← All changes | includes/default-window.php +41 -44 0.9.6 → 1.1.10 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2	/**
3		- * Desktop Mode — Default window preference.
	3	+ * OpenStation — Default window preference.
4	4	*
5	5	* Stores the user's choice of "what window opens when I enter the
6	6	* desktop with nothing currently in session." Two signals matter:
7	7	*
		@@ -13,31 +13,36 @@
13	13	* their startup window.
14	14	*
15	15	* Stored as a serialized array on user-meta `desktop_mode_default_window`.
16	16	* A missing meta entry is treated as `{ enabled: true, url: <dashboard> }`
17		- * for backward compatibility with pre-0.6 installs.
	17	+ * for backward compatibility with older installs.
18	18	*
19		- * @package WPDesktopMode
20		- * @since 0.6.0
	19	+ * @package OpenStation
21	20	*/
22	21
23	22	defined( 'ABSPATH' ) || exit;
24	23
25		-/** User-meta key. */
26		-const DESKTOP_MODE_DEFAULT_WINDOW_META = 'desktop_mode_default_window';
	24	+/**
	25	+ * User-meta key.
	26	+ *
	27	+ * The VALUE keeps its pre-rebrand spelling on purpose: it is a
	28	+ * persisted or externally-visible identifier, so renaming it would
	29	+ * orphan data already written by live installs (or break a live
	30	+ * URL). The mismatch between this constant's name and its value is
	31	+ * deliberate — it is NOT a half-finished rename.
	32	+ */
	33	+const OPENSTATION_DEFAULT_WINDOW_META = 'desktop_mode_default_window';
27	34
28	35	/**
29	36	* Fetch the user's default-window preference as a normalized array.
30	37	*
31		- * @since 0.6.0
32		- *
33	38	* @param int $user_id User ID. Falls back to the current user when 0.
34	39	* @return array{enabled: bool, url: string} Always returns both keys.
35	40	*/
36		-function desktop_mode_get_default_window( $user_id = 0 ) {
37		- $user_id = $user_id ? (int) $user_id : get_current_user_id();
	41	+function openstation_get_default_window( $user_id = 0 ) {
	42	+ $user_id = $user_id ? (int) $user_id : get_current_user_id();
38	43	$fallback_url = admin_url( 'index.php' );
39		- $default = array(
	44	+ $default = array(
40	45	'enabled' => true,
41	46	'url' => $fallback_url,
42	47	);
43	48
		@@ -44,9 +49,9 @@
44	49	if ( ! $user_id ) {
45	50	return $default;
46	51	}
47	52
48		- $raw = get_user_meta( $user_id, DESKTOP_MODE_DEFAULT_WINDOW_META, true );
	53	+ $raw = get_user_meta( $user_id, OPENSTATION_DEFAULT_WINDOW_META, true );
49	54	if ( ! is_array( $raw ) ) {
50	55	return $default;
51	56	}
52	57
		@@ -68,15 +73,13 @@
68	73	* Passing `null` for $url disables the default entirely — the shell
69	74	* will open an empty desktop on portal entry. Passing a URL enables
70	75	* the default and sets it.
71	76	*
72		- * @since 0.6.0
73		- *
74	77	* @param int $user_id User ID. Must be positive.
75	78	* @param string|null $url URL to set, or null to disable.
76	79	* @return bool True on success, false on invalid URL or unknown user.
77	80	*/
78		-function desktop_mode_set_default_window( $user_id, $url ) {
	81	+function openstation_set_default_window( $user_id, $url ) {
79	82	$user_id = (int) $user_id;
80	83	if ( $user_id <= 0 ) {
81	84	return false;
82	85	}
		@@ -83,9 +86,9 @@
83	86
84	87	if ( null === $url ) {
85	88	update_user_meta(
86	89	$user_id,
87		- DESKTOP_MODE_DEFAULT_WINDOW_META,
	90	+ OPENSTATION_DEFAULT_WINDOW_META,
88	91	array(
89	92	'enabled' => false,
90	93	'url' => admin_url( 'index.php' ),
91	94	)
		@@ -92,9 +95,9 @@
92	95	);
93	96	return true;
94	97	}
95	98
96		- $clean = desktop_mode_validate_default_window_url( $url );
	99	+ $clean = openstation_validate_default_window_url( $url );
97	100	if ( '' === $clean ) {
98	101	return false;
99	102	}
100	103
		@@ -99,9 +102,9 @@
99	102	}
100	103
101	104	update_user_meta(
102	105	$user_id,
103		- DESKTOP_MODE_DEFAULT_WINDOW_META,
	106	+ OPENSTATION_DEFAULT_WINDOW_META,
104	107	array(
105	108	'enabled' => true,
106	109	'url' => $clean,
107	110	)
		@@ -115,14 +118,12 @@
115	118	* A stricter net than `esc_url_raw` because the value flows back into
116	119	* the portal-entry redirect — we don't want an attacker's CSRF-seeded
117	120	* preference to hijack the user into an off-site landing page.
118	121	*
119		- * @since 0.6.0
120		- *
121	122	* @param string $url Raw input.
122	123	* @return string Fully-qualified admin URL or `native:<slug>` marker, or empty string if rejected.
123	124	*/
124		-function desktop_mode_validate_default_window_url( $url ) {
	125	+function openstation_validate_default_window_url( $url ) {
125	126	$url = trim( (string) $url );
126	127	if ( '' === $url ) {
127	128	return '';
128	129	}
		@@ -146,13 +147,13 @@
146	147	if ( ! is_array( $parsed ) || empty( $parsed['path'] ) ) {
147	148	return '';
148	149	}
149	150
150		- $home_origin = wp_parse_url( home_url( '/' ) );
151		- $url_host = isset( $parsed['host'] ) ? strtolower( $parsed['host'] ) : '';
152		- $url_scheme = isset( $parsed['scheme'] ) ? strtolower( $parsed['scheme'] ) : '';
153		- $home_host = is_array( $home_origin ) && isset( $home_origin['host'] ) ? strtolower( $home_origin['host'] ) : '';
154		- $home_scheme = is_array( $home_origin ) && isset( $home_origin['scheme'] ) ? strtolower( $home_origin['scheme'] ) : '';
	151	+ $home_origin = wp_parse_url( home_url( '/' ) );
	152	+ $url_host = isset( $parsed['host'] ) ? strtolower( $parsed['host'] ) : '';
	153	+ $url_scheme = isset( $parsed['scheme'] ) ? strtolower( $parsed['scheme'] ) : '';
	154	+ $home_host = is_array( $home_origin ) && isset( $home_origin['host'] ) ? strtolower( $home_origin['host'] ) : '';
	155	+ $home_scheme = is_array( $home_origin ) && isset( $home_origin['scheme'] ) ? strtolower( $home_origin['scheme'] ) : '';
155	156
156	157	if ( '' !== $url_host && $url_host !== $home_host ) {
157	158	return '';
158	159	}
		@@ -170,9 +171,9 @@
170	171
171	172	// Reassemble as a clean same-origin URL so downstream consumers
172	173	// always get a fully-qualified string.
173	174	$query = isset( $parsed['query'] ) ? '?' . $parsed['query'] : '';
174		- return esc_url_raw( home_url( $parsed['path'] . $query ), array( $home_scheme ?: 'https', 'http', 'https' ) );
	175	+ return esc_url_raw( home_url( $parsed['path'] . $query ), array( $home_scheme ? $home_scheme : 'https', 'http', 'https' ) );
175	176	}
176	177
177	178	/**
178	179	* REST route: `POST /desktop-mode/v1/default-window`.
		@@ -177,21 +178,19 @@
177	178	/**
178	179	* REST route: `POST /desktop-mode/v1/default-window`.
179	180	*
180	181	* Body: `{ url: string | null }`. Null disables the default.
181		- *
182		- * @since 0.6.0
183	182	*/
184		-function desktop_mode_register_default_window_routes() {
	183	+function openstation_register_default_window_routes() {
185	184	register_rest_route(
186	185	'desktop-mode/v1',
187	186	'/default-window',
188	187	array(
189	188	'methods' => 'POST',
190		- 'callback' => 'desktop_mode_rest_set_default_window',
191		- // Logged in + desktop mode enabled. `read` alone is too
192		- // loose — see desktop_mode_rest_require_enabled().
193		- 'permission_callback' => 'desktop_mode_rest_require_enabled',
	189	+ 'callback' => 'openstation_rest_set_default_window',
	190	+ // Logged in + OpenStation enabled. `read` alone is too
	191	+ // loose — see openstation_rest_require_enabled().
	192	+ 'permission_callback' => 'openstation_rest_require_enabled',
194	193	// No schema type on `url` — the param is fundamentally
195	194	// mixed (string | null) and WP REST's multi-type schema
196	195	// validation has historically been flaky for this case
197	196	// across core versions. Validate in the callback instead,
		@@ -203,9 +202,9 @@
203	202	),
204	203	)
205	204	);
206	205	}
207		-add_action( 'rest_api_init', 'desktop_mode_register_default_window_routes' );
	206	+add_action( 'rest_api_init', 'openstation_register_default_window_routes' );
208	207
209	208	/**
210	209	* REST handler — writes the default-window meta and returns the
211	210	* normalized state.
		@@ -216,14 +215,12 @@
216	215	* - `{}` (missing key) → treated same as null, for clients that
217	216	* encode "clear this value" as an absent key rather than an
218	217	* explicit null.
219	218	*
220		- * @since 0.6.0
221		- *
222	219	* @param WP_REST_Request $request REST request.
223	220	* @return WP_REST_Response|WP_Error
224	221	*/
225		-function desktop_mode_rest_set_default_window( $request ) {
	222	+function openstation_rest_set_default_window( $request ) {
226	223	$user_id = get_current_user_id();
227	224	$params = $request->get_json_params();
228	225
229	226	// Distinguish "url was sent" (possibly null or '') from "url key
		@@ -234,27 +231,27 @@
234	231	$url = $has_url ? $params['url'] : null;
235	232
236	233	// Null / missing / empty string all disable the default.
237	234	if ( null === $url || '' === $url ) {
238		- desktop_mode_set_default_window( $user_id, null );
239		- return rest_ensure_response( desktop_mode_get_default_window( $user_id ) );
	235	+ openstation_set_default_window( $user_id, null );
	236	+ return rest_ensure_response( openstation_get_default_window( $user_id ) );
240	237	}
241	238
242	239	if ( ! is_string( $url ) ) {
243	240	return new WP_Error(
244		- 'desktop_mode_invalid_url',
	241	+ 'openstation_invalid_url',
245	242	__( 'The `url` parameter must be a string or null.', 'desktop-mode' ),
246	243	array( 'status' => 400 )
247	244	);
248	245	}
249	246
250		- $ok = desktop_mode_set_default_window( $user_id, $url );
	247	+ $ok = openstation_set_default_window( $user_id, $url );
251	248	if ( ! $ok ) {
252	249	return new WP_Error(
253		- 'desktop_mode_invalid_url',
	250	+ 'openstation_invalid_url',
254	251	__( 'The URL is not a valid same-origin wp-admin URL.', 'desktop-mode' ),
255	252	array( 'status' => 400 )
256	253	);
257	254	}
258	255
259		- return rest_ensure_response( desktop_mode_get_default_window( $user_id ) );
	256	+ return rest_ensure_response( openstation_get_default_window( $user_id ) );
260	257	}