diff --git a/includes/class-modal-checkout.php b/includes/class-modal-checkout.php index bec59c382..cf456fac5 100644 --- a/includes/class-modal-checkout.php +++ b/includes/class-modal-checkout.php @@ -965,6 +965,21 @@ public static function is_modal_checkout() { if ( ! $is_modal_checkout && isset( $_REQUEST['post_data'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended $is_modal_checkout = strpos( $_REQUEST['post_data'], 'modal_checkout=1' ) !== false; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized } + + // Express checkout payment requests are separate requests, so they won't have the modal checkout flag. We'll have to check the HTTP_REFERER insteaad. + $payment_request_type = filter_input( INPUT_POST, 'payment_request_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); + $is_express_checkout = ! empty( $payment_request_type ) && in_array( $payment_request_type, [ 'apple_pay', 'google_pay', 'payment_request_api' ], true ); // Validate payment request types: https://github.com/woocommerce/woocommerce-gateway-stripe/blob/develop/includes/payment-methods/class-wc-stripe-payment-request.php#L529-L548. + if ( $is_express_checkout ) { + $referrer = isset( $_SERVER['HTTP_REFERER'] ) ? \esc_url_raw( \wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized + if ( $referrer ) { + $referrer_query = \wp_parse_url( $referrer, PHP_URL_QUERY ); + \wp_parse_str( $referrer_query, $referrer_query_params ); + if ( isset( $referrer_query_params['modal_checkout'] ) && $referrer_query_params['modal_checkout'] ) { + $is_modal_checkout = true; + } + } + } + return $is_modal_checkout; }