groups / lib / access / class-groups-post-access.php

class-groups-post-access.php in Groups – Memberships and Access Control 1.11.1, at lib/access/class-groups-post-access.php

441 lines 13.5 KB

Raw Download Zip

1	<?php
2	/**
3	* class-groups-post-access.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	/**
27	* Post access restrictions.
28	*
29	* @todo when wp_count_posts() provides reasonable filters, use them so that
30	* the post counts displayed on top are in line with the actual posts that
31	* are displayed in the table; same for wp_count_attachments()
32	* @see http://core.trac.wordpress.org/ticket/16603
33	*
34	*/
35	class Groups_Post_Access {
36
37	const POSTMETA_PREFIX = 'groups-';
38
39	const CACHE_GROUP = 'groups';
40	const CAN_READ_POST = 'can_read_post';
41
42	const READ_POST_CAPABILITY = "groups_read_post";
43	const READ_POST_CAPABILITY_NAME = "Read Post";
44	const READ_POST_CAPABILITIES = 'read_post_capabilities';
45	const POST_TYPES = 'post_types';
46
47	/**
48	* Create needed capabilities on plugin activation.
49	* Must be called explicitly or hooked into activation.
50	*/
51	public static function activate() {
52	if ( !Groups_Capability::read_by_capability( self::READ_POST_CAPABILITY ) ) {
53	Groups_Capability::create( array( "capability" => self::READ_POST_CAPABILITY ) );
54	// default read caps
55	Groups_Options::update_option( Groups_Post_Access::READ_POST_CAPABILITIES, array( Groups_Post_Access::READ_POST_CAPABILITY ) );
56	// for translation
57	// @see self::READ_POST_CAPABILITY_NAME
58	__( "Read Post", GROUPS_PLUGIN_DOMAIN );
59	}
60	}
61
62	/**
63	* Sets up filters to restrict access.
64	*/
65	public static function init() {
66	// post access
67	add_filter( 'posts_where', array( __CLASS__, 'posts_where' ), 10, 2 );
68	add_filter( 'get_pages', array( __CLASS__, "get_pages" ), 1 );
69	if ( apply_filters( 'groups_filter_the_posts', false ) ) {
70	add_filter( 'the_posts', array( __CLASS__, "the_posts" ), 1, 2 );
71	}
72	add_filter( 'wp_get_nav_menu_items', array( __CLASS__, "wp_get_nav_menu_items" ), 1, 3 );
73	// content access
74	add_filter( "get_the_excerpt", array( __CLASS__, "get_the_excerpt" ), 1 );
75	add_filter( "the_content", array( __CLASS__, "the_content" ), 1 );
76	// edit & delete post
77	add_filter( 'map_meta_cap', array( __CLASS__, 'map_meta_cap' ), 10, 4 );
78	// @todo these could be interesting to add later ...
79	// add_filter( "plugin_row_meta", array( __CLASS__, "plugin_row_meta" ), 1 );
80	// add_filter( "posts_join_paged", array( __CLASS__, "posts_join_paged" ), 1 );
81	// add_filter( "posts_where_paged", array( __CLASS__, "posts_where_paged" ), 1 );
82	add_action( 'groups_deleted_capability_capability', array( __CLASS__, 'groups_deleted_capability_capability' ) );
83	}
84
85	/**
86	* Restrict access to edit or delete posts based on the post's access restrictions.
87	*
88	* @param array $caps
89	* @param string $cap
90	* @param int $user_id
91	* @param array $args
92	* @return array
93	*/
94	public static function map_meta_cap( $caps, $cap, $user_id, $args ) {
95	if ( isset( $args[0] ) ) {
96	if ( strpos( $cap, 'edit_' ) === 0 \|\| strpos( $cap, 'delete_' ) === 0 ) {
97	if ( $post_type = get_post_type( $args[0] ) ) {
98
99	$edit_post_type = 'edit_' . $post_type;
100	$delete_post_type = 'delete_' . $post_type;
101	if ( $post_type_object = get_post_type_object( $post_type ) ) {
102	if ( !isset( $post_type_object->capabilities ) ) {
103	$post_type_object->capabilities = array();
104	}
105	$caps_object = get_post_type_capabilities( $post_type_object );
106	if ( isset( $caps_object->edit_post ) ) {
107	$edit_post_type = $caps_object->edit_post;
108	}
109	if ( isset( $caps_object->delete_post ) ) {
110	$delete_post_type = $caps_object->delete_post;
111	}
112	}
113
114	if ( $cap === $edit_post_type \|\| $cap === $delete_post_type ) {
115	$post_id = null;
116	if ( is_numeric( $args[0] ) ) {
117	$post_id = $args[0];
118	} else if ( $args[0] instanceof WP_Post ) {
119	$post_id = $post->ID;
120	}
121	if ( $post_id ) {
122	if ( !self::user_can_read_post( $post_id, $user_id ) ) {
123	$caps[] = 'do_not_allow';
124	}
125	}
126	}
127	}
128	}
129	}
130	return $caps;
131	}
132
133	/**
134	* Filters out posts that the user should not be able to access.
135	*
136	* @param string $where current where conditions
137	* @param WP_Query $query current query
138	* @return string modified $where
139	*/
140	public static function posts_where( $where, &$query ) {
141
142	global $wpdb;
143
144	$user_id = get_current_user_id();
145
146	// this only applies to logged in users
147	if ( $user_id ) {
148	// if administrators can override access, don't filter
149	if ( get_option( GROUPS_ADMINISTRATOR_ACCESS_OVERRIDE, GROUPS_ADMINISTRATOR_ACCESS_OVERRIDE_DEFAULT ) ) {
150	if ( user_can( $user_id, 'administrator' ) ) {
151	return $where;
152	}
153	}
154	}
155
156	// 1. Get all the capabilities that the user has, including those that are inherited:
157	$caps = array();
158	if ( $user = new Groups_User( $user_id ) ) {
159	$capabilities = $user->capabilities_deep;
160	if ( is_array( $capabilities ) ) {
161	foreach ( $capabilities as $capability ) {
162	$caps[] = "'". $capability . "'";
163	}
164	}
165	}
166
167	if ( count( $caps ) > 0 ) {
168	$caps = implode( ',', $caps );
169	} else {
170	$caps = '\'\'';
171	}
172
173	// 2. Filter the posts that require a capability that the user doesn't
174	// have, or in other words: exclude posts that the user must NOT access:
175
176	// The following is not correct in that it requires the user to have ALL capabilities:
177	// $where .= sprintf(
178	// " AND {$wpdb->posts}.ID NOT IN (SELECT DISTINCT ID FROM $wpdb->posts LEFT JOIN $wpdb->postmeta on {$wpdb->posts}.ID = {$wpdb->postmeta}.post_id WHERE {$wpdb->postmeta}.meta_key = '%s' AND {$wpdb->postmeta}.meta_value NOT IN (%s) ) ",
179	// self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
180	// $caps
181	// );
182
183	// This allows the user to access posts where the posts are not restricted or where
184	// the user has ANY of the capabilities:
185	$where .= sprintf(
186	" AND {$wpdb->posts}.ID IN " .
187	" ( " .
188	" SELECT ID FROM $wpdb->posts WHERE ID NOT IN ( SELECT post_id FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' ) " . // posts without access restriction
189	" UNION ALL " . // we don't care about duplicates here, just make it quick
190	" SELECT post_id AS ID FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' AND {$wpdb->postmeta}.meta_value IN (%s) " . // posts that require any capability the user has
191	" ) ",
192	self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
193	self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
194	$caps
195	);
196
197	return $where;
198	}
199
200	/**
201	* Filter pages by access capability.
202	*
203	* @param array $pages
204	*/
205	public static function get_pages( $pages ) {
206	$result = array();
207	$user_id = get_current_user_id();
208	foreach ( $pages as $page ) {
209	if ( self::user_can_read_post( $page->ID, $user_id ) ) {
210	$result[] = $page;
211	}
212	}
213	return $result;
214	}
215
216	/**
217	* Filter posts by access capability.
218	*
219	* @param array $posts list of posts
220	* @param WP_Query $query
221	*/
222	public static function the_posts( $posts, &$query ) {
223	$result = array();
224	$user_id = get_current_user_id();
225	foreach ( $posts as $post ) {
226	if ( self::user_can_read_post( $post->ID, $user_id ) ) {
227	$result[] = $post;
228	}
229	}
230	return $result;
231	}
232
233	/**
234	* Filter menu items by access capability.
235	*
236	* @todo admin section: this won't inhibit the items being offered to be added, although when they're added they won't show up in the menu
237	*
238	* @param array $items
239	* @param mixed $menu
240	* @param array $args
241	*/
242	public static function wp_get_nav_menu_items( $items = null, $menu = null, $args = null ) {
243	$result = array();
244	$user_id = get_current_user_id();
245	foreach ( $items as $item ) {
246	// @todo might want to check $item->object and $item->type first,
247	// for example these are 'page' and 'post_type' for a page
248	if ( self::user_can_read_post( $item->object_id, $user_id ) ) {
249	$result[] = $item;
250	}
251	}
252	return $result;
253	}
254
255	/**
256	* Filter excerpt by access capability.
257	*
258	* @param string $output
259	* @return $output if access granted, otherwise ''
260	*/
261	public static function get_the_excerpt( $output ) {
262	global $post;
263	$result = '';
264	if ( isset( $post->ID ) ) {
265	if ( self::user_can_read_post( $post->ID ) ) {
266	$result = $output;
267	}
268	} else {
269	// not a post, don't interfere
270	$result = $output;
271	}
272	return $result;
273	}
274
275	/**
276	* Filter content by access capability.
277	*
278	* @param string $output
279	* @return $output if access granted, otherwise ''
280	*/
281	public static function the_content( $output ) {
282	global $post;
283	$result = '';
284	if ( isset( $post->ID ) ) {
285	if ( self::user_can_read_post( $post->ID ) ) {
286	$result = $output;
287	}
288	} else {
289	// not a post, don't interfere
290	$result = $output;
291	}
292	return $result;
293	}
294
295	/**
296	* Adds an access capability requirement.
297	*
298	* $map must contain 'post_id' (*)
299	*
300	* For now this only should be used to add the READ_POST_CAPABILITY which
301	* it does automatically. Nothing else is checked for granting access.
302	*
303	* (*) Revisions : As of Groups 1.3.13 and at WordPress 3.6.1, as
304	* add_post_meta stores postmeta for the revision's parent, we retrieve
305	* the parent's post ID if it applies and check against that to see if
306	* that capability is already present. This is to avoid duplicating
307	* the already existing postmeta entry (which ocurred in previous
308	* versions).
309	*
310	* @param array $map
311	* @return true if the capability could be added to the post, otherwis false
312	*/
313	public static function create( $map ) {
314	extract( $map );
315	$result = false;
316
317	if ( !isset( $capability ) ) {
318	$capability = self::READ_POST_CAPABILITY;
319	}
320
321	if ( !empty( $post_id ) && !empty( $capability) ) {
322	if ( Groups_Capability::read_by_capability( $capability ) ) {
323	if ( $revision_parent_id = wp_is_post_revision( $post_id ) ) {
324	$post_id = $revision_parent_id;
325	}
326	if ( !in_array( $capability, get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY ) ) ) {
327	$result = add_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability );
328	}
329	}
330	}
331	return $result;
332	}
333
334	/**
335	* Returns true if the post requires the given capability to grant access.
336	*
337	* Currently only READ_POST_CAPABILITY should be used, this is also taken
338	* as the default.
339	*
340	* @param int $post_id
341	* @param string $capability capability label
342	* @return true if the capability is required, otherwise false
343	*/
344	public static function read( $post_id, $capability = self::READ_POST_CAPABILITY ) {
345	$result = false;
346	$caps = get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
347	if ( $caps ) {
348	$result = in_array( $capability, $caps );
349	}
350	return $result;
351	}
352
353	/**
354	* Currently does nothing, always returns false.
355	*
356	* @param array $map
357	* @return false
358	*/
359	public static function update( $map ) {
360	return false;
361	}
362
363	/**
364	* Removes a capability requirement from a post.
365	*
366	* @param int $post_id
367	* @param string $capability defaults to groups_read_post, removes all if null is given
368	* @return true on success, otherwise false
369	*/
370	public static function delete( $post_id, $capability = self::READ_POST_CAPABILITY ) {
371	$result = false;
372	if ( !empty( $post_id ) ) {
373	if ( !empty( $capability ) ) {
374	$result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability );
375	} else {
376	$result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
377	}
378	}
379	return $result;
380	}
381
382	/**
383	* Returns a list of capabilities that grant access to the post.
384	*
385	* @param int $post_id
386	* @return array of string, capabilities
387	*/
388	public static function get_read_post_capabilities( $post_id ) {
389	return get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
390	}
391
392	/**
393	* Returns true if the user has any of the capabilities that grant access to the post.
394	*
395	* @param int $post_id post id
396	* @param int $user_id user id or null for current user
397	* @return boolean true if user can read the post
398	*/
399	public static function user_can_read_post( $post_id, $user_id = null ) {
400	$result = false;
401	if ( !empty( $post_id ) ) {
402	if ( $user_id === null ) {
403	$user_id = get_current_user_id();
404	}
405	$cached = Groups_Cache::get( self::CAN_READ_POST . '_' . $user_id . '_' . $post_id, self::CACHE_GROUP );
406	if ( $cached !== null ) {
407	$result = $cached->value;
408	unset( $cached ) ;
409	} else {
410	$groups_user = new Groups_User( $user_id );
411	$read_caps = self::get_read_post_capabilities( $post_id );
412	if ( !empty( $read_caps ) ) {
413	foreach( $read_caps as $read_cap ) {
414	if ( $groups_user->can( $read_cap ) ) {
415	$result = true;
416	break;
417	}
418	}
419	} else {
420	$result = true;
421	}
422	$result = apply_filters( 'groups_post_access_user_can_read_post', $result, $post_id, $user_id );
423	Groups_Cache::set( self::CAN_READ_POST . '_' . $user_id . '_' . $post_id, $result, self::CACHE_GROUP );
424	}
425	}
426	return $result;
427	}
428
429	/**
430	* Hooks into groups_deleted_capability_capability to remove existing access
431	* restrictions based on the deleted capability.
432	*
433	* @param string $name of the deleted capability
434	*/
435	public static function groups_deleted_capability_capability( $capability ) {
436	delete_metadata( 'post', null, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability, true );
437	}
438
439	}
440	Groups_Post_Access::init();
441