← All changes | app/Traits/HasAllowlistControl.php +0 -67 2.0.2 → 2.1.1 View file →

		@@ -6,67 +6,8 @@
6	6
7	7	trait HasAllowlistControl
8	8	{
9	9	/**
10		- * Check if the current code execution allows access to the admin area.
11		- * This is the case when:
12		- * - user is logged in and has manage_options capability
13		- * - this is a REST API request and user is logged in
14		- * - this is a WPCLI request
15		- * - this is a cron request
16		- *
17		- * This ensures that auto updates can run, and cron jobs can complete.
18		- *
19		- * @internal This replaces global: metricool_has_admin_access()
20		- */
21		- public function adminAccessAllowed(): bool
22		- {
23		- $wpcli = defined('WP_CLI') && WP_CLI;
24		- $currentUserCanVisitAdmin = (is_admin() && current_user_can('metricool_manage'));
25		-
26		- return $currentUserCanVisitAdmin || $this->restRequestIsAllowed() || wp_doing_cron() || $wpcli;
27		- }
28		-
29		- /**
30		- * Check if the current request is authenticated, for a REST API request.
31		- * This is the case when:
32		- * - The request URI is set and contains '/metricool/v'
33		- * AND
34		- * - The callback URL is still active, and the request URI contains the callback URL
35		- * OR
36		- * - The user is logged in and has the 'metricool_manage' capability
37		- *
38		- * @internal Ignore the phpcs errors for this method, as they are false
39		- * positives. We do not actually use the $_GET or $_SERVER variables
40		- * directly, but we need to check if they are set and contain the
41		- * expected values.
42		- *
43		- * @internal This replaces global: metricool_is_logged_in_rest()
44		- * @todo Name of this method is not entirely accurate, consider renaming
45		- */
46		- public function restRequestIsAllowed(): bool
47		- {
48		- $validWpJsonRequest = (
49		- isset($_SERVER['REQUEST_URI'])
50		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
51		- && (strpos($_SERVER['REQUEST_URI'], '/metricool/v') !== false)
52		- );
53		-
54		- $validPlainPermalinksRequest = (
55		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
56		- isset($_GET['rest_route'])
57		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Recommended
58		- && (strpos($_GET['rest_route'], 'metricool/v') !== false)
59		- );
60		-
61		- if ($validWpJsonRequest === false && $validPlainPermalinksRequest === false) {
62		- return false;
63		- }
64		-
65		- return is_user_logged_in() && current_user_can('metricool_manage');
66		- }
67		-
68		- /**
69	10	* Check if the current user has the capability to manage the plugin.
70	11	* This is the case when:
71	12	* - The user is logged in and has the 'metricool_manage' capability
72	13	* - This is a REST API request and the user is logged in
		@@ -77,16 +18,8 @@
77	18	public function userCanManage(): bool
78	19	{
79	20	// During activation, we need to allow access
80	21	if (get_option('metricool_activation_flag')) {
81		- return true;
82		- }
83		-
84		- if (defined('WP_CLI') && WP_CLI) {
85		- return true;
86		- }
87		-
88		- if ($this->restRequestIsAllowed()) {
89	22	return true;
90	23	}
91	24
92	25	return current_user_can('metricool_manage');