PluginProbe
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder / 2.13.1
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder v2.13.1
2.13.0 2.13.1 2.12.0 2.11.1 2.11.0 2.10.0 2.9.0 2.7.4 2.7.5 2.7.6 2.7.7 2.8.0 2.8.1 2.9.1 trunk 1.0 1.0-beta1 1.0-beta2 1.0-beta3 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2 All 80 releases
← All changes | includes/ajax/settings.php +146 -15 2.9.02.13.1 View file →
@@ -9,8 +9,9 @@
9 9 use ABlocks\Classes\AbstractAjaxHandler;
10 10 use ABlocks\Classes\Sanitizer;
11 11 use ABlocks\Helper;
12 12 use ABlocks\Admin\Settings\Base as BaseSettings;
13 +use ABlocks\Permissions\SettingsGuard;
13 14
14 15 class Settings extends AbstractAjaxHandler {
15 16 public function __construct() {
16 17 $this->actions = array(
@@ -15,13 +16,13 @@
15 16 public function __construct() {
16 17 $this->actions = array(
17 18 'get_blocks_visibility' => array(
18 19 'callback' => array( $this, 'get_blocks_visibility' ),
19 - 'capability' => 'manage_options'
20 + 'capability' => 'ablocks_manage_settings'
20 21 ),
21 22 'save_block_visibility' => array(
22 23 'callback' => array( $this, 'save_block_visibility' ),
23 - 'capability' => 'manage_options',
24 + 'capability' => 'ablocks_manage_settings',
24 25 'fields' => array(
25 26 'block_name' => 'string',
26 27 'status' => 'boolean',
27 28 )
@@ -27,9 +28,9 @@
27 28 )
28 29 ),
29 30 'save_bulk_block_visibility' => array(
30 31 'callback' => array( $this, 'save_bulk_block_visibility' ),
31 - 'capability' => 'manage_options',
32 + 'capability' => 'ablocks_manage_settings',
32 33 'fields' => array(
33 34 'blocks' => 'json',
34 35 )
35 36 ),
@@ -34,13 +35,13 @@
34 35 )
35 36 ),
36 37 'get_settings' => array(
37 38 'callback' => array( $this, 'get_settings' ),
38 - 'capability' => 'manage_options',
39 + 'capability' => 'ablocks_access',
39 40 ),
40 41 'save_settings' => array(
41 42 'callback' => array( $this, 'save_settings' ),
42 - 'capability' => 'manage_options',
43 + 'capability' => 'ablocks_save_settings',
43 44 'fields' => array(
44 45 'default_container_width' => 'integer',
45 46 'container_padding' => 'integer',
46 47 'container_element_gap' => 'integer',
@@ -45,10 +46,14 @@
45 46 'container_padding' => 'integer',
46 47 'container_element_gap' => 'integer',
47 48 'enabled_assets_file_generation' => 'boolean',
48 49 'enabled_block_copy_paste_style' => 'boolean',
50 + 'lock_global_typography' => 'boolean',
51 + 'lock_global_typography_strict' => 'boolean',
52 + 'lock_global_colors' => 'boolean',
49 53 'enabled_load_google_font_locally' => 'boolean',
50 54 'enabled_only_selected_fonts' => 'boolean',
55 + 'font_metric_fallback' => 'boolean',
51 56 'enabled_coming_soon_page' => 'boolean',
52 57 'coming_soon_page' => 'integer',
53 58 'enabled_maintenance_page' => 'boolean',
54 59 'maintenance_page' => 'integer',
@@ -60,8 +65,61 @@
60 65 'drip_api_key' => 'string',
61 66 'getresponse_api_key' => 'string',
62 67 'convertkit_api_key' => 'string',
63 68 'mailerlite_api_key' => 'string',
69 + // Performance Suite
70 + 'perf_lazy_images' => 'boolean',
71 + 'perf_lcp_eager_count' => 'integer',
72 + 'perf_image_dimensions' => 'boolean',
73 + 'perf_responsive_images' => 'boolean',
74 + 'perf_preload_lcp' => 'boolean',
75 + 'perf_touch_targets' => 'boolean',
76 + 'perf_inline_css' => 'boolean',
77 + 'perf_async_css' => 'boolean',
78 + 'perf_critical_css' => 'boolean',
79 + 'perf_defer_js' => 'boolean',
80 + 'perf_delay_js' => 'boolean',
81 + 'perf_delay_js_timeout' => 'integer',
82 + 'perf_disable_emojis' => 'boolean',
83 + 'perf_disable_embeds' => 'boolean',
84 + 'perf_disable_dashicons' => 'boolean',
85 + 'perf_disable_jquery_migrate' => 'boolean',
86 + 'perf_control_heartbeat' => 'boolean',
87 + 'perf_heartbeat_frequency' => 'integer',
88 + // Editor paste
89 + 'paste_google_docs' => 'boolean',
90 + 'paste_convert_webp' => 'boolean',
91 + 'paste_webp_quality' => 'integer',
92 + // Performance Suite — full-page cache.
93 + 'perf_page_cache' => 'boolean',
94 + 'perf_page_cache_scope' => 'string',
95 + 'perf_page_cache_ttl' => 'integer',
96 + 'perf_page_cache_gzip' => 'boolean',
97 + 'perf_page_cache_prewarm' => 'boolean',
98 + 'perf_page_cache_mobile_variant' => 'boolean',
99 + 'perf_page_cache_crawler' => 'boolean',
100 + 'perf_page_cache_crawl_batch' => 'integer',
101 + 'perf_consolidate_css' => 'boolean',
102 + 'perf_consolidate_css_min' => 'integer',
103 + 'perf_fragment_cache' => 'boolean',
104 + 'perf_fragment_cache_ttl' => 'integer',
105 + 'perf_template_cache' => 'boolean',
106 + 'perf_template_cache_ttl' => 'integer',
107 + 'perf_image_optimize_on_upload' => 'boolean',
108 + 'perf_image_level' => 'string',
109 + 'perf_image_webp' => 'boolean',
110 + 'perf_image_quarantine_autodelete' => 'boolean',
111 + 'perf_image_quarantine_days' => 'integer',
112 + 'perf_image_require_filename' => 'boolean',
113 + 'perf_image_require_alt' => 'boolean',
114 + // Marketing — query param passthrough
115 + 'param_passthrough_enabled' => 'boolean',
116 + 'param_passthrough_keys' => 'string',
117 + 'param_passthrough_match' => 'string',
118 + 'param_passthrough_class' => 'string',
119 + 'param_passthrough_keyword' => 'string',
120 + 'param_passthrough_persist' => 'boolean',
121 + 'param_passthrough_cookie_days' => 'integer',
64 122 // global color & typography
65 123 'global_color' => 'json',
66 124 'global_typography' => 'json',
67 125 'global_font_family_fallback' => 'string',
@@ -87,9 +145,9 @@
87 145 )
88 146 ),
89 147 'fetch_posts' => array(
90 148 'callback' => array( $this, 'fetch_posts' ),
91 - 'capability' => 'manage_options',
149 + 'capability' => 'ablocks_access',
92 150 'fields' => array(
93 151 'postId' => 'integer',
94 152 'postType' => 'string',
95 153 'keyword' => 'string',
@@ -96,13 +154,13 @@
96 154 )
97 155 ),
98 156 'get_fronted_dashboard_pages' => array(
99 157 'callback' => array( $this, 'get_fronted_dashboard_pages' ),
100 - 'capability' => 'manage_options',
158 + 'capability' => 'ablocks_manage_settings',
101 159 ),
102 160 'create_fronted_dashboard_page' => array(
103 161 'callback' => array( $this, 'create_fronted_dashboard_page' ),
104 - 'capability' => 'manage_options',
162 + 'capability' => 'ablocks_manage_settings',
105 163 'fields' => [
106 164 'label' => 'string',
107 165 'slug' => 'string',
108 166 'icon' => 'string',
@@ -112,9 +170,9 @@
112 170 ]
113 171 ),
114 172 'create_fronted_dashboard_link' => array(
115 173 'callback' => array( $this, 'create_fronted_dashboard_link' ),
116 - 'capability' => 'manage_options',
174 + 'capability' => 'ablocks_manage_settings',
117 175 'fields' => [
118 176 'label' => 'string',
119 177 'link' => 'string',
120 178 'icon' => 'string',
@@ -124,9 +182,9 @@
124 182 ]
125 183 ),
126 184 'edit_fronted_dashboard_link' => array(
127 185 'callback' => array( $this, 'edit_fronted_dashboard_link' ),
128 - 'capability' => 'manage_options',
186 + 'capability' => 'ablocks_manage_settings',
129 187 'fields' => [
130 188 'label' => 'string',
131 189 'link' => 'string',
132 190 'icon' => 'string',
@@ -136,9 +194,9 @@
136 194 ]
137 195 ),
138 196 'delete_fronted_dashboard_link' => array(
139 197 'callback' => array( $this, 'delete_fronted_dashboard_link' ),
140 - 'capability' => 'manage_options',
198 + 'capability' => 'ablocks_manage_settings',
141 199 'fields' => array(
142 200 'page_id' => 'string',
143 201 )
144 202 ),
@@ -143,9 +201,9 @@
143 201 )
144 202 ),
145 203 'edit_fronted_dashboard_page' => array(
146 204 'callback' => array( $this, 'edit_fronted_dashboard_page' ),
147 - 'capability' => 'manage_options',
205 + 'capability' => 'ablocks_manage_settings',
148 206 'fields' => [
149 207 'label' => 'string',
150 208 'slug' => 'string',
151 209 'icon' => 'string',
@@ -156,9 +214,9 @@
156 214 ]
157 215 ),
158 216 'move_fronted_dashboard_page' => array(
159 217 'callback' => array( $this, 'move_fronted_dashboard_page' ),
160 - 'capability' => 'manage_options',
218 + 'capability' => 'ablocks_manage_settings',
161 219 'fields' => [
162 220 'reordered_items' => 'string',
163 221 ]
164 222 ),
@@ -163,9 +221,9 @@
163 221 ]
164 222 ),
165 223 'delete_fronted_dashboard_page' => array(
166 224 'callback' => array( $this, 'delete_fronted_dashboard_page' ),
167 - 'capability' => 'manage_options',
225 + 'capability' => 'ablocks_manage_settings',
168 226 'fields' => array(
169 227 'slug' => 'string',
170 228 'page_id' => 'integer',
171 229 )
@@ -227,12 +285,20 @@
227 285 wp_send_json_success( $settings );
228 286 }
229 287
230 288 public function save_settings( $payload ) {
289 + // The design system, the performance suite and site configuration are
290 + // three separate permissions but one endpoint. Keys this user may not
291 + // change are rewritten back to what is already saved, so the save
292 + // succeeds and simply leaves them alone.
293 + $payload = SettingsGuard::filter_payload( $payload );
294 +
231 295 // phpcs:ignore WordPress.Security.NonceVerification.Missing
232 296 do_action( 'ablocks/before_save_settings', $payload, 'base' );
233 297 $json_payload = Sanitizer::sanitize_payload([
234 298 'selected_fonts' => 'json',
299 + 'perf_page_cache_query_args' => 'json',
300 + 'perf_page_cache_exclusions' => 'json',
235 301 'global_color' => 'json',
236 302 'global_typography' => 'json',
237 303 'global_body_typography' => 'json',
238 304 'global_body_paragraph_space' => 'json',
@@ -245,8 +311,13 @@
245 311 'global_h5_typography' => 'json',
246 312 'global_h6_typography' => 'json',
247 313 ], $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
248 314
315 + // The JSON fields are read straight from $_POST rather than the sanitized
316 + // payload, so they need the same guard — the global colour and typography
317 + // presets live in here, and they are the design system.
318 + $json_payload = SettingsGuard::filter_payload( $json_payload );
319 +
249 320 $default = BaseSettings::get_default_data();
250 321 $is_update = BaseSettings::save_settings( [
251 322 'default_container_width' => $payload['default_container_width'] ?? $default['default_container_width'],
252 323 'container_padding' => $payload['container_padding'] ?? $default['container_padding'],
@@ -252,11 +323,70 @@
252 323 'container_padding' => $payload['container_padding'] ?? $default['container_padding'],
253 324 'container_element_gap' => $payload['container_element_gap'] ?? $default['container_element_gap'],
254 325 'enabled_assets_file_generation' => $payload['enabled_assets_file_generation'] ?? $default['enabled_assets_file_generation'],
255 326 'enabled_block_copy_paste_style' => $payload['enabled_block_copy_paste_style'] ?? $default['enabled_block_copy_paste_style'],
327 + 'lock_global_typography' => $payload['lock_global_typography'] ?? $default['lock_global_typography'],
328 + 'lock_global_typography_strict' => $payload['lock_global_typography_strict'] ?? $default['lock_global_typography_strict'],
329 + 'lock_global_colors' => $payload['lock_global_colors'] ?? $default['lock_global_colors'],
256 330 'enabled_load_google_font_locally' => $payload['enabled_load_google_font_locally'] ?? $default['enabled_load_google_font_locally'],
257 331 'enabled_only_selected_fonts' => $payload['enabled_only_selected_fonts'] ?? $default['enabled_only_selected_fonts'],
258 332 'selected_fonts' => $json_payload['selected_fonts'] ?? $default['selected_fonts'],
333 + 'font_metric_fallback' => $payload['font_metric_fallback'] ?? $default['font_metric_fallback'],
334 + // Performance Suite — platform optimizations.
335 + 'perf_disable_emojis' => $payload['perf_disable_emojis'] ?? $default['perf_disable_emojis'],
336 + 'perf_disable_embeds' => $payload['perf_disable_embeds'] ?? $default['perf_disable_embeds'],
337 + 'perf_disable_dashicons' => $payload['perf_disable_dashicons'] ?? $default['perf_disable_dashicons'],
338 + 'perf_disable_jquery_migrate' => $payload['perf_disable_jquery_migrate'] ?? $default['perf_disable_jquery_migrate'],
339 + 'perf_control_heartbeat' => $payload['perf_control_heartbeat'] ?? $default['perf_control_heartbeat'],
340 + 'perf_heartbeat_frequency' => $payload['perf_heartbeat_frequency'] ?? $default['perf_heartbeat_frequency'],
341 + 'perf_delay_js' => $payload['perf_delay_js'] ?? $default['perf_delay_js'],
342 + 'perf_delay_js_timeout' => $payload['perf_delay_js_timeout'] ?? $default['perf_delay_js_timeout'],
343 + 'perf_lazy_images' => $payload['perf_lazy_images'] ?? $default['perf_lazy_images'],
344 + 'perf_lcp_eager_count' => $payload['perf_lcp_eager_count'] ?? $default['perf_lcp_eager_count'],
345 + 'perf_image_dimensions' => $payload['perf_image_dimensions'] ?? $default['perf_image_dimensions'],
346 + 'perf_responsive_images' => $payload['perf_responsive_images'] ?? $default['perf_responsive_images'],
347 + 'perf_preload_lcp' => $payload['perf_preload_lcp'] ?? $default['perf_preload_lcp'],
348 + 'perf_touch_targets' => $payload['perf_touch_targets'] ?? $default['perf_touch_targets'],
349 + 'perf_inline_css' => $payload['perf_inline_css'] ?? $default['perf_inline_css'],
350 + 'perf_async_css' => $payload['perf_async_css'] ?? $default['perf_async_css'],
351 + 'perf_critical_css' => $payload['perf_critical_css'] ?? $default['perf_critical_css'],
352 + 'perf_defer_js' => $payload['perf_defer_js'] ?? $default['perf_defer_js'],
353 + // Editor paste.
354 + 'paste_google_docs' => $payload['paste_google_docs'] ?? $default['paste_google_docs'],
355 + 'paste_convert_webp' => $payload['paste_convert_webp'] ?? $default['paste_convert_webp'],
356 + 'paste_webp_quality' => $payload['paste_webp_quality'] ?? $default['paste_webp_quality'],
357 + // Performance Suite — full-page cache.
358 + 'perf_page_cache' => $payload['perf_page_cache'] ?? $default['perf_page_cache'],
359 + 'perf_page_cache_scope' => $payload['perf_page_cache_scope'] ?? $default['perf_page_cache_scope'],
360 + 'perf_page_cache_ttl' => $payload['perf_page_cache_ttl'] ?? $default['perf_page_cache_ttl'],
361 + 'perf_page_cache_gzip' => $payload['perf_page_cache_gzip'] ?? $default['perf_page_cache_gzip'],
362 + 'perf_page_cache_prewarm' => $payload['perf_page_cache_prewarm'] ?? $default['perf_page_cache_prewarm'],
363 + 'perf_page_cache_mobile_variant' => $payload['perf_page_cache_mobile_variant'] ?? $default['perf_page_cache_mobile_variant'],
364 + 'perf_page_cache_crawler' => $payload['perf_page_cache_crawler'] ?? $default['perf_page_cache_crawler'],
365 + 'perf_page_cache_crawl_batch' => $payload['perf_page_cache_crawl_batch'] ?? $default['perf_page_cache_crawl_batch'],
366 + 'perf_page_cache_query_args' => $json_payload['perf_page_cache_query_args'] ?? $default['perf_page_cache_query_args'],
367 + 'perf_page_cache_exclusions' => $json_payload['perf_page_cache_exclusions'] ?? $default['perf_page_cache_exclusions'],
368 + 'perf_consolidate_css' => $payload['perf_consolidate_css'] ?? $default['perf_consolidate_css'],
369 + 'perf_consolidate_css_min' => $payload['perf_consolidate_css_min'] ?? $default['perf_consolidate_css_min'],
370 + 'perf_fragment_cache' => $payload['perf_fragment_cache'] ?? $default['perf_fragment_cache'],
371 + 'perf_fragment_cache_ttl' => $payload['perf_fragment_cache_ttl'] ?? $default['perf_fragment_cache_ttl'],
372 + 'perf_template_cache' => $payload['perf_template_cache'] ?? $default['perf_template_cache'],
373 + 'perf_template_cache_ttl' => $payload['perf_template_cache_ttl'] ?? $default['perf_template_cache_ttl'],
374 + 'perf_image_optimize_on_upload' => $payload['perf_image_optimize_on_upload'] ?? $default['perf_image_optimize_on_upload'],
375 + 'perf_image_level' => $payload['perf_image_level'] ?? $default['perf_image_level'],
376 + 'perf_image_webp' => $payload['perf_image_webp'] ?? $default['perf_image_webp'],
377 + 'perf_image_quarantine_autodelete' => $payload['perf_image_quarantine_autodelete'] ?? $default['perf_image_quarantine_autodelete'],
378 + 'perf_image_quarantine_days' => $payload['perf_image_quarantine_days'] ?? $default['perf_image_quarantine_days'],
379 + 'perf_image_require_filename' => $payload['perf_image_require_filename'] ?? $default['perf_image_require_filename'],
380 + 'perf_image_require_alt' => $payload['perf_image_require_alt'] ?? $default['perf_image_require_alt'],
381 + // Marketing — query param passthrough
382 + 'param_passthrough_enabled' => $payload['param_passthrough_enabled'] ?? $default['param_passthrough_enabled'],
383 + 'param_passthrough_keys' => $payload['param_passthrough_keys'] ?? $default['param_passthrough_keys'],
384 + 'param_passthrough_match' => $payload['param_passthrough_match'] ?? $default['param_passthrough_match'],
385 + 'param_passthrough_class' => $payload['param_passthrough_class'] ?? $default['param_passthrough_class'],
386 + 'param_passthrough_keyword' => $payload['param_passthrough_keyword'] ?? $default['param_passthrough_keyword'],
387 + 'param_passthrough_persist' => $payload['param_passthrough_persist'] ?? $default['param_passthrough_persist'],
388 + 'param_passthrough_cookie_days' => $payload['param_passthrough_cookie_days'] ?? $default['param_passthrough_cookie_days'],
259 389 'enabled_coming_soon_page' => $payload['enabled_coming_soon_page'] ?? $default['enabled_coming_soon_page'],
260 390 'coming_soon_page' => $payload['coming_soon_page'] ?? $default['coming_soon_page'],
261 391 'enabled_maintenance_page' => $payload['enabled_maintenance_page'] ?? $default['enabled_maintenance_page'],
262 392 'maintenance_page' => $payload['maintenance_page'] ?? $default['maintenance_page'],
@@ -316,9 +446,10 @@
316 446 );
317 447 if ( ! empty( $keyword ) ) {
318 448 $args['s'] = $keyword;
319 449 }
320 - if ( ! current_user_can( 'manage_options' ) ) {
450 + // Anyone who cannot edit other people's posts only picks from their own.
451 + if ( ! current_user_can( 'edit_others_posts' ) ) {
321 452 $args['author'] = get_current_user_id();
322 453 }
323 454 }
324 455 $results = array();