| @@ -172,9 +172,9 @@ | ||
| 172 | 172 | }, |
| 173 | 173 | ], |
| 174 | 174 | ], |
| 175 | 175 | 'permission_callback' => function () { |
| 176 | - return current_user_can( 'edit_posts' ); | |
| 176 | + return current_user_can( 'manage_options' ); | |
| 177 | 177 | }, |
| 178 | 178 | 'callback' => [ $this, 'sync_snippet' ], |
| 179 | 179 | ], |
| 180 | 180 | ] |
| @@ -307,8 +307,15 @@ | ||
| 307 | 307 | ); |
| 308 | 308 | } |
| 309 | 309 | |
| 310 | 310 | foreach ( $data as $key => $value ) { |
| 311 | + if ( false === $value ) { | |
| 312 | + // update_option() short-circuits when storing `false` over a | |
| 313 | + // missing option (both compare equal), so a default-enabled | |
| 314 | + // checkbox could never be persisted as disabled. | |
| 315 | + $value = ''; | |
| 316 | + } | |
| 317 | + | |
| 311 | 318 | update_option( 'wbcr_inp_' . $key, $value ); |
| 312 | 319 | } |
| 313 | 320 | |
| 314 | 321 | return new \WP_REST_Response( |
| @@ -584,9 +591,9 @@ | ||
| 584 | 591 | $conditions['meta_query'] = $meta_query_conditions; |
| 585 | 592 | } |
| 586 | 593 | |
| 587 | 594 | if ( ! empty( $tax_query_conditions ) ) { |
| 588 | - $conditions['tax_query'] = $tax_query_conditions; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query | |
| 595 | + $conditions['tax_query'] = $tax_query_conditions; | |
| 589 | 596 | } |
| 590 | 597 | |
| 591 | 598 | // Query snippets. |
| 592 | 599 | $snippets = get_posts( $conditions ); |
| @@ -629,13 +636,14 @@ | ||
| 629 | 636 | |
| 630 | 637 | /** |
| 631 | 638 | * Handle snippet sync to cloud. |
| 632 | 639 | * |
| 633 | - * @param \WP_REST_Request<array<string, mixed>> $request Rest request. | |
| 640 | + * @param \WP_REST_Request $request Rest request. | |
| 641 | + * @phpstan-param \WP_REST_Request<array<string, mixed>> $request | |
| 634 | 642 | * |
| 635 | 643 | * @return \WP_REST_Response |
| 636 | 644 | */ |
| 637 | - public function sync_snippet( \WP_REST_Request $request ) { // phpcs:ignore Squiz.Commenting.FunctionComment.IncorrectTypeHint | |
| 645 | + public function sync_snippet( \WP_REST_Request $request ) { | |
| 638 | 646 | $title = $request->get_param( 'title' ); |
| 639 | 647 | $snippet_id = absint( $request->get_param( 'id' ) ); |
| 640 | 648 | |
| 641 | 649 | // Verify the snippet exists. |
| @@ -646,8 +654,19 @@ | ||
| 646 | 654 | 'message' => __( 'Snippet not found. It may have been deleted or moved.', 'insert-php' ), |
| 647 | 655 | 'success' => false, |
| 648 | 656 | ], |
| 649 | 657 | 404 |
| 658 | + ); | |
| 659 | + } | |
| 660 | + | |
| 661 | + // Verify the current user has permission to edit this specific snippet. | |
| 662 | + if ( ! current_user_can( 'edit_post', $snippet_id ) ) { | |
| 663 | + return new \WP_REST_Response( | |
| 664 | + [ | |
| 665 | + 'message' => __( 'You do not have permission to sync this snippet.', 'insert-php' ), | |
| 666 | + 'success' => false, | |
| 667 | + ], | |
| 668 | + 403 | |
| 650 | 669 | ); |
| 651 | 670 | } |
| 652 | 671 | |
| 653 | 672 | // Sync snippet using the API object. |
