← All changes | includes/REST/Settings.php +33 -3 4.5.5 → 4.9.2 View file →

		@@ -12,8 +12,10 @@
12	12	use WPDeveloper\BetterDocs\Core\BaseAPI;
13	13	use WPDeveloper\BetterDocs\Dependencies\DI\DependencyException;
14	14	use WPDeveloper\BetterDocs\Dependencies\DI\NotFoundException;
15	15	use WPDeveloper\BetterDocsChatbot\Core\AIChatbot;
	16	+use WPDeveloper\BetterDocs\Core\Settings as CoreSettings;
	17	+use WPDeveloper\BetterDocs\Utils\Helper;
16	18
17	19	class Settings extends BaseAPI {
18	20
19	21	public function permission_check(): bool {
		@@ -56,9 +58,9 @@
56	58	public function sample_docs( WP_REST_Request $request ) {
57	59	$action = $request->get_param( 'action' );
58	60
59	61	if ( $action == 'create-dummy-data' ) {
60		- $file = BETTERDOCS_ABSPATH . 'assets/admin/images/BetterDocs-sample-data.csv';
	62	+ $file = BETTERDOCS_ABSPATH . 'assets/static/admin/images/BetterDocs-sample-data.csv';
61	63	$args = [
62	64	'fetch_attachments' => true,
63	65	'action' => '',
64	66	'existing_slug' => '',
		@@ -154,9 +156,13 @@
154	156	$args = [
155	157	'fetch_attachments' => true,
156	158	'existing_slug' => $existing_slug,
157	159	'action' => $action,
158		- 'file_type' => $files['file']['type']
	160	+ 'file_type' => $files['file']['type'],
	161	+ // The original upload name (with its extension) is the reliable
	162	+ // signal for choosing the parser; the browser-reported MIME on
	163	+ // $files['file']['type'] is not.
	164	+ 'file_name' => isset( $files['file']['name'] ) ? $files['file']['name'] : ''
159	165	];
160	166
161	167	$wp_importer = new WPImport( $file, $args );
162	168
		@@ -289,9 +295,33 @@
289	295	return true;
290	296	}
291	297
292	298	public function get_settings(): array {
293		- return betterdocs()->settings->get_all( true );
	299	+ $settings = betterdocs()->settings->get_all( true );
	300	+
	301	+ // Never hand raw API keys back over REST. The route is already gated to
	302	+ // `edit_docs_settings` (see permission_check() above), but get_all( true ) returned
	303	+ // UNMASKED values, so an authorized admin still received every key in full — the admin
	304	+ // UI only ever needs the masked form. Mask for managers, and strip entirely for anyone
	305	+ // else as defense-in-depth should that capability gate ever loosen. Mirrors the
	306	+ // admin-page localizer (Core\Settings::enqueue()) so the masked-key save round-trip
	307	+ // stays consistent.
	308	+ $sensitive_api_keys = CoreSettings::sensitive_api_key_fields();
	309	+ $can_manage = current_user_can( 'edit_docs_settings' );
	310	+ foreach ( $sensitive_api_keys as $api_key_field ) {
	311	+ if ( ! isset( $settings[ $api_key_field ] ) ) {
	312	+ continue;
	313	+ }
	314	+ if ( ! $can_manage ) {
	315	+ unset( $settings[ $api_key_field ] );
	316	+ continue;
	317	+ }
	318	+ if ( ! empty( $settings[ $api_key_field ] ) ) {
	319	+ $settings[ $api_key_field ] = Helper::mask_api_key( $settings[ $api_key_field ] );
	320	+ }
	321	+ }
	322	+
	323	+ return $settings;
294	324	}
295	325
296	326	public function save_settings( WP_REST_Request $request ) {
297	327	$result = betterdocs()->settings->save_settings( $request->get_params() );