← All changes | includes/API/Route/Routes.php +80 -7 2.10.1 → 3.3.1 View file →

		@@ -2,12 +2,15 @@
2	2
3	3	namespace BitCode\BitForm\API\Route;
4	4
5	5	use BitCode\BitForm\API\Controller\EntryController;
	6	+use BitCode\BitForm\API\Controller\FileController;
	7	+use BitCode\BitForm\Core\Database\FormEntryModel;
6	8	use WP_REST_Controller;
	9	+use WP_REST_Request;
7	10	use WP_REST_Server;
8	11
9		-class Routes extends WP_REST_Controller
	12	+class Routes extends WP_REST_Controller
10	13	{
11	14	private $entryController;
12	15
13	16	protected $namespace;
		@@ -13,31 +16,47 @@
13	16	protected $namespace;
14	17
15	18	protected $rest_base;
16	19
	20	+ protected $fileController;
	21	+
17	22	public function __construct()
18	23	{
19	24	$this->namespace = 'bitform';
20	25	$this->rest_base = 'v1';
21	26	$this->entryController = new EntryController();
	27	+ $this->fileController = new FileController();
22	28	}
23	29
24	30	public function register_routes()
25	31	{
26		- /* google sheet route */
	32	+ // OAuth callback endpoints. Must be publicly accessible: third-party OAuth providers
	33	+ // redirect to these URLs after authorization. Authorization is enforced inside
	34	+ // authRedirect() via wp_safe_redirect() and same-domain validation of the state parameter.
27	35	register_rest_route(
28	36	$this->namespace,
	37	+ $this->rest_base . '/oauth-redirect/',
	38	+ [
	39	+ [
	40	+ 'methods' => WP_REST_Server::READABLE,
	41	+ 'callback' => [$this->entryController, 'authRedirect'],
	42	+ 'permission_callback' => '__return_true'
	43	+ ]
	44	+ ]
	45	+ );
	46	+
	47	+ register_rest_route(
	48	+ $this->namespace,
29	49	$this->rest_base . '/google/',
30	50	[
31	51	[
32	52	'methods' => WP_REST_Server::READABLE,
33		- 'callback' => [$this->entryController, 'googleAuth'],
	53	+ 'callback' => [$this->entryController, 'authRedirect'],
34	54	'permission_callback' => '__return_true'
35	55	]
36	56
37	57	]
38	58	);
39		- // oneDrive rest route
40	59	register_rest_route(
41	60	$this->namespace,
42	61	$this->rest_base . '/oneDrive/',
43	62	[
		@@ -42,9 +61,9 @@
42	61	$this->rest_base . '/oneDrive/',
43	62	[
44	63	[
45	64	'methods' => WP_REST_Server::READABLE,
46		- 'callback' => [$this->entryController, 'oneDriveAuth'],
	65	+ 'callback' => [$this->entryController, 'authRedirect'],
47	66	'permission_callback' => '__return_true'
48	67	]
49	68
50	69	]
		@@ -49,9 +68,8 @@
49	68
50	69	]
51	70	);
52	71
53		- // zoho
54	72	register_rest_route(
55	73	$this->namespace,
56	74	$this->rest_base . '/zoho/',
57	75	[
		@@ -62,6 +80,61 @@
62	80	]
63	81
64	82	]
65	83	);
	84	+
	85	+ register_rest_route(
	86	+ $this->namespace,
	87	+ $this->rest_base . '/bitform-file-download/',
	88	+ [
	89	+ [
	90	+ 'methods' => WP_REST_Server::READABLE,
	91	+ 'callback' => [$this->fileController, 'handleFileDownload'],
	92	+ 'permission_callback' => [$this, 'file_download_permissions_check']
	93	+ ]
	94	+ ]
	95	+ );
66	96	}
67		-}
	97	+
	98	+ public function file_download_permissions_check(WP_REST_Request $request)
	99	+ {
	100	+ if (!is_user_logged_in()) {
	101	+ return new \WP_Error(
	102	+ 'rest_forbidden',
	103	+ __('You do not have permission to access this file.', 'bit-form'),
	104	+ ['status' => 401]
	105	+ );
	106	+ }
	107	+
	108	+ if (current_user_can('manage_options')) {
	109	+ return true;
	110	+ }
	111	+
	112	+ $formID = absint($request->get_param('formID'));
	113	+ $entryID = absint($request->get_param('entryID'));
	114	+
	115	+ if (empty($formID) || empty($entryID)) {
	116	+ return new \WP_Error(
	117	+ 'rest_forbidden',
	118	+ __('You do not have permission to access this file.', 'bit-form'),
	119	+ ['status' => 403]
	120	+ );
	121	+ }
	122	+
	123	+ $entryModel = new FormEntryModel();
	124	+ $entry = $entryModel->get('id', [
	125	+ 'id' => $entryID,
	126	+ 'form_id' => $formID,
	127	+ 'user_id' => get_current_user_id(),
	128	+ ]);
	129	+
	130	+ if (is_wp_error($entry) || empty($entry)) {
	131	+ return new \WP_Error(
	132	+ 'rest_forbidden',
	133	+ __('You do not have permission to access this file.', 'bit-form'),
	134	+ ['status' => 403]
	135	+ );
	136	+ }
	137	+
	138	+ return true;
	139	+ }
	140	+}