| @@ -22,31 +22,60 @@ | ||
| 22 | 22 | } |
| 23 | 23 | |
| 24 | 24 | |
| 25 | 25 | public function init() { |
| 26 | - add_action( 'rest_api_init', function () { | |
| 27 | - register_rest_route( $this->getNamespace(), '/compare/add_to_list', [ | |
| 28 | - 'methods' => WP_REST_Server::CREATABLE, | |
| 29 | - 'callback' => [ $this, 'add_to_list_callback' ], | |
| 30 | - 'permission_callback' => '__return_true' | |
| 31 | - ] ); | |
| 32 | - register_rest_route( $this->getNamespace(), '/compare/remove_from_list', [ | |
| 33 | - 'methods' => WP_REST_Server::CREATABLE, | |
| 34 | - 'callback' => [ $this, 'remove_from_list_callback' ], | |
| 35 | - 'permission_callback' => '__return_true' | |
| 36 | - ] ); | |
| 37 | - } ); | |
| 26 | + add_action( | |
| 27 | + 'rest_api_init', | |
| 28 | + function () { | |
| 29 | + register_rest_route( | |
| 30 | + $this->getNamespace(), | |
| 31 | + '/compare/add_to_list', | |
| 32 | + [ | |
| 33 | + 'methods' => WP_REST_Server::CREATABLE, | |
| 34 | + 'callback' => [ $this, 'add_to_list_callback' ], | |
| 35 | + 'permission_callback' => [ $this, 'check_permission' ], | |
| 36 | + ] | |
| 37 | + ); | |
| 38 | + register_rest_route( | |
| 39 | + $this->getNamespace(), | |
| 40 | + '/compare/remove_from_list', | |
| 41 | + [ | |
| 42 | + 'methods' => WP_REST_Server::CREATABLE, | |
| 43 | + 'callback' => [ $this, 'remove_from_list_callback' ], | |
| 44 | + 'permission_callback' => [ $this, 'check_permission' ], | |
| 45 | + ] | |
| 46 | + ); | |
| 47 | + } | |
| 48 | + ); | |
| 38 | 49 | } |
| 39 | 50 | |
| 40 | 51 | /** |
| 41 | - * @param WP_REST_Request $request | |
| 52 | + * Check permission for the given WP_REST_Request. | |
| 42 | 53 | * |
| 43 | - * @return WP_Error|WP_HTTP_Response|WP_REST_Response | |
| 54 | + * @param WP_REST_Request $request The REST request object. | |
| 55 | + * | |
| 56 | + * @return boolean | |
| 44 | 57 | */ |
| 58 | + public function check_permission( WP_REST_Request $request ) { | |
| 59 | + $product_id = $request->get_param( 'product_id' ); | |
| 60 | + $nonce = $request->get_header( 'X-WP-Nonce' ); | |
| 61 | + | |
| 62 | + if ( ! $product_id || 'publish' !== get_post_status( $product_id ) ) { | |
| 63 | + return false; | |
| 64 | + } | |
| 65 | + | |
| 66 | + if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) { | |
| 67 | + return false; | |
| 68 | + } | |
| 69 | + | |
| 70 | + return true; | |
| 71 | + } | |
| 72 | + | |
| 73 | + | |
| 45 | 74 | public function add_to_list_callback( $request ) { |
| 46 | 75 | $product_id = $request->get_param( 'product_id' ); |
| 47 | 76 | |
| 48 | - if ( ! $product_id ) { | |
| 77 | + if ( ! $product_id || 'publish' !== get_post_status( $product_id ) ) { | |
| 49 | 78 | return $this->sendError( esc_html__( 'Product id not found.', 'shopbuilder' ) ); |
| 50 | 79 | } |
| 51 | 80 | |
| 52 | 81 | $inserted = CompareFns::instance()->add_product( $product_id ); |
| @@ -53,19 +82,23 @@ | ||
| 53 | 82 | if ( is_wp_error( $inserted ) ) { |
| 54 | 83 | return $this->sendError( $inserted->get_error_message() ); |
| 55 | 84 | } |
| 56 | 85 | |
| 57 | - return $this->sendResponse( [ | |
| 58 | - 'item_count' => count( CompareFns::instance()->get_compared_product_ids() ), | |
| 59 | - 'product_id' => $product_id, | |
| 60 | - 'list_html' => CompareFrontEnd::instance()->list_shortcode([]) | |
| 61 | - ] ); | |
| 86 | + return $this->sendResponse( | |
| 87 | + [ | |
| 88 | + 'item_count' => count( CompareFns::instance()->get_compared_product_ids() ), | |
| 89 | + 'product_id' => $product_id, | |
| 90 | + 'list_html' => CompareFrontEnd::instance()->list_shortcode( [] ), | |
| 91 | + ] | |
| 92 | + ); | |
| 62 | 93 | } |
| 63 | 94 | |
| 64 | 95 | |
| 65 | 96 | /** |
| 66 | - * @param WP_REST_Request $request | |
| 97 | + * Callback function for removing a product to the comparison list. | |
| 67 | 98 | * |
| 99 | + * @param WP_REST_Request $request The REST request object. | |
| 100 | + * | |
| 68 | 101 | * @return WP_Error|WP_HTTP_Response|WP_REST_Response |
| 69 | 102 | */ |
| 70 | 103 | public function remove_from_list_callback( $request ) { |
| 71 | 104 | $product_id = $request->get_param( 'product_id' ); |
| @@ -82,13 +115,13 @@ | ||
| 82 | 115 | if ( ! $deleted ) { |
| 83 | 116 | return $this->sendError( esc_html__( 'The product does not delete!', 'shopbuilder' ) ); |
| 84 | 117 | } |
| 85 | 118 | |
| 86 | - return $this->sendResponse( [ | |
| 87 | - 'product_id' => $product_id, | |
| 88 | - 'item_count' => count( CompareFns::instance()->get_compared_product_ids() ), | |
| 89 | - 'list_html' => CompareFrontEnd::instance()->list_shortcode([]) | |
| 90 | - ] ); | |
| 91 | - | |
| 119 | + return $this->sendResponse( | |
| 120 | + [ | |
| 121 | + 'product_id' => $product_id, | |
| 122 | + 'item_count' => count( CompareFns::instance()->get_compared_product_ids() ), | |
| 123 | + 'list_html' => CompareFrontEnd::instance()->list_shortcode( [] ), | |
| 124 | + ] | |
| 125 | + ); | |
| 92 | 126 | } |
| 93 | - | |
| 94 | -} | |
| 127 | +} | |