← All changes | inc/rest-api.php +104 -25 2.12.3 → 2.12.8 View file →

		@@ -1396,9 +1396,9 @@
1396	1396	*/
1397	1397	return apply_filters(
1398	1398	'srfm_rest_api_endpoints',
1399	1399	[
1400		- 'generate-form' => [
	1400	+ 'generate-form' => [
1401	1401	'methods' => 'POST',
1402	1402	'callback' => [ AI_Form_Builder::get_instance(), 'generate_ai_form' ],
1403	1403	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1404	1404	'args' => [
		@@ -1407,21 +1407,100 @@
1407	1407	],
1408	1408	],
1409	1409	],
1410	1410	// This route is used to map the AI response to SureForms fields markup.
1411		- 'map-fields' => [
	1411	+ 'map-fields' => [
1412	1412	'methods' => 'POST',
1413	1413	'callback' => [ Field_Mapping::get_instance(), 'generate_gutenberg_fields_from_questions' ],
1414	1414	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1415	1415	],
	1416	+ // Recreate the entries table when it has gone missing. The repair is
	1417	+ // idempotent (CREATE TABLE IF NOT EXISTS) so a double-click is safe.
	1418	+ 'database/repair-entries-table' => [
	1419	+ 'methods' => 'POST',
	1420	+ /**
	1421	+ * Resolved at dispatch, not while the route table is built:
	1422	+ * get_endpoints() runs on rest_api_init for every REST request,
	1423	+ * and Admin is only constructed under is_admin(). Naming the
	1424	+ * instance here would run Admin's constructor on the front-end
	1425	+ * submit path too.
	1426	+ *
	1427	+ * @param \WP_REST_Request<array<string,mixed>> $request Request.
	1428	+ * @return \WP_REST_Response|\WP_Error
	1429	+ */
	1430	+ 'callback' => static function ( $request ) {
	1431	+ $nonce = Helper::get_string_value( $request->get_header( 'X-WP-Nonce' ) );
	1432	+
	1433	+ if ( ! wp_verify_nonce( sanitize_text_field( $nonce ), 'wp_rest' ) ) {
	1434	+ return new \WP_Error(
	1435	+ 'rest_cookie_invalid_nonce',
	1436	+ __( 'Security verification failed. Please refresh the page and try again.', 'sureforms' ),
	1437	+ [ 'status' => 403 ]
	1438	+ );
	1439	+ }
	1440	+
	1441	+ // @phpstan-ignore-next-line -- PHPStan resolves SRFM\Admin\Admin via tests/php/stubs/srfm-stubs.php (admin/ is outside its `paths`) and that generated stub predates this method. Real location: admin/admin.php.
	1442	+ $repaired = \SRFM\Admin\Admin::get_instance()->do_database_repair();
	1443	+
	1444	+ if ( ! $repaired ) {
	1445	+ return new \WP_Error(
	1446	+ 'srfm_database_repair_failed',
	1447	+ __( 'SureForms could not finish updating the database. Your hosting may not allow SureForms to create database tables — please contact your hosting provider or SureForms support.', 'sureforms' ),
	1448	+ [ 'status' => 500 ]
	1449	+ );
	1450	+ }
	1451	+
	1452	+ return new \WP_REST_Response( [ 'success' => true ], 200 );
	1453	+ },
	1454	+ 'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
	1455	+ ],
	1456	+ // Record a "Finish setting up" card CTA click for a form (#3031).
	1457	+ // Per-form capability is re-checked in the handler.
	1458	+ 'dismiss-form-setup-card' => [
	1459	+ 'methods' => 'POST',
	1460	+ /**
	1461	+ * Resolve Admin at dispatch rather than while the route table is
	1462	+ * built. get_endpoints() runs on rest_api_init for *every* REST
	1463	+ * request, and plugin-loader.php only constructs Admin under
	1464	+ * is_admin() — which REST dispatch is not. Naming the instance
	1465	+ * here would therefore run Admin's constructor (40 admin hook
	1466	+ * registrations, an option read, the notices library, and the
	1467	+ * wpforms_current_user_can filter) on the front-end
	1468	+ * submit-form path too.
	1469	+ *
	1470	+ * @param \WP_REST_Request<array<string,mixed>> $request Request.
	1471	+ * @return \WP_REST_Response|\WP_Error
	1472	+ */
	1473	+ 'callback' => static function ( $request ) {
	1474	+ // @phpstan-ignore-next-line -- PHPStan resolves SRFM\Admin\Admin via tests/php/stubs/srfm-stubs.php (admin/ is outside its `paths`) and that generated stub predates this method. Real location: admin/admin.php:470.
	1475	+ return \SRFM\Admin\Admin::get_instance()->dismiss_form_setup_card( $request );
	1476	+ },
	1477	+ 'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
	1478	+ 'args' => [
	1479	+ 'form_id' => [
	1480	+ 'required' => true,
	1481	+ 'sanitize_callback' => 'absint',
	1482	+ ],
	1483	+ 'action' => [
	1484	+ 'required' => true,
	1485	+ 'type' => 'string',
	1486	+ 'enum' => [ 'edit_form', 'edit_thankyou', 'set_up_email', 'view_form' ],
	1487	+ // Core only enforces `enum` via the default arg sanitizer, which
	1488	+ // is skipped once a sanitize_callback is set — so pair it with an
	1489	+ // explicit validate_callback, matching this file's other routes.
	1490	+ 'validate_callback' => 'rest_validate_request_arg',
	1491	+ 'sanitize_callback' => 'sanitize_text_field',
	1492	+ ],
	1493	+ ],
	1494	+ ],
1416	1495	// This route is used to initiate auth process when user tries to authenticate on billing portal.
1417		- 'initiate-auth' => [
	1496	+ 'initiate-auth' => [
1418	1497	'methods' => 'GET',
1419	1498	'callback' => [ AI_Auth::get_instance(), 'get_auth_url' ],
1420	1499	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1421	1500	],
1422	1501	// This route is to used to decrypt the access key and save it in the database.
1423		- 'handle-access-key' => [
	1502	+ 'handle-access-key' => [
1424	1503	'methods' => 'POST',
1425	1504	'callback' => [ AI_Auth::get_instance(), 'handle_access_key' ],
1426	1505	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1427	1506	],
		@@ -1427,27 +1506,27 @@
1427	1506	],
1428	1507	// Public route: returns the visitor's detected country code. Called
1429	1508	// per-visitor from the phone field so auto-country detection works
1430	1509	// on full-page-cached sites (the value isn't baked into cached HTML).
1431		- 'geo-country' => [
	1510	+ 'geo-country' => [
1432	1511	'methods' => 'GET',
1433	1512	'callback' => [ $this, 'get_geo_country' ],
1434	1513	'permission_callback' => '__return_true',
1435	1514	],
1436	1515	// This route is to get the form submissions for the last 30 days.
1437		- 'entries-chart-data' => [
	1516	+ 'entries-chart-data' => [
1438	1517	'methods' => 'GET',
1439	1518	'callback' => [ $this, 'get_entries_chart_data' ],
1440	1519	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1441	1520	],
1442	1521	// This route is to get all forms data.
1443		- 'form-data' => [
	1522	+ 'form-data' => [
1444	1523	'methods' => 'GET',
1445	1524	'callback' => [ $this, 'get_form_data' ],
1446	1525	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1447	1526	],
1448	1527	// Page search endpoint for async admin dropdowns.
1449		- 'pages/search' => [
	1528	+ 'pages/search' => [
1450	1529	'methods' => 'GET',
1451	1530	'callback' => [ $this, 'search_pages' ],
1452	1531	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1453	1532	'args' => [
		@@ -1497,19 +1576,19 @@
1497	1576	],
1498	1577	],
1499	1578	],
1500	1579	// Onboarding endpoints.
1501		- 'onboarding/set-status' => [
	1580	+ 'onboarding/set-status' => [
1502	1581	'methods' => 'POST',
1503	1582	'callback' => [ $this, 'set_onboarding_status' ],
1504	1583	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1505	1584	],
1506		- 'onboarding/get-status' => [
	1585	+ 'onboarding/get-status' => [
1507	1586	'methods' => 'GET',
1508	1587	'callback' => [ $this, 'get_onboarding_status' ],
1509	1588	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1510	1589	],
1511		- 'onboarding/user-details' => [
	1590	+ 'onboarding/user-details' => [
1512	1591	'methods' => 'POST',
1513	1592	'callback' => [ $this, 'save_onboarding_user_details' ],
1514	1593	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1515	1594	'args' => [
		@@ -1533,9 +1612,9 @@
1533	1612	],
1534	1613	],
1535	1614	],
1536	1615	// Plugin status endpoint.
1537		- 'plugin-status' => [
	1616	+ 'plugin-status' => [
1538	1617	'methods' => 'GET',
1539	1618	'callback' => [ $this, 'get_plugin_status' ],
1540	1619	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1541	1620	'args' => [
		@@ -1545,9 +1624,9 @@
1545	1624	],
1546	1625	],
1547	1626	],
1548	1627	// Entries endpoints.
1549		- 'entries/list' => [
	1628	+ 'entries/list' => [
1550	1629	'methods' => 'GET',
1551	1630	'callback' => [ $this, 'get_entries_list' ],
1552	1631	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1553	1632	'args' => [
		@@ -1592,9 +1671,9 @@
1592	1671	'default' => 1,
1593	1672	],
1594	1673	],
1595	1674	],
1596		- 'entries/read-status' => [
	1675	+ 'entries/read-status' => [
1597	1676	'methods' => 'POST',
1598	1677	'callback' => [ $this, 'update_entries_read_status' ],
1599	1678	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1600	1679	'args' => [
		@@ -1608,9 +1687,9 @@
1608	1687	'validate_callback' => [ $this, 'validate_read_action' ],
1609	1688	],
1610	1689	],
1611	1690	],
1612		- 'entries/trash' => [
	1691	+ 'entries/trash' => [
1613	1692	'methods' => 'POST',
1614	1693	'callback' => [ $this, 'update_entries_trash_status' ],
1615	1694	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1616	1695	'args' => [
		@@ -1624,9 +1703,9 @@
1624	1703	'validate_callback' => [ $this, 'validate_trash_action' ],
1625	1704	],
1626	1705	],
1627	1706	],
1628		- 'entries/delete' => [
	1707	+ 'entries/delete' => [
1629	1708	'methods' => 'POST',
1630	1709	'callback' => [ $this, 'delete_entries' ],
1631	1710	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1632	1711	'args' => [
		@@ -1635,9 +1714,9 @@
1635	1714	'sanitize_callback' => [ $this, 'sanitize_entry_ids' ],
1636	1715	],
1637	1716	],
1638	1717	],
1639		- 'entries/export' => [
	1718	+ 'entries/export' => [
1640	1719	'methods' => 'POST',
1641	1720	'callback' => [ $this, 'export_entries' ],
1642	1721	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1643	1722	'args' => [
		@@ -1667,9 +1746,9 @@
1667	1746	],
1668	1747	],
1669	1748	],
1670	1749	// Get Single Entry Form Data.
1671		- 'entry/(?P<id>\d+)/details' => [
	1750	+ 'entry/(?P<id>\d+)/details' => [
1672	1751	'methods' => 'GET',
1673	1752	'callback' => [ $this, 'get_entry_details' ],
1674	1753	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1675	1754	'args' => [
		@@ -1679,9 +1758,9 @@
1679	1758	],
1680	1759	],
1681	1760	],
1682	1761	// Get Single Entry Logs.
1683		- 'entry/(?P<id>\d+)/logs' => [
	1762	+ 'entry/(?P<id>\d+)/logs' => [
1684	1763	'methods' => 'GET',
1685	1764	'callback' => [ $this, 'get_entry_logs' ],
1686	1765	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1687	1766	'args' => [
		@@ -1699,9 +1778,9 @@
1699	1778	],
1700	1779	],
1701	1780	],
1702	1781	// Forms listing endpoint.
1703		- 'forms' => [
	1782	+ 'forms' => [
1704	1783	'methods' => 'GET',
1705	1784	'callback' => [ Forms_Data::get_instance(), 'get_forms_list' ],
1706	1785	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1707	1786	'args' => [
		@@ -1725,9 +1804,9 @@
1725	1804	],
1726	1805	'orderby' => [
1727	1806	'type' => 'string',
1728	1807	'default' => 'date',
1729		- 'enum' => [ 'date', 'id', 'title', 'modified' ],
	1808	+ 'enum' => [ 'date', 'id', 'title', 'modified', 'views', 'conversion_rate' ],
1730	1809	],
1731	1810	'order' => [
1732	1811	'type' => 'string',
1733	1812	'default' => 'desc',
		@@ -1757,9 +1836,9 @@
1757	1836	],
1758	1837	],
1759	1838	],
1760	1839	// Export forms endpoint.
1761		- 'forms/export' => [
	1840	+ 'forms/export' => [
1762	1841	'methods' => 'POST',
1763	1842	'callback' => [ Export::get_instance(), 'handle_export_form_rest' ],
1764	1843	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1765	1844	'args' => [
		@@ -1781,9 +1860,9 @@
1781	1860	],
1782	1861	],
1783	1862	],
1784	1863	// Import forms endpoint.
1785		- 'forms/import' => [
	1864	+ 'forms/import' => [
1786	1865	'methods' => 'POST',
1787	1866	'callback' => [ Export::get_instance(), 'handle_import_form_rest' ],
1788	1867	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1789	1868	'args' => [
		@@ -1803,9 +1882,9 @@
1803	1882	],
1804	1883	],
1805	1884	],
1806	1885	// Form lifecycle management endpoint (trash/restore/delete/draft).
1807		- 'forms/manage' => [
	1886	+ 'forms/manage' => [
1808	1887	'methods' => 'POST',
1809	1888	'callback' => [ $this, 'manage_form_lifecycle' ],
1810	1889	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1811	1890	'args' => [
		@@ -1833,9 +1912,9 @@
1833	1912	],
1834	1913	],
1835	1914	],
1836	1915	// Form duplication endpoint.
1837		- 'forms/duplicate' => [
	1916	+ 'forms/duplicate' => [
1838	1917	'methods' => 'POST',
1839	1918	'callback' => [ Duplicate_Form::get_instance(), 'handle_duplicate_form_rest' ],
1840	1919	'permission_callback' => [ Helper::class, 'get_items_permissions_check' ],
1841	1920	'args' => [