Skip to content

Enrollment security issue #3130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sanjana4khan wants to merge 8 commits into
base: 4.2.1
Choose a base branch
from
Open

Enrollment security issue #3130

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
70d5f60
Fix(🛠):after course expiration user can access the course through suc…
sanjana4khan Oct 27, 2026
706f1dc
Merge branch '4.2.0' into enrollment-security-issue
sanjana4khan Oct 27, 2026
088e095
tutor_order_enrolled hook added.
sanjana4khan Oct 27, 2026
dacd877
removed unnecessary comments
sanjana4khan Oct 27, 2026
500eed8
comment added
sanjana4khan Oct 28, 2026
1ccffcb
Merge branch '4.2.1' into enrollment-security-issue
sanjana4khan Oct 29, 2026
9381340
Different solution applied to solve enrollment issue
sanjana4khan Oct 29, 2026
2977cc0
Different solution applied to solve enrollment issue
sanjana4khan Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 23 additions & 9 deletions ecommerce/HooksHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,23 +285,33 @@ public function handle_payment_status_changed( $order_id, $prev_payment_status,
* Clear cart items, managing enrollment & earnings
*
* @since 3.0.0
* @since 4.2.1 manage earnings and enrollment only for the buyer's unprocessed order.
*
* @param int $order_id Order id.
*
* @return void
*/
public function handle_order_placement_success( int $order_id ) {
$order_data = $this->order_model->get_order_by_id( $order_id );
if ( $order_data ) {
$user_id = $order_data->student->id;
if ( ! $order_data ) {
return;
}

( new CartModel() )->clear_user_cart( $user_id );
$user_id = $order_data->student->id;
( new CartModel() )->clear_user_cart( $user_id );

// Manage enrollment & earnings.
$order = ( new OrderModel() )->get_order_by_id( $order_id );
$payment_status = $order->payment_status;
/**
* Skip if the order is already processed, otherwise revisiting the success URL
* re-activates expired/cancelled enrollments and recalculates earnings.
*
* @since 4.2.1
*/
$is_processed = isset( $order_data->enrollment ) || Earnings::get_instance()->is_exist_order_earning( $order_id );

$order_status = $this->order_model->get_order_status_by_payment_status( $payment_status );
if ( get_current_user_id() === $user_id && ! $is_processed ) {
// Manage enrollment & earnings.
$payment_status = $order_data->payment_status;
$order_status = $this->order_model->get_order_status_by_payment_status( $payment_status );

$this->manage_earnings_and_enrollments( $order_status, $order_id );
}
Expand Down Expand Up @@ -527,8 +537,12 @@ public function handle_free_checkout( array $order_data ) {
add_filter( 'tutor_enroll_data', fn( $enroll_data ) => array_merge( $enroll_data, array( 'post_status' => 'completed' ) ) );

$enrolled_id = EnrollmentModel::do_enroll( $item['item_id'], $order_data['id'], $user_id );
if ( $enrolled_id && tutor_utils()->is_addon_enabled( 'course-bundle' ) && get_post_type( $item['item_id'] ) === CourseBundle::POST_TYPE ) {
BundleModel::enroll_to_bundle_courses( $item['item_id'], $user_id );
if ( $enrolled_id ) {
do_action( 'tutor_order_enrolled', (object) $order_data, $enrolled_id );

if ( tutor_utils()->is_addon_enabled( 'course-bundle' ) && get_post_type( $item['item_id'] ) === CourseBundle::POST_TYPE ) {
BundleModel::enroll_to_bundle_courses( $item['item_id'], $user_id );
}
}
}

Expand Down
Loading