jetpack / json-endpoints / jetpack / class.jetpack-json-api-endpoint.php

class.jetpack-json-api-endpoint.php in Jetpack – WP Security, Backup, Speed, & Growth 13.3.3, at json-endpoints/jetpack/class.jetpack-json-api-endpoint.php

178 lines 5.0 KB

Raw Download Zip

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2
3	require JETPACK__PLUGIN_DIR . '/modules/module-info.php';
4
5	/**
6	* Base class for Jetpack Endpoints, has the validate_call helper function.
7	*/
8	abstract class Jetpack_JSON_API_Endpoint extends WPCOM_JSON_API_Endpoint {
9
10	/**
11	* Needed capabilities.
12	*
13	* @var string
14	*/
15	protected $needed_capabilities;
16
17	/**
18	* Expected actions.
19	*
20	* @var array
21	*/
22	protected $expected_actions = array();
23
24	/**
25	* The action.
26	*
27	* @var string
28	*/
29	protected $action;
30
31	/**
32	* Callback function.
33	*
34	* @param string $path - the path.
35	* @param int $blog_id - the blog ID.
36	* @param object $object - parameter is for making the method signature compatible with its parent class method.
37	*/
38	public function callback( $path = '', $blog_id = 0, $object = null ) {
39	$error = $this->validate_call( $blog_id, $this->needed_capabilities );
40	if ( is_wp_error( $error ) ) {
41	return $error;
42	}
43
44	$error = $this->validate_input( $object );
45	if ( is_wp_error( $error ) ) {
46	return $error;
47	}
48
49	if ( ! empty( $this->action ) ) {
50	$error = call_user_func( array( $this, $this->action ) );
51	if ( is_wp_error( $error ) ) {
52	return $error;
53	}
54	}
55
56	return $this->result();
57	}
58
59	/**
60	* The result function.
61	*/
62	abstract protected function result();
63
64	/**
65	* Validate input.
66	*
67	* @param object $object - unused, for parent class compatability.
68	*
69	* @return bool
70	*/
71	protected function validate_input( $object ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
72	$args = $this->input();
73
74	if ( isset( $args['action'] ) && $args['action'] === 'update' ) {
75	$this->action = 'update';
76	}
77
78	if ( preg_match( '!/update/?$!', $this->path ) ) {
79	$this->action = 'update';
80
81	} elseif ( preg_match( '/\/install\/?$/', $this->path ) ) {
82	$this->action = 'install';
83
84	} elseif ( ! empty( $args['action'] ) ) {
85	if ( ! in_array( $args['action'], $this->expected_actions, true ) ) {
86	return new WP_Error( 'invalid_action', __( 'You must specify a valid action', 'jetpack' ) );
87	}
88	$this->action = $args['action'];
89	}
90	return true;
91	}
92
93	/**
94	* Switches to the blog and checks current user capabilities.
95	*
96	* @param int $_blog_id - the blog ID.
97	* @param array $capability - the capabilities of the user.
98	* @param bool $check_validation - if we're checking the validation.
99	*
100	* @return bool\|WP_Error a WP_Error object or true if things are good.
101	*/
102	protected function validate_call( $_blog_id, $capability, $check_validation = true ) {
103	$blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $_blog_id ) );
104	if ( is_wp_error( $blog_id ) ) {
105	return $blog_id;
106	}
107
108	$error = $this->check_capability( $capability );
109	if ( is_wp_error( $error ) ) {
110	return $error;
111	}
112
113	if (
114	$check_validation &&
115	'GET' !== $this->method &&
116	/**
117	* Filter to disallow JSON API requests to the site.
118	* Setting to false disallows you to manage your site remotely from WordPress.com
119	* and disallows plugin auto-updates.
120	*
121	* @since 7.3.0
122	*
123	* @param bool $check_validation Whether to allow API requests to manage the site
124	*/
125	! apply_filters( 'jetpack_json_manage_api_enabled', $check_validation )
126	) {
127	return new WP_Error( 'unauthorized_full_access', __( 'Full management mode is off for this site.', 'jetpack' ), 403 );
128	}
129
130	return true;
131	}
132
133	/**
134	* Check capability.
135	*
136	* @param array $capability - the compatability.
137	*
138	* @return bool\|WP_Error
139	*/
140	protected function check_capability( $capability ) {
141	// If this endpoint accepts site based authentication, skip capabilities check.
142	if ( $this->accepts_site_based_authentication() ) {
143	return true;
144	}
145	if ( is_array( $capability ) ) {
146	// the idea is that the we can pass in an array of capabilitie that the user needs to have before we allowing them to do something
147	$capabilities = ( isset( $capability['capabilities'] ) ? $capability['capabilities'] : $capability );
148
149	// We can pass in the number of conditions we must pass by default it is all.
150	$must_pass = ( isset( $capability['must_pass'] ) && is_int( $capability['must_pass'] ) ? $capability['must_pass'] : count( $capabilities ) );
151
152	$failed = array(); // store the failed capabilities
153	$passed = 0;
154	foreach ( $capabilities as $cap ) {
155	if ( current_user_can( $cap ) ) {
156	++$passed;
157	} else {
158	$failed[] = $cap;
159	}
160	}
161	// Check if all conditions have passed.
162	if ( $passed < $must_pass ) {
163	return new WP_Error(
164	'unauthorized',
165	/* translators: %s: comma-separated list of capabilities */
166	sprintf( __( 'This user is not authorized to %s on this blog.', 'jetpack' ), implode( ', ', $failed ) ),
167	403
168	);
169	}
170	} elseif ( ! current_user_can( $capability ) ) {
171	// Translators: the capability that the user is not authorized for.
172	return new WP_Error( 'unauthorized', sprintf( __( 'This user is not authorized to %s on this blog.', 'jetpack' ), $capability ), 403 );
173	}
174
175	return true;
176	}
177	}
178