20.55.0 SHQ23-3030 Fix issue in multiaddress checkout when virtual pr…

…oducts present. SHQ23-3040 Support for new security patch around CSP
shipperhq · Jul 17, 2024 · c9db1ff · c9db1ff
1 parent 70962e1
commit c9db1ff
Show file tree

Hide file tree

Showing 7 changed files with 74 additions and 32 deletions.
diff --git a/CHANGELOG-PUBLIC.md b/CHANGELOG-PUBLIC.md
@@ -780,3 +780,7 @@ SHQ23-474 Update code around order comments to be 2.4 compliant
 SHQ23-1281 Fix security linter warnings
 
 
+## 20.55.0 (2024-07-17)
+SHQ23-3030 Fix issue in multiaddress checkout when virtual products present. SHQ23-3040 Support for new security patch around CSP
+
+
diff --git a/CHANGELOG.MD b/CHANGELOG.MD
@@ -780,3 +780,7 @@ SHQ23-474 Update code around order comments to be 2.4 compliant
 SHQ23-1281 Fix security linter warnings
 
 
+## 20.55.0 (2024-07-17)
+SHQ23-3030 Fix issue in multiaddress checkout when virtual products present. SHQ23-3040 Support for new security patch around CSP
+
+
diff --git a/composer.json b/composer.json
@@ -2,7 +2,7 @@
   "name": "shipperhq/module-shipper",
   "description": "Magento Shipping integration with ShipperHQ",
   "type": "magento2-module",
-  "version": "20.54.2",
+  "version": "20.55.0",
   "license": [
     "OSL-3.0",
     "AFL-3.0"

diff --git a/src/Observer/AbstractRecordOrder.php b/src/Observer/AbstractRecordOrder.php
@@ -161,6 +161,12 @@ public function recordOrder($order)
 
         // SHQ18-1947 Need to find correct address to lookup carriergroup details and packed boxes when MAC
         if ($quote->getIsMultiShipping()) {
+
+            // SHQ23-3030 If order contains just virtual products, there is no shipping address
+            if ($order->getShippingAddress() == null) {
+                return;
+            }
+
             $customerAddressId = $order->getShippingAddress()->getCustomerAddressId();
 
             foreach ($quote->getAllShippingAddresses() as $address) {

diff --git a/src/composer.json b/src/composer.json
@@ -2,7 +2,7 @@
   "name": "shipperhq/module-shipper",
   "description": "Magento Shipping integration with ShipperHQ",
   "type": "magento2-module",
-  "version": "20.54.2",
+  "version": "20.55.0",
   "license": [
     "OSL-3.0",
     "AFL-3.0"

diff --git a/src/etc/config.xml b/src/etc/config.xml
@@ -67,7 +67,7 @@
                 <ws_timeout>30</ws_timeout>
                 <use_cache>0</use_cache>
                 <always_use_cache>1</always_use_cache>
-                <extension_version>20.54.2</extension_version>
+                <extension_version>20.55.0</extension_version>
                 <allowed_methods></allowed_methods>
                 <magento_version></magento_version>
                 <cache_timeout>300</cache_timeout>

diff --git a/src/view/adminhtml/templates/order/create/shipping/method/form.phtml b/src/view/adminhtml/templates/order/create/shipping/method/form.phtml
@@ -12,19 +12,22 @@
 
 // @codingStandardsIgnoreFile
 
+/**
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
+ */
 ?>
 <?php /** @var $block \Magento\Sales\Block\Adminhtml\Order\Create\Shipping\Method\Form */ ?>
 <?php $_shippingRateGroups = $block->getShippingRates(); ?>
 <?php $helper = $this->helper('ShipperHQ\Shipper\Helper\Data'); ?>
 <?php if ($_shippingRateGroups): ?>
-    <div id="order-shipping-method-choose" style="display:none">
+    <div id="order-shipping-method-choose" class="control">
         <dl class="admin__order-shipment-methods">
             <?php foreach ($_shippingRateGroups as $code => $_rates): ?>
                 <dt class="admin__order-shipment-methods-title"><?php echo $block->escapeHtml($block->getCarrierName($code)) ?></dt>
                 <dd class="admin__order-shipment-methods-options">
                     <ul class="admin__order-shipment-methods-options-list">
                         <?php foreach ($_rates as $_rate): ?>
-                            <?php $_radioProperty = 'name="order[shipping_method]" type="radio" onclick="order.setShippingMethod(this.value)"' ?>
+                            <?php $_radioProperty = 'name="order[shipping_method]" type="radio"' ?>
                             <?php $_code = $_rate->getCode() ?>
                             <li class="admin__field-option">
                                 <?php if ($_rate->getErrorMessage()): ?>
@@ -35,9 +38,9 @@
                                     </div>
                                 <?php else: ?>
                                     <?php $_checked = $block->isMethodActive($_code) ? 'checked="checked"' : '' ?>
-                                    <input <?= $block->escapeHtml($_radioProperty) ?> value="<?= $block->escapeHtml($_code) ?>"
-                                                            id="s_method_<?= $block->escapeHtml($_code) ?>" <?= $block->escapeHtml($_checked) ?>
-                                                            class="admin__control-radio"/>
+                                    <input <?= /* @noEscape */ $_radioProperty ?> value="<?= $block->escapeHtml($_code) ?>"
+                                                            id="s_method_<?= $block->escapeHtml($_code) ?>" <?= /* @noEscape */ $_checked ?>
+                                                            class="admin__control-radio required-entry"/>
                                     <label class="admin__field-label" for="s_method_<?= $block->escapeHtml($_code) ?>">
                                         <?php echo $block->escapeHtml($_rate->getMethodTitle() ? $_rate->getMethodTitle() : $_rate->getMethodDescription()) ?>
                                         -
@@ -48,12 +51,17 @@
                                             ); ?>
                                             <?php $_incl = $block->getShippingPrice($_rate->getPrice(), true); ?>
 
-                                            <?= $block->escapeHtml($_excl); ?>
+                                            <?= /* @noEscape */ $_excl ?>
                                             <?php if ($this->helper('Magento\Tax\Helper\Data')->displayShippingBothPrices() && $_incl != $_excl): ?>
-                                                (<?= $block->escapeHtml(__('Incl. Tax')); ?><?= $block->escapeHtml($_incl); ?>)
+                                                (<?= $block->escapeHtml(__('Incl. Tax')); ?><?= /* @noEscape */ $_incl ?>)
                                             <?php endif; ?>
                                         </strong>
                                     </label>
+                                    <?= /* @noEscape */ $secureRenderer->renderEventListenerAsTag(
+                                        'onclick',
+                                        "order.setShippingMethod(this.value)",
+                                        'input#s_method_' . $block->escapeHtml($_code)
+                                    ) ?>
                                 <?php endif ?>
                             </li>
                         <?php endforeach; ?>
@@ -74,18 +82,24 @@
             </div>
             <div class="admin__field">
                 <button type="button" title="<?= $block->escapeHtml(__('Add custom shipping')) ?>" class="action-default scalable action-secondary"
-                        onclick="order.setAdminShippingMethod(this.value, customCarrier.value, customPrice.value)"
-                        value="shipperadmin_adminshipping">
+                        value="shipperadmin_adminshipping" id="shipperadmin_button">
                     <span><?= $block->escapeHtml(__('Add custom shipping')) ?></span>
                 </button>
             </div>
+            <?= /* @noEscape */ $secureRenderer->renderEventListenerAsTag(
+                'onclick',
+                "order.setAdminShippingMethod('shipperadmin_adminshipping', customCarrier.value, customPrice.value)",
+                'button#shipperadmin_button'
+            ) ?>
         <?php endif; ?>
     </div>
-    <script>
-        require(['prototype'], function () {
-            $('order-shipping-method-choose').show();
-        });
-    </script>
+    <?php $scriptString = <<<script
+require(['prototype'], function(){
+    $('order-shipping-method-choose').show();
+});
+script;
+    ?>
+    <?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false) ?>
 <?php elseif ($block->getIsRateRequest()): ?>
     <div class="order-shipping-method-summary">
         <strong class="order-shipping-method-not-available"><?php /* @escapeNotVerified */
@@ -106,32 +120,43 @@
         </div>
         <div class="admin__field">
             <button type="button" title="<?= $block->escapeHtml(__('Add custom shipping')) ?>" class="action-default scalable action-secondary"
-                    onclick="order.setAdminShippingMethod(this.value, customCarrier.value, customPrice.value)"
-                    value="shipperadmin_adminshipping">
+                    value="shipperadmin_adminshipping" id="shipperadmin_button">
                 <span><?= $block->escapeHtml(__('Add custom shipping')) ?></span>
             </button>
         </div>
+        <?= /* @noEscape */ $secureRenderer->renderEventListenerAsTag(
+            'onclick',
+            "order.setAdminShippingMethod('shipperadmin_adminshipping', customCarrier.value, customPrice.value)",
+            'button#shipperadmin_button'
+        ) ?>
     <?php endif; ?>
 <?php else: ?>
     <div id="order-shipping-method-summary" class="order-shipping-method-summary">
-        <a href="#" onclick="order.loadShippingRates();return false" class="action-default">
+        <a href="#" class="action-default">
             <span><?= $block->escapeHtml(__('Get shipping methods and rates')) ?></span>
         </a>
-        <input type="hidden" name="order[has_shipping]" value="" class="required-entry"/>
+        <input type="hidden" name="order[has_shipping]" value="" class="required-entry" />
     </div>
+    <?= /* @noEscape */ $secureRenderer->renderEventListenerAsTag(
+        'onclick',
+        "order.loadShippingRates();event.preventDefault();",
+        'div#order-shipping-method-summary a.action-default'
+    ) ?>
 <?php endif; ?>
-<div style="display: none;" id="shipping-method-overlay" class="order-methods-overlay">
+<div id="shipping-method-overlay" class="order-methods-overlay">
     <span><?= $block->escapeHtml(__('You don\'t need to select a shipping method.')) ?></span>
 </div>
-<script>
-    require(["Magento_Sales/order/create/form"], function () {
-
-        order.overlay('shipping-method-overlay', <?php if ($block->getQuote()->isVirtual()): ?>false<?php else: ?>true<?php endif; ?>);
-        order.overlay('address-shipping-overlay', <?php if ($block->getQuote()->isVirtual()): ?>false<?php else: ?>true<?php endif; ?>);
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag("display: none;", 'div#shipping-method-overlay') ?>
+<?php $scriptString = <<<script
+    require(["Magento_Sales/order/create/form"], function(){
 
-        <?php if ($block->getQuote()->isVirtual()): ?>
-        order.isOnlyVirtualProduct = true;
-        <?php endif; ?>
+script;
+$scriptString .= "order.overlay('shipping-method-overlay', " . ($block->getQuote()->isVirtual() ? 'false' : 'true') .
+    ');' . PHP_EOL;
+$scriptString .= "order.overlay('address-shipping-overlay', " . ($block->getQuote()->isVirtual() ? 'false' : 'true') .
+ ');' . PHP_EOL;
+$scriptString .= "order.isOnlyVirtualProduct = " . ($block->getQuote()->isVirtual() ? 'true' : 'false') . ';' . PHP_EOL;
+$scriptString .= <<<script
 
         AdminOrder.prototype.setAdminShippingMethod = function (method, description, price) {
             var data = {};
@@ -151,6 +176,9 @@
 
             this.loadArea(['shipping_method', 'totals', 'billing_method'], true, data);
         }
-
+script;
+$scriptString .= <<<script
     });
-</script>
+script;
+?>
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false) ?>