method.', 'woocommerce-cost-of-shipping' ) );
+                                $this->log->add( 'the-rite-sites-profit-plugins', __( '     Cost of shipping history updated with value and method.', 'woo-cost-of-shipping' ) );
                         }
                 }
@@ -297 +375 @@
          */
         public function maybe_save_order_shipping_cost_shipstation( $order, $args ) {
-                
-                $xml = $this->get_parsed_xml( $args['xml'] );
-                
+
                 if ( is_null( $this->log ) ) {
                         $this->log = new WC_Logger();
                 }
-                
+
+                if ( ! is_a( $order, 'WC_Order' ) || ! is_array( $args ) || empty( $args['xml'] ) || ! is_string( $args['xml'] ) ) {
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration fired without an order or xml payload', 'woo-cost-of-shipping' ) );
+                        return;
+                }
+
+                $xml = $this->get_parsed_xml( $args['xml'] );
+
                 if ( ! isset( $xml ) ) {
-                        $this->log->add( 'shipstation', __( 'shipstation integration xml not set', 'woocommerce-cost-of-shipping' ) );
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml not set', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'shipstation', __( 'shipstation integration xml not set', 'woo-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml not set', 'woo-cost-of-shipping' ) );
                 }
                 elseif ( empty( $xml ) ) {
-                        $this->log->add( 'shipstation', __( 'shipstation integration xml is empty', 'woocommerce-cost-of-shipping' ) );
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml is empty', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'shipstation', __( 'shipstation integration xml is empty', 'woo-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml is empty', 'woo-cost-of-shipping' ) );
                 }
                 elseif ( ! isset( $xml->ShippingCost ) ) {
-                        $this->log->add( 'shipstation', __( 'shipstation integration xml does not have shipping amount set', 'woocommerce-cost-of-shipping' ) );
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml does not have shipping amount set', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'shipstation', __( 'shipstation integration xml does not have shipping amount set', 'woo-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml does not have shipping amount set', 'woo-cost-of-shipping' ) );
                 }
                 else {
-                        $shipping_cost = wc_clean( $xml->ShippingCost );
+                        // wc_clean() passes non-scalars through untouched, so cast the
+                        // SimpleXMLElement to a string first and then to the float we store.
+                        $shipping_cost = floatval( wc_clean( (string) $xml->ShippingCost ) );
+                        if ( ! is_finite( $shipping_cost ) || $shipping_cost < 0 ) {
+                                $this->log->add( 'the-rite-sites-profit-plugins', __( 'shipstation integration xml shipping amount is not a valid cost', 'woo-cost-of-shipping' ) );
+                                return;
+                        }
                         $this->store_cost_of_shipping( $order->get_id(), $shipping_cost, 'shipstation' );
                         $this->log->add( 'shipstation', 'After shipstation automatically stored cost of shipping.');
@@ -341 +430 @@
                 if ( true === is_woocommerce_services_active() ) {
                         if ( true === $this->plugin->__get( 'debug' ) )
-                                $this->log->add( 'the-rite-sites-profit-plugins', __( 'WooCommerce services is active, retrieving labels.', 'woocommerce-cost-of-shipping' ) );
+                                $this->log->add( 'the-rite-sites-profit-plugins', __( 'WooCommerce services is active, retrieving labels.', 'woo-cost-of-shipping' ) );
                         $labels = $this->get_wcs_label_order_meta_data( $order_id );
                         $flag = false;
@@ -353 +442 @@
 
                         $order = wc_get_order( $order_id );
+                        if ( ! $order || ! is_a( $order, 'WC_Order' ) ) return false;
                         $previous_cos_method = $order->get_meta( '_wc_cos_method', true );
                         if ( false === $flag && ! ( 'wc_services' === $previous_cos_method ) ) return false;
@@ -361 +451 @@
                 else {
                         if ( true === $this->plugin->__get( 'debug' ) )
-                                $this->log->add( 'the-rite-sites-profit-plugins', __( '    WooCommerce services is not active, ignoring trying to save WooCommerce services labels as cost of shipping.', 'woocommerce-cost-of-shipping' ) );
+                                $this->log->add( 'the-rite-sites-profit-plugins', __( '    WooCommerce services is not active, ignoring trying to save WooCommerce services labels as cost of shipping.', 'woo-cost-of-shipping' ) );
                 }
                 return false;
@@ -374 +464 @@
          * @return bool
          */
-        public function should_show_wcs_cos_meta_box() {
-                global $post_type, $pagenow;
-                $admin_page = isset( $_GET['page'] ) ? $_GET['page'] : '';
-
-                if ( true === is_woocommerce_services_active() ) {
-                        $order = wc_get_order();
-                        if ( $order && ( ( 'shop_order' === $post_type && ! ( 'post-new.php' === $pagenow ) || ( $pagenow == 'admin.php' && $admin_page == 'wc-orders' ) ) ) ) {
-                                return true;
-                        }
-                }
-                return false;
+        public function should_show_wcs_cos_meta_box( $screen_id = '', $post_or_order = null ) {
+                if ( true !== is_woocommerce_services_active() ) {
+                        return false;
+                }
+                // add_meta_boxes passes the screen id: 'shop_order' for the post type,
+                // the wc-orders page id under HPOS. wc_get_page_screen_id() returns
+                // whichever is in force, so one comparison covers both storage modes.
+                $order_screen = function_exists( 'wc_get_page_screen_id' ) ? wc_get_page_screen_id( 'shop-order' ) : 'shop_order';
+                if ( $screen_id !== $order_screen ) {
+                        return false;
+                }
+                // The second argument is a WP_Post under the post type and a WC_Order under
+                // HPOS. An order being created is auto-draft in both modes; that is the
+                // add-new case the old $pagenow check excluded.
+                $order = ( $post_or_order instanceof WP_Post ) ? wc_get_order( $post_or_order->ID ) : $post_or_order;
+                return $order && is_a( $order, 'WC_Order' ) && 'auto-draft' !== $order->get_status();
         }
 
@@ -398 +493 @@
         public function display_wcs_cos_meta_box( $post_id ) {
                 $order = ( $post_id instanceof WP_Post ) ? wc_get_order( $post_id->ID ) : $post_id;
-                // $order = wc_get_order( $post_id );
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        return;
+                }
 
                 $cos = floatval( $order->get_meta( '_wc_cost_of_shipping' ) );
@@ -405 +502 @@
                         ?>
                         <div class="wc-cos-wrapper">
-                                <button class="wc-cos-wcs-import button-primary" data-orderid="<?php echo $order->get_id() ?>" id="wcs-shipping-import">Import</button>
+                                <button class="wc-cos-wcs-import button-primary" data-orderid="<?php echo esc_attr( $order->get_id() ); ?>" id="wcs-shipping-import"><?php esc_html_e( 'Import', 'woo-cost-of-shipping' ); ?></button>
                         </div>
                         <?php
@@ -412 +509 @@
                         ?>
                         <div class="wc-cos-wrapper">
-                                <button class="wc-cos-wcs-import button-secondary" data-orderid="<?php echo $order->get_id() ?>" id="wcs-shipping-re-import">Re-Import</button>
+                                <button class="wc-cos-wcs-import button-secondary" data-orderid="<?php echo esc_attr( $order->get_id() ); ?>" id="wcs-shipping-re-import"><?php esc_html_e( 'Re-Import', 'woo-cost-of-shipping' ); ?></button>
                         </div>
                         <?php
@@ -429 +526 @@
          */
         public function set_label_cost_wcs_callback() {
-                if ( ! check_ajax_referer( 'wp_rest', 'security' ) || ! is_user_logged_in() || ! current_user_can( 'manage_woocommerce' ) ) {
-                        wp_send_json_error();
-                        wp_die();
-                }
-
-                $post_id = intval( sanitize_text_field( $_POST['post_id'] ) );
+                $order   = $this->ajax_guard();
+                $post_id = $order->get_id();
 
                 do_action( 'wc_cos_before_ajax_set_label_cost_wcs', $post_id );
-                
-                // Returns true on success, false on anything else
-                if ( $cost = $this->maybe_save_order_shipping_cost_woocommerce_services( $post_id ) ) {
+
+                // Returns the stored cost (which may legitimately be 0.00) on success, false on anything else.
+                $cost = $this->maybe_save_order_shipping_cost_woocommerce_services( $post_id );
+                if ( false !== $cost ) {
                         do_action( 'wc_cos_after_ajax_set_label_cost_wcs', $post_id );
                         wp_send_json_success( array( 'cost' => $cost, 'currency' => get_woocommerce_currency_symbol() ) );
-                        wp_die();
-                }
-                elseif ( false === $cost ) {
-                        do_action( 'wc_cos_after_ajax_no_labels_wcs', $post_id );
-                        wp_send_json_success( array( 'message' => 'No labels exist.' ) );
-                        wp_die();
-                }
-                wp_send_json_error();
-                wp_die();
+                }
+                do_action( 'wc_cos_after_ajax_no_labels_wcs', $post_id );
+                wp_send_json_success( array( 'message' => __( 'No labels exist.', 'woo-cost-of-shipping' ) ) );
         }
 
@@ -462 +550 @@
          * @param int    $post                  The current post ID.
          */
-        public function add_wcs_cos_meta_box( $post_type, $post ) {
-                if ( $this->should_show_wcs_cos_meta_box() ) {
-
-                        $screen = class_exists( '\Automattic\WooCommerce\Internal\DataStores\Orders\CustomOrdersTableController' ) && wc_get_container()->get( CustomOrdersTableController::class )->custom_orders_table_usage_is_enabled()
-                                        ? wc_get_page_screen_id( 'shop-order' )
-                                        : 'shop_order';
+        public function add_wcs_cos_meta_box( $post_type, $post = null ) {
+                if ( $this->should_show_wcs_cos_meta_box( $post_type, $post ) ) {
+
+                        // should_show_wcs_cos_meta_box() has already matched $post_type against
+                        // the order screen id for the storage mode in force, so it is the screen.
+                        $screen = $post_type;
 
                         add_meta_box(
                                 'wc-cos-services-cost-of-shipping',
-                                __( 'Import Cost of Shipping', 'woocommerce-cost-of-shipping' ),
+                                __( 'Import Cost of Shipping', 'woo-cost-of-shipping' ),
                                 array( $this, 'display_wcs_cos_meta_box' ),
                                 $screen,
@@ -481 +569 @@
 
         /**
+         * Attempts to recover a faulty json string field that might contain unescaped quotes,
+         * e.g. "package_name":"12" x 9" box". Escapes any quote inside the value that is not
+         * already escaped and is not the closing quote.
+         *
+         * Called since 1.2.0 but never defined until 1.5.5, so the legacy-string labels path
+         * used to fatal on any store whose wc_connect_labels meta was not valid JSON.
+         *
+         * @since 1.5.5
+         *
+         * @param string $field_name
+         * @param string $json
+         *
+         * @return string
+         */
+        public function try_recover_invalid_json_string( $field_name, $json ) {
+                $regex = '/"' . preg_quote( $field_name, '/' ) . '":"(.+?)"(?=\s*[,}])/';
+                preg_match_all( $regex, $json, $match_groups );
+                if ( 2 === count( $match_groups ) ) {
+                        foreach ( $match_groups[ 0 ] as $idx => $match ) {
+                                $value = $match_groups[ 1 ][ $idx ];
+                                $escaped_value = preg_replace( '/(?<!\\\)"/', '\\"', $value );
+                                $json = str_replace( '"' . $field_name . '":"' . $value . '"', '"' . $field_name . '":"' . $escaped_value . '"', $json );
+                        }
+                }
+                return $json;
+        }
+
+        /**
          * Attempts to recover faulty json string array fields that might contain strings with unescaped quotes
          *
          * @since 1.2.0
-         * 
+         *
          * @param string $field_name
          * @param string $json
@@ -542 +658 @@
         public function get_wcs_label_order_meta_data( $order_id ) {
                 $order = wc_get_order( ( int ) $order_id );
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        return array();
+                }
                 $label_data = $order->get_meta( 'wc_connect_labels', true );
                 //return an empty array if the data doesn't exist
@@ -578 +697 @@
 
                 if ( ! $success ) {
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'wpcom_safe_simplexml_load_string(): Error loading XML string in shipstation xml retrieve', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'wpcom_safe_simplexml_load_string(): Error loading XML string in shipstation xml retrieve', 'woo-cost-of-shipping' ) );
                         return false;
                 }
 
                 if ( isset( $dom->doctype ) ) {
-                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'wpcom_safe_simplexml_import_dom(): Unsafe DOCTYPE Detected in shipstation xml retrieve', 'woocommerce-cost-of-shipping' ) );
+                        $this->log->add( 'the-rite-sites-profit-plugins', __( 'wpcom_safe_simplexml_import_dom(): Unsafe DOCTYPE Detected in shipstation xml retrieve', 'woo-cost-of-shipping' ) );
                         return false;
                 }
@@ -600 +719 @@
          */
         public function show_order_shipping_cost( $post_id ) {
-                
-                $ajax_nonce = wp_create_nonce( 'edit-shipping-meta-nonce' );
+
                 $order = wc_get_order( $post_id );
+                if ( ! $order || ! is_a( $order, 'WC_Order' ) ) {
+                        return;
+                }
                 $cost_of_shipping = floatval( $order->get_meta( '_wc_cost_of_shipping', true ) );
                 $formatted_total = wc_price( $cost_of_shipping );
@@ -608 +729 @@
                 <tr>
 
-                        <td class="total shipping-total"><?php esc_html_e( 'Shipping Cost', 'woocommerce-cost-of-shipping' ); ?>:</td>
+                        <td class="total shipping-total"><?php esc_html_e( 'Shipping Cost', 'woo-cost-of-shipping' ); ?>:</td>
 
                         <td width="1%"></td>
@@ -614 +735 @@
                         <td class="total shipping-total">
                                 <span id="shipping-cost">
-                                        <?php echo $formatted_total; ?>
-                                
+                                        <?php echo wp_kses_post( $formatted_total ); ?>
+
                                         <div class="edit-shipping-tooltip" style="display:none;">
-                                                <input id="shipping-cost-input" type="number" step="0.01" min="0" value="<?php echo esc_attr($cost_of_shipping); ?>" />
+                                                <input id="shipping-cost-input" type="number" step="0.01" min="0" value="<?php echo esc_attr( $cost_of_shipping ); ?>" />
                                                 <div class="edit-shipping-buttons">
-                                                        <button id="edit-shipping-cancel" class="button" type="button">Cancel</button>
-                                                        <button id="edit-shipping-save" class="button button-primary" type="button">Save</button>
+                                                        <button id="edit-shipping-cancel" class="button" type="button"><?php esc_html_e( 'Cancel', 'woo-cost-of-shipping' ); ?></button>
+                                                        <button id="edit-shipping-save" class="button button-primary" type="button"><?php esc_html_e( 'Save', 'woo-cost-of-shipping' ); ?></button>
                                                 </div>
                                         </div>
@@ -626 +747 @@
                         </td>
 
-                        <td width="1%"><a data-orderid="<?php echo $post_id; ?>" id="edit-shipping-cost">edit</a></td>
+                        <td width="1%"><a data-orderid="<?php echo esc_attr( $order->get_id() ); ?>" id="edit-shipping-cost"><?php esc_html_e( 'edit', 'woo-cost-of-shipping' ); ?></a></td>
 
                 </tr>

woo-cost-of-shipping/trunk/includes/admin/class-wc-cos-safe-domdocument.php

@@ -19 +19 @@
          * @return bool|DOMDocument true on success, false on failure.  If called statically (E_STRICT error), returns DOMDocument on success.
          */
+        /**
+         * PHP 8.1 deprecates overriding a built-in method without a compatible
+         * return type. DOMDocument::load() declares `: bool`, but this override
+         * deliberately returns the parsed document or false, and it must keep
+         * working on PHP 7.0 (the plugin's declared floor), where a `: bool`
+         * declaration would be a fatal signature mismatch.
+         *
+         * ReturnTypeWillChange silences the deprecation without changing behaviour.
+         * On PHP 7 the line parses as a comment, so it is safe on both.
+         */
+        #[\ReturnTypeWillChange]
         public function load( $filename, $options = 0 ) {
                 if ( '' === $filename ) {
@@ -51 +62 @@
          * @return bool|DOMDocument true on success, false on failure.  If called statically (E_STRICT error), returns DOMDocument on success.
          */
+        /**
+         * PHP 8.1 deprecates overriding a built-in method without a compatible
+         * return type. DOMDocument::loadXML() declares `: bool`, but this override
+         * deliberately returns the parsed document or false, and it must keep
+         * working on PHP 7.0 (the plugin's declared floor), where a `: bool`
+         * declaration would be a fatal signature mismatch.
+         *
+         * ReturnTypeWillChange silences the deprecation without changing behaviour.
+         * On PHP 7 the line parses as a comment, so it is safe on both.
+         */
+        #[\ReturnTypeWillChange]
         public function loadXML( $source, $options = 0 ) {
                 if ( '' === $source ) {
@@ -62 +84 @@
                 $old = null;
 
-                if ( function_exists( 'libxml_disable_entity_loader' ) ) {
+                // PHP 8.0 deprecates libxml_disable_entity_loader() because libxml 2.9+
+                // no longer loads external entities unless asked to, so the call is
+                // only made on PHP 7, where it is still the guard.
+                if ( PHP_VERSION_ID < 80000 && function_exists( 'libxml_disable_entity_loader' ) ) {
                         $old = libxml_disable_entity_loader( true );
                 }
 
-                $return = parent::loadXML( $source, $options );
+                // Never let the parser reach the network for a DTD or entity, whatever
+                // the caller passed. Belt and braces alongside the DOCTYPE bail below.
+                $return = parent::loadXML( $source, $options | LIBXML_NONET );
 
                 if ( ! is_null( $old ) ) {

woo-cost-of-shipping/trunk/woo-includes/class-wc-cos-dependencies.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+}
+
 /**
  * WC Dependency Checker

woo-cost-of-shipping/trunk/woo-includes/woo-functions.php

@@ -1 +1 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+}
+
 /**
  * Functions used by plugins

woo-cost-of-shipping/trunk/woocommerce-cost-of-shipping.php

@@ -1 +1 @@
 <?php
 /**
- * Plugin Name: WooCommerce Cost of Shipping
- * Plugin URI:  https://www.theritesites.com/plugins/woocommerce-cost-of-shipping
+ * Plugin Name: Cost of Shipping for WooCommerce
+ * Plugin URI:  https://www.theritesites.com/plugins/woo-cost-of-shipping
  * Description: Allows the association of the cost of shipping to WooCommerce orders
- * Version:     1.5.4
+ * Version:     1.5.5
  * Author:      TheRiteSites
  * Author URI:  https://www.theritesites.com
- * Donate link: https://www.theritesites.com/plugins/woocommerce-cost-of-shipping
+ * Donate link: https://www.theritesites.com/plugins/woo-cost-of-shipping
  * License:     GPL-2.0+
- * Text Domain: woocommerce-cost-of-shipping
+ * Text Domain: woo-cost-of-shipping
  * Domain Path: /languages 
- * WC tested up to: 8.9
+ * WC tested up to: 10.9
  * WC requires at least: 3.0
  * Requires at least: 5.2
  *
- * @link    https://www.theritesites.com/plugins/woocommerce-cost-of-shipping
+ * @link    https://www.theritesites.com/plugins/woo-cost-of-shipping
  *
  * @package WC_COS
- * @version 1.5.4
+ * @version 1.5.5
  */
 
@@ -43 +43 @@
  */
 
-
+if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+}
 
 if ( ! function_exists( 'is_woocommerce_active' ) ) {
@@ -62 +64 @@
          * @since  1.0.0
          */
-        const VERSION = '1.5.3';
+        const VERSION = '1.5.5';
 
         /**
@@ -211 +213 @@
 
                 // Load translated strings for plugin.
-                load_plugin_textdomain( 'woocommerce-cost-of-shipping', false, dirname( $this->basename ) . '/languages/' );
+                load_plugin_textdomain( 'woo-cost-of-shipping', false, dirname( $this->basename ) . '/languages/' );
 
                 // Initialize plugin classes.
@@ -271 +273 @@
                 
                 if ( ! is_woocommerce_active() ) {
-                        array_push( $this->activation_errors, 'WooCommerce is a required plugin for WooCommerce Cost of Shipping!' );
+                        array_push( $this->activation_errors, 'Cost of Shipping for WooCommerce requires WooCommerce to be installed and active.' );
                         $flag = false;
                 } 
@@ -287 +289 @@
 
                 // Compile default message.
-                $default_message = sprintf( __( 'WooCommerce Cost of Shipping is missing requirements and has been <a href="%s">deactivated</a>. Please make sure all requirements are available.', 'woocommerce-cost-of-shipping' ), admin_url( 'plugins.php' ) );
+                $default_message = sprintf( __( 'Cost of Shipping for WooCommerce is missing requirements and has been <a href="%s">deactivated</a>. Please make sure all requirements are available.', 'woo-cost-of-shipping' ), admin_url( 'plugins.php' ) );
 
                 // Default details to null.