master-addons / inc / admin / templates / includes / classes / rest-api.php

rest-api.php in Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits 3.1.2, at inc/admin/templates/includes/classes/rest-api.php

266 lines 8.8 KB

Raw Download Zip

1	<?php
2	/**
3	* Template Library REST API
4	*
5	* Registers REST API endpoints for template library functionality
6	* Fixes missing permission_callback warnings for WordPress 5.5+
7	*
8	* @package MasterAddons
9	* @since 1.0.0
10	*/
11
12	namespace MasterAddons\Inc\Admin\Templates\Includes\Classes;
13
14	if (!defined('ABSPATH')) {
15	exit;
16	}
17
18	class REST_API {
19
20	private static $instance = null;
21	private $namespace = 'masteraddons/v2';
22
23	public static function get_instance() {
24	if (self::$instance === null) {
25	self::$instance = new self();
26	}
27	return self::$instance;
28	}
29
30	private function __construct() {
31	add_action('rest_api_init', array($this, 'register_routes'));
32	}
33
34	/**
35	* Register all REST API routes
36	*/
37	public function register_routes() {
38	// Info endpoint - requires authentication
39	register_rest_route($this->namespace, '/info', array(
40	'methods' => 'GET',
41	'callback' => array($this, 'get_info'),
42	'permission_callback' => array($this, 'check_edit_permission'),
43	));
44
45	// Single template endpoint - requires edit_posts capability for security
46	register_rest_route($this->namespace, '/template/(?P<id>\d+)', array(
47	'methods' => 'GET',
48	'callback' => array($this, 'get_template'),
49	'permission_callback' => array($this, 'check_edit_permission'),
50	'args' => array(
51	'id' => array(
52	'required' => true,
53	'validate_callback' => function($param) {
54	return is_numeric($param);
55	}
56	),
57	),
58	));
59
60	// Register routes for each template type
61	$template_types = array('master_section', 'master_pages', 'master_popups');
62
63	foreach ($template_types as $type) {
64	// Templates endpoint - requires authentication
65	register_rest_route($this->namespace, "/templates/{$type}", array(
66	'methods' => 'GET',
67	'callback' => array($this, 'get_templates'),
68	'permission_callback' => array($this, 'check_edit_permission'),
69	'args' => array(
70	'type' => array(
71	'default' => $type,
72	'sanitize_callback' => 'sanitize_text_field',
73	),
74	),
75	));
76
77	// Categories endpoint - requires authentication
78	register_rest_route($this->namespace, "/categories/{$type}", array(
79	'methods' => 'GET',
80	'callback' => array($this, 'get_categories'),
81	'permission_callback' => array($this, 'check_edit_permission'),
82	'args' => array(
83	'type' => array(
84	'default' => $type,
85	'sanitize_callback' => 'sanitize_text_field',
86	),
87	),
88	));
89
90	// Keywords endpoint - requires authentication
91	register_rest_route($this->namespace, "/keywords/{$type}", array(
92	'methods' => 'GET',
93	'callback' => array($this, 'get_keywords'),
94	'permission_callback' => array($this, 'check_edit_permission'),
95	'args' => array(
96	'type' => array(
97	'default' => $type,
98	'sanitize_callback' => 'sanitize_text_field',
99	),
100	),
101	));
102	}
103	}
104
105	/**
106	* Check if user has permission to access templates
107	* Prevents IDOR vulnerability by requiring authentication
108	*
109	* @return bool\|\WP_Error
110	*/
111	public function check_edit_permission() {
112	if (!is_user_logged_in()) {
113	return new \WP_Error(
114	'rest_not_logged_in',
115	__('You must be logged in to access templates.', 'master-addons'),
116	array('status' => 401)
117	);
118	}
119
120	if (!current_user_can('edit_posts')) {
121	return new \WP_Error(
122	'rest_forbidden',
123	__('You do not have permission to access templates.', 'master-addons'),
124	array('status' => 403)
125	);
126	}
127
128	return true;
129	}
130
131	/**
132	* Get plugin/API info
133	*/
134	public function get_info($request) {
135	return rest_ensure_response(array(
136	'success' => true,
137	'version' => JLTMA_VER,
138	'api_version' => '2.0',
139	'plugin_name' => 'Master Addons',
140	));
141	}
142
143	/**
144	* Get single template by ID
145	*/
146	public function get_template($request) {
147	$id = $request->get_param('id');
148
149	// Get template data (you can customize this based on your implementation)
150	$template = get_post($id);
151
152	if (!$template \|\| $template->post_type !== 'elementor_library') {
153	return new \WP_Error(
154	'template_not_found',
155	'Template not found',
156	array('status' => 404)
157	);
158	}
159
160	// Security check: Only allow access to published templates
161	// Users must be logged in to access draft/private templates
162	if ($template->post_status !== 'publish') {
163	if (!is_user_logged_in() \|\| !current_user_can('edit_post', $id)) {
164	return new \WP_Error(
165	'rest_forbidden',
166	'You do not have permission to access this template.',
167	array('status' => 403)
168	);
169	}
170	}
171
172	return rest_ensure_response(array(
173	'success' => true,
174	'data' => array(
175	'id' => $template->ID,
176	'title' => $template->post_title,
177	'content' => $template->post_content,
178	'type' => get_post_meta($template->ID, '_elementor_template_type', true),
179	),
180	));
181	}
182
183	/**
184	* Get templates for a specific type
185	*/
186	public function get_templates($request) {
187	$type = $request->get_param('type');
188
189	// Use existing template manager if available
190	if (function_exists('MasterAddons\Inc\Templates\master_addons_templates')) {
191	$manager = \MasterAddons\Inc\Templates\master_addons_templates()->temp_manager;
192	if ($manager && method_exists($manager, 'get_source')) {
193	$source = $manager->get_source('master-api');
194	if ($source) {
195	$templates = $source->get_items($type);
196	return rest_ensure_response(array(
197	'success' => true,
198	'data' => $templates ?: array(),
199	));
200	}
201	}
202	}
203
204	return rest_ensure_response(array(
205	'success' => true,
206	'data' => array(),
207	));
208	}
209
210	/**
211	* Get categories for a specific type
212	*/
213	public function get_categories($request) {
214	$type = $request->get_param('type');
215
216	// Use existing template manager if available
217	if (function_exists('MasterAddons\Inc\Templates\master_addons_templates')) {
218	$manager = \MasterAddons\Inc\Templates\master_addons_templates()->temp_manager;
219	if ($manager && method_exists($manager, 'get_source')) {
220	$source = $manager->get_source('master-api');
221	if ($source && method_exists($source, 'get_categories')) {
222	$categories = $source->get_categories($type);
223	return rest_ensure_response(array(
224	'success' => true,
225	'data' => $categories ?: array(),
226	));
227	}
228	}
229	}
230
231	return rest_ensure_response(array(
232	'success' => true,
233	'data' => array(),
234	));
235	}
236
237	/**
238	* Get keywords for a specific type
239	*/
240	public function get_keywords($request) {
241	$type = $request->get_param('type');
242
243	// Use existing template manager if available
244	if (function_exists('MasterAddons\Inc\Templates\master_addons_templates')) {
245	$manager = \MasterAddons\Inc\Templates\master_addons_templates()->temp_manager;
246	if ($manager && method_exists($manager, 'get_source')) {
247	$source = $manager->get_source('master-api');
248	if ($source && method_exists($source, 'get_keywords')) {
249	$keywords = $source->get_keywords($type);
250	return rest_ensure_response(array(
251	'success' => true,
252	'data' => $keywords ?: array(),
253	));
254	}
255	}
256	}
257
258	return rest_ensure_response(array(
259	'success' => true,
260	'data' => array(),
261	));
262	}
263	}
264
265	// Initialize the REST API
266	REST_API::get_instance();