WPCS

The shortcode takes value, or meta_value with an optional post_id; post_id without meta_value reads the meta key wpcs_price. price() multiplies by the rate only when the current currency differs from the base, then passes the number to format_price_numeric() and the wpcs_price filter.

price_html() wraps the result in a span with a unique id and data-amount holding the base value, which the page cache mode later uses to re-render it.

For fixed prices the shortcode parses the list into a map and shows the amount for the current currency, or 'none' if it is missing. The price-in-all-currencies list uses the same map instead of converting.

JPY and TWD are always shown without cents; any currency can be added to that list with hide_cents. Settings include per-currency decimals and per-currency decimal and thousands separators. The separator choice is an index into two parallel arrays, where index 0 means the global setting, so existing sites keep their formatting.

The interest is a fixed amount stored next to the rate. get_currencies() adds it to the rate everywhere except on the plugin settings page, so the admin edits the clean rate while the front end converts with the adjusted one. A wpcs_currency_data_manipulation filter runs after that for custom rules.

The price info list strips the thousands separator from the already formatted string, normalizes the decimal separator, converts back to the base with back_convert() (1/rate) and then forward into every other currency. The [wpcs_converter] endpoint uses rate[to] / rate[from], both relative to the base, and drops cents for no-cents currencies.

For a converted price the shortcode remembers the visitor's currency, switches to the requested one if it is configured, renders, and switches back so the rest of the page keeps the visitor's choice.

The changelog tracks the churn: Yahoo removed in 1.1.1 (2017), Google removed in 1.1.2 (2018), both added back in 1.1.3 (2018), sources that stopped working removed again in 1.1.3 and 1.1.4, custom aggregators through a hook in 1.1.5 (2020). Each source is a class with getApiUrl() and parseResponse() on a shared RateProvider base.

get_rate_provider() maps the option value to a class name; if no class exists, wpcs_add_aggregator_processor lets a site plug in its own source, and wpcs_announce_aggregator adds it to the settings list. The settings list has 14 sources.

ECB publishes against EUR, the National Bank of Ukraine against UAH, Magyar Nemzeti Bank against HUF. Each provider handles three cases: base is the bank currency, target is the bank currency, neither. The MNB source is a SOAP service with comma decimals and per-unit quotes (for example 100 JPY), normalized before division.

get_rate() returns the provider error text instead of a number when the rate is negative. rate_auto_update() casts results to float and replaces a rate only when the new value is above zero, so a broken source never writes zero or an error text as a rate.

The settings offer hourly, twice daily, daily, weekly or monthly. The plugin registers the two extra intervals through cron_schedules and schedules the event with the selected interval on load when it is not scheduled yet.

The AJAX handler saves the new is_etalon flag, sets the new default currency in memory, requests a rate for every other currency through the active provider and returns the rates to the settings form.

WPCS_World_Currencies holds symbol, description, decimals and flag code per currency. add_currencies_ajax() adds the selected ones, fetches a rate for each, registers unknown symbols as custom signs and downloads the flag into the media library, falling back to a remote flag URL if the download fails. The bulk-add dialog is shown only in the premium build.

Each price span carries a unique id and the base amount. With the cache option on, front.js sends the id/amount pairs to wpcs_get_prices_html, which resolves the visitor's currency server-side and returns a map of id to new HTML plus the current currency; the switcher widgets are then synced to it. The mode is present in the 2016 code.

While the switcher widgets are set to the returned currency, a flag stops their change events from starting another currency switch.

WPCS_STORAGE builds the backend by name from an abstract Storage class. SessionStorage::create() returns false when session_start() fails, and the wrapper then falls back to transient storage. Every value is sanitized on write.

The changelog names the reason: IP-keyed transients mix users who share an address. CookieStorage keys transients by a UUID cookie. If headers are already sent when the ID is created, it prints a footer script that posts the ID to a nonce-checked AJAX endpoint, which sets the cookie from a clean response.

In the default mode wpcs_redirect() rebuilds the current URL keeping other GET parameters and the #anchor. In 'No GET data in link' mode it posts the currency to wpcs_set_currency_ajax and reloads. GET parameters echoed into the page script are sanitized recursively first.

On the first request the welcome currency is stored and the flag set; geo rules also run only for a first unique visit. If a stored currency is later removed from the list, get_currencies() falls back to the base.

WooCommerce's WC_Geolocation is not available on a plain WordPress site, so the plugin ships its own country database. lib/GeoIP.dat and geoip.inc are wrapped in OpenIpCountryResolver with a per-request cache by IP.

With the bundled database, a Cloudflare HTTP_CF_IPCOUNTRY header is used directly and the database lookup is skipped. A request whose REMOTE_ADDR is 127.0.0.1 or ::1 is resolved as 8.8.8.8 before the proxy headers are read.

With a MaxMind license key the admin downloads the GeoLite2-Country archive; the handler unpacks .tar.gz with PharData, finds the .mmdb file, copies it to uploads/currency-switcher and removes temporary files on success and on error. Without a key the plugin stays on the bundled database. Lookups go through the geoip2 Composer package.

init_geo_currency() resolves the country, passes it through wpcs_geo_position, stores it for the visitor and applies the first matching rule on a first visit only. [wpcs_check_country] prints the detected country for debugging a rule.

wpcs_get_prices_html is available to anonymous visitors. It slices input to 500 entries, accepts only ids matching the uniqid() charset used by price_html(), skips non-scalar prices, and encodes the response with JSON_HEX_TAG, AMP, APOS and QUOT because admin-ajax serves it as text/html.

price_html() writes values that come from [wpcs_price] attributes, such as the base amount or the raw 'USD:15,EUR:20' list of a fixed price, into data-* attributes of the price span. Keys and values are escaped and quoted, so an attribute value cannot inject markup.

wpcs_rates_current_currency passes visitor input into do_shortcode(). Only currency codes that exist in the configuration survive, the result is esc_attr'd, and precision is cast to int, so no extra shortcode syntax can be injected.

The currency-switcher form field and the ?currency= parameter are checked with array_key_exists() against the configured list before they reach storage, and WPCS_STORAGE::set_val() sanitizes every value.

Symbols such as руб. are stored as entities. The select posts md5(symbol), and the save handler maps the hash back to the original entity from the known list, so the entity is neither double-encoded nor taken from raw input. The save is protected by check_admin_referer(), and position is checked against a fixed list.