Add logic to enable/disable PayPal subscriptions feature

modules/ppcp-button/resources/js/modules/ContextBootstrap/CheckoutBootstap.js

@@ -64,7 +64,10 @@ class CheckoutBootstap {
             this.spinner
         );
 
-        if(PayPalCommerceGateway.data_client_id.has_subscriptions) {
+        if(
+            PayPalCommerceGateway.data_client_id.has_subscriptions
+            && PayPalCommerceGateway.data_client_id.paypal_subscriptions_enabled
+        ) {
             this.renderer.render(actionHandler.subscriptionsConfiguration());
             return;
         }

modules/ppcp-button/services.php

@@ -106,7 +106,10 @@ return array(
 		$product_intent       = $subscription_helper->current_product_is_subscription() ? 'authorize' : $intent;
 		$other_context_intent = $subscription_helper->cart_contains_subscription() ? 'authorize' : $intent;
 
-		if ( $settings->has( 'subscription_handler' ) && $settings->get( 'subscription_handler' ) ) {
+		if (
+			$settings->has( 'subscription_handler' )
+			&& $settings->get( 'subscription_handler' ) === true
+		) {
 			return 'subscription';
 		}
 

modules/ppcp-button/src/Assets/SmartButton.php

@@ -717,6 +717,21 @@ class SmartButton implements SmartButtonInterface {
 		return $this->subscription_helper->cart_contains_subscription();
 	}
 
+	/**
+	 * Whether PayPal subscriptions is enabled or not.
+	 *
+	 * @return bool
+	 */
+	private function paypal_subscriptions_enabled(): bool {
+		try {
+			$subscription_handler = $this->settings->get( 'subscription_handler' );
+		} catch ( NotFoundException $exception ) {
+			return false;
+		}
+
+		return $subscription_handler;
+	}
+
 	/**
 	 * Retrieves the 3D Secure contingency settings.
 	 *
@@ -748,11 +763,12 @@ class SmartButton implements SmartButtonInterface {
 		$localize = array(
 			'script_attributes'                 => $this->attributes(),
 			'data_client_id'                    => array(
-				'set_attribute'     => ( is_checkout() && $this->dcc_is_enabled() ) || $this->can_save_vault_token,
-				'endpoint'          => \WC_AJAX::get_endpoint( DataClientIdEndpoint::ENDPOINT ),
-				'nonce'             => wp_create_nonce( DataClientIdEndpoint::nonce() ),
-				'user'              => get_current_user_id(),
-				'has_subscriptions' => $this->has_subscriptions(),
+				'set_attribute'                => ( is_checkout() && $this->dcc_is_enabled() ) || $this->can_save_vault_token,
+				'endpoint'                     => \WC_AJAX::get_endpoint( DataClientIdEndpoint::ENDPOINT ),
+				'nonce'                        => wp_create_nonce( DataClientIdEndpoint::nonce() ),
+				'user'                         => get_current_user_id(),
+				'has_subscriptions'            => $this->has_subscriptions(),
+				'paypal_subscriptions_enabled' => $this->paypal_subscriptions_enabled(),
 			),
 			'redirect'                          => wc_get_checkout_url(),
 			'context'                           => $this->context,

modules/ppcp-subscription/src/SubscriptionModule.php

@@ -142,7 +142,19 @@ class SubscriptionModule implements ModuleInterface {
 		add_action(
 			'save_post',
 			function( $product_id ) use ( $c ) {
-				if ( empty( $_POST['_wcsnonce'] ) || ! wp_verify_nonce( $_POST['_wcsnonce'], 'wcs_subscription_meta' ) ) {
+				$settings = $c->get( 'wcgateway.settings' );
+				assert( $settings instanceof Settings );
+
+				try {
+					$subscription_handler = $settings->get( 'subscription_handler' );
+				} catch ( NotFoundException $exception ) {
+					return;
+				}
+
+				if (
+					$subscription_handler !== true
+					|| empty( $_POST['_wcsnonce'] )
+					|| ! wp_verify_nonce( wc_clean( wp_unslash( $_POST['_wcsnonce'] ) ), 'wcs_subscription_meta' ) ) {
 					return;
 				}
 
@@ -215,8 +227,8 @@ class SubscriptionModule implements ModuleInterface {
 								'ppcp_subscription',
 								__( 'PayPal Subscription', 'woocommerce-paypal-payments' ),
 								function() use ( $subscription_id, $plan_id ) {
-									echo '<p>Subscription ID: ' . $subscription_id . '</p>';
-									echo '<p>Plan ID: ' . $plan_id . '</p>';
+									echo '<p>Subscription ID: ' . esc_attr( $subscription_id ) . '</p>';
+									echo '<p>Plan ID: ' . esc_attr( $plan_id ) . '</p>';
 								},
 								$post_type,
 								'side',

modules/ppcp-vaulting/assets/js/myaccount-payments.js.LICENSE.txt

@@ -0,0 +1 @@
+/*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */