[sanjana4khan]

ClickUp ticket link: https://app.clickup.com/t/9018365849/z8zyy1pqyv

Description

Fixes a security issue:
After a student's course enrollment expired, they could get access back by opening the order success URL.

Root cause: PaymentHandler::load_order_status_template() fires tutor_order_placement_success for any visitor who opens /?tutor_order_placement=success&order_id=N. It doesn't check login, nonce or who owns the order. The listener, HooksHandler::handle_order_placement_success(), then re-ran manage_earnings_and_enrollments() for that order. That meant:

• an enrollment (Pro) had cancelled for expiry was set back to completed, and its post_date was reset to now, giving another full access period. This could be repeated forever.
• an admin-cancelled enrollment could be re-activated if the order was still marked paid.
• earnings were recalculated with the current commission settings after reactivation.

Change (ecommerce/HooksHandler.php): handle_order_placement_success() now only clears the buyer's cart. Enrollment and earnings are being handled when payment is actually confirmed.

Impact check:

• Pro subscriptions (including free trials), bundles and guest checkout: no impact.
• Free / 100%-coupon orders no longer create tutor_earnings rows. Money totals are unchanged because these rows were zero. The visible differences are that Pro "Number of Sales", the Statements list and dashboard "Top performing courses" no longer include these orders.

Testing

• Tested
• Not tested

Use of AI Tool

Used: Yes

Used for:

AI was used to review the branch: tracing every caller of tutor_order_placement_success and manage_earnings_and_enrollments, checking the gateway add-ons and Pro modules for dependencies on the success page, checking who reads tutor_earnings.