From fdbbe6afb3f8de8cc7cf8908dc3a84fd6f7c01de Mon Sep 17 00:00:00 2001
From: Alex P <alex.pantec@gmail.com>
Date: Wed, 8 Jun 2022 15:53:30 +0300
Subject: [PATCH] Send form data as json object to fix decoding

was decoded twice, in RequestData and by parse_str
---
 .../modules/ActionHandler/CheckoutActionHandler.js   |  6 ++++--
 .../ppcp-button/src/Endpoint/CreateOrderEndpoint.php |  4 ++--
 modules/ppcp-button/src/Endpoint/RequestData.php     | 12 +++---------
 3 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/modules/ppcp-button/resources/js/modules/ActionHandler/CheckoutActionHandler.js b/modules/ppcp-button/resources/js/modules/ActionHandler/CheckoutActionHandler.js
index 625fd369b..bc7a90b4a 100644
--- a/modules/ppcp-button/resources/js/modules/ActionHandler/CheckoutActionHandler.js
+++ b/modules/ppcp-button/resources/js/modules/ActionHandler/CheckoutActionHandler.js
@@ -20,7 +20,9 @@ class CheckoutActionHandler {
             const errorHandler = this.errorHandler;
 
             const formSelector = this.config.context === 'checkout' ? 'form.checkout' : 'form#order_review';
-            const formValues = jQuery(formSelector).serialize();
+            const formData = new FormData(document.querySelector(formSelector));
+            // will not handle fields with multiple values (checkboxes, <select multiple>), but we do not care about this here
+            const formJsonObj = Object.fromEntries(formData);
 
             const createaccount = jQuery('#createaccount').is(":checked") ? true : false;
 
@@ -34,7 +36,7 @@ class CheckoutActionHandler {
                     order_id:this.config.order_id,
                     payment_method: getCurrentPaymentMethod(),
                     funding_source: window.ppcpFundingSource,
-                    form:formValues,
+                    form: formJsonObj,
                     createaccount: createaccount
                 })
             }).then(function (res) {
diff --git a/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php b/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php
index 00a1fc3bd..98e990b3c 100644
--- a/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php
+++ b/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php
@@ -403,9 +403,9 @@ class CreateOrderEndpoint implements EndpointInterface {
 		}
 
 		if ( ! $payer && isset( $data['form'] ) ) {
-			parse_str( $data['form'], $form_fields );
+			$form_fields = $data['form'];
 
-			if ( isset( $form_fields['billing_email'] ) && '' !== $form_fields['billing_email'] ) {
+			if ( is_array( $form_fields ) && isset( $form_fields['billing_email'] ) && '' !== $form_fields['billing_email'] ) {
 				return $this->payer_factory->from_checkout_form( $form_fields );
 			}
 		}
diff --git a/modules/ppcp-button/src/Endpoint/RequestData.php b/modules/ppcp-button/src/Endpoint/RequestData.php
index aba5e9fe4..60e053c00 100644
--- a/modules/ppcp-button/src/Endpoint/RequestData.php
+++ b/modules/ppcp-button/src/Endpoint/RequestData.php
@@ -81,15 +81,9 @@ class RequestData {
 		$data = array();
 		foreach ( (array) $assoc_array as $raw_key => $raw_value ) {
 			if ( ! is_array( $raw_value ) ) {
-				/**
-				 * The 'form' key is preserved for url encoded data and needs different
-				 * sanitization.
-				 */
-				if ( 'form' !== $raw_key ) {
-					$data[ sanitize_text_field( (string) $raw_key ) ] = sanitize_text_field( (string) $raw_value );
-				} else {
-					$data[ sanitize_text_field( (string) $raw_key ) ] = sanitize_text_field( urldecode( (string) $raw_value ) );
-				}
+				// Not sure if it is a good idea to sanitize everything at this level,
+				// but should be fine for now since we do not send any HTML or multi-line texts via ajax.
+				$data[ sanitize_text_field( (string) $raw_key ) ] = sanitize_text_field( (string) $raw_value );
 				continue;
 			}
 			$data[ sanitize_text_field( (string) $raw_key ) ] = $this->sanitize( $raw_value );