| @@ -24,8 +24,79 @@ | ||
| 24 | 24 | * deliberate — it is NOT a half-finished rename. |
| 25 | 25 | */ |
| 26 | 26 | const OPENSTATION_SESSION_META_KEY = 'desktop_mode_session'; |
| 27 | 27 | |
| 28 | +/** | |
| 29 | + * The session meta key for the admin the request is running against. | |
| 30 | + * | |
| 31 | + * User meta is network-wide, so every site shared one blob, and the | |
| 32 | + * sanitizer drops any window URL outside the current site's | |
| 33 | + * `admin_url()` — so the first save from site B rewrote it and site A's | |
| 34 | + * desktop was gone. The MAIN site keeps the bare key, and so does every | |
| 35 | + * single-site install: those sessions already exist, and a new key would | |
| 36 | + * silently empty every desktop on upgrade. | |
| 37 | + * | |
| 38 | + * The NETWORK admin gets its own key rather than sharing the main | |
| 39 | + * site's, even though it runs in the main site's blog context. The two | |
| 40 | + * desktops derive the same window ids from different admins — | |
| 41 | + * `index-php` is the site dashboard on one and the network dashboard on | |
| 42 | + * the other — so one shared blob meant the network desktop restored the | |
| 43 | + * site's dashboard window (and the reverse), and the dock's Dashboard | |
| 44 | + * tile focused the wrong admin's screen. | |
| 45 | + * | |
| 46 | + * @param bool|null $network The network admin's session (true) or the | |
| 47 | + * current site's (false). Null follows the | |
| 48 | + * request, which is wrong on `admin-ajax.php` | |
| 49 | + * and REST — those callers must pass what the | |
| 50 | + * client reported. | |
| 51 | + * @return string Meta key to read and write. | |
| 52 | + */ | |
| 53 | +function openstation_session_meta_key( $network = null ) { | |
| 54 | + if ( null === $network ) { | |
| 55 | + $network = is_multisite() && is_network_admin(); | |
| 56 | + } | |
| 57 | + if ( $network ) { | |
| 58 | + return OPENSTATION_SESSION_META_KEY . '_network'; | |
| 59 | + } | |
| 60 | + return ! is_multisite() || get_current_blog_id() === get_main_site_id() | |
| 61 | + ? OPENSTATION_SESSION_META_KEY | |
| 62 | + : OPENSTATION_SESSION_META_KEY . '_' . get_current_blog_id(); | |
| 63 | +} | |
| 64 | + | |
| 65 | +/** | |
| 66 | + * Whether a persisted window URL belongs to the session's admin. | |
| 67 | + * | |
| 68 | + * The scope gate behind the per-admin meta keys: keys separate the | |
| 69 | + * blobs, this separates their CONTENTS, so a blob written before the | |
| 70 | + * keys split (or by an older client posting to the wrong scope) heals | |
| 71 | + * on read instead of restoring one admin's window on the other's | |
| 72 | + * desktop. Runs on read and on sanitize both. | |
| 73 | + * | |
| 74 | + * @param string $url Absolute window URL, already same-admin checked. | |
| 75 | + * @param bool $network Whether the session is the network admin's. | |
| 76 | + * @return bool True when the URL lives in the session's own admin. | |
| 77 | + */ | |
| 78 | +function openstation_session_url_in_scope( $url, $network ) { | |
| 79 | + $path = wp_parse_url( $url, PHP_URL_PATH ); | |
| 80 | + $in_network = is_string( $path ) && false !== strpos( $path, '/wp-admin/network/' ); | |
| 81 | + return $in_network === (bool) $network; | |
| 82 | +} | |
| 83 | + | |
| 84 | +/** | |
| 85 | + * Whether a window URL may persist in this session: same-origin, under | |
| 86 | + * this site's admin path, on the right side of the network split. The | |
| 87 | + * rule every window has to satisfy — on a network every site is its | |
| 88 | + * own OpenStation, and one admin's window never persists into | |
| 89 | + * another's session. | |
| 90 | + * | |
| 91 | + * @param string $url Absolute window URL. | |
| 92 | + * @param bool $network Whether the session is the network admin's. | |
| 93 | + * @return bool | |
| 94 | + */ | |
| 95 | +function openstation_session_window_url_ok( $url, $network ) { | |
| 96 | + return openstation_url_is_same_admin( $url ) && openstation_session_url_in_scope( $url, $network ); | |
| 97 | +} | |
| 98 | + | |
| 28 | 99 | /** Hard cap on persisted windows — guards against runaway meta size. */ |
| 29 | 100 | const OPENSTATION_SESSION_MAX_WINDOWS = 32; |
| 30 | 101 | |
| 31 | 102 | /** |
| @@ -90,18 +161,22 @@ | ||
| 90 | 161 | * |
| 91 | 162 | * Always returns a well-shaped array so callers don't have to defend |
| 92 | 163 | * against corrupt or partial meta. |
| 93 | 164 | * |
| 94 | - * @param int $user_id The user ID. | |
| 165 | + * @param int $user_id The user ID. | |
| 166 | + * @param bool|null $network See {@see openstation_session_meta_key()}. | |
| 95 | 167 | * @return array{windows: array, desktops: array, activeDesktop: string, focused: string, updated: int} |
| 96 | 168 | */ |
| 97 | -function openstation_get_session( $user_id ) { | |
| 169 | +function openstation_get_session( $user_id, $network = null ) { | |
| 98 | 170 | $user_id = (int) $user_id; |
| 99 | 171 | if ( $user_id <= 0 ) { |
| 100 | 172 | return openstation_empty_session(); |
| 101 | 173 | } |
| 174 | + if ( null === $network ) { | |
| 175 | + $network = is_multisite() && is_network_admin(); | |
| 176 | + } | |
| 102 | 177 | |
| 103 | - $raw = get_user_meta( $user_id, OPENSTATION_SESSION_META_KEY, true ); | |
| 178 | + $raw = get_user_meta( $user_id, openstation_session_meta_key( $network ), true ); | |
| 104 | 179 | if ( ! is_array( $raw ) ) { |
| 105 | 180 | return openstation_empty_session(); |
| 106 | 181 | } |
| 107 | 182 | |
| @@ -113,10 +188,54 @@ | ||
| 113 | 188 | ? array_values( $raw['desktops'] ) |
| 114 | 189 | : array( openstation_default_desktop() ); |
| 115 | 190 | $active_desktop = isset( $raw['activeDesktop'] ) ? (string) $raw['activeDesktop'] : 'desktop-1'; |
| 116 | 191 | |
| 192 | + // A desktop persisted by the site-Spaces model carried a `scope`: a | |
| 193 | + // desk hosting another admin. Every site is its own OpenStation now, | |
| 194 | + // so such a desk has nothing left to host — dropped on read, with | |
| 195 | + // the active desktop moved off it, and the next save writes the | |
| 196 | + // blob without it. | |
| 197 | + $desktops = array_values( | |
| 198 | + array_filter( | |
| 199 | + $desktops, | |
| 200 | + static function ( $d ) { | |
| 201 | + return ! ( is_array( $d ) && isset( $d['scope'] ) ); | |
| 202 | + } | |
| 203 | + ) | |
| 204 | + ); | |
| 205 | + if ( empty( $desktops ) ) { | |
| 206 | + $desktops = array( openstation_default_desktop() ); | |
| 207 | + } | |
| 208 | + $desktop_ids = array(); | |
| 209 | + foreach ( $desktops as $d ) { | |
| 210 | + if ( is_array( $d ) && isset( $d['id'] ) ) { | |
| 211 | + $desktop_ids[] = (string) $d['id']; | |
| 212 | + } | |
| 213 | + } | |
| 214 | + if ( ! in_array( $active_desktop, $desktop_ids, true ) && ! empty( $desktop_ids ) ) { | |
| 215 | + $active_desktop = $desktop_ids[0]; | |
| 216 | + } | |
| 217 | + | |
| 218 | + // Scope gate on read: drop windows persisted for the other admin. | |
| 219 | + // Blobs written before the network admin had its own meta key mix | |
| 220 | + // the two, and restoring across the split would open one admin's | |
| 221 | + // window on the other's desktop under a colliding window id. | |
| 222 | + $windows = isset( $raw['windows'] ) && is_array( $raw['windows'] ) ? array_values( $raw['windows'] ) : array(); | |
| 223 | + $windows = array_values( | |
| 224 | + array_filter( | |
| 225 | + $windows, | |
| 226 | + static function ( $win ) use ( $network ) { | |
| 227 | + if ( ! is_array( $win ) || ! empty( $win['native'] ) ) { | |
| 228 | + return true; | |
| 229 | + } | |
| 230 | + $url = isset( $win['url'] ) ? (string) $win['url'] : ''; | |
| 231 | + return openstation_session_window_url_ok( $url, $network ); | |
| 232 | + } | |
| 233 | + ) | |
| 234 | + ); | |
| 235 | + | |
| 117 | 236 | return array( |
| 118 | - 'windows' => isset( $raw['windows'] ) && is_array( $raw['windows'] ) ? array_values( $raw['windows'] ) : array(), | |
| 237 | + 'windows' => $windows, | |
| 119 | 238 | 'desktops' => $desktops, |
| 120 | 239 | 'activeDesktop' => $active_desktop, |
| 121 | 240 | 'focused' => isset( $raw['focused'] ) ? (string) $raw['focused'] : '', |
| 122 | 241 | 'updated' => isset( $raw['updated'] ) ? (int) $raw['updated'] : 0, |
| @@ -148,22 +267,26 @@ | ||
| 148 | 267 | * |
| 149 | 268 | * Equal timestamps are still accepted — that's a tie and whichever the |
| 150 | 269 | * server processes first wins. |
| 151 | 270 | * |
| 152 | - * @param int $user_id The user ID. | |
| 153 | - * @param array $session Raw session payload (will be sanitized). | |
| 271 | + * @param int $user_id The user ID. | |
| 272 | + * @param array $session Raw session payload (will be sanitized). | |
| 273 | + * @param bool|null $network See {@see openstation_session_meta_key()}. | |
| 154 | 274 | * @return bool True on success, false when stale / invalid / failed. |
| 155 | 275 | */ |
| 156 | -function openstation_save_session( $user_id, $session ) { | |
| 276 | +function openstation_save_session( $user_id, $session, $network = null ) { | |
| 157 | 277 | $user_id = (int) $user_id; |
| 158 | 278 | if ( $user_id <= 0 ) { |
| 159 | 279 | return false; |
| 160 | 280 | } |
| 281 | + if ( null === $network ) { | |
| 282 | + $network = is_multisite() && is_network_admin(); | |
| 283 | + } | |
| 161 | 284 | |
| 162 | 285 | if ( is_array( $session ) && isset( $session['updated'] ) ) { |
| 163 | 286 | $incoming = (int) $session['updated']; |
| 164 | 287 | if ( $incoming > 0 ) { |
| 165 | - $existing = openstation_get_session( $user_id ); | |
| 288 | + $existing = openstation_get_session( $user_id, $network ); | |
| 166 | 289 | $stored = isset( $existing['updated'] ) ? (int) $existing['updated'] : 0; |
| 167 | 290 | if ( $incoming < $stored ) { |
| 168 | 291 | // Stale write — another tab saved a newer snapshot |
| 169 | 292 | // after this one was taken. Bail so the user's latest |
| @@ -172,38 +295,44 @@ | ||
| 172 | 295 | } |
| 173 | 296 | } |
| 174 | 297 | } |
| 175 | 298 | |
| 176 | - $clean = openstation_sanitize_session( $session ); | |
| 299 | + $clean = openstation_sanitize_session( $session, $network ); | |
| 177 | 300 | |
| 178 | - return false !== update_user_meta( $user_id, OPENSTATION_SESSION_META_KEY, $clean ); | |
| 301 | + return false !== update_user_meta( $user_id, openstation_session_meta_key( $network ), $clean ); | |
| 179 | 302 | } |
| 180 | 303 | |
| 181 | 304 | /** |
| 182 | 305 | * Clears a user's saved desktop session. |
| 183 | 306 | * |
| 184 | - * @param int $user_id The user ID. | |
| 307 | + * @param int $user_id The user ID. | |
| 308 | + * @param bool|null $network See {@see openstation_session_meta_key()}. | |
| 185 | 309 | * @return bool True on success. |
| 186 | 310 | */ |
| 187 | -function openstation_clear_session( $user_id ) { | |
| 311 | +function openstation_clear_session( $user_id, $network = null ) { | |
| 188 | 312 | $user_id = (int) $user_id; |
| 189 | 313 | if ( $user_id <= 0 ) { |
| 190 | 314 | return false; |
| 191 | 315 | } |
| 192 | - return (bool) delete_user_meta( $user_id, OPENSTATION_SESSION_META_KEY ); | |
| 316 | + return (bool) delete_user_meta( $user_id, openstation_session_meta_key( $network ) ); | |
| 193 | 317 | } |
| 194 | 318 | |
| 195 | 319 | /** |
| 196 | 320 | * Sanitizes a session payload before persistence. |
| 197 | 321 | * |
| 198 | - * Rejects windows whose `url` isn't a same-origin admin URL, clamps | |
| 199 | - * geometry to sane integer ranges, and normalizes the state enum. | |
| 200 | - * Windows beyond {@see OPENSTATION_SESSION_MAX_WINDOWS} are dropped. | |
| 322 | + * Rejects windows whose `url` isn't a same-origin admin URL or lives | |
| 323 | + * in the other admin's scope, clamps geometry to sane integer ranges, | |
| 324 | + * and normalizes the state enum. Windows beyond | |
| 325 | + * {@see OPENSTATION_SESSION_MAX_WINDOWS} are dropped. | |
| 201 | 326 | * |
| 202 | - * @param mixed $session Raw session data from the client. | |
| 327 | + * @param mixed $session Raw session data from the client. | |
| 328 | + * @param bool|null $network See {@see openstation_session_meta_key()}. | |
| 203 | 329 | * @return array{windows: array, desktops: array, activeDesktop: string, focused: string, updated: int} |
| 204 | 330 | */ |
| 205 | -function openstation_sanitize_session( $session ) { | |
| 331 | +function openstation_sanitize_session( $session, $network = null ) { | |
| 332 | + if ( null === $network ) { | |
| 333 | + $network = is_multisite() && is_network_admin(); | |
| 334 | + } | |
| 206 | 335 | $clean = openstation_empty_session(); |
| 207 | 336 | |
| 208 | 337 | if ( ! is_array( $session ) ) { |
| 209 | 338 | $clean['updated'] = openstation_session_now_ms(); |
| @@ -248,12 +377,21 @@ | ||
| 248 | 377 | // human-typed desktop name, hard ceiling on meta size. |
| 249 | 378 | if ( strlen( $d_label ) > 64 ) { |
| 250 | 379 | $d_label = substr( $d_label, 0, 64 ); |
| 251 | 380 | } |
| 252 | - $clean_desktops[] = array( | |
| 381 | + $entry = array( | |
| 253 | 382 | 'id' => $d_id, |
| 254 | 383 | 'label' => $d_label, |
| 255 | 384 | ); |
| 385 | + // A desktop's workspace profile — which apps it shows, what | |
| 386 | + // it opens with, how they are arranged. Optional, and only | |
| 387 | + // written when there is one, so a plain Space keeps the | |
| 388 | + // shape every session saved before workspaces existed had. | |
| 389 | + $profile = openstation_sanitize_workspace_profile( isset( $d['profile'] ) ? $d['profile'] : null ); | |
| 390 | + if ( null !== $profile ) { | |
| 391 | + $entry['profile'] = $profile; | |
| 392 | + } | |
| 393 | + $clean_desktops[] = $entry; | |
| 256 | 394 | $desktop_ids[] = $d_id; |
| 257 | 395 | if ( count( $clean_desktops ) >= OPENSTATION_SESSION_MAX_DESKTOPS ) { |
| 258 | 396 | break; |
| 259 | 397 | } |
| @@ -319,8 +457,18 @@ | ||
| 319 | 457 | if ( '' === $base_id ) { |
| 320 | 458 | $base_id = $id; |
| 321 | 459 | } |
| 322 | 460 | |
| 461 | + // Map the window to a known desktop. A client that sends a | |
| 462 | + // desktopId pointing at a non-existent desktop (race with a | |
| 463 | + // desktop close, or a malicious payload) is silently | |
| 464 | + // remapped to the active desktop so the window remains | |
| 465 | + // visible — losing it on restore would be the worse UX. | |
| 466 | + $win_desktop = isset( $win['desktopId'] ) ? sanitize_key( (string) $win['desktopId'] ) : ''; | |
| 467 | + if ( '' === $win_desktop || ! in_array( $win_desktop, $desktop_ids, true ) ) { | |
| 468 | + $win_desktop = $clean['activeDesktop']; | |
| 469 | + } | |
| 470 | + | |
| 323 | 471 | // Native windows (OS Settings, Bug Report, anything from |
| 324 | 472 | // `openstation_register_window()`) carry no admin URL — |
| 325 | 473 | // the shell reconstructs them from the registry by id. Their |
| 326 | 474 | // `url` is a `#slug` marker, which would fail the same-admin |
| @@ -334,14 +482,14 @@ | ||
| 334 | 482 | if ( $is_native ) { |
| 335 | 483 | $url = '#' . $id; |
| 336 | 484 | } else { |
| 337 | 485 | $url = isset( $win['url'] ) ? esc_url_raw( (string) $win['url'] ) : ''; |
| 338 | - // Only allow URLs that land inside our own wp-admin — both | |
| 339 | - // a safety net against storing arbitrary origins in user meta | |
| 340 | - // and a guarantee the restore path won't try to iframe a | |
| 341 | - // cross-origin page. Host+path parsing rejects tricks like | |
| 342 | - // `//evil.com/wp-admin/…` that a raw prefix check would miss. | |
| 343 | - if ( '' === $url || ! openstation_url_is_same_admin( $url ) ) { | |
| 486 | + // Only allow URLs this session may hold: same-origin, | |
| 487 | + // inside this admin. Host+path parsing rejects tricks | |
| 488 | + // like `//evil.com/wp-admin/…` that a raw prefix check | |
| 489 | + // would miss, and one admin's window never persists | |
| 490 | + // into another's session. | |
| 491 | + if ( '' === $url || ! openstation_session_window_url_ok( $url, $network ) ) { | |
| 344 | 492 | continue; |
| 345 | 493 | } |
| 346 | 494 | // Strip transient/routing flags before storage. The chromeless |
| 347 | 495 | // `openstation_chromeless` flag is an iframe-only concern and must never |
| @@ -357,18 +505,8 @@ | ||
| 357 | 505 | if ( ! in_array( $state, OPENSTATION_SESSION_STATES, true ) ) { |
| 358 | 506 | $state = 'normal'; |
| 359 | 507 | } |
| 360 | 508 | |
| 361 | - // Map the window to a known desktop. A client that sends a | |
| 362 | - // desktopId pointing at a non-existent desktop (race with | |
| 363 | - // a desktop close, or a malicious payload) is silently | |
| 364 | - // remapped to the active desktop so the window remains | |
| 365 | - // visible — losing it on restore would be the worse UX. | |
| 366 | - $win_desktop = isset( $win['desktopId'] ) ? sanitize_key( (string) $win['desktopId'] ) : ''; | |
| 367 | - if ( '' === $win_desktop || ! in_array( $win_desktop, $desktop_ids, true ) ) { | |
| 368 | - $win_desktop = $clean['activeDesktop']; | |
| 369 | - } | |
| 370 | - | |
| 371 | 509 | $entry = array( |
| 372 | 510 | 'id' => $id, |
| 373 | 511 | 'baseId' => $base_id, |
| 374 | 512 | 'desktopId' => $win_desktop, |
| @@ -381,8 +519,26 @@ | ||
| 381 | 519 | 'width' => openstation_sanitize_session_dimension( $win['width'] ?? 800, 0, 20000 ), |
| 382 | 520 | 'height' => openstation_sanitize_session_dimension( $win['height'] ?? 600, 0, 20000 ), |
| 383 | 521 | ); |
| 384 | 522 | |
| 523 | + // A grid-snapped window's cells, next to its pixels. On | |
| 524 | + // restore the cells win — they are a fraction of the desk, | |
| 525 | + // and the pixels are from whatever display the session was | |
| 526 | + // saved on. Only written when valid, so a plain window keeps | |
| 527 | + // the shape it always had. | |
| 528 | + $grid_span = openstation_sanitize_session_grid_span( $win['gridSpan'] ?? null ); | |
| 529 | + if ( null !== $grid_span ) { | |
| 530 | + $entry['gridSpan'] = $grid_span; | |
| 531 | + } | |
| 532 | + | |
| 533 | + // A window the phone layer opened with no desktop geometry to | |
| 534 | + // keep: its pixels are a phone's defaults, and the shell's | |
| 535 | + // restore path places it afresh instead of trusting them. | |
| 536 | + // Only written when true so plain sessions keep their shape. | |
| 537 | + if ( ! empty( $win['unplaced'] ) ) { | |
| 538 | + $entry['unplaced'] = true; | |
| 539 | + } | |
| 540 | + | |
| 385 | 541 | // Marks the entry for the shell's restore path: native |
| 386 | 542 | // windows reopen through the native-window registry, not by |
| 387 | 543 | // pointing an iframe at a URL. Only written when true so |
| 388 | 544 | // sessions of plain admin windows keep their existing shape. |
| @@ -500,8 +656,59 @@ | ||
| 500 | 656 | return $value; |
| 501 | 657 | } |
| 502 | 658 | |
| 503 | 659 | /** |
| 660 | + * Sanitize a window's grid placement. | |
| 661 | + * | |
| 662 | + * `{ anchor: { col, row }, cursor: { col, row }, cols, rows }`, every | |
| 663 | + * value an integer, the grid between 1×1 and 24×24 (the same ceiling | |
| 664 | + * the client's dimensions filter enforces), every cell inside it. | |
| 665 | + * Anything else is `null` — the window restores on its pixels, which | |
| 666 | + * is what a session written before grid snap does anyway. | |
| 667 | + * | |
| 668 | + * @param mixed $raw Raw span from the payload. | |
| 669 | + * @return array|null Sanitized span, or null. | |
| 670 | + */ | |
| 671 | +function openstation_sanitize_session_grid_span( $raw ) { | |
| 672 | + if ( ! is_array( $raw ) || ! isset( $raw['anchor'], $raw['cursor'], $raw['cols'], $raw['rows'] ) ) { | |
| 673 | + return null; | |
| 674 | + } | |
| 675 | + $int = static function ( $value ) { | |
| 676 | + return is_int( $value ) || ( is_numeric( $value ) && (string) (int) $value === (string) $value ) ? (int) $value : null; | |
| 677 | + }; | |
| 678 | + $cols = $int( $raw['cols'] ); | |
| 679 | + $rows = $int( $raw['rows'] ); | |
| 680 | + if ( null === $cols || null === $rows || $cols < 1 || $rows < 1 || $cols > 24 || $rows > 24 ) { | |
| 681 | + return null; | |
| 682 | + } | |
| 683 | + $cell = static function ( $c ) use ( $int, $cols, $rows ) { | |
| 684 | + if ( ! is_array( $c ) || ! isset( $c['col'], $c['row'] ) ) { | |
| 685 | + return null; | |
| 686 | + } | |
| 687 | + $col = $int( $c['col'] ); | |
| 688 | + $row = $int( $c['row'] ); | |
| 689 | + if ( null === $col || null === $row || $col < 0 || $row < 0 || $col >= $cols || $row >= $rows ) { | |
| 690 | + return null; | |
| 691 | + } | |
| 692 | + return array( | |
| 693 | + 'col' => $col, | |
| 694 | + 'row' => $row, | |
| 695 | + ); | |
| 696 | + }; | |
| 697 | + $anchor = $cell( $raw['anchor'] ); | |
| 698 | + $cursor = $cell( $raw['cursor'] ); | |
| 699 | + if ( null === $anchor || null === $cursor ) { | |
| 700 | + return null; | |
| 701 | + } | |
| 702 | + return array( | |
| 703 | + 'anchor' => $anchor, | |
| 704 | + 'cursor' => $cursor, | |
| 705 | + 'cols' => $cols, | |
| 706 | + 'rows' => $rows, | |
| 707 | + ); | |
| 708 | +} | |
| 709 | + | |
| 710 | +/** | |
| 504 | 711 | * Sanitize a native window's open-time params. |
| 505 | 712 | * |
| 506 | 713 | * These say WHAT a native window is showing (`{ userId: 12 }`, |
| 507 | 714 | * `{ customerId: 7 }`) as opposed to what it is — see |
| @@ -564,8 +771,18 @@ | ||
| 564 | 771 | * Registers the REST routes used by the desktop shell to load and save |
| 565 | 772 | * the current user's session. |
| 566 | 773 | */ |
| 567 | 774 | function openstation_register_session_rest_routes() { |
| 775 | + // `network` addresses the network admin's own session. The route | |
| 776 | + // runs in the main site's blog context whichever desktop is | |
| 777 | + // saving, so the shell says which one it is: the network screen's | |
| 778 | + // `sessionUrl` carries `network=1`. | |
| 779 | + $network_arg = array( | |
| 780 | + 'network' => array( | |
| 781 | + 'type' => 'boolean', | |
| 782 | + 'default' => false, | |
| 783 | + ), | |
| 784 | + ); | |
| 568 | 785 | register_rest_route( |
| 569 | 786 | 'desktop-mode/v1', |
| 570 | 787 | '/session', |
| 571 | 788 | array( |
| @@ -572,18 +789,22 @@ | ||
| 572 | 789 | array( |
| 573 | 790 | 'methods' => WP_REST_Server::READABLE, |
| 574 | 791 | 'callback' => 'openstation_rest_get_session', |
| 575 | 792 | 'permission_callback' => 'openstation_rest_session_permission', |
| 793 | + 'args' => $network_arg, | |
| 576 | 794 | ), |
| 577 | 795 | array( |
| 578 | 796 | 'methods' => WP_REST_Server::CREATABLE, |
| 579 | 797 | 'callback' => 'openstation_rest_save_session', |
| 580 | 798 | 'permission_callback' => 'openstation_rest_session_permission', |
| 581 | - 'args' => array( | |
| 582 | - 'session' => array( | |
| 583 | - 'required' => true, | |
| 584 | - 'type' => 'object', | |
| 799 | + 'args' => array_merge( | |
| 800 | + array( | |
| 801 | + 'session' => array( | |
| 802 | + 'required' => true, | |
| 803 | + 'type' => 'object', | |
| 804 | + ), | |
| 585 | 805 | ), |
| 806 | + $network_arg | |
| 586 | 807 | ), |
| 587 | 808 | ), |
| 588 | 809 | array( |
| 589 | 810 | 'methods' => WP_REST_Server::DELETABLE, |
| @@ -588,8 +809,9 @@ | ||
| 588 | 809 | array( |
| 589 | 810 | 'methods' => WP_REST_Server::DELETABLE, |
| 590 | 811 | 'callback' => 'openstation_rest_clear_session', |
| 591 | 812 | 'permission_callback' => 'openstation_rest_session_permission', |
| 813 | + 'args' => $network_arg, | |
| 592 | 814 | ), |
| 593 | 815 | ) |
| 594 | 816 | ); |
| 595 | 817 | } |
| @@ -606,14 +828,35 @@ | ||
| 606 | 828 | return openstation_rest_require_enabled(); |
| 607 | 829 | } |
| 608 | 830 | |
| 609 | 831 | /** |
| 832 | + * Which admin's session a REST call addresses. | |
| 833 | + * | |
| 834 | + * `is_network_admin()` is false on every REST request, so the client | |
| 835 | + * reports the scope (`network=1`, stamped onto the network screen's | |
| 836 | + * `sessionUrl`). Honoured only for users who can open the network | |
| 837 | + * desktop at all — anyone else's flag falls back to the site session | |
| 838 | + * rather than minting a blob for a desktop they cannot reach. | |
| 839 | + * | |
| 840 | + * @param WP_REST_Request $request The REST request. | |
| 841 | + * @return bool True when the call addresses the network admin's session. | |
| 842 | + */ | |
| 843 | +function openstation_rest_session_network( WP_REST_Request $request ) { | |
| 844 | + return is_multisite() | |
| 845 | + && rest_sanitize_boolean( $request->get_param( 'network' ) ) | |
| 846 | + && current_user_can( 'manage_network' ); | |
| 847 | +} | |
| 848 | + | |
| 849 | +/** | |
| 610 | 850 | * GET /desktop-mode/v1/session — returns the caller's session. |
| 611 | 851 | * |
| 852 | + * @param WP_REST_Request $request The REST request. | |
| 612 | 853 | * @return WP_REST_Response |
| 613 | 854 | */ |
| 614 | -function openstation_rest_get_session() { | |
| 615 | - return rest_ensure_response( openstation_get_session( get_current_user_id() ) ); | |
| 855 | +function openstation_rest_get_session( WP_REST_Request $request ) { | |
| 856 | + return rest_ensure_response( | |
| 857 | + openstation_get_session( get_current_user_id(), openstation_rest_session_network( $request ) ) | |
| 858 | + ); | |
| 616 | 859 | } |
| 617 | 860 | |
| 618 | 861 | /** |
| 619 | 862 | * POST /desktop-mode/v1/session — replaces the caller's session. |
| @@ -623,17 +866,19 @@ | ||
| 623 | 866 | */ |
| 624 | 867 | function openstation_rest_save_session( WP_REST_Request $request ) { |
| 625 | 868 | $user_id = get_current_user_id(); |
| 626 | 869 | $payload = $request->get_param( 'session' ); |
| 627 | - openstation_save_session( $user_id, $payload ); | |
| 628 | - return rest_ensure_response( openstation_get_session( $user_id ) ); | |
| 870 | + $network = openstation_rest_session_network( $request ); | |
| 871 | + openstation_save_session( $user_id, $payload, $network ); | |
| 872 | + return rest_ensure_response( openstation_get_session( $user_id, $network ) ); | |
| 629 | 873 | } |
| 630 | 874 | |
| 631 | 875 | /** |
| 632 | 876 | * DELETE /desktop-mode/v1/session — clears the caller's session. |
| 633 | 877 | * |
| 878 | + * @param WP_REST_Request $request The REST request. | |
| 634 | 879 | * @return WP_REST_Response |
| 635 | 880 | */ |
| 636 | -function openstation_rest_clear_session() { | |
| 637 | - openstation_clear_session( get_current_user_id() ); | |
| 881 | +function openstation_rest_clear_session( WP_REST_Request $request ) { | |
| 882 | + openstation_clear_session( get_current_user_id(), openstation_rest_session_network( $request ) ); | |
| 638 | 883 | return rest_ensure_response( openstation_empty_session() ); |
| 639 | 884 | } |
