← All changes | core/customer/controllers/customer-controller.php +57 -8 1.0.15 → 1.0.28 View file →

		@@ -226,9 +226,36 @@
226	226	*
227	227	* @return bool
228	228	*/
229	229	public function get_customer_permission( $request ) {
230		- return true;
	230	+ if ( current_user_can( 'manage_options' ) ) {
	231	+ return true;
	232	+ }
	233	+
	234	+ if ( is_user_logged_in() ) {
	235	+ $current_user = wp_get_current_user();
	236	+
	237	+ if ( in_array( 'booktics_team_member', (array) $current_user->roles, true ) ) {
	238	+ return true;
	239	+ }
	240	+
	241	+ $requested_customer_id = isset( $request['id'] ) ? intval( $request['id'] ) : 0;
	242	+
	243	+ if ( $requested_customer_id > 0 ) {
	244	+ $db = new Booktics_Database();
	245	+ $requested_customer = ( new Guest_Model( $db ) )->find( array( 'id' => $requested_customer_id ) );
	246	+
	247	+ if ( $requested_customer && intval( $requested_customer->wp_user_id ) === get_current_user_id() ) {
	248	+ return true;
	249	+ }
	250	+ }
	251	+ }
	252	+
	253	+ return new WP_Error(
	254	+ 'booktics_forbidden',
	255	+ __( 'You are not allowed to view this customer data.', 'booktics' ),
	256	+ array( 'status' => 403 )
	257	+ );
231	258	}
232	259
233	260	/**
234	261	* Get paginated list items for customer
		@@ -239,13 +266,13 @@
239	266	*/
240	267	public function get_items( $request ) {
241	268	$per_page = ! empty( $request['per_page'] ) ? intval( $request['per_page'] ) : 20;
242	269	$paged = ! empty( $request['paged'] ) ? intval( $request['paged'] ) : 1;
243		- $name = ! empty( $request['name'] ) ? trim( $request['name'] ) : '';
244		- $email = ! empty( $request['email'] ) ? trim( $request['email'] ) : '';
245		- $phone = ! empty( $request['phone'] ) ? trim( $request['phone'] ) : '';
246		- $user_name = ! empty( $request['user_name'] ) ? trim( $request['user_name'] ) : '';
247		- $search = ! empty( $request['search'] ) ? trim( $request['search'] ) : '';
	270	+ $name = ! empty( $request['name'] ) ? sanitize_text_field( $request['name'] ) : '';
	271	+ $email = ! empty( $request['email'] ) ? sanitize_email( $request['email'] ) : '';
	272	+ $phone = ! empty( $request['phone'] ) ? sanitize_text_field( $request['phone'] ) : '';
	273	+ $user_name = ! empty( $request['user_name'] ) ? sanitize_text_field( $request['user_name'] ) : '';
	274	+ $search = ! empty( $request['search'] ) ? sanitize_text_field( $request['search'] ) : '';
248	275
249	276	$db = new Booktics_Database();
250	277	$customers = ( new Guest_Model( $db ) )->query();
251	278
		@@ -270,8 +297,14 @@
270	297
271	298	$customers = $customers->paginate( $paged, $per_page );
272	299	foreach ( $customers['items'] as &$customer ) {
273	300	$customer = ( new Guest_Model( $db ) )->with_virtual_attributes( $customer );
	301	+
	302	+ // Mask wp_user_id and user_login from non-admins (use empty string instead of unset for API consistency)
	303	+ if ( ! current_user_can( 'manage_options' ) ) {
	304	+ $customer->wp_user_id = '';
	305	+ $customer->user_login = '';
	306	+ }
274	307	}
275	308
276	309	return $this->response( $customers, __( 'Successfully fetched customer', 'booktics' ) );
277	310	}
		@@ -376,9 +409,9 @@
376	409	if ( $guest_model->delete( $id ) ) {
377	410	++$count;
378	411	}
379	412	}
380		- if ( $count == 0 ) {
	413	+ if ( 0 == $count ) {
381	414	return $this->error( __( 'Customer delete error', 'booktics' ), 500 );
382	415	}
383	416
384	417	do_action( 'booktics_customers_deleted', $request );
		@@ -414,8 +447,14 @@
414	447	);
415	448	}, $orders['items']
416	449	);
417	450
	451	+ // Mask wp_user_id and user_login from non-admins (use empty string instead of unset for API consistency)
	452	+ if ( ! current_user_can( 'manage_options' ) ) {
	453	+ $customer->wp_user_id = '';
	454	+ $customer->user_login = '';
	455	+ }
	456	+
418	457	return $this->response( $customer, __( 'Customer found successfully', 'booktics' ) );
419	458	}
420	459
421	460	/**
		@@ -490,8 +529,9 @@
490	529	$customer = ( new Guest_Model( $db ) )->update( $request['id'], $prepared_data );
491	530	$image_url = $request->get_param( 'image' );
492	531	if ( $image_url ) {
493	532	( new Guest_Model( $db ) )->update( $request['id'], array( 'image' => esc_url_raw( $image_url ) ) );
	533	+ ( new Guest_Model( $db ) )->update( absint( $request['id'] ), array( 'image' => esc_url_raw( $image_url ) ) );
494	534	}
495	535
496	536	if ( ! $customer ) {
497	537	return $this->error( __( 'Customer update error', 'booktics' ), 500 );
		@@ -510,9 +550,17 @@
510	550	*
511	551	* @return bool
512	552	*/
513	553	public function customer_profile_permission( $request ) {
514		- return true;
	554	+ if ( is_user_logged_in() ) {
	555	+ return true;
	556	+ }
	557	+
	558	+ return new WP_Error(
	559	+ 'booktics_unauthorized',
	560	+ __( 'You must be logged in to view your profile.', 'booktics' ),
	561	+ array( 'status' => 401 )
	562	+ );
515	563	}
516	564
517	565	/**
518	566	* Get customer profile
		@@ -525,8 +573,9 @@
525	573	$user_id = get_current_user_id();
526	574	$db = new Booktics_Database();
527	575	$customer = ( new Guest_Model( $db ) )->find( array( 'wp_user_id' => $user_id ) );
528	576	$args = array(
	577	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Meta query is necessary for filtering customers by meta fields
529	578	'meta_query' => array(
530	579	array(
531	580	'key' => 'customer_id',
532	581	'value' => $customer->id,