cve-2026-9618-Patch

<?php
/**
 * Hardened PeachPay Stripe payment capture and void AJAX handlers.
 * By Taylor Christian Newsome
 * Security controls
 * - Authenticated AJAX requests only.
 * - Nonce verification.
 * - Strict order ID and amount validation.
 * - Order-specific authorization.
 * - Positive finite capture amounts.
 * - Exception handling and server-side logging.
 *
 * Requires WordPress, WooCommerce, and the PeachPay Stripe integration.
 */

defined( 'ABSPATH' ) || exit;

/**
 * Send a standardized JSON error and terminate execution.
 *
 * @param string $message Error message.
 * @param int    $status  HTTP response status.
 * @return void
 */
function peachpay_stripe_ajax_error( $message, $status = 400 ) {
	wp_send_json_error(
		array( 'message' => $message ),
		$status
	);
}

/**
 * Verify an AJAX nonce.
 *
 * @param string $action Nonce action.
 * @return void
 */
function peachpay_stripe_verify_ajax_nonce( $action ) {
	if (
		! isset( $_POST['security'] ) ||
		! is_string( $_POST['security'] )
	) {
		peachpay_stripe_ajax_error(
			'Invalid security token. Refresh the page and try again.',
			403
		);
	}

	$nonce = sanitize_text_field(
		wp_unslash( $_POST['security'] )
	);

	if ( ! wp_verify_nonce( $nonce, $action ) ) {
		peachpay_stripe_ajax_error(
			'Invalid security token. Refresh the page and try again.',
			403
		);
	}
}

/**
 * Validate and retrieve a positive order ID from POST data.
 *
 * @return int
 */
function peachpay_stripe_get_validated_order_id() {
	if (
		! isset( $_POST['order_id'] ) ||
		! is_string( $_POST['order_id'] ) &&
		! is_int( $_POST['order_id'] )
	) {
		peachpay_stripe_ajax_error(
			'A valid order_id is required.',
			400
		);
	}

	$raw_order_id = (string) wp_unslash( $_POST['order_id'] );

	// Reject arrays, decimals, signs, whitespace, and other malformed IDs.
	if (
		'' === $raw_order_id ||
		! ctype_digit( $raw_order_id ) ||
		(int) $raw_order_id < 1
	) {
		peachpay_stripe_ajax_error(
			'Invalid order_id.',
			400
		);
	}

	$order_id = absint( $raw_order_id );

	if ( $order_id < 1 ) {
		peachpay_stripe_ajax_error(
			'Invalid order_id.',
			400
		);
	}

	return $order_id;
}

/**
 * Retrieve an order and verify the current user is authorized to manage it.
 *
 * WooCommerce capability mappings can vary by version and configuration.
 * Confirm that these capabilities match the permissions used by your store.
 *
 * @param int $order_id Order ID.
 * @return WC_Order
 */
function peachpay_stripe_get_authorized_order( $order_id ) {
	if ( ! function_exists( 'wc_get_order' ) ) {
		peachpay_stripe_ajax_error(
			'WooCommerce is unavailable.',
			500
		);
	}

	$order = wc_get_order( $order_id );

	if ( ! $order ) {
		peachpay_stripe_ajax_error(
			'Order not found.',
			404
		);
	}

	if (
		! current_user_can( 'edit_shop_orders' ) ||
		! current_user_can( 'edit_shop_order', $order_id )
	) {
		peachpay_stripe_ajax_error(
			'Unauthorized to manage this order.',
			403
		);
	}

	return $order;
}

/**
 * Validate a positive decimal capture amount.
 *
 * This validates the syntax and numeric range. It does not establish the
 * Stripe payment intent's remaining capturable balance.
 *
 * @return float
 */
function peachpay_stripe_get_validated_capture_amount() {
	if (
		! isset( $_POST['amount_to_capture'] ) ||
		! is_string( $_POST['amount_to_capture'] ) &&
		! is_int( $_POST['amount_to_capture'] ) &&
		! is_float( $_POST['amount_to_capture'] )
	) {
		peachpay_stripe_ajax_error(
			'A valid amount_to_capture is required.',
			400
		);
	}

	$raw_amount = trim(
		(string) wp_unslash( $_POST['amount_to_capture'] )
	);

	// Accept ordinary decimal notation only; reject exponent notation,
	// signs, commas, currency symbols, and non-numeric input.
	if (
		'' === $raw_amount ||
		! preg_match( '/^\d+(?:\.\d+)?$/D', $raw_amount )
	) {
		peachpay_stripe_ajax_error(
			'Invalid amount to capture.',
			400
		);
	}

	// Reject excessively long values before converting to a float.
	if ( strlen( $raw_amount ) > 32 ) {
		peachpay_stripe_ajax_error(
			'Invalid amount to capture.',
			400
		);
	}

	$amount = (float) $raw_amount;

	if ( ! is_finite( $amount ) || $amount <= 0 ) {
		peachpay_stripe_ajax_error(
			'Invalid amount to capture.',
			400
		);
	}

	return $amount;
}

/**
 * Log a Stripe operation failure without exposing internal details to clients.
 *
 * @param string          $operation Operation name.
 * @param int             $order_id  Order ID.
 * @param Throwable       $exception Exception thrown.
 * @return void
 */
function peachpay_stripe_log_ajax_failure(
	$operation,
	$order_id,
	$exception
) {
	if ( function_exists( 'wc_get_logger' ) ) {
		wc_get_logger()->error(
			sprintf(
				'Stripe %s failed for order %d. Exception type: %s.',
				$operation,
				(int) $order_id,
				get_class( $exception )
			),
			array(
				'source' => 'peachpay-stripe',
			)
		);
	}
}

/**
 * Handle an authenticated AJAX request to capture a Stripe payment.
 *
 * @return void
 */
function peachpay_stripe_handle_capture_payment() {
	// 1. Verify request authenticity.
	peachpay_stripe_verify_ajax_nonce(
		'peachpay-stripe-capture-payment'
	);

	// 2. Validate the order ID and load an authorized order.
	$order_id = peachpay_stripe_get_validated_order_id();

	$order = peachpay_stripe_get_authorized_order(
		$order_id
	);

	// 3. Validate the requested capture amount.
	$raw_amount = peachpay_stripe_get_validated_capture_amount();

	// 4. Confirm the required PeachPay integration is available.
	if (
		! class_exists( 'PeachPay_Stripe' ) ||
		! is_callable( array( 'PeachPay_Stripe', 'format_amount' ) ) ||
		! is_callable( array( 'PeachPay_Stripe', 'capture_payment' ) )
	) {
		peachpay_stripe_ajax_error(
			'The Stripe payment integration is unavailable.',
			500
		);
	}

	try {
		// 5. Format the amount according to PeachPay's currency conventions.
		$amount_to_capture = PeachPay_Stripe::format_amount(
			$raw_amount,
			$order->get_currency()
		);

		if (
			! is_numeric( $amount_to_capture ) ||
			! is_finite( (float) $amount_to_capture ) ||
			(float) $amount_to_capture <= 0
		) {
			peachpay_stripe_ajax_error(
				'Invalid capture amount.',
				400
			);
		}

		/*
		 * IMPORTANT:
		 * capture_payment() must independently verify the Stripe PaymentIntent
		 * is capturable, enforce the remaining capturable balance, use the
		 * correct currency units, and handle duplicate requests safely.
		 */
		$result = PeachPay_Stripe::capture_payment(
			$order,
			$amount_to_capture
		);
	} catch ( Throwable $exception ) {
		peachpay_stripe_log_ajax_failure(
			'capture',
			$order_id,
			$exception
		);

		peachpay_stripe_ajax_error(
			'Unable to capture the payment. Please check the payment status.',
			500
		);
	}

	// Preserve the existing PeachPay response format.
	wp_send_json( $result );
}

/**
 * Handle an authenticated AJAX request to void a Stripe payment.
 *
 * @return void
 */
function peachpay_stripe_handle_void_payment() {
	// 1. Verify request authenticity.
	peachpay_stripe_verify_ajax_nonce(
		'peachpay-stripe-void-payment'
	);

	// 2. Validate the order ID and load an authorized order.
	$order_id = peachpay_stripe_get_validated_order_id();

	$order = peachpay_stripe_get_authorized_order(
		$order_id
	);

	// 3. Confirm the required PeachPay integration is available.
	if (
		! class_exists( 'PeachPay_Stripe' ) ||
		! is_callable( array( 'PeachPay_Stripe', 'void_payment' ) )
	) {
		peachpay_stripe_ajax_error(
			'The Stripe payment integration is unavailable.',
			500
		);
	}

	try {
		/*
		 * IMPORTANT:
		 * void_payment() must confirm the Stripe PaymentIntent is in a
		 * cancelable state. A payment that has already been captured cannot
		 * generally be voided; it may require a refund instead.
		 */
		$result = PeachPay_Stripe::void_payment( $order );
	} catch ( Throwable $exception ) {
		peachpay_stripe_log_ajax_failure(
			'void',
			$order_id,
			$exception
		);