$ids Order ids. */ public static function url( string $type, array $ids ): string { return add_query_arg( [ 'action' => self::ACTION, 'type' => $type, 'ids' => implode( ',', array_map( 'absint', $ids ) ), '_wpnonce' => wp_create_nonce( self::ACTION ), ], admin_url( 'admin-post.php' ) ); } /** * Render the document. * * @internal Hooked callback. */ public function handle(): void { // The capability is the authorisation gate; the nonce below is only CSRF // protection. Checking them in this order means a logged-out or // under-privileged request never reaches nonce handling at all. if ( ! current_user_can( self::CAPABILITY ) ) { wp_die( esc_html__( 'اجازه دسترسی ندارید.', 'rahkar-toolkit' ), '', [ 'response' => 403 ] ); } check_admin_referer( self::ACTION ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Verified above. $type = isset( $_GET['type'] ) ? sanitize_key( wp_unslash( $_GET['type'] ) ) : ''; if ( ! in_array( $type, [ 'invoice', 'label' ], true ) ) { wp_die( esc_html__( 'نوع چاپ نامعتبر است.', 'rahkar-toolkit' ) ); } $orders = $this->orders(); if ( [] === $orders ) { wp_die( esc_html__( 'سفارش معتبری یافت نشد.', 'rahkar-toolkit' ) ); } $template = 'label' === $type ? TemplateRegistry::selectedLabel() : TemplateRegistry::selectedInvoice(); $title = 'label' === $type ? __( 'برچسب پستی', 'rahkar-toolkit' ) : __( 'فاکتور فروش', 'rahkar-toolkit' ); // Never cached: a reprint has to reflect the order as it stands now, not // as it was when someone last printed it. nocache_headers(); header( 'Content-Type: text/html; charset=utf-8' ); Document::head( $title, (string) $template['page'] ); foreach ( $orders as $order ) { call_user_func( $template['render'], $order ); } Document::foot(); exit; } /** * Resolve the requested ids to real orders. * * Anything that is not an order is dropped silently — a refund id pasted in * by hand, or an order deleted between the list page rendering and the * operator clicking print. * * @return list */ private function orders(): array { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Verified by the caller. $raw = isset( $_GET['ids'] ) ? sanitize_text_field( wp_unslash( $_GET['ids'] ) ) : ''; $ids = array_filter( array_map( 'absint', explode( ',', $raw ) ) ); if ( [] === $ids || ! function_exists( 'wc_get_order' ) ) { return []; } $orders = []; foreach ( $ids as $id ) { $order = wc_get_order( $id ); if ( $order instanceof WC_Order ) { $orders[] = $order; } } return $orders; } }