#1560 Fix - Address Copilot review: defer_role by plan type, sanitize transaction_id, respect meta auth chain

Author: deepench

modules/membership/includes/Admin.php

@@ -1010,8 +1010,8 @@ public function protect_membership_post_meta() {
 		 * @return bool True when the evaluated user can manage the site's options.
 		 */
 		public function can_manage_membership_meta( $allowed = false, $meta_key = '', $object_id = 0, $user_id = 0, $cap = '', $caps = array() ) {
-			// Check the user WordPress is evaluating, not the current request user, so the callback is correct when caps are tested for another user.
-			return user_can( $user_id, 'manage_options' );
+			// Further restrict, never override: an earlier deny in the auth chain must stand.
+			return $allowed && user_can( $user_id, 'manage_options' );
 		}
 
 		/**

modules/membership/includes/Admin/Services/MembersService.php

@@ -163,6 +163,7 @@ public function prepare_members_data( $data, $context = 'admin' ) {
 				'membership'     => absint( $data['membership'] ),
 				'start_date'     => date( 'Y-m-d', strtotime( $data['start_date'] ) ),
 				'payment_method' => sanitize_text_field( $data['payment_method'] ?? '' ),
+				'type'           => isset( $membership_meta['type'] ) ? sanitize_text_field( $membership_meta['type'] ) : 'unknown',
 			);
 
 			if ( isset( $data['is_purchasing_multiple'] ) ) {

modules/membership/includes/Admin/Services/MembershipService.php

@@ -233,8 +233,9 @@ public function create_membership_order_and_subscription( $data ) {
 			$members_data = $this->members_service->prepare_members_data( $data, 'frontend' );
 			$member       = get_user_by( 'login', $data['username'] );
 
-			// Update user source and add membership_role.
-			$members_data['defer_role'] = 'free' !== ( $members_data['membership_data']['payment_method'] ?? '' );
+			// Update user source and add membership_role; a free plan always grants immediately.
+			$members_data['defer_role'] = 'free' !== ( $members_data['membership_data']['type'] ?? 'unknown' )
+				&& 'free' !== ( $members_data['membership_data']['payment_method'] ?? '' );
 			$this->members_service->update_user_meta( $members_data, $member->ID );
 
 			$subscription_service = new SubscriptionService();

modules/membership/includes/Templates/thank-you-page.php

@@ -2,7 +2,7 @@
 
 $bank_data         = ( isset( $_GET['info'] ) && ! empty( $_GET['info'] ) ) ? wp_kses_post( $_GET['info'] ) : '';
 $show_bank_data    = ( 'Free' === $bank_data || empty( $bank_data ) ) ? false : true;
-$transaction_id    = ( isset( $_GET['transaction_id'] ) && ! empty( $_GET['transaction_id'] ) ) ? wp_kses_post( $_GET['transaction_id'] ) : '';
+$transaction_id    = ( isset( $_GET['transaction_id'] ) && ! empty( $_GET['transaction_id'] ) ) ? sanitize_text_field( wp_unslash( $_GET['transaction_id'] ) ) : '';
 $username          = ( isset( $_GET['username'] ) && ! empty( $_GET['username'] ) ) ? wp_kses_post( $_GET['username'] ) : '';
 $main_content      = ! empty( $attributes['header'] ) ? wp_kses_post( $attributes['header'] ) : sprintf(
 	__( 'Thank You! Your registration was completed successfully.', 'user-registration' ),