JezK

Edit File: PickupLocationsRestController.php

<?php
declare( strict_types = 1 );

namespace Automattic\WooCommerce\Blocks\Shipping;

/**
 * REST controller for Local Pickup location settings.
 *
 * Exposes /wc/v3/pickup-locations so users with the manage_woocommerce
 * capability (e.g. Shop Managers) can save Local Pickup settings without
 * requiring the manage_options capability needed by /wp/v2/settings.
 *
 * @since 11.0.0
 */
class PickupLocationsRestController extends \WP_REST_Controller {

/**
	 * REST API namespace.
	 *
	 * @var string
	 */
	protected $namespace = 'wc/v3';

/**
	 * REST API resource base.
	 *
	 * @var string
	 */
	protected $rest_base = 'pickup-locations';

/**
	 * Register routes.
	 *
	 * @return void
	 */
	public function register_routes() {
		register_rest_route(
			$this->namespace,
			'/' . $this->rest_base,
			array(
				array(
					'methods'             => \WP_REST_Server::EDITABLE,
					'callback'            => array( $this, 'update_settings' ),
					'permission_callback' => array( $this, 'update_settings_permissions_check' ),
					'args'                => array(
						'pickup_location_settings' => array(
							'description' => __( 'Local pickup method settings.', 'woocommerce' ),
							'type'        => 'object',
						),
						'pickup_locations'         => array(
							'description' => __( 'List of local pickup locations.', 'woocommerce' ),
							'type'        => 'array',
						),
					),
				),
			)
		);
	}

/**
	 * Check whether the current user can update pickup location settings.
	 *
	 * @param \WP_REST_Request<array<string, mixed>> $request Request object.
	 * @return true|\WP_Error
	 */
	public function update_settings_permissions_check( $request ) {
		if ( ! wc_rest_check_manager_permissions( 'settings', 'edit' ) ) {
			return new \WP_Error(
				'woocommerce_rest_cannot_edit',
				__( 'Sorry, you cannot edit this resource.', 'woocommerce' ),
				array( 'status' => rest_authorization_required_code() )
			);
		}

return true;
	}

/**
	 * Save pickup location settings and return the saved values.
	 *
	 * @param \WP_REST_Request<array<string, mixed>> $request Request object.
	 * @return \WP_REST_Response|\WP_Error
	 */
	public function update_settings( $request ) {
		$settings  = $request->get_param( 'pickup_location_settings' );
		$locations = $request->get_param( 'pickup_locations' );

if ( is_array( $settings ) ) {
			$settings = $this->sanitize_pickup_location_settings( $settings );
			update_option( 'woocommerce_pickup_location_settings', $settings );
		}

if ( is_array( $locations ) ) {
			$locations = $this->sanitize_pickup_locations( $locations );
			update_option( 'pickup_location_pickup_locations', $locations );
		}

// The settings UI always saves both arrays together; a Tracks snapshot is
		// only meaningful with both present, so skip partial (non-UI) updates.
		if ( is_array( $settings ) && is_array( $locations ) ) {
			$this->record_save_event( $settings, $locations );
		}

return rest_ensure_response(
			array(
				'pickup_location_settings' => $settings,
				'pickup_locations'         => $locations,
			)
		);
	}

/**
	 * Record a Tracks event summarising a Local Pickup settings save.
	 *
	 * @param array $settings  Sanitized method settings.
	 * @param array $locations Sanitized list of pickup locations.
	 * @return void
	 */
	private function record_save_event( array $settings, array $locations ): void {
		$cost = $settings['cost'] ?? '';

\WC_Tracks::record_event(
			'local_pickup_save_changes',
			array(
				'local_pickup_enabled'     => 'yes' === ( $settings['enabled'] ?? '' ),
				'title'                    => __( 'Pickup', 'woocommerce' ) === ( $settings['title'] ?? '' ),
				'price'                    => '' === $cost,
				'cost'                     => '' === $cost ? 0 : $cost,
				'taxes'                    => $settings['tax_status'] ?? '',
				'total_pickup_locations'   => count( $locations ),
				'pickup_locations_enabled' => count(
					array_filter(
						$locations,
						function ( $location ) {
							return ! empty( $location['enabled'] );
						}
					)
				),
			)
		);
	}

/**
	 * Sanitize the pickup_location_settings payload before persisting.
	 *
	 * The WP REST dispatcher only auto-sanitizes top-level args, so nested
	 * object properties need to be cleaned here as defense in depth against
	 * stored HTML/JS in admin surfaces.
	 *
	 * @param array $settings Raw settings payload.
	 * @return array Sanitized settings payload.
	 */
	private function sanitize_pickup_location_settings( array $settings ): array {
		$sanitized = array();

if ( isset( $settings['enabled'] ) ) {
			$sanitized['enabled'] = in_array( $settings['enabled'], array( 'yes', 'no' ), true )
				? $settings['enabled']
				: 'no';
		}

if ( isset( $settings['title'] ) ) {
			$sanitized['title'] = sanitize_text_field( (string) $settings['title'] );
		}

if ( isset( $settings['tax_status'] ) ) {
			$sanitized['tax_status'] = in_array( $settings['tax_status'], array( 'taxable', 'none' ), true )
				? $settings['tax_status']
				: 'none';
		}

if ( isset( $settings['cost'] ) ) {
			// Cost may be a math expression (e.g. "5 + 1.50"), so strip HTML
			// without coercing to float — floatval would break formula syntax.
			$sanitized['cost'] = wp_strip_all_tags( (string) $settings['cost'] );
		}

return $sanitized;
	}

/**
	 * Sanitize the pickup_locations payload before persisting.
	 *
	 * @param array $locations Raw list of pickup locations.
	 * @return array Sanitized list of pickup locations.
	 */
	private function sanitize_pickup_locations( array $locations ): array {
		$sanitized = array();

foreach ( $locations as $location ) {
			if ( ! is_array( $location ) ) {
				continue;
			}

$name = isset( $location['name'] ) ? sanitize_text_field( (string) $location['name'] ) : '';

// A pickup location with no name is unusable, and incomplete entries
			// would later trigger undefined-index notices in
			// ShippingController::hydrate_client_settings(), which reads these
			// fields unconditionally. Skip nameless entries and always emit every
			// key with a safe default for the ones we keep.
			if ( '' === $name ) {
				continue;
			}

// Always emit every address key with a safe default. Downstream
			// readers such as ShippingController::filter_taxable_address() access
			// state/postcode/city unconditionally once country is set, so a
			// partial address (e.g. only country) would trigger undefined-index
			// notices.
			$address = array();
			if ( isset( $location['address'] ) && is_array( $location['address'] ) ) {
				foreach ( array( 'address_1', 'city', 'state', 'postcode', 'country' ) as $field ) {
					$address[ $field ] = isset( $location['address'][ $field ] )
						? sanitize_text_field( (string) $location['address'][ $field ] )
						: '';
				}
			}

$enabled = isset( $location['enabled'] ) ? rest_sanitize_boolean( (string) $location['enabled'] ) : false;

$sanitized[] = array(
				'name'    => $name,
				'address' => $address,
				// Details may contain limited HTML. Match the rendering side
				// in ShippingController::show_local_pickup_details() which uses
				// wp_kses_post().
				'details' => isset( $location['details'] ) ? wp_kses_post( (string) $location['details'] ) : '',
				'enabled' => $enabled,
			);
		}

return $sanitized;
	}
}