← All changes | includes/Admin/Api/SettingsData.php +141 -97 2.1.1 → 2.2.14 View file →

		@@ -1,97 +1,141 @@
1		-<?php
2		-
3		-namespace TableBuilder\Admin\Api;
4		-
5		-defined('ABSPATH') || exit;
6		-
7		-class SettingsData {
8		- public $prefix = '';
9		- public $param = '';
10		- public $request = null;
11		-
12		- public function __construct() {
13		- add_action('rest_api_init', function() {
14		- register_rest_route('tablebuilder/v1', 'settings',
15		- array(
16		- 'methods' => \WP_REST_Server::READABLE,
17		- 'callback' => array( $this, 'action_get_settings' ),
18		- 'permission_callback' => '__return_true',
19		- )
20		- );
21		- });
22		-
23		- add_action('rest_api_init', function() {
24		- register_rest_route('tablebuilder/v1', 'settings',
25		- array(
26		- 'methods' => \WP_REST_Server::EDITABLE,
27		- 'callback' => array( $this, 'action_edit_settings' ),
28		- 'permission_callback' => '__return_true',
29		- )
30		- );
31		- });
32		- }
33		-
34		- public function action_get_settings($request) {
35		- /**
36		- * Enable this section when fully functional from frontend and need Nonce & Permission check
37		- */
38		- if (!wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest')) {
39		- return array(
40		- 'status' => 'fail',
41		- 'message' => array(__('Nonce mismatch.', 'table-builder-block')),
42		- );
43		- }
44		-
45		- if (!is_user_logged_in() || !current_user_can('manage_options')) {
46		- return array(
47		- 'status' => 'fail',
48		- 'message' => array(__('Access denied.', 'table-builder-block')),
49		- );
50		- }
51		-
52		- $result_data = get_option('gutenkit_settings_list');
53		-
54		- return array(
55		- 'status' => 'success',
56		- 'settings' => $result_data,
57		- 'message' => array(__('Settings list has been fetched successfully.', 'table-builder-block')),
58		- );
59		- }
60		-
61		- public function action_edit_settings($request) {
62		- /**
63		- * Enable this section when fully functional from frontend and need Nonce & Permission check
64		- */
65		- if (!wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest')) {
66		- return array(
67		- 'status' => 'fail',
68		- 'message' => array(__('Nonce mismatch.', 'table-builder-block')),
69		- );
70		- }
71		-
72		- if (!is_user_logged_in() || !current_user_can('manage_options')) {
73		- return array(
74		- 'status' => 'fail',
75		- 'message' => array(__('Access denied.', 'table-builder-block')),
76		- );
77		- }
78		-
79		- $req_data = $request->get_params();
80		-
81		- if (array_key_exists('settings', $req_data)) {
82		- $data = $req_data['settings'];
83		- $array_get = update_option('gutenkit_settings_list', $data);
84		-
85		- return array(
86		- 'status' => 'success',
87		- 'settings' => $array_get,
88		- 'message' => array(__('Settings list has been updated successfully.', 'table-builder-block')),
89		- );
90		- } else {
91		- return array(
92		- 'status' => 'fail',
93		- 'message' => array(__('Something went wrong.', 'table-builder-block')),
94		- );
95		- }
96		- }
97		-}
	1	+<?php
	2	+/**
	3	+ * REST endpoints for the plugin's settings
	4	+ *
	5	+ * @package TableKit
	6	+ */
	7	+
	8	+namespace TableBuilder\Admin\Api;
	9	+
	10	+defined( 'ABSPATH' ) || exit;
	11	+
	12	+/**
	13	+ * Registers and serves the tablebuilder/v1/settings REST routes.
	14	+ */
	15	+class SettingsData {
	16	+ /**
	17	+ * Unused option-name prefix, reserved for future use.
	18	+ *
	19	+ * @var string
	20	+ */
	21	+ public $prefix = '';
	22	+
	23	+ /**
	24	+ * Unused request-param key, reserved for future use.
	25	+ *
	26	+ * @var string
	27	+ */
	28	+ public $param = '';
	29	+
	30	+ /**
	31	+ * Unused cached request reference, reserved for future use.
	32	+ *
	33	+ * @var \WP_REST_Request|null
	34	+ */
	35	+ public $request = null;
	36	+
	37	+ /**
	38	+ * Registers the tablebuilder/v1/settings GET/POST REST routes.
	39	+ */
	40	+ public function __construct() {
	41	+ add_action(
	42	+ 'rest_api_init',
	43	+ function () {
	44	+ register_rest_route(
	45	+ 'tablebuilder/v1',
	46	+ 'settings',
	47	+ array(
	48	+ 'methods' => \WP_REST_Server::READABLE,
	49	+ 'callback' => array( $this, 'action_get_settings' ),
	50	+ 'permission_callback' => array( $this, 'check_permission' ),
	51	+ )
	52	+ );
	53	+ }
	54	+ );
	55	+
	56	+ add_action(
	57	+ 'rest_api_init',
	58	+ function () {
	59	+ register_rest_route(
	60	+ 'tablebuilder/v1',
	61	+ 'settings',
	62	+ array(
	63	+ 'methods' => \WP_REST_Server::EDITABLE,
	64	+ 'callback' => array( $this, 'action_edit_settings' ),
	65	+ 'permission_callback' => array( $this, 'check_permission' ),
	66	+ )
	67	+ );
	68	+ }
	69	+ );
	70	+ }
	71	+
	72	+ /**
	73	+ * Verifies nonce and capability before either callback runs.
	74	+ * Doing this in permission_callback (rather than inside the action)
	75	+ * ensures WordPress returns a proper 401/403 status on failure.
	76	+ *
	77	+ * @param \WP_REST_Request $request The incoming request.
	78	+ * @return true|\WP_Error True if allowed, otherwise a 403 WP_Error.
	79	+ */
	80	+ public function check_permission( $request ) {
	81	+ if ( ! wp_verify_nonce( $request->get_header( 'X-WP-Nonce' ), 'wp_rest' ) ) {
	82	+ return new \WP_Error(
	83	+ 'rest_cookie_invalid_nonce',
	84	+ __( 'Nonce mismatch.', 'table-builder-block' ),
	85	+ array( 'status' => 403 )
	86	+ );
	87	+ }
	88	+
	89	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	90	+ return new \WP_Error(
	91	+ 'rest_forbidden',
	92	+ __( 'Access denied.', 'table-builder-block' ),
	93	+ array( 'status' => 403 )
	94	+ );
	95	+ }
	96	+
	97	+ return true;
	98	+ }
	99	+
	100	+ /**
	101	+ * REST callback: fetch the stored "gutenkit_settings_list" option.
	102	+ *
	103	+ * @param \WP_REST_Request $request Unused; no params required.
	104	+ * @return array{status:string,settings:mixed,message:string[]}
	105	+ */
	106	+ public function action_get_settings( $request ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- required by the register_rest_route() "callback" signature; not needed in the body.
	107	+ $result_data = get_option( 'gutenkit_settings_list' );
	108	+
	109	+ return array(
	110	+ 'status' => 'success',
	111	+ 'settings' => $result_data,
	112	+ 'message' => array( __( 'Settings list has been fetched successfully.', 'table-builder-block' ) ),
	113	+ );
	114	+ }
	115	+
	116	+ /**
	117	+ * REST callback: overwrite the "gutenkit_settings_list" option.
	118	+ *
	119	+ * @param \WP_REST_Request $request Request with a "settings" param.
	120	+ * @return array{status:string,settings?:mixed,message:string[]}
	121	+ */
	122	+ public function action_edit_settings( $request ) {
	123	+ $req_data = $request->get_params();
	124	+
	125	+ if ( array_key_exists( 'settings', $req_data ) ) {
	126	+ $data = $req_data['settings'];
	127	+ $array_get = update_option( 'gutenkit_settings_list', $data );
	128	+
	129	+ return array(
	130	+ 'status' => 'success',
	131	+ 'settings' => $array_get,
	132	+ 'message' => array( __( 'Settings list has been updated successfully.', 'table-builder-block' ) ),
	133	+ );
	134	+ } else {
	135	+ return array(
	136	+ 'status' => 'fail',
	137	+ 'message' => array( __( 'Something went wrong.', 'table-builder-block' ) ),
	138	+ );
	139	+ }
	140	+ }
	141	+}