Ajax.php — Kirki – Freeform Page Builder, Website Builder & Customizer 6.3.0

kirki / includes / Ajax.php

kirki / includes Last commit date

API 2 days ago Admin 2 months ago Ajax 2 days ago ExportImport 2 weeks ago FormValidator 4 months ago Frontend 2 days ago Manager 2 weeks ago API.php 1 month ago Admin.php 4 months ago Ajax.php 2 days ago Apps.php 2 months ago ContentManager.php 4 months ago DbQueryUtils.php 3 months ago ElementVisibilityConditions.php 4 months ago Frontend.php 4 months ago HelperFunctions.php 2 days ago KirkiBase.php 2 months ago PostsQueryUtils.php 4 months ago Staging.php 1 month ago View.php 2 months ago

Ajax.php

967 lines

1	<?php
2
3	/**
4	* All Ajax/API calls will goes here
5	*
6	* @package kirki
7	*/
8
9	namespace Kirki;
10
11	if (!defined('ABSPATH')) {
12	exit; // Exit if accessed directly.
13	}
14
15	use Kirki\Ajax\Apps;
16	use Kirki\Ajax\Collaboration\Collaboration;
17	use Kirki\Ajax\DynamicContent;
18	use Kirki\Ajax\Media;
19	use Kirki\Ajax\Page;
20	use Kirki\Ajax\PageSettings;
21	use Kirki\Ajax\Symbol;
22	use Kirki\Ajax\UserData;
23	use Kirki\Ajax\Walkthrough;
24	use Kirki\Ajax\WordpressData;
25	use Kirki\Ajax\Collection;
26	use Kirki\Ajax\ExportImport;
27	use Kirki\Ajax\Comments;
28	use Kirki\Ajax\WpAdmin;
29	use Kirki\Ajax\Form;
30	use Kirki\Ajax\RBAC;
31	use Kirki\Ajax\Taxonomy;
32	use Kirki\Ajax\Users;
33	use Kirki\Ajax\TemplateExportImport;
34	use Kirki\App\Supports\EditorPreview;
35
36	/**
37	* Kirki Ajax handler
38	*/
39	class Ajax
40	{
41
42
43	/**
44	* Initialize the class
45	*
46	* @return void
47	*/
48	public function __construct()
49	{
50	/**
51	* Manage Post API call's from Builder
52	*/
53	add_action('wp_ajax_kirki_get_apis', array($this, 'kirki_get_apis'));
54	add_action('wp_ajax_kirki_post_apis', array($this, 'kirki_post_apis'));
55
56	// add_action('wp_ajax_nopriv_kirki_post_apis_nopriv', array($this, 'kirki_post_apis_nopriv'));
57	add_action('wp_ajax_nopriv_kirki_get_apis', array($this, 'kirki_get_apis'));
58
59	add_action('wp_ajax_nopriv_kirki_post_apis', array($this, 'kirki_post_apis'));
60	/**
61	* Manage Post API call's from WP Admin
62	*/
63	add_action('wp_ajax_kirki_wp_admin_get_apis', array($this, 'kirki_wp_admin_get_apis'));
64	add_action('wp_ajax_kirki_wp_admin_post_apis', array($this, 'kirki_wp_admin_post_apis'));
65	add_action('wp_ajax_nopriv_kirki_wp_admin_get_apis', array($this, 'kirki_wp_admin_unauthorized'));
66	add_action('wp_ajax_nopriv_kirki_wp_admin_post_apis', array($this, 'kirki_wp_admin_unauthorized'));
67
68	/**
69	* Manage Post API call's from Frontend (logged in not required)
70	*/
71	}
72
73	/**
74	* Initialize post api
75	*
76	* @return void
77	*/
78	// public function kirki_post_apis_nopriv()
79	// { //phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
80	// $endpoint = HelperFunctions::sanitize_text(isset($_POST['endpoint']) ? $_POST['endpoint'] : null);
81	// if (!HelperFunctions::is_api_header_post_editor_preview_token_valid()) {
82	// wp_send_json_error('Not authorized');
83	// }
84	// /**
85	// * Single SYMBOL API
86	// */
87	// if ($endpoint === 'get-single-symbol') {
88	// Symbol::fetch_symbol();
89	// die();
90	// }
91	// }
92
93	/**
94	* Initialize post api
95	*
96	* @return void
97	*/
98	public function kirki_post_apis()
99	{
100	HelperFunctions::verify_nonce('wp_rest');
101	if (!is_admin()) {
102	wp_send_json_error('Not authorized');
103	}
104	/**
105	* PAGE APIS
106	*/
107
108	//phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
109	$endpoint = HelperFunctions::sanitize_text(isset($_POST['endpoint']) ? $_POST['endpoint'] : null);
110
111	/**
112	* Editor-preview (read-only) requests.
113	*
114	* These endpoints only render HTML from content the preview link is
115	* already permitted to display — the same data the server-rendered
116	* preview outputs inline. Canvas fetches them over ajax instead, so
117	* without this branch they fall through the edit-access gate below and
118	* return nothing. Read-only and explicitly enumerated: no write
119	* endpoint is reachable here.
120	*/
121	if (!HelperFunctions::user_has_post_edit_access() && EditorPreview::has_valid_token()) {
122	// get-single-symbol is DELIBERATELY excluded: Symbol::get_single_symbol()
123	// ingests attacker-supplied `contentElement` graph nodes, which feed the
124	// PHP object-injection chain fixed in the 6.2.x CVE. It must remain
125	// reachable only behind the full/content edit-access gate below and must
126	// never be exposed to a shareable, read-only preview token.
127	if ($endpoint === 'get-collection-batch') {
128	Collection::get_collection_batch();
129	}
130
131	if ($endpoint === 'get-dynamic-content-batch') {
132	DynamicContent::get_dynamic_element_data_batch();
133	}
134
135	wp_send_json_error('Not authorized');
136	}
137
138	if (HelperFunctions::user_has_post_edit_access()) {
139	/**
140	* @deprecated
141	* @see POST /pages/{page_id}/{page_content_type}
142	*/
143	// if ( 'save-page-data' === $endpoint ) {
144	// Page::save_page_data();
145	// }
146
147	/**
148	* @deprecated
149	* @see POST /pages
150	*/
151	// if ( $endpoint === 'add-new-page' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
152	// Page::add_new_page();
153	// }
154
155	/**
156	* @deprecated
157	* @see PUT /pages/{page_id}
158	* @see PUT /popups/{popup_id}
159	*/
160	// if ( $endpoint === 'update-page-data' ) {
161	// Page::update_page_data();
162	// }
163
164	/**
165	* @deprecated
166	* @see POST /toggle-disabled-page-symbols
167	*/
168	// if ( $endpoint === 'toggle-disabled-page-symbols' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
169	// Page::toggle_disabled_page_symbols();
170	// }
171
172	// if ( $endpoint === 'remove-unused-style-block-from-db' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
173	// Page::remove_unused_style_block_from_db();
174	// }
175
176	/**
177	* @deprecated
178	* @see POST /pages/{page_id}/duplicate
179	*/
180	// if ( $endpoint === 'duplicate-page' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
181	// Page::duplicate_page();
182	// }
183
184	/**
185	* @deprecated
186	* @see DELETE /pages/{page_id}
187	*/
188	// if ( $endpoint === 'delete-page' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
189	// Page::delete_page();
190	// }
191
192	/**
193	* @deprecated
194	* @see POST /back-to-kirki-editor
195	*/
196	// if ( $endpoint === 'back-to-kirki-editor' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
197	// Page::back_to_kirki_editor();
198	// }
199
200	/**
201	* @deprecated
202	* @see POST /back-to-wordpress-editor
203	*/
204	// if ( $endpoint === 'back-to-wordpress-editor' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
205	// Page::back_to_wordpress_editor();
206	// }
207
208	/**
209	* PAGE SETTINGS
210	*
211	* @deprecated
212	* @see PUT /pages/{page_id}/settings
213	*/
214	// if ( 'save-page-settings-data' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
215	// PageSettings::save_page_setting_data();
216	// }
217
218	/**
219	* PAGE SETTINGS
220	* @deprecated
221	* @see PUT /custom-code-data
222	*/
223	// if ( 'save-custom-code-data' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
224	// PageSettings::save_custom_code();
225	// }
226
227	/**
228	* USER APIS
229	*/
230
231	/**
232	* @deprecated
233	* @see PUT /global-ui-controller
234	*/
235	// if ( $endpoint === 'save-user-controller' ) {
236	// UserData::save_user_controller();
237	// }
238
239	/**
240	* @deprecated
241	* @see PUT /global-ui-saved-data
242	*/
243	// if ( $endpoint === 'save-user-saved-data' ) {
244	// UserData::save_user_saved_data();
245	// }
246
247	/**
248	* @deprecated
249	* @see PUT /global-custom-fonts
250	*/
251	// if ( $endpoint === 'save-user-custom-fonts-data' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
252	// UserData::save_user_custom_fonts_data();
253	// }
254
255	/**
256	* @deprecated
257	* @see POST /download-google-font-offline
258	*/
259	// if ( $endpoint === 'download-google-font-offline' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
260	// UserData::make_google_font_offline();
261	// }
262
263	/**
264	* @deprecated
265	* @see DELETE /remove-google-font-offline
266	*/
267	// if ( $endpoint === 'remove-google-font-offline' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
268	// UserData::remove_google_font_offline();
269	// }
270
271	/**
272	* SYMBOL SAVE API
273	*/
274	if ($endpoint === 'save-user-saved-symbol-data') {
275	Symbol::save();
276	}
277
278	/**
279	* SYMBOL UPDATE API
280	*/
281	if ($endpoint === 'update-user-saved-symbol-data') {
282	Symbol::update();
283	}
284
285	/**
286	* SYMBOL DELETE API
287	*/
288	if ($endpoint === 'delete-user-saved-symbol-data' && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
289	Symbol::delete();
290	}
291
292	/**
293	* MEDIA APIS
294	*/
295	if ($endpoint === 'upload-media') {
296	Media::upload_media();
297	}
298
299	if ($endpoint === 'upload-font' && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
300	Media::upload_fonts();
301	}
302
303	/**
304	* @deprecated
305	* @see DELETE /remove-custom-font-permanently
306	*/
307	// if ( $endpoint === 'remove-custom-font-folder-from-server' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
308	// Media::remove_custom_font_folder_from_server();
309	// }
310
311	if ($endpoint === 'upload-base64-img') {
312	Media::upload_base64_img();
313	}
314
315	/**
316	* WALKTHROUGH
317	* @deprecated
318	* @see PUT /walkthrough-shown-state
319	*/
320	if ('set-walkthrough-shown-state' === $endpoint) {
321	Walkthrough::set_walkthrough_state();
322	}
323
324	/**
325	* Collaboration data save
326	* @deprecated
327	* @see POST /collaboration-actions
328	*/
329	if ('save-collaboration-actions' === $endpoint) {
330	Collaboration::save_actions();
331	}
332
333	/**
334	* Collaboration data save
335	* @deprecated
336	* @see POST /install-app
337	*/
338	// if ( 'install-app' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
339	// Apps::install_app();
340	// }
341
342	/**
343	* @deprecated
344	* @see PUT /app-settings
345	*/
346	// if ( 'save-app-settings-using-slug' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
347	// Apps::save_app_settings_using_slug();
348	// }
349
350	/**
351	* @deprecated
352	* @see DELETE /remove-app
353	*/
354	// if ( 'delete-app-using-slug' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
355	// Apps::delete_app_using_slug();
356	// }
357
358	/**
359	* @deprecated
360	* @see PUT /update-app
361	*/
362	// if ( 'update-app' === $endpoint && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
363	// Apps::update_app();
364	// }
365
366	/**
367	* Export page data
368	*/
369	if ('import-page-data' === $endpoint && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
370	ExportImport::import();
371	}
372	/**
373	* Export template data
374	*/
375	if ('import-template-data' === $endpoint && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
376	ExportImport::template_import();
377
378	}
379
380	/**
381	* Export page dat
382	*/
383	if ('export-page-data' === $endpoint) {
384	ExportImport::export();
385	}
386	if ($endpoint === 'import-template-using-url' && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
387	TemplateExportImport::import_using_url();
388	}
389	if ($endpoint === 'process-imported-template' && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
390	TemplateExportImport::processImport();
391	}
392	if ($endpoint === 'check-existing-template-data' && HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
393	TemplateExportImport::check_existing_template_data();
394	}
395
396	/**
397	* @deprecated
398	* @see PUT /pages/{page_id}/rename-staging-version
399	*/
400	// if ( $endpoint === 'rename-staging-version' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
401	// Staging::rename_stage_version();
402	// }
403
404	/**
405	* @deprecated
406	* @see DELETE /pages/{page_id}/remove-staging-version
407	*/
408	// if ( $endpoint === 'delete-staging-version' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
409	// Staging::delete_stage_version();
410	// }
411
412	/**
413	* @deprecated
414	* @see POST /pages/{page_id}/publish-staging-version
415	*/
416	// if ( $endpoint === 'publish-staging-version' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
417	// Staging::publish_stage_version();
418	// }
419
420	/**
421	* @deprecated
422	* @see POST /pages/{page_id}/restore-staging-version
423	*/
424	// if ( $endpoint === 'restore-staging-version' && HelperFunctions::has_access( KIRKI_ACCESS_LEVELS['FULL_ACCESS'] ) ) {
425	// Staging::restore_stage_version();
426	// }
427
428	if ($endpoint === 'get-dynamic-content-batch') {
429	DynamicContent::get_dynamic_element_data_batch();
430	}
431
432	if ($endpoint === 'get-collection-batch') {
433	Collection::get_collection_batch();
434	}
435
436	if ($endpoint === 'get-single-symbol') {
437	Symbol::fetch_symbol();
438	}
439
440	}
441
442	}
443
444	/**
445	* Initialize the get apis
446	*
447	* @return void
448	*/
449	public function kirki_get_apis()
450	{
451	HelperFunctions::verify_nonce('wp_rest');
452
453	if (!$this->user_can_access_get_apis()) {
454	wp_send_json_error('Not authorized');
455	}
456
457	//phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
458	$endpoint = HelperFunctions::sanitize_text(isset($_GET['endpoint']) ? $_GET['endpoint'] : null);
459
460	/**
461	* PAGE APIS
462	* @deprecated
463	* @see GET /pages/{page_id}
464	*/
465	// if ($endpoint === 'get-page-data') {
466	// Page::get_page_blocks_and_styles();
467	// }
468
469	/**
470	* @deprecated
471	* @see GET /wp-posts/{post_id}
472	*/
473	// if ($endpoint === 'get-wp-single-post') {
474	// if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
475	// wp_send_json_error('Not authorized', 401);
476	// }
477	// $post_id = (int) HelperFunctions::sanitize_text(isset($_GET['post_id']) ? $_GET['post_id'] : null);
478	// $post = get_post($post_id);
479
480	// if (!$post) {
481	// wp_send_json_error('Post not found');
482	// }
483
484	// wp_send_json_success($post);
485	// }
486
487	/**
488	* @deprecated
489	* @see GET /pages
490	*/
491	if ($endpoint === 'get-pages-list') {
492	Page::fetch_list_api();
493	}
494
495	/**
496	* @deprecated
497	* @see GET /page-panel-pages
498	*/
499	if ($endpoint === 'get-pages-for-pages-panel') {
500	Page::get_pages_for_pages_panel();
501	}
502	/**
503	* @deprecated
504	* @see GET /data-list-for-template-edit-search-flyout
505	*/
506	// if ($endpoint === 'get-data-list-for-template-edit-search-flyout') {
507	// Page::get_data_list_for_template_edit_search_flyout();
508	// }
509	if ($endpoint === 'get-posts-list') {
510	Page::fetch_post_list_data_post_type_wise();
511	}
512
513	/**
514	* @deprecated
515	* @see GET /current-page/{page_id}
516	*/
517	// if ($endpoint === 'get-current-page-data') {
518	// Page::get_current_page_data();
519	// }
520	if ($endpoint === 'get-unused-class-info-from-db') {
521	Page::get_unused_class_info_from_db();
522	}
523	/**
524	* @deprecated
525	* @see GET /validate-wp-post-slug
526	*/
527	// if ($endpoint === 'validate-wp-post-slug') {
528	// Page::validate_wp_post_slug();
529	// }
530
531	/**
532	* USER DATA APIS
533	* @deprecated
534	* @see GET /global-ui-controller
535	*/
536	// if ( $endpoint === 'get-user-controller' ) {
537	// UserData::get_user_controller();
538	// }
539
540	/**
541	* @deprecated
542	* @see GET /is-user-logged-in
543	*/
544	// if ( $endpoint === 'is-user-logged-in' ) {
545	// UserData::check_user_login();
546	// }
547
548	/**
549	* USER DATA APIS
550	* @deprecated
551	* @see GET /global-ui-saved-data
552	*/
553	// if ( $endpoint === 'get-user-saved-data' ) {
554	// UserData::get_user_saved_data();
555	// }
556
557	/**
558	* USER DATA APIS
559	* @deprecated
560	* @see GET /app-list
561	*/
562	// if ( $endpoint === 'get-app-list' ) {
563	// Apps::get_app_list();
564	// }
565	/**
566	* USER DATA APIS
567	* @deprecated
568	* @see GET /installed-app-list
569	*/
570	// if ( $endpoint === 'get-installed-app-list' ) {
571	// Apps::get_installed_apps_list();
572	// }
573
574	/**
575	* USER DATA APIS
576	* @deprecated
577	* @see GET /app-settings
578	*/
579	// if ( $endpoint === 'get-app-settings-using-slug' ) {
580	// Apps::get_app_settings_using_slug();
581	// }
582
583	/**
584	* @deprecated
585	* @see GET /global-custom-fonts
586	*/
587	// if ( $endpoint === 'get-user-custom-fonts-data' ) {
588	// UserData::get_user_custom_fonts_data();
589	// }
590
591	/**
592	* GET SYMBOL LIST API
593	*/
594	if ($endpoint === 'get-symbol-list') {
595	Symbol::fetch_list(false, true);
596	}
597
598	if ($endpoint === 'get-page-custom-section') {
599	$type = HelperFunctions::sanitize_text(isset($_GET['type']) ? $_GET['type'] : '');
600	wp_send_json(HelperFunctions::get_page_custom_section($type, true));
601	}
602
603	/**
604	* GET Single prebuilt html API
605	*/
606	if ($endpoint === 'get-pre-built-html') {
607	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
608	wp_send_json_error('Not authorized', 401);
609	}
610	Symbol::get_pre_built_html_using_url();
611	}
612
613	/**
614	* GET DYNAMIC CONTENT API
615	*/
616	if ($endpoint === 'get-dynamic-content') {
617	DynamicContent::get_dynamic_element_data();
618	}
619
620	if ($endpoint === 'get-post-terms') {
621	Taxonomy::get_post_terms();
622	}
623
624	if ($endpoint === 'get-terms') {
625	Taxonomy::get_terms();
626	}
627
628	if ($endpoint === 'get-post-type-taxonomies') {
629	Taxonomy::get_post_type_taxonomies();
630	}
631
632	if ($endpoint === 'get-all-terms-by-post-type') {
633	Taxonomy::get_all_terms_by_post_type();
634	}
635
636	if ($endpoint === 'get_visibility_condition_fields') {
637	DynamicContent::get_visibility_condition_fields();
638	}
639
640	if ($endpoint === 'get_dynamic_content_fields') {
641	DynamicContent::get_dynamic_content_fields();
642	}
643
644	/**
645	* GET WordPress MENUS API
646	*/
647	if ($endpoint === 'get-wp-menus') {
648	WordpressData::get_wordpress_menus_data();
649	}
650
651	/**
652	* GET WordPress POST TYPES API
653	*/
654	if ($endpoint === 'get-wp-post-types') {
655	WordpressData::get_wordpress_post_types_data();
656	}
657
658	/**
659	* GET WordPress POST TYPES API
660	*/
661	if ($endpoint === 'get-wp-comment-types') {
662	WordpressData::get_wordpress_comment_types_data();
663	}
664
665	/**
666	* GET WordPress SINGLE MENU DATA API
667	*/
668	if ($endpoint === 'get-wp-sigle-menu') {
669	//phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
670	$term_id = HelperFunctions::sanitize_text(isset($_GET['term_id']) ? $_GET['term_id'] : null);
671	WordpressData::get_wordpress_single_menu_data($term_id);
672	}
673
674	/**
675	* PAGE SETTINGS
676	*/
677	if ($endpoint === 'get-page-settings-data') {
678	PageSettings::get_page_settings_data();
679	}
680
681	if ($endpoint === 'get-custom-code') {
682	PageSettings::get_custom_code();
683	}
684
685	/**
686	* WALKTHROUGH
687	* @deprecated
688	* @see GET /walkthrough-shown-state
689	*/
690	// if ('get-walkthrough-shown-state' === $endpoint) {
691	// Walkthrough::get_walkthrough_state();
692	// }
693
694	/**
695	* COLLECTION
696	*/
697	if ('get-collection' === $endpoint) {
698	Collection::get_collection();
699	}
700
701	if ('get-external-collection-options' === $endpoint) {
702	Collection::get_external_collection_options();
703	}
704
705	if ('get-external-collection-item-type' === $endpoint) {
706	Collection::get_external_collection_item_type();
707	}
708
709	/**
710	* GET USERS
711	*/
712
713	if ('get-users-of-collection' === $endpoint) {
714	Users::get_users_of_collection();
715	}
716
717	/**
718	* COMMENTS
719	*/
720	if ('get-comments' === $endpoint) {
721	Comments::get_comments();
722	}
723
724	/**
725	* AUTHOR LIST
726	*/
727	if ('get-authors' === $endpoint) {
728	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
729	wp_send_json_error('Not authorized', 401);
730	}
731	WordpressData::get_author_list();
732	}
733
734	/**
735	* ROLE LIST
736	*/
737
738	if ('get-roles' === $endpoint) {
739	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
740	wp_send_json_error('Not authorized', 401);
741	}
742	WordpressData::get_role_list();
743	}
744
745	/**
746	* USER LIST
747	*/
748	if (
749	'get-users' === $endpoint
750	) {
751	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
752	wp_send_json_error('Not authorized', 401);
753	}
754	WordpressData::get_user_list();
755	}
756
757	/**
758	* CATEGORY LIST
759	*/
760	if ('get-categories' === $endpoint) {
761	WordpressData::get_category_list();
762	}
763
764	/**
765	* GET ACCESS LEVEL
766	*/
767	if ('editor-access-level' === $endpoint) {
768	RBAC::get_editor_access_level();
769	}
770
771	if ($endpoint === 'get-common-data') {
772	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
773	wp_send_json_error('Not authorized', 401);
774	}
775	WpAdmin::get_common_data();
776	}
777
778	/**
779	* Collaboration data get
780	*/
781	if ('collect-collaboration-actions' === $endpoint) {
782	Collaboration::send_actions();
783	}
784	/**
785	* Collaboration data get
786	*/
787	if ('delete-collaboration-connection' === $endpoint) {
788	$session_id = HelperFunctions::sanitize_text($_GET['session_id']);
789	Collaboration::delete_connection($session_id);
790	}
791
792	if ($endpoint === 'get-connected-collaboration-users-list') {
793	$post_id = HelperFunctions::sanitize_text($_GET['post_id']);
794	$res = Collaboration::get_connected_collaboration_users_list($post_id);
795	wp_send_json($res);
796	}
797
798	/**
799	* Staging GET APIs
800	* @deprecated
801	* @see GET /pages/{pageId}/staged-versions
802	*/
803
804	// if ('get-all-staged-versions' === $endpoint) {
805	// $post_id = (int) HelperFunctions::sanitize_text(isset($_GET['post_id']) ? $_GET['post_id'] : null);
806	// Staging::get_all_staged_versions($post_id, false, true);
807	// }
808	}
809
810	/**
811	* Check if the current request can access wp endpoints.
812	*
813	* @return bool
814	*/
815	private function user_can_access_get_apis()
816	{
817	if (HelperFunctions::is_api_call_from_editor_preview() && HelperFunctions::is_api_header_post_editor_preview_token_valid()) {
818	return true;
819	}
820
821	return is_user_logged_in() && HelperFunctions::has_access(
822	array(
823	KIRKI_ACCESS_LEVELS['FULL_ACCESS'],
824	KIRKI_ACCESS_LEVELS['CONTENT_ACCESS'],
825	KIRKI_ACCESS_LEVELS['VIEW_ACCESS'],
826	)
827	);
828	}
829
830	/**
831	* Initialize the admin post apis
832	*
833	* @return void
834	*/
835	public function kirki_wp_admin_post_apis()
836	{
837	HelperFunctions::verify_nonce('wp_rest');
838
839	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
840	wp_send_json_error('Not authorized');
841	}
842
843	//phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
844	$endpoint = HelperFunctions::sanitize_text(isset($_POST['endpoint']) ? $_POST['endpoint'] : null);
845
846	if ($endpoint === 'save-common-data') {
847	WpAdmin::save_common_data();
848	}
849
850	if ($endpoint === 'update-license-validity') {
851	WpAdmin::update_license_validity();
852	}
853
854	if ($endpoint === 'update-access-level') {
855	RBAC::update_access_level();
856	}
857
858	if ($endpoint === 'delete-form-row') {
859	Form::delete_form_row();
860	}
861
862	if ($endpoint === 'delete-form') {
863	Form::delete_form();
864	}
865
866	if ($endpoint === 'update-form-cell') {
867	Form::update_form_row();
868	}
869
870	/**
871	* Export Template
872	*/
873	if ($endpoint === 'import-template') {
874	TemplateExportImport::import();
875	}
876
877	if ($endpoint === 'process-imported-template') {
878	TemplateExportImport::processImport();
879	}
880
881	if ($endpoint === 'process-export-template') {
882	TemplateExportImport::processExport();
883	}
884
885	if ($endpoint === 'save-editor-read-only-access-data') {
886	Page::save_editor_read_only_access_data();
887	}
888	/**
889	* Export Template
890	*/
891
892	if ($endpoint === 'export-template') {
893	TemplateExportImport::export();
894	}
895
896	}
897
898	/**
899	* Return an explicit unauthorized response for unauthenticated admin AJAX requests.
900	*
901	* @return void
902	*/
903	public function kirki_wp_admin_unauthorized()
904	{
905	wp_send_json_error('Not authorized', 401);
906	}
907
908	/**
909	* Initialize the admin get apis
910	*
911	* @return void
912	*/
913	public function kirki_wp_admin_get_apis()
914	{
915	HelperFunctions::verify_nonce('wp_rest');
916
917	if (!is_admin()) {
918	wp_send_json_error('Not authorized', 401);
919	}
920
921	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
922	wp_send_json_error('Not authorized', 401);
923	}
924
925	//phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
926	$endpoint = HelperFunctions::sanitize_text(isset($_GET['endpoint']) ? $_GET['endpoint'] : null);
927
928	if ($endpoint === 'get-common-data') {
929	WpAdmin::get_common_data();
930	}
931
932	// From manipulation from admin dashboard.
933	if ($endpoint === 'get-forms') {
934	Form::get_forms();
935	}
936
937	if ($endpoint === 'get-form-data') {
938	Form::get_form_data();
939	}
940
941	if ($endpoint === 'get-wp-admin-page-data') {
942	Page::get_pages_for_pages_panel();
943	}
944
945	if ($endpoint === 'get-members-based-on-role') {
946	RBAC::members_based_on_role();
947	}
948
949	if ($endpoint === 'download-form-data') {
950	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
951	wp_send_json_error('Not authorized');
952	}
953
954	Form::download_form_data();
955	}
956
957	// From manipulation from admin dashboard.
958
959	if ($endpoint === 'get-editor-read-only-access-data') {
960	if (!HelperFunctions::has_access(KIRKI_ACCESS_LEVELS['FULL_ACCESS'])) {
961	wp_send_json_error('Not authorized', 401);
962	}
963	Page::get_editor_read_only_access_data();
964	}
965	}
966	}
967