[Résolu] Orders publicly visible

[Auteur]

Publications

[martijnH]

lien caché

All orders are visible.
When I deactivate the "Toolset WooCommerce Blocks" the orders are invisible again.
V3.1.1
The problem is `wcviews_make_shop_order_views_queryable`

How do I solve this?

Jan-Willem

[Nigel]

The Toolset WooCommerce Blocks plugin makes the WC Order post type queryable so that it is possible to create Views to display lists of orders etc.

If you don't want that, it is possible to use the same WC filter that our plugin uses to override the default settings with a later priority to return them to their defaults.

Because the code needs to fire before the WC plugin sets up the Order post type you'll need to add the code as a plugin which runs before WooCommerce.

The easiest way to do that is to add a mu-plugins sub-directory in your wp-content folder, then add the following code inside a file within that directory (e.g. call the file order-settings.php):

<?php
/*
 Plugin Name: Order Settings
 Description: Reset WC Order Settings
 Version: 1.0
 */

add_filter( 'woocommerce_register_post_type_shop_order', 'ts_reset_order_settings', 11, 1 );
function ts_reset_order_settings( $post_type_param = array() ) {

    //Make it public
    if ( isset( $post_type_param['public'] ) ) {
        $post_type_param['public']	= false;
    }
    //Make it publicly queryable
    if ( isset( $post_type_param['publicly_queryable'] ) ) {
        $post_type_param['publicly_queryable'] = false;
    }
    //Enable query vars
    if ( isset( $post_type_param['query_var'] ) ) {
        $post_type_param['query_var'] = false;
    }
    //Enable archives
    if ( isset( $post_type_param['has_archive'] ) ) {
        $post_type_param['has_archive'] = false;
    }
    //Enable rewrite
    if ( isset( $post_type_param['rewrite'] ) ) {
        $post_type_param['rewrite'] = null;
    }

	return $post_type_param;

}

That will return the settings to the WC defaults.

[martijnH]

That works, I don't know the site fully so I don't know if/where the woo-views plugin used for.

Shouldn't this be an option?
This is technically a security leak.