← All changes
|
core/customer/controllers/customer-controller.php
+50
-3
1.0.16
→
1.0.28
View file →
| @@ -226,9 +226,36 @@ | ||
| 226 | 226 | * |
| 227 | 227 | * @return bool |
| 228 | 228 | */ |
| 229 | 229 | public function get_customer_permission( $request ) { |
| 230 | - return true; | |
| 230 | + if ( current_user_can( 'manage_options' ) ) { | |
| 231 | + return true; | |
| 232 | + } | |
| 233 | + | |
| 234 | + if ( is_user_logged_in() ) { | |
| 235 | + $current_user = wp_get_current_user(); | |
| 236 | + | |
| 237 | + if ( in_array( 'booktics_team_member', (array) $current_user->roles, true ) ) { | |
| 238 | + return true; | |
| 239 | + } | |
| 240 | + | |
| 241 | + $requested_customer_id = isset( $request['id'] ) ? intval( $request['id'] ) : 0; | |
| 242 | + | |
| 243 | + if ( $requested_customer_id > 0 ) { | |
| 244 | + $db = new Booktics_Database(); | |
| 245 | + $requested_customer = ( new Guest_Model( $db ) )->find( array( 'id' => $requested_customer_id ) ); | |
| 246 | + | |
| 247 | + if ( $requested_customer && intval( $requested_customer->wp_user_id ) === get_current_user_id() ) { | |
| 248 | + return true; | |
| 249 | + } | |
| 250 | + } | |
| 251 | + } | |
| 252 | + | |
| 253 | + return new WP_Error( | |
| 254 | + 'booktics_forbidden', | |
| 255 | + __( 'You are not allowed to view this customer data.', 'booktics' ), | |
| 256 | + array( 'status' => 403 ) | |
| 257 | + ); | |
| 231 | 258 | } |
| 232 | 259 | |
| 233 | 260 | /** |
| 234 | 261 | * Get paginated list items for customer |
| @@ -270,8 +297,14 @@ | ||
| 270 | 297 | |
| 271 | 298 | $customers = $customers->paginate( $paged, $per_page ); |
| 272 | 299 | foreach ( $customers['items'] as &$customer ) { |
| 273 | 300 | $customer = ( new Guest_Model( $db ) )->with_virtual_attributes( $customer ); |
| 301 | + | |
| 302 | + // Mask wp_user_id and user_login from non-admins (use empty string instead of unset for API consistency) | |
| 303 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 304 | + $customer->wp_user_id = ''; | |
| 305 | + $customer->user_login = ''; | |
| 306 | + } | |
| 274 | 307 | } |
| 275 | 308 | |
| 276 | 309 | return $this->response( $customers, __( 'Successfully fetched customer', 'booktics' ) ); |
| 277 | 310 | } |
| @@ -376,9 +409,9 @@ | ||
| 376 | 409 | if ( $guest_model->delete( $id ) ) { |
| 377 | 410 | ++$count; |
| 378 | 411 | } |
| 379 | 412 | } |
| 380 | - if ( $count == 0 ) { | |
| 413 | + if ( 0 == $count ) { | |
| 381 | 414 | return $this->error( __( 'Customer delete error', 'booktics' ), 500 ); |
| 382 | 415 | } |
| 383 | 416 | |
| 384 | 417 | do_action( 'booktics_customers_deleted', $request ); |
| @@ -414,8 +447,14 @@ | ||
| 414 | 447 | ); |
| 415 | 448 | }, $orders['items'] |
| 416 | 449 | ); |
| 417 | 450 | |
| 451 | + // Mask wp_user_id and user_login from non-admins (use empty string instead of unset for API consistency) | |
| 452 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 453 | + $customer->wp_user_id = ''; | |
| 454 | + $customer->user_login = ''; | |
| 455 | + } | |
| 456 | + | |
| 418 | 457 | return $this->response( $customer, __( 'Customer found successfully', 'booktics' ) ); |
| 419 | 458 | } |
| 420 | 459 | |
| 421 | 460 | /** |
| @@ -511,9 +550,17 @@ | ||
| 511 | 550 | * |
| 512 | 551 | * @return bool |
| 513 | 552 | */ |
| 514 | 553 | public function customer_profile_permission( $request ) { |
| 515 | - return true; | |
| 554 | + if ( is_user_logged_in() ) { | |
| 555 | + return true; | |
| 556 | + } | |
| 557 | + | |
| 558 | + return new WP_Error( | |
| 559 | + 'booktics_unauthorized', | |
| 560 | + __( 'You must be logged in to view your profile.', 'booktics' ), | |
| 561 | + array( 'status' => 401 ) | |
| 562 | + ); | |
| 516 | 563 | } |
| 517 | 564 | |
| 518 | 565 | /** |
| 519 | 566 | * Get customer profile |