| 1 |
<?php |
| 2 |
|
| 3 |
declare(strict_types=1); |
| 4 |
|
| 5 |
namespace Metricool\Traits; |
| 6 |
|
| 7 |
trait HasAllowlistControl |
| 8 |
{ |
| 9 |
/** |
| 10 |
* Check if the current code execution allows access to the admin area. |
| 11 |
* This is the case when: |
| 12 |
* - user is logged in and has manage_options capability |
| 13 |
* - this is a REST API request and user is logged in |
| 14 |
* - this is a WPCLI request |
| 15 |
* - this is a cron request |
| 16 |
* |
| 17 |
* This ensures that auto updates can run, and cron jobs can complete. |
| 18 |
* |
| 19 |
* @internal This replaces global: metricool_has_admin_access() |
| 20 |
*/ |
| 21 |
public function adminAccessAllowed(): bool |
| 22 |
{ |
| 23 |
$wpcli = defined('WP_CLI') && WP_CLI; |
| 24 |
$currentUserCanVisitAdmin = (is_admin() && current_user_can('metricool_manage')); |
| 25 |
|
| 26 |
return $currentUserCanVisitAdmin || $this->restRequestIsAllowed() || wp_doing_cron() || $wpcli; |
| 27 |
} |
| 28 |
|
| 29 |
/** |
| 30 |
* Check if the current request is authenticated, for a REST API request. |
| 31 |
* This is the case when: |
| 32 |
* - The request URI is set and contains '/metricool/v' |
| 33 |
* AND |
| 34 |
* - The callback URL is still active, and the request URI contains the callback URL |
| 35 |
* OR |
| 36 |
* - The user is logged in and has the 'metricool_manage' capability |
| 37 |
* |
| 38 |
* @internal Ignore the phpcs errors for this method, as they are false |
| 39 |
* positives. We do not actually use the $_GET or $_SERVER variables |
| 40 |
* directly, but we need to check if they are set and contain the |
| 41 |
* expected values. |
| 42 |
* |
| 43 |
* @internal This replaces global: metricool_is_logged_in_rest() |
| 44 |
* @todo Name of this method is not entirely accurate, consider renaming |
| 45 |
*/ |
| 46 |
public function restRequestIsAllowed(): bool |
| 47 |
{ |
| 48 |
$validWpJsonRequest = ( |
| 49 |
isset($_SERVER['REQUEST_URI']) |
| 50 |
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized |
| 51 |
&& (strpos($_SERVER['REQUEST_URI'], '/metricool/v') !== false) |
| 52 |
); |
| 53 |
|
| 54 |
$validPlainPermalinksRequest = ( |
| 55 |
// phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 56 |
isset($_GET['rest_route']) |
| 57 |
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Recommended |
| 58 |
&& (strpos($_GET['rest_route'], 'metricool/v') !== false) |
| 59 |
); |
| 60 |
|
| 61 |
if ($validWpJsonRequest === false && $validPlainPermalinksRequest === false) { |
| 62 |
return false; |
| 63 |
} |
| 64 |
|
| 65 |
return is_user_logged_in() && current_user_can('metricool_manage'); |
| 66 |
} |
| 67 |
|
| 68 |
/** |
| 69 |
* Check if the current user has the capability to manage the plugin. |
| 70 |
* This is the case when: |
| 71 |
* - The user is logged in and has the 'metricool_manage' capability |
| 72 |
* - This is a REST API request and the user is logged in |
| 73 |
* - This is a WPCLI request |
| 74 |
* |
| 75 |
* @internal This replaces Helper::user_can_manage() |
| 76 |
*/ |
| 77 |
public function userCanManage(): bool |
| 78 |
{ |
| 79 |
// During activation, we need to allow access |
| 80 |
if (get_option('metricool_activation_flag')) { |
| 81 |
return true; |
| 82 |
} |
| 83 |
|
| 84 |
if (defined('WP_CLI') && WP_CLI) { |
| 85 |
return true; |
| 86 |
} |
| 87 |
|
| 88 |
if ($this->restRequestIsAllowed()) { |
| 89 |
return true; |
| 90 |
} |
| 91 |
|
| 92 |
return current_user_can('metricool_manage'); |
| 93 |
} |
| 94 |
} |
| 95 |
|
