Merge remote-tracking branch 'refs/remotes/origin/add/8197-overview-s…

…urvey' into add/8197-overview-survey

.husky/pre-push

@@ -1,8 +1,11 @@
 #!/bin/bash
 . "$(dirname "$0")/_/husky.sh"
 
-# Allows us to read user input below, redirects script's input to the terminal.
-exec < /dev/tty
+# check if main stream (stdout and stderr) are attached to the terminal
+if [ -t 1 ] && [ -t 2 ]; then
+    # Allows us to read user input below, redirects script's input to the terminal.
+    exec < /dev/tty
+fi
 
 PROTECTED_BRANCH=("develop" "trunk")
 CURRENT_BRANCH=$(git branch --show-current)

changelog/enhance-pre-push-hook

@@ -0,0 +1,4 @@
+Significance: minor
+Type: dev
+
+Ensure pre-push hook understands terminal & non-terminal environments

changelog/fix-8334-leftover-onboarding-sandbox-mode

@@ -0,0 +1,5 @@
+Significance: patch
+Type: fix
+Comment: Prevent leftover sandbox mode onboarding and allow for live onboarding on subsequent retries.
+
+

changelog/fix-clearpay-aria-label

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Fixed Clearpay aria-label for UK sites

changelog/fix-gateway-individual-settings

@@ -0,0 +1,4 @@
+Significance: minor
+Type: fix
+
+Ensure every gateway has individual settings object.

changelog/update-deposit-details-validate-user-input

@@ -0,0 +1,4 @@
+Significance: minor
+Type: update
+
+Validate deposit id before sending a request to fetch deposit.

client/data/deposits/resolvers.js

@@ -30,6 +30,12 @@ import { formatDateValue } from 'utils';
  * @param {string} id Identifier for specified deposit to retrieve.
  */
 export function* getDeposit( id ) {
+	// Validate input to avoid path traversal request.
+	// Avoid lookup if the id contains any unexpected characters.
+	if ( /\W/.test( id ) ) {
+		return;
+	}
+
 	const path = addQueryArgs( `${ NAMESPACE }/deposits/${ id }` );
 
 	try {

client/data/deposits/test/resolvers.js

@@ -20,6 +20,8 @@ import {
 
 import { getDeposit, getDeposits, getDepositsSummary } from '../resolvers';
 
+jest.mock( '@wordpress/data-controls' );
+
 const depositsResponse = {
 	data: [
 		{
@@ -57,36 +59,54 @@ const filterQuery = {
 };
 
 describe( 'getDeposit resolver', () => {
-	let generator = null;
+	describe( 'on', () => {
+		let generator = null;
 
-	beforeEach( () => {
-		generator = getDeposit( 'test_dep_1' );
-		expect( generator.next().value ).toEqual(
-			apiFetch( { path: '/wc/v3/payments/deposits/test_dep_1' } )
-		);
-	} );
+		beforeEach( () => {
+			generator = getDeposit( 'test_dep_1' );
+			expect( generator.next().value ).toEqual(
+				apiFetch( { path: '/wc/v3/payments/deposits/test_dep_1' } )
+			);
+		} );
 
-	afterEach( () => {
-		expect( generator.next().done ).toStrictEqual( true );
-	} );
+		afterEach( () => {
+			expect( generator.next().done ).toStrictEqual( true );
+		} );
 
-	describe( 'on success', () => {
-		test( 'should update state with deposit data', () => {
-			expect(
-				generator.next( depositsResponse.data[ 0 ] ).value
-			).toEqual( updateDeposit( depositsResponse.data[ 0 ] ) );
+		describe( 'success', () => {
+			test( 'should update state with deposit data', () => {
+				expect(
+					generator.next( depositsResponse.data[ 0 ] ).value
+				).toEqual( updateDeposit( depositsResponse.data[ 0 ] ) );
+			} );
+		} );
+
+		describe( 'error', () => {
+			test( 'should update state with error on error', () => {
+				expect( generator.throw( errorResponse ).value ).toEqual(
+					controls.dispatch(
+						'core/notices',
+						'createErrorNotice',
+						expect.any( String )
+					)
+				);
+			} );
 		} );
 	} );
 
-	describe( 'on error', () => {
-		test( 'should update state with error on error', () => {
-			expect( generator.throw( errorResponse ).value ).toEqual(
-				controls.dispatch(
-					'core/notices',
-					'createErrorNotice',
-					expect.any( String )
-				)
-			);
+	describe( 'validation', () => {
+		let generator = null;
+
+		beforeEach( () => {
+			jest.clearAllMocks();
+		} );
+
+		test( "shouldn't fetch deposit with non-word-character deposit id", () => {
+			generator = getDeposit( '../path?a=b&c=d' );
+			const next = generator.next();
+			expect( next.value ).toStrictEqual( undefined );
+			expect( next.done ).toStrictEqual( true );
+			expect( apiFetch ).not.toBeCalled();
 		} );
 	} );
 } );
@@ -101,6 +121,9 @@ describe( 'getDeposits resolver', () => {
 		'page=1&pagesize=25&match=all&store_currency_is=gbp&date_before=2020-04-29%2003%3A59%3A59&date_after=2020-04-29%2004%3A00%3A00&date_between%5B0%5D=2020-04-28%2004%3A00%3A00&date_between%5B1%5D=2020-04-30%2003%3A59%3A59&status_is=paid&status_is_not=failed';
 
 	beforeEach( () => {
+		apiFetch.mockImplementation( () => {
+			return 'something';
+		} );
 		generator = getDeposits( query );
 		expect( generator.next().value ).toEqual(
 			apiFetch( {

client/payment-methods/constants.ts

@@ -20,14 +20,18 @@ enum PAYMENT_METHOD_IDS {
 	SOFORT = 'sofort',
 }
 
+const accountCountry = window.wcpaySettings?.accountStatus?.country || 'US';
 // This constant is used for rendering tooltip titles for payment methods in transaction list and details pages.
 // eslint-disable-next-line @typescript-eslint/naming-convention
 export const PAYMENT_METHOD_TITLES = {
 	ach_credit_transfer: __( 'ACH Credit Transfer', 'woocommerce-payments' ),
 	ach_debit: __( 'ACH Debit', 'woocommerce-payments' ),
 	acss_debit: __( 'ACSS Debit', 'woocommerce-payments' ),
 	affirm: __( 'Affirm', 'woocommerce-payments' ),
-	afterpay_clearpay: __( 'Afterpay', 'woocommerce-payments' ),
+	afterpay_clearpay:
+		'GB' === accountCountry
+			? __( 'Clearpay', 'woocommerce-payments' )
+			: __( 'Afterpay', 'woocommerce-payments' ),
 	alipay: __( 'Alipay', 'woocommerce-payments' ),
 	amex: __( 'American Express', 'woocommerce-payments' ),
 	au_becs_debit: __( 'AU BECS Debit', 'woocommerce-payments' ),

includes/class-wc-payment-gateway-wcpay.php

@@ -2399,8 +2399,7 @@ public function get_option( $key, $empty_value = null ) {
 	 * Overrides parent method so the option key is the same as the parent class.
 	 */
 	public function get_option_key() {
-		// Intentionally using self instead of static so options are loaded from main gateway settings.
-		return $this->plugin_id . self::GATEWAY_ID . '_settings';
+		return $this->plugin_id . $this->id . '_settings';
 	}
 
 

includes/class-wc-payments-account.php

@@ -1085,6 +1085,14 @@ public function maybe_handle_onboarding() {
 			) ) {
 				// Redirect non-onboarded account to the onboarding flow, otherwise to payments overview page.
 				if ( ! $this->is_stripe_connected() ) {
+					$should_onboard_in_test_mode = isset( $_GET['test_mode'] ) ? boolval( wc_clean( wp_unslash( $_GET['test_mode'] ) ) ) : false;
+					if ( ! $should_onboard_in_test_mode && WC_Payments_Onboarding_Service::is_test_mode_enabled() ) {
+						// If there is no test mode in the URL informing us to onboard in test mode,
+						// but the onboarding test mode is enabled in our DB, we should disable it.
+						// This is most likely a leftover from a previous onboarding attempt.
+						WC_Payments_Onboarding_Service::set_test_mode( false );
+					}
+
 					$this->redirect_to_onboarding_flow_page( $source );
 				} else {
 					// Accounts with Stripe account connected will be redirected to the overview page.