← All changes | includes/ajax/settings.php +36 -15 2.11.0 → 2.13.0 View file →

		@@ -9,8 +9,9 @@
9	9	use ABlocks\Classes\AbstractAjaxHandler;
10	10	use ABlocks\Classes\Sanitizer;
11	11	use ABlocks\Helper;
12	12	use ABlocks\Admin\Settings\Base as BaseSettings;
	13	+use ABlocks\Permissions\SettingsGuard;
13	14
14	15	class Settings extends AbstractAjaxHandler {
15	16	public function __construct() {
16	17	$this->actions = array(
		@@ -15,13 +16,13 @@
15	16	public function __construct() {
16	17	$this->actions = array(
17	18	'get_blocks_visibility' => array(
18	19	'callback' => array( $this, 'get_blocks_visibility' ),
19		- 'capability' => 'manage_options'
	20	+ 'capability' => 'ablocks_manage_settings'
20	21	),
21	22	'save_block_visibility' => array(
22	23	'callback' => array( $this, 'save_block_visibility' ),
23		- 'capability' => 'manage_options',
	24	+ 'capability' => 'ablocks_manage_settings',
24	25	'fields' => array(
25	26	'block_name' => 'string',
26	27	'status' => 'boolean',
27	28	)
		@@ -27,9 +28,9 @@
27	28	)
28	29	),
29	30	'save_bulk_block_visibility' => array(
30	31	'callback' => array( $this, 'save_bulk_block_visibility' ),
31		- 'capability' => 'manage_options',
	32	+ 'capability' => 'ablocks_manage_settings',
32	33	'fields' => array(
33	34	'blocks' => 'json',
34	35	)
35	36	),
		@@ -34,13 +35,13 @@
34	35	)
35	36	),
36	37	'get_settings' => array(
37	38	'callback' => array( $this, 'get_settings' ),
38		- 'capability' => 'manage_options',
	39	+ 'capability' => 'ablocks_access',
39	40	),
40	41	'save_settings' => array(
41	42	'callback' => array( $this, 'save_settings' ),
42		- 'capability' => 'manage_options',
	43	+ 'capability' => 'ablocks_save_settings',
43	44	'fields' => array(
44	45	'default_container_width' => 'integer',
45	46	'container_padding' => 'integer',
46	47	'container_element_gap' => 'integer',
		@@ -83,8 +84,12 @@
83	84	'perf_disable_dashicons' => 'boolean',
84	85	'perf_disable_jquery_migrate' => 'boolean',
85	86	'perf_control_heartbeat' => 'boolean',
86	87	'perf_heartbeat_frequency' => 'integer',
	88	+ // Editor paste
	89	+ 'paste_google_docs' => 'boolean',
	90	+ 'paste_convert_webp' => 'boolean',
	91	+ 'paste_webp_quality' => 'integer',
87	92	// Performance Suite — full-page cache.
88	93	'perf_page_cache' => 'boolean',
89	94	'perf_page_cache_scope' => 'string',
90	95	'perf_page_cache_ttl' => 'integer',
		@@ -140,9 +145,9 @@
140	145	)
141	146	),
142	147	'fetch_posts' => array(
143	148	'callback' => array( $this, 'fetch_posts' ),
144		- 'capability' => 'manage_options',
	149	+ 'capability' => 'ablocks_access',
145	150	'fields' => array(
146	151	'postId' => 'integer',
147	152	'postType' => 'string',
148	153	'keyword' => 'string',
		@@ -149,13 +154,13 @@
149	154	)
150	155	),
151	156	'get_fronted_dashboard_pages' => array(
152	157	'callback' => array( $this, 'get_fronted_dashboard_pages' ),
153		- 'capability' => 'manage_options',
	158	+ 'capability' => 'ablocks_manage_settings',
154	159	),
155	160	'create_fronted_dashboard_page' => array(
156	161	'callback' => array( $this, 'create_fronted_dashboard_page' ),
157		- 'capability' => 'manage_options',
	162	+ 'capability' => 'ablocks_manage_settings',
158	163	'fields' => [
159	164	'label' => 'string',
160	165	'slug' => 'string',
161	166	'icon' => 'string',
		@@ -165,9 +170,9 @@
165	170	]
166	171	),
167	172	'create_fronted_dashboard_link' => array(
168	173	'callback' => array( $this, 'create_fronted_dashboard_link' ),
169		- 'capability' => 'manage_options',
	174	+ 'capability' => 'ablocks_manage_settings',
170	175	'fields' => [
171	176	'label' => 'string',
172	177	'link' => 'string',
173	178	'icon' => 'string',
		@@ -177,9 +182,9 @@
177	182	]
178	183	),
179	184	'edit_fronted_dashboard_link' => array(
180	185	'callback' => array( $this, 'edit_fronted_dashboard_link' ),
181		- 'capability' => 'manage_options',
	186	+ 'capability' => 'ablocks_manage_settings',
182	187	'fields' => [
183	188	'label' => 'string',
184	189	'link' => 'string',
185	190	'icon' => 'string',
		@@ -189,9 +194,9 @@
189	194	]
190	195	),
191	196	'delete_fronted_dashboard_link' => array(
192	197	'callback' => array( $this, 'delete_fronted_dashboard_link' ),
193		- 'capability' => 'manage_options',
	198	+ 'capability' => 'ablocks_manage_settings',
194	199	'fields' => array(
195	200	'page_id' => 'string',
196	201	)
197	202	),
		@@ -196,9 +201,9 @@
196	201	)
197	202	),
198	203	'edit_fronted_dashboard_page' => array(
199	204	'callback' => array( $this, 'edit_fronted_dashboard_page' ),
200		- 'capability' => 'manage_options',
	205	+ 'capability' => 'ablocks_manage_settings',
201	206	'fields' => [
202	207	'label' => 'string',
203	208	'slug' => 'string',
204	209	'icon' => 'string',
		@@ -209,9 +214,9 @@
209	214	]
210	215	),
211	216	'move_fronted_dashboard_page' => array(
212	217	'callback' => array( $this, 'move_fronted_dashboard_page' ),
213		- 'capability' => 'manage_options',
	218	+ 'capability' => 'ablocks_manage_settings',
214	219	'fields' => [
215	220	'reordered_items' => 'string',
216	221	]
217	222	),
		@@ -216,9 +221,9 @@
216	221	]
217	222	),
218	223	'delete_fronted_dashboard_page' => array(
219	224	'callback' => array( $this, 'delete_fronted_dashboard_page' ),
220		- 'capability' => 'manage_options',
	225	+ 'capability' => 'ablocks_manage_settings',
221	226	'fields' => array(
222	227	'slug' => 'string',
223	228	'page_id' => 'integer',
224	229	)
		@@ -280,8 +285,14 @@
280	285	wp_send_json_success( $settings );
281	286	}
282	287
283	288	public function save_settings( $payload ) {
	289	+ // The design system, the performance suite and site configuration are
	290	+ // three separate permissions but one endpoint. Keys this user may not
	291	+ // change are rewritten back to what is already saved, so the save
	292	+ // succeeds and simply leaves them alone.
	293	+ $payload = SettingsGuard::filter_payload( $payload );
	294	+
284	295	// phpcs:ignore WordPress.Security.NonceVerification.Missing
285	296	do_action( 'ablocks/before_save_settings', $payload, 'base' );
286	297	$json_payload = Sanitizer::sanitize_payload([
287	298	'selected_fonts' => 'json',
		@@ -300,8 +311,13 @@
300	311	'global_h5_typography' => 'json',
301	312	'global_h6_typography' => 'json',
302	313	], $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
303	314
	315	+ // The JSON fields are read straight from $_POST rather than the sanitized
	316	+ // payload, so they need the same guard — the global colour and typography
	317	+ // presets live in here, and they are the design system.
	318	+ $json_payload = SettingsGuard::filter_payload( $json_payload );
	319	+
304	320	$default = BaseSettings::get_default_data();
305	321	$is_update = BaseSettings::save_settings( [
306	322	'default_container_width' => $payload['default_container_width'] ?? $default['default_container_width'],
307	323	'container_padding' => $payload['container_padding'] ?? $default['container_padding'],
		@@ -333,8 +349,12 @@
333	349	'perf_inline_css' => $payload['perf_inline_css'] ?? $default['perf_inline_css'],
334	350	'perf_async_css' => $payload['perf_async_css'] ?? $default['perf_async_css'],
335	351	'perf_critical_css' => $payload['perf_critical_css'] ?? $default['perf_critical_css'],
336	352	'perf_defer_js' => $payload['perf_defer_js'] ?? $default['perf_defer_js'],
	353	+ // Editor paste.
	354	+ 'paste_google_docs' => $payload['paste_google_docs'] ?? $default['paste_google_docs'],
	355	+ 'paste_convert_webp' => $payload['paste_convert_webp'] ?? $default['paste_convert_webp'],
	356	+ 'paste_webp_quality' => $payload['paste_webp_quality'] ?? $default['paste_webp_quality'],
337	357	// Performance Suite — full-page cache.
338	358	'perf_page_cache' => $payload['perf_page_cache'] ?? $default['perf_page_cache'],
339	359	'perf_page_cache_scope' => $payload['perf_page_cache_scope'] ?? $default['perf_page_cache_scope'],
340	360	'perf_page_cache_ttl' => $payload['perf_page_cache_ttl'] ?? $default['perf_page_cache_ttl'],
		@@ -426,9 +446,10 @@
426	446	);
427	447	if ( ! empty( $keyword ) ) {
428	448	$args['s'] = $keyword;
429	449	}
430		- if ( ! current_user_can( 'manage_options' ) ) {
	450	+ // Anyone who cannot edit other people's posts only picks from their own.
	451	+ if ( ! current_user_can( 'edit_others_posts' ) ) {
431	452	$args['author'] = get_current_user_id();
432	453	}
433	454	}
434	455	$results = array();