← All changes | includes/Utils/Options.php +48 -2 3.0.7 → 3.7.2 View file →

		@@ -21,8 +21,16 @@
21	21	*/
22	22	private $has_api;
23	23
24	24	/**
	25	+ * Pin every derived read/write to the acting user, bypassing the
	26	+ * global-login fallback in user_id().
	27	+ *
	28	+ * @var bool
	29	+ */
	30	+ private $force_current_user = false;
	31	+
	32	+ /**
25	33	* Automatically invoked and set up the properties.
26	34	*/
27	35	public function __construct(){
28	36	$this->current_user = get_current_user_id();
		@@ -71,12 +79,28 @@
71	79	return $_who_am_i;
72	80	}
73	81
74	82	/**
	83	+ * Pin the acting user as the target for every derived read/write.
	84	+ *
	85	+ * @param bool $force Whether to force the current user.
	86	+ * @return Options
	87	+ */
	88	+ public function use_current_user( bool $force = true ): Options {
	89	+ $this->force_current_user = $force;
	90	+
	91	+ return $this;
	92	+ }
	93	+
	94	+ /**
75	95	* Get user id determine dynamically
76	96	* @return integer
77	97	*/
78	98	private function user_id(): int {
	99	+ if ( $this->force_current_user ) {
	100	+ return $this->current_user;
	101	+ }
	102	+
79	103	$_who_am_i = $this->who_am_i();
80	104
81	105	if( ! empty( $_SERVER['REQUEST_URI'] ) ) {
82	106	$parse_uri = explode( '/', substr( $_SERVER['REQUEST_URI'], 0, strpos( $_SERVER['REQUEST_URI'], '?' ) ) );
		@@ -184,10 +208,16 @@
184	208	return get_user_option( $key, $user_id );
185	209	}
186	210
187	211	public function update_user_meta($user_id, $meta_key, $meta_value) {
188		- $user_id = is_null( $user_id ) ? $this->user_id() : $user_id;
	212	+ if ( is_null( $user_id ) ) {
	213	+ if ( ! $this->can_write() ) {
	214	+ return false;
	215	+ }
189	216
	217	+ $user_id = $this->user_id();
	218	+ }
	219	+
190	220	if( ! is_multisite() ) {
191	221	return update_user_meta( $user_id, $meta_key, $meta_value );
192	222	}
193	223
		@@ -194,8 +224,12 @@
194	224	return update_user_option( $user_id, $meta_key, $meta_value, $this->_is_global() );
195	225	}
196	226
197	227	public function delete_user_meta( $meta_key ): bool {
	228	+ if ( ! $this->can_write() ) {
	229	+ return false;
	230	+ }
	231	+
198	232	if( ! is_multisite() ) {
199	233	return delete_user_meta( $this->user_id(), $meta_key );
200	234	}
201	235
		@@ -201,8 +235,20 @@
201	235
202	236	return delete_user_option( $this->user_id(), $meta_key, $this->_is_global() );
203	237	}
204	238
	239	+ /**
	240	+ * Whether the current request may write to a derived user target.
	241	+ *
	242	+ * Reads retain the global-login fallback for unauthenticated cloud callbacks,
	243	+ * but an anonymous request must never write through it to the administrator.
	244	+ *
	245	+ * @return bool
	246	+ */
	247	+ private function can_write(): bool {
	248	+ return $this->current_user > 0;
	249	+ }
	250	+
205	251	private function _is_global() {
206	252	return apply_filters( 'templately_multisite_is_global', false );
207	253	}
208	254
		@@ -233,5 +279,5 @@
233	279	*/
234	280	public function update_option( $key, $value, $autoload = 'no' ): bool {
235	281	return update_option( $key, $value, $autoload );
236	282	}
237		-}
	283	+}