Updates to 1.11.37

app/controllers/MeprAppCtrl.php

@@ -460,10 +460,16 @@ public static function setup_menus()
 
     public static function admin_bar_menu($wp_admin_bar)
     {
+        $mepr_options = MeprOptions::fetch();
+
         if (! MeprUtils::is_mepr_admin()) {
             return;
         }
 
+        if ($mepr_options->hide_admin_bar_menu) {
+            return;
+        }
+
         $notifications_count = MeprNotifications::has_access() ?
             count(
                 MeprGrdLvlCtrl::getContainer()->get(Store::class)->fetch()->notifications(false, Store::FILTER_UNREAD)
@@ -934,10 +940,11 @@ public static function load_scripts()
                 'spc_enabled'       => ( $mepr_options->enable_spc || $mepr_options->design_enable_checkout_template ),
                 'spc_invoice'       => ( $mepr_options->enable_spc_invoice || $mepr_options->design_enable_checkout_template ),
                 'no_compatible_pms' => __('There are no payment methods available that can purchase this product, please contact the site administrator or purchase it separately.', 'memberpress'),
-                'switch_pm_prompt'  => __('It looks like your purchase requires %s. No problem! Just click below to switch.', 'memberpress'),
-                'switch_pm'         => __('Switch to %s', 'memberpress'),
-                'cancel'            => __('Cancel', 'memberpress'),
-                'warning_icon_url'  => MEPR_IMAGES_URL . '/notice-icon-error.png',
+                'switch_pm_prompt' => __('It looks like your purchase requires %s. No problem! Just click below to switch.', 'memberpress'),
+                'switch_pm' => __('Switch to %s', 'memberpress'),
+                'cancel' => __('Cancel', 'memberpress'),
+                'no_compatible_pms_ob_required' => __('Payment Gateway(s) do not support required order configuration.', 'memberpress'),
+                'warning_icon_url' => MEPR_IMAGES_URL . '/notice-icon-error.png',
             ];
 
             wp_localize_script('mp-signup', 'MeprSignup', $local_data);

app/controllers/MeprCheckoutCtrl.php

@@ -944,6 +944,16 @@ public static function prepare_transaction(MeprProduct $product, $order_id, $use
     public static function get_order_bump_products($product_id, array $order_bump_product_ids)
     {
         $order_bump_products = [];
+        $base_product = new MeprProduct($product_id);
+        $required_order_bumps = $base_product->get_required_order_bumps();
+
+        // Track if all required order bumps are found
+        if (!empty($required_order_bumps) && !empty($order_bump_product_ids)) {
+            $missing_required_order_bumps = array_diff($required_order_bumps, $order_bump_product_ids);
+            if (!empty($missing_required_order_bumps)) {
+                throw new Exception(__('One of the required products is missing.', 'memberpress'));
+            }
+        }
 
         foreach ($order_bump_product_ids as $order_bump_product_id) {
             $product = new MeprProduct($order_bump_product_id);
@@ -1022,6 +1032,30 @@ public function get_checkout_state()
         MeprProductsHelper::display_invoice($prd, $coupon_code);
         $price_string = ob_get_clean();
 
+        // By default hide required order bumps pricing terms on SPC and ReadyLaunch™ Templates.
+        $disable_ob_required_terms = $mepr_options->enable_spc || $mepr_options->design_enable_checkout_template;
+        if (! $mepr_options->enable_spc_invoice) {
+            $disable_ob_required_terms = false;
+        }
+
+        if (! MeprHooks::apply_filters('mepr_signup_disable_order_bumps_required_terms', $disable_ob_required_terms, $prd)) {
+            $required_order_bumps = $prd->get_required_order_bumps();
+            if (! empty($required_order_bumps)) {
+                ob_start();
+                foreach ($required_order_bumps as $required_order_bump_id) {
+                    if (! MeprHooks::apply_filters('mepr_signup_skip_order_bump_required_terms', false, $required_order_bump_id, $prd)) {
+                        echo'<br />';
+                        MeprProductsHelper::display_invoice(new MeprProduct($required_order_bump_id), false, true);
+                    }
+                }
+
+                $required_order_bumps_terms = ob_get_clean();
+                if (! empty($required_order_bumps_terms)) {
+                    $price_string .= wp_kses_post($required_order_bumps_terms);
+                }
+            }
+        }
+
         ob_start();
         MeprProductsHelper::display_spc_invoice($prd, $coupon_code, $order_bump_products);
         $invoice_html = ob_get_clean();

app/controllers/MeprCoachkitCtrl.php

@@ -14,18 +14,18 @@ public function load_hooks()
             add_action('admin_enqueue_scripts', [$this, 'enqueue_scripts']);
             add_action('wp_ajax_mepr_coachkit_action', [$this, 'ajax_coachkit_action']);
         } else {
-            add_action( 'admin_notices', array( $this, 'activated_admin_notice' ) );
+            add_action('admin_notices', [$this, 'activated_admin_notice']);
         }
     }
 
     public function activated_admin_notice()
     {
-        if ( isset( $_GET['coachkit_activated'] ) && ! empty( $_GET['coachkit_activated'] ) && 'true' === $_GET['coachkit_activated'] ) : ?>
+        if (isset($_GET['coachkit_activated']) && ! empty($_GET['coachkit_activated']) && 'true' === $_GET['coachkit_activated']) : ?>
           <div class="notice notice-success is-dismissible">
-            <p><?php esc_html_e( 'MemberPress CoachKit™ has been activated successfully!', 'memberpress' ) ?></p>
+            <p><?php esc_html_e('MemberPress CoachKit™ has been activated successfully!', 'memberpress') ?></p>
           </div>
         <?php endif;
-      }
+    }
 
     public static function route()
     {
@@ -44,7 +44,7 @@ public static function route()
     public function enqueue_scripts($hook)
     {
         if (preg_match('/_page_memberpress-(coachkit|options)$/', $hook)) {
-            remove_all_actions( 'admin_notices' );
+            remove_all_actions('admin_notices');
             wp_enqueue_style('mepr-sister-plugin-css', MEPR_CSS_URL . '/admin-sister-plugin.css', [], MEPR_VERSION);
         }
     }

app/controllers/MeprOnboardingCtrl.php

@@ -241,7 +241,7 @@ public static function maybe_install_activate_addons($license_addons, $addon_slu
     {
         $return_value = -1;
 
-        if ( ! empty($license_addons) && isset($license_addons->$addon_slug)) {
+        if (! empty($license_addons) && isset($license_addons->$addon_slug)) {
             $addon_info = $license_addons->$addon_slug;
 
             $plugin_url = $addon_info->url;
@@ -1258,13 +1258,12 @@ public static function install_addons()
                         } else {
                             $message = esc_html__('Unable to install. Please download and install manually.', 'memberpress');
                             if (-1 === (int) $response) {
-
                                 $purchase_links = MeprOnboardingHelper::features_addons_purchase_links();
 
                                 $features_data['addons_upgrade_failed'][] = $addon_slug;
                                 $features_data['addons_upgrade_failed'] = array_unique($features_data['addons_upgrade_failed']);
 
-                                if( isset($purchase_links[$addon_slug])) {
+                                if (isset($purchase_links[$addon_slug])) {
                                     $message = MeprOnboardingHelper::prepare_purchase_message($purchase_links[$addon_slug]);
                                 }
                             }

app/controllers/MeprProductsCtrl.php

@@ -274,7 +274,8 @@ public static function save_postdata($post_id)
             $product->customize_payment_methods = isset($_mepr_customize_payment_methods);
             $product->customize_profile_fields = isset($_mepr_customize_profile_fields);
             $product->custom_profile_fields = []; // We'll populate it below if we need to
-            $product->custom_payment_methods = json_decode(sanitize_text_field(wp_unslash($_POST['mepr-product-payment-methods-json'])));
+            $custom_payment_methods = json_decode(sanitize_text_field(wp_unslash($_POST['mepr-product-payment-methods-json'])));
+            $product->custom_payment_methods = is_array($custom_payment_methods) ? $custom_payment_methods : [];
             $product->custom_login_urls_enabled = isset($_mepr_custom_login_urls_enabled);
             $product->expire_type = isset(${MeprProduct::$expire_type_str}) ? sanitize_text_field($_POST[MeprProduct::$expire_type_str]) : $product->attrs['expire_type'];
             $product->expire_after = isset(${MeprProduct::$expire_after_str}) ? sanitize_text_field($_POST[MeprProduct::$expire_after_str]) : $product->attrs['expire_after'];
@@ -451,7 +452,7 @@ public static function validate_product($product)
         }
 
         // Make sure there's at least one payment method selected when customizing payment methods.
-        if ($product->customize_payment_methods && count($product->custom_payment_methods) <= 0) {
+        if ($product->customize_payment_methods && (empty($product->custom_payment_methods) || ! is_array($product->custom_payment_methods))) {
             $product->customize_payment_methods = false;
         }
 

app/controllers/MeprRulesCtrl.php

@@ -56,7 +56,6 @@ public function load_hooks()
             add_filter('woocommerce_variation_is_visible', 'MeprRulesCtrl::override_wc_is_visible', 11, 4);
             add_filter('mepr-pre-run-rule-content', 'MeprRulesCtrl::dont_hide_wc_product_content', 11, 3);
         }
-        add_action('wp_enqueue_scripts', 'MeprRulesCtrl::enqueue_scripts_paywall');
     }
 
     public function register_post_type()
@@ -418,6 +417,7 @@ public static function unauthorized_message($post)
             MeprView::render('/readylaunch/shared/unauthorized_message', get_defined_vars());
         } else {
             if (isset($unauth->modern_paywall) && true === $unauth->modern_paywall && ! MeprAppHelper::is_memberpress_page($post)) {
+                wp_enqueue_script('mepr-modern-paywall', MEPR_JS_URL . '/modern_paywall.js', ['jquery'], MEPR_VERSION, true);
                 MeprView::render('/shared/unauthorized_message_modern_paywall', get_defined_vars());
             } else {
                 MeprView::render('/shared/unauthorized_message', get_defined_vars());
@@ -1050,19 +1050,4 @@ public static function validate_rule_content($rule, $post_id)
             MeprUtils::debug_log("Rule (#{$post_id}) content can't be empty. Post status forced to 'draft'");
         }
     }
-
-    /**
-     * Enqueue Scripts for modern paywall.
-     */
-    public static function enqueue_scripts_paywall()
-    {
-        $current_post = MeprUtils::get_current_post();
-        if (false === $current_post) {
-            return;
-        }
-        $unauth = MeprRule::get_unauth_settings_for($current_post);
-        if (MeprRule::is_locked($current_post) && isset($unauth->modern_paywall) && true === $unauth->modern_paywall && ! MeprAppHelper::is_memberpress_page($current_post)) {
-            wp_enqueue_script('modern-paywall', MEPR_JS_URL . '/modern_paywall.js', ['jquery'], MEPR_VERSION, true);
-        }
-    }
-} //End class
+}

app/controllers/MeprUsersCtrl.php

@@ -372,7 +372,7 @@ public static function validate_extra_profile_fields(
 
         // Prevent checking when adding a new user via WP's New User system
         // or if an admin is editing the profile in the dashboard
-        if ($update === false || ($update !== false && MeprUtils::is_mepr_admin())) {
+        if ($update === false || ($update !== false && MeprUtils::is_mepr_admin() && is_admin())) {
             return $errs;
         }
 

app/data/events.php

@@ -1,6 +1,6 @@
 <?php
 
-return [
+return MeprHooks::apply_filters('mepr_events', [
     /**
      * Events for Members
      */
@@ -160,4 +160,4 @@
     'mpca-quiz-attempt-completed' => (object) [
         'unique' => false,
     ],
-];
+]);

app/gateways/MeprPayPalStandardGateway.php

@@ -627,7 +627,10 @@ public function record_refund()
 
             $txn->store();
 
-            MeprUtils::send_refunded_txn_notices($txn);
+            MeprUtils::send_refunded_txn_notices(
+                $txn,
+                MeprHooks::apply_filters('mepr_paypal_std_transaction_refunded_event_args', '', $txn)
+            );
 
             return $txn;
         }
@@ -1382,6 +1385,19 @@ private function update_paypal_payment_profile($sub_id, $action = 'cancel')
         $_REQUEST['recurring_payment_id'] = $sub->subscr_id;
     }
 
+    /**
+     * Determine if the current request is a redirect from PayPal
+     *
+     * @return boolean
+     */
+    private function is_paypal_referrer()
+    {
+        $referrer = isset($_SERVER['HTTP_REFERER']) ? wp_unslash($_SERVER['HTTP_REFERER']) : '';
+        $is_paypal_referrer = (strpos($referrer, 'paypal.com') !== false);
+
+        return MeprHooks::apply_filters('mepr_paypal_standard_is_paypal_referrer', $is_paypal_referrer);
+    }
+
     /**
      * Find the transaction from a PayPal return
      *
@@ -1424,14 +1440,17 @@ protected function get_paypal_return_txn()
 
     public function return_handler()
     {
-        $this->email_status("Paypal Return \$_REQUEST:\n" . MeprUtils::object_to_string($_REQUEST, true) . "\n", $this->settings->debug);
-
         $mepr_options = MeprOptions::fetch();
 
+        if (! $this->is_paypal_referrer()) {
+            wp_die(_x('Something unexpected has occurred. Please contact us for assistance.', 'ui', 'memberpress') . ' <br/><a href="' . $mepr_options->account_page_url('action=subscriptions') . '">View my Subscriptions</a>');
+        }
+
+        $this->email_status("Paypal Return \$_REQUEST:\n" . MeprUtils::object_to_string($_REQUEST, true) . "\n", $this->settings->debug);
+
         // Let's find the transaction from the PayPal return URL vars
         $txn = $this->get_paypal_return_txn();
 
-
         if (isset($txn->id) && $txn->id) {
             $product  = new MeprProduct($txn->product_id);
 
@@ -1498,33 +1517,33 @@ public function return_handler()
 
             // If $sub let's set this up as a confirmation txn until the IPN comes in later so the user can have access now
             if ($sub) {
-                $sub->status      = MeprSubscription::$active_str;
-                $sub->created_at  = $txn->created_at; // Set the created at too
+                $sub->status     = MeprSubscription::$active_str;
+                $sub->created_at = $txn->created_at; // Set the created at too
                 $sub->store();
 
                 if (!$mepr_options->disable_grace_init_days && $mepr_options->grace_init_days > 0) {
-                    $expires_at = MeprUtils::ts_to_mysql_date(time() + MeprUtils::days($mepr_options->grace_init_days), 'Y-m-d 23:59:59');
+                    $expires_at  = MeprUtils::ts_to_mysql_date(time() + MeprUtils::days($mepr_options->grace_init_days), 'Y-m-d 23:59:59');
                 } else {
-                    $expires_at = $txn->created_at; // Expire immediately
+                    $expires_at  = $txn->created_at; // Expire immediately
                 }
 
-                $txn->trans_num   = uniqid();
-                $txn->txn_type    = MeprTransaction::$subscription_confirmation_str;
-                $txn->status      = MeprTransaction::$confirmed_str;
-                $txn->expires_at  = $expires_at;
+                $txn->trans_num  = uniqid();
+                $txn->txn_type   = MeprTransaction::$subscription_confirmation_str;
+                $txn->status     = MeprTransaction::$confirmed_str;
+                $txn->expires_at = $expires_at;
                 $txn->store(true);
             } else {
                 // The amount can be fudged in the URL with PayPal Standard - so let's make sure no fudgyness is goin' on
                 if (isset($_GET['amt']) && (float)$_GET['amt'] < (float)$txn->total) {
-                    $txn->status    = MeprTransaction::$pending_str;
-                    $txn->txn_type  = MeprTransaction::$payment_str;
+                    $txn->status     = MeprTransaction::$pending_str;
+                    $txn->txn_type   = MeprTransaction::$payment_str;
                     $txn->store();
                     wp_die(_x('Your payment amount was lower than expected. Please contact us for assistance if necessary.', 'ui', 'memberpress') . ' <br/><a href="' . $mepr_options->account_page_url('action=subscriptions') . '">View my Subscriptions</a>');
                 }
 
                 // Don't set a trans_num here - it will get updated when the IPN comes in
-                $txn->txn_type    = MeprTransaction::$payment_str;
-                $txn->status      = MeprTransaction::$complete_str;
+                $txn->txn_type   = MeprTransaction::$payment_str;
+                $txn->status     = MeprTransaction::$complete_str;
                 $txn->store();
             }
 

app/gateways/MeprStripeGateway.php

@@ -1652,7 +1652,10 @@ public function record_refund()
                 $txn->status = MeprTransaction::$refunded_str;
                 $txn->store();
 
-                MeprUtils::send_refunded_txn_notices($txn);
+                MeprUtils::send_refunded_txn_notices(
+                    $txn,
+                    MeprHooks::apply_filters('mepr_stripe_transaction_refunded_event_args', '', $txn, $charge)
+                );
 
                 return $txn->id;
             }

app/helpers/MeprOnboardingHelper.php

@@ -127,8 +127,8 @@ public static function features_addons_purchase_links()
     public static function prepare_purchase_message($purchase_link)
     {
         return sprintf(
-            esc_html__('Unable to install. You can %spurchase it here%s, afterwards you can install it from the add-ons page.', 'memberpress'),
-            '<a href="'.esc_url($purchase_link).'">',
+            esc_html__('Unable to install. You can %1$spurchase it here%2$s, afterwards you can install it from the add-ons page.', 'memberpress'),
+            '<a href="' . esc_url($purchase_link) . '">',
             '</a>'
         );
     }