Automattic\WooCommerce\Internal\OrderReviews
SubmissionHandler::process_rows │ private │ WC 1.0
Process the submitted row payload and return per-row outcomes.
Method of the class: SubmissionHandler{}
No Hooks.
Returns
array<int, array{product_id:int, status:string, comment_id?:int, error?:string}>.
Usage
// private - for code of main (parent) class only $result = $this->process_rows( $order, $rows_in ): array;
- $order(WC_Order) (required)
- Order being reviewed.
- $rows_in(array) (required)
- Raw
$_POST['reviews']value.
SubmissionHandler::process_rows() SubmissionHandler::process rows code WC 11.1.2
private function process_rows( WC_Order $order, array $rows_in ): array {
$results = array();
$item_index = $this->index_eligible_order_items( $order );
$author_name = trim( $order->get_billing_first_name() . ' ' . $order->get_billing_last_name() );
$author_email = $order->get_billing_email();
$author_ip = $order->get_customer_ip_address();
$author_agent = $order->get_customer_user_agent();
// Drop any per-request memoisation a prior caller may have populated,
// then preload the eligibility cache so the per-row decide() calls
// below don't issue one already-reviewed query each. Reset matters
// inside the suite (multiple submissions in one PHP process) and is
// a no-op in production (admin-ajax runs in a fresh process).
ItemEligibility::reset_cache();
ItemEligibility::preload_for_items( $item_index, $order );
// Comment id created or updated in THIS request, keyed by product|variation
// slot. The eligibility cache only reflects pre-request state, so this lets
// the loop reject later rows for a slot already handled in the same request.
$request_slot_comments = array();
foreach ( $rows_in as $row_index => $row ) {
$row_index = (int) $row_index;
$row = is_array( $row ) ? $row : array();
$rating = isset( $row['rating'] ) ? (int) $row['rating'] : 0;
if ( 0 === $rating ) {
// Empty rating means the customer chose to skip this row; allowed.
continue;
}
$product_id = isset( $row['product_id'] ) ? absint( $row['product_id'] ) : 0;
$order_item_id = isset( $row['order_item_id'] ) ? absint( $row['order_item_id'] ) : 0;
// $rows_in was already unslashed in handle(); avoid double-unslashing.
$text = isset( $row['text'] ) && is_string( $row['text'] ) ? trim( wp_kses( $row['text'], 'pre_comment_content' ) ) : '';
// Per-row result always carries `product_id` (parent product, where
// the review lives) and `variation_id` (0 for simple products) so
// callers don't have to know whether the client posted the parent
// or the variation id as `product_id`. Both are echoed back as
// soon as we resolve the line item; for early validation failures
// they reflect the raw submitted product id with `variation_id: 0`.
$result = array(
'product_id' => $product_id,
'variation_id' => 0,
'status' => 'error',
);
if ( $rating < 1 || $rating > 5 ) {
$result['error'] = 'invalid_rating';
$results[ $row_index ] = $result;
continue;
}
// invalid_row also covers fully-refunded line items: index_eligible_order_items()
// runs them through woocommerce_review_order_eligible_items, which strips them.
if ( ! $product_id || ! $order_item_id || ! isset( $item_index[ $order_item_id ] ) ) {
$result['error'] = 'invalid_row';
$results[ $row_index ] = $result;
continue;
}
$item = $item_index[ $order_item_id ];
// Variable products: the row template posts the variation id,
// while $item->get_product_id() returns the parent. Accept either.
$line_product_id = (int) $item->get_product_id();
$line_variation_id = (int) $item->get_variation_id();
if ( $product_id !== $line_product_id && $product_id !== $line_variation_id ) {
$result['error'] = 'product_mismatch';
$results[ $row_index ] = $result;
continue;
}
// Canonicalise the result fields now that we've resolved the line
// item: parent product id + the line's variation id (0 for simple).
$result['product_id'] = $line_product_id;
$result['variation_id'] = $line_variation_id;
// Reviews always attach to the parent product so they show on the
// product page regardless of which variation was bought.
$review_post_id = $line_product_id;
// Reviews are stored and resolved per product/variation slot. If this
// slot was already handled in this request (the stock page collapses to
// one row per slot, but a theme override or a tampered POST can send
// several), reuse that outcome instead of storing a second review, so
// extra rows can't stack duplicates yet still report success.
$slot_key = $line_product_id . '|' . $line_variation_id;
if ( isset( $request_slot_comments[ $slot_key ] ) ) {
$results[ $row_index ] = $request_slot_comments[ $slot_key ];
continue;
}
// Reject submissions for products whose review form was never
// rendered (comments disabled on the product).
$decision = ItemEligibility::decide( $item, $order );
if ( ItemEligibility::STATUS_SKIP === $decision['status'] ) {
$result['error'] = 'reviews_not_open';
$results[ $row_index ] = $result;
continue;
}
// Only attribute the comment to a WP user when the current request is
// authenticated as that user. Guests reaching the page via the order
// key are not authenticated, so the comment stays unattributed (0).
$customer_id = (int) $order->get_customer_id();
$current_user_id = get_current_user_id();
$comment_user_id = ( $current_user_id > 0 && $current_user_id === $customer_id ) ? $current_user_id : 0;
// If the customer already has a review tied to this order for this
// product, update it in place instead of stacking duplicates. The
// existing comment id comes from the server-side lookup, not the
// client, so a tampered POST can't target someone else's review.
$existing = $decision['comment'] instanceof \WP_Comment ? $decision['comment'] : null;
if ( $existing instanceof \WP_Comment ) {
// decide() only returns approved or held reviews, so a spam/trash row
// here would be a moderator's final verdict; never edit it.
if ( in_array( wp_get_comment_status( $existing ), array( 'spam', 'trash' ), true ) ) {
$result['error'] = 'update_failed';
$results[ $row_index ] = $result;
continue;
}
$result = array_merge( $result, self::update_review_in_place( $existing, $text, $rating, $author_ip, $author_agent ) );
if ( ! isset( $result['error'] ) ) {
$request_slot_comments[ $slot_key ] = $result;
}
$results[ $row_index ] = $result;
continue;
}
// A moderator's spam/trash verdict for this slot is final.
if ( self::has_rejected_review( $order, $line_product_id, $line_variation_id ) ) {
$result['error'] = 'update_failed';
$results[ $row_index ] = $result;
continue;
}
// A row the pipeline auto-rejected earlier is invisible to decide()
// (it only looks at approved/held rows). Reuse it instead of storing a
// fresh row on every retry, so a disallowed resubmission can't grow the
// table without bound.
$auto_rejected = self::find_auto_rejected_review( $order, $line_product_id, $line_variation_id );
if ( $auto_rejected instanceof \WP_Comment ) {
$result = array_merge( $result, self::update_review_in_place( $auto_rejected, $text, $rating, $author_ip, $author_agent ) );
if ( ! isset( $result['error'] ) ) {
$request_slot_comments[ $slot_key ] = $result;
}
$results[ $row_index ] = $result;
continue;
}
$comment_meta = array(
'rating' => $rating,
'verified' => 1,
ItemEligibility::ORDER_META_KEY => (int) $order->get_id(),
ItemEligibility::VARIATION_META_KEY => $line_variation_id,
);
$variation_summary = ItemEligibility::format_variation_summary( $item );
if ( '' !== $variation_summary ) {
$comment_meta[ ItemEligibility::VARIATION_SUMMARY_META_KEY ] = $variation_summary;
}
$comment_id = self::insert_review(
array(
'comment_post_ID' => $review_post_id,
// Core strips markup from the name; fall back when nothing would be left.
'comment_author' => '' !== sanitize_text_field( $author_name ) ? $author_name : __( 'Anonymous', 'woocommerce' ),
'comment_author_email' => $author_email,
'comment_author_url' => '',
'comment_author_IP' => $author_ip,
'comment_agent' => $author_agent,
'comment_content' => $text,
'comment_type' => 'review',
'user_id' => $comment_user_id,
'comment_meta' => $comment_meta,
)
);
if ( ! $comment_id || is_wp_error( $comment_id ) ) {
$result['error'] = 'insert_failed';
$results[ $row_index ] = $result;
continue;
}
// Tag a row the checks rejected (spam/trash) as an automatic rejection,
// so a later valid resubmission is treated as a fresh attempt rather
// than a moderator's final verdict by has_rejected_review().
if ( in_array( wp_get_comment_status( $comment_id ), array( 'spam', 'trash' ), true ) ) {
update_comment_meta( (int) $comment_id, self::AUTO_REJECTED_META_KEY, 1 );
}
$result['comment_id'] = (int) $comment_id;
$result['status'] = 'approved' === wp_get_comment_status( $comment_id ) ? 'ok' : 'pending_moderation';
$request_slot_comments[ $slot_key ] = $result;
$results[ $row_index ] = $result;
}//end foreach
return $results;
}