← All changes | common/rest.php +29 -25 0.4.7 → 0.4.8 View file →

		@@ -13,62 +13,66 @@
13	13	private function __construct() {
14	14	add_action( 'rest_api_init', [ $this, 'rest_api_init' ] );
15	15	}
16	16
	17	+ /**
	18	+ * Capability gate for plugin admin endpoints. Defaults to manage_options but
	19	+ * honours a per-plugin filter so a site can grant access to other roles
	20	+ * without re-implementing every permission_callback. The filter name is
	21	+ * derived from the class name (`MeowKit_<PREFIX>_Rest` => `<prefix>_allow_setup`),
	22	+ * so each plugin gets its own filter automatically after Nekofy substitution.
	23	+ */
	24	+ private function can_setup() {
	25	+ static $filter = null;
	26	+ if ( $filter === null ) {
	27	+ $parts = explode( '_', __CLASS__ );
	28	+ $prefix = isset( $parts[1] ) ? strtolower( $parts[1] ) : '';
	29	+ $filter = $prefix !== '' ? $prefix . '_allow_setup' : '';
	30	+ }
	31	+ $default = current_user_can( 'manage_options' );
	32	+ return $filter !== '' ? apply_filters( $filter, $default ) : $default;
	33	+ }
	34	+
17	35	public function rest_api_init() {
18		- if ( !current_user_can( 'manage_options' ) ) {
	36	+ if ( !$this->can_setup() ) {
19	37	return;
20	38	}
	39	+ $permission = function () {
	40	+ return $this->can_setup();
	41	+ };
21	42	register_rest_route( $this->namespace, '/empty_request/', [
22	43	'methods' => 'POST',
23		- 'permission_callback' => function () {
24		- return current_user_can( 'manage_options' );
25		- },
	44	+ 'permission_callback' => $permission,
26	45	'callback' => [ $this, 'empty_request' ]
27	46	] );
28	47	register_rest_route( $this->namespace, '/file_operation/', [
29	48	'methods' => 'POST',
30		- 'permission_callback' => function () {
31		- return current_user_can( 'manage_options' );
32		- },
	49	+ 'permission_callback' => $permission,
33	50	'callback' => [ $this, 'file_operation' ]
34	51	] );
35	52	register_rest_route( $this->namespace, '/sql_request/', [
36	53	'methods' => 'POST',
37		- 'permission_callback' => function () {
38		- return current_user_can( 'manage_options' );
39		- },
	54	+ 'permission_callback' => $permission,
40	55	'callback' => [ $this, 'sql_request' ]
41	56	] );
42	57	register_rest_route( $this->namespace, '/error_logs/', [
43	58	'methods' => 'POST',
44		- 'permission_callback' => function () {
45		- $ok = current_user_can( 'manage_options' );
46		- return $ok;
47		- },
	59	+ 'permission_callback' => $permission,
48	60	'callback' => [ $this, 'rest_error_logs' ]
49	61	] );
50	62	register_rest_route( $this->namespace, '/all_settings/', [
51	63	'methods' => 'POST',
52		- 'permission_callback' => function () {
53		- $ok = current_user_can( 'manage_options' );
54		- return $ok;
55		- },
	64	+ 'permission_callback' => $permission,
56	65	'callback' => [ $this, 'rest_all_settings' ]
57	66	] );
58	67	register_rest_route( $this->namespace, '/update_option/', [
59	68	'methods' => 'POST',
60		- 'permission_callback' => function () {
61		- $ok = current_user_can( 'manage_options' );
62		- return $ok;
63		- },
	69	+ 'permission_callback' => $permission,
64	70	'callback' => [ $this, 'rest_update_option' ]
65	71	] );
66	72	register_rest_route( $this->namespace, '/installed_plugins/', [
67	73	'methods' => 'POST',
68		- 'permission_callback' => function () {
69		- return current_user_can( 'manage_options' );
70		- },
	74	+ 'permission_callback' => $permission,
71	75	'callback' => [ $this, 'rest_installed_plugins' ]
72	76	] );
73	77	}
74	78