swap session with cookie with hash

prijs-per-postcode.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once plugin_dir_path(__FILE__) . "session_dialog.php";
-require_once plugin_dir_path(__FILE__) . "admin.php";
 /*
  * Plugin Name: Prijzen per poscodeereeks.
  * Description:  Producten worden gefiltered aan de hand van opgegegeven postcodereksen.Klanten met een postcode Die in de opgegegeven postcode reeks vallen zullen een lokale prijs zien. Waar iedereen die niet in de reeks vallen de overige regios prijs te zien krijgt.
@@ -10,11 +8,23 @@ require_once plugin_dir_path(__FILE__) . "admin.php";
  * Text Domeain: prijs-per-postcode
  */
 
+require_once plugin_dir_path(__FILE__) . "session_dialog.php";
+require_once plugin_dir_path(__FILE__) . "admin.php";
+require_once plugin_dir_path(__FILE__) . "pppr_cookie.php";
+
 if (!defined("ABSPATH")) {
     echo "big bag of potatoes";
     exit();
 }
 
+register_activation_hook( __FILE__, 'create_pppr_salt' );
+if ( ! defined( 'WP_PPPR_SALT' ) ) {
+  $salt_file = ABSPATH . 'wp-pppr-salt.php';
+  if ( file_exists( $salt_file ) ) {
+      require_once $salt_file;
+  }
+}
+
 class PrijsPerPostcode
 {
     public function __construct()
@@ -25,10 +35,7 @@ class PrijsPerPostcode
 
     public function init()
     {
-        if (session_status() == PHP_SESSION_NONE) {
-            ob_start();
-            @session_start();
-        }
+        
         $uri = $_SERVER["REQUEST_URI"];
         init_postcode_handlers($uri);
         init_postode_admin();
@@ -61,7 +68,7 @@ class PrijsPerPostcode
         );
         add_action("template_redirect", [
             $this,
-            "controleer_postcode_op_woocommerce_paginas",
+            "check_postcode_on_every_woocommerce_page",
         ]);
         add_filter(
             "woocommerce_variation_is_visible",
@@ -118,8 +125,8 @@ class PrijsPerPostcode
 
             if (
                 $variation_id &&
-                isset($_SESSION["postcode_is_local"]) &&
-                $_SESSION["postcode_is_local"]
+                isset($_COOKIE["PPPR"]) &&
+                pppr_is_local() 
             ) {
                 $local_price = get_post_meta(
                     $variation_id,
@@ -133,7 +140,50 @@ class PrijsPerPostcode
         }
     }
 
-    public function controleer_postcode_op_woocommerce_paginas()
+    /*
+    public function controleer_postcode_op_woocommerce_paginas() 
+    {
+      if (is_admin() || defined('DOING_AJAX')) {
+          return;
+      }
+
+      // 2. Define target pages (Product, Cart, Checkout, etc., but NOT the Shop home)
+      if (
+          (is_product() ||
+           is_product_category() ||
+           is_product_tag() ||
+           is_cart() ||
+           is_checkout() ||
+           is_account_page()) &&
+          !is_shop()
+      ) {
+          // 3. Retrieve cookie safely (null coalescing prevents "Undefined index" errors)
+          $cookie_string = $_COOKIE['PPPR'] ?? '';
+
+          // 4. Validate: Check if empty OR if the signature is invalid (tampered)
+          // verify_ppp_cookie() returns false if the hash doesn't match the data
+          if (empty($cookie_string) || !verify_ppp_cookie($cookie_string)) {
+              
+              // Optional: Clear the invalid cookie from the browser immediately
+              setcookie('PPPR', '', time() - 3600, '/');
+               $shop_url = wc_get_page_permalink('shop');
+            
+            // Fallback to home URL if shop page is not set
+            if ($shop_url === -1) {
+                $shop_url = home_url('/');
+            }           
+              // 5. Redirect to the shop/home page to force postcode selection
+              wp_redirect($shop_url);
+              exit();
+          }
+          
+          // Optional: If valid, you can now safely access the data
+          // $is_local = ($cookie_string[0] === '1');
+      }
+    }    
+    */
+
+    public function check_postcode_on_every_woocommerce_page()
     {
         if (is_admin() || defined("DOING_AJAX")) {
             return;
@@ -141,14 +191,14 @@ class PrijsPerPostcode
 
         if (
             (is_product() ||
-                is_product_category() ||
-                is_product_tag() ||
-                is_cart() ||
-                is_checkout() ||
-                is_account_page()) &&
+             is_product_category() ||
+             is_product_tag() ||
+             is_cart() ||
+             is_checkout() ||
+             is_account_page()) &&
             !is_shop()
         ) {
-            if (!isset($_SESSION["postcode_is_local"])) {
+            if (!verify_pppr_cookie_string()) {
                 wp_redirect(home_url("/winkel/"));
                 exit();
             }
@@ -159,8 +209,8 @@ class PrijsPerPostcode
     {
         if (
             $product->is_type("variation") &&
-            isset($_SESSION["postcode_is_local"]) &&
-            $_SESSION["postcode_is_local"] === true
+            isset($_COOKIE["PPPR"]) &&
+            pppr_is_local()
         ) {
             $local_price = get_post_meta(
                 $product->get_id(),
@@ -189,10 +239,7 @@ class PrijsPerPostcode
             return false;
         }
 
-        $is_local = isset($_SESSION["postcode_is_local"])
-            ? $_SESSION["postcode_is_local"]
-            : false;
-        $price = $is_local
+        $price = pppr_is_local()
             ? $variation->get_meta("_local_price", true)
             : $variation->get_regular_price();