← All changes | classes/class-widget.php +9 -76 trunk → 3.7 View file →

		@@ -95,10 +95,10 @@
95	95	'show_in_rest' => array(
96	96	'schema' => $schema,
97	97	),
98	98	'single' => true,
99		- 'auth_callback' => function ( $allowed, $meta_key, $object_id ) {
100		- return current_user_can( 'edit_post', $object_id );
	99	+ 'auth_callback' => function () {
	100	+ return current_user_can( 'edit_posts' );
101	101	},
102	102	'sanitize_callback' => array( __CLASS__, 'sanitize_source' ),
103	103	)
104	104	);
		@@ -117,10 +117,10 @@
117	117	),
118	118	),
119	119	),
120	120	'single' => true,
121		- 'auth_callback' => function ( $allowed, $meta_key, $object_id ) {
122		- return current_user_can( 'edit_post', $object_id );
	121	+ 'auth_callback' => function () {
	122	+ return current_user_can( 'edit_posts' );
123	123	},
124	124	'sanitize_callback' => array( __CLASS__, 'sanitize_fieldset' ),
125	125	)
126	126	);
		@@ -410,10 +410,10 @@
410	410	'/poster/(?P<id>\d+)',
411	411	array(
412	412	'methods' => 'POST',
413	413	'callback' => array( __CLASS__, 'handle_rest_generator' ),
414		- 'permission_callback' => function ( $request ) {
415		- return current_user_can( 'edit_post', absint( $request['id'] ) );
	414	+ 'permission_callback' => function () {
	415	+ return current_user_can( 'edit_posts' );
416	416	},
417	417	)
418	418	);
419	419	}
		@@ -482,19 +482,13 @@
482	482	continue;
483	483	}
484	484
485	485	if ( 'text' === $layer['type'] ) {
486		- $sanitized[ $key ] = sanitize_textarea_field(
487		- Generator::normalize_text( $fieldset[ $key ] )
488		- );
	486	+ $sanitized[ $key ] = sanitize_textarea_field( $fieldset[ $key ] );
489	487	}
490	488
491	489	if ( 'image' === $layer['type'] ) {
492		- $attachment_id = absint( $fieldset[ $key ] );
493		-
494		- if ( $attachment_id && self::can_use_image_attachment( $attachment_id ) ) {
495		- $sanitized[ $key ] = $attachment_id;
496		- }
	490	+ $sanitized[ $key ] = absint( $fieldset[ $key ] );
497	491	}
498	492	}
499	493	}
500	494
		@@ -514,18 +508,14 @@
514	508	*
515	509	* @param WP_REST_Request $request Request params.
516	510	*/
517	511	public static function handle_rest_generator( $request ) {
518		- $post_id = absint( $request->get_param( 'id' ) );
	512	+ $post_id = $request->get_param( 'id' );
519	513
520	514	if ( empty( $post_id ) ) {
521	515	wp_send_json_error( __( 'Post data is empty.', 'sharing-image' ), 400 );
522	516	}
523	517
524		- if ( ! current_user_can( 'edit_post', $post_id ) ) {
525		- wp_send_json_error( __( 'Sorry, you are not allowed to edit this post.', 'sharing-image' ), 403 );
526		- }
527		-
528	518	$params = $request->get_json_params();
529	519
530	520	if ( ! isset( $params['template'] ) ) {
531	521	wp_send_json_error( __( 'Incorrect request parameters.', 'sharing-image' ), 400 );
		@@ -576,14 +566,8 @@
576	566	if ( ! empty( $_POST['sharing_image_context'] ) ) {
577	567	$context = sanitize_key( wp_unslash( $_POST['sharing_image_context'] ) );
578	568	}
579	569
580		- $permission_error = self::check_generate_permission( $screen_id, $context );
581		-
582		- if ( is_wp_error( $permission_error ) ) {
583		- wp_send_json_error( $permission_error->get_error_message(), $permission_error->get_error_data() );
584		- }
585		-
586	570	$fieldset = array();
587	571
588	572	if ( ! empty( $_POST[ self::META_FIELDSET ] ) ) {
589	573	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
		@@ -967,59 +951,8 @@
967	951	*
968	952	* @param array $taxonomies List of taxonomies to show settings.
969	953	*/
970	954	return apply_filters( 'sharing_image_widget_taxonomies', array_values( $taxonomies ) );
971		- }
972		-
973		- /**
974		- * Check whether current user can generate a poster for the requested object.
975		- *
976		- * @param int $screen_id Post or term ID.
977		- * @param string $context Widget context.
978		- *
979		- * @return true|WP_Error True when allowed, WP_Error otherwise.
980		- */
981		- private static function check_generate_permission( $screen_id, $context ) {
982		- if ( 'term' === $context ) {
983		- if ( ! $screen_id || ! current_user_can( 'edit_term', $screen_id ) ) {
984		- return new WP_Error( 'permission', __( 'Sorry, you are not allowed to edit this term.', 'sharing-image' ), 403 );
985		- }
986		-
987		- return true;
988		- }
989		-
990		- if ( 'post' !== $context ) {
991		- return new WP_Error( 'permission', __( 'Incorrect request context.', 'sharing-image' ), 400 );
992		- }
993		-
994		- if ( $screen_id ) {
995		- if ( ! current_user_can( 'edit_post', $screen_id ) ) {
996		- return new WP_Error( 'permission', __( 'Sorry, you are not allowed to edit this post.', 'sharing-image' ), 403 );
997		- }
998		-
999		- return true;
1000		- }
1001		-
1002		- if ( ! current_user_can( 'edit_posts' ) ) {
1003		- return new WP_Error( 'permission', __( 'Sorry, you are not allowed to edit posts.', 'sharing-image' ), 403 );
1004		- }
1005		-
1006		- return true;
1007		- }
1008		-
1009		- /**
1010		- * Check whether an attachment can be used as a dynamic image layer.
1011		- *
1012		- * @param int $attachment_id Attachment ID.
1013		- *
1014		- * @return bool Whether attachment is readable image.
1015		- */
1016		- private static function can_use_image_attachment( $attachment_id ) {
1017		- if ( ! current_user_can( 'read_post', $attachment_id ) ) {
1018		- return false;
1019		- }
1020		-
1021		- return wp_attachment_is_image( $attachment_id );
1022	955	}
1023	956
1024	957	/**
1025	958	* Save attachment to media library.