← All changes | controllers/controller-admin_ajax.php +122 -77 1.14 → 3.0 View file →

		@@ -12,8 +12,9 @@
12	12	defined( 'ABSPATH' ) || die( 'No direct script access allowed!' );
13	13
14	14	/**
15	15	* Admin AJAX Controller class, extends Base Controller Class
	16	+ *
16	17	* @package TablePress
17	18	* @subpackage Controllers
18	19	* @author Tobias Bäthge
19	20	* @since 1.0.0
		@@ -20,9 +21,9 @@
20	21	*/
21	22	class TablePress_Admin_AJAX_Controller extends TablePress_Controller {
22	23
23	24	/**
24		- * Initiate Admin AJAX functionality.
	25	+ * Initiates the Admin AJAX functionality.
25	26	*
26	27	* @since 1.0.0
27	28	*/
28	29	public function __construct() {
		@@ -30,9 +31,9 @@
30	31	ob_start();
31	32
32	33	parent::__construct();
33	34
34		- $ajax_actions = array( 'hide_message', 'save_table', 'preview_table' );
	35	+ $ajax_actions = array( 'hide_message', 'save_table', 'preview_table', 'save_screen_options' );
35	36	foreach ( $ajax_actions as $action ) {
36	37	add_action( "wp_ajax_tablepress_{$action}", array( $this, "ajax_action_{$action}" ) );
37	38	}
38	39	}
		@@ -37,13 +38,13 @@
37	38	}
38	39	}
39	40
40	41	/**
41		- * Hide a header message on an admin screen.
	42	+ * Hides a header message on an admin screen.
42	43	*
43	44	* @since 1.0.0
44	45	*/
45		- public function ajax_action_hide_message() {
	46	+ public function ajax_action_hide_message(): void {
46	47	if ( empty( $_GET['item'] ) ) {
47	48	wp_die( '0' );
48	49	}
49	50
		@@ -60,13 +61,13 @@
60	61	wp_die( '1' );
61	62	}
62	63
63	64	/**
64		- * Save the table after the "Save Changes" button on the "Edit" screen has been clicked.
	65	+ * Saves the table after the "Save Changes" button on the "Edit" screen has been clicked.
65	66	*
66	67	* @since 1.0.0
67	68	*/
68		- public function ajax_action_save_table() {
	69	+ public function ajax_action_save_table(): void {
69	70	if ( empty( $_POST['tablepress']['id'] ) ) {
70	71	wp_die( '-1' );
71	72	}
72	73
		@@ -83,37 +84,41 @@
83	84	// Default response data.
84	85	$success = false;
85	86	$message = 'error_save';
86	87	$error_details = '';
87		- do { // to be able to "break;" (allows for better readable code)
	88	+ do { // To be able to "break;" (allows for better readable code).
88	89	// Load table, without table data, but with options and visibility settings.
89	90	$existing_table = TablePress::$model_table->load( $edit_table['id'], false, true );
90		- if ( is_wp_error( $existing_table ) ) { // maybe somehow load a new table here? (TablePress::$model_table->get_table_template())?
91		- // Add an error code to the existing WP_Error.
92		- $existing_table->add( 'ajax_save_table_load', '', $edit_table['id'] );
93		- $error_details = $this->get_wp_error_string( $existing_table );
	91	+ if ( is_wp_error( $existing_table ) ) {
	92	+ $error = new WP_Error( 'ajax_save_table_load', '', $edit_table['id'] );
	93	+ $error->merge_from( $existing_table );
	94	+ $error_details = TablePress::get_wp_error_string( $error );
94	95	break;
95	96	}
96	97
97		- // Check and convert data that was transmitted as JSON.
98		- if ( empty( $edit_table['data'] )
99		- || empty( $edit_table['options'] )
100		- || empty( $edit_table['visibility'] ) ) {
101		- // Create a new WP_Error.
102		- $empty_data_error = new WP_Error( 'ajax_save_table_data_empty', '', $edit_table['id'] );
103		- $error_details = $this->get_wp_error_string( $empty_data_error );
104		- break;
	98	+ // Check and convert all data that was transmitted as valid JSON.
	99	+ $keys = array( 'data', 'options', 'visibility' );
	100	+ foreach ( $keys as $key ) {
	101	+ if ( empty( $edit_table[ $key ] ) ) {
	102	+ $error = new WP_Error( "ajax_save_table_{$key}_empty", '', $edit_table['id'] );
	103	+ $error_details = TablePress::get_wp_error_string( $error );
	104	+ break 2;
	105	+ }
	106	+ $edit_table[ $key ] = json_decode( $edit_table[ $key ], true );
	107	+ if ( is_null( $edit_table[ $key ] ) ) {
	108	+ $error = new WP_Error( "ajax_save_table_{$key}_invalid_json", '', $edit_table['id'] );
	109	+ $error_details = TablePress::get_wp_error_string( $error );
	110	+ break 2;
	111	+ }
	112	+ $edit_table[ $key ] = (array) $edit_table[ $key ]; // Cast to array again, to catch strings, etc.
105	113	}
106		- $edit_table['data'] = (array) json_decode( $edit_table['data'], true );
107		- $edit_table['options'] = (array) json_decode( $edit_table['options'], true );
108		- $edit_table['visibility'] = (array) json_decode( $edit_table['visibility'], true );
109	114
110	115	// Check consistency of new table, and then merge with existing table.
111	116	$table = TablePress::$model_table->prepare_table( $existing_table, $edit_table, true );
112	117	if ( is_wp_error( $table ) ) {
113		- // Add an error code to the existing WP_Error.
114		- $table->add( 'ajax_save_table_prepare', '', $edit_table['id'] );
115		- $error_details = $this->get_wp_error_string( $table );
	118	+ $error = new WP_Error( 'ajax_save_table_prepare', '', $edit_table['id'] );
	119	+ $error->merge_from( $table );
	120	+ $error_details = TablePress::get_wp_error_string( $error );
116	121	break;
117	122	}
118	123
119	124	// DataTables Custom Commands can only be edited by trusted users.
		@@ -123,11 +128,11 @@
123	128
124	129	// Save updated table.
125	130	$saved = TablePress::$model_table->save( $table );
126	131	if ( is_wp_error( $saved ) ) {
127		- // Add an error code to the existing WP_Error.
128		- $saved->add( 'ajax_save_table_save', '', $table['id'] );
129		- $error_details = $this->get_wp_error_string( $saved );
	132	+ $error = new WP_Error( 'ajax_save_table_save', '', $table['id'] );
	133	+ $error->merge_from( $saved );
	134	+ $error_details = TablePress::get_wp_error_string( $error );
130	135	break;
131	136	}
132	137
133	138	// At this point, the table was saved successfully, possible ID change remains.
		@@ -147,16 +152,18 @@
147	152	$message = 'success_save_success_id_change';
148	153	$table['id'] = $table['new_id'];
149	154	} else {
150	155	$message = 'success_save_error_id_change';
151		- // Add an error code to the existing WP_Error.
152		- $id_changed->add( 'ajax_save_table_id_change', '', $table['new_id'] );
153		- $error_details = $this->get_wp_error_string( $id_changed );
	156	+ $error = new WP_Error( 'ajax_save_table_id_change', '', $table['new_id'] );
	157	+ $error->merge_from( $id_changed );
	158	+ $error_details = TablePress::get_wp_error_string( $error );
154	159	}
155	160	} else {
156	161	$message = 'success_save_error_id_change';
157	162	$error_details = 'table_id_could_not_be_changed: capability_check_failed';
158	163	}
	164	+
	165	+ // @phpstan-ignore doWhile.alwaysFalse
159	166	} while ( false ); // Do-while-loop through this exactly once, to be able to "break;" early.
160	167
161	168	// Generate the response.
162	169
		@@ -165,13 +172,16 @@
165	172	'success' => $success,
166	173	'message' => $message,
167	174	);
168	175	if ( $success ) {
169		- $response['table_id'] = $table['id'];
170		- $response['new_edit_nonce'] = wp_create_nonce( TablePress::nonce( 'edit', $table['id'] ) );
171		- $response['new_preview_nonce'] = wp_create_nonce( TablePress::nonce( 'preview_table', $table['id'] ) );
172		- $response['last_modified'] = TablePress::format_datetime( $table['last_modified'] );
173		- $response['last_editor'] = TablePress::get_user_display_name( $table['options']['last_editor'] );
	176	+ // For the phpstan ignores in the next lines: If this is reached, $table is guaranteed to exist and is a valid array.
	177	+ $response['table_id'] = $table['id']; // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	178	+ $response['new_edit_nonce'] = wp_create_nonce( TablePress::nonce( 'edit', $table['id'] ) ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	179	+ $response['new_preview_nonce'] = wp_create_nonce( TablePress::nonce( 'preview_table', $table['id'] ) ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	180	+ $response['new_copy_nonce'] = wp_create_nonce( TablePress::nonce( 'copy_table', $table['id'] ) ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	181	+ $response['new_delete_nonce'] = wp_create_nonce( TablePress::nonce( 'delete_table', $table['id'] ) ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	182	+ $response['last_modified'] = TablePress::format_datetime( $table['last_modified'] ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	183	+ $response['last_editor'] = TablePress::get_user_display_name( $table['options']['last_editor'] ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
174	184	}
175	185	if ( ! empty( $error_details ) ) {
176	186	$response['error_details'] = esc_html( $error_details );
177	187	}
		@@ -185,13 +195,13 @@
185	195	wp_send_json( $response );
186	196	}
187	197
188	198	/**
189		- * Return the live preview data of table that has non-saved changes.
	199	+ * Returns the live preview data of table that has non-saved changes.
190	200	*
191	201	* @since 1.0.0
192	202	*/
193		- public function ajax_action_preview_table() {
	203	+ public function ajax_action_preview_table(): void {
194	204	if ( empty( $_POST['tablepress']['id'] ) ) {
195	205	wp_die( '-1' );
196	206	}
197	207
		@@ -206,24 +216,27 @@
206	216	}
207	217
208	218	// Default response data.
209	219	$success = false;
210		- do { // to be able to "break;" (allows for better readable code)
	220	+ do { // To be able to "break;" (allows for better readable code).
211	221	// Load table, without table data, but with options and visibility settings.
212	222	$existing_table = TablePress::$model_table->load( $preview_table['id'], false, true );
213		- if ( is_wp_error( $existing_table ) ) { // maybe somehow load a new table here? (TablePress::$model_table->get_table_template())?
	223	+ if ( is_wp_error( $existing_table ) ) {
214	224	break;
215	225	}
216	226
217		- // Check and convert data that was transmitted as JSON.
218		- if ( empty( $preview_table['data'] )
219		- || empty( $preview_table['options'] )
220		- || empty( $preview_table['visibility'] ) ) {
221		- break;
	227	+ // Check and convert all data that was transmitted as valid JSON.
	228	+ $keys = array( 'data', 'options', 'visibility' );
	229	+ foreach ( $keys as $key ) {
	230	+ if ( empty( $preview_table[ $key ] ) ) {
	231	+ break 2;
	232	+ }
	233	+ $preview_table[ $key ] = json_decode( $preview_table[ $key ], true );
	234	+ if ( is_null( $preview_table[ $key ] ) ) {
	235	+ break 2;
	236	+ }
	237	+ $preview_table[ $key ] = (array) $preview_table[ $key ]; // Cast to array again, to catch strings, etc.
222	238	}
223		- $preview_table['data'] = (array) json_decode( $preview_table['data'], true );
224		- $preview_table['options'] = (array) json_decode( $preview_table['options'], true );
225		- $preview_table['visibility'] = (array) json_decode( $preview_table['visibility'], true );
226	239
227	240	// Check consistency of new table, and then merge with existing table.
228	241	$table = TablePress::$model_table->prepare_table( $existing_table, $preview_table, true );
229	242	if ( is_wp_error( $table ) ) {
		@@ -246,8 +259,10 @@
246	259	}
247	260
248	261	// At this point, the table data is valid and sanitized and can be rendered.
249	262	$success = true;
	263	+
	264	+ // @phpstan-ignore doWhile.alwaysFalse
250	265	} while ( false ); // Do-while-loop through this exactly once, to be able to "break;" early.
251	266
252	267	if ( $success ) {
253	268	// Create a render class instance.
		@@ -255,24 +270,34 @@
255	270	// Merge desired options with default render options (see TablePress_Controller_Frontend::shortcode_table()).
256	271	$default_render_options = $_render->get_default_render_options();
257	272	/** This filter is documented in controllers/controller-frontend.php */
258	273	$default_render_options = apply_filters( 'tablepress_shortcode_table_default_shortcode_atts', $default_render_options );
259		- $render_options = shortcode_atts( $default_render_options, $table['options'] );
	274	+ // For the phpstan ignores in the next lines: If this is reached, $table is guaranteed to exist and is a valid array.
	275	+ $render_options = shortcode_atts( $default_render_options, $table['options'] ); // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
260	276	/** This filter is documented in controllers/controller-frontend.php */
261	277	$render_options = apply_filters( 'tablepress_shortcode_table_shortcode_atts', $render_options );
262		- $_render->set_input( $table, $render_options );
	278	+ $render_options['html_id'] = "tablepress-{$table['id']}"; // @phpstan-ignore offsetAccess.nonOffsetAccessible, variable.undefined
	279	+ $render_options['block_preview'] = true;
	280	+ $_render->set_input( $table, $render_options ); // @phpstan-ignore variable.undefined
263	281	$head_html = $_render->get_preview_css();
264	282	$custom_css = TablePress::$model_options->get( 'custom_css' );
265		- if ( ! empty( $custom_css ) ) {
266		- $head_html .= "<style type=\"text/css\">\n{$custom_css}\n</style>\n";
	283	+ $use_custom_css = ( TablePress::$model_options->get( 'use_custom_css' ) && '' !== $custom_css );
	284	+ if ( $use_custom_css ) {
	285	+ $head_html .= "<style>\n{$custom_css}\n</style>\n";
267	286	}
268	287
269	288	$body_html = '<div id="tablepress-page"><p>'
270	289	. __( 'This is a preview of your table.', 'tablepress' ) . ' '
271	290	. __( 'Because of CSS styling in your theme, the table might look different on your page!', 'tablepress' ) . ' '
272		- . __( 'The features of the DataTables JavaScript library are also not available or visible in this preview!', 'tablepress' ) . '<br />'
273		- . sprintf( __( 'To insert the table into a page, post, or text widget, copy the Shortcode %s and paste it into the editor.', 'tablepress' ), '<input type="text" class="table-shortcode table-shortcode-inline" value="' . esc_attr( '[' . TablePress::$shortcode . " id={$table['id']} /]" ) . '" readonly="readonly" />' )
274		- . '</p>' . $_render->get_output() . '</div>';
	291	+ . __( 'The Table Features for Site Visitors, like sorting, filtering, and pagination, are also not available in this preview!', 'tablepress' ) . '<br>';
	292	+ // Show the instructions string depending on whether the Block Editor is used on the site or not.
	293	+ if ( TablePress::site_uses_block_editor() ) {
	294	+ $body_html .= sprintf( __( 'To insert a table into a post or page, add a “%1$s” block in the block editor and select the desired table.', 'tablepress' ), __( 'TablePress table', 'tablepress' ) );
	295	+ } else {
	296	+ $body_html .= __( 'To insert a table into a post or page, paste its Shortcode at the desired place in the editor.', 'tablepress' ) . ' '
	297	+ . __( 'Each table has a unique ID that needs to be adjusted in that Shortcode.', 'tablepress' );
	298	+ }
	299	+ $body_html .= '</p>' . $_render->get_output( 'html' ) . '</div>';
275	300	} else {
276	301	$head_html = '';
277	302	$body_html = __( 'The preview could not be loaded.', 'tablepress' );
278	303	}
		@@ -293,32 +318,52 @@
293	318	wp_send_json( $response );
294	319	}
295	320
296	321	/**
297		- * Retrieve all information of a WP_Error object as a string.
	322	+ * Saves the screen options on the "Edit" screen when they are changed.
298	323	*
299		- * @since 1.4.0
300		- *
301		- * @param WP_Error $wp_error A WP_Error object.
302		- * @return string All error codes, messages, and data of the WP_Error.
	324	+ * @since 2.1.0
303	325	*/
304		- protected function get_wp_error_string( $wp_error ) {
305		- $error_strings = array();
306		- $error_codes = $wp_error->get_error_codes();
307		- // Reverse order to get latest errors first.
308		- $error_codes = array_reverse( $error_codes );
309		- foreach ( $error_codes as $error_code ) {
310		- $error_strings[ $error_code ] = $error_code;
311		- $error_messages = $wp_error->get_error_messages( $error_code );
312		- $error_messages = implode( ', ', $error_messages );
313		- if ( ! empty( $error_messages ) ) {
314		- $error_strings[ $error_code ] .= " ({$error_messages})";
315		- }
316		- $error_data = $wp_error->get_error_data( $error_code );
317		- if ( ! is_null( $error_data ) ) {
318		- $error_strings[ $error_code ] .= " [{$error_data}]";
319		- }
	326	+ public function ajax_action_save_screen_options(): void {
	327	+ // Check if the submitted nonce matches the generated nonce we created earlier, dies -1 on failure.
	328	+ TablePress::check_nonce( 'screen_options', false, '_ajax_nonce', true );
	329	+
	330	+ if ( empty( $_POST['tablepress'] ) ) {
	331	+ wp_die( '-1' );
320	332	}
321		- return implode( ";\n", $error_strings );
	333	+ $screen_options = wp_unslash( $_POST['tablepress'] );
	334	+
	335	+ // Sanitize and limit values to a minimum and a maximum.
	336	+ $new_screen_options = array();
	337	+
	338	+ if ( isset( $screen_options['table_editor_column_width'] ) ) {
	339	+ $new_screen_options['table_editor_column_width'] = absint( $screen_options['table_editor_column_width'] );
	340	+ $new_screen_options['table_editor_column_width'] = max( $new_screen_options['table_editor_column_width'], 30 ); // Minimum width: 30 pixels.
	341	+ $new_screen_options['table_editor_column_width'] = min( $new_screen_options['table_editor_column_width'], 9999 ); // Maximum width: 9999 pixels.
	342	+ }
	343	+
	344	+ if ( isset( $screen_options['table_editor_line_clamp'] ) ) {
	345	+ $new_screen_options['table_editor_line_clamp'] = absint( $screen_options['table_editor_line_clamp'] );
	346	+ $new_screen_options['table_editor_line_clamp'] = min( $new_screen_options['table_editor_line_clamp'], 999 ); // Maximum lines: 999. Minimum of 0 (for all lines) is ensured by absint().
	347	+ }
	348	+
	349	+ if ( empty( $new_screen_options ) ) {
	350	+ wp_die( '-1' );
	351	+ }
	352	+ TablePress::$model_options->update( $new_screen_options );
	353	+
	354	+ // Generate the response.
	355	+ $response = array(
	356	+ 'success' => true,
	357	+ );
	358	+
	359	+ // Buffer all outputs, to prevent errors/warnings being printed that make the JSON invalid.
	360	+ $output_buffer = ob_get_clean();
	361	+ if ( ! empty( $output_buffer ) ) {
	362	+ $response['output_buffer'] = $output_buffer;
	363	+ }
	364	+
	365	+ // Send the response.
	366	+ wp_send_json( $response );
322	367	}
323	368
324	369	} // class TablePress_Admin_AJAX_Controller