Udp.Code.Security WooCommerce

[alexander-b-clean]

https://app.doboard.com/1/task/54749

[Copilot]

🟡 Changes recommended

The WooCommerce checkout/store-API anti-spam checks can be bypassed when “Store blocked orders” is disabled, and the new setting’s default behavior is inconsistent between UI text, State defaults, and the updater.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the WooCommerce integration to improve how blocked (spam) orders are handled and surfaced in the admin, including embedding the plugin’s spam-orders table into the WooCommerce HPOS orders screen and adding a customer-facing rejection/thank-you flow for blocked checkouts.

Changes:

• Reworked the WooCommerce “Spam orders” admin list table to match WooCommerce’s orders UI (views row, columns, sorting, totals, styling) and support embedding into the WC orders page.
• Added a new setting to optionally show the rejection reason to customers; otherwise, blocked checkouts can be redirected to an “order received” page with transient-backed overview details.
• Cleaned up multiple integrations by removing redundant die()/exit after wp_send_json() and updated navigation links to point to the new WC orders screen spam view.

File summaries

File	Description
lib/Cleantalk/ApbctWP/WcSpamOrdersListTable.php	Refactors spam orders list UI (views, columns, totals, sorting) and adds embedded rendering support + notices.
lib/Cleantalk/ApbctWP/WcSpamOrdersFunctions.php	Adds helper to count stored spam orders for status counters/blank-state logic.
lib/Cleantalk/ApbctWP/Variables/AltSessions.php	Removes redundant post-wp_send_json() handling in error paths.
lib/Cleantalk/ApbctWP/State.php	Adds new WC setting default and changes default for storing blocked orders.
lib/Cleantalk/Antispam/IntegrationsByClass/Woocommerce.php	Adds customer rejection/redirect behavior and embeds spam orders view into WC HPOS orders screen.
lib/Cleantalk/Antispam/Integrations/UserRegistrationPro.php	Removes redundant die() after wp_send_json().
lib/Cleantalk/Antispam/Integrations/SureForms.php	Removes redundant die() after wp_send_json().
lib/Cleantalk/Antispam/Integrations/MailPoet.php	Removes redundant die() after wp_send_json().
lib/Cleantalk/Antispam/Integrations/HivePressRegistration.php	Removes redundant die() after wp_send_json().
lib/Cleantalk/Antispam/Integrations/HivePress.php	Removes redundant die() after wp_send_json().
lib/Cleantalk/Antispam/Integrations/ElementorUltimateAddonsRegister.php	Removes unreachable return value after wp_send_json().
lib/Cleantalk/Antispam/Integrations/ChatyContactForm.php	Removes redundant exit after wp_send_json().
inc/cleantalk-updater.php	Adds updater step for the new WC rejection-message setting.
inc/cleantalk-settings.php	Adds the new WC setting field and updates description/link to spam orders view.
inc/cleantalk-public-integrations.php	Removes redundant exit after wp_send_json().
inc/cleantalk-ajax.php	Removes redundant die() after wp_send_json().
inc/cleantalk-admin.php	Updates admin bar link to new WC orders spam view URL.
css/src/cleantalk-admin.css	Adds styles to make spam orders list match WooCommerce orders list presentation.
css/cleantalk-admin.min.css	Updates minified admin CSS to include new styles.

Review details

Files not reviewed (1)

• css/cleantalk-admin.min.css: Generated file

Suppressed comments (2)

lib/Cleantalk/Antispam/IntegrationsByClass/Woocommerce.php:270

• Same issue as in checkoutCheck(): returning here bypasses the Store API anti-spam check entirely when “Store blocked orders” is off. Keep the check and force the rejection-message path for this request so spam is blocked without storing blocked orders.

        if ( ! $apbct->settings['data__wc_store_blocked_orders'] ) {
            // The checkout is left to WooCommerce as is: no check, no blocked order to store.
            return;
        }

lib/Cleantalk/ApbctWP/WcSpamOrdersListTable.php:644

• User-facing notice capitalization/wording: “To store Spam orders…” reads inconsistent with “spam” elsewhere and “Store blocked orders” (not specifically “WooCommerce orders” on this page). Consider lowercasing “spam” and tightening the message.

                esc_html__(
                    'To store Spam orders, enable the "Store blocked WooCommerce orders" option in %1$sCleanTalk settings%2$s.',
                    'cleantalk-spam-protect'
                ),

• Files reviewed: 18/19 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[alexander-b-clean]

I disagree.

[alexander-b-clean]

I disagree.