| @@ -9,8 +9,9 @@ | ||
| 9 | 9 | use ABlocks\Classes\AbstractAjaxHandler; |
| 10 | 10 | use ABlocks\Classes\Sanitizer; |
| 11 | 11 | use ABlocks\Helper; |
| 12 | 12 | use ABlocks\Admin\Settings\Base as BaseSettings; |
| 13 | +use ABlocks\Permissions\SettingsGuard; | |
| 13 | 14 | |
| 14 | 15 | class Settings extends AbstractAjaxHandler { |
| 15 | 16 | public function __construct() { |
| 16 | 17 | $this->actions = array( |
| @@ -15,13 +16,13 @@ | ||
| 15 | 16 | public function __construct() { |
| 16 | 17 | $this->actions = array( |
| 17 | 18 | 'get_blocks_visibility' => array( |
| 18 | 19 | 'callback' => array( $this, 'get_blocks_visibility' ), |
| 19 | - 'capability' => 'manage_options' | |
| 20 | + 'capability' => 'ablocks_manage_settings' | |
| 20 | 21 | ), |
| 21 | 22 | 'save_block_visibility' => array( |
| 22 | 23 | 'callback' => array( $this, 'save_block_visibility' ), |
| 23 | - 'capability' => 'manage_options', | |
| 24 | + 'capability' => 'ablocks_manage_settings', | |
| 24 | 25 | 'fields' => array( |
| 25 | 26 | 'block_name' => 'string', |
| 26 | 27 | 'status' => 'boolean', |
| 27 | 28 | ) |
| @@ -27,9 +28,9 @@ | ||
| 27 | 28 | ) |
| 28 | 29 | ), |
| 29 | 30 | 'save_bulk_block_visibility' => array( |
| 30 | 31 | 'callback' => array( $this, 'save_bulk_block_visibility' ), |
| 31 | - 'capability' => 'manage_options', | |
| 32 | + 'capability' => 'ablocks_manage_settings', | |
| 32 | 33 | 'fields' => array( |
| 33 | 34 | 'blocks' => 'json', |
| 34 | 35 | ) |
| 35 | 36 | ), |
| @@ -34,13 +35,13 @@ | ||
| 34 | 35 | ) |
| 35 | 36 | ), |
| 36 | 37 | 'get_settings' => array( |
| 37 | 38 | 'callback' => array( $this, 'get_settings' ), |
| 38 | - 'capability' => 'manage_options', | |
| 39 | + 'capability' => 'ablocks_access', | |
| 39 | 40 | ), |
| 40 | 41 | 'save_settings' => array( |
| 41 | 42 | 'callback' => array( $this, 'save_settings' ), |
| 42 | - 'capability' => 'manage_options', | |
| 43 | + 'capability' => 'ablocks_save_settings', | |
| 43 | 44 | 'fields' => array( |
| 44 | 45 | 'default_container_width' => 'integer', |
| 45 | 46 | 'container_padding' => 'integer', |
| 46 | 47 | 'container_element_gap' => 'integer', |
| @@ -45,10 +46,14 @@ | ||
| 45 | 46 | 'container_padding' => 'integer', |
| 46 | 47 | 'container_element_gap' => 'integer', |
| 47 | 48 | 'enabled_assets_file_generation' => 'boolean', |
| 48 | 49 | 'enabled_block_copy_paste_style' => 'boolean', |
| 50 | + 'lock_global_typography' => 'boolean', | |
| 51 | + 'lock_global_typography_strict' => 'boolean', | |
| 52 | + 'lock_global_colors' => 'boolean', | |
| 49 | 53 | 'enabled_load_google_font_locally' => 'boolean', |
| 50 | 54 | 'enabled_only_selected_fonts' => 'boolean', |
| 55 | + 'font_metric_fallback' => 'boolean', | |
| 51 | 56 | 'enabled_coming_soon_page' => 'boolean', |
| 52 | 57 | 'coming_soon_page' => 'integer', |
| 53 | 58 | 'enabled_maintenance_page' => 'boolean', |
| 54 | 59 | 'maintenance_page' => 'integer', |
| @@ -63,9 +68,16 @@ | ||
| 63 | 68 | 'mailerlite_api_key' => 'string', |
| 64 | 69 | // Performance Suite |
| 65 | 70 | 'perf_lazy_images' => 'boolean', |
| 66 | 71 | 'perf_lcp_eager_count' => 'integer', |
| 72 | + 'perf_image_dimensions' => 'boolean', | |
| 73 | + 'perf_responsive_images' => 'boolean', | |
| 74 | + 'perf_preload_lcp' => 'boolean', | |
| 75 | + 'perf_touch_targets' => 'boolean', | |
| 67 | 76 | 'perf_inline_css' => 'boolean', |
| 77 | + 'perf_async_css' => 'boolean', | |
| 78 | + 'perf_critical_css' => 'boolean', | |
| 79 | + 'perf_defer_js' => 'boolean', | |
| 68 | 80 | 'perf_delay_js' => 'boolean', |
| 69 | 81 | 'perf_delay_js_timeout' => 'integer', |
| 70 | 82 | 'perf_disable_emojis' => 'boolean', |
| 71 | 83 | 'perf_disable_embeds' => 'boolean', |
| @@ -72,8 +84,42 @@ | ||
| 72 | 84 | 'perf_disable_dashicons' => 'boolean', |
| 73 | 85 | 'perf_disable_jquery_migrate' => 'boolean', |
| 74 | 86 | 'perf_control_heartbeat' => 'boolean', |
| 75 | 87 | 'perf_heartbeat_frequency' => 'integer', |
| 88 | + // Editor paste | |
| 89 | + 'paste_google_docs' => 'boolean', | |
| 90 | + 'paste_convert_webp' => 'boolean', | |
| 91 | + 'paste_webp_quality' => 'integer', | |
| 92 | + // Performance Suite — full-page cache. | |
| 93 | + 'perf_page_cache' => 'boolean', | |
| 94 | + 'perf_page_cache_scope' => 'string', | |
| 95 | + 'perf_page_cache_ttl' => 'integer', | |
| 96 | + 'perf_page_cache_gzip' => 'boolean', | |
| 97 | + 'perf_page_cache_prewarm' => 'boolean', | |
| 98 | + 'perf_page_cache_mobile_variant' => 'boolean', | |
| 99 | + 'perf_page_cache_crawler' => 'boolean', | |
| 100 | + 'perf_page_cache_crawl_batch' => 'integer', | |
| 101 | + 'perf_consolidate_css' => 'boolean', | |
| 102 | + 'perf_consolidate_css_min' => 'integer', | |
| 103 | + 'perf_fragment_cache' => 'boolean', | |
| 104 | + 'perf_fragment_cache_ttl' => 'integer', | |
| 105 | + 'perf_template_cache' => 'boolean', | |
| 106 | + 'perf_template_cache_ttl' => 'integer', | |
| 107 | + 'perf_image_optimize_on_upload' => 'boolean', | |
| 108 | + 'perf_image_level' => 'string', | |
| 109 | + 'perf_image_webp' => 'boolean', | |
| 110 | + 'perf_image_quarantine_autodelete' => 'boolean', | |
| 111 | + 'perf_image_quarantine_days' => 'integer', | |
| 112 | + 'perf_image_require_filename' => 'boolean', | |
| 113 | + 'perf_image_require_alt' => 'boolean', | |
| 114 | + // Marketing — query param passthrough | |
| 115 | + 'param_passthrough_enabled' => 'boolean', | |
| 116 | + 'param_passthrough_keys' => 'string', | |
| 117 | + 'param_passthrough_match' => 'string', | |
| 118 | + 'param_passthrough_class' => 'string', | |
| 119 | + 'param_passthrough_keyword' => 'string', | |
| 120 | + 'param_passthrough_persist' => 'boolean', | |
| 121 | + 'param_passthrough_cookie_days' => 'integer', | |
| 76 | 122 | // global color & typography |
| 77 | 123 | 'global_color' => 'json', |
| 78 | 124 | 'global_typography' => 'json', |
| 79 | 125 | 'global_font_family_fallback' => 'string', |
| @@ -99,9 +145,9 @@ | ||
| 99 | 145 | ) |
| 100 | 146 | ), |
| 101 | 147 | 'fetch_posts' => array( |
| 102 | 148 | 'callback' => array( $this, 'fetch_posts' ), |
| 103 | - 'capability' => 'manage_options', | |
| 149 | + 'capability' => 'ablocks_access', | |
| 104 | 150 | 'fields' => array( |
| 105 | 151 | 'postId' => 'integer', |
| 106 | 152 | 'postType' => 'string', |
| 107 | 153 | 'keyword' => 'string', |
| @@ -108,13 +154,13 @@ | ||
| 108 | 154 | ) |
| 109 | 155 | ), |
| 110 | 156 | 'get_fronted_dashboard_pages' => array( |
| 111 | 157 | 'callback' => array( $this, 'get_fronted_dashboard_pages' ), |
| 112 | - 'capability' => 'manage_options', | |
| 158 | + 'capability' => 'ablocks_manage_settings', | |
| 113 | 159 | ), |
| 114 | 160 | 'create_fronted_dashboard_page' => array( |
| 115 | 161 | 'callback' => array( $this, 'create_fronted_dashboard_page' ), |
| 116 | - 'capability' => 'manage_options', | |
| 162 | + 'capability' => 'ablocks_manage_settings', | |
| 117 | 163 | 'fields' => [ |
| 118 | 164 | 'label' => 'string', |
| 119 | 165 | 'slug' => 'string', |
| 120 | 166 | 'icon' => 'string', |
| @@ -124,9 +170,9 @@ | ||
| 124 | 170 | ] |
| 125 | 171 | ), |
| 126 | 172 | 'create_fronted_dashboard_link' => array( |
| 127 | 173 | 'callback' => array( $this, 'create_fronted_dashboard_link' ), |
| 128 | - 'capability' => 'manage_options', | |
| 174 | + 'capability' => 'ablocks_manage_settings', | |
| 129 | 175 | 'fields' => [ |
| 130 | 176 | 'label' => 'string', |
| 131 | 177 | 'link' => 'string', |
| 132 | 178 | 'icon' => 'string', |
| @@ -136,9 +182,9 @@ | ||
| 136 | 182 | ] |
| 137 | 183 | ), |
| 138 | 184 | 'edit_fronted_dashboard_link' => array( |
| 139 | 185 | 'callback' => array( $this, 'edit_fronted_dashboard_link' ), |
| 140 | - 'capability' => 'manage_options', | |
| 186 | + 'capability' => 'ablocks_manage_settings', | |
| 141 | 187 | 'fields' => [ |
| 142 | 188 | 'label' => 'string', |
| 143 | 189 | 'link' => 'string', |
| 144 | 190 | 'icon' => 'string', |
| @@ -148,9 +194,9 @@ | ||
| 148 | 194 | ] |
| 149 | 195 | ), |
| 150 | 196 | 'delete_fronted_dashboard_link' => array( |
| 151 | 197 | 'callback' => array( $this, 'delete_fronted_dashboard_link' ), |
| 152 | - 'capability' => 'manage_options', | |
| 198 | + 'capability' => 'ablocks_manage_settings', | |
| 153 | 199 | 'fields' => array( |
| 154 | 200 | 'page_id' => 'string', |
| 155 | 201 | ) |
| 156 | 202 | ), |
| @@ -155,9 +201,9 @@ | ||
| 155 | 201 | ) |
| 156 | 202 | ), |
| 157 | 203 | 'edit_fronted_dashboard_page' => array( |
| 158 | 204 | 'callback' => array( $this, 'edit_fronted_dashboard_page' ), |
| 159 | - 'capability' => 'manage_options', | |
| 205 | + 'capability' => 'ablocks_manage_settings', | |
| 160 | 206 | 'fields' => [ |
| 161 | 207 | 'label' => 'string', |
| 162 | 208 | 'slug' => 'string', |
| 163 | 209 | 'icon' => 'string', |
| @@ -168,9 +214,9 @@ | ||
| 168 | 214 | ] |
| 169 | 215 | ), |
| 170 | 216 | 'move_fronted_dashboard_page' => array( |
| 171 | 217 | 'callback' => array( $this, 'move_fronted_dashboard_page' ), |
| 172 | - 'capability' => 'manage_options', | |
| 218 | + 'capability' => 'ablocks_manage_settings', | |
| 173 | 219 | 'fields' => [ |
| 174 | 220 | 'reordered_items' => 'string', |
| 175 | 221 | ] |
| 176 | 222 | ), |
| @@ -175,9 +221,9 @@ | ||
| 175 | 221 | ] |
| 176 | 222 | ), |
| 177 | 223 | 'delete_fronted_dashboard_page' => array( |
| 178 | 224 | 'callback' => array( $this, 'delete_fronted_dashboard_page' ), |
| 179 | - 'capability' => 'manage_options', | |
| 225 | + 'capability' => 'ablocks_manage_settings', | |
| 180 | 226 | 'fields' => array( |
| 181 | 227 | 'slug' => 'string', |
| 182 | 228 | 'page_id' => 'integer', |
| 183 | 229 | ) |
| @@ -239,12 +285,20 @@ | ||
| 239 | 285 | wp_send_json_success( $settings ); |
| 240 | 286 | } |
| 241 | 287 | |
| 242 | 288 | public function save_settings( $payload ) { |
| 289 | + // The design system, the performance suite and site configuration are | |
| 290 | + // three separate permissions but one endpoint. Keys this user may not | |
| 291 | + // change are rewritten back to what is already saved, so the save | |
| 292 | + // succeeds and simply leaves them alone. | |
| 293 | + $payload = SettingsGuard::filter_payload( $payload ); | |
| 294 | + | |
| 243 | 295 | // phpcs:ignore WordPress.Security.NonceVerification.Missing |
| 244 | 296 | do_action( 'ablocks/before_save_settings', $payload, 'base' ); |
| 245 | 297 | $json_payload = Sanitizer::sanitize_payload([ |
| 246 | 298 | 'selected_fonts' => 'json', |
| 299 | + 'perf_page_cache_query_args' => 'json', | |
| 300 | + 'perf_page_cache_exclusions' => 'json', | |
| 247 | 301 | 'global_color' => 'json', |
| 248 | 302 | 'global_typography' => 'json', |
| 249 | 303 | 'global_body_typography' => 'json', |
| 250 | 304 | 'global_body_paragraph_space' => 'json', |
| @@ -257,8 +311,13 @@ | ||
| 257 | 311 | 'global_h5_typography' => 'json', |
| 258 | 312 | 'global_h6_typography' => 'json', |
| 259 | 313 | ], $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.Missing |
| 260 | 314 | |
| 315 | + // The JSON fields are read straight from $_POST rather than the sanitized | |
| 316 | + // payload, so they need the same guard — the global colour and typography | |
| 317 | + // presets live in here, and they are the design system. | |
| 318 | + $json_payload = SettingsGuard::filter_payload( $json_payload ); | |
| 319 | + | |
| 261 | 320 | $default = BaseSettings::get_default_data(); |
| 262 | 321 | $is_update = BaseSettings::save_settings( [ |
| 263 | 322 | 'default_container_width' => $payload['default_container_width'] ?? $default['default_container_width'], |
| 264 | 323 | 'container_padding' => $payload['container_padding'] ?? $default['container_padding'], |
| @@ -264,11 +323,15 @@ | ||
| 264 | 323 | 'container_padding' => $payload['container_padding'] ?? $default['container_padding'], |
| 265 | 324 | 'container_element_gap' => $payload['container_element_gap'] ?? $default['container_element_gap'], |
| 266 | 325 | 'enabled_assets_file_generation' => $payload['enabled_assets_file_generation'] ?? $default['enabled_assets_file_generation'], |
| 267 | 326 | 'enabled_block_copy_paste_style' => $payload['enabled_block_copy_paste_style'] ?? $default['enabled_block_copy_paste_style'], |
| 327 | + 'lock_global_typography' => $payload['lock_global_typography'] ?? $default['lock_global_typography'], | |
| 328 | + 'lock_global_typography_strict' => $payload['lock_global_typography_strict'] ?? $default['lock_global_typography_strict'], | |
| 329 | + 'lock_global_colors' => $payload['lock_global_colors'] ?? $default['lock_global_colors'], | |
| 268 | 330 | 'enabled_load_google_font_locally' => $payload['enabled_load_google_font_locally'] ?? $default['enabled_load_google_font_locally'], |
| 269 | 331 | 'enabled_only_selected_fonts' => $payload['enabled_only_selected_fonts'] ?? $default['enabled_only_selected_fonts'], |
| 270 | 332 | 'selected_fonts' => $json_payload['selected_fonts'] ?? $default['selected_fonts'], |
| 333 | + 'font_metric_fallback' => $payload['font_metric_fallback'] ?? $default['font_metric_fallback'], | |
| 271 | 334 | // Performance Suite — platform optimizations. |
| 272 | 335 | 'perf_disable_emojis' => $payload['perf_disable_emojis'] ?? $default['perf_disable_emojis'], |
| 273 | 336 | 'perf_disable_embeds' => $payload['perf_disable_embeds'] ?? $default['perf_disable_embeds'], |
| 274 | 337 | 'perf_disable_dashicons' => $payload['perf_disable_dashicons'] ?? $default['perf_disable_dashicons'], |
| @@ -278,9 +341,52 @@ | ||
| 278 | 341 | 'perf_delay_js' => $payload['perf_delay_js'] ?? $default['perf_delay_js'], |
| 279 | 342 | 'perf_delay_js_timeout' => $payload['perf_delay_js_timeout'] ?? $default['perf_delay_js_timeout'], |
| 280 | 343 | 'perf_lazy_images' => $payload['perf_lazy_images'] ?? $default['perf_lazy_images'], |
| 281 | 344 | 'perf_lcp_eager_count' => $payload['perf_lcp_eager_count'] ?? $default['perf_lcp_eager_count'], |
| 345 | + 'perf_image_dimensions' => $payload['perf_image_dimensions'] ?? $default['perf_image_dimensions'], | |
| 346 | + 'perf_responsive_images' => $payload['perf_responsive_images'] ?? $default['perf_responsive_images'], | |
| 347 | + 'perf_preload_lcp' => $payload['perf_preload_lcp'] ?? $default['perf_preload_lcp'], | |
| 348 | + 'perf_touch_targets' => $payload['perf_touch_targets'] ?? $default['perf_touch_targets'], | |
| 282 | 349 | 'perf_inline_css' => $payload['perf_inline_css'] ?? $default['perf_inline_css'], |
| 350 | + 'perf_async_css' => $payload['perf_async_css'] ?? $default['perf_async_css'], | |
| 351 | + 'perf_critical_css' => $payload['perf_critical_css'] ?? $default['perf_critical_css'], | |
| 352 | + 'perf_defer_js' => $payload['perf_defer_js'] ?? $default['perf_defer_js'], | |
| 353 | + // Editor paste. | |
| 354 | + 'paste_google_docs' => $payload['paste_google_docs'] ?? $default['paste_google_docs'], | |
| 355 | + 'paste_convert_webp' => $payload['paste_convert_webp'] ?? $default['paste_convert_webp'], | |
| 356 | + 'paste_webp_quality' => $payload['paste_webp_quality'] ?? $default['paste_webp_quality'], | |
| 357 | + // Performance Suite — full-page cache. | |
| 358 | + 'perf_page_cache' => $payload['perf_page_cache'] ?? $default['perf_page_cache'], | |
| 359 | + 'perf_page_cache_scope' => $payload['perf_page_cache_scope'] ?? $default['perf_page_cache_scope'], | |
| 360 | + 'perf_page_cache_ttl' => $payload['perf_page_cache_ttl'] ?? $default['perf_page_cache_ttl'], | |
| 361 | + 'perf_page_cache_gzip' => $payload['perf_page_cache_gzip'] ?? $default['perf_page_cache_gzip'], | |
| 362 | + 'perf_page_cache_prewarm' => $payload['perf_page_cache_prewarm'] ?? $default['perf_page_cache_prewarm'], | |
| 363 | + 'perf_page_cache_mobile_variant' => $payload['perf_page_cache_mobile_variant'] ?? $default['perf_page_cache_mobile_variant'], | |
| 364 | + 'perf_page_cache_crawler' => $payload['perf_page_cache_crawler'] ?? $default['perf_page_cache_crawler'], | |
| 365 | + 'perf_page_cache_crawl_batch' => $payload['perf_page_cache_crawl_batch'] ?? $default['perf_page_cache_crawl_batch'], | |
| 366 | + 'perf_page_cache_query_args' => $json_payload['perf_page_cache_query_args'] ?? $default['perf_page_cache_query_args'], | |
| 367 | + 'perf_page_cache_exclusions' => $json_payload['perf_page_cache_exclusions'] ?? $default['perf_page_cache_exclusions'], | |
| 368 | + 'perf_consolidate_css' => $payload['perf_consolidate_css'] ?? $default['perf_consolidate_css'], | |
| 369 | + 'perf_consolidate_css_min' => $payload['perf_consolidate_css_min'] ?? $default['perf_consolidate_css_min'], | |
| 370 | + 'perf_fragment_cache' => $payload['perf_fragment_cache'] ?? $default['perf_fragment_cache'], | |
| 371 | + 'perf_fragment_cache_ttl' => $payload['perf_fragment_cache_ttl'] ?? $default['perf_fragment_cache_ttl'], | |
| 372 | + 'perf_template_cache' => $payload['perf_template_cache'] ?? $default['perf_template_cache'], | |
| 373 | + 'perf_template_cache_ttl' => $payload['perf_template_cache_ttl'] ?? $default['perf_template_cache_ttl'], | |
| 374 | + 'perf_image_optimize_on_upload' => $payload['perf_image_optimize_on_upload'] ?? $default['perf_image_optimize_on_upload'], | |
| 375 | + 'perf_image_level' => $payload['perf_image_level'] ?? $default['perf_image_level'], | |
| 376 | + 'perf_image_webp' => $payload['perf_image_webp'] ?? $default['perf_image_webp'], | |
| 377 | + 'perf_image_quarantine_autodelete' => $payload['perf_image_quarantine_autodelete'] ?? $default['perf_image_quarantine_autodelete'], | |
| 378 | + 'perf_image_quarantine_days' => $payload['perf_image_quarantine_days'] ?? $default['perf_image_quarantine_days'], | |
| 379 | + 'perf_image_require_filename' => $payload['perf_image_require_filename'] ?? $default['perf_image_require_filename'], | |
| 380 | + 'perf_image_require_alt' => $payload['perf_image_require_alt'] ?? $default['perf_image_require_alt'], | |
| 381 | + // Marketing — query param passthrough | |
| 382 | + 'param_passthrough_enabled' => $payload['param_passthrough_enabled'] ?? $default['param_passthrough_enabled'], | |
| 383 | + 'param_passthrough_keys' => $payload['param_passthrough_keys'] ?? $default['param_passthrough_keys'], | |
| 384 | + 'param_passthrough_match' => $payload['param_passthrough_match'] ?? $default['param_passthrough_match'], | |
| 385 | + 'param_passthrough_class' => $payload['param_passthrough_class'] ?? $default['param_passthrough_class'], | |
| 386 | + 'param_passthrough_keyword' => $payload['param_passthrough_keyword'] ?? $default['param_passthrough_keyword'], | |
| 387 | + 'param_passthrough_persist' => $payload['param_passthrough_persist'] ?? $default['param_passthrough_persist'], | |
| 388 | + 'param_passthrough_cookie_days' => $payload['param_passthrough_cookie_days'] ?? $default['param_passthrough_cookie_days'], | |
| 283 | 389 | 'enabled_coming_soon_page' => $payload['enabled_coming_soon_page'] ?? $default['enabled_coming_soon_page'], |
| 284 | 390 | 'coming_soon_page' => $payload['coming_soon_page'] ?? $default['coming_soon_page'], |
| 285 | 391 | 'enabled_maintenance_page' => $payload['enabled_maintenance_page'] ?? $default['enabled_maintenance_page'], |
| 286 | 392 | 'maintenance_page' => $payload['maintenance_page'] ?? $default['maintenance_page'], |
| @@ -340,9 +446,10 @@ | ||
| 340 | 446 | ); |
| 341 | 447 | if ( ! empty( $keyword ) ) { |
| 342 | 448 | $args['s'] = $keyword; |
| 343 | 449 | } |
| 344 | - if ( ! current_user_can( 'manage_options' ) ) { | |
| 450 | + // Anyone who cannot edit other people's posts only picks from their own. | |
| 451 | + if ( ! current_user_can( 'edit_others_posts' ) ) { | |
| 345 | 452 | $args['author'] = get_current_user_id(); |
| 346 | 453 | } |
| 347 | 454 | } |
| 348 | 455 | $results = array(); |
