← All changes | common/rest.php +26 -67 0.5.5 → 0.4.2 View file →

		@@ -13,85 +13,64 @@
13	13	private function __construct() {
14	14	add_action( 'rest_api_init', [ $this, 'rest_api_init' ] );
15	15	}
16	16
17		- /**
18		- * Capability gate for plugin admin endpoints. Defaults to manage_options but
19		- * honours a per-plugin filter so a site can grant access to other roles
20		- * without re-implementing every permission_callback. The filter name is
21		- * derived from the class name (`MeowKit_<PREFIX>_Rest` => `<prefix>_allow_setup`),
22		- * so each plugin gets its own filter automatically after Nekofy substitution.
23		- */
24		- private function can_setup() {
25		- static $filter = null;
26		- if ( $filter === null ) {
27		- $parts = explode( '_', __CLASS__ );
28		- $prefix = isset( $parts[1] ) ? strtolower( $parts[1] ) : '';
29		- $filter = $prefix !== '' ? $prefix . '_allow_setup' : '';
30		- }
31		- $default = current_user_can( 'manage_options' );
32		- return $filter !== '' ? apply_filters( $filter, $default ) : $default;
33		- }
34		-
35	17	public function rest_api_init() {
36		- if ( !$this->can_setup() ) {
	18	+ if ( !current_user_can( 'manage_options' ) ) {
37	19	return;
38	20	}
39		- $permission = function () {
40		- return $this->can_setup();
41		- };
42	21	register_rest_route( $this->namespace, '/empty_request/', [
43	22	'methods' => 'POST',
44		- 'permission_callback' => $permission,
	23	+ 'permission_callback' => function () {
	24	+ return current_user_can( 'manage_options' );
	25	+ },
45	26	'callback' => [ $this, 'empty_request' ]
46	27	] );
47	28	register_rest_route( $this->namespace, '/file_operation/', [
48	29	'methods' => 'POST',
49		- 'permission_callback' => $permission,
	30	+ 'permission_callback' => function () {
	31	+ return current_user_can( 'manage_options' );
	32	+ },
50	33	'callback' => [ $this, 'file_operation' ]
51	34	] );
52	35	register_rest_route( $this->namespace, '/sql_request/', [
53	36	'methods' => 'POST',
54		- 'permission_callback' => $permission,
	37	+ 'permission_callback' => function () {
	38	+ return current_user_can( 'manage_options' );
	39	+ },
55	40	'callback' => [ $this, 'sql_request' ]
56	41	] );
57	42	register_rest_route( $this->namespace, '/error_logs/', [
58	43	'methods' => 'POST',
59		- 'permission_callback' => $permission,
	44	+ 'permission_callback' => function () {
	45	+ $ok = current_user_can( 'manage_options' );
	46	+ return $ok;
	47	+ },
60	48	'callback' => [ $this, 'rest_error_logs' ]
61	49	] );
62	50	register_rest_route( $this->namespace, '/all_settings/', [
63	51	'methods' => 'POST',
64		- 'permission_callback' => $permission,
	52	+ 'permission_callback' => function () {
	53	+ $ok = current_user_can( 'manage_options' );
	54	+ return $ok;
	55	+ },
65	56	'callback' => [ $this, 'rest_all_settings' ]
66	57	] );
67	58	register_rest_route( $this->namespace, '/update_option/', [
68	59	'methods' => 'POST',
69		- 'permission_callback' => $permission,
	60	+ 'permission_callback' => function () {
	61	+ $ok = current_user_can( 'manage_options' );
	62	+ return $ok;
	63	+ },
70	64	'callback' => [ $this, 'rest_update_option' ]
71	65	] );
72		- register_rest_route( $this->namespace, '/installed_plugins/', [
73		- 'methods' => 'POST',
74		- 'permission_callback' => $permission,
75		- 'callback' => [ $this, 'rest_installed_plugins' ]
76		- ] );
77	66	}
78	67
79	68	public function file_rand( $filesize ) {
80		- // Write the benchmark file inside a dedicated subfolder of the uploads
81		- // directory (created on demand), then remove it. wp.org forbids writing to
82		- // the plugin folder or the uploads root — only a sanctioned subfolder.
83		- $upload = wp_upload_dir();
84		- if ( !empty( $upload['error'] ) || empty( $upload['basedir'] ) ) { return; }
85		- $dir = trailingslashit( $upload['basedir'] ) . 'meowapps';
86		- if ( !wp_mkdir_p( $dir ) ) { return; }
87		- $path = trailingslashit( $dir ) . 'speedtest-' . wp_generate_password( 12, false ) . '.tmp';
88		- $fh = @fopen( $path, 'wb' );
89		- if ( $fh === false ) { return; }
90		- fseek( $fh, $filesize - 1, SEEK_CUR );
91		- fwrite( $fh, 'a' );
92		- fclose( $fh );
93		- @unlink( $path );
	69	+ $tmp_file = tmpfile();
	70	+ fseek( $tmp_file, $filesize - 1, SEEK_CUR );
	71	+ fwrite( $tmp_file, 'a' );
	72	+ fclose( $tmp_file );
94	73	}
95	74
96	75	public function empty_request() {
97	76	return new WP_REST_Response( [ 'success' => true ], 200 );
		@@ -126,28 +105,8 @@
126	105	}
127	106
128	107	public function rest_all_settings() {
129	108	return new WP_REST_Response( [ 'success' => true, 'data' => $this->get_all_options() ], 200 );
130		- }
131		-
132		- public function rest_installed_plugins() {
133		- if ( !function_exists( 'get_plugins' ) ) {
134		- require_once ABSPATH . 'wp-admin/includes/plugin.php';
135		- }
136		- $all_plugins = get_plugins();
137		- $result = [];
138		- foreach ( $all_plugins as $plugin_file => $plugin_data ) {
139		- // Plugin file looks like "ai-engine/ai-engine.php" — the slug is the
140		- // first path segment. Some plugins live at the root (single file),
141		- // those we just skip; we only care about Meow Apps directories anyway.
142		- $parts = explode( '/', $plugin_file );
143		- if ( count( $parts ) < 2 ) {
144		- continue;
145		- }
146		- $slug = $parts[0];
147		- $result[ $slug ] = is_plugin_active( $plugin_file ) ? 'active' : 'inactive';
148		- }
149		- return new WP_REST_Response( [ 'success' => true, 'data' => $result ], 200 );
150	109	}
151	110
152	111	public function rest_update_option( $request ) {
153	112	$params = $request->get_json_params();