← All changes | classes/rest.php +119 -23 5.5.0 → 5.5.5 View file →

		@@ -4,8 +4,15 @@
4	4	{
5	5	private $core;
6	6	private $namespace = 'meow-gallery/v1';
7	7
	8	+ // Gallery attributes that decide *which* media a gallery shows. They must never be taken from
	9	+ // an untrusted request: see rest_load_gallery_collection().
	10	+ private static $source_atts = [
	11	+ 'collection', 'id', 'ids', 'include', 'tags', 'posts', 'latest_posts', 'attachments',
	12	+ 'rml', 'wplr-collection', 'meow',
	13	+ ];
	14	+
8	15	public function __construct( $core ) {
9	16	$this->core = $core;
10	17
11	18	// FOR DEBUG
		@@ -66,8 +73,13 @@
66	73	'methods' => 'POST',
67	74	'permission_callback' => array( $this->core, 'can_access_settings' ),
68	75	'callback' => array( $this, 'rest_update_gallery_rank' ),
69	76	) );
	77	+ register_rest_route( $this->namespace, '/rml_folders', array(
	78	+ 'methods' => 'GET',
	79	+ 'permission_callback' => array( $this->core, 'can_access_settings' ),
	80	+ 'callback' => array( $this, 'rest_rml_folders' ),
	81	+ ) );
70	82
71	83
72	84	register_rest_route( $this->namespace, '/fetch_shortcodes', array(
73	85	'methods' => 'POST',
		@@ -115,9 +127,9 @@
115	127
116	128	// Gallery
117	129	register_rest_route( $this->namespace, '/images/', array(
118	130	'methods' => 'POST',
119		- 'permission_callback' => '__return_true',
	131	+ 'permission_callback' => array( $this, 'can_load_images' ),
120	132	'callback' => array( $this, 'rest_images' )
121	133	) );
122	134
123	135	register_rest_route( $this->namespace, '/fetch_posts', array(
		@@ -131,8 +143,18 @@
131	143	)
132	144	) );
133	145	}
134	146
	147	+ // The /images/ route feeds the infinite scroll and nothing else: when it is off (the default,
	148	+ // and always in the free version) the gallery is rendered whole and the front-end never calls
	149	+ // this. It has to stay open to visitors when infinite scroll IS on, but leaving it open
	150	+ // everywhere exposed the title, caption and URL of any attachment ID, including attachments of
	151	+ // posts that are not published.
	152	+ public function can_load_images() {
	153	+ $infinite = class_exists( 'MeowPro_MGL_Core' ) && Meow_MGL_Core::get_plugin_option( 'infinite', false );
	154	+ return apply_filters( 'mgl_allow_load_images', (bool) $infinite );
	155	+ }
	156	+
135	157	function preview( WP_REST_Request $request ) {
136	158	$params = $request->get_body( );
137	159	$params = json_decode( $params );
138	160	$params->ids = implode( ',', $params->ids );
		@@ -137,31 +159,65 @@
137	159	$params = json_decode( $params );
138	160	$params->ids = implode( ',', $params->ids );
139	161	$atts = ( array ) $params;
140	162
	163	+ $full = !empty( $atts['full'] );
	164	+ unset( $atts['full'] );
	165	+
141	166	$is_collection = isset( $atts['collection'] ) && !empty( $atts['collection'] );
142	167	if ( $is_collection ) {
143		- $html = do_shortcode( '[meow-collection id="' . $atts['collection'] . '"]' );
	168	+ $html = $this->core->render_collection( $atts['collection'] );
	169	+ $counts = [ 'total' => 0, 'shown' => 0 ];
144	170	} else {
	171	+ $this->core->last_preview_counts = [ 'total' => 0, 'shown' => 0 ];
	172	+ if ( $full ) {
	173	+ $this->core->preview_cutoff = PHP_INT_MAX;
	174	+ }
145	175	$html = $this->core->gallery( $atts, [ 'isPreview' => true ] );
	176	+ $counts = $this->core->last_preview_counts;
146	177	}
147	178
148	179
149		- return new WP_REST_Response( [ 'success' => true, 'data' => $html ], 200 );
	180	+ return new WP_REST_Response( [
	181	+ 'success' => true,
	182	+ 'data' => $html,
	183	+ 'total' => intval( $counts['total'] ),
	184	+ 'shown' => intval( $counts['shown'] ),
	185	+ ], 200 );
150	186	}
151	187
152	188	function rest_load_gallery_collection( $request ) {
153	189	try {
154	190	$params = $request->get_json_params( );
155		- $gallery_id = $params['id'];
156		- $search_slug = $params['search_slug'];
157		- $gallery_atts = $params['gallery_atts'];
	191	+ $gallery_id = $params['id'] ?? '';
	192	+ $search_slug = $params['search_slug'] ?? '';
	193	+ $gallery_atts = $params['gallery_atts'] ?? array();
	194	+ $gallery_atts = is_array( $gallery_atts ) ? $gallery_atts : array();
158	195
159	196	$key = [
160	197	'gallery_id' => 'id',
161	198	'wplr_collection_id' => 'wplr-collection',
	199	+ 'rml' => 'rml',
162	200	];
163	201
	202	+ // This route is public (visitors open galleries from a collection), so everything it
	203	+ // receives is untrusted. The gallery to render is decided by 'search_slug' + 'id'
	204	+ // only: the caller-supplied attributes are stripped of anything that could point the
	205	+ // gallery at other content. Without this, 'collection' could be used to inject
	206	+ // arbitrary shortcodes (reported by JunHee CHO, 2026-09).
	207	+ if ( !isset( $key[ $search_slug ] ) ) {
	208	+ return new WP_REST_Response( [ 'success' => false, 'message' => __( 'Unknown gallery source.', MGL_DOMAIN ) ], 400 );
	209	+ }
	210	+ $gallery_atts = array_diff_key( $gallery_atts, array_flip( self::$source_atts ) );
	211	+
	212	+ // The RML source is a folder path, the others are identifiers.
	213	+ if ( $search_slug !== 'rml' ) {
	214	+ $gallery_id = Meow_MGL_Core::sanitize_id( $gallery_id );
	215	+ if ( $gallery_id === '' ) {
	216	+ return new WP_REST_Response( [ 'success' => false, 'message' => __( 'Invalid gallery ID.', MGL_DOMAIN ) ], 400 );
	217	+ }
	218	+ }
	219	+
164	220	$shortcode_atts = array();
165	221	$shortcode_atts[ $key[$search_slug] ] = $gallery_id;
166	222	$shortcode_atts = [...$shortcode_atts, ...$gallery_atts];
167	223
		@@ -177,8 +233,15 @@
177	233	function rest_all_settings( ) {
178	234	return new WP_REST_Response( [ 'success' => true, 'data' => $this->core->get_all_options( ) ], 200 );
179	235	}
180	236
	237	+ function rest_rml_folders( ) {
	238	+ if ( ! Meow_MGL_RML::is_available() ) {
	239	+ return new WP_REST_Response( [ 'success' => true, 'available' => false, 'data' => [] ], 200 );
	240	+ }
	241	+ return new WP_REST_Response( [ 'success' => true, 'available' => true, 'data' => Meow_MGL_RML::get_all_folders() ], 200 );
	242	+ }
	243	+
181	244	function rest_reset_options( ) {
182	245	$this->core->reset_options( );
183	246	return new WP_REST_Response( [ 'success' => true, 'options' => $this->core->get_all_options( ) ], 200 );
184	247	}
		@@ -188,9 +251,9 @@
188	251	global $wpdb;
189	252	$params = $request->get_json_params( );
190	253
191	254	$id = $params['id'];
192		- $medias = $params['medias'];
	255	+ $medias = Meow_MGL_Core::normalize_medias( $params['medias'] ?? null );
193	256	$name = $params['name'];
194	257	$layout = $params['layout'];
195	258	$description = $params['description'];
196	259	$posts = $params['posts'];
		@@ -200,14 +263,15 @@
200	263	$lead_image_id = $params['lead_image_id'];
201	264	$order_by = $params['order_by'];
202	265	$is_post_mode = $params['is_post_mode'];
203	266	$is_hero_mode = $params['is_hero_mode'];
	267	+ $rml = $params['rml'] ?? null;
204	268
205	269	if ( !$name ) {
206	270	throw new Exception( __( 'Please enter a name for your shortcode.', MGL_DOMAIN ));
207	271	}
208	272
209		- if ( !$is_post_mode && ( !$medias || !count( $medias['thumbnail_ids'] )) ) {
	273	+ if ( !$is_post_mode && empty( $medias['thumbnail_ids'] ) ) {
210	274	throw new Exception( __( 'Please select at least one image.', MGL_DOMAIN ));
211	275	}
212	276
213	277	if ( $is_post_mode && $dynamic_source === 'posts' && ( !$posts && !$latest_posts )) {
		@@ -217,8 +281,12 @@
217	281	if ( $is_post_mode && $dynamic_source === 'tags' && !$tags ) {
218	282	throw new Exception( __( 'Please enter at least one tag.', MGL_DOMAIN ));
219	283	}
220	284
	285	+ if ( $is_post_mode && $dynamic_source === 'rml' && empty( $rml ) ) {
	286	+ throw new Exception( __( 'Please select a Real Media Library folder.', MGL_DOMAIN ));
	287	+ }
	288	+
221	289	if ( $is_hero_mode && !$is_post_mode ) {
222	290	throw new Exception( __( 'Hero mode is only available for post mode.', MGL_DOMAIN ));
223	291	}
224	292
		@@ -243,9 +311,10 @@
243	311	'is_hero_mode' => $is_hero_mode ? 1 : 0,
244	312	'posts' => $posts ? serialize( $posts ) : null,
245	313	'latest_posts' => $latest_posts,
246	314	'tags' => serialize( $tags ),
247		- 'dynamic_source' => $dynamic_source
	315	+ 'dynamic_source' => $dynamic_source,
	316	+ 'rml' => $rml
248	317	];
249	318
250	319	if ( $exists ) {
251	320	// Update existing record
		@@ -384,9 +453,9 @@
384	453	$galleries[$gallery['id']] = [
385	454	'name' => $gallery['name'],
386	455	'description' => $gallery['description'],
387	456	'layout' => $gallery['layout'],
388		- 'medias' => unserialize( $gallery['medias'] ),
	457	+ 'medias' => Meow_MGL_Core::hydrate_medias( maybe_unserialize( $gallery['medias'] ) ),
389	458	'is_post_mode' => ( bool )$gallery['is_post_mode'],
390	459	'hero' => ( bool )$gallery['is_hero_mode'],
391	460	'posts' => $gallery['posts'] ? unserialize( $gallery['posts'] ) : null,
392	461	'latest_posts' => $gallery['latest_posts'],
		@@ -496,24 +565,21 @@
496	565	"AND p.ID NOT IN ( " . implode( ', ', array_fill( 0, count( $except ), '%s' )) . " )", $except
497	566	) : '';
498	567	$join_clause = '';
499	568	if ( $unusedImages ) {
500		- // Retrieve the serialized option from the database
501		- $meow_gallery_shortcodes = get_option( 'mgl_shortcodes' );
	569	+ // Every image used by a gallery, read from the galleries table (this used to read the
	570	+ // old 'mgl_shortcodes' option, which isn't written anymore since the migration).
	571	+ $shortcodes_table = $wpdb->prefix . 'mgl_gallery_shortcodes';
	572	+ Meow_MGL_Migrations::check_db();
502	573
503		- // Deserialize the option to get the array
504		- $shortcodes_array = maybe_unserialize( $meow_gallery_shortcodes );
505		-
506		- // Extract all thumbnail IDs from the array
507	574	$used_thumbnail_ids = [];
508		- foreach ( $shortcodes_array as $shortcode ) {
509		- if ( isset( $shortcode['medias']['thumbnail_ids'] ) && is_array( $shortcode['medias']['thumbnail_ids'] ) ) {
510		- $used_thumbnail_ids = array_merge( $used_thumbnail_ids, $shortcode['medias']['thumbnail_ids'] );
511		- }
	575	+ foreach ( $wpdb->get_col( "SELECT medias FROM $shortcodes_table" ) as $medias ) {
	576	+ $medias = Meow_MGL_Core::normalize_medias( maybe_unserialize( $medias ) );
	577	+ $used_thumbnail_ids = array_merge( $used_thumbnail_ids, $medias['thumbnail_ids'] );
512	578	}
513	579
514	580	// Make sure the IDs are integers
515		- $used_thumbnail_ids = array_map( 'intval', $used_thumbnail_ids );
	581	+ $used_thumbnail_ids = array_unique( array_map( 'intval', $used_thumbnail_ids ) );
516	582
517	583	// Include the NOT IN clause to exclude used thumbnail IDs
518	584	if ( !empty( $used_thumbnail_ids ) ) {
519	585	$placeholders = implode( ',', array_fill( 0, count( $used_thumbnail_ids ), '%d' ) );
		@@ -596,8 +662,33 @@
596	662	'data' => $this->core->get_gallery_images( $image_ids, $atts, $layout, $size )
597	663	], 200 );
598	664	}
599	665
	666	+ // Applies WordPress's own visibility rules to a raw posts query: published posts for everyone,
	667	+ // other people's drafts only with edit_others_posts, other people's private posts only with
	668	+ // read_private_posts, and your own in both cases. 'upload_files' (the capability gating this
	669	+ // REST controller) is held by Authors, who must not see the whole site's unpublished content.
	670	+ private function get_post_status_clause( $alias = 'p', $post_type = 'post' ) {
	671	+ global $wpdb;
	672	+
	673	+ $post_type_object = get_post_type_object( $post_type );
	674	+ $read_private_cap = $post_type_object ? $post_type_object->cap->read_private_posts : 'read_private_posts';
	675	+ $edit_others_cap = $post_type_object ? $post_type_object->cap->edit_others_posts : 'edit_others_posts';
	676	+
	677	+ $user_id = get_current_user_id();
	678	+ $clause = "AND ( $alias.post_status = 'publish'";
	679	+
	680	+ $clause .= current_user_can( $read_private_cap )
	681	+ ? " OR $alias.post_status = 'private'"
	682	+ : $wpdb->prepare( " OR ( $alias.post_status = 'private' AND $alias.post_author = %d )", $user_id );
	683	+
	684	+ $clause .= current_user_can( $edit_others_cap )
	685	+ ? " OR $alias.post_status = 'draft'"
	686	+ : $wpdb->prepare( " OR ( $alias.post_status = 'draft' AND $alias.post_author = %d )", $user_id );
	687	+
	688	+ return $clause . " ) ";
	689	+ }
	690	+
600	691	function rest_fetch_posts( $request ) {
601	692	try {
602	693	$params = $request->get_json_params();
603	694	$search = isset($params['search']) ? $params['search'] : '';
		@@ -612,8 +703,13 @@
612	703	$searchPlaceholder,
613	704	$searchPlaceholder
614	705	) : '';
615	706
	707	+ // The same clause is used by both queries on purpose: the search also matches
	708	+ // post_content, so a count taken over a wider set than the rows would let a user probe
	709	+ // the body of posts they cannot read (reported by Kaan Özbek, 2026-09).
	710	+ $where_status_clause = $this->get_post_status_clause( 'p' );
	711	+
616	712	$posts = $wpdb->get_results(
617	713	$wpdb->prepare(
618	714	"SELECT p.ID, p.post_title, p.post_date, p.post_status, u.display_name as author
619	715	FROM $wpdb->posts p
		@@ -618,9 +714,9 @@
618	714	"SELECT p.ID, p.post_title, p.post_date, p.post_status, u.display_name as author
619	715	FROM $wpdb->posts p
620	716	LEFT JOIN $wpdb->users u ON p.post_author = u.ID
621	717	WHERE p.post_type = 'post'
622		- AND p.post_status IN ('publish', 'draft', 'private')
	718	+ $where_status_clause
623	719	$where_search_clause
624	720	ORDER BY p.post_date DESC
625	721	LIMIT %d, %d",
626	722	$offset,
		@@ -632,9 +728,9 @@
632	728	$posts_count = (int)$wpdb->get_var(
633	729	"SELECT COUNT(*)
634	730	FROM $wpdb->posts p
635	731	WHERE p.post_type = 'post'
636		- AND p.post_status IN ('publish', 'draft', 'private')
	732	+ $where_status_clause
637	733	$where_search_clause"
638	734	);
639	735
640	736	$data = array_map(function($post) {