← All changes | common/rest.php +22 -53 0.4.8 → 0.4.5 View file →

		@@ -13,68 +13,57 @@
13	13	private function __construct() {
14	14	add_action( 'rest_api_init', [ $this, 'rest_api_init' ] );
15	15	}
16	16
17		- /**
18		- * Capability gate for plugin admin endpoints. Defaults to manage_options but
19		- * honours a per-plugin filter so a site can grant access to other roles
20		- * without re-implementing every permission_callback. The filter name is
21		- * derived from the class name (`MeowKit_<PREFIX>_Rest` => `<prefix>_allow_setup`),
22		- * so each plugin gets its own filter automatically after Nekofy substitution.
23		- */
24		- private function can_setup() {
25		- static $filter = null;
26		- if ( $filter === null ) {
27		- $parts = explode( '_', __CLASS__ );
28		- $prefix = isset( $parts[1] ) ? strtolower( $parts[1] ) : '';
29		- $filter = $prefix !== '' ? $prefix . '_allow_setup' : '';
30		- }
31		- $default = current_user_can( 'manage_options' );
32		- return $filter !== '' ? apply_filters( $filter, $default ) : $default;
33		- }
34		-
35	17	public function rest_api_init() {
36		- if ( !$this->can_setup() ) {
	18	+ if ( !current_user_can( 'manage_options' ) ) {
37	19	return;
38	20	}
39		- $permission = function () {
40		- return $this->can_setup();
41		- };
42	21	register_rest_route( $this->namespace, '/empty_request/', [
43	22	'methods' => 'POST',
44		- 'permission_callback' => $permission,
	23	+ 'permission_callback' => function () {
	24	+ return current_user_can( 'manage_options' );
	25	+ },
45	26	'callback' => [ $this, 'empty_request' ]
46	27	] );
47	28	register_rest_route( $this->namespace, '/file_operation/', [
48	29	'methods' => 'POST',
49		- 'permission_callback' => $permission,
	30	+ 'permission_callback' => function () {
	31	+ return current_user_can( 'manage_options' );
	32	+ },
50	33	'callback' => [ $this, 'file_operation' ]
51	34	] );
52	35	register_rest_route( $this->namespace, '/sql_request/', [
53	36	'methods' => 'POST',
54		- 'permission_callback' => $permission,
	37	+ 'permission_callback' => function () {
	38	+ return current_user_can( 'manage_options' );
	39	+ },
55	40	'callback' => [ $this, 'sql_request' ]
56	41	] );
57	42	register_rest_route( $this->namespace, '/error_logs/', [
58	43	'methods' => 'POST',
59		- 'permission_callback' => $permission,
	44	+ 'permission_callback' => function () {
	45	+ $ok = current_user_can( 'manage_options' );
	46	+ return $ok;
	47	+ },
60	48	'callback' => [ $this, 'rest_error_logs' ]
61	49	] );
62	50	register_rest_route( $this->namespace, '/all_settings/', [
63	51	'methods' => 'POST',
64		- 'permission_callback' => $permission,
	52	+ 'permission_callback' => function () {
	53	+ $ok = current_user_can( 'manage_options' );
	54	+ return $ok;
	55	+ },
65	56	'callback' => [ $this, 'rest_all_settings' ]
66	57	] );
67	58	register_rest_route( $this->namespace, '/update_option/', [
68	59	'methods' => 'POST',
69		- 'permission_callback' => $permission,
	60	+ 'permission_callback' => function () {
	61	+ $ok = current_user_can( 'manage_options' );
	62	+ return $ok;
	63	+ },
70	64	'callback' => [ $this, 'rest_update_option' ]
71	65	] );
72		- register_rest_route( $this->namespace, '/installed_plugins/', [
73		- 'methods' => 'POST',
74		- 'permission_callback' => $permission,
75		- 'callback' => [ $this, 'rest_installed_plugins' ]
76		- ] );
77	66	}
78	67
79	68	public function file_rand( $filesize ) {
80	69	$tmp_file = tmpfile();
		@@ -116,28 +105,8 @@
116	105	}
117	106
118	107	public function rest_all_settings() {
119	108	return new WP_REST_Response( [ 'success' => true, 'data' => $this->get_all_options() ], 200 );
120		- }
121		-
122		- public function rest_installed_plugins() {
123		- if ( !function_exists( 'get_plugins' ) ) {
124		- require_once ABSPATH . 'wp-admin/includes/plugin.php';
125		- }
126		- $all_plugins = get_plugins();
127		- $result = [];
128		- foreach ( $all_plugins as $plugin_file => $plugin_data ) {
129		- // Plugin file looks like "ai-engine/ai-engine.php" — the slug is the
130		- // first path segment. Some plugins live at the root (single file),
131		- // those we just skip; we only care about Meow Apps directories anyway.
132		- $parts = explode( '/', $plugin_file );
133		- if ( count( $parts ) < 2 ) {
134		- continue;
135		- }
136		- $slug = $parts[0];
137		- $result[ $slug ] = is_plugin_active( $plugin_file ) ? 'active' : 'inactive';
138		- }
139		- return new WP_REST_Response( [ 'success' => true, 'data' => $result ], 200 );
140	109	}
141	110
142	111	public function rest_update_option( $request ) {
143	112	$params = $request->get_json_params();