diff --git a/modules.local/ppcp-button/src/Endpoint/RequestData.php b/modules.local/ppcp-button/src/Endpoint/RequestData.php index 100741594..e85132895 100644 --- a/modules.local/ppcp-button/src/Endpoint/RequestData.php +++ b/modules.local/ppcp-button/src/Endpoint/RequestData.php @@ -13,18 +13,33 @@ class RequestData { $stream = file_get_contents('php://input'); $json = json_decode($stream, true); + add_filter('nonce_user_logged_out', array($this, 'nonceFix'), 100); if ( ! isset($json['nonce']) || !wp_verify_nonce($json['nonce'], $nonce) ) { + remove_filter('nonce_user_logged_out', array($this, 'nonceFix'), 100); throw new RuntimeException( __('Could not validate nonce.', 'woocommerce-paypal-commerce-gateway') ); } + remove_filter('nonce_user_logged_out', array($this, 'nonceFix'), 100); return $this->sanitize($json); } + /** + * woocommerce will give you a customer object on your 2nd request. the first page + * load will not yet have this customer object, but the ajax request will. Therefore + * the nonce validation will fail. this fixes this problem: + * + * @wp-hook nonce_user_logged_out + * @see https://github.com/woocommerce/woocommerce/blob/69e3835041113bee80379c1037e97e26815a699b/includes/class-wc-session-handler.php#L288-L296 * @return int + */ + public function nonceFix() { + return 0; + } + private function sanitize(array $assocArray): array { $data = [];