← All changes | classes/route.php +37 -10 1.0.2 → 1.7.7 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2
3		-namespace ImageOptimizer\Classes;
	3	+namespace ImageOptimization\Classes;
4	4
5	5	use ReflectionClass;
6	6	use WP_Error;
7	7	use WP_REST_Request;
		@@ -6,8 +6,12 @@
6	6	use WP_Error;
7	7	use WP_REST_Request;
8	8	use WP_REST_Response;
9	9
	10	+if ( ! defined( 'ABSPATH' ) ) {
	11	+ exit; // Exit if accessed directly.
	12	+}
	13	+
10	14	abstract class Route {
11	15
12	16	/**
13	17	* Should the endpoint be validated for user authentication?
		@@ -110,18 +114,28 @@
110	114	/**
111	115	* get_permission_callback_method
112	116	*
113	117	* Returns a reference to the permission callback for the method if exists or the default one if it doesn't.
	118	+ * Looks up inherited methods so module Route_Base manage_options gates are honoured.
	119	+ *
114	120	* @param string $method The REST method name
115	121	*
116		- * @return callable If a method called (rest-method)_permission_callback exists, returns a reference to it, otherwise
117		- * returns a reference to the default member method /permission_callback/.
	122	+ * @return callable If a method called (rest-method)_permission_callback exists, returns a reference to it,
	123	+ * otherwise get_permission_callback when present, otherwise permission_callback.
118	124	*/
119	125	public function get_permission_callback_method( string $method ): callable {
120	126	$method_name = strtolower( $method );
121	127	$permission_callback_method = $method_name . '_permission_callback';
122		- $permission_callback = $this->method_exists_in_current_class( $permission_callback_method ) ? $permission_callback_method : 'permission_callback';
123		- return [ $this, $permission_callback ];
	128	+
	129	+ if ( method_exists( $this, $permission_callback_method ) ) {
	130	+ return [ $this, $permission_callback_method ];
	131	+ }
	132	+
	133	+ if ( method_exists( $this, 'get_permission_callback' ) ) {
	134	+ return [ $this, 'get_permission_callback' ];
	135	+ }
	136	+
	137	+ return [ $this, 'permission_callback' ];
124	138	}
125	139
126	140	/**
127	141	* maybe_add_args_to_config
		@@ -331,9 +345,9 @@
331	345	public function respond_error_json( array $data ): WP_Error {
332	346	if ( ! isset( $data['message'] ) || ! isset( $data['code'] ) ) {
333	347	_doing_it_wrong(
334	348	__FUNCTION__,
335		- esc_html__( 'Both `message` and `code` keys must be provided', 'image-optimizer' ),
	349	+ esc_html__( 'Both `message` and `code` keys must be provided', 'image-optimization' ),
336	350	'1.0.0'
337	351	); // @codeCoverageIgnore
338	352	}
339	353
		@@ -338,9 +352,9 @@
338	352	}
339	353
340	354	return new WP_Error(
341	355	$data['code'] ?? 'internal_server_error',
342		- $data['message'] ?? esc_html__( 'Internal server error', 'image-optimizer' ),
	356	+ $data['message'] ?? esc_html__( 'Internal server error', 'image-optimization' ),
343	357	);
344	358	}
345	359
346	360	public function verify_nonce( $nonce = '', $name = '' ) {
		@@ -345,20 +359,33 @@
345	359
346	360	public function verify_nonce( $nonce = '', $name = '' ) {
347	361	if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $nonce ) ), $name ) ) {
348	362	return $this->respond_error_json([
349		- 'message' => esc_html__( 'Invalid nonce', 'image-optimizer' ),
	363	+ 'message' => esc_html__( 'Invalid nonce', 'image-optimization' ),
350	364	'code' => 'bad_request',
351	365	]);
352	366	}
353	367	}
354	368
	369	+ public function verify_capability( $capability = 'manage_options' ) {
	370	+ if ( ! current_user_can( $capability ) ) {
	371	+ return $this->respond_error_json([
	372	+ 'message' => esc_html__( 'You do not have sufficient permissions to access this data.', 'image-optimization' ),
	373	+ 'code' => 'bad_request',
	374	+ ]);
	375	+ }
	376	+ }
	377	+
355	378	public function verify_nonce_and_capability( $nonce = '', $name = '', $capability = 'manage_options' ) {
356		- $this->verify_nonce( $nonce, $name );
	379	+ $valid = $this->verify_nonce( $nonce, $name );
357	380
	381	+ if ( is_wp_error( $valid ) ) {
	382	+ return $valid;
	383	+ }
	384	+
358	385	if ( ! current_user_can( $capability ) ) {
359	386	return $this->respond_error_json([
360		- 'message' => esc_html__( 'You do not have sufficient permissions to access this data.', 'image-optimizer' ),
	387	+ 'message' => esc_html__( 'You do not have sufficient permissions to access this data.', 'image-optimization' ),
361	388	'code' => 'bad_request',
362	389	]);
363	390	}
364	391	}