Automattic\WooCommerce\Internal\CustomerEmailVerification

VerificationController::maybe_process_request │ public │ WC 11.0.0

Route an incoming request: a send request or an opened verify-link.

Opening the emailed link is a GET, which email clients and security scanners routinely prefetch. Verification is gated on authentication ({@see self::handle_verify_link()}), so a prefetch — always logged out — only ever reaches the My Account login and can never consume the key.

Method of the class: VerificationController{}

No Hooks.

Returns

null. Nothing (null).

Usage

$VerificationController = new VerificationController();
$VerificationController->maybe_process_request(): void;

Changelog

VerificationController::maybe_process_request() VerificationController::maybe process request code ^{WC 11.0.1}

public function maybe_process_request(): void {
	if ( isset( $_GET[ self::SEND_PARAM ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$this->handle_send_request();
		return;
	}

	// No nonce on the verify-link: like WordPress core's email-change confirmation links, the
	// unguessable one-time key is the CSRF defence and the login gate is the authority.
	// phpcs:disable WordPress.Security.NonceVerification.Recommended
	if ( isset( $_GET[ self::KEY_PARAM ], $_GET[ self::USER_PARAM ] ) ) {
		$this->handle_verify_link(
			absint( wp_unslash( $_GET[ self::USER_PARAM ] ) ),
			sanitize_text_field( wp_unslash( $_GET[ self::KEY_PARAM ] ) )
		);
	}
	// phpcs:enable WordPress.Security.NonceVerification.Recommended
}