| 1 |
<?php |
| 2 |
/** |
| 3 |
* OpenStation AJAX endpoints. |
| 4 |
* |
| 5 |
* @package OpenStation |
| 6 |
*/ |
| 7 |
|
| 8 |
defined( 'ABSPATH' ) || exit; |
| 9 |
|
| 10 |
/** |
| 11 |
* Handles saving the user's OpenStation preference via AJAX. |
| 12 |
*/ |
| 13 |
function openstation_ajax_save() { |
| 14 |
check_ajax_referer( 'save-openstation', 'nonce' ); |
| 15 |
|
| 16 |
// A valid nonce proves *this* request was authored by the current |
| 17 |
// user, but WP's cap system is the authoritative gate for "is this |
| 18 |
// account allowed to touch admin state at all". `read` is the |
| 19 |
// minimum cap every admin-visible role carries; subscribers on sites |
| 20 |
// that revoke it have no business flipping an admin-UI preference. |
| 21 |
if ( ! current_user_can( 'read' ) ) { |
| 22 |
wp_send_json_error( 'openstation_forbidden', 403 ); |
| 23 |
} |
| 24 |
|
| 25 |
/** |
| 26 |
* Filters whether OpenStation is available for this user. |
| 27 |
* |
| 28 |
* Plugins can disable OpenStation for certain roles, capabilities, or conditions. |
| 29 |
* |
| 30 |
* @param bool $enabled Whether OpenStation is enabled. Default true. |
| 31 |
* @param int $user_id The current user ID. |
| 32 |
*/ |
| 33 |
$allowed = apply_filters( 'openstation_mode_enabled', true, get_current_user_id() ); |
| 34 |
if ( ! $allowed ) { |
| 35 |
wp_send_json_error( 'openstation_disabled' ); |
| 36 |
} |
| 37 |
|
| 38 |
$enabled = ! empty( $_POST['enabled'] ) && '1' === $_POST['enabled'] ? '1' : ''; |
| 39 |
|
| 40 |
update_user_meta( get_current_user_id(), 'desktop_mode_mode', $enabled ); |
| 41 |
|
| 42 |
// Tell the client where to land. |
| 43 |
// |
| 44 |
// Enabling from classic admin: land directly on the Dashboard with |
| 45 |
// the portal flag (`wp-admin/index.php?desktop_mode_portal=1`). |
| 46 |
// Previously this redirected through `/openstation/` so the |
| 47 |
// portal handler could pick a landing page (saved-session focused |
| 48 |
// window, `?target=`, or Dashboard fallback). That logic remains |
| 49 |
// in place for users who visit `/openstation/` directly — a |
| 50 |
// bookmark or shared link — but the explicit "Switch to Desktop |
| 51 |
// Mode" button is a deliberate user action that consistently |
| 52 |
// lands on the Dashboard, so users get a predictable starting |
| 53 |
// point regardless of what they did last session. The shell still |
| 54 |
// honours session restore and the user's default-window pref via |
| 55 |
// its own boot-time logic — the URL just provides a stable entry |
| 56 |
// point rather than a portal hop. |
| 57 |
// |
| 58 |
// Disabling from the shell jumps to a plain admin URL — NOT the |
| 59 |
// portal, which would auto-re-enable the mode via the |
| 60 |
// `openstation_portal_auto_enable` filter and trap the user in a |
| 61 |
// loop. |
| 62 |
$redirect = '1' === $enabled |
| 63 |
? admin_url( 'index.php?' . OPENSTATION_PORTAL_FLAG . '=1' ) |
| 64 |
: admin_url(); |
| 65 |
|
| 66 |
wp_send_json_success( |
| 67 |
array( |
| 68 |
'enabled' => $enabled, |
| 69 |
'redirect' => esc_url_raw( $redirect ), |
| 70 |
) |
| 71 |
); |
| 72 |
} |
| 73 |
add_action( 'wp_ajax_save-openstation', 'openstation_ajax_save' ); |
| 74 |
|
