Robustness: null-deref, div-by-zero and control-flow guards

inc/functions/currency.php

@@ -210,6 +210,7 @@ function wu_get_currency_symbol($currency = '') {
 			break;
 		case 'BYN':
 			$currency_symbol = 'Br';
+			break;
 		case 'CHF':
 			$currency_symbol = 'CHF';
 			break;

inc/functions/discount-code.php

@@ -63,6 +63,10 @@ function wu_get_discount_codes($query = []) {
  */
 function wu_get_discounted_price($base_price, $amount, $type, $format = true) {
 
+	// Default to the base price so an unknown discount type fails safe to
+	// "no discount applied" instead of an undefined variable.
+	$discounted_price = $base_price;
+
 	if ('percentage' === $type) {
 		$discounted_price = $base_price - ($base_price * ($amount / 100));
 	} elseif ('absolute' === $type) {

inc/installers/class-migrator.php

@@ -520,7 +520,7 @@
 		/*
 		 * Registers a shutdown handler.
 		 */
 		// register_shutdown_function(array($this, 'on_shutdown'), $session, $this->dry_run, $installer);
 
 		try {
 			wp_cache_flush();
@@ -656,7 +656,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return mixed
 	 */
 	public function _install_dry_run_check(): void {
 
 		global $wpdb, $wu_migrator_current_installer;
 
@@ -678,7 +678,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return mixed
 	 */
 	public function _install_backup(): void {
 
 		global $wpdb;
 
@@ -754,7 +754,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_settings() {
 
 		$settings = $this->get_old_settings();
 
@@ -977,7 +977,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_products() {
 
 		global $wpdb;
 
@@ -1418,7 +1418,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_customers() {
 
 		global $wpdb;
 
@@ -1488,7 +1488,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_memberships() {
 
 		global $wpdb;
 
@@ -1766,7 +1766,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_transactions() {
 
 		global $wpdb;
 
@@ -1871,7 +1871,7 @@
 				'parent'             => 0,
 				'line_items'         => $line_items,
 				'status'             => wu_get_isset($map_status, $transaction->type, Payment_Status::COMPLETED),
-				'customer_id'        => $membership ? $customer->get_id() : false,
+				'customer_id'        => ($membership && $customer) ? $customer->get_id() : false,
 				'membership_id'      => $membership ? $membership->get_id() : false,
 				'product_id'         => $membership ? $membership->get_plan_id() : false,
 				'currency'           => $membership ? $membership->get_currency() : false,
@@ -1914,7 +1914,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_discount_codes() {
 
 		global $wpdb;
 
@@ -2018,7 +2018,7 @@
 	 * @throws Exception Halts the process on error.
 	 * @return void
 	 */
 	protected function _install_sites() {
 
 		global $wpdb;
 

inc/integrations/host-providers/class-cloudflare-host-provider.php

@@ -96,8 +96,10 @@ public function add_cloudflare_dns_entries($dns_records, $domain) {
 			]
 		);
 
-		foreach ($cloudflare_zones->result as $zone) {
-			$zone_ids[] = $zone->id;
+		if ( ! is_wp_error($cloudflare_zones) && ! empty($cloudflare_zones->result) && is_iterable($cloudflare_zones->result) ) {
+			foreach ($cloudflare_zones->result as $zone) {
+				$zone_ids[] = $zone->id;
+			}
 		}
 
 		foreach ($zone_ids as $zone_id) {

inc/integrations/host-providers/class-dns-record.php

@@ -505,7 +505,7 @@ public static function from_provider(array $data, string $provider): self {
 						'id'       => $data['id'] ?? ($data['type'] . '-' . ($data['name'] ?? '@')),
 						'type'     => $data['type'] ?? 'A',
 						'name'     => $data['name'] ?? '@',
-						'content'  => $data['value'] ?? '',
+						'content'  => $data['content'] ?? $data['value'] ?? '',
 						'ttl'      => (int) ($data['ttl'] ?? 3600),
 						'priority' => isset($data['priority']) ? (int) $data['priority'] : null,
 						'proxied'  => false,

inc/models/class-membership.php

@@ -1106,6 +1106,10 @@ public function get_normalized_amount() {
 
 		$duration = $this->get_duration();
 
+		if ( ! $duration ) {
+			return $amount;
+		}
+
 		$normalized_duration_unit = wu_convert_duration_unit_to_month($this->get_duration_unit());
 
 		return $amount / $duration * $normalized_duration_unit;

inc/models/class-site.php

@@ -2258,7 +2258,7 @@
 		 * @param bool       $is_new If this object is a new one.
 		 */
 		$profile_stage = microtime(true);
 		do_action('wu_model_post_save', $this->model, $data, $data_unserialized, $this, $new); // @phpstan-ignore-line
 
 		/**
 		 * Fires after an object is stored into the database.
@@ -2378,14 +2378,18 @@
 
 					$pending_site = maybe_unserialize($item);
 
+					if ( ! $pending_site instanceof self ) {
+						return null;
+					}
+
 					$pending_site->set_type('pending');
 
 					return $pending_site;
 				},
 				$results
 			);
 
-			return $results;
+			return array_values(array_filter($results));
 		}
 
 		$query = $query_args;

inc/sso/class-magic-link.php

@@ -125,6 +125,10 @@ public function generate_magic_link($user_id, $site_id, $redirect_to = '') {
 
 		$site = wu_get_site($site_id);
 
+		if ( ! $site ) {
+			return false;
+		}
+
 		// Build the magic link URL.
 		$site_url = $site->get_active_site_url();