← All changes | includes/API/Route/Routes.php +89 -9 2.0 → 3.3.1 View file →

		@@ -2,35 +2,61 @@
2	2
3	3	namespace BitCode\BitForm\API\Route;
4	4
5	5	use BitCode\BitForm\API\Controller\EntryController;
	6	+use BitCode\BitForm\API\Controller\FileController;
	7	+use BitCode\BitForm\Core\Database\FormEntryModel;
6	8	use WP_REST_Controller;
	9	+use WP_REST_Request;
7	10	use WP_REST_Server;
8	11
9		-class Routes extends WP_REST_Controller {
10		-// public $entryController;
	12	+class Routes extends WP_REST_Controller
	13	+{
	14	+ private $entryController;
11	15
12		- public function __construct() {
	16	+ protected $namespace;
	17	+
	18	+ protected $rest_base;
	19	+
	20	+ protected $fileController;
	21	+
	22	+ public function __construct()
	23	+ {
13	24	$this->namespace = 'bitform';
14	25	$this->rest_base = 'v1';
15	26	$this->entryController = new EntryController();
	27	+ $this->fileController = new FileController();
16	28	}
17	29
18		- public function register_routes() {
19		- /* google sheet route */
	30	+ public function register_routes()
	31	+ {
	32	+ // OAuth callback endpoints. Must be publicly accessible: third-party OAuth providers
	33	+ // redirect to these URLs after authorization. Authorization is enforced inside
	34	+ // authRedirect() via wp_safe_redirect() and same-domain validation of the state parameter.
20	35	register_rest_route(
21	36	$this->namespace,
	37	+ $this->rest_base . '/oauth-redirect/',
	38	+ [
	39	+ [
	40	+ 'methods' => WP_REST_Server::READABLE,
	41	+ 'callback' => [$this->entryController, 'authRedirect'],
	42	+ 'permission_callback' => '__return_true'
	43	+ ]
	44	+ ]
	45	+ );
	46	+
	47	+ register_rest_route(
	48	+ $this->namespace,
22	49	$this->rest_base . '/google/',
23	50	[
24	51	[
25	52	'methods' => WP_REST_Server::READABLE,
26		- 'callback' => [$this->entryController, 'googleAuth'],
	53	+ 'callback' => [$this->entryController, 'authRedirect'],
27	54	'permission_callback' => '__return_true'
28	55	]
29	56
30	57	]
31	58	);
32		- // oneDrive rest route
33	59	register_rest_route(
34	60	$this->namespace,
35	61	$this->rest_base . '/oneDrive/',
36	62	[
		@@ -35,9 +61,9 @@
35	61	$this->rest_base . '/oneDrive/',
36	62	[
37	63	[
38	64	'methods' => WP_REST_Server::READABLE,
39		- 'callback' => [$this->entryController, 'oneDriveAuth'],
	65	+ 'callback' => [$this->entryController, 'authRedirect'],
40	66	'permission_callback' => '__return_true'
41	67	]
42	68
43	69	]
		@@ -42,9 +68,8 @@
42	68
43	69	]
44	70	);
45	71
46		- // zoho
47	72	register_rest_route(
48	73	$this->namespace,
49	74	$this->rest_base . '/zoho/',
50	75	[
		@@ -55,6 +80,61 @@
55	80	]
56	81
57	82	]
58	83	);
	84	+
	85	+ register_rest_route(
	86	+ $this->namespace,
	87	+ $this->rest_base . '/bitform-file-download/',
	88	+ [
	89	+ [
	90	+ 'methods' => WP_REST_Server::READABLE,
	91	+ 'callback' => [$this->fileController, 'handleFileDownload'],
	92	+ 'permission_callback' => [$this, 'file_download_permissions_check']
	93	+ ]
	94	+ ]
	95	+ );
	96	+ }
	97	+
	98	+ public function file_download_permissions_check(WP_REST_Request $request)
	99	+ {
	100	+ if (!is_user_logged_in()) {
	101	+ return new \WP_Error(
	102	+ 'rest_forbidden',
	103	+ __('You do not have permission to access this file.', 'bit-form'),
	104	+ ['status' => 401]
	105	+ );
	106	+ }
	107	+
	108	+ if (current_user_can('manage_options')) {
	109	+ return true;
	110	+ }
	111	+
	112	+ $formID = absint($request->get_param('formID'));
	113	+ $entryID = absint($request->get_param('entryID'));
	114	+
	115	+ if (empty($formID) || empty($entryID)) {
	116	+ return new \WP_Error(
	117	+ 'rest_forbidden',
	118	+ __('You do not have permission to access this file.', 'bit-form'),
	119	+ ['status' => 403]
	120	+ );
	121	+ }
	122	+
	123	+ $entryModel = new FormEntryModel();
	124	+ $entry = $entryModel->get('id', [
	125	+ 'id' => $entryID,
	126	+ 'form_id' => $formID,
	127	+ 'user_id' => get_current_user_id(),
	128	+ ]);
	129	+
	130	+ if (is_wp_error($entry) || empty($entry)) {
	131	+ return new \WP_Error(
	132	+ 'rest_forbidden',
	133	+ __('You do not have permission to access this file.', 'bit-form'),
	134	+ ['status' => 403]
	135	+ );
	136	+ }
	137	+
	138	+ return true;
59	139	}
60	140	}