Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions includes/Dokan.php
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ public function __construct() {

// If vendor created via REST API
add_action( 'dokan_new_vendor', [ $this, 'after_create_vendor_via_rest' ], 15 );

// Exclude wepos_cash payments from vendor withdrawal balance
add_filter( 'dokan_order_should_exclude_from_vendor_balance', [ $this, 'exclude_wepos_cash_payment' ], 10, 5 );
Comment on lines +29 to +31

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for the filter definition and apply_filters calls
echo "=== Searching for filter definition ==="
rg -n "dokan_order_should_exclude_from_vendor_balance" --type php

echo ""
echo "=== Checking for apply_filters in vendor/dokan or similar ==="
fd -e php . | xargs rg -l "apply_filters" 2>/dev/null | head -20

echo ""
echo "=== Searching more broadly for Dokan filter patterns ==="
rg -n "apply_filters.*dokan" --type php | head -20

Repository: getdokan/wepos

Length of output: 849


Confirm this dokan_order_should_exclude_from_vendor_balance filter is supported by your Dokan version.

The filter registration is syntactically correct, but this filter does not exist in the current codebase—it must be provided by the Dokan plugin dependency. If your version of Dokan does not include this filter, the callback will never be invoked and vendor cash exclusion logic will not execute. Verify your Dokan version (or premium/custom build) actually applies this filter before deploying.

🤖 Prompt for AI Agents
In `@includes/Dokan.php` around lines 29 - 31, The registered filter
dokan_order_should_exclude_from_vendor_balance may not exist in the Dokan
version used, so confirm support and add a safe fallback: verify that Dokan
applies that filter before relying on it (e.g., check
function_exists/apply_filters availability in runtime) and if not present, hook
your exclusion logic into a supported alternative (or add a small compatibility
wrapper that calls your exclude_wepos_cash_payment method from an existing Dokan
hook/event). Ensure the callback name exclude_wepos_cash_payment remains
unchanged and document which Dokan versions the filter is required for so the
integration fails gracefully when absent.

add_filter( 'dokan_order_refund_should_exclude_from_vendor_balance', [ $this, 'prevent_wepos_cash_refund_deduction' ], 10, 6 );
}

/**
Expand Down Expand Up @@ -163,4 +167,54 @@ public function add_dokan_settings( $settings_fields ) {

return $settings_fields;
}

/**
* Exclude wepos_cash payments from vendor withdrawal balance
*
* When a payment is made via wepos_cash method, exclude it from
* the vendor's withdrawal balance calculation.
*
* @since 1.3.3
*
* @param bool $should_exclude Whether to exclude the payment.
* @param WC_Order $order Order object.
* @param int $order_id Order ID.
* @param string $new_status New order status.
* @param bool $exclude_cod Whether exclude COD option is enabled.
*
* @return bool True if payment should be excluded, false otherwise.
*/
public function exclude_wepos_cash_payment( $should_exclude, $order, $order_id, $new_status, $exclude_cod ) {
// Check if the payment method is wepos_cash
if ( 'wepos_cash' === $order->get_payment_method() ) {
return true;
}

return $should_exclude;
}

/**
* Prevent reducing refund amount from vendor balance for wepos_cash payments
*
* When a refund is processed for an order paid via wepos_cash method,
* prevent deducting the refund amount from the vendor's balance.
*
* @since 1.3.3
*
* @param bool $should_exclude Whether to exclude from balance deduction.
* @param WC_Order $order Order object.
* @param int $order_id Order ID.
* @param string $new_status New order status.
* @param bool $exclude_cod Whether exclude COD option is enabled.
*
* @return bool True if refund should not reduce vendor balance, false otherwise.
*/
public function prevent_wepos_cash_refund_deduction( $should_exclude, $order, $order_id, $new_status, $exclude_cod, $refund_order ) {
// Check if the payment method is wepos_cash
if ( 'wepos_cash' === $order->get_payment_method() ) {
return true;
}

return $should_exclude;
}
Comment on lines +187 to +194

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for the filter definition and usage
rg -n "dokan_order_should_exclude_from_vendor_balance" -C3

Repository: getdokan/wepos

Length of output: 506


🏁 Script executed:

#!/bin/bash
# Search for where the filter is applied/called
rg -n "apply_filters.*dokan_order_should_exclude_from_vendor_balance" -C5

Repository: getdokan/wepos

Length of output: 40


🏁 Script executed:

#!/bin/bash
# Search for other uses of apply_filters to understand the pattern
rg -n "apply_filters.*vendor_balance" -C3

Repository: getdokan/wepos

Length of output: 40


🏁 Script executed:

#!/bin/bash
# Check composer.json for Dokan dependency
cat composer.json | grep -A5 "dokan" || echo "No composer.json or dokan not listed"

Repository: getdokan/wepos

Length of output: 94


🌐 Web query:

site:github.com/getdokan/dokan dokan_order_should_exclude_from_vendor_balance

💡 Result:

I searched the getdokan/dokan GitHub repository and found no occurrences of the identifier "dokan_order_should_exclude_from_vendor_balance". Source: repository files/index. [1]

Would you like me to search other repos, issues, or the wider web for that filter name? [1] https://github.com/getdokan/dokan


🏁 Script executed:

#!/bin/bash
# Search for any apply_filters in wepos repo
rg -n "apply_filters" includes/ | head -20

Repository: getdokan/wepos

Length of output: 2631


🌐 Web query:

dokan_order_should_exclude_from_vendor_balance filter WooCommerce

💡 Result:

I couldn't find any public Dokan doc or code reference for a filter named exactly dokan_order_should_exclude_from_vendor_balance. Dokan does expose functional filters and seller hooks (see Dokan dev docs). [1][2]

If that filter exists in your installed Dokan version (custom/third-party or newer internal hook), you can use it like any WP filter. Example — add to your theme/plugin:

add_filter( 'dokan_order_should_exclude_from_vendor_balance', 'my_dokan_exclude_order_from_vendor_balance', 10, 2 );
function my_dokan_exclude_order_from_vendor_balance( $exclude, $order ) {
// $exclude = (bool) current state; $order = WC_Order or order ID depending on Dokan version
// Example: exclude refunds or specific payment method
if ( is_a( $order, 'WC_Order' ) ) {
$payment = $order->get_payment_method();
} else {
$order = wc_get_order( $order );
$payment = $order ? $order->get_payment_method() : '';
}

if ( $payment === 'bacs' || $order->has_status( 'refunded' ) ) {
    return true; // exclude from vendor balance
}

return $exclude; // default

}

Notes:

  • Adjust parameter handling if the filter passes order ID vs WC_Order object.
  • If your Dokan version doesn't define this filter, add the logic where Dokan computes vendor balance (search for balance calculation in dokan plugin files) or create a small patch that applies a filter at that point.

References:

  • Dokan functional filters / hooks docs. [1]
  • Example discussion of filtering/hiding vendor orders in Dokan (StackOverflow). [2]

Sources:
[1] Dokan — Functional Filters / Hooks documentation.
[2] StackOverflow — WooCommerce Dokan multivendor hide order for vendors with specific order status.


🏁 Script executed:

#!/bin/bash
# Search for other methods that use $order parameter or get_payment_method
rg -n "get_payment_method|WC_Order" includes/Dokan.php -C2

Repository: getdokan/wepos

Length of output: 602


🏁 Script executed:

#!/bin/bash
# Check other methods in Dokan.php
rg -n "public function" includes/Dokan.php -A10 | head -50

Repository: getdokan/wepos

Length of output: 1928


🏁 Script executed:

#!/bin/bash
# View the full exclude_wepos_cash_payment method with more context
sed -n '170,200p' includes/Dokan.php

Repository: getdokan/wepos

Length of output: 995


Add defensive guard before calling $order->get_payment_method().
Dokan may pass this filter with different argument types depending on version—potentially null or an order ID instead of a WC_Order object. Without a guard, this will fatal. Add a type check with fallback to wc_get_order().

🔧 Suggested fix
 public function exclude_wepos_cash_payment( $should_exclude, $order, $order_id, $new_status, $exclude_cod ) {
+    if ( ! $order instanceof \WC_Order ) {
+        $order = $order_id ? wc_get_order( $order_id ) : null;
+        if ( ! $order ) {
+            return $should_exclude;
+        }
+    }
+
     // Check if the payment method is wepos_cash
     if ( $order->get_payment_method() === 'wepos_cash' ) {
         return true;
     }

     return $should_exclude;
 }

Optionally suppress PHPMD unused-parameter warnings ($order_id, $new_status, $exclude_cod) via annotation without changing the hook signature.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
public function exclude_wepos_cash_payment( $should_exclude, $order, $order_id, $new_status, $exclude_cod ) {
// Check if the payment method is wepos_cash
if ( $order->get_payment_method() === 'wepos_cash' ) {
return true;
}
return $should_exclude;
}
public function exclude_wepos_cash_payment( $should_exclude, $order, $order_id, $new_status, $exclude_cod ) {
if ( ! $order instanceof \WC_Order ) {
$order = $order_id ? wc_get_order( $order_id ) : null;
if ( ! $order ) {
return $should_exclude;
}
}
// Check if the payment method is wepos_cash
if ( $order->get_payment_method() === 'wepos_cash' ) {
return true;
}
return $should_exclude;
}
🧰 Tools
🪛 PHPMD (2.15.0)

186-186: Avoid unused parameters such as '$order_id'. (undefined)

(UnusedFormalParameter)


186-186: Avoid unused parameters such as '$new_status'. (undefined)

(UnusedFormalParameter)


186-186: Avoid unused parameters such as '$exclude_cod'. (undefined)

(UnusedFormalParameter)

🤖 Prompt for AI Agents
In `@includes/Dokan.php` around lines 186 - 193, In exclude_wepos_cash_payment
update the function to defensively ensure $order is a WC_Order before calling
get_payment_method: if $order is null or not an instance of WC_Order, call
wc_get_order($order_id) and re-check the returned object; only call
$order->get_payment_method() when $order instanceof WC_Order, otherwise return
$should_exclude. Also optionally add a PHPMD annotation (e.g. /* `@noinspection`
PhpUnusedParameterInspection */ or `@param` comments) to mark unused parameters
$order_id, $new_status, $exclude_cod to suppress warnings without changing the
signature.

Comment on lines +196 to +219

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Add defensive type check and fix incomplete docblock.

This method has the same vulnerability as exclude_wepos_cash_payment: calling $order->get_payment_method() without verifying $order is a valid WC_Order instance will cause a fatal error if Dokan passes null or an order ID.

Additionally, the docblock is missing the $refund_order parameter documentation.

🔧 Suggested fix
     /**
      * Prevent reducing refund amount from vendor balance for wepos_cash payments
      *
      * When a refund is processed for an order paid via wepos_cash method,
      * prevent deducting the refund amount from the vendor's balance.
      *
      * `@since` 1.3.3
      *
      * `@param` bool     $should_exclude Whether to exclude from balance deduction.
      * `@param` WC_Order $order          Order object.
      * `@param` int      $order_id       Order ID.
      * `@param` string   $new_status     New order status.
      * `@param` bool     $exclude_cod    Whether exclude COD option is enabled.
+     * `@param` WC_Order $refund_order   Refund order object.
      *
      * `@return` bool True if refund should not reduce vendor balance, false otherwise.
      */
     public function prevent_wepos_cash_refund_deduction( $should_exclude, $order, $order_id, $new_status, $exclude_cod, $refund_order ) {
+        if ( ! $order instanceof \WC_Order ) {
+            $order = $order_id ? wc_get_order( $order_id ) : null;
+            if ( ! $order ) {
+                return $should_exclude;
+            }
+        }
+
         // Check if the payment method is wepos_cash
         if ( 'wepos_cash' === $order->get_payment_method() ) {
             return true;
         }
 
         return $should_exclude;
     }
🧰 Tools
🪛 PHPMD (2.15.0)

212-212: Avoid unused parameters such as '$order_id'. (undefined)

(UnusedFormalParameter)


212-212: Avoid unused parameters such as '$new_status'. (undefined)

(UnusedFormalParameter)


212-212: Avoid unused parameters such as '$exclude_cod'. (undefined)

(UnusedFormalParameter)


212-212: Avoid unused parameters such as '$refund_order'. (undefined)

(UnusedFormalParameter)

🤖 Prompt for AI Agents
In `@includes/Dokan.php` around lines 196 - 219, The
prevent_wepos_cash_refund_deduction method calls $order->get_payment_method()
without ensuring $order is a WC_Order, and its docblock omits the $refund_order
param; update the docblock to document $refund_order and add a defensive type
check in prevent_wepos_cash_refund_deduction: if $order is not an instance of
WC_Order, attempt to resolve it with wc_get_order($order_id) (or if that returns
null, bail by returning $should_exclude), then only call get_payment_method() on
a valid WC_Order and return true when the payment method equals 'wepos_cash'.
Ensure the check references the method name prevent_wepos_cash_refund_deduction
and the parameters $order and $order_id so reviewers can find the change.

}