← All changes | includes/ajax.php +40 -33 0.9.3 → 1.1.10 View file →

		@@ -1,20 +1,18 @@
1	1	<?php
2	2	/**
3		- * Desktop Mode AJAX endpoints.
	3	+ * OpenStation AJAX endpoints.
4	4	*
5		- * @package WPDesktopMode
	5	+ * @package OpenStation
6	6	*/
7	7
8	8	defined( 'ABSPATH' ) || exit;
9	9
10	10	/**
11		- * Handles saving the user's desktop mode preference via AJAX.
12		- *
13		- * @since 0.1.0
	11	+ * Handles saving the user's OpenStation preference via AJAX.
14	12	*/
15		-function desktop_mode_ajax_save() {
16		- check_ajax_referer( 'save-desktop-mode', 'nonce' );
	13	+function openstation_ajax_save() {
	14	+ check_ajax_referer( 'save-openstation', 'nonce' );
17	15
18	16	// A valid nonce proves *this* request was authored by the current
19	17	// user, but WP's cap system is the authoritative gate for "is this
20	18	// account allowed to touch admin state at all". `read` is the
		@@ -20,24 +18,22 @@
20	18	// account allowed to touch admin state at all". `read` is the
21	19	// minimum cap every admin-visible role carries; subscribers on sites
22	20	// that revoke it have no business flipping an admin-UI preference.
23	21	if ( ! current_user_can( 'read' ) ) {
24		- wp_send_json_error( 'desktop_mode_forbidden', 403 );
	22	+ wp_send_json_error( 'openstation_forbidden', 403 );
25	23	}
26	24
27	25	/**
28		- * Filters whether desktop mode is available for this user.
	26	+ * Filters whether OpenStation is available for this user.
29	27	*
30		- * Plugins can disable desktop mode for certain roles, capabilities, or conditions.
	28	+ * Plugins can disable OpenStation for certain roles, capabilities, or conditions.
31	29	*
32		- * @since 0.1.0
33		- *
34		- * @param bool $enabled Whether desktop mode is enabled. Default true.
	30	+ * @param bool $enabled Whether OpenStation is enabled. Default true.
35	31	* @param int $user_id The current user ID.
36	32	*/
37		- $allowed = apply_filters( 'desktop_mode_mode_enabled', true, get_current_user_id() );
	33	+ $allowed = apply_filters( 'openstation_mode_enabled', true, get_current_user_id() );
38	34	if ( ! $allowed ) {
39		- wp_send_json_error( 'desktop_mode_disabled' );
	35	+ wp_send_json_error( 'openstation_disabled' );
40	36	}
41	37
42	38	$enabled = ! empty( $_POST['enabled'] ) && '1' === $_POST['enabled'] ? '1' : '';
43	39
		@@ -42,31 +38,42 @@
42	38	$enabled = ! empty( $_POST['enabled'] ) && '1' === $_POST['enabled'] ? '1' : '';
43	39
44	40	update_user_meta( get_current_user_id(), 'desktop_mode_mode', $enabled );
45	41
	42	+ // The first-run stamps and the enable / disable actions. One helper
	43	+ // shared with the portal's auto-enable so the two writers cannot
	44	+ // drift — see `includes/first-run/stamps.php`.
	45	+ if ( '1' === $enabled ) {
	46	+ openstation_record_user_enabled( get_current_user_id() );
	47	+ } else {
	48	+ openstation_record_user_disabled( get_current_user_id() );
	49	+ }
	50	+
46	51	// Tell the client where to land.
47	52	//
48		- // Enabling from classic admin: land directly on the Dashboard with
49		- // the portal flag (`wp-admin/index.php?desktop_mode_portal=1`).
50		- // Previously this redirected through `/desktop-mode/` so the
51		- // portal handler could pick a landing page (saved-session focused
52		- // window, `?target=`, or Dashboard fallback). That logic remains
53		- // in place for users who visit `/desktop-mode/` directly — a
54		- // bookmark or shared link — but the explicit "Switch to Desktop
55		- // Mode" button is a deliberate user action that consistently
56		- // lands on the Dashboard, so users get a predictable starting
57		- // point regardless of what they did last session. The shell still
58		- // honours session restore and the user's default-window pref via
59		- // its own boot-time logic — the URL just provides a stable entry
60		- // point rather than a portal hop.
	53	+ // Enabling from classic admin: land on the shell screen with the
	54	+ // Dashboard as the page it opens first. The explicit "Switch to
	55	+ // Desktop Mode" button is a deliberate user action that
	56	+ // consistently lands on the Dashboard, so users get a predictable
	57	+ // starting point regardless of what they did last session; the
	58	+ // shell still honours session restore and the user's default-window
	59	+ // pref via its own boot-time logic. Going to the screen directly
	60	+ // rather than through `/openstation/` skips a hop the portal would
	61	+ // spend re-deciding what this URL already says.
61	62	//
62	63	// Disabling from the shell jumps to a plain admin URL — NOT the
63	64	// portal, which would auto-re-enable the mode via the
64		- // `desktop_mode_portal_auto_enable` filter and trap the user in a
	65	+ // `openstation_portal_auto_enable` filter and trap the user in a
65	66	// loop.
66		- $redirect = '1' === $enabled
67		- ? admin_url( 'index.php?' . DESKTOP_MODE_PORTAL_FLAG . '=1' )
68		- : admin_url();
	67	+ // Which admin to land in. The toggle reports its own context, since
	68	+ // `is_network_admin()` is false on every `admin-ajax.php` request,
	69	+ // and we confirm the capability before honouring it — a client
	70	+ // cannot talk us into a screen the user can't open.
	71	+ $in_network = ! empty( $_POST['network'] ) && current_user_can( 'manage_network' );
	72	+ $admin = $in_network ? network_admin_url() : admin_url();
	73	+ $redirect = '1' === $enabled
	74	+ ? openstation_shell_url( $admin . 'index.php', false, $in_network )
	75	+ : $admin;
69	76
70	77	wp_send_json_success(
71	78	array(
72	79	'enabled' => $enabled,
		@@ -73,5 +80,5 @@
73	80	'redirect' => esc_url_raw( $redirect ),
74	81	)
75	82	);
76	83	}
77		-add_action( 'wp_ajax_save-desktop-mode', 'desktop_mode_ajax_save' );
	84	+add_action( 'wp_ajax_save-openstation', 'openstation_ajax_save' );