From 487e6bfb317360573887c92fa01322c26fbbcadd Mon Sep 17 00:00:00 2001
From: Alex P <alex.pantec@gmail.com>
Date: Mon, 6 Dec 2021 12:58:51 +0200
Subject: [PATCH] Check that only allowed chars are used for invoice prefix

---
 .../ppcp-onboarding/assets/css/onboarding.css |  4 ++++
 modules/ppcp-wc-gateway/services.php          | 21 +++++++++++--------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/modules/ppcp-onboarding/assets/css/onboarding.css b/modules/ppcp-onboarding/assets/css/onboarding.css
index 9fadc2b3f..affc68415 100644
--- a/modules/ppcp-onboarding/assets/css/onboarding.css
+++ b/modules/ppcp-onboarding/assets/css/onboarding.css
@@ -88,3 +88,7 @@
 .woocommerce_page_wc-settings h3.ppcp-subheading {
 	font-size: 1.1em;
 }
+
+.input-text[pattern]:invalid {
+	border: red solid 2px;
+}
diff --git a/modules/ppcp-wc-gateway/services.php b/modules/ppcp-wc-gateway/services.php
index 04a7aa035..2a4e60625 100644
--- a/modules/ppcp-wc-gateway/services.php
+++ b/modules/ppcp-wc-gateway/services.php
@@ -737,23 +737,26 @@ return array(
 				'gateway'      => 'paypal',
 			),
 			'prefix'                         => array(
-				'title'        => __( 'Invoice prefix', 'woocommerce-paypal-payments' ),
-				'type'         => 'text',
-				'desc_tip'     => true,
-				'description'  => __( 'If you use your PayPal account with more than one installation, please use a distinct prefix to separate those installations. Please do not use numbers in your prefix.', 'woocommerce-paypal-payments' ),
-				'maxlength'    => 15,
-				'default'      => ( static function (): string {
+				'title'             => __( 'Invoice prefix', 'woocommerce-paypal-payments' ),
+				'type'              => 'text',
+				'desc_tip'          => true,
+				'description'       => __( 'If you use your PayPal account with more than one installation, please use a distinct prefix to separate those installations. Please use only English letters and "-", "_" characters.', 'woocommerce-paypal-payments' ),
+				'maxlength'         => 15,
+				'custom_attributes' => array(
+					'pattern' => '[a-zA-Z_-]+',
+				),
+				'default'           => ( static function (): string {
 					$site_url = get_site_url( get_current_blog_id() );
 					$hash = md5( $site_url );
 					$letters = preg_replace( '~\d~', '', $hash );
 					return substr( $letters, 0, 6 ) . '-';
 				} )(),
-				'screens'      => array(
+				'screens'           => array(
 					State::STATE_PROGRESSIVE,
 					State::STATE_ONBOARDED,
 				),
-				'requirements' => array(),
-				'gateway'      => 'paypal',
+				'requirements'      => array(),
+				'gateway'           => 'paypal',
 			),
 
 			// General button styles.