← All changes
|
core/appointment/controllers/appointment-controller.php
+0
-40
1.0.28
→
1.0.27
View file →
| @@ -392,14 +392,9 @@ | ||
| 392 | 392 | // Remove user_email from team data to protect privacy |
| 393 | 393 | $team_member_data->user_email = ''; |
| 394 | 394 | } |
| 395 | 395 | } |
| 396 | - | |
| 397 | - // Never hand the cancel/reschedule credential to a customer | |
| 398 | - // through the list feed; it is delivered only via e-mail links. | |
| 399 | - $appointment->security_token = ''; | |
| 400 | 396 | } |
| 401 | - unset( $appointment ); | |
| 402 | 397 | } |
| 403 | 398 | |
| 404 | 399 | if ( ! $data ) { |
| 405 | 400 | return $this->error( __( 'No appointment found', 'booktics' ), 404 ); |
| @@ -547,35 +542,8 @@ | ||
| 547 | 542 | } |
| 548 | 543 | |
| 549 | 544 | $args = apply_filters( 'booktics_appointment_args', $args ); |
| 550 | 545 | |
| 551 | - // Scope to the caller's own appointments when they are not an | |
| 552 | - // admin/team-member. The calendar route is open to any logged-in user, | |
| 553 | - // so without this a plain customer would read every booking on the | |
| 554 | - // site. Mirrors the scoping already enforced in get_items(). | |
| 555 | - $scope_to_customer = ! booktics_is_admin_or_team_member() && is_user_logged_in(); | |
| 556 | - if ( $scope_to_customer ) { | |
| 557 | - $db = new Booktics_Database(); | |
| 558 | - $guest = ( new Guest_Model( $db ) )->find( array( 'wp_user_id' => get_current_user_id() ) ); | |
| 559 | - if ( ! $guest ) { | |
| 560 | - return $this->response( | |
| 561 | - array( | |
| 562 | - 'month' => gmdate( 'Y-m', strtotime( $month ) ), | |
| 563 | - 'date_range' => array( | |
| 564 | - 'start' => $adjusted_start_date, | |
| 565 | - 'end' => $adjusted_end_date, | |
| 566 | - ), | |
| 567 | - 'appointments' => array(), | |
| 568 | - ), __( 'Calendar appointments retrieved successfully', 'booktics' ) | |
| 569 | - ); | |
| 570 | - } | |
| 571 | - $args['meta_query'][] = array( | |
| 572 | - 'key' => 'customer_id', | |
| 573 | - 'value' => $guest->id, | |
| 574 | - 'compare' => '=', | |
| 575 | - ); | |
| 576 | - } | |
| 577 | - | |
| 578 | 546 | $appointments = Appointment_Model::paginate( $per_page, $paged, $args ); |
| 579 | 547 | |
| 580 | 548 | // Format the response |
| 581 | 549 | $formatted_appointments = array(); |
| @@ -583,16 +551,8 @@ | ||
| 583 | 551 | if ( ! empty( $appointments ) ) { |
| 584 | 552 | foreach ( $appointments['items'] as $appointment ) { |
| 585 | 553 | if ( ! empty( $appointment ) ) { |
| 586 | 554 | $appointment->source = 'booktics'; |
| 587 | - | |
| 588 | - // The per-appointment security token is the credential that | |
| 589 | - // authorises cancel/reschedule. Customers receive it only | |
| 590 | - // through their e-mailed links, never through this feed, so | |
| 591 | - // strip it from any non-admin response. | |
| 592 | - if ( $scope_to_customer ) { | |
| 593 | - $appointment->security_token = ''; | |
| 594 | - } | |
| 595 | 555 | } |
| 596 | 556 | |
| 597 | 557 | $formatted_appointments[] = $appointment; |
| 598 | 558 | } |