PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 7.2.1
Jetpack – WP Security, Backup, Speed, & Growth v7.2.1
12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 14.1.1 14.2.2 14.3.1 14.4.2 All 500 releases
← All changes | class.json-api.php +210 -702 13.7.27.2.1 View file →
@@ -1,260 +1,77 @@
1 -<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2 -/**
3 - * Jetpack JSON API.
4 - *
5 - * @package automattic/jetpack
6 - */
1 +<?php
7 2
8 -use Automattic\Jetpack\Status;
3 +defined( 'WPCOM_JSON_API__DEBUG' ) or define( 'WPCOM_JSON_API__DEBUG', false );
9 4
10 -if ( ! defined( 'WPCOM_JSON_API__DEBUG' ) ) {
11 - define( 'WPCOM_JSON_API__DEBUG', false );
12 -}
5 +require_once dirname( __FILE__ ) . '/sal/class.json-api-platform.php';
13 6
14 -require_once __DIR__ . '/sal/class.json-api-platform.php';
15 -
16 -/**
17 - * Jetpack JSON API.
18 - */
19 7 class WPCOM_JSON_API {
20 - /**
21 - * Static instance.
22 - *
23 - * @todo This should be private.
24 - * @var self|null
25 - */
26 - public static $self = null;
8 + static $self = null;
27 9
28 - /**
29 - * Registered endpoints.
30 - *
31 - * @var WPCOM_JSON_API_Endpoint[]
32 - */
33 10 public $endpoints = array();
34 11
35 - /**
36 - * Endpoint being processed.
37 - *
38 - * @var WPCOM_JSON_API_Endpoint
39 - */
40 - public $endpoint = null;
41 -
42 - /**
43 - * Token details.
44 - *
45 - * @var array
46 - */
47 12 public $token_details = array();
48 13
49 - /**
50 - * Request HTTP method.
51 - *
52 - * @var string
53 - */
54 14 public $method = '';
55 -
56 - /**
57 - * Request URL.
58 - *
59 - * @var string
60 - */
61 15 public $url = '';
62 -
63 - /**
64 - * Path part of the request URL.
65 - *
66 - * @var string
67 - */
68 16 public $path = '';
69 -
70 - /**
71 - * Version extracted from the request URL.
72 - *
73 - * @var string|null
74 - */
75 17 public $version = null;
76 -
77 - /**
78 - * Parsed query data.
79 - *
80 - * @var array
81 - */
82 18 public $query = array();
83 -
84 - /**
85 - * Post body, if the request is a POST.
86 - *
87 - * @var string|null
88 - */
89 19 public $post_body = null;
90 -
91 - /**
92 - * Copy of `$_FILES` if the request is a POST.
93 - *
94 - * @var null|array
95 - */
96 20 public $files = null;
97 -
98 - /**
99 - * Content type of the request.
100 - *
101 - * @var string|null
102 - */
103 21 public $content_type = null;
104 -
105 - /**
106 - * Value of `$_SERVER['HTTP_ACCEPT']`, if any
107 - *
108 - * @var string
109 - */
110 22 public $accept = '';
111 23
112 - /**
113 - * Value of `$_SERVER['HTTPS']`, or "--UNset--" if unset.
114 - *
115 - * @var string
116 - */
117 - public $_server_https; // phpcs:ignore PSR2.Classes.PropertyDeclaration.Underscore
118 -
119 - /**
120 - * Whether to exit after serving a response.
121 - *
122 - * @var bool
123 - */
24 + public $_server_https;
124 25 public $exit = true;
125 -
126 - /**
127 - * Public API scheme.
128 - *
129 - * @var string
130 - */
131 26 public $public_api_scheme = 'https';
132 27
133 - /**
134 - * Output status code.
135 - *
136 - * @var int
137 - */
138 28 public $output_status_code = 200;
139 29
140 - /**
141 - * Trapped error.
142 - *
143 - * @var null|array
144 - */
145 30 public $trapped_error = null;
146 -
147 - /**
148 - * Whether output has been done.
149 - *
150 - * @var bool
151 - */
152 31 public $did_output = false;
153 32
154 - /**
155 - * Extra HTTP headers.
156 - *
157 - * @var string
158 - */
159 33 public $extra_headers = array();
160 34
161 35 /**
162 - * AMP source origin.
163 - *
164 - * @var string
165 - */
166 - public $amp_source_origin = null;
167 -
168 - /**
169 - * Initialize.
170 - *
171 - * @param string|null $method As for `$this->setup_inputs()`.
172 - * @param string|null $url As for `$this->setup_inputs()`.
173 - * @param string|null $post_body As for `$this->setup_inputs()`.
174 36 * @return WPCOM_JSON_API instance
175 37 */
176 - public static function init( $method = null, $url = null, $post_body = null ) {
177 - if ( ! self::$self ) {
178 - self::$self = new static( $method, $url, $post_body );
38 + static function init( $method = null, $url = null, $post_body = null ) {
39 + if ( !self::$self ) {
40 + $class = function_exists( 'get_called_class' ) ? get_called_class() : __CLASS__; // phpcs:ignore PHPCompatibility.PHP.NewFunctions.get_called_classFound
41 + self::$self = new $class( $method, $url, $post_body );
179 42 }
180 43 return self::$self;
181 44 }
182 45
183 - /**
184 - * Add an endpoint.
185 - *
186 - * @param WPCOM_JSON_API_Endpoint $endpoint Endpoint to add.
187 - */
188 - public function add( WPCOM_JSON_API_Endpoint $endpoint ) {
189 - // @todo Determine if anything depends on this being serialized rather than e.g. JSON.
190 - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_serialize -- Legacy, possibly depended on elsewhere.
191 - $path_versions = serialize(
192 - array(
193 - $endpoint->path,
194 - $endpoint->min_version,
195 - $endpoint->max_version,
196 - )
197 - );
198 - if ( ! isset( $this->endpoints[ $path_versions ] ) ) {
199 - $this->endpoints[ $path_versions ] = array();
46 + function add( WPCOM_JSON_API_Endpoint $endpoint ) {
47 + $path_versions = serialize( array (
48 + $endpoint->path,
49 + $endpoint->min_version,
50 + $endpoint->max_version,
51 + ) );
52 + if ( !isset( $this->endpoints[$path_versions] ) ) {
53 + $this->endpoints[$path_versions] = array();
200 54 }
201 - $this->endpoints[ $path_versions ][ $endpoint->method ] = $endpoint;
55 + $this->endpoints[$path_versions][$endpoint->method] = $endpoint;
202 56 }
203 57
204 - /**
205 - * Determine if a string is truthy. If it's not a string, which can happen with
206 - * not well-formed data coming from Jetpack sites, we still consider it a truthy value.
207 - *
208 - * @param mixed $value true, 1, "1", "t", and "true" (case insensitive) are truthy, everything else isn't.
209 - * @return bool
210 - */
211 - public static function is_truthy( $value ) {
212 - if ( true === $value ) {
58 + static function is_truthy( $value ) {
59 + switch ( strtolower( (string) $value ) ) {
60 + case '1' :
61 + case 't' :
62 + case 'true' :
213 63 return true;
214 64 }
215 65
216 - if ( 1 === $value ) {
217 - return true;
218 - }
219 -
220 - if ( ! is_string( $value ) ) {
221 - return false;
222 - }
223 -
224 - switch ( strtolower( (string) $value ) ) {
225 - case '1':
226 - case 't':
227 - case 'true':
228 - return true;
229 - }
230 -
231 66 return false;
232 67 }
233 68
234 - /**
235 - * Determine if a string is falsey.
236 - *
237 - * @param mixed $value false, 0, "0", "f", and "false" (case insensitive) are falsey, everything else isn't.
238 - * @return bool
239 - */
240 - public static function is_falsy( $value ) {
241 - if ( false === $value ) {
242 - return true;
243 - }
244 -
245 - if ( 0 === $value ) {
246 - return true;
247 - }
248 -
249 - if ( ! is_string( $value ) ) {
250 - return false;
251 - }
252 -
69 + static function is_falsy( $value ) {
253 70 switch ( strtolower( (string) $value ) ) {
254 - case '0':
255 - case 'f':
256 - case 'false':
71 + case '0' :
72 + case 'f' :
73 + case 'false' :
257 74 return true;
258 75 }
259 76
260 77 return false;
@@ -259,154 +76,79 @@
259 76
260 77 return false;
261 78 }
262 79
263 - /**
264 - * Constructor.
265 - *
266 - * @todo This should be private.
267 - * @param string|null $method As for `$this->setup_inputs()`.
268 - * @param string|null $url As for `$this->setup_inputs()`.
269 - * @param string|null $post_body As for `$this->setup_inputs()`.
270 - */
271 - public function __construct( $method = null, $url = null, $post_body = null ) {
272 - $this->setup_inputs( $method, $url, $post_body );
80 + function __construct() {
81 + $args = func_get_args();
82 + call_user_func_array( array( $this, 'setup_inputs' ), $args );
273 83 }
274 84
275 - /**
276 - * Setup inputs.
277 - *
278 - * @param string|null $method Request HTTP method. Fetched from `$_SERVER` if null.
279 - * @param string|null $url URL requested. Determined from `$_SERVER` if null.
280 - * @param string|null $post_body POST body. Read from `php://input` if null and method is POST.
281 - */
282 - public function setup_inputs( $method = null, $url = null, $post_body = null ) {
283 - if ( $method === null ) {
284 - $this->method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( filter_var( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) ) : '';
85 + function setup_inputs( $method = null, $url = null, $post_body = null ) {
86 + if ( is_null( $method ) ) {
87 + $this->method = strtoupper( $_SERVER['REQUEST_METHOD'] );
285 88 } else {
286 89 $this->method = strtoupper( $method );
287 90 }
288 - if ( $url === null ) {
289 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sniff misses the esc_url_raw.
290 - $this->url = esc_url_raw( set_url_scheme( 'http://' . ( isset( $_SERVER['HTTP_HOST'] ) ? wp_unslash( $_SERVER['HTTP_HOST'] ) : '' ) . ( isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( $_SERVER['REQUEST_URI'] ) : '' ) ) );
91 + if ( is_null( $url ) ) {
92 + $this->url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
291 93 } else {
292 94 $this->url = $url;
293 95 }
294 96
295 - $parsed = wp_parse_url( $this->url );
296 - if ( ! empty( $parsed['path'] ) ) {
297 - $this->path = $parsed['path'];
298 - }
97 + $parsed = parse_url( $this->url );
98 + $this->path = $parsed['path'];
299 99
300 - if ( ! empty( $parsed['query'] ) ) {
100 + if ( !empty( $parsed['query'] ) ) {
301 101 wp_parse_str( $parsed['query'], $this->query );
302 102 }
303 103
304 - if ( ! empty( $_SERVER['HTTP_ACCEPT'] ) ) {
305 - $this->accept = filter_var( wp_unslash( $_SERVER['HTTP_ACCEPT'] ) );
104 + if ( isset( $_SERVER['HTTP_ACCEPT'] ) && $_SERVER['HTTP_ACCEPT'] ) {
105 + $this->accept = $_SERVER['HTTP_ACCEPT'];
306 106 }
307 107
308 108 if ( 'POST' === $this->method ) {
309 - if ( $post_body === null ) {
109 + if ( is_null( $post_body ) ) {
310 110 $this->post_body = file_get_contents( 'php://input' );
311 111
312 - if ( ! empty( $_SERVER['HTTP_CONTENT_TYPE'] ) ) {
313 - $this->content_type = filter_var( wp_unslash( $_SERVER['HTTP_CONTENT_TYPE'] ) );
314 - } elseif ( ! empty( $_SERVER['CONTENT_TYPE'] ) ) {
315 - $this->content_type = filter_var( wp_unslash( $_SERVER['CONTENT_TYPE'] ) );
316 - } elseif ( isset( $this->post_body[0] ) && '{' === $this->post_body[0] ) {
112 + if ( isset( $_SERVER['HTTP_CONTENT_TYPE'] ) && $_SERVER['HTTP_CONTENT_TYPE'] ) {
113 + $this->content_type = $_SERVER['HTTP_CONTENT_TYPE'];
114 + } elseif ( isset( $_SERVER['CONTENT_TYPE'] ) && $_SERVER['CONTENT_TYPE'] ) {
115 + $this->content_type = $_SERVER['CONTENT_TYPE'] ;
116 + } elseif ( '{' === $this->post_body[0] ) {
317 117 $this->content_type = 'application/json';
318 118 } else {
319 119 $this->content_type = 'application/x-www-form-urlencoded';
320 120 }
321 121
322 - if ( str_starts_with( strtolower( $this->content_type ), 'multipart/' ) ) {
323 - // phpcs:ignore WordPress.Security.NonceVerification.Missing
324 - $this->post_body = http_build_query( stripslashes_deep( $_POST ) );
325 - $this->files = $_FILES;
122 + if ( 0 === strpos( strtolower( $this->content_type ), 'multipart/' ) ) {
123 + $this->post_body = http_build_query( stripslashes_deep( $_POST ) );
124 + $this->files = $_FILES;
326 125 $this->content_type = 'multipart/form-data';
327 126 }
328 127 } else {
329 - $this->post_body = $post_body;
330 - $this->content_type = isset( $this->post_body[0] ) && '{' === $this->post_body[0] ? 'application/json' : 'application/x-www-form-urlencoded';
128 + $this->post_body = $post_body;
129 + $this->content_type = '{' === isset( $this->post_body[0] ) && $this->post_body[0] ? 'application/json' : 'application/x-www-form-urlencoded';
331 130 }
332 131 } else {
333 - $this->post_body = null;
132 + $this->post_body = null;
334 133 $this->content_type = null;
335 134 }
336 135
337 - $this->_server_https = array_key_exists( 'HTTPS', $_SERVER ) ? filter_var( wp_unslash( $_SERVER['HTTPS'] ) ) : '--UNset--';
136 + $this->_server_https = array_key_exists( 'HTTPS', $_SERVER ) ? $_SERVER['HTTPS'] : '--UNset--';
338 137 }
339 138
340 - /**
341 - * Initialize.
342 - *
343 - * @return null|WP_Error (although this implementation always returns null)
344 - */
345 - public function initialize() {
139 + function initialize() {
346 140 $this->token_details['blog_id'] = Jetpack_Options::get_option( 'id' );
347 - return null;
348 141 }
349 142
350 - /**
351 - * Checks if the current request is authorized with a blog token.
352 - * This method is overridden by a child class in WPCOM.
353 - *
354 - * @since 9.1.0
355 - *
356 - * @param boolean|int $site_id The site id.
357 - * @return boolean
358 - */
359 - public function is_jetpack_authorized_for_site( $site_id = false ) {
360 - if ( ! $this->token_details ) {
361 - return false;
362 - }
143 + function serve( $exit = true ) {
144 + ini_set( 'display_errors', false );
363 145
364 - $token_details = (object) $this->token_details;
365 -
366 - $site_in_token = (int) $token_details->blog_id;
367 -
368 - if ( $site_in_token < 1 ) {
369 - return false;
370 - }
371 -
372 - if ( $site_id && $site_in_token !== (int) $site_id ) {
373 - return false;
374 - }
375 -
376 - if ( (int) get_current_user_id() !== 0 ) {
377 - // If Jetpack blog token is used, no logged-in user should exist.
378 - return false;
379 - }
380 -
381 - return true;
382 - }
383 -
384 - /**
385 - * Checks if the current request is authorized with an upload token.
386 - * This method is overridden by a child class in WPCOM.
387 - *
388 - * @since 13.5
389 - * @return boolean
390 - */
391 - public function is_authorized_with_upload_token() {
392 - return false;
393 - }
394 -
395 - /**
396 - * Serve.
397 - *
398 - * @param bool $exit Whether to exit.
399 - * @return string|null Content type (assuming it didn't exit), or null in certain error cases.
400 - */
401 - public function serve( $exit = true ) {
402 - ini_set( 'display_errors', false ); // phpcs:ignore WordPress.PHP.IniSet.display_errors_Blacklisted
403 -
404 146 $this->exit = (bool) $exit;
405 147
406 148 // This was causing problems with Jetpack, but is necessary for wpcom
407 149 // @see https://github.com/Automattic/jetpack/pull/2603
408 - // @see r124548-wpcom .
150 + // @see r124548-wpcom
409 151 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
410 152 add_filter( 'home_url', array( $this, 'ensure_http_scheme_of_home_url' ), 10, 3 );
411 153 }
412 154
@@ -414,9 +156,9 @@
414 156
415 157 add_filter( 'comment_edit_pre', array( $this, 'comment_edit_pre' ) );
416 158
417 159 $initialization = $this->initialize();
418 - if ( 'OPTIONS' === $this->method ) {
160 + if ( 'OPTIONS' == $this->method ) {
419 161 /**
420 162 * Fires before the page output.
421 163 * Can be used to specify custom header options.
422 164 *
@@ -432,33 +174,32 @@
432 174 $this->output_error( $initialization );
433 175 return;
434 176 }
435 177
436 - // Normalize path and extract API version.
178 + // Normalize path and extract API version
437 179 $this->path = untrailingslashit( $this->path );
438 - if ( preg_match( '#^/rest/v(\d+(\.\d+)*)#', $this->path, $matches ) ) {
439 - $this->path = substr( $this->path, strlen( $matches[0] ) );
440 - $this->version = $matches[1];
441 - }
180 + preg_match( '#^/rest/v(\d+(\.\d+)*)#', $this->path, $matches );
181 + $this->path = substr( $this->path, strlen( $matches[0] ) );
182 + $this->version = $matches[1];
442 183
443 184 $allowed_methods = array( 'GET', 'POST' );
444 - $four_oh_five = false;
185 + $four_oh_five = false;
445 186
446 - $is_help = preg_match( '#/help/?$#i', $this->path );
187 + $is_help = preg_match( '#/help/?$#i', $this->path );
447 188 $matching_endpoints = array();
448 189
449 190 if ( $is_help ) {
450 191 $origin = get_http_origin();
451 192
452 - if ( ! empty( $origin ) && 'GET' === $this->method ) {
193 + if ( !empty( $origin ) && 'GET' == $this->method ) {
453 194 header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
454 195 }
455 196
456 197 $this->path = substr( rtrim( $this->path, '/' ), 0, -5 );
457 - // Show help for all matching endpoints regardless of method.
458 - $methods = $allowed_methods;
198 + // Show help for all matching endpoints regardless of method
199 + $methods = $allowed_methods;
459 200 $find_all_matching_endpoints = true;
460 - // How deep to truncate each endpoint's path to see if it matches this help request.
201 + // How deep to truncate each endpoint's path to see if it matches this help request
461 202 $depth = substr_count( $this->path, '/' ) + 1;
462 203 if ( false !== stripos( $this->accept, 'javascript' ) || false !== stripos( $this->accept, 'json' ) ) {
463 204 $help_content_type = 'json';
464 205 } else {
@@ -463,50 +204,50 @@
463 204 $help_content_type = 'json';
464 205 } else {
465 206 $help_content_type = 'html';
466 207 }
467 - } elseif ( in_array( $this->method, $allowed_methods, true ) ) {
468 - // Only serve requested method.
469 - $methods = array( $this->method );
470 - $find_all_matching_endpoints = false;
471 208 } else {
472 - // We don't allow this requested method - find matching endpoints and send 405.
473 - $methods = $allowed_methods;
474 - $find_all_matching_endpoints = true;
475 - $four_oh_five = true;
209 + if ( in_array( $this->method, $allowed_methods ) ) {
210 + // Only serve requested method
211 + $methods = array( $this->method );
212 + $find_all_matching_endpoints = false;
213 + } else {
214 + // We don't allow this requested method - find matching endpoints and send 405
215 + $methods = $allowed_methods;
216 + $find_all_matching_endpoints = true;
217 + $four_oh_five = true;
218 + }
476 219 }
477 220
478 - // Find which endpoint to serve.
221 + // Find which endpoint to serve
479 222 $found = false;
480 223 foreach ( $this->endpoints as $endpoint_path_versions => $endpoints_by_method ) {
481 - // @todo Determine if anything depends on this being serialized rather than e.g. JSON.
482 - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize -- Legacy, possibly depended on elsewhere.
483 224 $endpoint_path_versions = unserialize( $endpoint_path_versions );
484 - $endpoint_path = $endpoint_path_versions[0];
485 - $endpoint_min_version = $endpoint_path_versions[1];
486 - $endpoint_max_version = $endpoint_path_versions[2];
225 + $endpoint_path = $endpoint_path_versions[0];
226 + $endpoint_min_version = $endpoint_path_versions[1];
227 + $endpoint_max_version = $endpoint_path_versions[2];
487 228
488 - // Make sure max_version is not less than min_version.
229 + // Make sure max_version is not less than min_version
489 230 if ( version_compare( $endpoint_max_version, $endpoint_min_version, '<' ) ) {
490 231 $endpoint_max_version = $endpoint_min_version;
491 232 }
492 233
493 234 foreach ( $methods as $method ) {
494 - if ( ! isset( $endpoints_by_method[ $method ] ) ) {
235 + if ( !isset( $endpoints_by_method[$method] ) ) {
495 236 continue;
496 237 }
497 238
498 - // Normalize.
239 + // Normalize
499 240 $endpoint_path = untrailingslashit( $endpoint_path );
500 241 if ( $is_help ) {
501 - // Truncate path at help depth.
502 - $endpoint_path = implode( '/', array_slice( explode( '/', $endpoint_path ), 0, $depth ) );
242 + // Truncate path at help depth
243 + $endpoint_path = join( '/', array_slice( explode( '/', $endpoint_path ), 0, $depth ) );
503 244 }
504 245
505 - // Generate regular expression from sprintf().
246 + // Generate regular expression from sprintf()
506 247 $endpoint_path_regex = str_replace( array( '%s', '%d' ), array( '([^/?&]+)', '(\d+)' ), $endpoint_path );
507 248
508 - if ( ! preg_match( "#^$endpoint_path_regex\$#", $this->path, $path_pieces ) ) {
249 + if ( !preg_match( "#^$endpoint_path_regex\$#", $this->path, $path_pieces ) ) {
509 250 // This endpoint does not match the requested path.
510 251 continue;
511 252 }
512 253
@@ -517,18 +258,18 @@
517 258
518 259 $found = true;
519 260
520 261 if ( $find_all_matching_endpoints ) {
521 - $matching_endpoints[] = array( $endpoints_by_method[ $method ], $path_pieces );
262 + $matching_endpoints[] = array( $endpoints_by_method[$method], $path_pieces );
522 263 } else {
523 - // The method parameters are now in $path_pieces.
524 - $endpoint = $endpoints_by_method[ $method ];
264 + // The method parameters are now in $path_pieces
265 + $endpoint = $endpoints_by_method[$method];
525 266 break 2;
526 267 }
527 268 }
528 269 }
529 270
530 - if ( ! $found ) {
271 + if ( !$found ) {
531 272 return $this->output( 404, '', 'text/plain' );
532 273 }
533 274
534 275 if ( $four_oh_five ) {
@@ -536,16 +277,10 @@
536 277 foreach ( $matching_endpoints as $matching_endpoint ) {
537 278 $allowed_methods[] = $matching_endpoint[0]->method;
538 279 }
539 280
540 - header( 'Allow: ' . strtoupper( implode( ',', array_unique( $allowed_methods ) ) ) );
541 - return $this->output(
542 - 405,
543 - array(
544 - 'error' => 'not_allowed',
545 - 'error_message' => 'Method not allowed',
546 - )
547 - );
281 + header( 'Allow: ' . strtoupper( join( ',', array_unique( $allowed_methods ) ) ) );
282 + return $this->output( 405, array( 'error' => 'not_allowed', 'error_message' => 'Method not allowed' ) );
548 283 }
549 284
550 285 if ( $is_help ) {
551 286 /**
@@ -559,25 +294,23 @@
559 294 $proxied = function_exists( 'wpcom_is_proxied_request' ) ? wpcom_is_proxied_request() : false;
560 295 if ( 'json' === $help_content_type ) {
561 296 $docs = array();
562 297 foreach ( $matching_endpoints as $matching_endpoint ) {
563 - if ( $matching_endpoint[0]->is_publicly_documentable() || $proxied || WPCOM_JSON_API__DEBUG ) {
298 + if ( $matching_endpoint[0]->is_publicly_documentable() || $proxied || WPCOM_JSON_API__DEBUG )
564 299 $docs[] = call_user_func( array( $matching_endpoint[0], 'generate_documentation' ) );
565 - }
566 300 }
567 301 return $this->output( 200, $docs );
568 302 } else {
569 303 status_header( 200 );
570 304 foreach ( $matching_endpoints as $matching_endpoint ) {
571 - if ( $matching_endpoint[0]->is_publicly_documentable() || $proxied || WPCOM_JSON_API__DEBUG ) {
305 + if ( $matching_endpoint[0]->is_publicly_documentable() || $proxied || WPCOM_JSON_API__DEBUG )
572 306 call_user_func( array( $matching_endpoint[0], 'document' ) );
573 - }
574 307 }
575 308 }
576 309 exit;
577 310 }
578 311
579 - if ( $endpoint->in_testing && ! WPCOM_JSON_API__DEBUG ) {
312 + if ( $endpoint->in_testing && !WPCOM_JSON_API__DEBUG ) {
580 313 return $this->output( 404, '', 'text/plain' );
581 314 }
582 315
583 316 /** This action is documented in class.json-api.php */
@@ -584,9 +317,9 @@
584 317 do_action( 'wpcom_json_api_output', $endpoint->stat );
585 318
586 319 $response = $this->process_request( $endpoint, $path_pieces );
587 320
588 - if ( ! $response && ! is_array( $response ) ) {
321 + if ( !$response && !is_array( $response ) ) {
589 322 return $this->output( 500, '', 'text/plain' );
590 323 } elseif ( is_wp_error( $response ) ) {
591 324 return $this->output_error( $response );
592 325 }
@@ -596,35 +329,20 @@
596 329
597 330 return $this->output( $output_status_code, $response, 'application/json', $this->extra_headers );
598 331 }
599 332
600 - /**
601 - * Process a request.
602 - *
603 - * @param WPCOM_JSON_API_Endpoint $endpoint Endpoint.
604 - * @param array $path_pieces Path pieces.
605 - * @return array|WP_Error Return value from the endpoint's callback.
606 - */
607 - public function process_request( WPCOM_JSON_API_Endpoint $endpoint, $path_pieces ) {
333 + function process_request( WPCOM_JSON_API_Endpoint $endpoint, $path_pieces ) {
608 334 $this->endpoint = $endpoint;
609 335 return call_user_func_array( array( $endpoint, 'callback' ), $path_pieces );
610 336 }
611 337
612 - /**
613 - * Output a response or error without exiting.
614 - *
615 - * @param int $status_code HTTP status code.
616 - * @param mixed $response Response data.
617 - * @param string $content_type Content type of the response.
618 - */
619 - public function output_early( $status_code, $response = null, $content_type = 'application/json' ) {
620 - $exit = $this->exit;
338 + function output_early( $status_code, $response = null, $content_type = 'application/json' ) {
339 + $exit = $this->exit;
621 340 $this->exit = false;
622 - if ( is_wp_error( $response ) ) {
341 + if ( is_wp_error( $response ) )
623 342 $this->output_error( $response );
624 - } else {
343 + else
625 344 $this->output( $status_code, $response, $content_type );
626 - }
627 345 $this->exit = $exit;
628 346 if ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
629 347 $this->finish_request();
630 348 }
@@ -629,61 +347,36 @@
629 347 $this->finish_request();
630 348 }
631 349 }
632 350
633 - /**
634 - * Set output status code.
635 - *
636 - * @param int $code HTTP status code.
637 - */
638 - public function set_output_status_code( $code = 200 ) {
351 + function set_output_status_code( $code = 200 ) {
639 352 $this->output_status_code = $code;
640 353 }
641 354
642 - /**
643 - * Output a response.
644 - *
645 - * @param int $status_code HTTP status code.
646 - * @param mixed $response Response data.
647 - * @param string $content_type Content type of the response.
648 - * @param array $extra Additional HTTP headers.
649 - * @return string Content type (assuming it didn't exit).
650 - */
651 - public function output( $status_code, $response = null, $content_type = 'application/json', $extra = array() ) {
652 - $status_code = (int) $status_code;
653 -
654 - // In case output() was called before the callback returned.
355 + function output( $status_code, $response = null, $content_type = 'application/json', $extra = array() ) {
356 + // In case output() was called before the callback returned
655 357 if ( $this->did_output ) {
656 - if ( $this->exit ) {
358 + if ( $this->exit )
657 359 exit;
658 - }
659 360 return $content_type;
660 361 }
661 362 $this->did_output = true;
662 363
663 364 // 400s and 404s are allowed for all origins
664 - if ( 404 === $status_code || 400 === $status_code ) {
365 + if ( 404 == $status_code || 400 == $status_code )
665 366 header( 'Access-Control-Allow-Origin: *' );
666 - }
667 367
668 - /* Add headers for form submission from <amp-form/> */
669 - if ( $this->amp_source_origin ) {
670 - header( 'Access-Control-Allow-Origin: ' . wp_unslash( $this->amp_source_origin ) );
671 - header( 'Access-Control-Allow-Credentials: true' );
368 + if ( is_null( $response ) ) {
369 + $response = new stdClass;
672 370 }
673 371
674 - if ( $response === null ) {
675 - $response = new stdClass();
676 - }
677 -
678 - if ( 'text/plain' === $content_type ||
679 - 'text/html' === $content_type ) {
372 + if ( 'text/plain' === $content_type ) {
680 373 status_header( (int) $status_code );
681 - header( 'Content-Type: ' . $content_type );
682 - foreach ( $extra as $key => $value ) {
374 + header( 'Content-Type: text/plain' );
375 + foreach( $extra as $key => $value ) {
683 376 header( "$key: $value" );
684 377 }
685 - echo $response; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
378 + echo $response;
686 379 if ( $this->exit ) {
687 380 exit;
688 381 }
689 382
@@ -694,26 +387,23 @@
694 387
695 388 if ( isset( $this->query['http_envelope'] ) && self::is_truthy( $this->query['http_envelope'] ) ) {
696 389 $headers = array(
697 390 array(
698 - 'name' => 'Content-Type',
391 + 'name' => 'Content-Type',
699 392 'value' => $content_type,
700 - ),
393 + )
701 394 );
702 395
703 - foreach ( $extra as $key => $value ) {
704 - $headers[] = array(
705 - 'name' => $key,
706 - 'value' => $value,
707 - );
396 + foreach( $extra as $key => $value ) {
397 + $headers[] = array( 'name' => $key, 'value' => $value );
708 398 }
709 399
710 - $response = array(
711 - 'code' => (int) $status_code,
400 + $response = array(
401 + 'code' => (int) $status_code,
712 402 'headers' => $headers,
713 - 'body' => $response,
403 + 'body' => $response,
714 404 );
715 - $status_code = 200;
405 + $status_code = 200;
716 406 $content_type = 'application/json';
717 407 }
718 408
719 409 status_header( (int) $status_code );
@@ -726,15 +416,15 @@
726 416
727 417 if ( $callback ) {
728 418 // Mitigate Rosetta Flash [1] by setting the Content-Type-Options: nosniff header
729 419 // and by prepending the JSONP response with a JS comment.
730 - // [1] <https://blog.miki.it/2014/7/8/abusing-jsonp-with-rosetta-flash/index.html>.
731 - echo "/**/$callback("; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- This is JSONP output, not HTML.
420 + // [1] http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
421 + echo "/**/$callback(";
732 422
733 423 }
734 - echo $this->json_encode( $response ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- This is JSON or JSONP output, not HTML.
424 + echo $this->json_encode( $response );
735 425 if ( $callback ) {
736 - echo ');';
426 + echo ");";
737 427 }
738 428
739 429 if ( $this->exit ) {
740 430 exit;
@@ -742,23 +432,17 @@
742 432
743 433 return $content_type;
744 434 }
745 435
746 - /**
747 - * Serialize an error.
748 - *
749 - * @param WP_Error $error Error.
750 - * @return array with 'status_code' and 'errors' data.
751 - */
752 - public static function serializable_error( $error ) {
436 + public static function serializable_error ( $error ) {
753 437
754 438 $status_code = $error->get_error_data();
755 439
756 - if ( is_array( $status_code ) && isset( $status_code['status_code'] ) ) {
440 + if ( is_array( $status_code ) ) {
757 441 $status_code = $status_code['status_code'];
758 442 }
759 443
760 - if ( ! $status_code ) {
444 + if ( !$status_code ) {
761 445 $status_code = 400;
762 446 }
763 447 $response = array(
764 448 'error' => $error->get_error_code(),
@@ -764,41 +448,27 @@
764 448 'error' => $error->get_error_code(),
765 449 'message' => $error->get_error_message(),
766 450 );
767 451
768 - $additional_data = $error->get_error_data( 'additional_data' );
769 - if ( $additional_data ) {
452 + if ( $additional_data = $error->get_error_data( 'additional_data' ) ) {
770 453 $response['data'] = $additional_data;
771 454 }
772 455
773 456 return array(
774 457 'status_code' => $status_code,
775 - 'errors' => $response,
458 + 'errors' => $response
776 459 );
777 460 }
778 461
779 - /**
780 - * Output an error.
781 - *
782 - * @param WP_Error $error Error.
783 - * @return string Content type (assuming it didn't exit).
784 - */
785 - public function output_error( $error ) {
786 - $error_response = static::serializable_error( $error );
462 + function output_error( $error ) {
463 + $error_response = $this->serializable_error( $error );
787 464
788 - return $this->output( $error_response['status_code'], $error_response['errors'] );
465 + return $this->output( $error_response[ 'status_code'], $error_response['errors'] );
789 466 }
790 467
791 - /**
792 - * Filter fields in a response.
793 - *
794 - * @param array|object $response Response.
795 - * @return array|object Filtered response.
796 - */
797 - public function filter_fields( $response ) {
798 - if ( empty( $this->query['fields'] ) || ( is_array( $response ) && ! empty( $response['error'] ) ) || ! empty( $this->endpoint->custom_fields_filtering ) ) {
468 + function filter_fields( $response ) {
469 + if ( empty( $this->query['fields'] ) || ( is_array( $response ) && ! empty( $response['error'] ) ) || ! empty( $this->endpoint->custom_fields_filtering ) )
799 470 return $response;
800 - }
801 471
802 472 $fields = array_map( 'trim', explode( ',', $this->query['fields'] ) );
803 473
804 474 if ( is_object( $response ) ) {
@@ -826,16 +496,14 @@
826 496 'users',
827 497 );
828 498
829 499 foreach ( $keys_to_filter as $key_to_filter ) {
830 - if ( ! isset( $response[ $key_to_filter ] ) || $has_filtered ) {
500 + if ( ! isset( $response[ $key_to_filter ] ) || $has_filtered )
831 501 continue;
832 - }
833 502
834 503 foreach ( $response[ $key_to_filter ] as $key => $values ) {
835 504 if ( is_object( $values ) ) {
836 505 if ( is_object( $response[ $key_to_filter ] ) ) {
837 - // phpcs:ignore Squiz.PHP.DisallowMultipleAssignments.Found -- False positive.
838 506 $response[ $key_to_filter ]->$key = (object) array_intersect_key( ( (array) $values ), array_flip( $fields ) );
839 507 } elseif ( is_array( $response[ $key_to_filter ] ) ) {
840 508 $response[ $key_to_filter ][ $key ] = (object) array_intersect_key( ( (array) $values ), array_flip( $fields ) );
841 509 }
@@ -850,9 +518,9 @@
850 518
851 519 if ( ! $has_filtered ) {
852 520 if ( is_object( $response ) ) {
853 521 $response = (object) array_intersect_key( (array) $response, array_flip( $fields ) );
854 - } elseif ( is_array( $response ) ) {
522 + } else if ( is_array( $response ) ) {
855 523 $response = array_intersect_key( $response, array_flip( $fields ) );
856 524 }
857 525 }
858 526
@@ -858,19 +526,9 @@
858 526
859 527 return $response;
860 528 }
861 529
862 - /**
863 - * Filter for `home_url`.
864 - *
865 - * If `$original_scheme` is null, turns an https URL to http.
866 - *
867 - * @param string $url The complete home URL including scheme and path.
868 - * @param string $path Path relative to the home URL. Blank string if no path is specified.
869 - * @param string|null $original_scheme Scheme to give the home URL context. Accepts 'http', 'https', 'relative', 'rest', or null.
870 - * @return string URL.
871 - */
872 - public function ensure_http_scheme_of_home_url( $url, $path, $original_scheme ) {
530 + function ensure_http_scheme_of_home_url( $url, $path, $original_scheme ) {
873 531 if ( $original_scheme ) {
874 532 return $url;
875 533 }
876 534
@@ -876,78 +534,36 @@
876 534
877 535 return preg_replace( '#^https:#', 'http:', $url );
878 536 }
879 537
880 - /**
881 - * Decode HTML special characters in comment content.
882 - *
883 - * @param string $comment_content Comment content.
884 - * @return string
885 - */
886 - public function comment_edit_pre( $comment_content ) {
538 + function comment_edit_pre( $comment_content ) {
887 539 return htmlspecialchars_decode( $comment_content, ENT_QUOTES );
888 540 }
889 541
890 - /**
891 - * JSON encode.
892 - *
893 - * @param mixed $data Data.
894 - * @return string|false
895 - */
896 - public function json_encode( $data ) {
897 - return wp_json_encode( $data );
542 + function json_encode( $data ) {
543 + return json_encode( $data );
898 544 }
899 545
900 - /**
901 - * Test if a string ends with a string.
902 - *
903 - * @param string $haystack String to check.
904 - * @param string $needle Suffix to check.
905 - * @return bool
906 - */
907 - public function ends_with( $haystack, $needle ) {
908 - return substr( $haystack, -strlen( $needle ) ) === $needle;
546 + function ends_with( $haystack, $needle ) {
547 + return $needle === substr( $haystack, -strlen( $needle ) );
909 548 }
910 549
911 - /**
912 - * Returns the site's blog_id in the WP.com ecosystem
913 - *
914 - * @return int
915 - */
916 - public function get_blog_id_for_output() {
550 + // Returns the site's blog_id in the WP.com ecosystem
551 + function get_blog_id_for_output() {
917 552 return $this->token_details['blog_id'];
918 553 }
919 554
920 - /**
921 - * Returns the site's local blog_id.
922 - *
923 - * @param int $blog_id Blog ID.
924 - * @return int
925 - */
926 - public function get_blog_id( $blog_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
555 + // Returns the site's local blog_id
556 + function get_blog_id( $blog_id ) {
927 557 return $GLOBALS['blog_id'];
928 558 }
929 559
930 - /**
931 - * Switch to blog and validate user.
932 - *
933 - * @param int $blog_id Blog ID.
934 - * @param bool $verify_token_for_blog Whether to verify the token.
935 - * @return int Blog ID.
936 - */
937 - public function switch_to_blog_and_validate_user( $blog_id = 0, $verify_token_for_blog = true ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
560 + function switch_to_blog_and_validate_user( $blog_id = 0, $verify_token_for_blog = true ) {
938 561 if ( $this->is_restricted_blog( $blog_id ) ) {
939 562 return new WP_Error( 'unauthorized', 'User cannot access this restricted blog', 403 );
940 563 }
941 - /**
942 - * If this is a private site we check for 2 things:
943 - * 1. In case of user based authentication, we need to check if the logged-in user has the 'read' capability.
944 - * 2. In case of site based authentication, make sure the endpoint accepts it.
945 - */
946 - if ( ( new Status() )->is_private_site() &&
947 - ! current_user_can( 'read' ) &&
948 - ! $this->endpoint->accepts_site_based_authentication()
949 - ) {
564 +
565 + if ( -1 == get_option( 'blog_public' ) && !current_user_can( 'read' ) ) {
950 566 return new WP_Error( 'unauthorized', 'User cannot access this private blog.', 403 );
951 567 }
952 568
953 569 return $blog_id;
@@ -952,15 +568,10 @@
952 568
953 569 return $blog_id;
954 570 }
955 571
956 - /**
957 - * Returns true if the specified blog ID is a restricted blog
958 - *
959 - * @param int $blog_id Blog ID.
960 - * @return bool
961 - */
962 - public function is_restricted_blog( $blog_id ) {
572 + // Returns true if the specified blog ID is a restricted blog
573 + function is_restricted_blog( $blog_id ) {
963 574 /**
964 575 * Filters all REST API access and return a 403 unauthorized response for all Restricted blog IDs.
965 576 *
966 577 * @module json-api
@@ -969,99 +580,47 @@
969 580 *
970 581 * @param array $array Array of Blog IDs.
971 582 */
972 583 $restricted_blog_ids = apply_filters( 'wpcom_json_api_restricted_blog_ids', array() );
973 - return true === in_array( $blog_id, $restricted_blog_ids ); // phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict -- I don't trust filters to return the right types.
584 + return true === in_array( $blog_id, $restricted_blog_ids );
974 585 }
975 586
976 - /**
977 - * Post like count.
978 - *
979 - * @param int $blog_id Blog ID.
980 - * @param int $post_id Post ID.
981 - * @return int
982 - */
983 - public function post_like_count( $blog_id, $post_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
587 + function post_like_count( $blog_id, $post_id ) {
984 588 return 0;
985 589 }
986 590
987 - /**
988 - * Is liked?
989 - *
990 - * @param int $blog_id Blog ID.
991 - * @param int $post_id Post ID.
992 - * @return bool
993 - */
994 - public function is_liked( $blog_id, $post_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
591 + function is_liked( $blog_id, $post_id ) {
995 592 return false;
996 593 }
997 594
998 - /**
999 - * Is reblogged?
1000 - *
1001 - * @param int $blog_id Blog ID.
1002 - * @param int $post_id Post ID.
1003 - * @return bool
1004 - */
1005 - public function is_reblogged( $blog_id, $post_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
595 + function is_reblogged( $blog_id, $post_id ) {
1006 596 return false;
1007 597 }
1008 598
1009 - /**
1010 - * Is following?
1011 - *
1012 - * @param int $blog_id Blog ID.
1013 - * @return bool
1014 - */
1015 - public function is_following( $blog_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
599 + function is_following( $blog_id ) {
1016 600 return false;
1017 601 }
1018 602
1019 - /**
1020 - * Add global ID.
1021 - *
1022 - * @param int $blog_id Blog ID.
1023 - * @param int $post_id Post ID.
1024 - * @return string
1025 - */
1026 - public function add_global_ID( $blog_id, $post_id ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable, WordPress.NamingConventions.ValidFunctionName.MethodNameInvalid
603 + function add_global_ID( $blog_id, $post_id ) {
1027 604 return '';
1028 605 }
1029 606
1030 - /**
1031 - * Return a count of comment likes.
1032 - * This method is overridden by a child class in WPCOM.
1033 - *
1034 - * @since 13.5
1035 - * @return int
1036 - */
1037 - public function comment_like_count() {
1038 - func_get_args(); // @phan-suppress-current-line PhanPluginUseReturnValueInternalKnown -- This is just here so Phan realizes the wpcom version does this.
1039 - return 0;
1040 - }
1041 -
1042 - /**
1043 - * Get avatar URL.
1044 - *
1045 - * @param string $email Email.
1046 - * @param array $args Args for `get_avatar_url()`.
1047 - * @return string|false
1048 - */
1049 - public function get_avatar_url( $email, $args = null ) {
607 + function get_avatar_url( $email, $avatar_size = null ) {
1050 608 if ( function_exists( 'wpcom_get_avatar_url' ) ) {
1051 - $ret = wpcom_get_avatar_url( $email, $args['size'] ?? 96, $args['default'] ?? '', false, $args['force_default'] ?? false );
1052 - return $ret ? $ret[0] : false;
609 + return null === $avatar_size
610 + ? wpcom_get_avatar_url( $email )
611 + : wpcom_get_avatar_url( $email, $avatar_size );
1053 612 } else {
1054 - return null === $args
613 + return null === $avatar_size
1055 614 ? get_avatar_url( $email )
1056 - : get_avatar_url( $email, $args );
615 + : get_avatar_url( $email, $avatar_size );
1057 616 }
1058 617 }
1059 618
1060 619 /**
1061 - * Counts the number of comments on a site, including certain comment types.
620 + * Counts the number of comments on a site, excluding certain comment types.
1062 621 *
1063 - * @param int $post_id Post ID.
622 + * @param $post_id int Post ID.
1064 623 * @return array Array of counts, matching the output of https://developer.wordpress.org/reference/functions/get_comment_count/.
1065 624 */
1066 625 public function wp_count_comments( $post_id ) {
1067 626 global $wpdb;
@@ -1074,44 +633,29 @@
1074 633 'all' => 0,
1075 634 );
1076 635
1077 636 /**
1078 - * Exclude certain comment types from comment counts in the REST API.
1079 - *
1080 - * @since 6.9.0
1081 - * @deprecated 11.1
1082 - * @module json-api
1083 - *
1084 - * @param array Array of comment types to exclude (default: 'order_note', 'webhook_delivery', 'review', 'action_log')
1085 - */
1086 - $exclude = apply_filters_deprecated( 'jetpack_api_exclude_comment_types_count', array( 'order_note', 'webhook_delivery', 'review', 'action_log' ), 'jetpack-11.1', 'jetpack_api_include_comment_types_count' ); // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
1087 -
1088 - /**
1089 - * Include certain comment types in comment counts in the REST API.
1090 - * Note: the default array of comment types includes an empty string,
1091 - * to support comments posted before WP 5.5, that used an empty string as comment type.
1092 - *
1093 - * @since 11.1
1094 - * @module json-api
1095 - *
1096 - * @param array Array of comment types to include (default: 'comment', 'pingback', 'trackback')
1097 - */
1098 - $include = apply_filters(
1099 - 'jetpack_api_include_comment_types_count',
1100 - array( 'comment', 'pingback', 'trackback', '' )
637 + * Exclude certain comment types from comment counts in the REST API.
638 + *
639 + * @since 6.9.0
640 + * @module json-api
641 + *
642 + * @param array Array of comment types to exclude (default: 'order_note', 'webhook_delivery', 'review', 'action_log')
643 + */
644 + $exclude = apply_filters( 'jetpack_api_exclude_comment_types_count',
645 + array( 'order_note', 'webhook_delivery', 'review', 'action_log' )
1101 646 );
1102 647
1103 - if ( empty( $include ) ) {
648 + if ( empty( $exclude ) ) {
1104 649 return wp_count_comments( $post_id );
1105 650 }
1106 651
1107 - array_walk( $include, 'esc_sql' );
652 + array_walk( $exclude, 'esc_sql' );
1108 653 $where = sprintf(
1109 - "WHERE comment_type IN ( '%s' )",
1110 - implode( "','", $include )
654 + "WHERE comment_type NOT IN ( '%s' )",
655 + implode( "','", $exclude )
1111 656 );
1112 657
1113 - // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- `$where` is built with escaping just above.
1114 658 $count = $wpdb->get_results(
1115 659 "SELECT comment_approved, COUNT(*) AS num_comments
1116 660 FROM $wpdb->comments
1117 661 {$where}
@@ -1117,9 +661,8 @@
1117 661 {$where}
1118 662 GROUP BY comment_approved
1119 663 "
1120 664 );
1121 - // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
1122 665
1123 666 $approved = array(
1124 667 '0' => 'moderated',
1125 668 '1' => 'approved',
@@ -1127,9 +670,9 @@
1127 670 'trash' => 'trash',
1128 671 'post-trashed' => 'post-trashed',
1129 672 );
1130 673
1131 - // <https://developer.wordpress.org/reference/functions/get_comment_count/#source>
674 + // https://developer.wordpress.org/reference/functions/get_comment_count/#source
1132 675 foreach ( $count as $row ) {
1133 676 if ( ! in_array( $row->comment_approved, array( 'post-trashed', 'trash', 'spam' ), true ) ) {
1134 677 $counts['all'] += $row->num_comments;
1135 678 $counts['total_comments'] += $row->num_comments;
@@ -1152,30 +695,19 @@
1152 695 return $counts;
1153 696 }
1154 697
1155 698 /**
1156 - * Traps `wp_die()` calls and outputs a JSON response instead.
699 + * traps `wp_die()` calls and outputs a JSON response instead.
1157 700 * The result is always output, never returned.
1158 701 *
1159 702 * @param string|null $error_code Call with string to start the trapping. Call with null to stop.
1160 703 * @param int $http_status HTTP status code, 400 by default.
1161 704 */
1162 - public function trap_wp_die( $error_code = null, $http_status = 400 ) {
1163 - // Determine the filter name; based on the conditionals inside the wp_die function.
1164 - if ( wp_is_json_request() ) {
1165 - $die_handler = 'wp_die_json_handler';
1166 - } elseif ( wp_is_jsonp_request() ) {
1167 - $die_handler = 'wp_die_jsonp_handler';
1168 - } elseif ( wp_is_xml_request() ) {
1169 - $die_handler = 'wp_die_xml_handler';
1170 - } else {
1171 - $die_handler = 'wp_die_handler';
1172 - }
1173 -
1174 - if ( $error_code === null ) {
705 + function trap_wp_die( $error_code = null, $http_status = 400 ) {
706 + if ( is_null( $error_code ) ) {
1175 707 $this->trapped_error = null;
1176 - // Stop trapping.
1177 - remove_filter( $die_handler, array( $this, 'wp_die_handler_callback' ) );
708 + // Stop trapping
709 + remove_filter( 'wp_die_handler', array( $this, 'wp_die_handler_callback' ) );
1178 710 return;
1179 711 }
1180 712
1181 713 // If API called via PHP, bail: don't do our custom wp_die(). Do the normal wp_die().
@@ -1182,10 +714,12 @@
1182 714 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
1183 715 if ( ! defined( 'REST_API_REQUEST' ) || ! REST_API_REQUEST ) {
1184 716 return;
1185 717 }
1186 - } elseif ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
1187 - return;
718 + } else {
719 + if ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
720 + return;
721 + }
1188 722 }
1189 723
1190 724 $this->trapped_error = array(
1191 725 'status' => $http_status,
@@ -1191,40 +725,24 @@
1191 725 'status' => $http_status,
1192 726 'code' => $error_code,
1193 727 'message' => '',
1194 728 );
1195 - // Start trapping.
1196 - add_filter( $die_handler, array( $this, 'wp_die_handler_callback' ) );
729 + // Start trapping
730 + add_filter( 'wp_die_handler', array( $this, 'wp_die_handler_callback' ) );
1197 731 }
1198 732
1199 - /**
1200 - * Filter function for `wp_die_handler` and similar filters.
1201 - *
1202 - * @return callable
1203 - */
1204 - public function wp_die_handler_callback() {
733 + function wp_die_handler_callback() {
1205 734 return array( $this, 'wp_die_handler' );
1206 735 }
1207 736
1208 - /**
1209 - * Handler for `wp_die` calls.
1210 - *
1211 - * @param string|WP_Error $message As for `wp_die()`.
1212 - * @param string|int $title As for `wp_die()`.
1213 - * @param string|array|int $args As for `wp_die()`.
1214 - * @return never
1215 - */
1216 - public function wp_die_handler( $message, $title = '', $args = array() ) {
737 + function wp_die_handler( $message, $title = '', $args = array() ) {
1217 738 // Allow wp_die calls to override HTTP status code...
1218 - $args = wp_parse_args(
1219 - $args,
1220 - array(
1221 - 'response' => $this->trapped_error['status'],
1222 - )
1223 - );
739 + $args = wp_parse_args( $args, array(
740 + 'response' => $this->trapped_error['status'],
741 + ) );
1224 742
1225 - // ... unless it's 500
1226 - if ( 500 !== (int) $args['response'] ) {
743 + // ... unless it's 500 ( see http://wp.me/pMz3w-5VV )
744 + if ( (int) $args['response'] !== 500 ) {
1227 745 $this->trapped_error['status'] = $args['response'];
1228 746 }
1229 747
1230 748 if ( $title ) {
@@ -1233,12 +751,12 @@
1233 751
1234 752 $this->trapped_error['message'] = wp_kses( $message, array() );
1235 753
1236 754 switch ( $this->trapped_error['code'] ) {
1237 - case 'comment_failure':
755 + case 'comment_failure' :
1238 756 if ( did_action( 'comment_duplicate_trigger' ) ) {
1239 757 $this->trapped_error['code'] = 'comment_duplicate';
1240 - } elseif ( did_action( 'comment_flood_trigger' ) ) {
758 + } else if ( did_action( 'comment_flood_trigger' ) ) {
1241 759 $this->trapped_error['code'] = 'comment_flood';
1242 760 }
1243 761 break;
1244 762 }
@@ -1243,32 +761,22 @@
1243 761 break;
1244 762 }
1245 763
1246 764 // We still want to exit so that code execution stops where it should.
1247 - // Attach the JSON output to the WordPress shutdown handler.
765 + // Attach the JSON output to the WordPress shutdown handler
1248 766 add_action( 'shutdown', array( $this, 'output_trapped_error' ), 0 );
1249 767 exit;
1250 768 }
1251 769
1252 - /**
1253 - * Output the trapped error.
1254 - */
1255 - public function output_trapped_error() {
770 + function output_trapped_error() {
1256 771 $this->exit = false; // We're already exiting once. Don't do it twice.
1257 - $this->output(
1258 - $this->trapped_error['status'],
1259 - (object) array(
1260 - 'error' => $this->trapped_error['code'],
1261 - 'message' => $this->trapped_error['message'],
1262 - )
1263 - );
772 + $this->output( $this->trapped_error['status'], (object) array(
773 + 'error' => $this->trapped_error['code'],
774 + 'message' => $this->trapped_error['message'],
775 + ) );
1264 776 }
1265 777
1266 - /**
1267 - * Finish the request.
1268 - */
1269 - public function finish_request() {
1270 - if ( function_exists( 'fastcgi_finish_request' ) ) {
778 + function finish_request() {
779 + if ( function_exists( 'fastcgi_finish_request' ) )
1271 780 return fastcgi_finish_request();
1272 - }
1273 781 }
1274 782 }