Ticket #4054: 4054.diff

wordcamp-reports/classes/report/class-base-details.php

@@ -6 +6 @@
  */
 
 namespace WordCamp\Reports\Report;
-defined( 'WPINC' ) || die();
-use Exception;
+use DateTime, Exception;
+use WP_Error;
 use WordCamp\Reports\Utility\Date_Range;
 use function WordCamp\Reports\{get_assets_url, get_assets_dir_path, get_views_dir_path};
 use function WordCamp\Reports\Validation\{validate_date_range};
 use WordCamp\Utilities\Export_CSV;
 
+defined( 'WPINC' ) || die();
+
 /**
  * Class Base_Details
  * Base class of details report type
@@ -360 +362 @@
 
                 $exporter->emit_file();
         }
+
+        /**
+         * Parse input params for public report.
+         *
+         * @return array
+         */
+        public static function parse_public_report_input() {
+                $action     = filter_input( INPUT_GET, 'action' );
+                $start_date = filter_input( INPUT_GET, 'start-date' );
+                $end_date   = filter_input( INPUT_GET, 'end-date' );
+
+                $valid_input = array(
+                        'range'   => null,
+                        'error'   => null,
+                        'options' => array(),
+                );
+
+                if ( $start_date && $end_date ) {
+                        try {
+                                $valid_input['range'] = validate_date_range( $start_date, $end_date );
+                        } catch ( Exception $exception ) {
+                                $valid_input['error'] = array(
+                                        'error' => new WP_Error( 'date-range-error', $exception->getMessage() ),
+                                );
+                        }
+
+                        $valid_input['options'] = array(
+                                'earliest_start' => new DateTime( '2006-01-01' ), // No WordCamp posts before 2006.
+                                // this isn't working on front-end, but i don't think it's meant to
+
+                                // should pass public explicitly here?
+
+                                // should this be set at all? if so, should it be set from the child class? b/c this is used for meetups too.
+                                // maybe make note that no meetups before 2006 either?
+                        );
+                }
+
+                return $valid_input;
+        }
 }
+ No newline at end of file

wordcamp-reports/classes/report/class-base.php

@@ -14 +14 @@
  * A base report class with methods for filtering and caching data, and handling errors, plus some other helper methods.
  *
  * Things to keep in mind when writing a new report
- *  - Currently all reports extend `Date_Range` range than extending this directly. If your new report isn't based
+ *  - Currently all reports extend `Date_Range` rather than extending this directly. If your new report isn't based
  *    on pulling data between a date range, then you might want to write a new abstract class that's similar to
  *    `Date_Range`, or just extend this directly, depending on the likelihood of that new abstract class being
  *    reused in the future.

wordcamp-reports/classes/report/class-wordcamp-details.php

@@ -3 +3 @@
  * @package WordCamp\Reports
  */
 
+// todo run phpcs and eslint in next commit
+
 namespace WordCamp\Reports\Report;
 defined( 'WPINC' ) || die();
 
@@ -21 +23 @@
  *
  * Note that this report does not use caching because it is only used in WP Admin and has a large number of
  * optional parameters.
+ * todo add caching, update ^
+ *   make sure don't expose private fields via caching, but should be find if use get_cache_key(), since it includes $options['public'] in key
+ *  maybe don't add caching b/c unlikely to get cache-hit on the date ranges, or maybe just leave it as a todo
  *
  * @package WordCamp\Reports\Report
  */
@@ -66 +71 @@
          */
         public static $group = 'wordcamp';
 
+        /**
+         * Shortcode tag for outputting the public report form.
+         *
+         * @var string
+         */
+        public static $shortcode_tag = 'wordcamp_details_report';
+
         /**
          * Whether to include counts of various post types for each WordCamp.
          *
@@ -109 +121 @@
                 return array_merge(
                         [
                                 'Name',
+                                //todo? or included below?
                         ],
                         WordCamp_Loader::get_public_meta_keys()
                 );
@@ -286 +299 @@
                         require_once( WP_PLUGIN_DIR . '/wcpt/wcpt-wordcamp/wordcamp-admin.php' );
                 }
 
+                // todo if phpcs doesn't already catch defining arrays inside params, add a note to catch that. it should though b/c that's what core does now, unless it was just talked about but not impelemented
+                        // now that manually changes this line, need to find another example in this plugin to look for
                 $meta_keys = array_merge(
                         array_keys( WordCamp_Admin::meta_keys( 'all' ) ),
                         WordCamp_Admin::get_venue_address_meta_keys()
@@ -381 +396 @@
                 return $counts;
         }
 
+        /**
+         * Determine whether to render the public report form.
+         *
+         * This shortcode is limited to use on pages.
+         *
+         * @return string HTML content to display shortcode.
+         */
+        public static function handle_shortcode() {
+                if ( 'page' !== get_post_type() ) {
+                        return '';
+                }
+
+                ob_start();
+                self::render_public_page();
+                return ob_get_clean();
+
+                // add note that showing all public fields for simplicity, rather than letting pick individual ones like wp-admin can
+                // make sure that only showing PUBLIC fields, though
+        }
+
+        /**
+         * Render the page for this report on the front end.
+         *
+         * @return void
+         */
+        public static function render_public_page() {
+                $report     = null;
+                $start_date = '';
+                $end_date   = '';
+                $params     = self::parse_public_report_input();
+
+                if ( ! empty( $params['range'] ) ) {
+                        $start_date = $params['range']->start->format( 'Y-m-d' );
+                        $end_date   = $params['range']->end->format( 'Y-m-d' );
+                        $report     = new self( $params['range'], null, false, $params['options'] );
+                        // need to do this part in other function like admin page does?
+                                // what other function?
+
+                        // add params for public (just to be explicit), or any other params?
+                        // maybe earliest_date should be in here instead of parse_inptu()?
+                }
+
+                include get_views_dir_path() . 'public/wordcamp-details.php';
+
+                // css to size/position export button
+        }
+
         /**
          * Render the page for this report in the WP Admin.
          *
@@ -412 +474 @@
                 $nonce            = filter_input( INPUT_POST, self::$slug . '-nonce' );
 
                 $report = null;
+                $options = array();
 
+return;
+wp_die('x');
                 if ( 'Export CSV' !== $action ) {
                         return;
                 }
 
-                if ( ! wp_verify_nonce( $nonce, 'run-report' ) ) {
-                        return;
-                }
+                if ( is_admin() ) {
+                        if ( ! wp_verify_nonce( $nonce, 'run-report' ) ) {
+                                return;
+                        }
 
-                if ( ! current_user_can( 'manage_network' ) ) {
-                        return;
+                        if ( ! current_user_can( 'manage_network' ) ) {
+                                return;
+                        }
+
+                        $options['public'] = false;
+                } else {
+                        $options['public'] = true;
+
+                        // where does $fields get set? i guess i need to make a hidden input field for that
+                        // but make sure it's validated server side b/c attacker could just override
                 }
 
+                // need to make sure any changes above don't allow attacker to get a private report via the front end
+                        // maybe pass in a param to
+
                 $error = null;
                 $range = null;
 
@@ -450 +527 @@
                 // The "Name" field should always be included, but does not get submitted because the input is disabled,
                 // so add it in here.
                 $fields[] = 'Name';
+                // need to add on front end?
 
-                $options = array(
-                        'fields' => $fields,
-                        'public' => false,
-                );
-
+                $options['fields'] = $fields;    // hardcode these to the public function?
 
                 $report = new self( $range, null, $include_counts, $options );
 
+                var_dump($report);wp_die();
+
                 self::export_to_file_common( $report );
         }
 
+        // ask corey for feedback on this changeset
 }

new file wordcamp-reports/classes/report/class-wordcamp-sessions.php

@@ +1 @@
+<?php
+/**
+ * WordCamp Payment Methods.
+ *
+ * @package WordCamp\Reports
+ */
+
+namespace WordCamp\Reports\Report;
+defined( 'WPINC' ) || die();
+
+use Exception;
+use WordCamp\Reports;
+use WordCamp\Utilities;
+use function WordCamp\Reports\Validation\{validate_wordcamp_id};
+
+/**
+ * Class WordCamp_Payment_Methods
+ *
+ * @package WordCamp\Reports\Report
+ */
+class WordCamp_Payment_Methods extends Date_Range {
+        /**
+         * Report name.
+         *
+         * @var string
+         */
+        public static $name = 'WordCamp Payment Methods';
+
+        /**
+         * Report slug.
+         *
+         * @var string
+         */
+        public static $slug = 'wordcamp-payment-methods';
+
+        /**
+         * Report description.
+         *
+         * @var string
+         */
+        public static $description = 'WordCamp ticket sales broken out by payment method.';
+
+        /**
+         * Report methodology.
+         *
+         * @var string
+         */
+        public static $methodology = "
+                <ol>
+                        <li>Generate a transaction data set from the Ticket Revenue report, using the specified date range.</li>
+                        <li>Strip out refund transactions, since we're only interested in the initial purchase.</li>
+                        <li>Count the number of transactions for each payment method.</li>
+                        <li>Count the number of transactions for each payment method, for each WordCamp that had transactions during the specified date range.</li>
+                </ol>
+        ";
+
+        /**
+         * Report group.
+         *
+         * @var string
+         */
+        public static $group = 'misc';
+
+        /**
+         * WordCamp post ID.
+         *
+         * @var int The ID of the WordCamp post for this report.
+         */
+        public $wordcamp_id = 0;
+
+        /**
+         * WordCamp site ID.
+         *
+         * @var int The ID of the WordCamp site where the invoices are located.
+         */
+        public $wordcamp_site_id = 0;
+
+        /**
+         * Currency exchange rate client.
+         *
+         * @var Utilities\Currency_XRT_Client Utility to handle currency conversion.
+         */
+        protected $xrt = null;
+
+        /**
+         * Data fields that can be visible in a public context.
+         *
+         * @var array An associative array of key/default value pairs.
+         */
+        protected $public_data_fields = array(
+                'timestamp'        => '',
+                'blog_id'          => 0,
+                'object_id'        => 0,
+                'method'           => '',
+                'currency'         => '',
+                'full_price'       => 0,
+                'discounted_price' => 0,
+        );
+
+        /**
+         * Ticket_Payment_Methods constructor.
+         *
+         * @param string $start_date  The start of the date range for the report.
+         * @param string $end_date    The end of the date range for the report.
+         * @param int    $wordcamp_id Optional. The ID of a WordCamp post to limit this report to.
+         * @param array  $options     {
+         *     Optional. Additional report parameters.
+         *     See Base::__construct and Date_Range::__construct for additional parameters.
+         * }
+         */
+        public function __construct( $start_date, $end_date, $wordcamp_id = 0, array $options = array() ) {
+                parent::__construct( $start_date, $end_date, $options );
+
+                $this->xrt = new Utilities\Currency_XRT_Client();
+
+                if ( $wordcamp_id ) {
+                        try {
+                                $valid = validate_wordcamp_id( $wordcamp_id );
+
+                                $this->wordcamp_id      = $valid->post_id;
+                                $this->wordcamp_site_id = $valid->site_id;
+                        } catch( Exception $e ) {
+                                $this->error->add(
+                                        self::$slug . '-wordcamp-id-error',
+                                        $e->getMessage()
+                                );
+                        }
+                }
+        }
+
+        /**
+         * Generate a cache key.
+         *
+         * @return string
+         */
+        protected function get_cache_key() {
+                $cache_key = parent::get_cache_key();
+
+                if ( $this->wordcamp_id ) {
+                        $cache_key .= '_' . $this->wordcamp_id;
+                }
+
+                return $cache_key;
+        }
+
+        /**
+         * Query and parse the data for the report.
+         *
+         * @return array
+         */
+        public function get_data() {
+                // Bail if there are errors.
+                if ( ! empty( $this->error->get_error_messages() ) ) {
+                        return array();
+                }
+
+                // Maybe use cached data.
+                $data = $this->maybe_get_cached_data();
+                if ( is_array( $data ) ) {
+                        return $data;
+                }
+
+                $transactions = $this->get_ticket_transactions();
+
+                // We're not interested in refunds, only the original purchases.
+                $purchases = array_filter( $transactions, function( $transaction ) {
+                        if ( 'Purchase' === $transaction['type'] ) {
+                                return true;
+                        }
+
+                        return false;
+                } );
+
+                // Thus we don't need the `type` property. We need every method field to have a value, though.
+                $data = array_map( function( $purchase ) {
+                        unset( $purchase['type'] );
+
+                        if ( ! $purchase['method'] ) {
+                                $purchase['method'] = 'none';
+                        }
+
+                        return $purchase;
+                }, $purchases );
+
+                $data = $this->filter_data_fields( $data );
+                $this->maybe_cache_data( $data );
+
+                return $data;
+        }
+
+        /**
+         * Compile the report data into results.
+         *
+         * @param array $data The data to compile.
+         *
+         * @return array
+         */
+        public function compile_report_data( array $data ) {
+                $totals = array_reduce( $data, function( $carry, $item ) {
+                        $method = $item['method'];
+
+                        if ( ! isset( $carry['Total'] ) ) {
+                                $carry['Total'] = 0;
+                        }
+
+                        if ( ! isset( $carry[ $method ] ) ) {
+                                $carry[ $method ] = 0;
+                        }
+
+                        $carry[ $method ] ++;
+                        $carry['Total'] ++;
+
+                        return $carry;
+                } );
+
+                uksort( $totals, function( $a, $b ) {
+                        if ( 'Total' === $a ) {
+                                return 1;
+                        }
+
+                        if ( 'Total' === $b ) {
+                                return -1;
+                        }
+
+                        return ( $a < $b ) ? -1 : 1;
+                } );
+
+                $by_site = array_reduce( $data, function( $carry, $item ) use ( $totals ) {
+                        $blog_id = $item['blog_id'];
+                        $method  = $item['method'];
+
+                        if ( ! isset( $carry[ $blog_id ] ) ) {
+                                $carry[ $blog_id ] = array_merge( array_fill_keys( array_keys( $totals ), 0 ), array(
+                                        'name' => get_wordcamp_name( $blog_id ),
+                                ) );
+                        }
+
+                        $carry[ $blog_id ][ $method ] ++;
+                        $carry[ $blog_id ]['Total'] ++;
+
+                        return $carry;
+                } );
+
+                usort( $by_site, function( $a, $b ) {
+                        if ( $a['Total'] === $b['Total'] ) {
+                                return 0;
+                        }
+
+                        return ( $a['Total'] < $b['Total'] ) ? 1 : -1;
+                } );
+
+                return array(
+                        'method_totals'   => $totals,
+                        'methods_by_site' => $by_site,
+                );
+        }
+
+        /**
+         * Get a list of ticket transaction events from the given date range.
+         *
+         * Uses the Ticket Revenue report to get the relevant transaction event data.
+         *
+         * @return array
+         */
+        protected function get_ticket_transactions() {
+                $ticket_revenue_report = new Ticket_Revenue(
+                        $this->start_date->format( 'Y-m-d' ),
+                        $this->end_date->format( 'Y-m-d' ),
+                        $this->wordcamp_id,
+                        $this->options
+                );
+
+                return $ticket_revenue_report->get_data();
+        }
+
+        /**
+         * Render an HTML version of the report output.
+         *
+         * @return void
+         */
+        public function render_html() {
+                $data = $this->compile_report_data( $this->get_data() );
+
+                $start_date    = $this->start_date;
+                $end_date      = $this->end_date;
+                $wordcamp_name = ( $this->wordcamp_site_id ) ? get_wordcamp_name( $this->wordcamp_site_id ) : '';
+                $method_totals = $data['method_totals'];
+                $site_totals   = $data['methods_by_site'];
+
+                if ( ! empty( $this->error->get_error_messages() ) ) {
+                        $this->render_error_html();
+                } else {
+                        include Reports\get_views_dir_path() . 'html/wordcamp-payment-methods.php';
+                }
+        }
+
+        /**
+         * Render the page for this report in the WP Admin.
+         *
+         * @return void
+         */
+        public static function render_admin_page() {
+                $start_date  = filter_input( INPUT_POST, 'start-date' );
+                $end_date    = filter_input( INPUT_POST, 'end-date' );
+                $wordcamp_id = filter_input( INPUT_POST, 'wordcamp-id' );
+                $refresh     = filter_input( INPUT_POST, 'refresh', FILTER_VALIDATE_BOOLEAN );
+                $action      = filter_input( INPUT_POST, 'action' );
+                $nonce       = filter_input( INPUT_POST, self::$slug . '-nonce' );
+
+                $report = null;
+
+                if ( 'Show results' === $action
+                     && wp_verify_nonce( $nonce, 'run-report' )
+                     && current_user_can( 'manage_network' )
+                ) {
+                        $options = array(
+                                'earliest_start' => new \DateTime( '2015-01-01' ), // No indexed CampTix events before 2015.
+                                'max_interval'   => new \DateInterval( 'P1Y' ), // 1 year. See http://php.net/manual/en/dateinterval.construct.php.
+                        );
+
+                        if ( $refresh ) {
+                                $options['flush_cache'] = true;
+                        }
+
+                        $report = new self( $start_date, $end_date, $wordcamp_id, $options );
+
+                        // The report adjusts the end date in some circumstances.
+                        if ( empty( $report->error->get_error_messages() ) ) {
+                                $end_date = $report->end_date->format( 'Y-m-d' );
+                        }
+                }
+
+                include Reports\get_views_dir_path() . 'report/wordcamp-payment-methods.php';
+        }
+}

wordcamp-reports/classes/report/class-wordcamp-status.php

@@ -424 +424 @@
                 $months   = month_array();
                 $statuses = WordCamp_Loader::get_post_statuses();
 
-                $error = $params['error'];
+                $error = $params['error'];  // todo never gets used?
                 $report = null;
                 $period = $params['period'];
                 $year = $params['year'];

wordcamp-reports/index.php

@@ -13 +13 @@
 namespace WordCamp\Reports;
 defined( 'WPINC' ) || die();
 
+use WP_Post;
 use WordCamp\Reports\Report;
 
 define( __NAMESPACE__ . '\PLUGIN_DIR', \plugin_dir_path( __FILE__ ) );
@@ -341 +342 @@
         foreach ( $report_classes as $class ) {
                 if ( method_exists( $class, 'export_to_file' ) ) {
                         add_action( 'admin_init', array( $class, 'export_to_file' ) );
+
+//                      if ( false !== stripos( $class, 'details' ) ) {
+//                              var_dump($class, $post );
+//                              wp_die();
+//                      }
+
+                        if ( method_exists( $class, 'handle_shortcode' ) ) {
+                                add_action( 'wp', array( $class, 'export_to_file' ) );
+
+                                // also make sure that only public reports
+                                        // maybe hardcode it to just details, since that's the only one that needs this?
+                                        // not sure, but make sure attacker can't leverage this to access private reports
+                        }
                 }
         }
 }

new file wordcamp-reports/views/public/wordcamp-details.php

@@ +1 @@
+<?php
+/**
+ * @package WordCamp\Reports
+ */
+
+namespace WordCamp\Reports\Views\Report\WordCamp_Details;
+defined( 'WPINC' ) || die();
+
+use WordCamp\Reports\Report;
+
+/**
+ * @var string $start_date
+ * @var string $end_date
+ */
+
+// need something to restrict years to > 2006 ?
+
+// test front end w/ date error, like end date more than 365 days from start date
+
+?>
+
+<div id="<?php echo esc_attr( Report\WordCamp_Details::$slug ); ?>-report" class="report-container">
+        <p class="report-description">
+                <?php echo wp_kses_post( Report\WordCamp_Details::$description ); ?>
+        </p>
+
+        <form method="get" action="" class="report-form">
+                <table class="form-table">
+                        <tbody>
+                                <tr>
+                                        <th scope="row">
+                                                <label for="start-date">
+                                                        Start Date (optional)
+                                                </label>
+                                        </th>
+
+                                        <td>
+                                                <input type="date" id="start-date" name="start-date" value="<?php echo esc_attr( $start_date ); ?>" />
+                                        </td>
+                                </tr>
+
+                                <tr>
+                                        <th scope="row">
+                                                <label for="end-date">
+                                                        End Date (optional)
+                                                </label>
+                                        </th>
+
+                                        <td>
+                                                <input type="date" id="end-date" name="end-date" value="<?php echo esc_attr( $end_date ); ?>" />
+                                        </td>
+                                </tr>
+                        </tbody>
+                </table>
+
+                <?php submit_button( 'Export CSV', 'primary', 'action', false ); ?>
+        </form>
+</div>