← All changes | includes/API/Route/Routes.php +74 -111 1.4 → 3.3.1 View file →

		@@ -1,177 +1,140 @@
1	1	<?php
2	2
3	3	namespace BitCode\BitForm\API\Route;
4	4
	5	+use BitCode\BitForm\API\Controller\EntryController;
	6	+use BitCode\BitForm\API\Controller\FileController;
	7	+use BitCode\BitForm\Core\Database\FormEntryModel;
5	8	use WP_REST_Controller;
	9	+use WP_REST_Request;
6	10	use WP_REST_Server;
7		-use BitCode\BitForm\API\Controller\EntryController;
8		-use BitCode\BitForm\API\Controller\NoteController;
9	11
10		-
11	12	class Routes extends WP_REST_Controller
12	13	{
13		- function __construct()
	14	+ private $entryController;
	15	+
	16	+ protected $namespace;
	17	+
	18	+ protected $rest_base;
	19	+
	20	+ protected $fileController;
	21	+
	22	+ public function __construct()
14	23	{
15	24	$this->namespace = 'bitform';
16	25	$this->rest_base = 'v1';
17	26	$this->entryController = new EntryController();
18		- $this->noteController = new NoteController();
	27	+ $this->fileController = new FileController();
19	28	}
20	29
21	30	public function register_routes()
22	31	{
23		- /* form routes */
	32	+ // OAuth callback endpoints. Must be publicly accessible: third-party OAuth providers
	33	+ // redirect to these URLs after authorization. Authorization is enforced inside
	34	+ // authRedirect() via wp_safe_redirect() and same-domain validation of the state parameter.
24	35	register_rest_route(
25	36	$this->namespace,
26		- $this->rest_base . '/forms/',
	37	+ $this->rest_base . '/oauth-redirect/',
27	38	[
28	39	[
29	40	'methods' => WP_REST_Server::READABLE,
30		- 'callback' => [$this->entryController, 'get_forms'],
31		- 'permission_callback' => array($this, 'get_items_permissions_check'),
32		- ],
33		- 'schema' => [$this, 'get_item_schema']
34		- ]
35		- );
36		- register_rest_route(
37		- $this->namespace,
38		- $this->rest_base . '/fields/(?P<form_id>[\d]+)',
39		- [
40		- [
41		- 'methods' => WP_REST_Server::READABLE,
42		- 'callback' => [$this->entryController, 'get_fields'],
43		- 'permission_callback' => [$this, 'get_items_permissions_check']
	41	+ 'callback' => [$this->entryController, 'authRedirect'],
	42	+ 'permission_callback' => '__return_true'
44	43	]
45	44	]
46	45	);
47		- /* form routes*/
48	46
49		- /* entry routes*/
50	47	register_rest_route(
51	48	$this->namespace,
52		- $this->rest_base . '/entry/(?P<form_id>[\d]+)',
	49	+ $this->rest_base . '/google/',
53	50	[
54	51	[
55		- 'methods' => WP_REST_Server::CREATABLE,
56		- 'callback' => [$this->entryController, 'entry_store'],
57		- 'permission_callback' => [$this, 'get_items_permissions_check']
58		- ]
59		- ]
60		- );
61		- register_rest_route(
62		- $this->namespace,
63		- $this->rest_base . '/form/response/(?P<id>[\d]+)',
64		- [
65		- [
66	52	'methods' => WP_REST_Server::READABLE,
67		- 'callback' => [$this->entryController, 'getEntryResponse'],
68		- 'permission_callback' => [$this, 'get_items_permissions_check']
	53	+ 'callback' => [$this->entryController, 'authRedirect'],
	54	+ 'permission_callback' => '__return_true'
69	55	]
	56	+
70	57	]
71	58	);
72	59	register_rest_route(
73	60	$this->namespace,
74		- $this->rest_base . '/entry/(?P<entry_id>[\d]+)',
	61	+ $this->rest_base . '/oneDrive/',
75	62	[
76	63	[
77	64	'methods' => WP_REST_Server::READABLE,
78		- 'callback' => [$this->entryController, 'entry_view'],
79		- 'permission_callback' => [$this, 'get_items_permissions_check']
80		-
81		- ],
82		- [
83		- 'methods' => WP_REST_Server::DELETABLE,
84		- 'callback' => [$this->entryController, 'entry_delete'],
85		- 'permission_callback' => [$this, 'get_items_permissions_check']
	65	+ 'callback' => [$this->entryController, 'authRedirect'],
	66	+ 'permission_callback' => '__return_true'
86	67	]
87		- ]
88		- );
89	68
90		- register_rest_route(
91		- $this->namespace,
92		- $this->rest_base . '/entry_update/(?P<entry_id>[\d]+)/',
93		- [
94		- [
95		- 'methods' => WP_REST_Server::EDITABLE,
96		- 'callback' => [$this->entryController, 'entry_update'],
97		- 'permission_callback' => [$this, 'get_items_permissions_check']
98		- ]
99	69	]
100	70	);
101		- /* entry routes*/
102	71
103		- /* note routes*/
104	72	register_rest_route(
105	73	$this->namespace,
106		- $this->rest_base . '/notes/',
	74	+ $this->rest_base . '/zoho/',
107	75	[
108	76	[
109	77	'methods' => WP_REST_Server::READABLE,
110		- 'callback' => [$this->noteController, 'get_notes'],
111		- 'permission_callback' => [$this, 'get_items_permissions_check']
	78	+ 'callback' => [$this->entryController, 'authRedirect'],
	79	+ 'permission_callback' => '__return_true'
112	80	]
	81	+
113	82	]
114	83	);
	84	+
115	85	register_rest_route(
116	86	$this->namespace,
117		- $this->rest_base . '/create-note/',
	87	+ $this->rest_base . '/bitform-file-download/',
118	88	[
119	89	[
120		- 'methods' => WP_REST_Server::CREATABLE,
121		- 'callback' => [$this->noteController, 'create_note'],
122		- 'permission_callback' => [$this, 'get_items_permissions_check']
123		- ]
124		- ]
125		- );
126		- register_rest_route(
127		- $this->namespace,
128		- $this->rest_base . '/note/(?P<id>[\d]+)',
129		- [
130		- [
131	90	'methods' => WP_REST_Server::READABLE,
132		- 'callback' => [$this->noteController, 'note_edit'],
133		- 'permission_callback' => [$this, 'get_items_permissions_check'],
134		- 'args' => $this->get_endpoint_args_for_item_schema(WP_REST_Server::EDITABLE),
135		- ],
136		- [
137		- 'methods' => WP_REST_Server::EDITABLE,
138		- 'callback' => [$this->noteController, 'note_update'],
139		- 'permission_callback' => [$this, 'get_items_permissions_check']
140		- ],
141		- [
142		- 'methods' => WP_REST_Server::DELETABLE,
143		- 'callback' => [$this->noteController, 'note_delete'],
144		- 'permission_callback' => [$this, 'get_items_permissions_check']
	91	+ 'callback' => [$this->fileController, 'handleFileDownload'],
	92	+ 'permission_callback' => [$this, 'file_download_permissions_check']
145	93	]
146	94	]
147	95	);
148		- /* note routes*/
	96	+ }
149	97
150		- /* google sheet route */
151		- register_rest_route(
152		- $this->namespace,
153		- $this->rest_base . '/google/',
154		- [
155		- [
156		- 'methods' => WP_REST_Server::READABLE,
157		- 'callback' => [$this->entryController, 'googleAuth'],
158		- 'permission_callback' => '__return_true'
159		- ]
	98	+ public function file_download_permissions_check(WP_REST_Request $request)
	99	+ {
	100	+ if (!is_user_logged_in()) {
	101	+ return new \WP_Error(
	102	+ 'rest_forbidden',
	103	+ __('You do not have permission to access this file.', 'bit-form'),
	104	+ ['status' => 401]
	105	+ );
	106	+ }
160	107
161		- ]
162		- );
163		- }
164		- public function get_items_permissions_check($request)
165		- {
166		- $api_key = get_option('bitform_secret_api_key');
167		- $header = $request->get_header('Bitform-Api-Key');
168		- if (empty($header)) {
169		- $error = ['message' => 'Api Key is required to access this resource'];
170		- return wp_send_json_error($error, 401);
171		- } else if ($request->get_header('Bitform-Api-Key') != $api_key || $api_key == null) {
172		- $error = ['message' => 'Invalid API key'];
173		- return wp_send_json_error($error, 401);
	108	+ if (current_user_can('manage_options')) {
	109	+ return true;
174	110	}
	111	+
	112	+ $formID = absint($request->get_param('formID'));
	113	+ $entryID = absint($request->get_param('entryID'));
	114	+
	115	+ if (empty($formID) || empty($entryID)) {
	116	+ return new \WP_Error(
	117	+ 'rest_forbidden',
	118	+ __('You do not have permission to access this file.', 'bit-form'),
	119	+ ['status' => 403]
	120	+ );
	121	+ }
	122	+
	123	+ $entryModel = new FormEntryModel();
	124	+ $entry = $entryModel->get('id', [
	125	+ 'id' => $entryID,
	126	+ 'form_id' => $formID,
	127	+ 'user_id' => get_current_user_id(),
	128	+ ]);
	129	+
	130	+ if (is_wp_error($entry) || empty($entry)) {
	131	+ return new \WP_Error(
	132	+ 'rest_forbidden',
	133	+ __('You do not have permission to access this file.', 'bit-form'),
	134	+ ['status' => 403]
	135	+ );
	136	+ }
	137	+
175	138	return true;
176	139	}
177	140	}