elementor / includes / user.php

user.php in Elementor Website Builder – more than just a page builder 4.3.0-beta2, at includes/user.php

422 lines 10.1 KB

Raw Download Zip

1	<?php
2	namespace Elementor;
3
4	use Elementor\Core\Common\Modules\Ajax\Module as Ajax;
5
6	if ( ! defined( 'ABSPATH' ) ) {
7	exit; // Exit if accessed directly.
8	}
9
10	/**
11	* Elementor user.
12	*
13	* Elementor user handler class is responsible for checking if the user can edit
14	* with Elementor and displaying different admin notices.
15	*
16	* @since 1.0.0
17	*/
18	class User {
19
20	/**
21	* Holds the admin notices key.
22	*
23	* @var string Admin notices key.
24	*/
25	const ADMIN_NOTICES_KEY = 'elementor_admin_notices';
26
27	/**
28	* Holds the editor introduction screen key.
29	*
30	* @var string Introduction key.
31	*/
32	const INTRODUCTION_KEY = 'elementor_introduction';
33
34	/**
35	* Holds the beta tester key.
36	*
37	* @var string Beta tester key.
38	*/
39	const BETA_TESTER_META_KEY = 'elementor_beta_tester';
40
41	/**
42	* Holds the URL of the Beta Tester Opt-in API.
43	*
44	* @since 1.0.0
45	*
46	* @var string API URL.
47	*/
48	const BETA_TESTER_API_URL = 'https://my.elementor.com/api/v1/beta_tester/';
49
50	/**
51	* Holds the dismissed editor notices key.
52	*
53	* @since 3.19.0
54	*
55	* @var string Editor notices key.
56	*/
57	const DISMISSED_EDITOR_NOTICES_KEY = 'elementor_dismissed_editor_notices';
58
59	/**
60	* Init.
61	*
62	* Initialize Elementor user.
63	*
64	* @since 1.0.0
65	* @access public
66	* @static
67	*/
68	public static function init() {
69	add_action( 'wp_ajax_elementor_set_admin_notice_viewed', [ __CLASS__, 'ajax_set_admin_notice_viewed' ] );
70	add_action( 'admin_post_elementor_set_admin_notice_viewed', [ __CLASS__, 'ajax_set_admin_notice_viewed' ] );
71
72	add_action( 'elementor/ajax/register_actions', [ __CLASS__, 'register_ajax_actions' ] );
73	}
74
75	/**
76	* @param Ajax $ajax
77	* @since 2.1.0
78	* @access public
79	* @static
80	*/
81	public static function register_ajax_actions( Ajax $ajax ) {
82	$ajax->register_ajax_action( 'introduction_viewed', [ __CLASS__, 'set_introduction_viewed' ] );
83	$ajax->register_ajax_action( 'beta_tester_signup', [ __CLASS__, 'register_as_beta_tester' ] );
84	$ajax->register_ajax_action( 'dismissed_editor_notices', [ __CLASS__, 'set_dismissed_editor_notices' ] );
85	}
86
87	/**
88	* Is current user can edit.
89	*
90	* Whether the current user can edit the post.
91	*
92	* @since 1.0.0
93	* @access public
94	* @static
95	*
96	* @param int $post_id Optional. The post ID. Default is `0`.
97	*
98	* @return bool Whether the current user can edit the post.
99	*/
100	public static function is_current_user_can_edit( $post_id = 0 ) {
101	$post = get_post( $post_id );
102
103	if ( ! $post ) {
104	return false;
105	}
106
107	if ( 'trash' === get_post_status( $post->ID ) ) {
108	return false;
109	}
110
111	if ( ! self::is_current_user_can_edit_post_type( $post->post_type ) ) {
112	return false;
113	}
114
115	$post_type_object = get_post_type_object( $post->post_type );
116
117	if ( ! isset( $post_type_object->cap->edit_post ) ) {
118	return false;
119	}
120
121	$edit_cap = $post_type_object->cap->edit_post;
122	if ( ! current_user_can( $edit_cap, $post->ID ) ) {
123	return false;
124	}
125
126	if ( intval( get_option( 'page_for_posts' ) ) === $post->ID ) {
127	return false;
128	}
129
130	if ( function_exists( 'wc_get_page_id' ) && intval( wc_get_page_id( 'shop' ) ) === $post->ID ) {
131	return false;
132	}
133
134	return true;
135	}
136
137	/**
138	* Is current user can access elementor.
139	*
140	* Whether the current user role is not excluded by Elementor Settings.
141	*
142	* @since 2.1.7
143	* @access public
144	* @static
145	*
146	* @return bool True if can access, False otherwise.
147	*/
148	public static function is_current_user_in_editing_black_list() {
149	$user = wp_get_current_user();
150	$exclude_roles = get_option( 'elementor_exclude_user_roles', [] );
151
152	$compare_roles = array_intersect( $user->roles, $exclude_roles );
153	if ( ! empty( $compare_roles ) ) {
154	return false;
155	}
156
157	return true;
158	}
159
160	/**
161	* Is current user can edit post type.
162	*
163	* Whether the current user can edit the given post type.
164	*
165	* @since 1.9.0
166	* @access public
167	* @static
168	*
169	* @param string $post_type the post type slug to check.
170	*
171	* @return bool True if can edit, False otherwise.
172	*/
173	public static function is_current_user_can_edit_post_type( $post_type ) {
174	if ( ! self::is_current_user_in_editing_black_list() ) {
175	return false;
176	}
177
178	if ( ! Utils::is_post_type_support( $post_type ) ) {
179	return false;
180	}
181
182	$post_type_object = get_post_type_object( $post_type );
183
184	if ( ! current_user_can( $post_type_object->cap->edit_posts ) ) {
185	return false;
186	}
187
188	return true;
189	}
190
191	/**
192	* Get user notices.
193	*
194	* Retrieve the list of notices for the current user.
195	*
196	* @since 2.0.0
197	* @access public
198	* @static
199	*
200	* @return array A list of user notices.
201	*/
202	public static function get_user_notices() {
203	$notices = get_user_meta( get_current_user_id(), self::ADMIN_NOTICES_KEY, true );
204	return is_array( $notices ) ? $notices : [];
205	}
206
207	/**
208	* Is admin notice viewed.
209	*
210	* Whether the admin notice was viewed by the current user.
211	*
212	* @since 1.0.0
213	* @access public
214	* @static
215	*
216	* @param int $notice_id The notice ID.
217	*
218	* @return bool Whether the admin notice was viewed by the user.
219	*/
220	public static function is_user_notice_viewed( $notice_id ) {
221	$notices = self::get_user_notices();
222
223	if ( empty( $notices[ $notice_id ] ) ) {
224	return false;
225	}
226
227	// BC: Handles old structure ( `[ 'notice_id' => 'true' ]` ).
228	if ( 'true' === $notices[ $notice_id ] ) {
229	return true;
230	}
231
232	return $notices[ $notice_id ]['is_viewed'] ?? false;
233	}
234
235	/**
236	* Checks whether the current user is allowed to upload JSON files.
237	*
238	* Note: The 'json-upload' capability is managed by the Role Manager as a part of its blacklist restrictions.
239	* In this context, we are negating the user's permission check to use it as a whitelist, allowing uploads.
240	*
241	* @return bool Whether the current user can upload JSON files.
242	*/
243	public static function is_current_user_can_upload_json() {
244	return current_user_can( 'manage_options' ) \|\| ! Plugin::instance()->role_manager->user_can( 'json-upload' );
245	}
246
247	public static function is_current_user_can_use_custom_html() {
248	return current_user_can( 'manage_options' ) \|\| ! Plugin::instance()->role_manager->user_can( 'custom-html' );
249	}
250
251	/**
252	* Set admin notice as viewed.
253	*
254	* Flag the admin notice as viewed by the current user, using an authenticated ajax request.
255	*
256	* Fired by `wp_ajax_elementor_set_admin_notice_viewed` action.
257	*
258	* @since 1.0.0
259	* @access public
260	* @static
261	*/
262	public static function ajax_set_admin_notice_viewed() {
263	// phpcs:ignore WordPress.Security.NonceVerification.NoNonceVerification
264	$notice_id = Utils::get_super_global_value( $_REQUEST, 'notice_id' );
265
266	if ( ! $notice_id ) {
267	wp_die();
268	}
269
270	check_admin_referer( 'elementor_set_admin_notice_viewed' );
271
272	self::set_user_notice( $notice_id );
273
274	if ( ! wp_doing_ajax() ) {
275	wp_safe_redirect( admin_url() );
276	die;
277	}
278
279	wp_die();
280	}
281
282	/**
283	* @param string $notice_id
284	* @param bool $is_viewed
285	* @param array $meta
286	*
287	* @return void
288	*/
289	public static function set_user_notice( $notice_id, $is_viewed = true, $meta = null ) {
290	$notices = self::get_user_notices();
291
292	if ( ! is_array( $meta ) ) {
293	$meta = $notices[ $notice_id ]['meta'] ?? [];
294	}
295
296	$notices[ $notice_id ] = [
297	'is_viewed' => $is_viewed,
298	'meta' => $meta,
299	];
300
301	update_user_meta( get_current_user_id(), self::ADMIN_NOTICES_KEY, $notices );
302	}
303
304	/**
305	* @since 2.1.0
306	* @access public
307	* @static
308	*/
309	public static function set_introduction_viewed( array $data ) {
310	$user_introduction_meta = self::get_introduction_meta();
311
312	$user_introduction_meta[ $data['introductionKey'] ] = true;
313
314	update_user_meta( get_current_user_id(), self::INTRODUCTION_KEY, $user_introduction_meta );
315	}
316
317	/**
318	* @throws \Exception If the user cannot install plugins.
319	*/
320	public static function register_as_beta_tester( array $data ) {
321	if ( ! current_user_can( 'install_plugins' ) ) {
322	throw new \Exception( 'You do not have permission to install plugins.' );
323	}
324
325	update_user_meta( get_current_user_id(), self::BETA_TESTER_META_KEY, true );
326	$response = wp_safe_remote_post(
327	self::BETA_TESTER_API_URL,
328	[
329	'timeout' => 25,
330	'body' => [
331	'api_version' => ELEMENTOR_VERSION,
332	'site_lang' => get_bloginfo( 'language' ),
333	'beta_tester_email' => $data['betaTesterEmail'],
334	],
335	]
336	);
337
338	$response_code = (int) wp_remote_retrieve_response_code( $response );
339
340	if ( 200 === $response_code ) {
341	self::set_introduction_viewed( [
342	'introductionKey' => Beta_Testers::BETA_TESTER_SIGNUP,
343	] );
344	}
345	}
346
347	/**
348	* @param string $key
349	*
350	* @return array\|mixed\|string
351	* @since 2.1.0
352	* @access public
353	* @static
354	*/
355	public static function get_introduction_meta( $key = '' ) {
356	$user_introduction_meta = get_user_meta( get_current_user_id(), self::INTRODUCTION_KEY, true );
357
358	if ( ! $user_introduction_meta ) {
359	$user_introduction_meta = [];
360	}
361
362	if ( $key ) {
363	return empty( $user_introduction_meta[ $key ] ) ? '' : $user_introduction_meta[ $key ];
364	}
365
366	return $user_introduction_meta;
367	}
368
369	/**
370	* Get a user option with a fallback value.
371	*
372	* @param string $option Option key.
373	* @param int $user_id User ID.
374	* @param mixed $fallback Default fallback value.
375	*
376	* @return mixed
377	*/
378	public static function get_user_option_with_default( $option, $user_id, $fallback ) {
379	$value = get_user_option( $option, $user_id );
380
381	return ( false === $value ) ? $fallback : $value;
382	}
383
384	/**
385	* Get dismissed editor notices.
386	*
387	* Retrieve the list of dismissed editor notices for the current user.
388	*
389	* @since 3.19.0
390	* @access public
391	* @static
392	*
393	* @return array A list of dismissed editor notices.
394	*/
395	public static function get_dismissed_editor_notices() {
396	$notices = get_user_meta( get_current_user_id(), self::DISMISSED_EDITOR_NOTICES_KEY, true );
397
398	return is_array( $notices ) ? $notices : [];
399	}
400
401	/**
402	* Set dismissed editor notices for the current user.
403	*
404	* @since 3.19.0
405	* @access public
406	* @static
407	*
408	* @param array $data Editor notices.
409	*
410	* @return void
411	*/
412	public static function set_dismissed_editor_notices( array $data ) {
413	$editor_notices = self::get_dismissed_editor_notices();
414
415	if ( ! in_array( $data['dismissId'], $editor_notices, true ) ) {
416	$editor_notices[] = $data['dismissId'];
417
418	update_user_meta( get_current_user_id(), self::DISMISSED_EDITOR_NOTICES_KEY, $editor_notices );
419	}
420	}
421	}
422